145 files changed, 1458 insertions, 741 deletions
diff --git a/Documentation/ABI/testing/sysfs-block b/Documentation/ABI/testing/sysfs-block
index cbbd3e069945..5f3bedaf8e35 100644
--- a/Documentation/ABI/testing/sysfs-block
+++ b/Documentation/ABI/testing/sysfs-block
@@ -94,28 +94,37 @@ What:		/sys/block/<disk>/queue/physical_block_size
 Date:           May 2009
 Contact:        Martin K. Petersen <martin.petersen@oracle.com>
 Description:
-                This is the smallest unit the storage device can write
+                This is the smallest unit a physical storage device can
-                without resorting to read-modify-write operation.  It is
+                write atomically.  It is usually the same as the logical
-                usually the same as the logical block size but may be
+                block size but may be bigger.  One example is SATA
-                bigger.  One example is SATA drives with 4KB sectors
+                drives with 4KB sectors that expose a 512-byte logical
-                that expose a 512-byte logical block size to the
+                block size to the operating system.  For stacked block
-                operating system.
+                devices the physical_block_size variable contains the
+                maximum physical_block_size of the component devices.
 What:           /sys/block/<disk>/queue/minimum_io_size
 Date:           April 2009
 Contact:        Martin K. Petersen <martin.petersen@oracle.com>
 Description:
-                Storage devices may report a preferred minimum I/O size,
+                Storage devices may report a granularity or preferred
-                which is the smallest request the device can perform
+                minimum I/O size which is the smallest request the
-                without incurring a read-modify-write penalty.  For disk
+                device can perform without incurring a performance
-                drives this is often the physical block size.  For RAID
+                penalty.  For disk drives this is often the physical
-                arrays it is often the stripe chunk size.
+                block size.  For RAID arrays it is often the stripe
+                chunk size.  A properly aligned multiple of
+                minimum_io_size is the preferred request size for
+                workloads where a high number of I/O operations is
+                desired.
 What:           /sys/block/<disk>/queue/optimal_io_size
 Date:           April 2009
 Contact:        Martin K. Petersen <martin.petersen@oracle.com>
 Description:
                Storage devices may report an optimal I/O size, which is
-                the device's preferred unit of receiving I/O.  This is
+                the device's preferred unit for sustained I/O.  This is
-                rarely reported for disk drives.  For RAID devices it is
+                rarely reported for disk drives.  For RAID arrays it is
-                usually the stripe width or the internal block size.
+                usually the stripe width or the internal track size.  A
+                properly aligned multiple of optimal_io_size is the
+                preferred request size for workloads where sustained
+                throughput is desired.  If no optimal I/O size is
+                reported this file contains 0.
diff --git a/Documentation/DocBook/kernel-hacking.tmpl b/Documentation/DocBook/kernel-hacking.tmpl
index a50d6cd58573..992e67e6be7f 100644
--- a/Documentation/DocBook/kernel-hacking.tmpl
+++ b/Documentation/DocBook/kernel-hacking.tmpl
@@ -449,8 +449,8 @@ printk(KERN_INFO "i = %u\n", i);
   </para>
   <programlisting>
-__u32 ipaddress;
+__be32 ipaddress;
-printk(KERN_INFO "my ip: %d.%d.%d.%d\n", NIPQUAD(ipaddress));
+printk(KERN_INFO "my ip: %pI4\n", &amp;ipaddress);
   </programlisting>
   <para>
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index ae3e70cd1e14..e552e547cb93 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -553,7 +553,7 @@
         * on most of those machines only handles cache transactions.
         */
        extrd,u,*=      \pte,_PAGE_NO_CACHE_BIT+32,1,%r0
-        depi            1,12,1,\prot
+        depdi           1,12,1,\prot
        /* Drop prot bits and convert to page addr for iitlbt and idtlbt */
        convert_for_tlb_insert20 \pte
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index ef5caf2e6ed0..61ee0eec4e69 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -86,8 +86,12 @@
 * the bottom of the table, which has a maximum signed displacement of
 * 0x3fff; however, since we're only going forward, this becomes
 * 0x1fff, and thus, since each GOT entry is 8 bytes long we can have
- * at most 1023 entries */
+ * at most 1023 entries.
-#define MAX_GOTS        1023
+ * To overcome this 14bit displacement with some kernel modules, we'll
+ * use instead the unusal 16bit displacement method (see reassemble_16a)
+ * which gives us a maximum positive displacement of 0x7fff, and as such
+ * allows us to allocate up to 4095 GOT entries. */
+#define MAX_GOTS        4095
 /* three functions to determine where in the module core
 * or init pieces the location is */
@@ -145,12 +149,40 @@ struct stub_entry {
 /* The reassemble_* functions prepare an immediate value for
   insertion into an opcode. pa-risc uses all sorts of weird bitfields
   in the instruction to hold the value.  */
+static inline int sign_unext(int x, int len)
+{
+        int len_ones;
+        len_ones = (1 << len) - 1;
+        return x & len_ones;
+}
+static inline int low_sign_unext(int x, int len)
+{
+        int sign, temp;
+        sign = (x >> (len-1)) & 1;
+        temp = sign_unext(x, len-1);
+        return (temp << 1) | sign;
+}
 static inline int reassemble_14(int as14)
 {
        return (((as14 & 0x1fff) << 1) |
                ((as14 & 0x2000) >> 13));
 }
+static inline int reassemble_16a(int as16)
+{
+        int s, t;
+        /* Unusual 16-bit encoding, for wide mode only.  */
+        t = (as16 << 1) & 0xffff;
+        s = (as16 & 0x8000);
+        return (t ^ s ^ (s >> 1)) | (s >> 15);
+}
 static inline int reassemble_17(int as17)
 {
        return (((as17 & 0x10000) >> 16) |
@@ -407,6 +439,7 @@ static Elf_Addr get_stub(struct module *me, unsigned long value, long addend,
        enum elf_stub_type stub_type, Elf_Addr loc0, unsigned int targetsec)
 {
        struct stub_entry *stub;
+        int __maybe_unused d;
        /* initialize stub_offset to point in front of the section */
        if (!me->arch.section[targetsec].stub_offset) {
@@ -460,12 +493,19 @@ static Elf_Addr get_stub(struct module *me, unsigned long value, long addend,
 */
        switch (stub_type) {
        case ELF_STUB_GOT:
-                stub->insns[0] = 0x537b0000;    /* ldd 0(%dp),%dp       */
+                d = get_got(me, value, addend);
+                if (d <= 15) {
+                        /* Format 5 */
+                        stub->insns[0] = 0x0f6010db; /* ldd 0(%dp),%dp  */
+                        stub->insns[0] |= low_sign_unext(d, 5) << 16;
+                } else {
+                        /* Format 3 */
+                        stub->insns[0] = 0x537b0000; /* ldd 0(%dp),%dp  */
+                        stub->insns[0] |= reassemble_16a(d);
+                }
                stub->insns[1] = 0x53610020;    /* ldd 10(%dp),%r1      */
                stub->insns[2] = 0xe820d000;    /* bve (%r1)            */
                stub->insns[3] = 0x537b0030;    /* ldd 18(%dp),%dp      */
-                stub->insns[0] |= reassemble_14(get_got(me, value, addend) & 0x3fff);
                break;
        case ELF_STUB_MILLI:
                stub->insns[0] = 0x20200000;    /* ldil 0,%r1           */
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index edc90f23e708..8406ed7f9926 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -33,7 +33,7 @@ extern unsigned long asmlinkage efi_call_phys(void *, ...);
 #define efi_call_virt6(f, a1, a2, a3, a4, a5, a6)       \
        efi_call_virt(f, a1, a2, a3, a4, a5, a6)
-#define efi_ioremap(addr, size)                 ioremap_cache(addr, size)
+#define efi_ioremap(addr, size, type)           ioremap_cache(addr, size)
 #else /* !CONFIG_X86_32 */
@@ -84,7 +84,8 @@ extern u64 efi_call6(void *fp, u64 arg1, u64 arg2, u64 arg3,
        efi_call6((void *)(efi.systab->runtime->f), (u64)(a1), (u64)(a2), \
                  (u64)(a3), (u64)(a4), (u64)(a5), (u64)(a6))
-extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size);
+extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
+                                 u32 type);
 #endif /* CONFIG_X86_32 */
diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
index 2bdab21f0898..c6ccbe7e81ad 100644
--- a/arch/x86/include/asm/irqflags.h
+++ b/arch/x86/include/asm/irqflags.h
@@ -12,9 +12,15 @@ static inline unsigned long native_save_fl(void)
 {
        unsigned long flags;
+        /*
+         * Note: this needs to be "=r" not "=rm", because we have the
+         * stack offset from what gcc expects at the time the "pop" is
+         * executed, and so a memory reference with respect to the stack
+         * would end up using the wrong address.
+         */
        asm volatile("# __raw_save_flags\n\t"
                     "pushf ; pop %0"
-                     : "=g" (flags)
+                     : "=r" (flags)
                     : /* no input */
                     : "memory");
diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
index 341070f7ad5c..77a68505419a 100644
--- a/arch/x86/include/asm/uv/uv_hub.h
+++ b/arch/x86/include/asm/uv/uv_hub.h
@@ -175,7 +175,7 @@ DECLARE_PER_CPU(struct uv_hub_info_s, __uv_hub_info);
 #define UV_GLOBAL_MMR32_PNODE_BITS(p)   ((p) << (UV_GLOBAL_MMR32_PNODE_SHIFT))
 #define UV_GLOBAL_MMR64_PNODE_BITS(p)                                   \
-        ((unsigned long)(UV_PNODE_TO_GNODE(p)) << UV_GLOBAL_MMR64_PNODE_SHIFT)
+        (((unsigned long)(p)) << UV_GLOBAL_MMR64_PNODE_SHIFT)
 #define UV_APIC_PNODE_SHIFT     6
@@ -327,6 +327,7 @@ struct uv_blade_info {
        unsigned short  nr_possible_cpus;
        unsigned short  nr_online_cpus;
        unsigned short  pnode;
+        short           memory_nid;
 };
 extern struct uv_blade_info *uv_blade_info;
 extern short *uv_node_to_blade;
@@ -363,6 +364,12 @@ static inline int uv_blade_to_pnode(int bid)
        return uv_blade_info[bid].pnode;
 }
+/* Nid of memory node on blade. -1 if no blade-local memory */
+static inline int uv_blade_to_memory_nid(int bid)
+{
+        return uv_blade_info[bid].memory_nid;
+}
 /* Determine the number of possible cpus on a blade */
 static inline int uv_blade_nr_possible_cpus(int bid)
 {
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 2284a4812b68..d2ed6c5ddc80 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -3793,6 +3793,9 @@ int arch_enable_uv_irq(char *irq_name, unsigned int irq, int cpu, int mmr_blade,
        mmr_pnode = uv_blade_to_pnode(mmr_blade);
        uv_write_global_mmr64(mmr_pnode, mmr_offset, mmr_value);
+        if (cfg->move_in_progress)
+                send_cleanup_vector(cfg);
        return irq;
 }
diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
index 8e4cbb255c38..2ed4e2bb3b32 100644
--- a/arch/x86/kernel/apic/x2apic_cluster.c
+++ b/arch/x86/kernel/apic/x2apic_cluster.c
@@ -170,7 +170,7 @@ static unsigned long set_apic_id(unsigned int id)
 static int x2apic_cluster_phys_pkg_id(int initial_apicid, int index_msb)
 {
-        return current_cpu_data.initial_apicid >> index_msb;
+        return initial_apicid >> index_msb;
 }
 static void x2apic_send_IPI_self(int vector)
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index a284359627e7..0b631c6a2e00 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -162,7 +162,7 @@ static unsigned long set_apic_id(unsigned int id)
 static int x2apic_phys_pkg_id(int initial_apicid, int index_msb)
 {
-        return current_cpu_data.initial_apicid >> index_msb;
+        return initial_apicid >> index_msb;
 }
 static void x2apic_send_IPI_self(int vector)
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 096d19aea2f7..832e908adcb5 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -261,7 +261,7 @@ struct apic apic_x2apic_uv_x = {
        .apic_id_registered             = uv_apic_id_registered,
        .irq_delivery_mode              = dest_Fixed,
-        .irq_dest_mode                  = 1, /* logical */
+        .irq_dest_mode                  = 0, /* physical */
        .target_cpus                    = uv_target_cpus,
        .disable_esr                    = 0,
@@ -362,12 +362,6 @@ static __init void get_lowmem_redirect(unsigned long *base, unsigned long *size)
        BUG();
 }
-static __init void map_low_mmrs(void)
-{
-        init_extra_mapping_uc(UV_GLOBAL_MMR32_BASE, UV_GLOBAL_MMR32_SIZE);
-        init_extra_mapping_uc(UV_LOCAL_MMR_BASE, UV_LOCAL_MMR_SIZE);
-}
 enum map_type {map_wb, map_uc};
 static __init void map_high(char *id, unsigned long base, int shift,
@@ -395,26 +389,6 @@ static __init void map_gru_high(int max_pnode)
                map_high("GRU", gru.s.base, shift, max_pnode, map_wb);
 }
-static __init void map_config_high(int max_pnode)
-{
-        union uvh_rh_gam_cfg_overlay_config_mmr_u cfg;
-        int shift = UVH_RH_GAM_CFG_OVERLAY_CONFIG_MMR_BASE_SHFT;
-        cfg.v = uv_read_local_mmr(UVH_RH_GAM_CFG_OVERLAY_CONFIG_MMR);
-        if (cfg.s.enable)
-                map_high("CONFIG", cfg.s.base, shift, max_pnode, map_uc);
-}
-static __init void map_mmr_high(int max_pnode)
-{
-        union uvh_rh_gam_mmr_overlay_config_mmr_u mmr;
-        int shift = UVH_RH_GAM_MMR_OVERLAY_CONFIG_MMR_BASE_SHFT;
-        mmr.v = uv_read_local_mmr(UVH_RH_GAM_MMR_OVERLAY_CONFIG_MMR);
-        if (mmr.s.enable)
-                map_high("MMR", mmr.s.base, shift, max_pnode, map_uc);
-}
 static __init void map_mmioh_high(int max_pnode)
 {
        union uvh_rh_gam_mmioh_overlay_config_mmr_u mmioh;
@@ -566,8 +540,6 @@ void __init uv_system_init(void)
        unsigned long mmr_base, present, paddr;
        unsigned short pnode_mask;
-        map_low_mmrs();
        m_n_config.v = uv_read_local_mmr(UVH_SI_ADDR_MAP_CONFIG);
        m_val = m_n_config.s.m_skt;
        n_val = m_n_config.s.n_skt;
@@ -591,6 +563,8 @@ void __init uv_system_init(void)
        bytes = sizeof(struct uv_blade_info) * uv_num_possible_blades();
        uv_blade_info = kmalloc(bytes, GFP_KERNEL);
        BUG_ON(!uv_blade_info);
+        for (blade = 0; blade < uv_num_possible_blades(); blade++)
+                uv_blade_info[blade].memory_nid = -1;
        get_lowmem_redirect(&lowmem_redir_base, &lowmem_redir_size);
@@ -629,6 +603,9 @@ void __init uv_system_init(void)
                lcpu = uv_blade_info[blade].nr_possible_cpus;
                uv_blade_info[blade].nr_possible_cpus++;
+                /* Any node on the blade, else will contain -1. */
+                uv_blade_info[blade].memory_nid = nid;
                uv_cpu_hub_info(cpu)->lowmem_remap_base = lowmem_redir_base;
                uv_cpu_hub_info(cpu)->lowmem_remap_top = lowmem_redir_size;
                uv_cpu_hub_info(cpu)->m_val = m_val;
@@ -662,11 +639,10 @@ void __init uv_system_init(void)
                pnode = (paddr >> m_val) & pnode_mask;
                blade = boot_pnode_to_blade(pnode);
                uv_node_to_blade[nid] = blade;
+                max_pnode = max(pnode, max_pnode);
        }
        map_gru_high(max_pnode);
-        map_mmr_high(max_pnode);
-        map_config_high(max_pnode);
        map_mmioh_high(max_pnode);
        uv_cpu_init();
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index 79302e9a33a4..442b5508893f 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -811,7 +811,7 @@ static int apm_do_idle(void)
        u8 ret = 0;
        int idled = 0;
        int polling;
-        int err;
+        int err = 0;
        polling = !!(current_thread_info()->status & TS_POLLING);
        if (polling) {
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index 96f7ac0bbf01..19ccf6d0dccf 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -512,7 +512,7 @@ void __init efi_enter_virtual_mode(void)
                        && end_pfn <= max_pfn_mapped))
                        va = __va(md->phys_addr);
                else
-                        va = efi_ioremap(md->phys_addr, size);
+                        va = efi_ioremap(md->phys_addr, size, md->type);
                md->virt_addr = (u64) (unsigned long) va;
diff --git a/arch/x86/kernel/efi_64.c b/arch/x86/kernel/efi_64.c
index 22c3b7828c50..ac0621a7ac3d 100644
--- a/arch/x86/kernel/efi_64.c
+++ b/arch/x86/kernel/efi_64.c
@@ -98,10 +98,14 @@ void __init efi_call_phys_epilog(void)
        early_runtime_code_mapping_set_exec(0);
 }
-void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size)
+void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
+                                 u32 type)
 {
        unsigned long last_map_pfn;
+        if (type == EFI_MEMORY_MAPPED_IO)
+                return ioremap(phys_addr, size);
        last_map_pfn = init_memory_mapping(phys_addr, phys_addr + size);
        if ((last_map_pfn << PAGE_SHIFT) < phys_addr + size)
                return NULL;
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 8663afb56535..0d98a01cbdb2 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -602,7 +602,11 @@ ignore_int:
 #endif
        iret
-.section .cpuinit.data,"wa"
+#ifndef CONFIG_HOTPLUG_CPU
+        __CPUINITDATA
+#else
+        __REFDATA
+#endif
 .align 4
 ENTRY(initial_code)
        .long i386_start_kernel
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 508e982dd072..834c9da8bf9d 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -3,6 +3,7 @@
 #include <linux/init.h>
 #include <linux/pm.h>
 #include <linux/efi.h>
+#include <linux/dmi.h>
 #include <acpi/reboot.h>
 #include <asm/io.h>
 #include <asm/apic.h>
@@ -17,7 +18,6 @@
 #include <asm/cpu.h>
 #ifdef CONFIG_X86_32
-# include <linux/dmi.h>
 # include <linux/ctype.h>
 # include <linux/mc146818rtc.h>
 #else
@@ -404,6 +404,38 @@ EXPORT_SYMBOL(machine_real_restart);
 #endif /* CONFIG_X86_32 */
+/*
+ * Apple MacBook5,2 (2009 MacBook) needs reboot=p
+ */
+static int __init set_pci_reboot(const struct dmi_system_id *d)
+{
+        if (reboot_type != BOOT_CF9) {
+                reboot_type = BOOT_CF9;
+                printk(KERN_INFO "%s series board detected. "
+                       "Selecting PCI-method for reboots.\n", d->ident);
+        }
+        return 0;
+}
+static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
+        {       /* Handle problems with rebooting on Apple MacBook5,2 */
+                .callback = set_pci_reboot,
+                .ident = "Apple MacBook",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBook5,2"),
+                },
+        },
+        { }
+};
+static int __init pci_reboot_init(void)
+{
+        dmi_check_system(pci_reboot_dmi_table);
+        return 0;
+}
+core_initcall(pci_reboot_init);
 static inline void kb_wait(void)
 {
        int i;
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 59f31d2dd435..78d185d797de 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -393,8 +393,8 @@ SECTIONS
 #ifdef CONFIG_X86_32
-ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE),
+. = ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE),
-        "kernel image bigger than KERNEL_IMAGE_SIZE")
+           "kernel image bigger than KERNEL_IMAGE_SIZE");
 #else
 /*
 * Per-cpu symbols which need to be offset from __per_cpu_load
@@ -407,12 +407,12 @@ INIT_PER_CPU(irq_stack_union);
 /*
 * Build-time check on the image size:
 */
-ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
+. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
-        "kernel image bigger than KERNEL_IMAGE_SIZE")
+           "kernel image bigger than KERNEL_IMAGE_SIZE");
 #ifdef CONFIG_SMP
-ASSERT((per_cpu__irq_stack_union == 0),
+. = ASSERT((per_cpu__irq_stack_union == 0),
-        "irq_stack_union is not at start of per-cpu area");
+           "irq_stack_union is not at start of per-cpu area");
 #endif
 #endif /* CONFIG_X86_32 */
@@ -420,7 +420,7 @@ ASSERT((per_cpu__irq_stack_union == 0),
 #ifdef CONFIG_KEXEC
 #include <asm/kexec.h>
-ASSERT(kexec_control_code_size <= KEXEC_CONTROL_CODE_MAX_SIZE,
+. = ASSERT(kexec_control_code_size <= KEXEC_CONTROL_CODE_MAX_SIZE,
-       "kexec control code size is too big")
+           "kexec control code size is too big");
 #endif
diff --git a/arch/x86/lib/msr.c b/arch/x86/lib/msr.c
index 1440b9c0547e..caa24aca8115 100644
--- a/arch/x86/lib/msr.c
+++ b/arch/x86/lib/msr.c
@@ -89,16 +89,13 @@ void rdmsr_on_cpus(const cpumask_t *mask, u32 msr_no, struct msr *msrs)
        rv.msrs   = msrs;
        rv.msr_no = msr_no;
-        preempt_disable();
+        this_cpu = get_cpu();
-        /*
-         * FIXME: handle the CPU we're executing on separately for now until
+        if (cpumask_test_cpu(this_cpu, mask))
-         * smp_call_function_many has been fixed to not skip it.
+                __rdmsr_on_cpu(&rv);
-         */
-        this_cpu = raw_smp_processor_id();
-        smp_call_function_single(this_cpu, __rdmsr_on_cpu, &rv, 1);
        smp_call_function_many(mask, __rdmsr_on_cpu, &rv, 1);
-        preempt_enable();
+        put_cpu();
 }
 EXPORT_SYMBOL(rdmsr_on_cpus);
@@ -121,16 +118,13 @@ void wrmsr_on_cpus(const cpumask_t *mask, u32 msr_no, struct msr *msrs)
        rv.msrs   = msrs;
        rv.msr_no = msr_no;
-        preempt_disable();
+        this_cpu = get_cpu();
-        /*
-         * FIXME: handle the CPU we're executing on separately for now until
+        if (cpumask_test_cpu(this_cpu, mask))
-         * smp_call_function_many has been fixed to not skip it.
