188 files changed, 1987 insertions, 1420 deletions
diff --git a/Makefile b/Makefile
index 54dfde5e9f9e..08ef9bdb80c7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Unicycling Gorilla
 # *DOCUMENTATION*
diff --git a/arch/arm/common/gic.c b/arch/arm/common/gic.c
index 36ae03a3f5d1..87dfa9026c5b 100644
--- a/arch/arm/common/gic.c
+++ b/arch/arm/common/gic.c
@@ -351,6 +351,25 @@ void __init gic_cascade_irq(unsigned int gic_nr, unsigned int irq)
        irq_set_chained_handler(irq, gic_handle_cascade_irq);
 }
+static u8 gic_get_cpumask(struct gic_chip_data *gic)
+{
+        void __iomem *base = gic_data_dist_base(gic);
+        u32 mask, i;
+        for (i = mask = 0; i < 32; i += 4) {
+                mask = readl_relaxed(base + GIC_DIST_TARGET + i);
+                mask |= mask >> 16;
+                mask |= mask >> 8;
+                if (mask)
+                        break;
+        }
+        if (!mask)
+                pr_crit("GIC CPU mask not found - kernel will fail to boot.\n");
+        return mask;
+}
 static void __init gic_dist_init(struct gic_chip_data *gic)
 {
        unsigned int i;
@@ -369,7 +388,9 @@ static void __init gic_dist_init(struct gic_chip_data *gic)
        /*
         * Set all global interrupts to this CPU only.
         */
-        cpumask = readl_relaxed(base + GIC_DIST_TARGET + 0);
+        cpumask = gic_get_cpumask(gic);
+        cpumask |= cpumask << 8;
+        cpumask |= cpumask << 16;
        for (i = 32; i < gic_irqs; i += 4)
                writel_relaxed(cpumask, base + GIC_DIST_TARGET + i * 4 / 4);
@@ -400,7 +421,7 @@ static void __cpuinit gic_cpu_init(struct gic_chip_data *gic)
         * Get what the GIC says our CPU mask is.
         */
        BUG_ON(cpu >= NR_GIC_CPU_IF);
-        cpu_mask = readl_relaxed(dist_base + GIC_DIST_TARGET + 0);
+        cpu_mask = gic_get_cpumask(gic);
        gic_cpu_map[cpu] = cpu_mask;
        /*
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 73cf03aa981e..1c4df27f9332 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -37,7 +37,7 @@
 */
 #define PAGE_OFFSET             UL(CONFIG_PAGE_OFFSET)
 #define TASK_SIZE               (UL(CONFIG_PAGE_OFFSET) - UL(0x01000000))
-#define TASK_UNMAPPED_BASE      (UL(CONFIG_PAGE_OFFSET) / 3)
+#define TASK_UNMAPPED_BASE      ALIGN(TASK_SIZE / 3, SZ_16M)
 /*
 * The maximum size of a 26-bit user space task.
diff --git a/arch/arm/include/asm/smp_scu.h b/arch/arm/include/asm/smp_scu.h
index 4eb6d005ffaa..86dff32a0737 100644
--- a/arch/arm/include/asm/smp_scu.h
+++ b/arch/arm/include/asm/smp_scu.h
@@ -7,8 +7,14 @@
 #ifndef __ASSEMBLER__
 unsigned int scu_get_core_count(void __iomem *);
-void scu_enable(void __iomem *);
 int scu_power_mode(void __iomem *, unsigned int);
+#ifdef CONFIG_SMP
+void scu_enable(void __iomem *scu_base);
+#else
+static inline void scu_enable(void __iomem *scu_base) {}
+#endif
 #endif
 #endif
diff --git a/arch/arm/kernel/smp_scu.c b/arch/arm/kernel/smp_scu.c
index b9f015e843d8..45eac87ed66a 100644
--- a/arch/arm/kernel/smp_scu.c
+++ b/arch/arm/kernel/smp_scu.c
@@ -75,7 +75,7 @@ void scu_enable(void __iomem *scu_base)
 int scu_power_mode(void __iomem *scu_base, unsigned int mode)
 {
        unsigned int val;
-        int cpu = cpu_logical_map(smp_processor_id());
+        int cpu = MPIDR_AFFINITY_LEVEL(cpu_logical_map(smp_processor_id()), 0);
        if (mode > 3 || mode == 1 || cpu > 3)
                return -EINVAL;
diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
index e103c290bc9e..85afb031b676 100644
--- a/arch/arm/mach-exynos/Kconfig
+++ b/arch/arm/mach-exynos/Kconfig
@@ -414,7 +414,7 @@ config MACH_EXYNOS4_DT
        select CPU_EXYNOS4210
        select HAVE_SAMSUNG_KEYPAD if INPUT_KEYBOARD
        select PINCTRL
-        select PINCTRL_EXYNOS4
+        select PINCTRL_EXYNOS
        select USE_OF
        help
          Machine support for Samsung Exynos4 machine with device tree enabled.
diff --git a/arch/arm/mach-highbank/highbank.c b/arch/arm/mach-highbank/highbank.c
index 981dc1e1da51..e6c061282939 100644
--- a/arch/arm/mach-highbank/highbank.c
+++ b/arch/arm/mach-highbank/highbank.c
@@ -28,6 +28,7 @@
 #include <asm/arch_timer.h>
 #include <asm/cacheflush.h>
+#include <asm/cputype.h>
 #include <asm/smp_plat.h>
 #include <asm/smp_twd.h>
 #include <asm/hardware/arm_timer.h>
@@ -59,7 +60,7 @@ static void __init highbank_scu_map_io(void)
 void highbank_set_cpu_jump(int cpu, void *jump_addr)
 {
-        cpu = cpu_logical_map(cpu);
+        cpu = MPIDR_AFFINITY_LEVEL(cpu_logical_map(cpu), 0);
        writel(virt_to_phys(jump_addr), HB_JUMP_TABLE_VIRT(cpu));
        __cpuc_flush_dcache_area(HB_JUMP_TABLE_VIRT(cpu), 16);
        outer_clean_range(HB_JUMP_TABLE_PHYS(cpu),
diff --git a/arch/arm/mach-highbank/sysregs.h b/arch/arm/mach-highbank/sysregs.h
index 70af9d13fcef..5995df7f2622 100644
--- a/arch/arm/mach-highbank/sysregs.h
+++ b/arch/arm/mach-highbank/sysregs.h
@@ -37,7 +37,7 @@ extern void __iomem *sregs_base;
 static inline void highbank_set_core_pwr(void)
 {
-        int cpu = cpu_logical_map(smp_processor_id());
+        int cpu = MPIDR_AFFINITY_LEVEL(cpu_logical_map(smp_processor_id()), 0);
        if (scu_base_addr)
                scu_power_mode(scu_base_addr, SCU_PM_POWEROFF);
        else
@@ -46,7 +46,7 @@ static inline void highbank_set_core_pwr(void)
 static inline void highbank_clear_core_pwr(void)
 {
-        int cpu = cpu_logical_map(smp_processor_id());
+        int cpu = MPIDR_AFFINITY_LEVEL(cpu_logical_map(smp_processor_id()), 0);
        if (scu_base_addr)
                scu_power_mode(scu_base_addr, SCU_PM_NORMAL);
        else
diff --git a/arch/arm/mach-realview/include/mach/irqs-eb.h b/arch/arm/mach-realview/include/mach/irqs-eb.h
index d6b5073692d2..44754230fdcc 100644
--- a/arch/arm/mach-realview/include/mach/irqs-eb.h
+++ b/arch/arm/mach-realview/include/mach/irqs-eb.h
@@ -115,7 +115,7 @@
 /*
 * Only define NR_IRQS if less than NR_IRQS_EB
 */
-#define NR_IRQS_EB              (IRQ_EB_GIC_START + 96)
+#define NR_IRQS_EB              (IRQ_EB_GIC_START + 128)
 #if defined(CONFIG_MACH_REALVIEW_EB) \
        && (!defined(NR_IRQS) || (NR_IRQS < NR_IRQS_EB))
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 076c26d43864..dda3904dc64c 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -640,7 +640,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
        if (is_coherent || nommu())
                addr = __alloc_simple_buffer(dev, size, gfp, &page);
-        else if (gfp & GFP_ATOMIC)
+        else if (!(gfp & __GFP_WAIT))
                addr = __alloc_from_pool(size, &page);
        else if (!IS_ENABLED(CONFIG_CMA))
                addr = __alloc_remap_buffer(dev, size, gfp, prot, &page, caller);
diff --git a/arch/avr32/include/asm/dma-mapping.h b/arch/avr32/include/asm/dma-mapping.h
index aaf5199d8fcb..b3d18f9f3e8d 100644
--- a/arch/avr32/include/asm/dma-mapping.h
+++ b/arch/avr32/include/asm/dma-mapping.h
@@ -336,4 +336,14 @@ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
+/* drivers/base/dma-mapping.c */
+extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
+                           void *cpu_addr, dma_addr_t dma_addr, size_t size);
+extern int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size);
+#define dma_mmap_coherent(d, v, c, h, s) dma_common_mmap(d, v, c, h, s)
+#define dma_get_sgtable(d, t, v, h, s) dma_common_get_sgtable(d, t, v, h, s)
 #endif /* __ASM_AVR32_DMA_MAPPING_H */
diff --git a/arch/blackfin/include/asm/dma-mapping.h b/arch/blackfin/include/asm/dma-mapping.h
index bbf461076a0a..054d9ec57d9d 100644
--- a/arch/blackfin/include/asm/dma-mapping.h
+++ b/arch/blackfin/include/asm/dma-mapping.h
@@ -154,4 +154,14 @@ dma_cache_sync(struct device *dev, void *vaddr, size_t size,
        _dma_sync((dma_addr_t)vaddr, size, dir);
 }
+/* drivers/base/dma-mapping.c */
+extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
+                           void *cpu_addr, dma_addr_t dma_addr, size_t size);
+extern int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size);
+#define dma_mmap_coherent(d, v, c, h, s) dma_common_mmap(d, v, c, h, s)
+#define dma_get_sgtable(d, t, v, h, s) dma_common_get_sgtable(d, t, v, h, s)
 #endif                          /* _BLACKFIN_DMA_MAPPING_H */
diff --git a/arch/c6x/include/asm/dma-mapping.h b/arch/c6x/include/asm/dma-mapping.h
index 3c694065030f..88bd0d899bdb 100644
--- a/arch/c6x/include/asm/dma-mapping.h
+++ b/arch/c6x/include/asm/dma-mapping.h
@@ -89,4 +89,19 @@ extern void dma_free_coherent(struct device *, size_t, void *, dma_addr_t);
 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent((d), (s), (h), (f))
 #define dma_free_noncoherent(d, s, v, h)  dma_free_coherent((d), (s), (v), (h))
+/* Not supported for now */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
 #endif  /* _ASM_C6X_DMA_MAPPING_H */
diff --git a/arch/cris/include/asm/dma-mapping.h b/arch/cris/include/asm/dma-mapping.h
index 8588b2ccf854..2f0f654f1b44 100644
--- a/arch/cris/include/asm/dma-mapping.h
+++ b/arch/cris/include/asm/dma-mapping.h
@@ -158,5 +158,15 @@ dma_cache_sync(struct device *dev, void *vaddr, size_t size,
 {
 }
+/* drivers/base/dma-mapping.c */
+extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
+                           void *cpu_addr, dma_addr_t dma_addr, size_t size);
+extern int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size);
+#define dma_mmap_coherent(d, v, c, h, s) dma_common_mmap(d, v, c, h, s)
+#define dma_get_sgtable(d, t, v, h, s) dma_common_get_sgtable(d, t, v, h, s)
 #endif
diff --git a/arch/frv/include/asm/dma-mapping.h b/arch/frv/include/asm/dma-mapping.h
index dfb811002c64..1746a2b8e6e7 100644
--- a/arch/frv/include/asm/dma-mapping.h
+++ b/arch/frv/include/asm/dma-mapping.h
@@ -132,4 +132,19 @@ void dma_cache_sync(struct device *dev, void *vaddr, size_t size,
        flush_write_buffers();
 }
+/* Not supported for now */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
 #endif  /* _ASM_DMA_MAPPING_H */
diff --git a/arch/m68k/include/asm/dma-mapping.h b/arch/m68k/include/asm/dma-mapping.h
index 3e6b8445af6a..292805f0762e 100644
--- a/arch/m68k/include/asm/dma-mapping.h
+++ b/arch/m68k/include/asm/dma-mapping.h
@@ -115,4 +115,14 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t handle)
 #include <asm-generic/dma-mapping-broken.h>
 #endif
+/* drivers/base/dma-mapping.c */
+extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
+                           void *cpu_addr, dma_addr_t dma_addr, size_t size);
+extern int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size);
+#define dma_mmap_coherent(d, v, c, h, s) dma_common_mmap(d, v, c, h, s)
+#define dma_get_sgtable(d, t, v, h, s) dma_common_get_sgtable(d, t, v, h, s)
 #endif  /* _M68K_DMA_MAPPING_H */
diff --git a/arch/m68k/include/asm/processor.h b/arch/m68k/include/asm/processor.h
index ae700f49e51d..b0768a657920 100644
--- a/arch/m68k/include/asm/processor.h
+++ b/arch/m68k/include/asm/processor.h
@@ -130,7 +130,6 @@ extern int handle_kernel_fault(struct pt_regs *regs);
 #define start_thread(_regs, _pc, _usp)                  \
 do {                                                    \
        (_regs)->pc = (_pc);                            \
-        ((struct switch_stack *)(_regs))[-1].a6 = 0;    \
        setframeformat(_regs);                          \
        if (current->mm)                                \
                (_regs)->d5 = current->mm->start_data;  \
diff --git a/arch/mn10300/include/asm/dma-mapping.h b/arch/mn10300/include/asm/dma-mapping.h
index c1be4397b1ed..a18abfc558eb 100644
--- a/arch/mn10300/include/asm/dma-mapping.h
+++ b/arch/mn10300/include/asm/dma-mapping.h
@@ -168,4 +168,19 @@ void dma_cache_sync(void *vaddr, size_t size,
        mn10300_dcache_flush_inv();
 }
+/* Not supported for now */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
 #endif
diff --git a/arch/parisc/include/asm/dma-mapping.h b/arch/parisc/include/asm/dma-mapping.h
index 467bbd510eac..106b395688e1 100644
--- a/arch/parisc/include/asm/dma-mapping.h
+++ b/arch/parisc/include/asm/dma-mapping.h
@@ -238,4 +238,19 @@ void * sba_get_iommu(struct parisc_device *dev);
 /* At the moment, we panic on error for IOMMU resource exaustion */
 #define dma_mapping_error(dev, x)       0
+/* This API cannot be supported on PA-RISC */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
 #endif
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index a5f4f5a1d24b..0aa98db8a80d 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -120,6 +120,9 @@ static int s390_next_ktime(ktime_t expires,
        nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires));
        do_div(nsecs, 125);
        S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9);
+        /* Program the maximum value if we have an overflow (== year 2042) */
+        if (unlikely(S390_lowcore.clock_comparator < sched_clock_base_cc))
+                S390_lowcore.clock_comparator = -1ULL;
        set_clock_comparator(S390_lowcore.clock_comparator);
        return 0;
 }
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 875d008828b8..1bb7ad4aeff4 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -140,6 +140,8 @@ config ARCH_DEFCONFIG
 source "init/Kconfig"
+source "kernel/Kconfig.freezer"
 menu "Tilera-specific configuration"
 config NR_CPUS
diff --git a/arch/tile/include/asm/io.h b/arch/tile/include/asm/io.h
index 2a9b293fece6..31672918064c 100644
--- a/arch/tile/include/asm/io.h
+++ b/arch/tile/include/asm/io.h
@@ -250,7 +250,9 @@ static inline void writeq(u64 val, unsigned long addr)
 #define iowrite32 writel
 #define iowrite64 writeq
-static inline void memset_io(void *dst, int val, size_t len)
+#if CHIP_HAS_MMIO() || defined(CONFIG_PCI)
+static inline void memset_io(volatile void *dst, int val, size_t len)
 {
        int x;
        BUG_ON((unsigned long)dst & 0x3);
@@ -277,6 +279,8 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src,
                writel(*(u32 *)(src + x), dst + x);
 }
+#endif
 /*
 * The Tile architecture does not support IOPORT, even with PCI.
 * Unfortunately we can't yet simply not declare these methods,
diff --git a/arch/tile/include/asm/irqflags.h b/arch/tile/include/asm/irqflags.h
index b4e96fef2cf8..241c0bb60b12 100644
--- a/arch/tile/include/asm/irqflags.h
+++ b/arch/tile/include/asm/irqflags.h
@@ -18,32 +18,20 @@
 #include <arch/interrupts.h>
 #include <arch/chip.h>
-#if !defined(__tilegx__) && defined(__ASSEMBLY__)
 /*
 * The set of interrupts we want to allow when interrupts are nominally
 * disabled.  The remainder are effectively "NMI" interrupts from
 * the point of view of the generic Linux code.  Note that synchronous
 * interrupts (aka "non-queued") are not blocked by the mask in any case.
 */
-#if CHIP_HAS_AUX_PERF_COUNTERS()
-#define LINUX_MASKABLE_INTERRUPTS_HI \
-        (~(INT_MASK_HI(INT_PERF_COUNT) | INT_MASK_HI(INT_AUX_PERF_COUNT)))
-#else
-#define LINUX_MASKABLE_INTERRUPTS_HI \
-        (~(INT_MASK_HI(INT_PERF_COUNT)))
-#endif
-#else
-#if CHIP_HAS_AUX_PERF_COUNTERS()
-#define LINUX_MASKABLE_INTERRUPTS \
-        (~(INT_MASK(INT_PERF_COUNT) | INT_MASK(INT_AUX_PERF_COUNT)))
-#else
 #define LINUX_MASKABLE_INTERRUPTS \
-        (~(INT_MASK(INT_PERF_COUNT)))
+        (~((_AC(1,ULL) << INT_PERF_COUNT) | (_AC(1,ULL) << INT_AUX_PERF_COUNT)))
-#endif
+#if CHIP_HAS_SPLIT_INTR_MASK()
+/* The same macro, but for the two 32-bit SPRs separately. */
+#define LINUX_MASKABLE_INTERRUPTS_LO (-1)
+#define LINUX_MASKABLE_INTERRUPTS_HI \
+        (~((1 << (INT_PERF_COUNT - 32)) | (1 << (INT_AUX_PERF_COUNT - 32))))
 #endif
 #ifndef __ASSEMBLY__
@@ -126,7 +114,7 @@
 * to know our current state.