+                __wrmsr_on_cpu(&rv);
-         */
-        this_cpu = raw_smp_processor_id();
-        smp_call_function_single(this_cpu, __wrmsr_on_cpu, &rv, 1);
        smp_call_function_many(mask, __wrmsr_on_cpu, &rv, 1);
-        preempt_enable();
+        put_cpu();
 }
 EXPORT_SYMBOL(wrmsr_on_cpus);
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 1b734d7a8966..7e600c1962db 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -591,9 +591,12 @@ static int __change_page_attr(struct cpa_data *cpa, int primary)
        unsigned int level;
        pte_t *kpte, old_pte;
-        if (cpa->flags & CPA_PAGES_ARRAY)
+        if (cpa->flags & CPA_PAGES_ARRAY) {
-                address = (unsigned long)page_address(cpa->pages[cpa->curpage]);
+                struct page *page = cpa->pages[cpa->curpage];
-        else if (cpa->flags & CPA_ARRAY)
+                if (unlikely(PageHighMem(page)))
+                        return 0;
+                address = (unsigned long)page_address(page);
+        } else if (cpa->flags & CPA_ARRAY)
                address = cpa->vaddr[cpa->curpage];
        else
                address = *cpa->vaddr;
@@ -697,9 +700,12 @@ static int cpa_process_alias(struct cpa_data *cpa)
         * No need to redo, when the primary call touched the direct
         * mapping already:
         */
-        if (cpa->flags & CPA_PAGES_ARRAY)
+        if (cpa->flags & CPA_PAGES_ARRAY) {
-                vaddr = (unsigned long)page_address(cpa->pages[cpa->curpage]);
+                struct page *page = cpa->pages[cpa->curpage];
-        else if (cpa->flags & CPA_ARRAY)
+                if (unlikely(PageHighMem(page)))
+                        return 0;
+                vaddr = (unsigned long)page_address(page);
+        } else if (cpa->flags & CPA_ARRAY)
                vaddr = cpa->vaddr[cpa->curpage];
        else
                vaddr = *cpa->vaddr;
@@ -997,12 +1003,15 @@ EXPORT_SYMBOL(set_memory_array_uc);
 int _set_memory_wc(unsigned long addr, int numpages)
 {
        int ret;
+        unsigned long addr_copy = addr;
        ret = change_page_attr_set(&addr, numpages,
                                    __pgprot(_PAGE_CACHE_UC_MINUS), 0);
        if (!ret) {
-                ret = change_page_attr_set(&addr, numpages,
+                ret = change_page_attr_set_clr(&addr_copy, numpages,
-                                    __pgprot(_PAGE_CACHE_WC), 0);
+                                               __pgprot(_PAGE_CACHE_WC),
+                                               __pgprot(_PAGE_CACHE_MASK),
+                                               0, 0, NULL);
        }
        return ret;
 }
@@ -1119,7 +1128,9 @@ int set_pages_array_uc(struct page **pages, int addrinarray)
        int free_idx;
        for (i = 0; i < addrinarray; i++) {
-                start = (unsigned long)page_address(pages[i]);
+                if (PageHighMem(pages[i]))
+                        continue;
+                start = page_to_pfn(pages[i]) << PAGE_SHIFT;
                end = start + PAGE_SIZE;
                if (reserve_memtype(start, end, _PAGE_CACHE_UC_MINUS, NULL))
                        goto err_out;
@@ -1132,7 +1143,9 @@ int set_pages_array_uc(struct page **pages, int addrinarray)
 err_out:
        free_idx = i;
        for (i = 0; i < free_idx; i++) {
-                start = (unsigned long)page_address(pages[i]);
+                if (PageHighMem(pages[i]))
+                        continue;
+                start = page_to_pfn(pages[i]) << PAGE_SHIFT;
                end = start + PAGE_SIZE;
                free_memtype(start, end);
        }
@@ -1161,7 +1174,9 @@ int set_pages_array_wb(struct page **pages, int addrinarray)
                return retval;
        for (i = 0; i < addrinarray; i++) {
-                start = (unsigned long)page_address(pages[i]);
+                if (PageHighMem(pages[i]))
+                        continue;
+                start = page_to_pfn(pages[i]) << PAGE_SHIFT;
                end = start + PAGE_SIZE;
                free_memtype(start, end);
        }
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index af8f9650058c..ed34f5e35999 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -329,7 +329,6 @@ void __init reserve_top_address(unsigned long reserve)
        printk(KERN_INFO "Reserving virtual address space above 0x%08x\n",
               (int)-reserve);
        __FIXADDR_TOP = -reserve - PAGE_SIZE;
-        __VMALLOC_RESERVE += reserve;
 #endif
 }
diff --git a/block/Kconfig b/block/Kconfig
index 95a86adc33a1..9be0b56eaee1 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -48,9 +48,9 @@ config LBDAF
          If unsure, say Y.
 config BLK_DEV_BSG
-        bool "Block layer SG support v4 (EXPERIMENTAL)"
+        bool "Block layer SG support v4"
-        depends on EXPERIMENTAL
+        default y
-        ---help---
+        help
          Saying Y here will enable generic SG (SCSI generic) v4 support
          for any block device.
@@ -60,7 +60,10 @@ config BLK_DEV_BSG
          protocols (e.g. Task Management Functions and SMP in Serial
          Attached SCSI).
-          If unsure, say N.
+          This option is required by recent UDEV versions to properly
+          access device serial numbers, etc.
+          If unsure, say Y.
 config BLK_DEV_INTEGRITY
        bool "Block layer data integrity support"
diff --git a/block/blk-settings.c b/block/blk-settings.c
index 8a3ea3bba10d..476d87065073 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -7,6 +7,7 @@
 #include <linux/bio.h>
 #include <linux/blkdev.h>
 #include <linux/bootmem.h>      /* for max_pfn/max_low_pfn */
+#include <linux/gcd.h>
 #include "blk.h"
@@ -384,8 +385,8 @@ void blk_queue_alignment_offset(struct request_queue *q, unsigned int offset)
 EXPORT_SYMBOL(blk_queue_alignment_offset);
 /**
- * blk_queue_io_min - set minimum request size for the queue
+ * blk_limits_io_min - set minimum request size for a device
- * @q:  the request queue for the device
+ * @limits: the queue limits
 * @min:  smallest I/O size in bytes
 *
 * Description:
@@ -394,15 +395,35 @@ EXPORT_SYMBOL(blk_queue_alignment_offset);
 *   smallest I/O the device can perform without incurring a performance
 *   penalty.
 */
-void blk_queue_io_min(struct request_queue *q, unsigned int min)
+void blk_limits_io_min(struct queue_limits *limits, unsigned int min)
 {
-        q->limits.io_min = min;
+        limits->io_min = min;
-        if (q->limits.io_min < q->limits.logical_block_size)
+        if (limits->io_min < limits->logical_block_size)
-                q->limits.io_min = q->limits.logical_block_size;
+                limits->io_min = limits->logical_block_size;
-        if (q->limits.io_min < q->limits.physical_block_size)
+        if (limits->io_min < limits->physical_block_size)
-                q->limits.io_min = q->limits.physical_block_size;
+                limits->io_min = limits->physical_block_size;
+}
+EXPORT_SYMBOL(blk_limits_io_min);
+/**
+ * blk_queue_io_min - set minimum request size for the queue
+ * @q:  the request queue for the device
+ * @min:  smallest I/O size in bytes
+ *
+ * Description:
+ *   Storage devices may report a granularity or preferred minimum I/O
+ *   size which is the smallest request the device can perform without
+ *   incurring a performance penalty.  For disk drives this is often the
+ *   physical block size.  For RAID arrays it is often the stripe chunk
+ *   size.  A properly aligned multiple of minimum_io_size is the
+ *   preferred request size for workloads where a high number of I/O
+ *   operations is desired.
+ */
+void blk_queue_io_min(struct request_queue *q, unsigned int min)
+{
+        blk_limits_io_min(&q->limits, min);
 }
 EXPORT_SYMBOL(blk_queue_io_min);
@@ -412,8 +433,12 @@ EXPORT_SYMBOL(blk_queue_io_min);
 * @opt:  optimal request size in bytes
 *
 * Description:
- *   Drivers can call this function to set the preferred I/O request
+ *   Storage devices may report an optimal I/O size, which is the
- *   size for devices that report such a value.
+ *   device's preferred unit for sustained I/O.  This is rarely reported
+ *   for disk drives.  For RAID arrays it is usually the stripe width or
+ *   the internal track size.  A properly aligned multiple of
+ *   optimal_io_size is the preferred request size for workloads where
+ *   sustained throughput is desired.
 */
 void blk_queue_io_opt(struct request_queue *q, unsigned int opt)
 {
@@ -433,27 +458,7 @@ EXPORT_SYMBOL(blk_queue_io_opt);
 **/
 void blk_queue_stack_limits(struct request_queue *t, struct request_queue *b)
 {
-        /* zero is "infinity" */
+        blk_stack_limits(&t->limits, &b->limits, 0);
-        t->limits.max_sectors = min_not_zero(queue_max_sectors(t),
-                                             queue_max_sectors(b));
-        t->limits.max_hw_sectors = min_not_zero(queue_max_hw_sectors(t),
-                                                queue_max_hw_sectors(b));
-        t->limits.seg_boundary_mask = min_not_zero(queue_segment_boundary(t),
-                                                   queue_segment_boundary(b));
-        t->limits.max_phys_segments = min_not_zero(queue_max_phys_segments(t),
-                                                   queue_max_phys_segments(b));
-        t->limits.max_hw_segments = min_not_zero(queue_max_hw_segments(t),
-                                                 queue_max_hw_segments(b));
-        t->limits.max_segment_size = min_not_zero(queue_max_segment_size(t),
-                                                  queue_max_segment_size(b));
-        t->limits.logical_block_size = max(queue_logical_block_size(t),
-                                           queue_logical_block_size(b));
        if (!t->queue_lock)
                WARN_ON_ONCE(1);
@@ -523,6 +528,16 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
                return -1;
        }
+        /* Find lcm() of optimal I/O size */
+        if (t->io_opt && b->io_opt)
+                t->io_opt = (t->io_opt * b->io_opt) / gcd(t->io_opt, b->io_opt);
+        else if (b->io_opt)
+                t->io_opt = b->io_opt;
+        /* Verify that optimal I/O size is a multiple of io_min */
+        if (t->io_min && t->io_opt % t->io_min)
+                return -1;
        return 0;
 }
 EXPORT_SYMBOL(blk_stack_limits);
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index f4bb43fb8016..e077701ae3d9 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -225,7 +225,7 @@ static const struct agp_bridge_driver parisc_agp_driver = {
        .configure              = parisc_agp_configure,
        .fetch_size             = parisc_agp_fetch_size,
        .tlb_flush              = parisc_agp_tlbflush,
-        .mask_memory            = parisc_agp_mask_memory,
+        .mask_memory            = parisc_agp_page_mask_memory,
        .masks                  = parisc_agp_masks,
        .agp_enable             = parisc_agp_enable,
        .cache_flush            = global_cache_flush,
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b90eda8b3440..fd69086d08d5 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -858,6 +858,8 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
                /* Check for existing affected CPUs.
                 * They may not be aware of it due to CPU Hotplug.
+                 * cpufreq_cpu_put is called when the device is removed
+                 * in __cpufreq_remove_dev()
                 */
                managed_policy = cpufreq_cpu_get(j);
                if (unlikely(managed_policy)) {
@@ -884,7 +886,7 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
                        ret = sysfs_create_link(&sys_dev->kobj,
                                                &managed_policy->kobj,
                                                "cpufreq");
-                        if (!ret)
+                        if (ret)
                                cpufreq_cpu_put(managed_policy);
                        /*
                         * Success. We only needed to be added to the mask.
@@ -924,6 +926,8 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
        spin_lock_irqsave(&cpufreq_driver_lock, flags);
        for_each_cpu(j, policy->cpus) {
+                if (!cpu_online(j))
+                        continue;
                per_cpu(cpufreq_cpu_data, j) = policy;
                per_cpu(policy_cpu, j) = policy->cpu;
        }
@@ -1244,13 +1248,22 @@ EXPORT_SYMBOL(cpufreq_get);
 static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 {
-        int cpu = sysdev->id;
        int ret = 0;
+#ifdef __powerpc__
+        int cpu = sysdev->id;
        unsigned int cur_freq = 0;
        struct cpufreq_policy *cpu_policy;
        dprintk("suspending cpu %u\n", cpu);
+        /*
+         * This whole bogosity is here because Powerbooks are made of fail.
+         * No sane platform should need any of the code below to be run.
+         * (it's entirely the wrong thing to do, as driver->get may
+         *  reenable interrupts on some architectures).
+         */
        if (!cpu_online(cpu))
                return 0;
@@ -1309,6 +1322,7 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 out:
        cpufreq_cpu_put(cpu_policy);
+#endif  /* __powerpc__ */
        return ret;
 }
@@ -1322,12 +1336,18 @@ out:
 */
 static int cpufreq_resume(struct sys_device *sysdev)
 {
-        int cpu = sysdev->id;
        int ret = 0;
+#ifdef __powerpc__
+        int cpu = sysdev->id;
        struct cpufreq_policy *cpu_policy;
        dprintk("resuming cpu %u\n", cpu);
+        /* As with the ->suspend method, all the code below is
+         * only necessary because Powerbooks suck.
+         * See commit 42d4dc3f4e1e for jokes. */
        if (!cpu_online(cpu))
                return 0;
@@ -1391,6 +1411,7 @@ out:
        schedule_work(&cpu_policy->update);
 fail:
        cpufreq_cpu_put(cpu_policy);
+#endif  /* __powerpc__ */
        return ret;
 }
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 57490502b21c..bdea7e2f94ba 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -63,6 +63,7 @@ struct cpu_dbs_info_s {
        unsigned int down_skip;
        unsigned int requested_freq;
        int cpu;
+        unsigned int enable:1;
        /*
         * percpu mutex that serializes governor limit change with
         * do_dbs_timer invocation. We do not want do_dbs_timer to run
@@ -141,6 +142,9 @@ dbs_cpufreq_notifier(struct notifier_block *nb, unsigned long val,
        struct cpufreq_policy *policy;
+        if (!this_dbs_info->enable)
+                return 0;
        policy = this_dbs_info->cur_policy;
        /*
@@ -497,6 +501,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
        int delay = usecs_to_jiffies(dbs_tuners_ins.sampling_rate);
        delay -= jiffies % delay;
+        dbs_info->enable = 1;
        INIT_DELAYED_WORK_DEFERRABLE(&dbs_info->work, do_dbs_timer);
        queue_delayed_work_on(dbs_info->cpu, kconservative_wq, &dbs_info->work,
                                delay);
@@ -504,6 +509,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
+        dbs_info->enable = 0;
        cancel_delayed_work_sync(&dbs_info->work);
 }
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 24964c1d0af9..e2a10bcba7a1 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -868,6 +868,8 @@ static void amd64_read_dbam_reg(struct amd64_pvt *pvt)
                        goto err_reg;
        }
+        return;
 err_reg:
        debugf0("Error reading F2x%03x.\n", reg);
 }
@@ -2634,6 +2636,8 @@ static void amd64_read_mc_registers(struct amd64_pvt *pvt)
        amd64_dump_misc_regs(pvt);
+        return;
 err_reg:
        debugf0("Reading an MC register failed\n");
@@ -2977,6 +2981,9 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
                        "ECC is enabled by BIOS, Proceeding "
                        "with EDAC module initialization\n");
+                /* Signal good ECC status */
+                ret = 0;
                /* CLEAR the override, since BIOS controlled it */
                ecc_enable_override = 0;
        }
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 8fab7890a363..33be210d6723 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1461,7 +1461,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
                goto out;
        }
-        if (crtc_req->count_connectors > 0 && !mode && !fb) {
+        if (crtc_req->count_connectors > 0 && (!mode || !fb)) {
                DRM_DEBUG("Count connectors is %d but no mode or fb set\n",
                          crtc_req->count_connectors);
                ret = -EINVAL;
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 3da9cfa31848..6aaa2cb23365 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -706,8 +706,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
        struct drm_encoder **save_encoders, *new_encoder;
        struct drm_framebuffer *old_fb = NULL;
        bool save_enabled;
-        bool mode_changed = false;
+        bool mode_changed = false; /* if true do a full mode set */
-        bool fb_changed = false;
+        bool fb_changed = false; /* if true and !mode_changed just do a flip */
        struct drm_connector *connector;
        int count = 0, ro, fail = 0;
        struct drm_crtc_helper_funcs *crtc_funcs;
@@ -758,6 +758,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                if (set->crtc->fb == NULL) {
                        DRM_DEBUG("crtc has no fb, full mode set\n");
                        mode_changed = true;
+                } else if (set->fb == NULL) {
+                        mode_changed = true;
                } else if ((set->fb->bits_per_pixel !=
                         set->crtc->fb->bits_per_pixel) ||
                         set->fb->depth != set->crtc->fb->depth)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 05a44896dffb..f1ba8ff41130 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -722,13 +722,14 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p,
                         unsigned idx)
 {
        struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
-        uint32_t header = ib_chunk->kdata[idx];
+        uint32_t header;
        if (idx >= ib_chunk->length_dw) {
                DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
                          idx, ib_chunk->length_dw);
                return -EINVAL;
        }
+        header = ib_chunk->kdata[idx];
        pkt->idx = idx;
        pkt->type = CP_PACKET_GET_TYPE(header);
        pkt->count = CP_PACKET_GET_COUNT(header);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 3cfcee17dc56..0bd5879a4957 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -318,6 +318,14 @@ static int __init radeon_init(void)
        driver = &driver_old;
        driver->num_ioctls = radeon_max_ioctl;
 #if defined(CONFIG_DRM_RADEON_KMS)
+#ifdef CONFIG_VGA_CONSOLE
+        if (vgacon_text_force() && radeon_modeset == -1) {
+                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
+                driver = &driver_old;
+                driver->driver_features &= ~DRIVER_MODESET;
+                radeon_modeset = 0;
+        }
+#endif
        /* if enabled by default */
        if (radeon_modeset == -1) {
                DRM_INFO("radeon default to kernel modesetting.\n");
@@ -329,17 +337,8 @@ static int __init radeon_init(void)
                driver->driver_features |= DRIVER_MODESET;
                driver->num_ioctls = radeon_max_kms_ioctl;
        }
        /* if the vga console setting is enabled still
         * let modprobe override it */
-#ifdef CONFIG_VGA_CONSOLE
-        if (vgacon_text_force() && radeon_modeset == -1) {
-                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
-                driver = &driver_old;
-                driver->driver_features &= ~DRIVER_MODESET;
-                radeon_modeset = 0;
-        }
-#endif
 #endif
        return drm_init(driver);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 937a2f1cdb46..3357110e30ce 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -58,6 +58,8 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
        if (r) {
                DRM_ERROR("Failed to initialize radeon, disabling IOCTL\n");
                radeon_device_fini(rdev);
+                kfree(rdev);
+                dev->dev_private = NULL;
                return r;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 551e608702e4..fd8f3ca716ea 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -370,6 +370,7 @@ void rv515_vram_info(struct radeon_device *rdev)
        rv515_vram_get_type(rdev);
+        r100_vram_init_sizes(rdev);
        /* FIXME: we should enforce default clock in case GPU is not in
         * default setup
         */
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 6538d4236989..c2b0d710d10f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1182,13 +1182,14 @@ static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
 int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type)
 {
-        struct ttm_mem_type_manager *man = &bdev->man[mem_type];
+        struct ttm_mem_type_manager *man;
        int ret = -EINVAL;
        if (mem_type >= TTM_NUM_MEM_TYPES) {
                printk(KERN_ERR TTM_PFX "Illegal memory type %d\n", mem_type);
                return ret;
        }
+        man = &bdev->man[mem_type];
        if (!man->has_type) {
                printk(KERN_ERR TTM_PFX "Trying to take down uninitialized "
@@ -1575,6 +1576,10 @@ int ttm_bo_wait(struct ttm_buffer_object *bo,
                        driver->sync_obj_unref(&sync_obj);
                        driver->sync_obj_unref(&tmp_obj);
                        spin_lock(&bo->lock);
+                } else {
+                        spin_unlock(&bo->lock);
+                        driver->sync_obj_unref(&sync_obj);
+                        spin_lock(&bo->lock);
                }
        }
        return 0;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ce2e6f38ea01..ad4ada07c6cf 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -150,7 +150,7 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
 #ifdef CONFIG_X86
        dst = kmap_atomic_prot(d, KM_USER0, prot);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                dst = vmap(&d, 1, 0, prot);
        else
                dst = kmap(d);
@@ -163,7 +163,7 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
 #ifdef CONFIG_X86
        kunmap_atomic(dst, KM_USER0);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                vunmap(dst);
        else
                kunmap(d);
@@ -186,7 +186,7 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
 #ifdef CONFIG_X86
        src = kmap_atomic_prot(s, KM_USER0, prot);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                src = vmap(&s, 1, 0, prot);
        else
                src = kmap(s);
@@ -199,7 +199,7 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
 #ifdef CONFIG_X86
        kunmap_atomic(src, KM_USER0);
 #else
-        if (prot != PAGE_KERNEL)
+        if (pgprot_val(prot) != pgprot_val(PAGE_KERNEL))
                vunmap(src);
        else
                kunmap(s);
diff --git a/drivers/input/serio/hp_sdc_mlc.c b/drivers/input/serio/hp_sdc_mlc.c
index b587e2d576ac..820e51673b26 100644
--- a/drivers/input/serio/hp_sdc_mlc.c
+++ b/drivers/input/serio/hp_sdc_mlc.c
@@ -296,7 +296,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc)
        priv->tseq[3] = 0;
        if (mlc->opacket & HIL_CTRL_APE) {
                priv->tseq[3] |= HP_SDC_LPC_APE_IPF;
-                down_trylock(&mlc->csem);
+                BUG_ON(down_trylock(&mlc->csem));
        }
 enqueue:
        hp_sdc_enqueue_transaction(&priv->trans);
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index c3b661a666cb..7e5f30dbc0a0 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -1480,7 +1480,7 @@ l1oip_init(void)
                return -ENOMEM;
        l1oip_cnt = 0;
-        while (type[l1oip_cnt] && l1oip_cnt < MAX_CARDS) {
+        while (l1oip_cnt < MAX_CARDS && type[l1oip_cnt]) {
                switch (type[l1oip_cnt] & 0xff) {
                case 1:
                        pri = 0;
diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
index bae61b22501c..7d430835655f 100644
--- a/drivers/mfd/twl4030-irq.c
+++ b/drivers/mfd/twl4030-irq.c
@@ -180,14 +180,9 @@ static struct completion irq_event;
 static int twl4030_irq_thread(void *data)
 {
        long irq = (long)data;
-        struct irq_desc *desc = irq_to_desc(irq);
        static unsigned i2c_errors;
        static const unsigned max_i2c_errors = 100;
-        if (!desc) {
-                pr_err("twl4030: Invalid IRQ: %ld\n", irq);
-                return -EINVAL;
-        }
        current->flags |= PF_NOFREEZE;
@@ -240,7 +235,7 @@ static int twl4030_irq_thread(void *data)
                }
                local_irq_enable();
-                desc->chip->unmask(irq);
+                enable_irq(irq);
        }
        return 0;
@@ -255,25 +250,13 @@ static int twl4030_irq_thread(void *data)
 * thread.  All we do here is acknowledge and mask the interrupt and wakeup
 * the kernel thread.
 */
-static void handle_twl4030_pih(unsigned int irq, struct irq_desc *desc)
+static irqreturn_t handle_twl4030_pih(int irq, void *devid)
 {
        /* Acknowledge, clear *AND* mask the interrupt... */
-        desc->chip->ack(irq);
+        disable_irq_nosync(irq);
-        complete(&irq_event);
+        complete(devid);
-}
+        return IRQ_HANDLED;
-static struct task_struct *start_twl4030_irq_thread(long irq)
-{
-        struct task_struct *thread;
-        init_completion(&irq_event);
-        thread = kthread_run(twl4030_irq_thread, (void *)irq, "twl4030-irq");
-        if (!thread)
-                pr_err("twl4030: could not create irq %ld thread!\n", irq);
-        return thread;
 }
 /*----------------------------------------------------------------------*/
 /*
@@ -734,18 +717,28 @@ int twl_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
        }
        /* install an irq handler to demultiplex the TWL4030 interrupt */
-        task = start_twl4030_irq_thread(irq_num);
-        if (!task) {
-                pr_err("twl4030: irq thread FAIL\n");
-                status = -ESRCH;
-                goto fail;
-        }
-        set_irq_data(irq_num, task);
-        set_irq_chained_handler(irq_num, handle_twl4030_pih);
-        return status;
+        init_completion(&irq_event);
+        status = request_irq(irq_num, handle_twl4030_pih, IRQF_DISABLED,
+                                "TWL4030-PIH", &irq_event);
+        if (status < 0) {
+                pr_err("twl4030: could not claim irq%d: %d\n", irq_num, status);
+                goto fail_rqirq;
+        }
+        task = kthread_run(twl4030_irq_thread, (void *)irq_num, "twl4030-irq");
+        if (IS_ERR(task)) {
+                pr_err("twl4030: could not create irq %d thread!\n", irq_num);
+                status = PTR_ERR(task);
+                goto fail_kthread;
+        }
+        return status;
+fail_kthread:
+        free_irq(irq_num, &irq_event);
+fail_rqirq:
+        /* clean up twl4030_sih_setup */
 fail:
        for (i = irq_base; i < irq_end; i++)
                set_irq_chip_and_handler(i, NULL, NULL);
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index 3e00fa8ea65f..4a7c32895be5 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -832,7 +832,9 @@ static int corkscrew_open(struct net_device *dev)
                        skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                        vp->rx_ring[i].addr = isa_virt_to_bus(skb->data);
                }
-                vp->rx_ring[i - 1].next = isa_virt_to_bus(&vp->rx_ring[0]);     /* Wrap the ring. */
+                if (i != 0)
+                        vp->rx_ring[i - 1].next =
+                                isa_virt_to_bus(&vp->rx_ring[0]);       /* Wrap the ring. */
                outl(isa_virt_to_bus(&vp->rx_ring[0]), ioaddr + UpListPtr);
        }
        if (vp->full_bus_master_tx) {   /* Boomerang bus master Tx. */
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c34aee91250b..c20416850948 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -2721,13 +2721,15 @@ dump_tx_ring(struct net_device *dev)
                                   &vp->tx_ring[vp->dirty_tx % TX_RING_SIZE]);
                        issue_and_wait(dev, DownStall);
                        for (i = 0; i < TX_RING_SIZE; i++) {
-                                pr_err("  %d: @%p  length %8.8x status %8.8x\n", i,
+                                unsigned int length;
-                                           &vp->tx_ring[i],
 #if DO_ZEROCOPY
-                                           le32_to_cpu(vp->tx_ring[i].frag[0].length),
+                                length = le32_to_cpu(vp->tx_ring[i].frag[0].length);
 #else
-                                           le32_to_cpu(vp->tx_ring[i].length),
+                                length = le32_to_cpu(vp->tx_ring[i].length);
 #endif
+                                pr_err("  %d: @%p  length %8.8x status %8.8x\n",
+                                           i, &vp->tx_ring[i], length,
                                           le32_to_cpu(vp->tx_ring[i].status));
                        }
                        if (!stalled)
diff --git a/drivers/net/eexpress.c b/drivers/net/eexpress.c
index 1686dca28748..1f016d66684a 100644
--- a/drivers/net/eexpress.c
+++ b/drivers/net/eexpress.c
@@ -1474,13 +1474,13 @@ static void eexp_hw_init586(struct net_device *dev)
        outw(0x0000, ioaddr + 0x800c);
        outw(0x0000, ioaddr + 0x800e);
-        for (i = 0; i < (sizeof(start_code)); i+=32) {
+        for (i = 0; i < ARRAY_SIZE(start_code) * 2; i+=32) {
                int j;
                outw(i, ioaddr + SM_PTR);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j)/2 < ARRAY_SIZE(start_code); j+=2)
                        outw(start_code[(i+j)/2],
                             ioaddr+0x4000+j);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j+16)/2 < ARRAY_SIZE(start_code); j+=2)
                        outw(start_code[(i+j+16)/2],
                             ioaddr+0x8000+j);
        }
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 78952f8324e2..fa311a950996 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0101"
+#define DRV_VERSION     "EHEA_0102"
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index e8d46cc1bec2..977c3d358279 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1545,6 +1545,9 @@ static int ehea_clean_portres(struct ehea_port *port, struct ehea_port_res *pr)
 {
        int ret, i;
+        if (pr->qp)
+                netif_napi_del(&pr->napi);
        ret = ehea_destroy_qp(pr->qp);
        if (!ret) {
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index dbf06e9313cc..2234118eedbb 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -366,9 +366,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                return -EINVAL;
        }
-        priv->rxic = mk_ic_value(
+        priv->rxic = mk_ic_value(cvals->rx_max_coalesced_frames,
-                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs),
+                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs));
-                cvals->rx_max_coalesced_frames);
        /* Set up tx coalescing */
        if ((cvals->tx_coalesce_usecs == 0) ||
@@ -390,9 +389,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                return -EINVAL;
        }
-        priv->txic = mk_ic_value(
+        priv->txic = mk_ic_value(cvals->tx_max_coalesced_frames,
-                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs),
+                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs));
-                cvals->tx_max_coalesced_frames);
        gfar_write(&priv->regs->rxic, 0);
        if (priv->rxcoalescing)
diff --git a/drivers/net/igbvf/vf.c b/drivers/net/igbvf/vf.c
index 2a4faf9ade69..a9a61efa964c 100644
--- a/drivers/net/igbvf/vf.c
+++ b/drivers/net/igbvf/vf.c
@@ -274,6 +274,8 @@ static s32 e1000_set_vfta_vf(struct e1000_hw *hw, u16 vid, bool set)
        err = mbx->ops.read_posted(hw, msgbuf, 2);
+        msgbuf[0] &= ~E1000_VT_MSGTYPE_CTS;
        /* if nacked the vlan was rejected */
        if (!err && (msgbuf[0] == (E1000_VF_SET_VLAN | E1000_VT_MSGTYPE_NACK)))
                err = -E1000_ERR_MAC_INIT;
@@ -317,6 +319,8 @@ static void e1000_rar_set_vf(struct e1000_hw *hw, u8 * addr, u32 index)
        if (!ret_val)
                ret_val = mbx->ops.read_posted(hw, msgbuf, 3);
+        msgbuf[0] &= ~E1000_VT_MSGTYPE_CTS;
        /* if nacked the address was rejected, use "perm_addr" */
        if (!ret_val &&
            (msgbuf[0] == (E1000_VF_SET_MAC_ADDR | E1000_VT_MSGTYPE_NACK)))
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 1b12c7ba275f..e11d83d5852b 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -96,6 +96,8 @@
 #define IXGBE_TX_FLAGS_VLAN_PRIO_MASK   0x0000e000
 #define IXGBE_TX_FLAGS_VLAN_SHIFT       16
+#define IXGBE_MAX_RSC_INT_RATE          162760
 /* wrapper around a pointer to a socket buffer,
 * so a DMA handle can be stored along with the buffer */
 struct ixgbe_tx_buffer {
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index b9923047ce11..522c03bc1dad 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -50,6 +50,51 @@ static s32 ixgbe_read_i2c_eeprom_82598(struct ixgbe_hw *hw, u8 byte_offset,
                                       u8 *eeprom_data);
 /**
+ *  ixgbe_set_pcie_completion_timeout - set pci-e completion timeout
+ *  @hw: pointer to the HW structure
+ *
+ *  The defaults for 82598 should be in the range of 50us to 50ms,
+ *  however the hardware default for these parts is 500us to 1ms which is less
+ *  than the 10ms recommended by the pci-e spec.  To address this we need to
+ *  increase the value to either 10ms to 250ms for capability version 1 config,
+ *  or 16ms to 55ms for version 2.
+ **/
+void ixgbe_set_pcie_completion_timeout(struct ixgbe_hw *hw)
+{
+        struct ixgbe_adapter *adapter = hw->back;
+        u32 gcr = IXGBE_READ_REG(hw, IXGBE_GCR);
+        u16 pcie_devctl2;
+        /* only take action if timeout value is defaulted to 0 */
+        if (gcr & IXGBE_GCR_CMPL_TMOUT_MASK)
+                goto out;
+        /*
+         * if capababilities version is type 1 we can write the
+         * timeout of 10ms to 250ms through the GCR register
+         */
+        if (!(gcr & IXGBE_GCR_CAP_VER2)) {
+                gcr |= IXGBE_GCR_CMPL_TMOUT_10ms;
+                goto out;
+        }
+        /*
+         * for version 2 capabilities we need to write the config space
+         * directly in order to set the completion timeout value for
+         * 16ms to 55ms
+         */
+        pci_read_config_word(adapter->pdev,
+                             IXGBE_PCI_DEVICE_CONTROL2, &pcie_devctl2);
+        pcie_devctl2 |= IXGBE_PCI_DEVICE_CONTROL2_16ms;
+        pci_write_config_word(adapter->pdev,
+                              IXGBE_PCI_DEVICE_CONTROL2, pcie_devctl2);
+out:
+        /* disable completion timeout resend */
+        gcr &= ~IXGBE_GCR_CMPL_TMOUT_RESEND;
+        IXGBE_WRITE_REG(hw, IXGBE_GCR, gcr);
+}
+/**
 *  ixgbe_get_pcie_msix_count_82598 - Gets MSI-X vector count
 *  @hw: pointer to hardware structure
 *
@@ -153,6 +198,26 @@ out:
 }
 /**
+ *  ixgbe_start_hw_82598 - Prepare hardware for Tx/Rx
+ *  @hw: pointer to hardware structure
+ *
+ *  Starts the hardware using the generic start_hw function.
+ *  Then set pcie completion timeout
+ **/
+s32 ixgbe_start_hw_82598(struct ixgbe_hw *hw)
+{
+        s32 ret_val = 0;
+        ret_val = ixgbe_start_hw_generic(hw);
+        /* set the completion timeout for interface */
+        if (ret_val == 0)
+                ixgbe_set_pcie_completion_timeout(hw);
+        return ret_val;
+}
+/**
 *  ixgbe_get_link_capabilities_82598 - Determines link capabilities
 *  @hw: pointer to hardware structure
 *  @speed: pointer to link speed
@@ -1085,7 +1150,7 @@ out:
 static struct ixgbe_mac_operations mac_ops_82598 = {
        .init_hw                = &ixgbe_init_hw_generic,
        .reset_hw               = &ixgbe_reset_hw_82598,
-        .start_hw               = &ixgbe_start_hw_generic,
+        .start_hw               = &ixgbe_start_hw_82598,
        .clear_hw_cntrs         = &ixgbe_clear_hw_cntrs_generic,
        .get_media_type         = &ixgbe_get_media_type_82598,
        .get_supported_physical_layer = &ixgbe_get_supported_physical_layer_82598,
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 2a978008fd6e..79144e950a34 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1975,7 +1975,10 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 * any other value means disable eitr, which is best
                 * served by setting the interrupt rate very high
                 */
-                adapter->eitr_param = IXGBE_MAX_INT_RATE;
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
+                        adapter->eitr_param = IXGBE_MAX_RSC_INT_RATE;
+                else
+                        adapter->eitr_param = IXGBE_MAX_INT_RATE;
                adapter->itr_setting = 0;
        }
@@ -1999,13 +2002,13 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
        ethtool_op_set_flags(netdev, data);
-        if (!(adapter->flags & IXGBE_FLAG2_RSC_CAPABLE))
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE))
                return 0;
        /* if state changes we need to update adapter->flags and reset */
        if ((!!(data & ETH_FLAG_LRO)) != 
-            (!!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED))) {
+            (!!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) {
-                adapter->flags ^= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->flags2 ^= IXGBE_FLAG2_RSC_ENABLED;
                if (netif_running(netdev))
                        ixgbe_reinit_locked(adapter);
                else
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 200454f30f6a..110c65ab5cb5 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -780,7 +780,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                prefetch(next_rxd);
                cleaned_count++;
-                if (adapter->flags & IXGBE_FLAG2_RSC_CAPABLE)
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)
                        rsc_count = ixgbe_get_rsc_count(rx_desc);
                if (rsc_count) {
@@ -2036,7 +2036,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                        IXGBE_WRITE_REG(hw, IXGBE_PSRTYPE(0), psrtype);
                }
        } else {
-                if (!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED) &&
+                if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) &&
                    (netdev->mtu <= ETH_DATA_LEN))
                        rx_buf_len = MAXIMUM_ETHERNET_VLAN_SIZE;
                else
@@ -2165,7 +2165,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, rdrxctl);
        }
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED) {
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                /* Enable 82599 HW-RSC */
                for (i = 0; i < adapter->num_rx_queues; i++) {
                        j = adapter->rx_ring[i].reg_idx;
@@ -3812,8 +3812,8 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82598;
        } else if (hw->mac.type == ixgbe_mac_82599EB) {
                adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82599;
-                adapter->flags |= IXGBE_FLAG2_RSC_CAPABLE;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_CAPABLE;
-                adapter->flags |= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
                adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
                adapter->ring_feature[RING_F_FDIR].indices =
                                                         IXGBE_MAX_FDIR_INDICES;
@@ -5360,12 +5360,19 @@ static int ixgbe_del_sanmac_netdev(struct net_device *dev)
 static void ixgbe_netpoll(struct net_device *netdev)
 {
        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        int i;
-        disable_irq(adapter->pdev->irq);
        adapter->flags |= IXGBE_FLAG_IN_NETPOLL;
-        ixgbe_intr(adapter->pdev->irq, netdev);
+        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
+                int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
+                for (i = 0; i < num_q_vectors; i++) {
+                        struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+                        ixgbe_msix_clean_many(0, q_vector);
+                }
+        } else {
+                ixgbe_intr(adapter->pdev->irq, netdev);
+        }
        adapter->flags &= ~IXGBE_FLAG_IN_NETPOLL;
-        enable_irq(adapter->pdev->irq);
 }
 #endif
@@ -5611,7 +5618,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
        if (pci_using_dac)
                netdev->features |= NETIF_F_HIGHDMA;
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED)
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
                netdev->features |= NETIF_F_LRO;
        /* make sure the EEPROM is good */
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index fa87309dc087..be90eb4575f6 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -718,6 +718,12 @@
 #define IXGBE_ECC_STATUS_82599  0x110E0
 #define IXGBE_BAR_CTRL_82599    0x110F4
+/* PCI Express Control */
+#define IXGBE_GCR_CMPL_TMOUT_MASK       0x0000F000
+#define IXGBE_GCR_CMPL_TMOUT_10ms       0x00001000
+#define IXGBE_GCR_CMPL_TMOUT_RESEND     0x00010000
+#define IXGBE_GCR_CAP_VER2              0x00040000
 /* Time Sync Registers */
 #define IXGBE_TSYNCRXCTL 0x05188 /* Rx Time Sync Control register - RW */
 #define IXGBE_TSYNCTXCTL 0x08C00 /* Tx Time Sync Control register - RW */
@@ -1521,6 +1527,7 @@
 /* PCI Bus Info */
 #define IXGBE_PCI_LINK_STATUS     0xB2
+#define IXGBE_PCI_DEVICE_CONTROL2 0xC8
 #define IXGBE_PCI_LINK_WIDTH      0x3F0
 #define IXGBE_PCI_LINK_WIDTH_1    0x10
 #define IXGBE_PCI_LINK_WIDTH_2    0x20
@@ -1531,6 +1538,7 @@
 #define IXGBE_PCI_LINK_SPEED_5000 0x2
 #define IXGBE_PCI_HEADER_TYPE_REGISTER  0x0E
 #define IXGBE_PCI_HEADER_TYPE_MULTIFUNC 0x80
+#define IXGBE_PCI_DEVICE_CONTROL2_16ms  0x0005
 /* Number of 100 microseconds we wait for PCI Express master disable */
 #define IXGBE_PCI_MASTER_DISABLE_TIMEOUT 800
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 08c43f2ae72b..5a88b3f57693 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -249,6 +249,7 @@ static u32 mlx4_en_free_tx_desc(struct mlx4_en_priv *priv,
                                pci_unmap_page(mdev->pdev,
                                        (dma_addr_t) be64_to_cpu(data->addr),
                                         frag->size, PCI_DMA_TODEVICE);
+                                ++data;
                        }
                }
                /* Stamp the freed descriptor */
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 637ac8b89bac..3cd8cfcf627b 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -221,7 +221,7 @@ netxen_napi_disable(struct netxen_adapter *adapter)
        }
 }
-static int nx_set_dma_mask(struct netxen_adapter *adapter, uint8_t revision_id)
+static int nx_set_dma_mask(struct netxen_adapter *adapter)
 {
        struct pci_dev *pdev = adapter->pdev;
        uint64_t mask, cmask;
@@ -229,19 +229,17 @@ static int nx_set_dma_mask(struct netxen_adapter *adapter, uint8_t revision_id)
        adapter->pci_using_dac = 0;
        mask = DMA_BIT_MASK(32);
-        /*
-         * Consistent DMA mask is set to 32 bit because it cannot be set to
-         * 35 bits. For P3 also leave it at 32 bits for now. Only the rings
-         * come off this pool.
-         */
        cmask = DMA_BIT_MASK(32);
+        if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
 #ifndef CONFIG_IA64
-        if (revision_id >= NX_P3_B0)
-                mask = DMA_BIT_MASK(39);
-        else if (revision_id == NX_P2_C1)
                mask = DMA_BIT_MASK(35);
 #endif
+        } else {
+                mask = DMA_BIT_MASK(39);
+                cmask = mask;
+        }
        if (pci_set_dma_mask(pdev, mask) == 0 &&
                pci_set_consistent_dma_mask(pdev, cmask) == 0) {
                adapter->pci_using_dac = 1;
@@ -256,7 +254,7 @@ static int
 nx_update_dma_mask(struct netxen_adapter *adapter)
 {
        int change, shift, err;
-        uint64_t mask, old_mask;
+        uint64_t mask, old_mask, old_cmask;
        struct pci_dev *pdev = adapter->pdev;
        change = 0;
@@ -272,14 +270,29 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
        if (change) {
                old_mask = pdev->dma_mask;
+                old_cmask = pdev->dev.coherent_dma_mask;
                mask = (1ULL<<(32+shift)) - 1;
                err = pci_set_dma_mask(pdev, mask);
                if (err)
-                        return pci_set_dma_mask(pdev, old_mask);
+                        goto err_out;
+                if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+                        err = pci_set_consistent_dma_mask(pdev, mask);
+                        if (err)
+                                goto err_out;
+                }
+                dev_info(&pdev->dev, "using %d-bit dma mask\n", 32+shift);
        }
        return 0;
+err_out:
+        pci_set_dma_mask(pdev, old_mask);
+        pci_set_consistent_dma_mask(pdev, old_cmask);
+        return err;
 }
 static void netxen_check_options(struct netxen_adapter *adapter)
@@ -1006,7 +1019,7 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        revision_id = pdev->revision;
        adapter->ahw.revision_id = revision_id;
-        err = nx_set_dma_mask(adapter, revision_id);
+        err = nx_set_dma_mask(adapter);
        if (err)
                goto err_out_free_netdev;
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 28368157dac4..a646a445fda9 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1611,8 +1611,11 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                if (pcnet32_dwio_read_csr(ioaddr, 0) == 4
                    && pcnet32_dwio_check(ioaddr)) {
                        a = &pcnet32_dwio;
-                } else
+                } else {
+                        if (pcnet32_debug & NETIF_MSG_PROBE)
+                                printk(KERN_ERR PFX "No access methods\n");
                        goto err_release_region;
+                }
        }
        chip_version =
@@ -1719,7 +1722,9 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                ret = -ENOMEM;
                goto err_release_region;
        }
-        SET_NETDEV_DEV(dev, &pdev->dev);
+        if (pdev)
+                SET_NETDEV_DEV(dev, &pdev->dev);
        if (pcnet32_debug & NETIF_MSG_PROBE)
                printk(KERN_INFO PFX "%s at %#3lx,", chipname, ioaddr);
@@ -1818,7 +1823,6 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        spin_lock_init(&lp->lock);
-        SET_NETDEV_DEV(dev, &pdev->dev);
        lp->name = chipname;
        lp->shared_irq = shared;
        lp->tx_ring_size = TX_RING_SIZE;        /* default tx ring size */
@@ -1852,12 +1856,6 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
            ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
                lp->options |= PCNET32_PORT_FD;
-        if (!a) {
-                if (pcnet32_debug & NETIF_MSG_PROBE)
-                        printk(KERN_ERR PFX "No access methods\n");
-                ret = -ENODEV;
-                goto err_free_consistent;
-        }
        lp->a = *a;
        /* prior to register_netdev, dev->name is not yet correct */
@@ -1973,14 +1971,13 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        return 0;
-      err_free_ring:
+err_free_ring:
        pcnet32_free_ring(dev);
-      err_free_consistent:
        pci_free_consistent(lp->pci_dev, sizeof(*lp->init_block),
                            lp->init_block, lp->init_dma_addr);
-      err_free_netdev:
+err_free_netdev:
        free_netdev(dev);
-      err_release_region:
+err_release_region:
        release_region(ioaddr, PCNET32_TOTAL_SIZE);
        return ret;
 }
@@ -2089,6 +2086,7 @@ static void pcnet32_free_ring(struct net_device *dev)
 static int pcnet32_open(struct net_device *dev)
 {
        struct pcnet32_private *lp = netdev_priv(dev);
+        struct pci_dev *pdev = lp->pci_dev;
        unsigned long ioaddr = dev->base_addr;
        u16 val;
        int i;
@@ -2149,9 +2147,9 @@ static int pcnet32_open(struct net_device *dev)
        lp->a.write_csr(ioaddr, 124, val);
        /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
-        if (lp->pci_dev->subsystem_vendor == PCI_VENDOR_ID_AT &&
+        if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
-            (lp->pci_dev->subsystem_device == PCI_SUBDEVICE_ID_AT_2700FX ||
+            (pdev->subsystem_device == PCI_SUBDEVICE_ID_AT_2700FX ||
-             lp->pci_dev->subsystem_device == PCI_SUBDEVICE_ID_AT_2701FX)) {
+             pdev->subsystem_device == PCI_SUBDEVICE_ID_AT_2701FX)) {
                if (lp->options & PCNET32_PORT_ASEL) {
                        lp->options = PCNET32_PORT_FD | PCNET32_PORT_100;
                        if (netif_msg_link(lp))
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 639d11bc444e..cd37d739ac74 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1384,7 +1384,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
        /* create a     fragment for each channel */
        bits = B;
-        while (nfree > 0 &&     len     > 0) {
+        while (len      > 0) {
                list = list->next;
                if (list ==     &ppp->channels) {
                        i =     0;
@@ -1431,29 +1431,31 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                *otherwise divide it according to the speed
                *of the channel we are going to transmit on
                */
-                if (pch->speed == 0) {
+                if (nfree > 0) {
-                        flen = totlen/nfree     ;
+                        if (pch->speed == 0) {
-                        if (nbigger > 0) {
+                                flen = totlen/nfree     ;
-                                flen++;
+                                if (nbigger > 0) {
-                                nbigger--;
+                                        flen++;
-                        }
+                                        nbigger--;
-                } else {
+                                }
-                        flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /
+                        } else {
-                                ((totspeed*totfree)/pch->speed)) - hdrlen;
+                                flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /
-                        if (nbigger > 0) {
+                                        ((totspeed*totfree)/pch->speed)) - hdrlen;
-                                flen += ((totfree - nzero)*pch->speed)/totspeed;
+                                if (nbigger > 0) {
-                                nbigger -= ((totfree - nzero)*pch->speed)/
+                                        flen += ((totfree - nzero)*pch->speed)/totspeed;
+                                        nbigger -= ((totfree - nzero)*pch->speed)/
                                                        totspeed;
+                                }
                        }
+                        nfree--;
                }
-                nfree--;
                /*
                 *check if we are on the last channel or
                 *we exceded the lenght of the data     to
                 *fragment
                 */
-                if ((nfree == 0) || (flen > len))
+                if ((nfree <= 0) || (flen > len))
                        flen = len;
                /*
                 *it is not worth to tx on slow channels:
@@ -1467,7 +1469,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                        continue;
                }
-                mtu     = pch->chan->mtu + 2 - hdrlen;
+                mtu     = pch->chan->mtu - hdrlen;
                if (mtu < 4)
                        mtu     = 4;
                if (flen > mtu)
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index f0031f1f97e5..5f2090233d7b 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -1063,6 +1063,7 @@ static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
        else {
                int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
+                po = NULL;
                while (++hash < PPPOE_HASH_SIZE) {
                        po = pn->hash_table[hash];
                        if (po)
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index e7935d09c896..e0f9219a0aea 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -2680,6 +2680,7 @@ out_unregister_pppol2tp_proto:
 static void __exit pppol2tp_exit(void)
 {
        unregister_pppox_proto(PX_PROTO_OL2TP);
+        unregister_pernet_gen_device(pppol2tp_net_id, &pppol2tp_net_ops);
        proto_unregister(&pppol2tp_sk_proto);
 }
diff --git a/drivers/net/s6gmac.c b/drivers/net/s6gmac.c
index 5345e47b35ac..4525cbe8dd69 100644
--- a/drivers/net/s6gmac.c
+++ b/drivers/net/s6gmac.c
@@ -793,7 +793,7 @@ static inline int s6gmac_phy_start(struct net_device *dev)
        struct s6gmac *pd = netdev_priv(dev);
        int i = 0;
        struct phy_device *p = NULL;
-        while ((!(p = pd->mii.bus->phy_map[i])) && (i < PHY_MAX_ADDR))
+        while ((i < PHY_MAX_ADDR) && (!(p = pd->mii.bus->phy_map[i])))
                i++;
        p = phy_connect(dev, dev_name(&p->dev), &s6gmac_adjust_link, 0,
                        PHY_INTERFACE_MODE_RGMII);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3550c5dcd93c..0a551d8f5d95 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1488,6 +1488,8 @@ static int sky2_up(struct net_device *dev)
        sky2_set_vlan_mode(hw, port, sky2->vlgrp != NULL);
 #endif
+        sky2->restarting = 0;
        err = sky2_rx_start(sky2);
        if (err)
                goto err_out;
@@ -1500,6 +1502,9 @@ static int sky2_up(struct net_device *dev)
        sky2_set_multicast(dev);
+        /* wake queue incase we are restarting */
+        netif_wake_queue(dev);
        if (netif_msg_ifup(sky2))
                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
        return 0;
@@ -1533,6 +1538,8 @@ static inline int tx_dist(unsigned tail, unsigned head)
 /* Number of list elements available for next tx */
 static inline int tx_avail(const struct sky2_port *sky2)
 {
+        if (unlikely(sky2->restarting))
+                return 0;
        return sky2->tx_pending - tx_dist(sky2->tx_cons, sky2->tx_prod);
 }
@@ -1818,6 +1825,10 @@ static int sky2_down(struct net_device *dev)
        if (netif_msg_ifdown(sky2))
                printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
+        /* explicitly shut off tx incase we're restarting */
+        sky2->restarting = 1;
+        netif_tx_disable(dev);
        /* Force flow control off */
        sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
@@ -2359,7 +2370,7 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
 {
        struct sky2_port *sky2 = netdev_priv(dev);
-        if (netif_running(dev)) {
+        if (likely(netif_running(dev) && !sky2->restarting)) {
                netif_tx_lock(dev);
                sky2_tx_complete(sky2, last);
                netif_tx_unlock(dev);
@@ -4283,6 +4294,7 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
        spin_lock_init(&sky2->phy_lock);
        sky2->tx_pending = TX_DEF_PENDING;
        sky2->rx_pending = RX_DEF_PENDING;
+        sky2->restarting = 0;
        hw->dev[port] = dev;
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index b5549c9e5107..4486b066b43f 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -2051,6 +2051,7 @@ struct sky2_port {
        u8                   duplex;    /* DUPLEX_HALF, DUPLEX_FULL */
        u8                   rx_csum;
        u8                   wol;
+        u8                   restarting;
        enum flow_control    flow_mode;
        enum flow_control    flow_status;
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index eb72d2e9ab3d..acfdccd44567 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -5059,7 +5059,7 @@ mii_get_phy(struct net_device *dev)
        if ((id == 0) || (id == 65535)) continue;  /* Valid ID? */
        for (j=0; j<limit; j++) {                  /* Search PHY table */
            if (id != phy_info[j].id) continue;    /* ID match? */
-            for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+            for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
            if (k < DE4X5_MAX_PHY) {
                memcpy((char *)&lp->phy[k],
                       (char *)&phy_info[j], sizeof(struct phy_table));
@@ -5072,7 +5072,7 @@ mii_get_phy(struct net_device *dev)
            break;
        }
        if ((j == limit) && (i < DE4X5_MAX_MII)) {
-            for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+            for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
            lp->phy[k].addr = i;
            lp->phy[k].id = id;
            lp->phy[k].spd.reg = GENERIC_REG;      /* ANLPA register         */
@@ -5091,7 +5091,7 @@ mii_get_phy(struct net_device *dev)
  purgatory:
    lp->active = 0;
    if (lp->phy[0].id) {                           /* Reset the PHY devices */
-        for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++) { /*For each PHY*/
+        for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++) { /*For each PHY*/
            mii_wr(MII_CR_RST, MII_CR, lp->phy[k].addr, DE4X5_MII);
            while (mii_rd(MII_CR, lp->phy[k].addr, DE4X5_MII) & MII_CR_RST);
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c70604f0329e..8ce5e4cee168 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
        readSsidRid(local, &SSID_rid);
        /* Check if we asked for `any' */
-        if(dwrq->flags == 0) {
+        if (dwrq->flags == 0) {
                /* Just send an empty SSID list */
                memset(&SSID_rid, 0, sizeof(SSID_rid));
        } else {
-                int     index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+                unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
                /* Check the size of the string */
-                if(dwrq->length > IW_ESSID_MAX_SIZE) {
+                if (dwrq->length > IW_ESSID_MAX_SIZE)
                        return -E2BIG ;
-                }
                /* Check if index is valid */
-                if((index < 0) || (index >= 4)) {
+                if (index >= ARRAY_SIZE(SSID_rid.ssids))
                        return -EINVAL;
-                }
                /* Set the SSID */
                memset(SSID_rid.ssids[index].ssid, 0,
@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
                return -EINVAL;
        }
        clear_bit (FLAG_RADIO_OFF, &local->flags);
-        for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
+        for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
                if (v == cap_rid.txPowerLevels[i]) {
                        readConfigRid(local, 1);
                        local->config.txPower = v;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index a2fda702b620..ce0e86c36a82 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -460,7 +460,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                integer = swab32(eep->modalHeader.antCtrlCommon);
                eep->modalHeader.antCtrlCommon = integer;
-                for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
                        integer = swab32(eep->modalHeader.antCtrlChain[i]);
                        eep->modalHeader.antCtrlChain[i] = integer;
                }
@@ -914,7 +914,7 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
                        ctlMode, numCtlModes, isHt40CtlMode,
                        (pCtlMode[ctlMode] & EXT_ADDITIVE));
-                for (i = 0; (i < AR5416_NUM_CTLS) &&
+                for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
                                pEepData->ctlIndex[i]; i++) {
                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
                                "  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index fbb3a573463e..2de6471d4be9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -112,7 +112,7 @@ enum iwl3945_antenna {
 #define IWL_TX_FIFO_NONE        7
 /* Minimum number of queues. MAX_NUM is defined in hw specific files */
-#define IWL_MIN_NUM_QUEUES      4
+#define IWL39_MIN_NUM_QUEUES    4
 #define IEEE80211_DATA_LEN              2304
 #define IEEE80211_4ADDR_LEN             30
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 6ab07165ea28..18b135f510e5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1332,6 +1332,9 @@ int iwl_setup_mac(struct iwl_priv *priv)
        hw->wiphy->custom_regulatory = true;
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
        /* we create the 802.11 header and a zero-length SSID element */
        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 11e08c068917..ca00cc8ad4c7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -308,18 +308,18 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                return -ENODATA;
        }
+        ptr = priv->eeprom;
+        if (!ptr) {
+                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
+                return -ENOMEM;
+        }
        /* 4 characters for byte 0xYY */
        buf = kzalloc(buf_size, GFP_KERNEL);
        if (!buf) {
                IWL_ERR(priv, "Can not allocate Buffer\n");
                return -ENOMEM;
        }
-        ptr = priv->eeprom;
-        if (!ptr) {
-                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
-                return -ENOMEM;
-        }
        pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s\n",
                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
                        ? "OTP" : "EEPROM");
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index e2d620f0b6e8..650e20af20fa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -258,8 +258,10 @@ struct iwl_channel_info {
 #define IWL_TX_FIFO_HCCA_2      6
 #define IWL_TX_FIFO_NONE        7
-/* Minimum number of queues. MAX_NUM is defined in hw specific files */
+/* Minimum number of queues. MAX_NUM is defined in hw specific files.