 */
 DECLARE_PER_CPU(unsigned long long, interrupts_enabled_mask);
-#define INITIAL_INTERRUPTS_ENABLED INT_MASK(INT_MEM_ERROR)
+#define INITIAL_INTERRUPTS_ENABLED (1ULL << INT_MEM_ERROR)
 /* Disable interrupts. */
 #define arch_local_irq_disable() \
@@ -165,7 +153,7 @@ DECLARE_PER_CPU(unsigned long long, interrupts_enabled_mask);
 /* Prevent the given interrupt from being enabled next time we enable irqs. */
 #define arch_local_irq_mask(interrupt) \
-        (__get_cpu_var(interrupts_enabled_mask) &= ~INT_MASK(interrupt))
+        (__get_cpu_var(interrupts_enabled_mask) &= ~(1ULL << (interrupt)))
 /* Prevent the given interrupt from being enabled immediately. */
 #define arch_local_irq_mask_now(interrupt) do { \
@@ -175,7 +163,7 @@ DECLARE_PER_CPU(unsigned long long, interrupts_enabled_mask);
 /* Allow the given interrupt to be enabled next time we enable irqs. */
 #define arch_local_irq_unmask(interrupt) \
-        (__get_cpu_var(interrupts_enabled_mask) |= INT_MASK(interrupt))
+        (__get_cpu_var(interrupts_enabled_mask) |= (1ULL << (interrupt)))
 /* Allow the given interrupt to be enabled immediately, if !irqs_disabled. */
 #define arch_local_irq_unmask_now(interrupt) do { \
@@ -250,7 +238,7 @@ DECLARE_PER_CPU(unsigned long long, interrupts_enabled_mask);
 /* Disable interrupts. */
 #define IRQ_DISABLE(tmp0, tmp1)                                 \
        {                                                       \
-         movei  tmp0, -1;                                       \
+         movei  tmp0, LINUX_MASKABLE_INTERRUPTS_LO;             \
         moveli tmp1, lo16(LINUX_MASKABLE_INTERRUPTS_HI)        \
        };                                                      \
        {                                                       \
diff --git a/arch/tile/include/uapi/arch/interrupts_32.h b/arch/tile/include/uapi/arch/interrupts_32.h
index 96b5710505b6..2efe3f68b2d6 100644
--- a/arch/tile/include/uapi/arch/interrupts_32.h
+++ b/arch/tile/include/uapi/arch/interrupts_32.h
@@ -15,6 +15,7 @@
 #ifndef __ARCH_INTERRUPTS_H__
 #define __ARCH_INTERRUPTS_H__
+#ifndef __KERNEL__
 /** Mask for an interrupt. */
 /* Note: must handle breaking interrupts into high and low words manually. */
 #define INT_MASK_LO(intno) (1 << (intno))
@@ -23,6 +24,7 @@
 #ifndef __ASSEMBLER__
 #define INT_MASK(intno) (1ULL << (intno))
 #endif
+#endif
 /** Where a given interrupt executes */
@@ -92,216 +94,216 @@
 #ifndef __ASSEMBLER__
 #define QUEUED_INTERRUPTS ( \
-    INT_MASK(INT_MEM_ERROR) | \
+    (1ULL << INT_MEM_ERROR) | \
-    INT_MASK(INT_DMATLB_MISS) | \
+    (1ULL << INT_DMATLB_MISS) | \
-    INT_MASK(INT_DMATLB_ACCESS) | \
+    (1ULL << INT_DMATLB_ACCESS) | \
-    INT_MASK(INT_SNITLB_MISS) | \
+    (1ULL << INT_SNITLB_MISS) | \
-    INT_MASK(INT_SN_NOTIFY) | \
+    (1ULL << INT_SN_NOTIFY) | \
-    INT_MASK(INT_SN_FIREWALL) | \
+    (1ULL << INT_SN_FIREWALL) | \
-    INT_MASK(INT_IDN_FIREWALL) | \
+    (1ULL << INT_IDN_FIREWALL) | \
-    INT_MASK(INT_UDN_FIREWALL) | \
+    (1ULL << INT_UDN_FIREWALL) | \
-    INT_MASK(INT_TILE_TIMER) | \
+    (1ULL << INT_TILE_TIMER) | \
-    INT_MASK(INT_IDN_TIMER) | \
+    (1ULL << INT_IDN_TIMER) | \
-    INT_MASK(INT_UDN_TIMER) | \
+    (1ULL << INT_UDN_TIMER) | \
-    INT_MASK(INT_DMA_NOTIFY) | \
+    (1ULL << INT_DMA_NOTIFY) | \
-    INT_MASK(INT_IDN_CA) | \
+    (1ULL << INT_IDN_CA) | \
-    INT_MASK(INT_UDN_CA) | \
+    (1ULL << INT_UDN_CA) | \
-    INT_MASK(INT_IDN_AVAIL) | \
+    (1ULL << INT_IDN_AVAIL) | \
-    INT_MASK(INT_UDN_AVAIL) | \
+    (1ULL << INT_UDN_AVAIL) | \
-    INT_MASK(INT_PERF_COUNT) | \
+    (1ULL << INT_PERF_COUNT) | \
-    INT_MASK(INT_INTCTRL_3) | \
+    (1ULL << INT_INTCTRL_3) | \
-    INT_MASK(INT_INTCTRL_2) | \
+    (1ULL << INT_INTCTRL_2) | \
-    INT_MASK(INT_INTCTRL_1) | \
+    (1ULL << INT_INTCTRL_1) | \
-    INT_MASK(INT_INTCTRL_0) | \
+    (1ULL << INT_INTCTRL_0) | \
-    INT_MASK(INT_BOOT_ACCESS) | \
+    (1ULL << INT_BOOT_ACCESS) | \
-    INT_MASK(INT_WORLD_ACCESS) | \
+    (1ULL << INT_WORLD_ACCESS) | \
-    INT_MASK(INT_I_ASID) | \
+    (1ULL << INT_I_ASID) | \
-    INT_MASK(INT_D_ASID) | \
+    (1ULL << INT_D_ASID) | \
-    INT_MASK(INT_DMA_ASID) | \
+    (1ULL << INT_DMA_ASID) | \
-    INT_MASK(INT_SNI_ASID) | \
+    (1ULL << INT_SNI_ASID) | \
-    INT_MASK(INT_DMA_CPL) | \
+    (1ULL << INT_DMA_CPL) | \
-    INT_MASK(INT_SN_CPL) | \
+    (1ULL << INT_SN_CPL) | \
-    INT_MASK(INT_DOUBLE_FAULT) | \
+    (1ULL << INT_DOUBLE_FAULT) | \
-    INT_MASK(INT_AUX_PERF_COUNT) | \
+    (1ULL << INT_AUX_PERF_COUNT) | \
    0)
 #define NONQUEUED_INTERRUPTS ( \
-    INT_MASK(INT_ITLB_MISS) | \
+    (1ULL << INT_ITLB_MISS) | \
-    INT_MASK(INT_ILL) | \
+    (1ULL << INT_ILL) | \
-    INT_MASK(INT_GPV) | \
+    (1ULL << INT_GPV) | \
-    INT_MASK(INT_SN_ACCESS) | \
+    (1ULL << INT_SN_ACCESS) | \
-    INT_MASK(INT_IDN_ACCESS) | \
+    (1ULL << INT_IDN_ACCESS) | \
-    INT_MASK(INT_UDN_ACCESS) | \
+    (1ULL << INT_UDN_ACCESS) | \
-    INT_MASK(INT_IDN_REFILL) | \
+    (1ULL << INT_IDN_REFILL) | \
-    INT_MASK(INT_UDN_REFILL) | \
+    (1ULL << INT_UDN_REFILL) | \
-    INT_MASK(INT_IDN_COMPLETE) | \
+    (1ULL << INT_IDN_COMPLETE) | \
-    INT_MASK(INT_UDN_COMPLETE) | \
+    (1ULL << INT_UDN_COMPLETE) | \
-    INT_MASK(INT_SWINT_3) | \
+    (1ULL << INT_SWINT_3) | \
-    INT_MASK(INT_SWINT_2) | \
+    (1ULL << INT_SWINT_2) | \
-    INT_MASK(INT_SWINT_1) | \
+    (1ULL << INT_SWINT_1) | \
-    INT_MASK(INT_SWINT_0) | \
+    (1ULL << INT_SWINT_0) | \
-    INT_MASK(INT_UNALIGN_DATA) | \
+    (1ULL << INT_UNALIGN_DATA) | \
-    INT_MASK(INT_DTLB_MISS) | \
+    (1ULL << INT_DTLB_MISS) | \
-    INT_MASK(INT_DTLB_ACCESS) | \
+    (1ULL << INT_DTLB_ACCESS) | \
-    INT_MASK(INT_SN_STATIC_ACCESS) | \
+    (1ULL << INT_SN_STATIC_ACCESS) | \
    0)
 #define CRITICAL_MASKED_INTERRUPTS ( \
-    INT_MASK(INT_MEM_ERROR) | \
+    (1ULL << INT_MEM_ERROR) | \
-    INT_MASK(INT_DMATLB_MISS) | \
+    (1ULL << INT_DMATLB_MISS) | \
-    INT_MASK(INT_DMATLB_ACCESS) | \
+    (1ULL << INT_DMATLB_ACCESS) | \
-    INT_MASK(INT_SNITLB_MISS) | \
+    (1ULL << INT_SNITLB_MISS) | \
-    INT_MASK(INT_SN_NOTIFY) | \
+    (1ULL << INT_SN_NOTIFY) | \
-    INT_MASK(INT_SN_FIREWALL) | \
+    (1ULL << INT_SN_FIREWALL) | \
-    INT_MASK(INT_IDN_FIREWALL) | \
+    (1ULL << INT_IDN_FIREWALL) | \
-    INT_MASK(INT_UDN_FIREWALL) | \
+    (1ULL << INT_UDN_FIREWALL) | \