-#define IWL_MIN_NUM_QUEUES      4
+ * Set the minimum to accommodate the 4 standard TX queues, 1 command
+ * queue, 2 (unused) HCCA queues, and 4 HT queues (one for each AC) */
+#define IWL_MIN_NUM_QUEUES      10
 /* Power management (not Tx power) structures */
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 2addf735b193..ffd5c61a7553 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -566,6 +566,8 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
        unsigned long flags;
        spin_lock_irqsave(&priv->sta_lock, flags);
+        IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
+                      keyconf->keyidx);
        if (!test_and_clear_bit(keyconf->keyidx, &priv->ucode_key_table))
                IWL_ERR(priv, "index %d not used in uCode key table.\n",
@@ -573,6 +575,11 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
        priv->default_wep_key--;
        memset(&priv->wep_keys[keyconf->keyidx], 0, sizeof(priv->wep_keys[0]));
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
        ret = iwl_send_static_wepkey_cmd(priv, 1);
        IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
                      keyconf->keyidx, ret);
@@ -853,6 +860,11 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled. \n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
        ret =  iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
        spin_unlock_irqrestore(&priv->sta_lock, flags);
        return ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 9bbeec9427f0..2e89040e63be 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -720,8 +720,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                goto drop_unlock;
        }
-        spin_unlock_irqrestore(&priv->lock, flags);
        hdr_len = ieee80211_hdrlen(fc);
        /* Find (or create) index into station table for destination station */
@@ -729,7 +727,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        if (sta_id == IWL_INVALID_STATION) {
                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                               hdr->addr1);
-                goto drop;
+                goto drop_unlock;
        }
        IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -750,14 +748,17 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                        txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
                        swq_id = iwl_virtual_agg_queue_num(swq_id, txq_id);
                }
-                priv->stations[sta_id].tid[tid].tfds_in_queue++;
        }
        txq = &priv->txq[txq_id];
        q = &txq->q;
        txq->swq_id = swq_id;
-        spin_lock_irqsave(&priv->lock, flags);
+        if (unlikely(iwl_queue_space(q) < q->high_mark))
+                goto drop_unlock;
+        if (ieee80211_is_data_qos(fc))
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
        /* Set up driver data for this TFD */
        memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
@@ -902,7 +903,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 drop_unlock:
        spin_unlock_irqrestore(&priv->lock, flags);
-drop:
        return -1;
 }
 EXPORT_SYMBOL(iwl_tx_skb);
@@ -1171,6 +1171,8 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
                IWL_ERR(priv, "Start AGG on invalid station\n");
                return -ENXIO;
        }
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
                IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 956798f2c80c..523843369ca2 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3968,6 +3968,9 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
        hw->wiphy->custom_regulatory = true;
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
        /* we create the 802.11 header and a zero-length SSID element */
        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
@@ -4018,10 +4021,10 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
        SET_IEEE80211_DEV(hw, &pdev->dev);
        if ((iwl3945_mod_params.num_of_queues > IWL39_MAX_NUM_QUEUES) ||
-             (iwl3945_mod_params.num_of_queues < IWL_MIN_NUM_QUEUES)) {
+             (iwl3945_mod_params.num_of_queues < IWL39_MIN_NUM_QUEUES)) {
                IWL_ERR(priv,
                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL39_MAX_NUM_QUEUES);
+                        IWL39_MIN_NUM_QUEUES, IWL39_MAX_NUM_QUEUES);
                err = -EINVAL;
                goto out_ieee80211_free_hw;
        }
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 834a7f544e5d..e2334d123599 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -220,6 +220,7 @@ int iwm_store_rxiq_calib_result(struct iwm_priv *iwm)
        eeprom_rxiq = iwm_eeprom_access(iwm, IWM_EEPROM_CALIB_RXIQ);
        if (IS_ERR(eeprom_rxiq)) {
                IWM_ERR(iwm, "Couldn't access EEPROM RX IQ entry\n");
+                kfree(rxiq);
                return PTR_ERR(eeprom_rxiq);
        }
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index aea5ccf24ccf..bf294e41753b 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -106,10 +106,8 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
        int ret = 0;
        wdev = iwm_wdev_alloc(sizeof_bus, dev);
-        if (!wdev) {
+        if (IS_ERR(wdev))
-                dev_err(dev, "no memory for wireless device instance\n");
+                return wdev;
-                return ERR_PTR(-ENOMEM);
-        }
        iwm = wdev_to_iwm(wdev);
        iwm->bus_ops = if_ops;
diff --git a/drivers/net/wireless/libertas/11d.c b/drivers/net/wireless/libertas/11d.c
index 9a5408e7d94a..5c6968101f0d 100644
--- a/drivers/net/wireless/libertas/11d.c
+++ b/drivers/net/wireless/libertas/11d.c
@@ -47,7 +47,7 @@ static u8 lbs_region_2_code(u8 *region)
 {
        u8 i;
-        for (i = 0; region[i] && i < COUNTRY_CODE_LEN; i++)
+        for (i = 0; i < COUNTRY_CODE_LEN && region[i]; i++)
                region[i] = toupper(region[i]);
        for (i = 0; i < ARRAY_SIZE(region_code_mapping); i++) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index b9b374119033..d6997371c27e 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,6 +1,7 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -43,21 +44,21 @@ static int get_common_rates(struct lbs_private *priv,
        u16 *rates_size)
 {
        u8 *card_rates = lbs_bg_rates;
-        size_t num_card_rates = sizeof(lbs_bg_rates);
        int ret = 0, i, j;
-        u8 tmp[30];
+        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
        size_t tmp_size = 0;
        /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
+        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
-                for (j = 0; rates[j] && (j < *rates_size); j++) {
+                for (j = 0; j < *rates_size && rates[j]; j++) {
                        if (rates[j] == card_rates[i])
                                tmp[tmp_size++] = card_rates[i];
                }
        }
        lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+                        ARRAY_SIZE(lbs_bg_rates));
        lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
        lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
@@ -69,10 +70,7 @@ static int get_common_rates(struct lbs_private *priv,
                lbs_pr_alert("Previously set fixed data rate %#x isn't "
                       "compatible with the network.\n", priv->cur_rate);
                ret = -1;
-                goto done;
        }
-        ret = 0;
 done:
        memset(rates, 0, *rates_size);
        *rates_size = min_t(int, tmp_size, *rates_size);
@@ -322,7 +320,7 @@ static int lbs_associate(struct lbs_private *priv,
        rates = (struct mrvl_ie_rates_param_set *) pos;
        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
        memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = MAX_RATES;
+        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
        if (get_common_rates(priv, rates->rates, &tmplen)) {
                ret = -1;
                goto done;
@@ -598,7 +596,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
        /* Copy Data rates from the rates recorded in scan response */
        memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
        memcpy(cmd.bss.rates, bss->rates, ratesize);
        if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 601b54249677..6c95af3023cc 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -5,6 +5,7 @@
  *  for sending scan commands to the firmware.
  */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>
@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
        iwe.u.bitrate.disabled = 0;
        iwe.u.bitrate.value = 0;
-        for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+        for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
                /* Bit rate given in 500 kb/s units */
                iwe.u.bitrate.value = bss->rates[j] * 500000;
                current_val = iwe_stream_add_value(info, start, current_val,
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 40b07b988224..3bd3c779fff3 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -698,7 +698,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
                        && !mac->pass_ctrl)
                return 0;
-        fc = *(__le16 *)buffer;
+        fc = get_unaligned((__le16*)buffer);
        need_padding = ieee80211_is_data_qos(fc) ^ ieee80211_has_a4(fc);
        skb = dev_alloc_skb(length + (need_padding ? 2 : 0));
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index 0f0e0b919ef4..a45b0c0d574e 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -70,7 +70,6 @@
 #undef CCIO_COLLECT_STATS
 #endif
-#include <linux/proc_fs.h>
 #include <asm/runway.h>         /* for proc_runway_root */
 #ifdef DEBUG_CCIO_INIT
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index c590974e9815..d69bde6a2343 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -614,7 +614,7 @@ dino_fixup_bus(struct pci_bus *bus)
                            dev_name(&bus->self->dev), i,
                            bus->self->resource[i].start,
                            bus->self->resource[i].end);
-                        pci_assign_resource(bus->self, i);
+                        WARN_ON(pci_assign_resource(bus->self, i));
                        DBG("DEBUG %s after assign %d [0x%lx,0x%lx]\n",
                            dev_name(&bus->self->dev), i,
                            bus->self->resource[i].start,
diff --git a/drivers/parisc/eisa_eeprom.c b/drivers/parisc/eisa_eeprom.c
index 685d94e69d44..8c0b26e9b98a 100644
--- a/drivers/parisc/eisa_eeprom.c
+++ b/drivers/parisc/eisa_eeprom.c
@@ -55,7 +55,7 @@ static ssize_t eisa_eeprom_read(struct file * file,
        ssize_t ret;
        int i;
        
-        if (*ppos >= HPEE_MAX_LENGTH)
+        if (*ppos < 0 || *ppos >= HPEE_MAX_LENGTH)
                return 0;
        
        count = *ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - *ppos;
diff --git a/drivers/parisc/hppb.c b/drivers/parisc/hppb.c
index 13856415b432..815db175d427 100644
--- a/drivers/parisc/hppb.c
+++ b/drivers/parisc/hppb.c
@@ -62,7 +62,8 @@ static int hppb_probe(struct parisc_device *dev)
                }
                card = card->next;
        }
-        printk(KERN_INFO "Found GeckoBoa at 0x%x\n", dev->hpa.start);
+        printk(KERN_INFO "Found GeckoBoa at 0x%llx\n",
+                        (unsigned long long) dev->hpa.start);
        card->hpa = dev->hpa.start;
        card->mmio_region.name = "HP-PB Bus";
@@ -73,8 +74,10 @@ static int hppb_probe(struct parisc_device *dev)
        status = ccio_request_resource(dev, &card->mmio_region);
        if(status < 0) {
-                printk(KERN_ERR "%s: failed to claim HP-PB bus space (%08x, %08x)\n",
+                printk(KERN_ERR "%s: failed to claim HP-PB "
-                        __FILE__, card->mmio_region.start, card->mmio_region.end);
+                        "bus space (0x%08llx, 0x%08llx)\n",
+                        __FILE__, (unsigned long long) card->mmio_region.start,
+                        (unsigned long long) card->mmio_region.end);
        }
        return 0;
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index ede614616f8e..3aeb3279c92a 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -992,7 +992,7 @@ lba_pat_resources(struct parisc_device *pa_dev, struct lba_device *lba_dev)
                return;
        io_pdc_cell = kzalloc(sizeof(pdc_pat_cell_mod_maddr_block_t), GFP_KERNEL);
-        if (!pa_pdc_cell) {
+        if (!io_pdc_cell) {
                kfree(pa_pdc_cell);
                return;
        }
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index f9f9a5f1bbd0..13a64bc081b6 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -370,7 +370,7 @@ pdcspath_layer_read(struct pdcspath_entry *entry, char *buf)
        if (!i) /* entry is not ready */
                return -ENODATA;
        
-        for (i = 0; devpath->layers[i] && (likely(i < 6)); i++)
+        for (i = 0; i < 6 && devpath->layers[i]; i++)
                out += sprintf(out, "%u ", devpath->layers[i]);
        out += sprintf(out, "\n");
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 8030e25152fb..c75d6f35cb5f 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -553,40 +553,35 @@ static void _zfcp_erp_unit_reopen_all(struct zfcp_port *port, int clear,
                _zfcp_erp_unit_reopen(unit, clear, id, ref);
 }
-static void zfcp_erp_strategy_followup_actions(struct zfcp_erp_action *act)
+static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
 {
-        struct zfcp_adapter *adapter = act->adapter;
-        struct zfcp_port *port = act->port;
-        struct zfcp_unit *unit = act->unit;
-        u32 status = act->status;
-        /* initiate follow-up actions depending on success of finished action */
        switch (act->action) {
        case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_adapter_reopen(act->adapter, 0, "ersff_1", NULL);
-                        _zfcp_erp_port_reopen_all(adapter, 0, "ersfa_1", NULL);
-                else
-                        _zfcp_erp_adapter_reopen(adapter, 0, "ersfa_2", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_port_forced_reopen(act->port, 0, "ersff_2", NULL);
-                        _zfcp_erp_port_reopen(port, 0, "ersfa_3", NULL);
-                else
-                        _zfcp_erp_adapter_reopen(adapter, 0, "ersfa_4", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_PORT:
-                if (status == ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_port_reopen(act->port, 0, "ersff_3", NULL);
-                        _zfcp_erp_unit_reopen_all(port, 0, "ersfa_5", NULL);
-                else
-                        _zfcp_erp_port_forced_reopen(port, 0, "ersfa_6", NULL);
                break;
        case ZFCP_ERP_ACTION_REOPEN_UNIT:
-                if (status != ZFCP_ERP_SUCCEEDED)
+                _zfcp_erp_unit_reopen(act->unit, 0, "ersff_4", NULL);
-                        _zfcp_erp_port_reopen(unit->port, 0, "ersfa_7", NULL);
+                break;
+        }
+}
+static void zfcp_erp_strategy_followup_success(struct zfcp_erp_action *act)
+{
+        switch (act->action) {
+        case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
+                _zfcp_erp_port_reopen_all(act->adapter, 0, "ersfs_1", NULL);
+                break;
+        case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
+                _zfcp_erp_port_reopen(act->port, 0, "ersfs_2", NULL);
+                break;
+        case ZFCP_ERP_ACTION_REOPEN_PORT:
+                _zfcp_erp_unit_reopen_all(act->port, 0, "ersfs_3", NULL);
                break;
        }
 }
@@ -801,7 +796,7 @@ static int zfcp_erp_port_forced_strategy(struct zfcp_erp_action *erp_action)
                        return ZFCP_ERP_FAILED;
        case ZFCP_ERP_STEP_PHYS_PORT_CLOSING:
-                if (status & ZFCP_STATUS_PORT_PHYS_OPEN)
+                if (!(status & ZFCP_STATUS_PORT_PHYS_OPEN))
                        return ZFCP_ERP_SUCCEEDED;
        }
        return ZFCP_ERP_FAILED;
@@ -853,11 +848,17 @@ void zfcp_erp_port_strategy_open_lookup(struct work_struct *work)
                                              gid_pn_work);
        retval = zfcp_fc_ns_gid_pn(&port->erp_action);
-        if (retval == -ENOMEM)
+        if (!retval) {
-                zfcp_erp_notify(&port->erp_action, ZFCP_ERP_NOMEM);
+                port->erp_action.step = ZFCP_ERP_STEP_NAMESERVER_LOOKUP;
-        port->erp_action.step = ZFCP_ERP_STEP_NAMESERVER_LOOKUP;
+                goto out;
-        if (retval)
+        }
-                zfcp_erp_notify(&port->erp_action, ZFCP_ERP_FAILED);
+        if (retval == -ENOMEM) {
+                zfcp_erp_notify(&port->erp_action, ZFCP_STATUS_ERP_LOWMEM);
+                goto out;
+        }
+        /* all other error condtions */
+        zfcp_erp_notify(&port->erp_action, 0);
+out:
        zfcp_port_put(port);
 }
@@ -1289,7 +1290,10 @@ static int zfcp_erp_strategy(struct zfcp_erp_action *erp_action)
        retval = zfcp_erp_strategy_statechange(erp_action, retval);
        if (retval == ZFCP_ERP_EXIT)
                goto unlock;
-        zfcp_erp_strategy_followup_actions(erp_action);
+        if (retval == ZFCP_ERP_SUCCEEDED)
+                zfcp_erp_strategy_followup_success(erp_action);
+        if (retval == ZFCP_ERP_FAILED)
+                zfcp_erp_strategy_followup_failed(erp_action);
 unlock:
        write_unlock(&adapter->erp_lock);
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index 2f0705d76b72..47daebfa7e59 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -79,11 +79,9 @@ static int zfcp_wka_port_get(struct zfcp_wka_port *wka_port)
        mutex_unlock(&wka_port->mutex);
-        wait_event_timeout(
+        wait_event(wka_port->completion_wq,
-                wka_port->completion_wq,
+                   wka_port->status == ZFCP_WKA_PORT_ONLINE ||
-                wka_port->status == ZFCP_WKA_PORT_ONLINE ||
+                   wka_port->status == ZFCP_WKA_PORT_OFFLINE);
-                wka_port->status == ZFCP_WKA_PORT_OFFLINE,
-                HZ >> 1);
        if (wka_port->status == ZFCP_WKA_PORT_ONLINE) {
                atomic_inc(&wka_port->refcount);
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index c57658f3d34f..47795fbf081f 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -670,8 +670,11 @@ static int zfcp_fsf_req_sbal_get(struct zfcp_adapter *adapter)
                               zfcp_fsf_sbal_check(adapter), 5 * HZ);
        if (ret > 0)
                return 0;
-        if (!ret)
+        if (!ret) {
                atomic_inc(&adapter->qdio_outb_full);
+                /* assume hanging outbound queue, try queue recovery */
+                zfcp_erp_adapter_reopen(adapter, 0, "fsrsg_1", NULL);
+        }
        spin_lock_bh(&adapter->req_q_lock);
        return -EIO;
@@ -722,7 +725,7 @@ static struct zfcp_fsf_req *zfcp_fsf_req_create(struct zfcp_adapter *adapter,
                req = zfcp_fsf_alloc_qtcb(pool);
        if (unlikely(!req))
-                return ERR_PTR(-EIO);
+                return ERR_PTR(-ENOMEM);
        if (adapter->req_no == 0)
                adapter->req_no++;
@@ -1010,6 +1013,23 @@ skip_fsfstatus:
                send_ct->handler(send_ct->handler_data);
 }
+static void zfcp_fsf_setup_ct_els_unchained(struct qdio_buffer_element *sbale,
+                                            struct scatterlist *sg_req,
+                                            struct scatterlist *sg_resp)
+{
+        sbale[0].flags |= SBAL_FLAGS0_TYPE_WRITE_READ;
+        sbale[2].addr   = sg_virt(sg_req);
+        sbale[2].length = sg_req->length;
+        sbale[3].addr   = sg_virt(sg_resp);
+        sbale[3].length = sg_resp->length;
+        sbale[3].flags |= SBAL_FLAGS_LAST_ENTRY;
+}
+static int zfcp_fsf_one_sbal(struct scatterlist *sg)
+{
+        return sg_is_last(sg) && sg->length <= PAGE_SIZE;
+}
 static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
                                       struct scatterlist *sg_req,
                                       struct scatterlist *sg_resp,
@@ -1020,30 +1040,30 @@ static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
        int bytes;
        if (!(feat & FSF_FEATURE_ELS_CT_CHAINED_SBALS)) {
-                if (sg_req->length > PAGE_SIZE || sg_resp->length > PAGE_SIZE ||
+                if (!zfcp_fsf_one_sbal(sg_req) || !zfcp_fsf_one_sbal(sg_resp))
-                    !sg_is_last(sg_req) || !sg_is_last(sg_resp))
                        return -EOPNOTSUPP;
-                sbale[0].flags |= SBAL_FLAGS0_TYPE_WRITE_READ;
+                zfcp_fsf_setup_ct_els_unchained(sbale, sg_req, sg_resp);
-                sbale[2].addr   = sg_virt(sg_req);
+                return 0;
-                sbale[2].length = sg_req->length;
+        }
-                sbale[3].addr   = sg_virt(sg_resp);
-                sbale[3].length = sg_resp->length;
+        /* use single, unchained SBAL if it can hold the request */
-                sbale[3].flags |= SBAL_FLAGS_LAST_ENTRY;
+        if (zfcp_fsf_one_sbal(sg_req) && zfcp_fsf_one_sbal(sg_resp)) {
+                zfcp_fsf_setup_ct_els_unchained(sbale, sg_req, sg_resp);
                return 0;
        }
        bytes = zfcp_qdio_sbals_from_sg(req, SBAL_FLAGS0_TYPE_WRITE_READ,
                                        sg_req, max_sbals);
        if (bytes <= 0)
-                return -ENOMEM;
+                return -EIO;
        req->qtcb->bottom.support.req_buf_length = bytes;
        req->sbale_curr = ZFCP_LAST_SBALE_PER_SBAL;
        bytes = zfcp_qdio_sbals_from_sg(req, SBAL_FLAGS0_TYPE_WRITE_READ,
                                        sg_resp, max_sbals);
        if (bytes <= 0)
-                return -ENOMEM;
+                return -EIO;
        req->qtcb->bottom.support.resp_buf_length = bytes;
        return 0;
@@ -1607,10 +1627,10 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
        case FSF_ACCESS_DENIED:
                wka_port->status = ZFCP_WKA_PORT_OFFLINE;
                break;
-        case FSF_PORT_ALREADY_OPEN:
-                break;
        case FSF_GOOD:
                wka_port->handle = header->port_handle;
+                /* fall through */
+        case FSF_PORT_ALREADY_OPEN:
                wka_port->status = ZFCP_WKA_PORT_ONLINE;
        }
 out:
@@ -1731,15 +1751,16 @@ static void zfcp_fsf_close_physical_port_handler(struct zfcp_fsf_req *req)
                zfcp_fsf_access_denied_port(req, port);
                break;
        case FSF_PORT_BOXED:
-                zfcp_erp_port_boxed(port, "fscpph2", req);
-                req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-                               ZFCP_STATUS_FSFREQ_RETRY;
                /* can't use generic zfcp_erp_modify_port_status because
                 * ZFCP_STATUS_COMMON_OPEN must not be reset for the port */
                atomic_clear_mask(ZFCP_STATUS_PORT_PHYS_OPEN, &port->status);
                list_for_each_entry(unit, &port->unit_list_head, list)
                        atomic_clear_mask(ZFCP_STATUS_COMMON_OPEN,
                                          &unit->status);
+                zfcp_erp_port_boxed(port, "fscpph2", req);
+                req->status |= ZFCP_STATUS_FSFREQ_ERROR |
+                               ZFCP_STATUS_FSFREQ_RETRY;
                break;
        case FSF_ADAPTER_STATUS_AVAILABLE:
                switch (header->fsf_status_qual.word[0]) {
@@ -2541,7 +2562,6 @@ struct zfcp_fsf_req *zfcp_fsf_control_file(struct zfcp_adapter *adapter,
        bytes = zfcp_qdio_sbals_from_sg(req, direction, fsf_cfdc->sg,
                                        FSF_MAX_SBALS_PER_REQ);
        if (bytes != ZFCP_CFDC_MAX_SIZE) {
-                retval = -ENOMEM;
                zfcp_fsf_req_free(req);
                goto out;
        }
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 967ede73f4c5..6925a1784682 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -167,20 +167,21 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
        struct zfcp_unit *unit = scpnt->device->hostdata;
        struct zfcp_fsf_req *old_req, *abrt_req;
        unsigned long flags;
-        unsigned long old_req_id = (unsigned long) scpnt->host_scribble;
+        unsigned long old_reqid = (unsigned long) scpnt->host_scribble;
        int retval = SUCCESS;
        int retry = 3;
+        char *dbf_tag;
        /* avoid race condition between late normal completion and abort */
        write_lock_irqsave(&adapter->abort_lock, flags);
        spin_lock(&adapter->req_list_lock);
-        old_req = zfcp_reqlist_find(adapter, old_req_id);
+        old_req = zfcp_reqlist_find(adapter, old_reqid);
        spin_unlock(&adapter->req_list_lock);
        if (!old_req) {
                write_unlock_irqrestore(&adapter->abort_lock, flags);
                zfcp_scsi_dbf_event_abort("lte1", adapter, scpnt, NULL,
-                                          old_req_id);
+                                          old_reqid);
                return FAILED; /* completion could be in progress */
        }
        old_req->data = NULL;
@@ -189,7 +190,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
        write_unlock_irqrestore(&adapter->abort_lock, flags);
        while (retry--) {
-                abrt_req = zfcp_fsf_abort_fcp_command(old_req_id, unit);
+                abrt_req = zfcp_fsf_abort_fcp_command(old_reqid, unit);
                if (abrt_req)
                        break;
@@ -197,7 +198,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
                if (!(atomic_read(&adapter->status) &
                      ZFCP_STATUS_COMMON_RUNNING)) {
                        zfcp_scsi_dbf_event_abort("nres", adapter, scpnt, NULL,
-                                                  old_req_id);
+                                                  old_reqid);
                        return SUCCESS;
                }
        }
@@ -208,13 +209,14 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
                   abrt_req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
        if (abrt_req->status & ZFCP_STATUS_FSFREQ_ABORTSUCCEEDED)
-                zfcp_scsi_dbf_event_abort("okay", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "okay";
        else if (abrt_req->status & ZFCP_STATUS_FSFREQ_ABORTNOTNEEDED)
-                zfcp_scsi_dbf_event_abort("lte2", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "lte2";
        else {
-                zfcp_scsi_dbf_event_abort("fail", adapter, scpnt, abrt_req, 0);
+                dbf_tag = "fail";
                retval = FAILED;
        }
+        zfcp_scsi_dbf_event_abort(dbf_tag, adapter, scpnt, abrt_req, old_reqid);
        zfcp_fsf_req_free(abrt_req);
        return retval;
 }
@@ -534,6 +536,9 @@ static void zfcp_scsi_rport_register(struct zfcp_port *port)
        struct fc_rport_identifiers ids;
        struct fc_rport *rport;
+        if (port->rport)
+                return;
        ids.node_name = port->wwnn;
        ids.port_name = port->wwpn;
        ids.port_id = port->d_id;
@@ -557,8 +562,10 @@ static void zfcp_scsi_rport_block(struct zfcp_port *port)
 {
        struct fc_rport *rport = port->rport;
-        if (rport)
+        if (rport) {
                fc_remote_port_delete(rport);
+                port->rport = NULL;
+        }
 }
 void zfcp_scsi_schedule_rport_register(struct zfcp_port *port)
diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
index 3e51e64d1108..0fe5cce818cb 100644
--- a/drivers/s390/scsi/zfcp_sysfs.c
+++ b/drivers/s390/scsi/zfcp_sysfs.c
@@ -494,9 +494,14 @@ static ssize_t zfcp_sysfs_adapter_q_full_show(struct device *dev,
        struct Scsi_Host *scsi_host = class_to_shost(dev);
        struct zfcp_adapter *adapter =
                (struct zfcp_adapter *) scsi_host->hostdata[0];
+        u64 util;
+        spin_lock_bh(&adapter->qdio_stat_lock);
+        util = adapter->req_q_util;
+        spin_unlock_bh(&adapter->qdio_stat_lock);
        return sprintf(buf, "%d %llu\n", atomic_read(&adapter->qdio_outb_full),
-                       (unsigned long long)adapter->req_q_util);
+                       (unsigned long long)util);
 }
 static DEVICE_ATTR(queue_full, S_IRUGO, zfcp_sysfs_adapter_q_full_show, NULL);
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 2bc22be5f849..145ab9ba55ea 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -415,9 +415,9 @@ static void fc_exch_timeout(struct work_struct *work)
        e_stat = ep->esb_stat;
        if (e_stat & ESB_ST_COMPLETE) {
                ep->esb_stat = e_stat & ~ESB_ST_REC_QUAL;
+                spin_unlock_bh(&ep->ex_lock);
                if (e_stat & ESB_ST_REC_QUAL)
                        fc_exch_rrq(ep);
-                spin_unlock_bh(&ep->ex_lock);
                goto done;
        } else {
                resp = ep->resp;
@@ -1624,14 +1624,14 @@ static void fc_exch_rrq(struct fc_exch *ep)
        struct fc_lport *lp;
        struct fc_els_rrq *rrq;
        struct fc_frame *fp;
-        struct fc_seq *rrq_sp;
        u32 did;
        lp = ep->lp;
        fp = fc_frame_alloc(lp, sizeof(*rrq));
        if (!fp)
-                return;
+                goto retry;
        rrq = fc_frame_payload_get(fp, sizeof(*rrq));
        memset(rrq, 0, sizeof(*rrq));
        rrq->rrq_cmd = ELS_RRQ;
@@ -1647,13 +1647,20 @@ static void fc_exch_rrq(struct fc_exch *ep)
                       fc_host_port_id(lp->host), FC_TYPE_ELS,
                       FC_FC_FIRST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
-        rrq_sp = fc_exch_seq_send(lp, fp, fc_exch_rrq_resp, NULL, ep,
+        if (fc_exch_seq_send(lp, fp, fc_exch_rrq_resp, NULL, ep, lp->e_d_tov))
-                                  lp->e_d_tov);
+                return;
-        if (!rrq_sp) {
-                ep->esb_stat |= ESB_ST_REC_QUAL;
+retry:
-                fc_exch_timer_set_locked(ep, ep->r_a_tov);
+        spin_lock_bh(&ep->ex_lock);
+        if (ep->state & (FC_EX_RST_CLEANUP | FC_EX_DONE)) {
+                spin_unlock_bh(&ep->ex_lock);
+                /* drop hold for rec qual */
+                fc_exch_release(ep);
                return;
        }
+        ep->esb_stat |= ESB_ST_REC_QUAL;
+        fc_exch_timer_set_locked(ep, ep->r_a_tov);
+        spin_unlock_bh(&ep->ex_lock);
 }
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 716cc344c5df..a751f6230c22 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1974,10 +1974,10 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
                 * good and have never sent us a successful tmf response
                 * then sent more data for the cmd.
                 */
-                spin_lock(&session->lock);
+                spin_lock_bh(&session->lock);
                fail_scsi_task(task, DID_ABORT);
                conn->tmf_state = TMF_INITIAL;
-                spin_unlock(&session->lock);
+                spin_unlock_bh(&session->lock);
                iscsi_start_tx(conn);
                goto success_unlocked;
        case TMF_TIMEDOUT:
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 54fa1e42dc4d..b3381959acce 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -766,6 +766,7 @@ static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
                if (!memcmp(phy->attached_sas_addr, ephy->attached_sas_addr,
                            SAS_ADDR_SIZE) && ephy->port) {
                        sas_port_add_phy(ephy->port, phy->phy);
+                        phy->port = ephy->port;
                        phy->phy_state = PHY_DEVICE_DISCOVERED;
                        return 0;
                }
@@ -945,11 +946,21 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
                        if (ex->ex_phy[i].phy_state == PHY_VACANT ||
                            ex->ex_phy[i].phy_state == PHY_NOT_PRESENT)
                                continue;
+                        /*
+                         * Due to races, the phy might not get added to the
+                         * wide port, so we add the phy to the wide port here.
+                         */
                        if (SAS_ADDR(ex->ex_phy[i].attached_sas_addr) ==
-                            SAS_ADDR(child->sas_addr))
+                            SAS_ADDR(child->sas_addr)) {
                                ex->ex_phy[i].phy_state= PHY_DEVICE_DISCOVERED;
+                                res = sas_ex_join_wide_port(dev, i);
+                                if (!res)
+                                        SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n",
+                                                    i, SAS_ADDR(ex->ex_phy[i].attached_sas_addr));
+                        }
                }
+                res = 0;
        }
        return res;
@@ -1598,7 +1609,7 @@ static int sas_get_phy_attached_sas_addr(struct domain_device *dev,
 }
 static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
-                              int from_phy)
+                              int from_phy, bool update)
 {
        struct expander_device *ex = &dev->ex_dev;
        int res = 0;
@@ -1611,7 +1622,9 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
                if (res)
                        goto out;
                else if (phy_change_count != ex->ex_phy[i].phy_change_count) {
-                        ex->ex_phy[i].phy_change_count = phy_change_count;
+                        if (update)
+                                ex->ex_phy[i].phy_change_count =
+                                        phy_change_count;
                        *phy_id = i;
                        return 0;
                }
@@ -1653,31 +1666,52 @@ out:
        kfree(rg_req);
        return res;
 }
+/**
+ * sas_find_bcast_dev -  find the device issue BROADCAST(CHANGE).
+ * @dev:domain device to be detect.
+ * @src_dev: the device which originated BROADCAST(CHANGE).
+ *
+ * Add self-configuration expander suport. Suppose two expander cascading,
+ * when the first level expander is self-configuring, hotplug the disks in
+ * second level expander, BROADCAST(CHANGE) will not only be originated
+ * in the second level expander, but also be originated in the first level
+ * expander (see SAS protocol SAS 2r-14, 7.11 for detail), it is to say,
+ * expander changed count in two level expanders will all increment at least
+ * once, but the phy which chang count has changed is the source device which
+ * we concerned.
+ */
 static int sas_find_bcast_dev(struct domain_device *dev,
                              struct domain_device **src_dev)
 {
        struct expander_device *ex = &dev->ex_dev;
        int ex_change_count = -1;
+        int phy_id = -1;
        int res;
+        struct domain_device *ch;
        res = sas_get_ex_change_count(dev, &ex_change_count);
        if (res)
                goto out;
-        if (ex_change_count != -1 &&
+        if (ex_change_count != -1 && ex_change_count != ex->ex_change_count) {
-            ex_change_count != ex->ex_change_count) {
+                /* Just detect if this expander phys phy change count changed,
-                *src_dev = dev;
+                * in order to determine if this expander originate BROADCAST,
-                ex->ex_change_count = ex_change_count;
+                * and do not update phy change count field in our structure.
-        } else {
+                */
-                struct domain_device *ch;
+                res = sas_find_bcast_phy(dev, &phy_id, 0, false);
+                if (phy_id != -1) {
-                list_for_each_entry(ch, &ex->children, siblings) {
+                        *src_dev = dev;
-                        if (ch->dev_type == EDGE_DEV ||
+                        ex->ex_change_count = ex_change_count;
-                            ch->dev_type == FANOUT_DEV) {
+                        SAS_DPRINTK("Expander phy change count has changed\n");
-                                res = sas_find_bcast_dev(ch, src_dev);
+                        return res;
-                                if (src_dev)
+                } else
-                                        return res;
+                        SAS_DPRINTK("Expander phys DID NOT change\n");
-                        }
+        }
+        list_for_each_entry(ch, &ex->children, siblings) {
+                if (ch->dev_type == EDGE_DEV || ch->dev_type == FANOUT_DEV) {
+                        res = sas_find_bcast_dev(ch, src_dev);
+                        if (src_dev)
+                                return res;
                }
        }
 out:
@@ -1700,24 +1734,26 @@ static void sas_unregister_ex_tree(struct domain_device *dev)
 }
 static void sas_unregister_devs_sas_addr(struct domain_device *parent,
-                                         int phy_id)
+                                         int phy_id, bool last)
 {
        struct expander_device *ex_dev = &parent->ex_dev;
        struct ex_phy *phy = &ex_dev->ex_phy[phy_id];
        struct domain_device *child, *n;
+        if (last) {
-        list_for_each_entry_safe(child, n, &ex_dev->children, siblings) {
+                list_for_each_entry_safe(child, n,
-                if (SAS_ADDR(child->sas_addr) ==
+                        &ex_dev->children, siblings) {
-                    SAS_ADDR(phy->attached_sas_addr)) {
+                        if (SAS_ADDR(child->sas_addr) ==
-                        if (child->dev_type == EDGE_DEV ||
+                            SAS_ADDR(phy->attached_sas_addr)) {
-                            child->dev_type == FANOUT_DEV)
+                                if (child->dev_type == EDGE_DEV ||
-                                sas_unregister_ex_tree(child);
+                                    child->dev_type == FANOUT_DEV)
-                        else
+                                        sas_unregister_ex_tree(child);
-                                sas_unregister_dev(child);
+                                else
-                        break;
+                                        sas_unregister_dev(child);
+                                break;
+                        }
                }
+                sas_disable_routing(parent, phy->attached_sas_addr);
        }
-        sas_disable_routing(parent, phy->attached_sas_addr);
        memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
        sas_port_delete_phy(phy->port, phy->phy);
        if (phy->port->num_phys == 0)
@@ -1770,15 +1806,31 @@ static int sas_discover_new(struct domain_device *dev, int phy_id)
 {
        struct ex_phy *ex_phy = &dev->ex_dev.ex_phy[phy_id];
        struct domain_device *child;
-        int res;
+        bool found = false;
+        int res, i;
        SAS_DPRINTK("ex %016llx phy%d new device attached\n",
                    SAS_ADDR(dev->sas_addr), phy_id);
        res = sas_ex_phy_discover(dev, phy_id);
        if (res)
                goto out;
+        /* to support the wide port inserted */
+        for (i = 0; i < dev->ex_dev.num_phys; i++) {
+                struct ex_phy *ex_phy_temp = &dev->ex_dev.ex_phy[i];
+                if (i == phy_id)
+                        continue;
+                if (SAS_ADDR(ex_phy_temp->attached_sas_addr) ==
+                    SAS_ADDR(ex_phy->attached_sas_addr)) {
+                        found = true;
+                        break;
+                }
+        }
+        if (found) {
+                sas_ex_join_wide_port(dev, phy_id);
+                return 0;
+        }
        res = sas_ex_discover_devices(dev, phy_id);
-        if (res)
+        if (!res)
                goto out;
        list_for_each_entry(child, &dev->ex_dev.children, siblings) {
                if (SAS_ADDR(child->sas_addr) ==
@@ -1793,7 +1845,7 @@ out:
        return res;
 }
-static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
+static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
 {
        struct expander_device *ex = &dev->ex_dev;
        struct ex_phy *phy = &ex->ex_phy[phy_id];
@@ -1804,11 +1856,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
        switch (res) {
        case SMP_RESP_NO_PHY:
                phy->phy_state = PHY_NOT_PRESENT;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
                goto out; break;
        case SMP_RESP_PHY_VACANT:
                phy->phy_state = PHY_VACANT;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
                goto out; break;
        case SMP_RESP_FUNC_ACC:
                break;
@@ -1816,7 +1868,7 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id)
        if (SAS_ADDR(attached_sas_addr) == 0) {
                phy->phy_state = PHY_EMPTY;
-                sas_unregister_devs_sas_addr(dev, phy_id);
+                sas_unregister_devs_sas_addr(dev, phy_id, last);
        } else if (SAS_ADDR(attached_sas_addr) ==
                   SAS_ADDR(phy->attached_sas_addr)) {
                SAS_DPRINTK("ex %016llx phy 0x%x broadcast flutter\n",
@@ -1828,12 +1880,27 @@ out:
        return res;
 }
+/**
+ * sas_rediscover - revalidate the domain.
+ * @dev:domain device to be detect.
+ * @phy_id: the phy id will be detected.
+ *
+ * NOTE: this process _must_ quit (return) as soon as any connection
+ * errors are encountered.  Connection recovery is done elsewhere.
+ * Discover process only interrogates devices in order to discover the
+ * domain.For plugging out, we un-register the device only when it is
+ * the last phy in the port, for other phys in this port, we just delete it
+ * from the port.For inserting, we do discovery when it is the
+ * first phy,for other phys in this port, we add it to the port to
+ * forming the wide-port.