-    INT_MASK(INT_TILE_TIMER) | \
+    (1ULL << INT_TILE_TIMER) | \
-    INT_MASK(INT_IDN_TIMER) | \
+    (1ULL << INT_IDN_TIMER) | \
-    INT_MASK(INT_UDN_TIMER) | \
+    (1ULL << INT_UDN_TIMER) | \
-    INT_MASK(INT_DMA_NOTIFY) | \
+    (1ULL << INT_DMA_NOTIFY) | \
-    INT_MASK(INT_IDN_CA) | \
+    (1ULL << INT_IDN_CA) | \
-    INT_MASK(INT_UDN_CA) | \
+    (1ULL << INT_UDN_CA) | \
-    INT_MASK(INT_IDN_AVAIL) | \
+    (1ULL << INT_IDN_AVAIL) | \
-    INT_MASK(INT_UDN_AVAIL) | \
+    (1ULL << INT_UDN_AVAIL) | \
-    INT_MASK(INT_PERF_COUNT) | \
+    (1ULL << INT_PERF_COUNT) | \
-    INT_MASK(INT_INTCTRL_3) | \
+    (1ULL << INT_INTCTRL_3) | \
-    INT_MASK(INT_INTCTRL_2) | \
+    (1ULL << INT_INTCTRL_2) | \
-    INT_MASK(INT_INTCTRL_1) | \
+    (1ULL << INT_INTCTRL_1) | \
-    INT_MASK(INT_INTCTRL_0) | \
+    (1ULL << INT_INTCTRL_0) | \
-    INT_MASK(INT_AUX_PERF_COUNT) | \
+    (1ULL << INT_AUX_PERF_COUNT) | \
    0)
 #define CRITICAL_UNMASKED_INTERRUPTS ( \
-    INT_MASK(INT_ITLB_MISS) | \
+    (1ULL << INT_ITLB_MISS) | \
-    INT_MASK(INT_ILL) | \
+    (1ULL << INT_ILL) | \
-    INT_MASK(INT_GPV) | \
+    (1ULL << INT_GPV) | \
-    INT_MASK(INT_SN_ACCESS) | \
+    (1ULL << INT_SN_ACCESS) | \
-    INT_MASK(INT_IDN_ACCESS) | \
+    (1ULL << INT_IDN_ACCESS) | \
-    INT_MASK(INT_UDN_ACCESS) | \
+    (1ULL << INT_UDN_ACCESS) | \
-    INT_MASK(INT_IDN_REFILL) | \
+    (1ULL << INT_IDN_REFILL) | \
-    INT_MASK(INT_UDN_REFILL) | \
+    (1ULL << INT_UDN_REFILL) | \
-    INT_MASK(INT_IDN_COMPLETE) | \
+    (1ULL << INT_IDN_COMPLETE) | \
-    INT_MASK(INT_UDN_COMPLETE) | \
+    (1ULL << INT_UDN_COMPLETE) | \
-    INT_MASK(INT_SWINT_3) | \
+    (1ULL << INT_SWINT_3) | \
-    INT_MASK(INT_SWINT_2) | \
+    (1ULL << INT_SWINT_2) | \
-    INT_MASK(INT_SWINT_1) | \
+    (1ULL << INT_SWINT_1) | \
-    INT_MASK(INT_SWINT_0) | \
+    (1ULL << INT_SWINT_0) | \
-    INT_MASK(INT_UNALIGN_DATA) | \
+    (1ULL << INT_UNALIGN_DATA) | \
-    INT_MASK(INT_DTLB_MISS) | \
+    (1ULL << INT_DTLB_MISS) | \
-    INT_MASK(INT_DTLB_ACCESS) | \
+    (1ULL << INT_DTLB_ACCESS) | \
-    INT_MASK(INT_BOOT_ACCESS) | \
+    (1ULL << INT_BOOT_ACCESS) | \
-    INT_MASK(INT_WORLD_ACCESS) | \
+    (1ULL << INT_WORLD_ACCESS) | \
-    INT_MASK(INT_I_ASID) | \
+    (1ULL << INT_I_ASID) | \
-    INT_MASK(INT_D_ASID) | \
+    (1ULL << INT_D_ASID) | \
-    INT_MASK(INT_DMA_ASID) | \
+    (1ULL << INT_DMA_ASID) | \
-    INT_MASK(INT_SNI_ASID) | \
+    (1ULL << INT_SNI_ASID) | \
-    INT_MASK(INT_DMA_CPL) | \
+    (1ULL << INT_DMA_CPL) | \
-    INT_MASK(INT_SN_CPL) | \
+    (1ULL << INT_SN_CPL) | \
-    INT_MASK(INT_DOUBLE_FAULT) | \
+    (1ULL << INT_DOUBLE_FAULT) | \
-    INT_MASK(INT_SN_STATIC_ACCESS) | \
+    (1ULL << INT_SN_STATIC_ACCESS) | \
    0)
 #define MASKABLE_INTERRUPTS ( \
-    INT_MASK(INT_MEM_ERROR) | \
+    (1ULL << INT_MEM_ERROR) | \
-    INT_MASK(INT_IDN_REFILL) | \
+    (1ULL << INT_IDN_REFILL) | \
-    INT_MASK(INT_UDN_REFILL) | \
+    (1ULL << INT_UDN_REFILL) | \
-    INT_MASK(INT_IDN_COMPLETE) | \
+    (1ULL << INT_IDN_COMPLETE) | \
-    INT_MASK(INT_UDN_COMPLETE) | \
+    (1ULL << INT_UDN_COMPLETE) | \
-    INT_MASK(INT_DMATLB_MISS) | \
+    (1ULL << INT_DMATLB_MISS) | \
-    INT_MASK(INT_DMATLB_ACCESS) | \
+    (1ULL << INT_DMATLB_ACCESS) | \
-    INT_MASK(INT_SNITLB_MISS) | \
+    (1ULL << INT_SNITLB_MISS) | \
-    INT_MASK(INT_SN_NOTIFY) | \
+    (1ULL << INT_SN_NOTIFY) | \
-    INT_MASK(INT_SN_FIREWALL) | \
+    (1ULL << INT_SN_FIREWALL) | \
-    INT_MASK(INT_IDN_FIREWALL) | \
+    (1ULL << INT_IDN_FIREWALL) | \
-    INT_MASK(INT_UDN_FIREWALL) | \
+    (1ULL << INT_UDN_FIREWALL) | \
-    INT_MASK(INT_TILE_TIMER) | \
+    (1ULL << INT_TILE_TIMER) | \
-    INT_MASK(INT_IDN_TIMER) | \
+    (1ULL << INT_IDN_TIMER) | \
-    INT_MASK(INT_UDN_TIMER) | \
+    (1ULL << INT_UDN_TIMER) | \
-    INT_MASK(INT_DMA_NOTIFY) | \
+    (1ULL << INT_DMA_NOTIFY) | \
-    INT_MASK(INT_IDN_CA) | \
+    (1ULL << INT_IDN_CA) | \
-    INT_MASK(INT_UDN_CA) | \
+    (1ULL << INT_UDN_CA) | \
-    INT_MASK(INT_IDN_AVAIL) | \
+    (1ULL << INT_IDN_AVAIL) | \
-    INT_MASK(INT_UDN_AVAIL) | \
+    (1ULL << INT_UDN_AVAIL) | \
-    INT_MASK(INT_PERF_COUNT) | \
+    (1ULL << INT_PERF_COUNT) | \
-    INT_MASK(INT_INTCTRL_3) | \
+    (1ULL << INT_INTCTRL_3) | \
-    INT_MASK(INT_INTCTRL_2) | \
+    (1ULL << INT_INTCTRL_2) | \
-    INT_MASK(INT_INTCTRL_1) | \
+    (1ULL << INT_INTCTRL_1) | \
-    INT_MASK(INT_INTCTRL_0) | \
+    (1ULL << INT_INTCTRL_0) | \
-    INT_MASK(INT_AUX_PERF_COUNT) | \
+    (1ULL << INT_AUX_PERF_COUNT) | \
    0)
 #define UNMASKABLE_INTERRUPTS ( \
-    INT_MASK(INT_ITLB_MISS) | \
+    (1ULL << INT_ITLB_MISS) | \
-    INT_MASK(INT_ILL) | \
+    (1ULL << INT_ILL) | \
-    INT_MASK(INT_GPV) | \
+    (1ULL << INT_GPV) | \
-    INT_MASK(INT_SN_ACCESS) | \
+    (1ULL << INT_SN_ACCESS) | \
-    INT_MASK(INT_IDN_ACCESS) | \
+    (1ULL << INT_IDN_ACCESS) | \
-    INT_MASK(INT_UDN_ACCESS) | \
+    (1ULL << INT_UDN_ACCESS) | \
-    INT_MASK(INT_SWINT_3) | \
+    (1ULL << INT_SWINT_3) | \
-    INT_MASK(INT_SWINT_2) | \
+    (1ULL << INT_SWINT_2) | \
-    INT_MASK(INT_SWINT_1) | \
+    (1ULL << INT_SWINT_1) | \
-    INT_MASK(INT_SWINT_0) | \
+    (1ULL << INT_SWINT_0) | \
-    INT_MASK(INT_UNALIGN_DATA) | \
+    (1ULL << INT_UNALIGN_DATA) | \
-    INT_MASK(INT_DTLB_MISS) | \
+    (1ULL << INT_DTLB_MISS) | \
-    INT_MASK(INT_DTLB_ACCESS) | \
+    (1ULL << INT_DTLB_ACCESS) | \
-    INT_MASK(INT_BOOT_ACCESS) | \
+    (1ULL << INT_BOOT_ACCESS) | \
-    INT_MASK(INT_WORLD_ACCESS) | \
+    (1ULL << INT_WORLD_ACCESS) | \
-    INT_MASK(INT_I_ASID) | \
+    (1ULL << INT_I_ASID) | \
-    INT_MASK(INT_D_ASID) | \
+    (1ULL << INT_D_ASID) | \
-    INT_MASK(INT_DMA_ASID) | \
+    (1ULL << INT_DMA_ASID) | \
-    INT_MASK(INT_SNI_ASID) | \
+    (1ULL << INT_SNI_ASID) | \
-    INT_MASK(INT_DMA_CPL) | \
+    (1ULL << INT_DMA_CPL) | \
-    INT_MASK(INT_SN_CPL) | \
+    (1ULL << INT_SN_CPL) | \
-    INT_MASK(INT_DOUBLE_FAULT) | \
+    (1ULL << INT_DOUBLE_FAULT) | \
-    INT_MASK(INT_SN_STATIC_ACCESS) | \
+    (1ULL << INT_SN_STATIC_ACCESS) | \
    0)
 #define SYNC_INTERRUPTS ( \
-    INT_MASK(INT_ITLB_MISS) | \
+    (1ULL << INT_ITLB_MISS) | \
-    INT_MASK(INT_ILL) | \
+    (1ULL << INT_ILL) | \
-    INT_MASK(INT_GPV) | \
+    (1ULL << INT_GPV) | \
-    INT_MASK(INT_SN_ACCESS) | \
+    (1ULL << INT_SN_ACCESS) | \
-    INT_MASK(INT_IDN_ACCESS) | \