+ */
 static int sas_rediscover(struct domain_device *dev, const int phy_id)
 {
        struct expander_device *ex = &dev->ex_dev;
        struct ex_phy *changed_phy = &ex->ex_phy[phy_id];
        int res = 0;
        int i;
+        bool last = true;       /* is this the last phy of the port */
        SAS_DPRINTK("ex %016llx phy%d originated BROADCAST(CHANGE)\n",
                    SAS_ADDR(dev->sas_addr), phy_id);
@@ -1848,13 +1915,13 @@ static int sas_rediscover(struct domain_device *dev, const int phy_id)
                            SAS_ADDR(changed_phy->attached_sas_addr)) {
                                SAS_DPRINTK("phy%d part of wide port with "
                                            "phy%d\n", phy_id, i);
-                                goto out;
+                                last = false;
+                                break;
                        }
                }
-                res = sas_rediscover_dev(dev, phy_id);
+                res = sas_rediscover_dev(dev, phy_id, last);
        } else
                res = sas_discover_new(dev, phy_id);
-out:
        return res;
 }
@@ -1881,7 +1948,7 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev)
                do {
                        phy_id = -1;
-                        res = sas_find_bcast_phy(dev, &phy_id, i);
+                        res = sas_find_bcast_phy(dev, &phy_id, i, true);
                        if (phy_id == -1)
                                break;
                        res = sas_rediscover(dev, phy_id);
diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
index e6ac59c023f1..fe8b74c706d2 100644
--- a/drivers/scsi/libsas/sas_port.c
+++ b/drivers/scsi/libsas/sas_port.c
@@ -56,7 +56,7 @@ static void sas_form_port(struct asd_sas_phy *phy)
                }
        }
-        /* find a port */
+        /* see if the phy should be part of a wide port */
        spin_lock_irqsave(&sas_ha->phy_port_lock, flags);
        for (i = 0; i < sas_ha->num_phys; i++) {
                port = sas_ha->sas_port[i];
@@ -69,12 +69,23 @@ static void sas_form_port(struct asd_sas_phy *phy)
                        SAS_DPRINTK("phy%d matched wide port%d\n", phy->id,
                                    port->id);
                        break;
-                } else if (*(u64 *) port->sas_addr == 0 && port->num_phys==0) {
-                        memcpy(port->sas_addr, phy->sas_addr, SAS_ADDR_SIZE);
-                        break;
                }
                spin_unlock(&port->phy_list_lock);
        }
+        /* The phy does not match any existing port, create a new one */
+        if (i == sas_ha->num_phys) {
+                for (i = 0; i < sas_ha->num_phys; i++) {
+                        port = sas_ha->sas_port[i];
+                        spin_lock(&port->phy_list_lock);
+                        if (*(u64 *)port->sas_addr == 0
+                                && port->num_phys == 0) {
+                                memcpy(port->sas_addr, phy->sas_addr,
+                                        SAS_ADDR_SIZE);
+                                break;
+                        }
+                        spin_unlock(&port->phy_list_lock);
+                }
+        }
        if (i >= sas_ha->num_phys) {
                printk(KERN_NOTICE "%s: couldn't find a free port, bug?\n",
diff --git a/drivers/scsi/qla4xxx/ql4_dbg.c b/drivers/scsi/qla4xxx/ql4_dbg.c
index fcc184cd066d..cbceb0ebabf7 100644
--- a/drivers/scsi/qla4xxx/ql4_dbg.c
+++ b/drivers/scsi/qla4xxx/ql4_dbg.c
@@ -15,19 +15,18 @@ void qla4xxx_dump_buffer(void *b, uint32_t size)
        uint32_t cnt;
        uint8_t *c = b;
-        printk(" 0   1   2   3   4   5   6   7   8   9  Ah  Bh  Ch  Dh  Eh  "
+        printk(" 0   1   2   3   4   5   6   7   8   9  Ah  Bh  Ch  Dh  Eh  "
               "Fh\n");
        printk("------------------------------------------------------------"
               "--\n");
-        for (cnt = 0; cnt < size; cnt++, c++) {
+        for (cnt = 0; cnt < size; c++) {
-                printk(KERN_DEBUG "%02x", *c);
+                printk(KERN_INFO "%02x", *c);
-                if (!(cnt % 16))
+                if (!(++cnt % 16))
-                        printk(KERN_DEBUG "\n");
+                        printk(KERN_INFO "\n");
                else
-                        printk(KERN_DEBUG "  ");
+                        printk(KERN_INFO "  ");
        }
-        if (cnt % 16)
+        printk(KERN_INFO "\n");
-                printk(KERN_DEBUG "\n");
 }
diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index b586f27c3bd4..81b5f29254e2 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -100,7 +100,6 @@
 #define MAX_SRBS                MAX_CMDS_TO_RISC
 #define MBOX_AEN_REG_COUNT      5
 #define MAX_INIT_RETRIES        5
-#define IOCB_HIWAT_CUSHION      16
 /*
 * Buffer sizes
@@ -184,6 +183,11 @@ struct srb {
        uint16_t cc_stat;
        u_long r_start;         /* Time we recieve a cmd from OS */
        u_long u_start;         /* Time when we handed the cmd to F/W */
+        /* Used for extended sense / status continuation */
+        uint8_t *req_sense_ptr;
+        uint16_t req_sense_len;
+        uint16_t reserved2;
 };
 /*
@@ -302,7 +306,6 @@ struct scsi_qla_host {
        uint32_t tot_ddbs;
        uint16_t        iocb_cnt;
-        uint16_t        iocb_hiwat;
        /* SRB cache. */
 #define SRB_MIN_REQ     128
@@ -436,6 +439,8 @@ struct scsi_qla_host {
        /* Map ddb_list entry by FW ddb index */
        struct ddb_entry *fw_ddb_index_map[MAX_DDB_ENTRIES];
+        /* Saved srb for status continuation entry processing */
+        struct srb *status_srb;
 };
 static inline int is_qla4010(struct scsi_qla_host *ha)
diff --git a/drivers/scsi/qla4xxx/ql4_fw.h b/drivers/scsi/qla4xxx/ql4_fw.h
index 1b667a70cffa..9cd7a608df38 100644
--- a/drivers/scsi/qla4xxx/ql4_fw.h
+++ b/drivers/scsi/qla4xxx/ql4_fw.h
@@ -572,6 +572,7 @@ struct conn_event_log_entry {
 *************************************************************************/
 #define IOCB_MAX_CDB_LEN            16  /* Bytes in a CBD */
 #define IOCB_MAX_SENSEDATA_LEN      32  /* Bytes of sense data */
+#define IOCB_MAX_EXT_SENSEDATA_LEN  60  /* Bytes of extended sense data */
 /* IOCB header structure */
 struct qla4_header {
@@ -733,6 +734,12 @@ struct status_entry {
 };
+/* Status Continuation entry */
+struct status_cont_entry {
+       struct qla4_header hdr; /* 00-03 */
+       uint8_t ext_sense_data[IOCB_MAX_EXT_SENSEDATA_LEN]; /* 04-63 */
+};
 struct passthru0 {
        struct qla4_header hdr;                /* 00-03 */
        uint32_t handle;        /* 04-07 */
diff --git a/drivers/scsi/qla4xxx/ql4_iocb.c b/drivers/scsi/qla4xxx/ql4_iocb.c
index 912a67494adf..e0c32159749c 100644
--- a/drivers/scsi/qla4xxx/ql4_iocb.c
+++ b/drivers/scsi/qla4xxx/ql4_iocb.c
@@ -10,9 +10,42 @@
 #include "ql4_dbg.h"
 #include "ql4_inline.h"
 #include <scsi/scsi_tcq.h>
+static int
+qla4xxx_space_in_req_ring(struct scsi_qla_host *ha, uint16_t req_cnt)
+{
+        uint16_t cnt;
+        /* Calculate number of free request entries. */
+        if ((req_cnt + 2) >= ha->req_q_count) {
+                cnt = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
+                if (ha->request_in < cnt)
+                        ha->req_q_count = cnt - ha->request_in;
+                else
+                        ha->req_q_count = REQUEST_QUEUE_DEPTH -
+                                                (ha->request_in - cnt);
+        }
+        /* Check if room for request in request ring. */
+        if ((req_cnt + 2) < ha->req_q_count)
+                return 1;
+        else
+                return 0;
+}
+static void qla4xxx_advance_req_ring_ptr(struct scsi_qla_host *ha)
+{
+        /* Advance request queue pointer */
+        if (ha->request_in == (REQUEST_QUEUE_DEPTH - 1)) {
+                ha->request_in = 0;
+                ha->request_ptr = ha->request_ring;
+        } else {
+                ha->request_in++;
+                ha->request_ptr++;
+        }
+}
 /**
 * qla4xxx_get_req_pkt - returns a valid entry in request queue.
 * @ha: Pointer to host adapter structure.
@@ -26,35 +59,18 @@
 static int qla4xxx_get_req_pkt(struct scsi_qla_host *ha,
                               struct queue_entry **queue_entry)
 {
-        uint16_t request_in;
+        uint16_t req_cnt = 1;
-        uint8_t status = QLA_SUCCESS;
-        *queue_entry = ha->request_ptr;
-        /* get the latest request_in and request_out index */
+        if (qla4xxx_space_in_req_ring(ha, req_cnt)) {
-        request_in = ha->request_in;
+                *queue_entry = ha->request_ptr;
-        ha->request_out = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
-        /* Advance request queue pointer and check for queue full */
-        if (request_in == (REQUEST_QUEUE_DEPTH - 1)) {
-                request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else {
-                request_in++;
-                ha->request_ptr++;
-        }
-        /* request queue is full, try again later */
-        if ((ha->iocb_cnt + 1) >= ha->iocb_hiwat) {
-                /* restore request pointer */
-                ha->request_ptr = *queue_entry;
-                status = QLA_ERROR;
-        } else {
-                ha->request_in = request_in;
                memset(*queue_entry, 0, sizeof(**queue_entry));
+                qla4xxx_advance_req_ring_ptr(ha);
+                ha->req_q_count -= req_cnt;
+                return QLA_SUCCESS;
        }
-        return status;
+        return QLA_ERROR;
 }
 /**
@@ -100,21 +116,14 @@ exit_send_marker:
        return status;
 }
-static struct continuation_t1_entry* qla4xxx_alloc_cont_entry(
+static struct continuation_t1_entry *
-        struct scsi_qla_host *ha)
+qla4xxx_alloc_cont_entry(struct scsi_qla_host *ha)
 {
        struct continuation_t1_entry *cont_entry;
        cont_entry = (struct continuation_t1_entry *)ha->request_ptr;
-        /* Advance request queue pointer */
+        qla4xxx_advance_req_ring_ptr(ha);
-        if (ha->request_in == (REQUEST_QUEUE_DEPTH - 1)) {
-                ha->request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else {
-                ha->request_in++;
-                ha->request_ptr++;
-        }
        /* Load packet defaults */
        cont_entry->hdr.entryType = ET_CONTINUE;
@@ -197,13 +206,10 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        struct scsi_cmnd *cmd = srb->cmd;
        struct ddb_entry *ddb_entry;
        struct command_t3_entry *cmd_entry;
        int nseg;
        uint16_t tot_dsds;
        uint16_t req_cnt;
        unsigned long flags;
-        uint16_t cnt;
        uint32_t index;
        char tag[2];
@@ -217,6 +223,19 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        index = (uint32_t)cmd->request->tag;
+        /*
+         * Check to see if adapter is online before placing request on
+         * request queue.  If a reset occurs and a request is in the queue,
+         * the firmware will still attempt to process the request, retrieving
+         * garbage for pointers.
+         */
+        if (!test_bit(AF_ONLINE, &ha->flags)) {
+                DEBUG2(printk("scsi%ld: %s: Adapter OFFLINE! "
+                              "Do not issue command.\n",
+                              ha->host_no, __func__));
+                goto queuing_error;
+        }
        /* Calculate the number of request entries needed. */
        nseg = scsi_dma_map(cmd);
        if (nseg < 0)
@@ -224,17 +243,7 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
        tot_dsds = nseg;
        req_cnt = qla4xxx_calc_request_entries(tot_dsds);
+        if (!qla4xxx_space_in_req_ring(ha, req_cnt))
-        if (ha->req_q_count < (req_cnt + 2)) {
-                cnt = (uint16_t) le32_to_cpu(ha->shadow_regs->req_q_out);
-                if (ha->request_in < cnt)
-                        ha->req_q_count = cnt - ha->request_in;
-                else
-                        ha->req_q_count = REQUEST_QUEUE_DEPTH -
-                                (ha->request_in - cnt);
-        }
-        if (ha->req_q_count < (req_cnt + 2))
                goto queuing_error;
        /* total iocbs active */
@@ -286,32 +295,10 @@ int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb)
                        break;
                }
+        qla4xxx_advance_req_ring_ptr(ha);
-        /* Advance request queue pointer */
-        ha->request_in++;
-        if (ha->request_in == REQUEST_QUEUE_DEPTH) {
-                ha->request_in = 0;
-                ha->request_ptr = ha->request_ring;
-        } else
-                ha->request_ptr++;
        qla4xxx_build_scsi_iocbs(srb, cmd_entry, tot_dsds);
        wmb();
-        /*
-         * Check to see if adapter is online before placing request on
-         * request queue.  If a reset occurs and a request is in the queue,
-         * the firmware will still attempt to process the request, retrieving
-         * garbage for pointers.
-         */
-        if (!test_bit(AF_ONLINE, &ha->flags)) {
-                DEBUG2(printk("scsi%ld: %s: Adapter OFFLINE! "
-                              "Do not issue command.\n",
-                              ha->host_no, __func__));
-                goto queuing_error;
-        }
        srb->cmd->host_scribble = (unsigned char *)srb;
        /* update counters */
diff --git a/drivers/scsi/qla4xxx/ql4_isr.c b/drivers/scsi/qla4xxx/ql4_isr.c
index 799120fcb9be..8025ee16588e 100644
--- a/drivers/scsi/qla4xxx/ql4_isr.c
+++ b/drivers/scsi/qla4xxx/ql4_isr.c
@@ -11,6 +11,98 @@
 #include "ql4_inline.h"
 /**
+ * qla4xxx_copy_sense - copy sense data into cmd sense buffer
+ * @ha: Pointer to host adapter structure.
+ * @sts_entry: Pointer to status entry structure.
+ * @srb: Pointer to srb structure.
+ **/
+static void qla4xxx_copy_sense(struct scsi_qla_host *ha,
+                               struct status_entry *sts_entry,
+                               struct srb *srb)
+{
+        struct scsi_cmnd *cmd = srb->cmd;
+        uint16_t sense_len;
+        memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+        sense_len = le16_to_cpu(sts_entry->senseDataByteCnt);
+        if (sense_len == 0)
+                return;
+        /* Save total available sense length,
+         * not to exceed cmd's sense buffer size */
+        sense_len = min_t(uint16_t, sense_len, SCSI_SENSE_BUFFERSIZE);
+        srb->req_sense_ptr = cmd->sense_buffer;
+        srb->req_sense_len = sense_len;
+        /* Copy sense from sts_entry pkt */
+        sense_len = min_t(uint16_t, sense_len, IOCB_MAX_SENSEDATA_LEN);
+        memcpy(cmd->sense_buffer, sts_entry->senseData, sense_len);
+        DEBUG2(printk(KERN_INFO "scsi%ld:%d:%d:%d: %s: sense key = %x, "
+                "ASL= %02x, ASC/ASCQ = %02x/%02x\n", ha->host_no,
+                cmd->device->channel, cmd->device->id,
+                cmd->device->lun, __func__,
+                sts_entry->senseData[2] & 0x0f,
+                sts_entry->senseData[7],
+                sts_entry->senseData[12],
+                sts_entry->senseData[13]));
+        DEBUG5(qla4xxx_dump_buffer(cmd->sense_buffer, sense_len));
+        srb->flags |= SRB_GOT_SENSE;
+        /* Update srb, in case a sts_cont pkt follows */
+        srb->req_sense_ptr += sense_len;
+        srb->req_sense_len -= sense_len;
+        if (srb->req_sense_len != 0)
+                ha->status_srb = srb;
+        else
+                ha->status_srb = NULL;
+}
+/**
+ * qla4xxx_status_cont_entry - Process a Status Continuations entry.
+ * @ha: SCSI driver HA context
+ * @sts_cont: Entry pointer
+ *
+ * Extended sense data.
+ */
+static void
+qla4xxx_status_cont_entry(struct scsi_qla_host *ha,
+                          struct status_cont_entry *sts_cont)
+{
+        struct srb *srb = ha->status_srb;
+        struct scsi_cmnd *cmd;
+        uint8_t sense_len;
+        if (srb == NULL)
+                return;
+        cmd = srb->cmd;
+        if (cmd == NULL) {
+                DEBUG2(printk(KERN_INFO "scsi%ld: %s: Cmd already returned "
+                        "back to OS srb=%p srb->state:%d\n", ha->host_no,
+                        __func__, srb, srb->state));
+                ha->status_srb = NULL;
+                return;
+        }
+        /* Copy sense data. */
+        sense_len = min_t(uint16_t, srb->req_sense_len,
+                          IOCB_MAX_EXT_SENSEDATA_LEN);
+        memcpy(srb->req_sense_ptr, sts_cont->ext_sense_data, sense_len);
+        DEBUG5(qla4xxx_dump_buffer(srb->req_sense_ptr, sense_len));
+        srb->req_sense_ptr += sense_len;
+        srb->req_sense_len -= sense_len;
+        /* Place command on done queue. */
+        if (srb->req_sense_len == 0) {
+                qla4xxx_srb_compl(ha, srb);
+                ha->status_srb = NULL;
+        }
+}
+/**
 * qla4xxx_status_entry - processes status IOCBs
 * @ha: Pointer to host adapter structure.
 * @sts_entry: Pointer to status entry structure.
@@ -23,7 +115,6 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
        struct srb *srb;
        struct ddb_entry *ddb_entry;
        uint32_t residual;
-        uint16_t sensebytecnt;
        srb = qla4xxx_del_from_active_array(ha, le32_to_cpu(sts_entry->handle));
        if (!srb) {
@@ -92,24 +183,7 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
                        break;
                /* Copy Sense Data into sense buffer. */
-                memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+                qla4xxx_copy_sense(ha, sts_entry, srb);
-                sensebytecnt = le16_to_cpu(sts_entry->senseDataByteCnt);
-                if (sensebytecnt == 0)
-                        break;
-                memcpy(cmd->sense_buffer, sts_entry->senseData,
-                       min_t(uint16_t, sensebytecnt, SCSI_SENSE_BUFFERSIZE));
-                DEBUG2(printk("scsi%ld:%d:%d:%d: %s: sense key = %x, "
-                              "ASC/ASCQ = %02x/%02x\n", ha->host_no,
-                              cmd->device->channel, cmd->device->id,
-                              cmd->device->lun, __func__,
-                              sts_entry->senseData[2] & 0x0f,
-                              sts_entry->senseData[12],
-                              sts_entry->senseData[13]));
-                srb->flags |= SRB_GOT_SENSE;
                break;
        case SCS_INCOMPLETE:
@@ -176,23 +250,7 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
                                break;
                        /* Copy Sense Data into sense buffer. */
-                        memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
+                        qla4xxx_copy_sense(ha, sts_entry, srb);
-                        sensebytecnt =
-                                le16_to_cpu(sts_entry->senseDataByteCnt);
-                        if (sensebytecnt == 0)
-                                break;
-                        memcpy(cmd->sense_buffer, sts_entry->senseData,
-                               min_t(uint16_t, sensebytecnt, SCSI_SENSE_BUFFERSIZE));
-                        DEBUG2(printk("scsi%ld:%d:%d:%d: %s: sense key = %x, "
-                                      "ASC/ASCQ = %02x/%02x\n", ha->host_no,
-                                      cmd->device->channel, cmd->device->id,
-                                      cmd->device->lun, __func__,
-                                      sts_entry->senseData[2] & 0x0f,
-                                      sts_entry->senseData[12],
-                                      sts_entry->senseData[13]));
                } else {
                        /*
                         * If RISC reports underrun and target does not
@@ -268,9 +326,10 @@ static void qla4xxx_status_entry(struct scsi_qla_host *ha,
 status_entry_exit:
-        /* complete the request */
+        /* complete the request, if not waiting for status_continuation pkt */
        srb->cc_stat = sts_entry->completionStatus;
-        qla4xxx_srb_compl(ha, srb);
+        if (ha->status_srb == NULL)
+                qla4xxx_srb_compl(ha, srb);
 }
 /**
@@ -305,10 +364,7 @@ static void qla4xxx_process_response_queue(struct scsi_qla_host * ha)
                /* process entry */
                switch (sts_entry->hdr.entryType) {
                case ET_STATUS:
-                        /*
+                        /* Common status */
-                         * Common status - Single completion posted in single
-                         * IOSB.
-                         */
                        qla4xxx_status_entry(ha, sts_entry);
                        break;
@@ -316,9 +372,8 @@ static void qla4xxx_process_response_queue(struct scsi_qla_host * ha)
                        break;
                case ET_STATUS_CONTINUATION:
-                        /* Just throw away the status continuation entries */
+                        qla4xxx_status_cont_entry(ha,
-                        DEBUG2(printk("scsi%ld: %s: Status Continuation entry "
+                                (struct status_cont_entry *) sts_entry);
-                                      "- ignoring\n", ha->host_no, __func__));
                        break;
                case ET_COMMAND:
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index 051b0f5e8c8e..09d6d4b76f39 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -385,16 +385,6 @@ int qla4xxx_get_firmware_status(struct scsi_qla_host * ha)
                              mbox_sts[0]));
                return QLA_ERROR;
        }
-        /* High-water mark of IOCBs */
-        ha->iocb_hiwat = mbox_sts[2];
-        if (ha->iocb_hiwat > IOCB_HIWAT_CUSHION)
-                ha->iocb_hiwat -= IOCB_HIWAT_CUSHION;
-        else
-                dev_info(&ha->pdev->dev, "WARNING!!!  You have less than %d "
-                           "firmware IOCBs available (%d).\n",
-                           IOCB_HIWAT_CUSHION, ha->iocb_hiwat);
        return QLA_SUCCESS;
 }
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index ec9da6ce8489..40e3cafb3a9c 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -66,6 +66,7 @@ static int qla4xxx_sess_get_param(struct iscsi_cls_session *sess,
 static int qla4xxx_host_get_param(struct Scsi_Host *shost,
                                  enum iscsi_host_param param, char *buf);
 static void qla4xxx_recovery_timedout(struct iscsi_cls_session *session);
+static enum blk_eh_timer_return qla4xxx_eh_cmd_timed_out(struct scsi_cmnd *sc);
 /*
 * SCSI host template entry points
@@ -89,6 +90,7 @@ static struct scsi_host_template qla4xxx_driver_template = {
        .eh_device_reset_handler = qla4xxx_eh_device_reset,
        .eh_target_reset_handler = qla4xxx_eh_target_reset,
        .eh_host_reset_handler  = qla4xxx_eh_host_reset,
+        .eh_timed_out           = qla4xxx_eh_cmd_timed_out,
        .slave_configure        = qla4xxx_slave_configure,
        .slave_alloc            = qla4xxx_slave_alloc,
@@ -124,6 +126,21 @@ static struct iscsi_transport qla4xxx_iscsi_transport = {
 static struct scsi_transport_template *qla4xxx_scsi_transport;
+static enum blk_eh_timer_return qla4xxx_eh_cmd_timed_out(struct scsi_cmnd *sc)
+{
+        struct iscsi_cls_session *session;
+        struct ddb_entry *ddb_entry;
+        session = starget_to_session(scsi_target(sc->device));
+        ddb_entry = session->dd_data;
+        /* if we are not logged in then the LLD is going to clean up the cmd */
+        if (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)
+                return BLK_EH_RESET_TIMER;
+        else
+                return BLK_EH_NOT_HANDLED;
+}
 static void qla4xxx_recovery_timedout(struct iscsi_cls_session *session)
 {
        struct ddb_entry *ddb_entry = session->dd_data;
@@ -904,18 +921,17 @@ static int qla4xxx_recover_adapter(struct scsi_qla_host *ha,
        /* Flush any pending ddb changed AENs */
        qla4xxx_process_aen(ha, FLUSH_DDB_CHANGED_AENS);
+        qla4xxx_flush_active_srbs(ha);
        /* Reset the firmware.  If successful, function
         * returns with ISP interrupts enabled.
         */
-        if (status == QLA_SUCCESS) {
+        DEBUG2(printk("scsi%ld: %s - Performing soft reset..\n",
-                DEBUG2(printk("scsi%ld: %s - Performing soft reset..\n",
+                      ha->host_no, __func__));
-                              ha->host_no, __func__));
+        if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
-                qla4xxx_flush_active_srbs(ha);
+                status = qla4xxx_soft_reset(ha);
-                if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
+        else
-                        status = qla4xxx_soft_reset(ha);
+                status = QLA_ERROR;
-                else
-                        status = QLA_ERROR;
-        }
        /* Flush any pending ddb changed AENs */
        qla4xxx_process_aen(ha, FLUSH_DDB_CHANGED_AENS);
@@ -1527,11 +1543,9 @@ static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd)
 {
        struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
        struct ddb_entry *ddb_entry = cmd->device->hostdata;
-        struct srb *sp;
        int ret = FAILED, stat;
-        sp = (struct srb *) cmd->SCp.ptr;
+        if (!ddb_entry)
-        if (!sp || !ddb_entry)
                return ret;
        dev_info(&ha->pdev->dev,
@@ -1644,7 +1658,7 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd)
        ha = (struct scsi_qla_host *) cmd->device->host->hostdata;
        dev_info(&ha->pdev->dev,
-                   "scsi(%ld:%d:%d:%d): ADAPTER RESET ISSUED.\n", ha->host_no,
+                   "scsi(%ld:%d:%d:%d): HOST RESET ISSUED.\n", ha->host_no,
                   cmd->device->channel, cmd->device->id, cmd->device->lun);
        if (qla4xxx_wait_for_hba_online(ha) != QLA_SUCCESS) {
diff --git a/drivers/scsi/qla4xxx/ql4_version.h b/drivers/scsi/qla4xxx/ql4_version.h
index ab984cb89cea..6980cb279c81 100644
--- a/drivers/scsi/qla4xxx/ql4_version.h
+++ b/drivers/scsi/qla4xxx/ql4_version.h
@@ -5,5 +5,5 @@
 * See LICENSE.qla4xxx for copyright and licensing details.