+    (1ULL << INT_IDN_ACCESS) | \
-    INT_MASK(INT_UDN_ACCESS) | \
+    (1ULL << INT_UDN_ACCESS) | \
-    INT_MASK(INT_IDN_REFILL) | \
+    (1ULL << INT_IDN_REFILL) | \
-    INT_MASK(INT_UDN_REFILL) | \
+    (1ULL << INT_UDN_REFILL) | \
-    INT_MASK(INT_IDN_COMPLETE) | \
+    (1ULL << INT_IDN_COMPLETE) | \
-    INT_MASK(INT_UDN_COMPLETE) | \
+    (1ULL << INT_UDN_COMPLETE) | \
-    INT_MASK(INT_SWINT_3) | \
+    (1ULL << INT_SWINT_3) | \
-    INT_MASK(INT_SWINT_2) | \
+    (1ULL << INT_SWINT_2) | \
-    INT_MASK(INT_SWINT_1) | \
+    (1ULL << INT_SWINT_1) | \
-    INT_MASK(INT_SWINT_0) | \
+    (1ULL << INT_SWINT_0) | \
-    INT_MASK(INT_UNALIGN_DATA) | \
+    (1ULL << INT_UNALIGN_DATA) | \
-    INT_MASK(INT_DTLB_MISS) | \
+    (1ULL << INT_DTLB_MISS) | \
-    INT_MASK(INT_DTLB_ACCESS) | \
+    (1ULL << INT_DTLB_ACCESS) | \
-    INT_MASK(INT_SN_STATIC_ACCESS) | \
+    (1ULL << INT_SN_STATIC_ACCESS) | \
    0)
 #define NON_SYNC_INTERRUPTS ( \
-    INT_MASK(INT_MEM_ERROR) | \
+    (1ULL << INT_MEM_ERROR) | \
-    INT_MASK(INT_DMATLB_MISS) | \
+    (1ULL << INT_DMATLB_MISS) | \
-    INT_MASK(INT_DMATLB_ACCESS) | \
+    (1ULL << INT_DMATLB_ACCESS) | \
-    INT_MASK(INT_SNITLB_MISS) | \
+    (1ULL << INT_SNITLB_MISS) | \
-    INT_MASK(INT_SN_NOTIFY) | \
+    (1ULL << INT_SN_NOTIFY) | \
-    INT_MASK(INT_SN_FIREWALL) | \
+    (1ULL << INT_SN_FIREWALL) | \
-    INT_MASK(INT_IDN_FIREWALL) | \
+    (1ULL << INT_IDN_FIREWALL) | \
-    INT_MASK(INT_UDN_FIREWALL) | \
+    (1ULL << INT_UDN_FIREWALL) | \
-    INT_MASK(INT_TILE_TIMER) | \
+    (1ULL << INT_TILE_TIMER) | \
-    INT_MASK(INT_IDN_TIMER) | \
+    (1ULL << INT_IDN_TIMER) | \
-    INT_MASK(INT_UDN_TIMER) | \
+    (1ULL << INT_UDN_TIMER) | \
-    INT_MASK(INT_DMA_NOTIFY) | \
+    (1ULL << INT_DMA_NOTIFY) | \
-    INT_MASK(INT_IDN_CA) | \
+    (1ULL << INT_IDN_CA) | \
-    INT_MASK(INT_UDN_CA) | \
+    (1ULL << INT_UDN_CA) | \
-    INT_MASK(INT_IDN_AVAIL) | \
+    (1ULL << INT_IDN_AVAIL) | \
-    INT_MASK(INT_UDN_AVAIL) | \
+    (1ULL << INT_UDN_AVAIL) | \
-    INT_MASK(INT_PERF_COUNT) | \
+    (1ULL << INT_PERF_COUNT) | \
-    INT_MASK(INT_INTCTRL_3) | \
+    (1ULL << INT_INTCTRL_3) | \
-    INT_MASK(INT_INTCTRL_2) | \
+    (1ULL << INT_INTCTRL_2) | \
-    INT_MASK(INT_INTCTRL_1) | \
+    (1ULL << INT_INTCTRL_1) | \
-    INT_MASK(INT_INTCTRL_0) | \
+    (1ULL << INT_INTCTRL_0) | \
-    INT_MASK(INT_BOOT_ACCESS) | \
+    (1ULL << INT_BOOT_ACCESS) | \
-    INT_MASK(INT_WORLD_ACCESS) | \
+    (1ULL << INT_WORLD_ACCESS) | \
-    INT_MASK(INT_I_ASID) | \
+    (1ULL << INT_I_ASID) | \
-    INT_MASK(INT_D_ASID) | \
+    (1ULL << INT_D_ASID) | \
-    INT_MASK(INT_DMA_ASID) | \
+    (1ULL << INT_DMA_ASID) | \
-    INT_MASK(INT_SNI_ASID) | \
+    (1ULL << INT_SNI_ASID) | \
-    INT_MASK(INT_DMA_CPL) | \
+    (1ULL << INT_DMA_CPL) | \
-    INT_MASK(INT_SN_CPL) | \
+    (1ULL << INT_SN_CPL) | \
-    INT_MASK(INT_DOUBLE_FAULT) | \
+    (1ULL << INT_DOUBLE_FAULT) | \
-    INT_MASK(INT_AUX_PERF_COUNT) | \
+    (1ULL << INT_AUX_PERF_COUNT) | \
    0)
 #endif /* !__ASSEMBLER__ */
 #endif /* !__ARCH_INTERRUPTS_H__ */
diff --git a/arch/tile/include/uapi/arch/interrupts_64.h b/arch/tile/include/uapi/arch/interrupts_64.h
index 5bb58b2e4e6f..13c9f9182348 100644
--- a/arch/tile/include/uapi/arch/interrupts_64.h
+++ b/arch/tile/include/uapi/arch/interrupts_64.h
@@ -15,6 +15,7 @@
 #ifndef __ARCH_INTERRUPTS_H__
 #define __ARCH_INTERRUPTS_H__
+#ifndef __KERNEL__
 /** Mask for an interrupt. */
 #ifdef __ASSEMBLER__
 /* Note: must handle breaking interrupts into high and low words manually. */
@@ -22,6 +23,7 @@
 #else
 #define INT_MASK(intno) (1ULL << (intno))
 #endif
+#endif
 /** Where a given interrupt executes */
@@ -85,192 +87,192 @@
 #ifndef __ASSEMBLER__
 #define QUEUED_INTERRUPTS ( \
-    INT_MASK(INT_MEM_ERROR) | \
+    (1ULL << INT_MEM_ERROR) | \
-    INT_MASK(INT_IDN_COMPLETE) | \
+    (1ULL << INT_IDN_COMPLETE) | \
-    INT_MASK(INT_UDN_COMPLETE) | \
+    (1ULL << INT_UDN_COMPLETE) | \
-    INT_MASK(INT_IDN_FIREWALL) | \
+    (1ULL << INT_IDN_FIREWALL) | \
-    INT_MASK(INT_UDN_FIREWALL) | \
+    (1ULL << INT_UDN_FIREWALL) | \
-    INT_MASK(INT_TILE_TIMER) | \
+    (1ULL << INT_TILE_TIMER) | \
-    INT_MASK(INT_AUX_TILE_TIMER) | \
+    (1ULL << INT_AUX_TILE_TIMER) | \
-    INT_MASK(INT_IDN_TIMER) | \
+    (1ULL << INT_IDN_TIMER) | \
-    INT_MASK(INT_UDN_TIMER) | \
+    (1ULL << INT_UDN_TIMER) | \
-    INT_MASK(INT_IDN_AVAIL) | \
+    (1ULL << INT_IDN_AVAIL) | \
-    INT_MASK(INT_UDN_AVAIL) | \
+    (1ULL << INT_UDN_AVAIL) | \
-    INT_MASK(INT_IPI_3) | \
+    (1ULL << INT_IPI_3) | \
-    INT_MASK(INT_IPI_2) | \
+    (1ULL << INT_IPI_2) | \
-    INT_MASK(INT_IPI_1) | \
+    (1ULL << INT_IPI_1) | \
-    INT_MASK(INT_IPI_0) | \
+    (1ULL << INT_IPI_0) | \
-    INT_MASK(INT_PERF_COUNT) | \
+    (1ULL << INT_PERF_COUNT) | \
-    INT_MASK(INT_AUX_PERF_COUNT) | \
+    (1ULL << INT_AUX_PERF_COUNT) | \
-    INT_MASK(INT_INTCTRL_3) | \
+    (1ULL << INT_INTCTRL_3) | \
-    INT_MASK(INT_INTCTRL_2) | \
+    (1ULL << INT_INTCTRL_2) | \
-    INT_MASK(INT_INTCTRL_1) | \
+    (1ULL << INT_INTCTRL_1) | \
-    INT_MASK(INT_INTCTRL_0) | \
+    (1ULL << INT_INTCTRL_0) | \
-    INT_MASK(INT_BOOT_ACCESS) | \
+    (1ULL << INT_BOOT_ACCESS) | \
-    INT_MASK(INT_WORLD_ACCESS) | \
+    (1ULL << INT_WORLD_ACCESS) | \
-    INT_MASK(INT_I_ASID) | \
+    (1ULL << INT_I_ASID) | \
-    INT_MASK(INT_D_ASID) | \
+    (1ULL << INT_D_ASID) | \
-    INT_MASK(INT_DOUBLE_FAULT) | \
+    (1ULL << INT_DOUBLE_FAULT) | \
    0)
 #define NONQUEUED_INTERRUPTS ( \
-    INT_MASK(INT_SINGLE_STEP_3) | \
+    (1ULL << INT_SINGLE_STEP_3) | \
-    INT_MASK(INT_SINGLE_STEP_2) | \
+    (1ULL << INT_SINGLE_STEP_2) | \
-    INT_MASK(INT_SINGLE_STEP_1) | \
+    (1ULL << INT_SINGLE_STEP_1) | \
-    INT_MASK(INT_SINGLE_STEP_0) | \
+    (1ULL << INT_SINGLE_STEP_0) | \
-    INT_MASK(INT_ITLB_MISS) | \
+    (1ULL << INT_ITLB_MISS) | \
-    INT_MASK(INT_ILL) | \
+    (1ULL << INT_ILL) | \
-    INT_MASK(INT_GPV) | \
+    (1ULL << INT_GPV) | \
-    INT_MASK(INT_IDN_ACCESS) | \
+    (1ULL << INT_IDN_ACCESS) | \
-    INT_MASK(INT_UDN_ACCESS) | \
+    (1ULL << INT_UDN_ACCESS) | \
-    INT_MASK(INT_SWINT_3) | \
+    (1ULL << INT_SWINT_3) | \
-    INT_MASK(INT_SWINT_2) | \
+    (1ULL << INT_SWINT_2) | \
-    INT_MASK(INT_SWINT_1) | \
+    (1ULL << INT_SWINT_1) | \
-    INT_MASK(INT_SWINT_0) | \
+    (1ULL << INT_SWINT_0) | \
-    INT_MASK(INT_ILL_TRANS) | \
+    (1ULL << INT_ILL_TRANS) | \
-    INT_MASK(INT_UNALIGN_DATA) | \
+    (1ULL << INT_UNALIGN_DATA) | \
-    INT_MASK(INT_DTLB_MISS) | \
+    (1ULL << INT_DTLB_MISS) | \
-    INT_MASK(INT_DTLB_ACCESS) | \
+    (1ULL << INT_DTLB_ACCESS) | \
    0)
 #define CRITICAL_MASKED_INTERRUPTS ( \
-    INT_MASK(INT_MEM_ERROR) | \
+    (1ULL << INT_MEM_ERROR) | \
-    INT_MASK(INT_SINGLE_STEP_3) | \
+    (1ULL << INT_SINGLE_STEP_3) | \
-    INT_MASK(INT_SINGLE_STEP_2) | \
+    (1ULL << INT_SINGLE_STEP_2) | \
-    INT_MASK(INT_SINGLE_STEP_1) | \
+    (1ULL << INT_SINGLE_STEP_1) | \
-    INT_MASK(INT_SINGLE_STEP_0) | \
+    (1ULL << INT_SINGLE_STEP_0) | \
-    INT_MASK(INT_IDN_COMPLETE) | \
+    (1ULL << INT_IDN_COMPLETE) | \
-    INT_MASK(INT_UDN_COMPLETE) | \
+    (1ULL << INT_UDN_COMPLETE) | \
-    INT_MASK(INT_IDN_FIREWALL) | \
+    (1ULL << INT_IDN_FIREWALL) | \
-    INT_MASK(INT_UDN_FIREWALL) | \
+    (1ULL << INT_UDN_FIREWALL) | \
-    INT_MASK(INT_TILE_TIMER) | \
+    (1ULL << INT_TILE_TIMER) | \
-    INT_MASK(INT_AUX_TILE_TIMER) | \
+    (1ULL << INT_AUX_TILE_TIMER) | \
-    INT_MASK(INT_IDN_TIMER) | \
+    (1ULL << INT_IDN_TIMER) | \
-    INT_MASK(INT_UDN_TIMER) | \
+    (1ULL << INT_UDN_TIMER) | \
-    INT_MASK(INT_IDN_AVAIL) | \
+    (1ULL << INT_IDN_AVAIL) | \
-    INT_MASK(INT_UDN_AVAIL) | \
+    (1ULL << INT_UDN_AVAIL) | \
-    INT_MASK(INT_IPI_3) | \
+    (1ULL << INT_IPI_3) | \
-    INT_MASK(INT_IPI_2) | \
+    (1ULL << INT_IPI_2) | \
-    INT_MASK(INT_IPI_1) | \
+    (1ULL << INT_IPI_1) | \
-    INT_MASK(INT_IPI_0) | \
+    (1ULL << INT_IPI_0) | \
-    INT_MASK(INT_PERF_COUNT) | \
+    (1ULL << INT_PERF_COUNT) | \
-    INT_MASK(INT_AUX_PERF_COUNT) | \
+    (1ULL << INT_AUX_PERF_COUNT) | \
-    INT_MASK(INT_INTCTRL_3) | \
+    (1ULL << INT_INTCTRL_3) | \
-    INT_MASK(INT_INTCTRL_2) | \
+    (1ULL << INT_INTCTRL_2) | \
-    INT_MASK(INT_INTCTRL_1) | \
+    (1ULL << INT_INTCTRL_1) | \
-    INT_MASK(INT_INTCTRL_0) | \
+    (1ULL << INT_INTCTRL_0) | \
    0)
 #define CRITICAL_UNMASKED_INTERRUPTS ( \
-    INT_MASK(INT_ITLB_MISS) | \
+    (1ULL << INT_ITLB_MISS) | \
-    INT_MASK(INT_ILL) | \
+    (1ULL << INT_ILL) | \
-    INT_MASK(INT_GPV) | \
+    (1ULL << INT_GPV) | \
-    INT_MASK(INT_IDN_ACCESS) | \
+    (1ULL << INT_IDN_ACCESS) | \
-    INT_MASK(INT_UDN_ACCESS) | \
+    (1ULL << INT_UDN_ACCESS) | \
-    INT_MASK(INT_SWINT_3) | \
+    (1ULL << INT_SWINT_3) | \
-    INT_MASK(INT_SWINT_2) | \
+    (1ULL << INT_SWINT_2) | \
-    INT_MASK(INT_SWINT_1) | \
+    (1ULL << INT_SWINT_1) | \
-    INT_MASK(INT_SWINT_0) | \
+    (1ULL << INT_SWINT_0) | \
-    INT_MASK(INT_ILL_TRANS) | \
+    (1ULL << INT_ILL_TRANS) | \
-    INT_MASK(INT_UNALIGN_DATA) | \
+    (1ULL << INT_UNALIGN_DATA) | \
-    INT_MASK(INT_DTLB_MISS) | \
+    (1ULL << INT_DTLB_MISS) | \
-    INT_MASK(INT_DTLB_ACCESS) | \
+    (1ULL << INT_DTLB_ACCESS) | \
-    INT_MASK(INT_BOOT_ACCESS) | \
+    (1ULL << INT_BOOT_ACCESS) | \
-    INT_MASK(INT_WORLD_ACCESS) | \
+    (1ULL << INT_WORLD_ACCESS) | \
-    INT_MASK(INT_I_ASID) | \
+    (1ULL << INT_I_ASID) | \
-    INT_MASK(INT_D_ASID) | \
+    (1ULL << INT_D_ASID) | \
-    INT_MASK(INT_DOUBLE_FAULT) | \
+    (1ULL << INT_DOUBLE_FAULT) | \
    0)
 #define MASKABLE_INTERRUPTS ( \
-    INT_MASK(INT_MEM_ERROR) | \
+    (1ULL << INT_MEM_ERROR) | \
-    INT_MASK(INT_SINGLE_STEP_3) | \
+    (1ULL << INT_SINGLE_STEP_3) | \
-    INT_MASK(INT_SINGLE_STEP_2) | \
+    (1ULL << INT_SINGLE_STEP_2) | \
-    INT_MASK(INT_SINGLE_STEP_1) | \
+    (1ULL << INT_SINGLE_STEP_1) | \
-    INT_MASK(INT_SINGLE_STEP_0) | \
+    (1ULL << INT_SINGLE_STEP_0) | \
-    INT_MASK(INT_IDN_COMPLETE) | \
+    (1ULL << INT_IDN_COMPLETE) | \
-    INT_MASK(INT_UDN_COMPLETE) | \
+    (1ULL << INT_UDN_COMPLETE) | \
-    INT_MASK(INT_IDN_FIREWALL) | \
+    (1ULL << INT_IDN_FIREWALL) | \
-    INT_MASK(INT_UDN_FIREWALL) | \
+    (1ULL << INT_UDN_FIREWALL) | \
-    INT_MASK(INT_TILE_TIMER) | \
+    (1ULL << INT_TILE_TIMER) | \
-    INT_MASK(INT_AUX_TILE_TIMER) | \
+    (1ULL << INT_AUX_TILE_TIMER) | \
-    INT_MASK(INT_IDN_TIMER) | \
+    (1ULL << INT_IDN_TIMER) | \
-    INT_MASK(INT_UDN_TIMER) | \
+    (1ULL << INT_UDN_TIMER) | \
-    INT_MASK(INT_IDN_AVAIL) | \
+    (1ULL << INT_IDN_AVAIL) | \
-    INT_MASK(INT_UDN_AVAIL) | \
+    (1ULL << INT_UDN_AVAIL) | \
-    INT_MASK(INT_IPI_3) | \
+    (1ULL << INT_IPI_3) | \
-    INT_MASK(INT_IPI_2) | \
+    (1ULL << INT_IPI_2) | \
-    INT_MASK(INT_IPI_1) | \
+    (1ULL << INT_IPI_1) | \
-    INT_MASK(INT_IPI_0) | \
+    (1ULL << INT_IPI_0) | \
-    INT_MASK(INT_PERF_COUNT) | \
+    (1ULL << INT_PERF_COUNT) | \
-    INT_MASK(INT_AUX_PERF_COUNT) | \
+    (1ULL << INT_AUX_PERF_COUNT) | \
-    INT_MASK(INT_INTCTRL_3) | \
+    (1ULL << INT_INTCTRL_3) | \
-    INT_MASK(INT_INTCTRL_2) | \
+    (1ULL << INT_INTCTRL_2) | \
-    INT_MASK(INT_INTCTRL_1) | \
+    (1ULL << INT_INTCTRL_1) | \
-    INT_MASK(INT_INTCTRL_0) | \
+    (1ULL << INT_INTCTRL_0) | \
    0)
 #define UNMASKABLE_INTERRUPTS ( \
-    INT_MASK(INT_ITLB_MISS) | \
+    (1ULL << INT_ITLB_MISS) | \
-    INT_MASK(INT_ILL) | \
+    (1ULL << INT_ILL) | \
-    INT_MASK(INT_GPV) | \
+    (1ULL << INT_GPV) | \
-    INT_MASK(INT_IDN_ACCESS) | \
+    (1ULL << INT_IDN_ACCESS) | \
-    INT_MASK(INT_UDN_ACCESS) | \
+    (1ULL << INT_UDN_ACCESS) | \
-    INT_MASK(INT_SWINT_3) | \
+    (1ULL << INT_SWINT_3) | \
-    INT_MASK(INT_SWINT_2) | \
+    (1ULL << INT_SWINT_2) | \
-    INT_MASK(INT_SWINT_1) | \
+    (1ULL << INT_SWINT_1) | \
-    INT_MASK(INT_SWINT_0) | \
+    (1ULL << INT_SWINT_0) | \
-    INT_MASK(INT_ILL_TRANS) | \
+    (1ULL << INT_ILL_TRANS) | \
-    INT_MASK(INT_UNALIGN_DATA) | \
+    (1ULL << INT_UNALIGN_DATA) | \
-    INT_MASK(INT_DTLB_MISS) | \
+    (1ULL << INT_DTLB_MISS) | \
-    INT_MASK(INT_DTLB_ACCESS) | \
+    (1ULL << INT_DTLB_ACCESS) | \
-    INT_MASK(INT_BOOT_ACCESS) | \
+    (1ULL << INT_BOOT_ACCESS) | \
-    INT_MASK(INT_WORLD_ACCESS) | \
+    (1ULL << INT_WORLD_ACCESS) | \
-    INT_MASK(INT_I_ASID) | \
+    (1ULL << INT_I_ASID) | \
-    INT_MASK(INT_D_ASID) | \
+    (1ULL << INT_D_ASID) | \
-    INT_MASK(INT_DOUBLE_FAULT) | \
+    (1ULL << INT_DOUBLE_FAULT) | \
    0)
 #define SYNC_INTERRUPTS ( \
-    INT_MASK(INT_SINGLE_STEP_3) | \
+    (1ULL << INT_SINGLE_STEP_3) | \
-    INT_MASK(INT_SINGLE_STEP_2) | \
+    (1ULL << INT_SINGLE_STEP_2) | \
-    INT_MASK(INT_SINGLE_STEP_1) | \