 */
-#define QLA4XXX_DRIVER_VERSION  "5.01.00-k8"
+#define QLA4XXX_DRIVER_VERSION  "5.01.00-k9"
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 783e33c65eb7..b47240ca4b19 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -990,7 +990,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
        struct iscsi_uevent *ev;
        int len = NLMSG_SPACE(sizeof(*ev) + data_size);
-        skb = alloc_skb(len, GFP_NOIO);
+        skb = alloc_skb(len, GFP_ATOMIC);
        if (!skb) {
                printk(KERN_ERR "can not deliver iscsi offload message:OOM\n");
                return -ENOMEM;
@@ -1012,7 +1012,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
        memcpy((char *)ev + sizeof(*ev), data, data_size);
-        return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_NOIO);
+        return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_ATOMIC);
 }
 EXPORT_SYMBOL_GPL(iscsi_offload_mesg);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 5616cd780ff3..b7b9fec67a98 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1840,6 +1840,18 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp)
        kfree(buffer);
 }
+static int sd_try_extended_inquiry(struct scsi_device *sdp)
+{
+        /*
+         * Although VPD inquiries can go to SCSI-2 type devices,
+         * some USB ones crash on receiving them, and the pages
+         * we currently ask for are for SPC-3 and beyond
+         */
+        if (sdp->scsi_level > SCSI_SPC_2)
+                return 1;
+        return 0;
+}
 /**
 *      sd_revalidate_disk - called the first time a new disk is seen,
 *      performs disk spin up, read_capacity, etc.
@@ -1877,8 +1889,12 @@ static int sd_revalidate_disk(struct gendisk *disk)
         */
        if (sdkp->media_present) {
                sd_read_capacity(sdkp, buffer);
-                sd_read_block_limits(sdkp);
-                sd_read_block_characteristics(sdkp);
+                if (sd_try_extended_inquiry(sdp)) {
+                        sd_read_block_limits(sdkp);
+                        sd_read_block_characteristics(sdkp);
+                }
                sd_read_write_protect_flag(sdkp, buffer);
                sd_read_cache_type(sdkp, buffer);
                sd_read_app_tag_own(sdkp, buffer);
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index ef7870f5ea08..857b3668b3ba 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -957,9 +957,14 @@ static int __devinit sticore_pci_init(struct pci_dev *pd,
 #ifdef CONFIG_PCI
        unsigned long fb_base, rom_base;
        unsigned int fb_len, rom_len;
+        int err;
        struct sti_struct *sti;
        
-        pci_enable_device(pd);
+        err = pci_enable_device(pd);
+        if (err < 0) {
+                dev_err(&pd->dev, "Cannot enable PCI device\n");
+                return err;
+        }
        fb_base = pci_resource_start(pd, 0);
        fb_len = pci_resource_len(pd, 0);
@@ -1048,7 +1053,7 @@ static void __devinit sti_init_roms(void)
        /* Register drivers for native & PCI cards */
        register_parisc_driver(&pa_sti_driver);
-        pci_register_driver(&pci_sti_driver);
+        WARN_ON(pci_register_driver(&pci_sti_driver));
        /* if we didn't find the given default sti, take the first one */
        if (!default_sti)
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 92888aa90749..e85b1e4389e0 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,10 @@
+Version 1.60
+-------------
+Fix memory leak in reconnect.  Fix oops in DFS mount error path.
+Set s_maxbytes to smaller (the max that vfs can handle) so that
+sendfile will now work over cifs mounts again.  Add noforcegid
+and noforceuid mount parameters.
 Version 1.59
 ------------
 Client uses server inode numbers (which are persistent) rather than
diff --git a/fs/cifs/README b/fs/cifs/README
index ad92921dbde4..79c1a93400be 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -262,11 +262,11 @@ A partial list of the supported mount options follows:
                mount.  
  domain        Set the SMB/CIFS workgroup name prepended to the
                username during CIFS session establishment
-  forceuid      Set the default uid for inodes based on the uid
+  forceuid      Set the default uid for inodes to the uid
-                passed in. For mounts to servers
+                passed in on mount. For mounts to servers
                which do support the CIFS Unix extensions, such as a
                properly configured Samba server, the server provides
-                the uid, gid and mode so this parameter should  not be
+                the uid, gid and mode so this parameter should not be
                specified unless the server and clients uid and gid
                numbering differ.  If the server and client are in the
                same domain (e.g. running winbind or nss_ldap) and
@@ -278,11 +278,7 @@ A partial list of the supported mount options follows:
                of existing files will be the uid (gid) of the person
                who executed the mount (root, except when mount.cifs
                is configured setuid for user mounts) unless the "uid=" 
-                (gid) mount option is specified.  For the uid (gid) of newly
+                (gid) mount option is specified. Also note that permission
-                created files and directories, ie files created since 
-                the last mount of the server share, the expected uid 
-                (gid) is cached as long as the inode remains in 
-                memory on the client.   Also note that permission
                checks (authorization checks) on accesses to a file occur
                at the server, but there are cases in which an administrator
                may want to restrict at the client as well.  For those
@@ -290,12 +286,15 @@ A partial list of the supported mount options follows:
                (such as Windows), permissions can also be checked at the
                client, and a crude form of client side permission checking 
                can be enabled by specifying file_mode and dir_mode on 
-                the client.  Note that the mount.cifs helper must be
+                the client.  (default)
-                at version 1.10 or higher to support specifying the uid
+  forcegid      (similar to above but for the groupid instead of uid) (default)
-                (or gid) in non-numeric form.
+  noforceuid    Fill in file owner information (uid) by requesting it from
-  forcegid      (similar to above but for the groupid instead of uid)
+                the server if possible. With this option, the value given in
+                the uid= option (on mount) will only be used if the server
+                can not support returning uids on inodes.
+  noforcegid    (similar to above but for the group owner, gid, instead of uid)
  uid           Set the default uid for inodes, and indicate to the
-                cifs kernel driver which local user mounted . If the server
+                cifs kernel driver which local user mounted. If the server
                supports the unix extensions the default uid is
                not used to fill in the owner fields of inodes (files)
                unless the "forceuid" parameter is specified.
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 3bb11be8b6a8..606912d8f2a8 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -55,7 +55,7 @@ void cifs_dfs_release_automount_timer(void)
 * i.e. strips from UNC trailing path that is not part of share
 * name and fixup missing '\' in the begining of DFS node refferal
 * if neccessary.
- * Returns pointer to share name on success or NULL on error.
+ * Returns pointer to share name on success or ERR_PTR on error.
 * Caller is responsible for freeing returned string.
 */
 static char *cifs_get_share_name(const char *node_name)
@@ -68,7 +68,7 @@ static char *cifs_get_share_name(const char *node_name)
        UNC = kmalloc(len+2 /*for term null and additional \ if it's missed */,
                         GFP_KERNEL);
        if (!UNC)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        /* get share name and server name */
        if (node_name[1] != '\\') {
@@ -87,7 +87,7 @@ static char *cifs_get_share_name(const char *node_name)
                cERROR(1, ("%s: no server name end in node name: %s",
                        __func__, node_name));
                kfree(UNC);
-                return NULL;
+                return ERR_PTR(-EINVAL);
        }
        /* find sharename end */
@@ -133,6 +133,12 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
                return ERR_PTR(-EINVAL);
        *devname = cifs_get_share_name(ref->node_name);
+        if (IS_ERR(*devname)) {
+                rc = PTR_ERR(*devname);
+                *devname = NULL;
+                goto compose_mount_options_err;
+        }
        rc = dns_resolve_server_name_to_ip(*devname, &srvIP);
        if (rc != 0) {
                cERROR(1, ("%s: Failed to resolve server part of %s to IP: %d",
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 60e3c4253de0..714a542cbafc 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -44,7 +44,7 @@ cifs_ucs2_bytes(const __le16 *from, int maxbytes,
        int maxwords = maxbytes / 2;
        char tmp[NLS_MAX_CHARSET_SIZE];
-        for (i = 0; from[i] && i < maxwords; i++) {
+        for (i = 0; i < maxwords && from[i]; i++) {
                charlen = codepage->uni2char(le16_to_cpu(from[i]), tmp,
                                             NLS_MAX_CHARSET_SIZE);
                if (charlen > 0)
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 44f30504b82d..84b75253b05a 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -376,10 +376,14 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
        seq_printf(s, ",uid=%d", cifs_sb->mnt_uid);
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_UID)
                seq_printf(s, ",forceuid");
+        else
+                seq_printf(s, ",noforceuid");
        seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID)
                seq_printf(s, ",forcegid");
+        else
+                seq_printf(s, ",noforcegid");
        cifs_show_address(s, tcon->ses->server);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index fc44d316d0bb..1f3345d7fa79 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -803,6 +803,10 @@ cifs_parse_mount_options(char *options, const char *devname,
        char *data;
        unsigned int  temp_len, i, j;
        char separator[2];
+        short int override_uid = -1;
+        short int override_gid = -1;
+        bool uid_specified = false;
+        bool gid_specified = false;
        separator[0] = ',';
        separator[1] = 0;
@@ -1093,18 +1097,20 @@ cifs_parse_mount_options(char *options, const char *devname,
                                                    "too long.\n");
                                return 1;
                        }
-                } else if (strnicmp(data, "uid", 3) == 0) {
+                } else if (!strnicmp(data, "uid", 3) && value && *value) {
-                        if (value && *value)
+                        vol->linux_uid = simple_strtoul(value, &value, 0);
-                                vol->linux_uid =
+                        uid_specified = true;
-                                        simple_strtoul(value, &value, 0);
+                } else if (!strnicmp(data, "forceuid", 8)) {
-                } else if (strnicmp(data, "forceuid", 8) == 0) {
+                        override_uid = 1;
-                                vol->override_uid = 1;
+                } else if (!strnicmp(data, "noforceuid", 10)) {
-                } else if (strnicmp(data, "gid", 3) == 0) {
+                        override_uid = 0;
-                        if (value && *value)
+                } else if (!strnicmp(data, "gid", 3) && value && *value) {
-                                vol->linux_gid =
+                        vol->linux_gid = simple_strtoul(value, &value, 0);
-                                        simple_strtoul(value, &value, 0);
+                        gid_specified = true;
-                } else if (strnicmp(data, "forcegid", 8) == 0) {
+                } else if (!strnicmp(data, "forcegid", 8)) {
-                                vol->override_gid = 1;
+                        override_gid = 1;
+                } else if (!strnicmp(data, "noforcegid", 10)) {
+                        override_gid = 0;
                } else if (strnicmp(data, "file_mode", 4) == 0) {
                        if (value && *value) {
                                vol->file_mode =
@@ -1355,6 +1361,18 @@ cifs_parse_mount_options(char *options, const char *devname,
        if (vol->UNCip == NULL)
                vol->UNCip = &vol->UNC[2];
+        if (uid_specified)
+                vol->override_uid = override_uid;
+        else if (override_uid == 1)
+                printk(KERN_NOTICE "CIFS: ignoring forceuid mount option "
+                                   "specified with no uid= option.\n");
+        if (gid_specified)
+                vol->override_gid = override_gid;
+        else if (override_gid == 1)
+                printk(KERN_NOTICE "CIFS: ignoring forcegid mount option "
+                                   "specified with no gid= option.\n");
        return 0;
 }
@@ -2544,11 +2562,20 @@ remote_path_check:
                        if (mount_data != mount_data_global)
                                kfree(mount_data);
                        mount_data = cifs_compose_mount_options(
                                        cifs_sb->mountdata, full_path + 1,
                                        referrals, &fake_devname);
-                        kfree(fake_devname);
                        free_dfs_info_array(referrals, num_referrals);
+                        kfree(fake_devname);
+                        kfree(full_path);
+                        if (IS_ERR(mount_data)) {
+                                rc = PTR_ERR(mount_data);
+                                mount_data = NULL;
+                                goto mount_fail_check;
+                        }
                        if (tcon)
                                cifs_put_tcon(tcon);
@@ -2556,8 +2583,6 @@ remote_path_check:
                                cifs_put_smb_ses(pSesInfo);
                        cleanup_volume_info(&volume_info);
-                        FreeXid(xid);
-                        kfree(full_path);
                        referral_walks_count++;
                        goto try_mount_again;
                }
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 3d3ddb3f5177..2dfd47714ae5 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -412,8 +412,10 @@ nilfs_mdt_write_page(struct page *page, struct writeback_control *wbc)
                return 0; /* Do not request flush for shadow page cache */
        if (!sb) {
                writer = nilfs_get_writer(NILFS_MDT(inode)->mi_nilfs);
-                if (!writer)
+                if (!writer) {
+                        nilfs_put_writer(NILFS_MDT(inode)->mi_nilfs);
                        return -EROFS;
+                }
                sb = writer->s_super;
        }
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 8b5e4778cf28..51ff3d0a4ee2 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1859,12 +1859,26 @@ static void nilfs_end_page_io(struct page *page, int err)
        if (!page)
                return;
-        if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page))
+        if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page)) {
                /*
                 * For b-tree node pages, this function may be called twice
                 * or more because they might be split in a segment.
                 */
+                if (PageDirty(page)) {
+                        /*
+                         * For pages holding split b-tree node buffers, dirty
+                         * flag on the buffers may be cleared discretely.
+                         * In that case, the page is once redirtied for
+                         * remaining buffers, and it must be cancelled if
+                         * all the buffers get cleaned later.
+                         */
+                        lock_page(page);
+                        if (nilfs_page_buffers_clean(page))
+                                __nilfs_clear_page_dirty(page);
+                        unlock_page(page);
+                }
                return;
+        }
        __nilfs_end_page_io(page, err);
 }
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 7174818c2c13..9d4c00491547 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -257,9 +257,12 @@
        {0x1002, 0x940F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R600|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94A1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94B1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94B3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94B4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x94B5, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x94B9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV740|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9440, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9441, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9442, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
@@ -288,6 +291,7 @@
        {0x1002, 0x948F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9490, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9491, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9495, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9498, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x949C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x949E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV730|RADEON_NEW_MEMMAP}, \
@@ -325,6 +329,7 @@
        {0x1002, 0x9552, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9553, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9555, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9557, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV710|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9580, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9581, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x9583, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV630|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index e7cb5dbf6c26..69103e053c92 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -913,6 +913,7 @@ extern void blk_queue_logical_block_size(struct request_queue *, unsigned short)
 extern void blk_queue_physical_block_size(struct request_queue *, unsigned short);
 extern void blk_queue_alignment_offset(struct request_queue *q,
                                       unsigned int alignment);
+extern void blk_limits_io_min(struct queue_limits *limits, unsigned int min);
 extern void blk_queue_io_min(struct request_queue *q, unsigned int min);
 extern void blk_queue_io_opt(struct request_queue *q, unsigned int opt);
 extern void blk_set_default_limits(struct queue_limits *lim);
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index acef2a770b6b..ad27c7da8798 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -82,7 +82,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 #define IN_DEV_FORWARD(in_dev)          IN_DEV_CONF_GET((in_dev), FORWARDING)
 #define IN_DEV_MFORWARD(in_dev)         IN_DEV_ANDCONF((in_dev), MC_FORWARDING)
-#define IN_DEV_RPFILTER(in_dev)         IN_DEV_ANDCONF((in_dev), RP_FILTER)
+#define IN_DEV_RPFILTER(in_dev)         IN_DEV_MAXCONF((in_dev), RP_FILTER)
 #define IN_DEV_SOURCE_ROUTE(in_dev)     IN_DEV_ANDCONF((in_dev), \
                                                       ACCEPT_SOURCE_ROUTE)
 #define IN_DEV_BOOTP_RELAY(in_dev)      IN_DEV_ANDCONF((in_dev), BOOTP_RELAY)
diff --git a/include/linux/perf_counter.h b/include/linux/perf_counter.h
index bd15d7a5f5ce..e604e6ef72dd 100644
--- a/include/linux/perf_counter.h
+++ b/include/linux/perf_counter.h
@@ -181,8 +181,9 @@ struct perf_counter_attr {
                                freq           :  1, /* use freq, not period  */
                                inherit_stat   :  1, /* per task counts       */
                                enable_on_exec :  1, /* next exec enables     */
+                                task           :  1, /* trace fork/exit       */
-                                __reserved_1   : 51;
+                                __reserved_1   : 50;
        __u32                   wakeup_events;  /* wakeup every n events */
        __u32                   __reserved_2;
@@ -311,6 +312,15 @@ enum perf_event_type {
        /*
         * struct {
         *      struct perf_event_header        header;
+         *      u32                             pid, ppid;
+         *      u32                             tid, ptid;
+         * };
+         */
+        PERF_EVENT_EXIT                 = 4,
+        /*
+         * struct {
+         *      struct perf_event_header        header;
         *      u64                             time;
         *      u64                             id;
         *      u64                             stream_id;
@@ -323,6 +333,7 @@ enum perf_event_type {
         * struct {
         *      struct perf_event_header        header;
         *      u32                             pid, ppid;
+         *      u32                             tid, ptid;
         * };
         */
        PERF_EVENT_FORK                 = 7,
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 80072611d26a..c274993234e3 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -355,7 +355,17 @@ struct rfcomm_dev_list_req {
 };
 int  rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+#ifdef CONFIG_BT_RFCOMM_TTY
 int  rfcomm_init_ttys(void);
 void rfcomm_cleanup_ttys(void);
+#else
+static inline int rfcomm_init_ttys(void)
+{
+        return 0;
+}
+static inline void rfcomm_cleanup_ttys(void)
+{
+}
+#endif
 #endif /* __RFCOMM_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 1a21895b732b..d1892d66701a 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -979,6 +979,10 @@ struct cfg80211_ops {
 *      channels at a later time. This can be used for devices which do not
 *      have calibration information gauranteed for frequencies or settings
 *      outside of its regulatory domain.
+ * @disable_beacon_hints: enable this if your driver needs to ensure that
+ *      passive scan flags and beaconing flags may not be lifted by cfg80211
+ *      due to regulatory beacon hints. For more information on beacon
+ *      hints read the documenation for regulatory_hint_found_beacon()
 * @reg_notifier: the driver's regulatory notification callback
 * @regd: the driver's regulatory domain, if one was requested via
 *      the regulatory_hint() API. This can be used by the driver
@@ -1004,6 +1008,7 @@ struct wiphy {
        bool custom_regulatory;
        bool strict_regulatory;
+        bool disable_beacon_hints;
        enum cfg80211_signal_type signal_type;
diff --git a/init/Kconfig b/init/Kconfig
index cb2c09270226..3f7e60995c80 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -940,6 +940,7 @@ menu "Performance Counters"
 config PERF_COUNTERS
        bool "Kernel Performance Counters"
+        default y if PROFILING
        depends on HAVE_PERF_COUNTERS
        select ANON_INODES
        help
@@ -961,9 +962,17 @@ config PERF_COUNTERS
          Say Y if unsure.
 config EVENT_PROFILE
-        bool "Tracepoint profile sources"
+        bool "Tracepoint profiling sources"
        depends on PERF_COUNTERS && EVENT_TRACING
        default y
+        help
+         Allow the use of tracepoints as software performance counters.
+         When this is enabled, you can create perf counters based on
+         tracepoints using PERF_TYPE_TRACEPOINT and the tracepoint ID
+         found in debugfs://tracing/events/*/*/id. (The -e/--events
+         option to the perf tool can parse and interpret symbolic
+         tracepoints, in the subsystem:tracepoint_name format.)
 endmenu
diff --git a/kernel/fork.c b/kernel/fork.c
index 29b532e718f7..466531eb92cc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1269,6 +1269,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        write_unlock_irq(&tasklist_lock);
        proc_fork_connector(p);
        cgroup_post_fork(p);
+        perf_counter_fork(p);
        return p;
 bad_fork_free_pid:
@@ -1410,9 +1411,6 @@ long do_fork(unsigned long clone_flags,
                        init_completion(&vfork);
                }
-                if (!(clone_flags & CLONE_THREAD))
-                        perf_counter_fork(p);
                audit_finish_fork(p);
                tracehook_report_clone(regs, clone_flags, nr, p);
diff --git a/kernel/panic.c b/kernel/panic.c
index 984b3ecbd72c..512ab73b0ca3 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -301,6 +301,7 @@ int oops_may_print(void)
 */
 void oops_enter(void)
 {
+        tracing_off();
        /* can't trust the integrity of the kernel anymore: */
        debug_locks_off();
        do_oops_enter_exit();
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index 950931041954..199ed4771315 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -42,6 +42,7 @@ static int perf_overcommit __read_mostly = 1;
 static atomic_t nr_counters __read_mostly;
 static atomic_t nr_mmap_counters __read_mostly;
 static atomic_t nr_comm_counters __read_mostly;
+static atomic_t nr_task_counters __read_mostly;
 /*
 * perf counter paranoia level:
@@ -1654,6 +1655,8 @@ static void free_counter(struct perf_counter *counter)
                        atomic_dec(&nr_mmap_counters);
                if (counter->attr.comm)
                        atomic_dec(&nr_comm_counters);
+                if (counter->attr.task)
+                        atomic_dec(&nr_task_counters);
        }
        if (counter->destroy)
@@ -1688,6 +1691,18 @@ static int perf_release(struct inode *inode, struct file *file)
        return 0;
 }
+static u64 perf_counter_read_tree(struct perf_counter *counter)
+{
+        struct perf_counter *child;
+        u64 total = 0;
+        total += perf_counter_read(counter);
+        list_for_each_entry(child, &counter->child_list, child_list)
+                total += perf_counter_read(child);
+        return total;
+}
 /*
 * Read the performance counter - simple non blocking version for now
 */
@@ -1707,7 +1722,7 @@ perf_read_hw(struct perf_counter *counter, char __user *buf, size_t count)
        WARN_ON_ONCE(counter->ctx->parent_ctx);
        mutex_lock(&counter->child_mutex);
-        values[0] = perf_counter_read(counter);
+        values[0] = perf_counter_read_tree(counter);
        n = 1;
        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
                values[n++] = counter->total_time_enabled +
@@ -2819,10 +2834,12 @@ perf_counter_read_event(struct perf_counter *counter,
 }
 /*
- * fork tracking
+ * task tracking -- fork/exit
+ *
+ * enabled by: attr.comm | attr.mmap | attr.task
 */
-struct perf_fork_event {
+struct perf_task_event {
        struct task_struct      *task;
        struct {
@@ -2830,37 +2847,42 @@ struct perf_fork_event {
                u32                             pid;
                u32                             ppid;
+                u32                             tid;
+                u32                             ptid;
        } event;
 };
-static void perf_counter_fork_output(struct perf_counter *counter,
+static void perf_counter_task_output(struct perf_counter *counter,
-                                     struct perf_fork_event *fork_event)
+                                     struct perf_task_event *task_event)
 {
        struct perf_output_handle handle;
-        int size = fork_event->event.header.size;
+        int size = task_event->event.header.size;
-        struct task_struct *task = fork_event->task;
+        struct task_struct *task = task_event->task;
        int ret = perf_output_begin(&handle, counter, size, 0, 0);
        if (ret)
                return;
-        fork_event->event.pid = perf_counter_pid(counter, task);
+        task_event->event.pid = perf_counter_pid(counter, task);
-        fork_event->event.ppid = perf_counter_pid(counter, task->real_parent);
+        task_event->event.ppid = perf_counter_pid(counter, task->real_parent);
-        perf_output_put(&handle, fork_event->event);
+        task_event->event.tid = perf_counter_tid(counter, task);
+        task_event->event.ptid = perf_counter_tid(counter, task->real_parent);
+        perf_output_put(&handle, task_event->event);
        perf_output_end(&handle);
 }
-static int perf_counter_fork_match(struct perf_counter *counter)
+static int perf_counter_task_match(struct perf_counter *counter)
 {
-        if (counter->attr.comm || counter->attr.mmap)
+        if (counter->attr.comm || counter->attr.mmap || counter->attr.task)
                return 1;
        return 0;
 }
-static void perf_counter_fork_ctx(struct perf_counter_context *ctx,
+static void perf_counter_task_ctx(struct perf_counter_context *ctx,
-                                  struct perf_fork_event *fork_event)
+                                  struct perf_task_event *task_event)
 {
        struct perf_counter *counter;
@@ -2869,19 +2891,19 @@ static void perf_counter_fork_ctx(struct perf_counter_context *ctx,
        rcu_read_lock();
        list_for_each_entry_rcu(counter, &ctx->event_list, event_entry) {
-                if (perf_counter_fork_match(counter))
+                if (perf_counter_task_match(counter))
-                        perf_counter_fork_output(counter, fork_event);
+                        perf_counter_task_output(counter, task_event);
        }
        rcu_read_unlock();
 }
-static void perf_counter_fork_event(struct perf_fork_event *fork_event)
+static void perf_counter_task_event(struct perf_task_event *task_event)
 {
        struct perf_cpu_context *cpuctx;
        struct perf_counter_context *ctx;
        cpuctx = &get_cpu_var(perf_cpu_context);
-        perf_counter_fork_ctx(&cpuctx->ctx, fork_event);
+        perf_counter_task_ctx(&cpuctx->ctx, task_event);
        put_cpu_var(perf_cpu_context);
        rcu_read_lock();
@@ -2891,32 +2913,40 @@ static void perf_counter_fork_event(struct perf_fork_event *fork_event)
         */
        ctx = rcu_dereference(current->perf_counter_ctxp);
        if (ctx)
-                perf_counter_fork_ctx(ctx, fork_event);
+                perf_counter_task_ctx(ctx, task_event);
        rcu_read_unlock();
 }
-void perf_counter_fork(struct task_struct *task)
+static void perf_counter_task(struct task_struct *task, int new)
 {
-        struct perf_fork_event fork_event;
+        struct perf_task_event task_event;
        if (!atomic_read(&nr_comm_counters) &&
-            !atomic_read(&nr_mmap_counters))
+            !atomic_read(&nr_mmap_counters) &&
+            !atomic_read(&nr_task_counters))
                return;
-        fork_event = (struct perf_fork_event){
+        task_event = (struct perf_task_event){
                .task   = task,
                .event  = {
                        .header = {
-                                .type = PERF_EVENT_FORK,
+                                .type = new ? PERF_EVENT_FORK : PERF_EVENT_EXIT,
                                .misc = 0,
-                                .size = sizeof(fork_event.event),
+                                .size = sizeof(task_event.event),
                        },
                        /* .pid  */
                        /* .ppid */
+                        /* .tid  */
+                        /* .ptid */
                },
        };
-        perf_counter_fork_event(&fork_event);
+        perf_counter_task_event(&task_event);
+}
+void perf_counter_fork(struct task_struct *task)
+{
+        perf_counter_task(task, 1);
 }
 /*
@@ -3875,6 +3905,8 @@ done:
                        atomic_inc(&nr_mmap_counters);
                if (counter->attr.comm)
                        atomic_inc(&nr_comm_counters);
+                if (counter->attr.task)
+                        atomic_inc(&nr_task_counters);
        }
        return counter;
@@ -4236,8 +4268,10 @@ void perf_counter_exit_task(struct task_struct *child)
        struct perf_counter_context *child_ctx;
        unsigned long flags;
-        if (likely(!child->perf_counter_ctxp))
+        if (likely(!child->perf_counter_ctxp)) {
+                perf_counter_task(child, 0);
                return;
+        }
        local_irq_save(flags);
        /*
@@ -4255,15 +4289,22 @@ void perf_counter_exit_task(struct task_struct *child)
         * incremented the context's refcount before we do put_ctx below.