+    (1ULL << INT_SINGLE_STEP_1) | \
-    INT_MASK(INT_SINGLE_STEP_0) | \
+    (1ULL << INT_SINGLE_STEP_0) | \
-    INT_MASK(INT_IDN_COMPLETE) | \
+    (1ULL << INT_IDN_COMPLETE) | \
-    INT_MASK(INT_UDN_COMPLETE) | \
+    (1ULL << INT_UDN_COMPLETE) | \
-    INT_MASK(INT_ITLB_MISS) | \
+    (1ULL << INT_ITLB_MISS) | \
-    INT_MASK(INT_ILL) | \
+    (1ULL << INT_ILL) | \
-    INT_MASK(INT_GPV) | \
+    (1ULL << INT_GPV) | \
-    INT_MASK(INT_IDN_ACCESS) | \
+    (1ULL << INT_IDN_ACCESS) | \
-    INT_MASK(INT_UDN_ACCESS) | \
+    (1ULL << INT_UDN_ACCESS) | \
-    INT_MASK(INT_SWINT_3) | \
+    (1ULL << INT_SWINT_3) | \
-    INT_MASK(INT_SWINT_2) | \
+    (1ULL << INT_SWINT_2) | \
-    INT_MASK(INT_SWINT_1) | \
+    (1ULL << INT_SWINT_1) | \
-    INT_MASK(INT_SWINT_0) | \
+    (1ULL << INT_SWINT_0) | \
-    INT_MASK(INT_ILL_TRANS) | \
+    (1ULL << INT_ILL_TRANS) | \
-    INT_MASK(INT_UNALIGN_DATA) | \
+    (1ULL << INT_UNALIGN_DATA) | \
-    INT_MASK(INT_DTLB_MISS) | \
+    (1ULL << INT_DTLB_MISS) | \
-    INT_MASK(INT_DTLB_ACCESS) | \
+    (1ULL << INT_DTLB_ACCESS) | \
    0)
 #define NON_SYNC_INTERRUPTS ( \
-    INT_MASK(INT_MEM_ERROR) | \
+    (1ULL << INT_MEM_ERROR) | \
-    INT_MASK(INT_IDN_FIREWALL) | \
+    (1ULL << INT_IDN_FIREWALL) | \
-    INT_MASK(INT_UDN_FIREWALL) | \
+    (1ULL << INT_UDN_FIREWALL) | \
-    INT_MASK(INT_TILE_TIMER) | \
+    (1ULL << INT_TILE_TIMER) | \
-    INT_MASK(INT_AUX_TILE_TIMER) | \
+    (1ULL << INT_AUX_TILE_TIMER) | \
-    INT_MASK(INT_IDN_TIMER) | \
+    (1ULL << INT_IDN_TIMER) | \
-    INT_MASK(INT_UDN_TIMER) | \
+    (1ULL << INT_UDN_TIMER) | \
-    INT_MASK(INT_IDN_AVAIL) | \
+    (1ULL << INT_IDN_AVAIL) | \
-    INT_MASK(INT_UDN_AVAIL) | \
+    (1ULL << INT_UDN_AVAIL) | \
-    INT_MASK(INT_IPI_3) | \
+    (1ULL << INT_IPI_3) | \
-    INT_MASK(INT_IPI_2) | \
+    (1ULL << INT_IPI_2) | \
-    INT_MASK(INT_IPI_1) | \
+    (1ULL << INT_IPI_1) | \
-    INT_MASK(INT_IPI_0) | \
+    (1ULL << INT_IPI_0) | \
-    INT_MASK(INT_PERF_COUNT) | \
+    (1ULL << INT_PERF_COUNT) | \
-    INT_MASK(INT_AUX_PERF_COUNT) | \
+    (1ULL << INT_AUX_PERF_COUNT) | \
-    INT_MASK(INT_INTCTRL_3) | \
+    (1ULL << INT_INTCTRL_3) | \
-    INT_MASK(INT_INTCTRL_2) | \
+    (1ULL << INT_INTCTRL_2) | \
-    INT_MASK(INT_INTCTRL_1) | \
+    (1ULL << INT_INTCTRL_1) | \
-    INT_MASK(INT_INTCTRL_0) | \
+    (1ULL << INT_INTCTRL_0) | \
-    INT_MASK(INT_BOOT_ACCESS) | \
+    (1ULL << INT_BOOT_ACCESS) | \
-    INT_MASK(INT_WORLD_ACCESS) | \
+    (1ULL << INT_WORLD_ACCESS) | \
-    INT_MASK(INT_I_ASID) | \
+    (1ULL << INT_I_ASID) | \
-    INT_MASK(INT_D_ASID) | \
+    (1ULL << INT_D_ASID) | \
-    INT_MASK(INT_DOUBLE_FAULT) | \
+    (1ULL << INT_DOUBLE_FAULT) | \
    0)
 #endif /* !__ASSEMBLER__ */
 #endif /* !__ARCH_INTERRUPTS_H__ */
diff --git a/arch/tile/kernel/intvec_64.S b/arch/tile/kernel/intvec_64.S
index 54bc9a6678e8..4ea080902654 100644
--- a/arch/tile/kernel/intvec_64.S
+++ b/arch/tile/kernel/intvec_64.S
@@ -1035,7 +1035,9 @@ handle_syscall:
        /* Ensure that the syscall number is within the legal range. */
        {
         moveli r20, hw2(sys_call_table)
+#ifdef CONFIG_COMPAT
         blbs   r30, .Lcompat_syscall
+#endif
        }
        {
         cmpltu r21, TREG_SYSCALL_NR_NAME, r21
@@ -1093,6 +1095,7 @@ handle_syscall:
         j      .Lresume_userspace   /* jump into middle of interrupt_return */
        }
+#ifdef CONFIG_COMPAT
 .Lcompat_syscall:
        /*
         * Load the base of the compat syscall table in r20, and
@@ -1117,6 +1120,7 @@ handle_syscall:
        { move r15, r4; addxi r4, r4, 0 }
        { move r16, r5; addxi r5, r5, 0 }
        j .Lload_syscall_pointer
+#endif
 .Linvalid_syscall:
        /* Report an invalid syscall back to the user program */
diff --git a/arch/tile/kernel/process.c b/arch/tile/kernel/process.c
index 0e5661e7d00d..caf93ae11793 100644
--- a/arch/tile/kernel/process.c
+++ b/arch/tile/kernel/process.c
@@ -159,7 +159,7 @@ static void save_arch_state(struct thread_struct *t);
 int copy_thread(unsigned long clone_flags, unsigned long sp,
                unsigned long arg, struct task_struct *p)
 {
-        struct pt_regs *childregs = task_pt_regs(p), *regs = current_pt_regs();
+        struct pt_regs *childregs = task_pt_regs(p);
        unsigned long ksp;
        unsigned long *callee_regs;
diff --git a/arch/tile/kernel/reboot.c b/arch/tile/kernel/reboot.c
index baa3d905fee2..d1b5c913ae72 100644
--- a/arch/tile/kernel/reboot.c
+++ b/arch/tile/kernel/reboot.c
@@ -16,6 +16,7 @@
 #include <linux/reboot.h>
 #include <linux/smp.h>
 #include <linux/pm.h>
+#include <linux/export.h>
 #include <asm/page.h>
 #include <asm/setup.h>
 #include <hv/hypervisor.h>
@@ -49,3 +50,4 @@ void machine_restart(char *cmd)
 /* No interesting distinction to be made here. */
 void (*pm_power_off)(void) = NULL;
+EXPORT_SYMBOL(pm_power_off);
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 6a649a4462d3..d1e15f7b59c6 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -31,6 +31,7 @@
 #include <linux/timex.h>
 #include <linux/hugetlb.h>
 #include <linux/start_kernel.h>
+#include <linux/screen_info.h>
 #include <asm/setup.h>
 #include <asm/sections.h>
 #include <asm/cacheflush.h>
@@ -49,6 +50,10 @@ static inline int ABS(int x) { return x >= 0 ? x : -x; }
 /* Chip information */
 char chip_model[64] __write_once;
+#ifdef CONFIG_VT
+struct screen_info screen_info;
+#endif
 struct pglist_data node_data[MAX_NUMNODES] __read_mostly;
 EXPORT_SYMBOL(node_data);
diff --git a/arch/tile/kernel/stack.c b/arch/tile/kernel/stack.c
index b2f44c28dda6..ed258b8ae320 100644
--- a/arch/tile/kernel/stack.c
+++ b/arch/tile/kernel/stack.c
@@ -112,7 +112,7 @@ static struct pt_regs *valid_fault_handler(struct KBacktraceIterator* kbt)
                       p->pc, p->sp, p->ex1);
                p = NULL;
        }
-        if (!kbt->profile || (INT_MASK(p->faultnum) & QUEUED_INTERRUPTS) == 0)
+        if (!kbt->profile || ((1ULL << p->faultnum) & QUEUED_INTERRUPTS) == 0)
                return p;
        return NULL;
 }
@@ -484,6 +484,7 @@ void save_stack_trace(struct stack_trace *trace)
 {
        save_stack_trace_tsk(NULL, trace);
 }
+EXPORT_SYMBOL_GPL(save_stack_trace);
 #endif
diff --git a/arch/tile/lib/cacheflush.c b/arch/tile/lib/cacheflush.c
index db4fb89e12d8..8f8ad814b139 100644
--- a/arch/tile/lib/cacheflush.c
+++ b/arch/tile/lib/cacheflush.c
@@ -12,6 +12,7 @@
 *   more details.