         */
        spin_lock(&child_ctx->lock);
-        child->perf_counter_ctxp = NULL;
        /*
         * If this context is a clone; unclone it so it can't get
         * swapped to another process while we're removing all
         * the counters from it.
         */
        unclone_ctx(child_ctx);
-        spin_unlock(&child_ctx->lock);
+        spin_unlock_irqrestore(&child_ctx->lock, flags);
-        local_irq_restore(flags);
+        /*
+         * Report the task dead after unscheduling the counters so that we
+         * won't get any samples after PERF_EVENT_EXIT. We can however still
+         * get a few PERF_EVENT_READ events.
+         */
+        perf_counter_task(child, 0);
+        child->perf_counter_ctxp = NULL;
        /*
         * We can recurse on the same lock type through:
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 052ec4d195c7..d089d052c4a9 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -202,6 +202,12 @@ static int no_timer_create(struct k_itimer *new_timer)
        return -EOPNOTSUPP;
 }
+static int no_nsleep(const clockid_t which_clock, int flags,
+                     struct timespec *tsave, struct timespec __user *rmtp)
+{
+        return -EOPNOTSUPP;
+}
 /*
 * Return nonzero if we know a priori this clockid_t value is bogus.
 */
@@ -254,6 +260,7 @@ static __init int init_posix_timers(void)
                .clock_get = posix_get_monotonic_raw,
                .clock_set = do_posix_clock_nosettime,
                .timer_create = no_timer_create,
+                .nsleep = no_nsleep,
        };
        register_posix_clock(CLOCK_REALTIME, &clock_realtime);
diff --git a/kernel/sched_cpupri.c b/kernel/sched_cpupri.c
index e6c251790dde..d014efbf947a 100644
--- a/kernel/sched_cpupri.c
+++ b/kernel/sched_cpupri.c
@@ -81,8 +81,21 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p,
                if (cpumask_any_and(&p->cpus_allowed, vec->mask) >= nr_cpu_ids)
                        continue;
-                if (lowest_mask)
+                if (lowest_mask) {
                        cpumask_and(lowest_mask, &p->cpus_allowed, vec->mask);
+                        /*
+                         * We have to ensure that we have at least one bit
+                         * still set in the array, since the map could have
+                         * been concurrently emptied between the first and
+                         * second reads of vec->mask.  If we hit this
+                         * condition, simply act as though we never hit this
+                         * priority level and continue on.
+                         */
+                        if (cpumask_any(lowest_mask) >= nr_cpu_ids)
+                                continue;
+                }
                return 1;
        }
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 9ffb2b2ceba4..652e8bdef9aa 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -611,9 +611,13 @@ account_entity_dequeue(struct cfs_rq *cfs_rq, struct sched_entity *se)
 static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
 #ifdef CONFIG_SCHEDSTATS
+        struct task_struct *tsk = NULL;
+        if (entity_is_task(se))
+                tsk = task_of(se);
        if (se->sleep_start) {
                u64 delta = rq_of(cfs_rq)->clock - se->sleep_start;
-                struct task_struct *tsk = task_of(se);
                if ((s64)delta < 0)
                        delta = 0;
@@ -624,11 +628,11 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
                se->sleep_start = 0;
                se->sum_sleep_runtime += delta;
-                account_scheduler_latency(tsk, delta >> 10, 1);
+                if (tsk)
+                        account_scheduler_latency(tsk, delta >> 10, 1);
        }
        if (se->block_start) {
                u64 delta = rq_of(cfs_rq)->clock - se->block_start;
-                struct task_struct *tsk = task_of(se);
                if ((s64)delta < 0)
                        delta = 0;
@@ -639,17 +643,19 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
                se->block_start = 0;
                se->sum_sleep_runtime += delta;
-                /*
+                if (tsk) {
-                 * Blocking time is in units of nanosecs, so shift by 20 to
+                        /*
-                 * get a milliseconds-range estimation of the amount of
+                         * Blocking time is in units of nanosecs, so shift by
-                 * time that the task spent sleeping:
+                         * 20 to get a milliseconds-range estimation of the
-                 */
+                         * amount of time that the task spent sleeping:
-                if (unlikely(prof_on == SLEEP_PROFILING)) {
+                         */
+                        if (unlikely(prof_on == SLEEP_PROFILING)) {
-                        profile_hits(SLEEP_PROFILING, (void *)get_wchan(tsk),
+                                profile_hits(SLEEP_PROFILING,
-                                     delta >> 20);
+                                                (void *)get_wchan(tsk),
+                                                delta >> 20);
+                        }
+                        account_scheduler_latency(tsk, delta >> 10, 0);
                }
-                account_scheduler_latency(tsk, delta >> 10, 0);
        }
 #endif
 }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 1f3ec2afa511..1e1d23c26308 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1662,7 +1662,7 @@ ftrace_regex_open(struct inode *inode, struct file *file, int enable)
        mutex_lock(&ftrace_regex_lock);
        if ((file->f_mode & FMODE_WRITE) &&
-            !(file->f_flags & O_APPEND))
+            (file->f_flags & O_TRUNC))
                ftrace_filter_reset(enable);
        if (file->f_mode & FMODE_READ) {
@@ -2577,7 +2577,7 @@ ftrace_graph_open(struct inode *inode, struct file *file)
        mutex_lock(&graph_lock);
        if ((file->f_mode & FMODE_WRITE) &&
-            !(file->f_flags & O_APPEND)) {
+            (file->f_flags & O_TRUNC)) {
                ftrace_graph_count = 0;
                memset(ftrace_graph_funcs, 0, sizeof(ftrace_graph_funcs));
        }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8bc8d8afea6a..8930e39b9d8c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2031,7 +2031,7 @@ static int tracing_open(struct inode *inode, struct file *file)
        /* If this file was open for write, then erase contents */
        if ((file->f_mode & FMODE_WRITE) &&
-            !(file->f_flags & O_APPEND)) {
+            (file->f_flags & O_TRUNC)) {
                long cpu = (long) inode->i_private;
                if (cpu == TRACE_PIPE_ALL_CPU)
@@ -3085,7 +3085,8 @@ tracing_fill_pipe_page(size_t rem, struct trace_iterator *iter)
                        break;
                }
-                trace_consume(iter);
+                if (ret != TRACE_TYPE_NO_CONSUME)
+                        trace_consume(iter);
                rem -= count;
                if (!find_next_entry_inc(iter)) {
                        rem = 0;
@@ -4233,8 +4234,11 @@ static void __ftrace_dump(bool disable_tracing)
                iter.pos = -1;
                if (find_next_entry_inc(&iter) != NULL) {
-                        print_trace_line(&iter);
+                        int ret;
-                        trace_consume(&iter);
+                        ret = print_trace_line(&iter);
+                        if (ret != TRACE_TYPE_NO_CONSUME)
+                                trace_consume(&iter);
                }
                trace_printk_seq(&iter.seq);
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 53c8fd376a88..23d2972b22d6 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -376,7 +376,7 @@ ftrace_event_seq_open(struct inode *inode, struct file *file)
        const struct seq_operations *seq_ops;
        if ((file->f_mode & FMODE_WRITE) &&
-            !(file->f_flags & O_APPEND))
+            (file->f_flags & O_TRUNC))
                ftrace_clear_events();
        seq_ops = inode->i_private;
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index d2249abafb53..420ec3487579 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -843,9 +843,16 @@ print_graph_function(struct trace_iterator *iter)
        switch (entry->type) {
        case TRACE_GRAPH_ENT: {
-                struct ftrace_graph_ent_entry *field;
+                /*
+                 * print_graph_entry() may consume the current event,
+                 * thus @field may become invalid, so we need to save it.
+                 * sizeof(struct ftrace_graph_ent_entry) is very small,
+                 * it can be safely saved at the stack.
+                 */
+                struct ftrace_graph_ent_entry *field, saved;
                trace_assign_type(field, entry);
-                return print_graph_entry(field, s, iter);
+                saved = *field;
+                return print_graph_entry(&saved, s, iter);
        }
        case TRACE_GRAPH_RET: {
                struct ftrace_graph_ret_entry *field;
diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
index 7b6278110827..687699d365ae 100644
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -176,7 +176,7 @@ static int t_show(struct seq_file *m, void *v)
        const char *str = *fmt;
        int i;
-        seq_printf(m, "0x%lx : \"", (unsigned long)fmt);
+        seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
        /*
         * Tabs and new lines need to be converted.
diff --git a/lib/flex_array.c b/lib/flex_array.c
index 0e7894ce8882..08f1636d296a 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -254,7 +254,6 @@ void *flex_array_get(struct flex_array *fa, int element_nr)
 {
        int part_nr = fa_element_to_part_nr(fa, element_nr);
        struct flex_array_part *part;
-        int index;
        if (element_nr >= fa->total_nr_elements)
                return NULL;
@@ -264,6 +263,5 @@ void *flex_array_get(struct flex_array *fa, int element_nr)
                part = (struct flex_array_part *)&fa->parts[0];
        else
                part = fa->parts[part_nr];
-        index = index_inside_part(fa, element_nr);
        return &part->elements[index_inside_part(fa, element_nr)];
 }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e50566ebf9f9..94b3388c188b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
 {
+        int ret;
        l2cap_load();
        hci_register_cb(&rfcomm_cb);
        rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
        if (IS_ERR(rfcomm_thread)) {
-                hci_unregister_cb(&rfcomm_cb);
+                ret = PTR_ERR(rfcomm_thread);
-                return PTR_ERR(rfcomm_thread);
+                goto out_thread;
        }
        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
                BT_ERR("Failed to create RFCOMM info file");
-        rfcomm_init_sockets();
+        ret = rfcomm_init_ttys();
+        if (ret)
+                goto out_tty;
-#ifdef CONFIG_BT_RFCOMM_TTY
+        ret = rfcomm_init_sockets();
-        rfcomm_init_ttys();
+        if (ret)
-#endif
+                goto out_sock;
        BT_INFO("RFCOMM ver %s", VERSION);
        return 0;
+out_sock:
+        rfcomm_cleanup_ttys();
+out_tty:
+        kthread_stop(rfcomm_thread);
+out_thread:
+        hci_unregister_cb(&rfcomm_cb);
+        return ret;
 }
 static void __exit rfcomm_exit(void)
@@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
        kthread_stop(rfcomm_thread);
-#ifdef CONFIG_BT_RFCOMM_TTY
        rfcomm_cleanup_ttys();
-#endif
        rfcomm_cleanup_sockets();
 }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7f482784e9f7..0b85e8116859 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1132,7 +1132,7 @@ error:
        return err;
 }
-void __exit rfcomm_cleanup_sockets(void)
+void rfcomm_cleanup_sockets(void)
 {
        class_remove_file(bt_class, &class_attr_rfcomm);
diff --git a/net/core/dev.c b/net/core/dev.c
index 70c27e0c7c32..43e61ba7bd95 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3865,10 +3865,12 @@ int dev_unicast_delete(struct net_device *dev, void *addr)
        ASSERT_RTNL();
+        netif_addr_lock_bh(dev);
        err = __hw_addr_del(&dev->uc, addr, dev->addr_len,
                            NETDEV_HW_ADDR_T_UNICAST);
        if (!err)
                __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_delete);
@@ -3889,10 +3891,12 @@ int dev_unicast_add(struct net_device *dev, void *addr)
        ASSERT_RTNL();
+        netif_addr_lock_bh(dev);
        err = __hw_addr_add(&dev->uc, addr, dev->addr_len,
                            NETDEV_HW_ADDR_T_UNICAST);
        if (!err)
                __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_add);
@@ -3949,7 +3953,8 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
 *      @from: source device
 *
 *      Add newly added addresses to the destination device and release
- *      addresses that have no users left.
+ *      addresses that have no users left. The source device must be
+ *      locked by netif_tx_lock_bh.
 *
 *      This function is intended to be called from the dev->set_rx_mode
 *      function of layered software devices.
@@ -3958,14 +3963,14 @@ int dev_unicast_sync(struct net_device *to, struct net_device *from)
 {
        int err = 0;
-        ASSERT_RTNL();
        if (to->addr_len != from->addr_len)
                return -EINVAL;
+        netif_addr_lock_bh(to);
        err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
        if (!err)
                __dev_set_rx_mode(to);
+        netif_addr_unlock_bh(to);
        return err;
 }
 EXPORT_SYMBOL(dev_unicast_sync);
@@ -3981,28 +3986,30 @@ EXPORT_SYMBOL(dev_unicast_sync);
 */
 void dev_unicast_unsync(struct net_device *to, struct net_device *from)
 {
-        ASSERT_RTNL();
        if (to->addr_len != from->addr_len)
                return;
+        netif_addr_lock_bh(from);
+        netif_addr_lock(to);
        __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
        __dev_set_rx_mode(to);
+        netif_addr_unlock(to);
+        netif_addr_unlock_bh(from);
 }
 EXPORT_SYMBOL(dev_unicast_unsync);
 static void dev_unicast_flush(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
+        netif_addr_lock_bh(dev);
        __hw_addr_flush(&dev->uc);
+        netif_addr_unlock_bh(dev);
 }
 static void dev_unicast_init(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
+        netif_addr_lock_bh(dev);
        __hw_addr_init(&dev->uc);
+        netif_addr_unlock_bh(dev);
 }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index b7292a2719dc..197283072cc8 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -488,7 +488,7 @@ int net_assign_generic(struct net *net, int id, void *data)
         */
        ng->len = id;
-        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len);
+        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
        rcu_assign_pointer(net->gen, ng);
        call_rcu(&old_ng->rcu, net_generic_release);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c29d75d8f1b1..090e9991ac2a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
                hbuffer[k++] = hex_asc_lo(n->ha[j]);
                hbuffer[k++] = ':';
        }
-        hbuffer[--k] = 0;
+        if (k != 0)
+                --k;
+        hbuffer[k] = 0;
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
        }
 #endif
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index aca22b00b6a3..07e7e41816be 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -721,7 +721,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 {
        struct ieee80211_local *local = (void *) data;
-        if (local->quiescing)
+        if (local->quiescing || local->suspended)
                return;
        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb96..5e3d476972f9 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
        rcu_read_unlock();
-        /* flush again, in case driver queued work */
-        flush_workqueue(local->hw.workqueue);
-        /* stop hardware - this must stop RX */
-        if (local->open_count) {
-                ieee80211_led_radio(local, false);
-                drv_stop(local);
-        }
        /* remove STAs */
        spin_lock_irqsave(&local->sta_lock, flags);
        list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                drv_remove_interface(local, &conf);
        }
+        /* stop hardware - this must stop RX */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                drv_stop(local);
+        }
+        /*
+         * flush again, in case driver queued work -- it
+         * shouldn't be doing (or cancel everything in the
+         * stop callback) that but better safe than sorry.
+         */
+        flush_workqueue(local->hw.workqueue);
        local->suspended = true;
+        /* need suspended to be visible before quiescing is false */
+        barrier();
        local->quiescing = false;
        return 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index de5bba7f910a..0936fc24942d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                return;
        }
+        /*
+         * If we're suspending, it is possible although not too likely
+         * that we'd be receiving frames after having already partially
+         * quiesced the stack. We can't process such frames then since
+         * that might, for example, cause stations to be added or other
+         * driver callbacks be invoked.
+         */
+        if (unlikely(local->quiescing || local->suspended)) {
+                kfree_skb(skb);
+                return;
+        }
        if (status->flag & RX_FLAG_HT) {
                /* rate_idx is MCS index */
                if (WARN_ON(status->rate_idx < 0 ||
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index b0e582f2d37a..16e6c4378ff1 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -151,7 +151,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                        addr6 = addr;
                        mask6 = mask;
                        map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
-                        if (map4 == NULL)
+                        if (map6 == NULL)
                                goto cfg_unlbl_map_add_failure;
                        map6->type = NETLBL_NLTYPE_UNLABELED;
                        ipv6_addr_copy(&map6->list.addr, addr6);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5e14371cda70..75a406d33619 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1089,17 +1089,18 @@ static void handle_reg_beacon(struct wiphy *wiphy,
        chan->beacon_found = true;
+        if (wiphy->disable_beacon_hints)
+                return;
        chan_before.center_freq = chan->center_freq;
        chan_before.flags = chan->flags;
-        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
-            !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
                chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
                channel_changed = true;
        }
-        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
-            !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
                chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
                channel_changed = true;
        }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index e37829a49dc4..4e167a8e11be 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -30,7 +30,8 @@ int set_regdom(const struct ieee80211_regdomain *rd);
 * non-radar 5 GHz channels.
 *
 * Drivers do not need to call this, cfg80211 will do it for after a scan
- * on a newly found BSS.
+ * on a newly found BSS. If you cannot make use of this feature you can
+ * set the wiphy->disable_beacon_hints to true.
 */
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                        struct ieee80211_channel *beacon_chan,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 9271118e1fc4..7e595ce24eeb 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -118,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
        if (!ie1 && !ie2)
                return 0;
-        if (!ie1)
+        if (!ie1 || !ie2)
                return -1;
        r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
@@ -171,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss *a,
        ie = find_ie(WLAN_EID_MESH_CONFIG,
                     a->information_elements,
                     a->len_information_elements);
+        if (!ie)
+                return false;
        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
                return false;
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index 7109e2b5bc0a..d29baa2e063a 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -403,7 +403,6 @@ while (<IN>) {
    # section found, now is this a start of a function?
    } elsif ($read_function && /$function_regex/) {
        $text_found = 1;
-        $offset = hex $1;
        $text = $2;
        # if this is either a local function or a weak function
@@ -412,10 +411,12 @@ while (<IN>) {
        if (!defined($locals{$text}) && !defined($weak{$text})) {
            $ref_func = $text;
            $read_function = 0;
+            $offset = hex $1;
        } else {
            # if we already have a function, and this is weak, skip it
-            if (!defined($ref_func) || !defined($weak{$text})) {
+            if (!defined($ref_func) && !defined($weak{$text})) {
                $ref_func = $text;
+                $offset = hex $1;
            }
        }
    } elsif ($read_headers && /$mcount_section/) {
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index a5e9b876ca09..4b20fa47c3ab 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -345,7 +345,7 @@ BUILTIN_OBJS += builtin-stat.o
 BUILTIN_OBJS += builtin-top.o
 PERFLIBS = $(LIB_FILE)
-EXTLIBS = -lbfd
+EXTLIBS = -lbfd -liberty
 #
 # Platform specific tweaks
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index b20a4b6e31b7..ce4f28645e64 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -99,6 +99,7 @@ struct comm_event {
 struct fork_event {
        struct perf_event_header header;
        u32 pid, ppid;
+        u32 tid, ptid;
 };
 struct lost_event {
@@ -252,7 +253,7 @@ static int strcommon(const char *pathname)
 {
        int n = 0;
-        while (pathname[n] == cwd[n] && n < cwdlen)
+        while (n < cwdlen && pathname[n] == cwd[n])
                ++n;
        return n;
@@ -1608,15 +1609,27 @@ process_comm_event(event_t *event, unsigned long offset, unsigned long head)
 }
 static int
-process_fork_event(event_t *event, unsigned long offset, unsigned long head)
+process_task_event(event_t *event, unsigned long offset, unsigned long head)
 {
        struct thread *thread = threads__findnew(event->fork.pid);
        struct thread *parent = threads__findnew(event->fork.ppid);
-        dprintf("%p [%p]: PERF_EVENT_FORK: %d:%d\n",
+        dprintf("%p [%p]: PERF_EVENT_%s: (%d:%d):(%d:%d)\n",
                (void *)(offset + head),
                (void *)(long)(event->header.size),
-                event->fork.pid, event->fork.ppid);
+                event->header.type == PERF_EVENT_FORK ? "FORK" : "EXIT",
+                event->fork.pid, event->fork.tid,
+                event->fork.ppid, event->fork.ptid);
+        /*
+         * A thread clone will have the same PID for both
+         * parent and child.
+         */
+        if (thread == parent)
+                return 0;
+        if (event->header.type == PERF_EVENT_EXIT)
+                return 0;
        if (!thread || !parent || thread__fork(thread, parent)) {
                dprintf("problem processing PERF_EVENT_FORK, skipping event.\n");
@@ -1706,7 +1719,8 @@ process_event(event_t *event, unsigned long offset, unsigned long head)
                return process_comm_event(event, offset, head);
        case PERF_EVENT_FORK:
-                return process_fork_event(event, offset, head);
+        case PERF_EVENT_EXIT:
+                return process_task_event(event, offset, head);
        case PERF_EVENT_LOST:
                return process_lost_event(event, offset, head);
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index c0a423004e15..f139f1ab9333 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -285,6 +285,7 @@ static const char *skip_symbols[] = {
        "enter_idle",
        "exit_idle",
        "mwait_idle",
+        "mwait_idle_with_hints",
        "ppc64_runlatch_off",
        "pseries_dedicated_idle_sleep",
        NULL
diff --git a/tools/perf/util/quote.c b/tools/perf/util/quote.c
index c6e5dc0dc82f..2726fe40eb5d 100644
--- a/tools/perf/util/quote.c
+++ b/tools/perf/util/quote.c
@@ -318,7 +318,7 @@ char *quote_path_relative(const char *in, int len,
                strbuf_addch(out, '"');
        if (prefix) {
                int off = 0;
-                while (prefix[off] && off < len && prefix[off] == in[off])
+                while (off < len && prefix[off] && prefix[off] == in[off])
                        if (prefix[off] == '/') {
                                prefix += off + 1;
                                in += off + 1;
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 28106059bf12..b4fe0579bd6b 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -565,7 +565,7 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
                goto out_elf_end;
        secstrs = elf_getdata(sec_strndx, NULL);
-        if (symstrs == NULL)
+        if (secstrs == NULL)
                goto out_elf_end;
        nr_syms = shdr.sh_size / shdr.sh_entsize;