 */
+#include <linux/export.h>
 #include <asm/page.h>
 #include <asm/cacheflush.h>
 #include <arch/icache.h>
@@ -165,3 +166,4 @@ void finv_buffer_remote(void *buffer, size_t size, int hfh)
        __insn_mtspr(SPR_DSTREAM_PF, old_dstream_pf);
 #endif
 }
+EXPORT_SYMBOL_GPL(finv_buffer_remote);
diff --git a/arch/tile/lib/cpumask.c b/arch/tile/lib/cpumask.c
index fdc403614d12..75947edccb26 100644
--- a/arch/tile/lib/cpumask.c
+++ b/arch/tile/lib/cpumask.c
@@ -16,6 +16,7 @@
 #include <linux/ctype.h>
 #include <linux/errno.h>
 #include <linux/smp.h>
+#include <linux/export.h>
 /*
 * Allow cropping out bits beyond the end of the array.
@@ -50,3 +51,4 @@ int bitmap_parselist_crop(const char *bp, unsigned long *maskp, int nmaskbits)
        } while (*bp != '\0' && *bp != '\n');
        return 0;
 }
+EXPORT_SYMBOL(bitmap_parselist_crop);
diff --git a/arch/tile/lib/exports.c b/arch/tile/lib/exports.c
index dd5f0a33fdaf..4385cb6fa00a 100644
--- a/arch/tile/lib/exports.c
+++ b/arch/tile/lib/exports.c
@@ -55,6 +55,8 @@ EXPORT_SYMBOL(hv_dev_poll_cancel);
 EXPORT_SYMBOL(hv_dev_close);
 EXPORT_SYMBOL(hv_sysconf);
 EXPORT_SYMBOL(hv_confstr);
+EXPORT_SYMBOL(hv_get_rtc);
+EXPORT_SYMBOL(hv_set_rtc);
 /* libgcc.a */
 uint32_t __udivsi3(uint32_t dividend, uint32_t divisor);
diff --git a/arch/tile/mm/homecache.c b/arch/tile/mm/homecache.c
index 5f7868dcd6d4..1ae911939a18 100644
--- a/arch/tile/mm/homecache.c
+++ b/arch/tile/mm/homecache.c
@@ -408,6 +408,7 @@ void homecache_change_page_home(struct page *page, int order, int home)
                __set_pte(ptep, pte_set_home(pteval, home));
        }
 }
+EXPORT_SYMBOL(homecache_change_page_home);
 struct page *homecache_alloc_pages(gfp_t gfp_mask,
                                   unsigned int order, int home)
diff --git a/arch/xtensa/include/asm/dma-mapping.h b/arch/xtensa/include/asm/dma-mapping.h
index 4acb5feba1fb..172a02a6ad14 100644
--- a/arch/xtensa/include/asm/dma-mapping.h
+++ b/arch/xtensa/include/asm/dma-mapping.h
@@ -170,4 +170,19 @@ dma_cache_sync(struct device *dev, void *vaddr, size_t size,
        consistent_sync(vaddr, size, direction);
 }
+/* Not supported for now */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
 #endif  /* _XTENSA_DMA_MAPPING_H */
diff --git a/block/genhd.c b/block/genhd.c
index 9a289d7c84bb..3993ebf4135f 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -35,6 +35,8 @@ static DEFINE_IDR(ext_devt_idr);
 static struct device_type disk_type;
+static void disk_check_events(struct disk_events *ev,
+                              unsigned int *clearing_ptr);
 static void disk_alloc_events(struct gendisk *disk);
 static void disk_add_events(struct gendisk *disk);
 static void disk_del_events(struct gendisk *disk);
@@ -1549,6 +1551,7 @@ unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask)
        const struct block_device_operations *bdops = disk->fops;
        struct disk_events *ev = disk->ev;
        unsigned int pending;
+        unsigned int clearing = mask;
        if (!ev) {
                /* for drivers still using the old ->media_changed method */
@@ -1558,34 +1561,53 @@ unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask)
                return 0;
        }
-        /* tell the workfn about the events being cleared */
+        disk_block_events(disk);
+        /*
+         * store the union of mask and ev->clearing on the stack so that the
+         * race with disk_flush_events does not cause ambiguity (ev->clearing
+         * can still be modified even if events are blocked).
+         */
        spin_lock_irq(&ev->lock);
-        ev->clearing |= mask;
+        clearing |= ev->clearing;
+        ev->clearing = 0;
        spin_unlock_irq(&ev->lock);
-        /* uncondtionally schedule event check and wait for it to finish */
+        disk_check_events(ev, &clearing);
-        disk_block_events(disk);
+        /*
-        queue_delayed_work(system_freezable_wq, &ev->dwork, 0);
+         * if ev->clearing is not 0, the disk_flush_events got called in the
-        flush_delayed_work(&ev->dwork);
+         * middle of this function, so we want to run the workfn without delay.
-        __disk_unblock_events(disk, false);
+         */
+        __disk_unblock_events(disk, ev->clearing ? true : false);
        /* then, fetch and clear pending events */
        spin_lock_irq(&ev->lock);
-        WARN_ON_ONCE(ev->clearing & mask);      /* cleared by workfn */
        pending = ev->pending & mask;
        ev->pending &= ~mask;
        spin_unlock_irq(&ev->lock);
+        WARN_ON_ONCE(clearing & mask);
        return pending;
 }
+/*
+ * Separate this part out so that a different pointer for clearing_ptr can be
+ * passed in for disk_clear_events.
+ */
 static void disk_events_workfn(struct work_struct *work)
 {
        struct delayed_work *dwork = to_delayed_work(work);
        struct disk_events *ev = container_of(dwork, struct disk_events, dwork);
+        disk_check_events(ev, &ev->clearing);
+}
+static void disk_check_events(struct disk_events *ev,
+                              unsigned int *clearing_ptr)
+{
        struct gendisk *disk = ev->disk;
        char *envp[ARRAY_SIZE(disk_uevents) + 1] = { };
-        unsigned int clearing = ev->clearing;
+        unsigned int clearing = *clearing_ptr;
        unsigned int events;
        unsigned long intv;
        int nr_events = 0, i;
@@ -1598,7 +1620,7 @@ static void disk_events_workfn(struct work_struct *work)
        events &= ~ev->pending;
        ev->pending |= events;
-        ev->clearing &= ~clearing;
+        *clearing_ptr &= ~clearing;
        intv = disk_events_poll_jiffies(disk);
        if (!ev->block && intv)
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index 6a0955e6d4fc..53ecac5a2161 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -636,82 +636,82 @@ struct rx_buf_desc {
 #define SEG_BASE IPHASE5575_FRAG_CONTROL_REG_BASE  
 #define REASS_BASE IPHASE5575_REASS_CONTROL_REG_BASE  
-typedef volatile u_int  freg_t;
+typedef volatile u_int  ffreg_t;
 typedef u_int   rreg_t;
 typedef struct _ffredn_t {
-        freg_t  idlehead_high;  /* Idle cell header (high)              */
+        ffreg_t idlehead_high;  /* Idle cell header (high)              */
-        freg_t  idlehead_low;   /* Idle cell header (low)               */
+        ffreg_t idlehead_low;   /* Idle cell header (low)               */
-        freg_t  maxrate;        /* Maximum rate                         */
+        ffreg_t maxrate;        /* Maximum rate                         */
-        freg_t  stparms;        /* Traffic Management Parameters        */
+        ffreg_t stparms;        /* Traffic Management Parameters        */
-        freg_t  abrubr_abr;     /* ABRUBR Priority Byte 1, TCR Byte 0   */
+        ffreg_t abrubr_abr;     /* ABRUBR Priority Byte 1, TCR Byte 0   */
-        freg_t  rm_type;        /*                                      */
+        ffreg_t rm_type;        /*                                      */
-        u_int   filler5[0x17 - 0x06];
+        u_int   filler5[0x17 - 0x06];
-        freg_t  cmd_reg;        /* Command register                     */
+        ffreg_t cmd_reg;        /* Command register                     */
-        u_int   filler18[0x20 - 0x18];
+        u_int   filler18[0x20 - 0x18];
-        freg_t  cbr_base;       /* CBR Pointer Base                     */
+        ffreg_t cbr_base;       /* CBR Pointer Base                     */
-        freg_t  vbr_base;       /* VBR Pointer Base                     */
+        ffreg_t vbr_base;       /* VBR Pointer Base                     */
-        freg_t  abr_base;       /* ABR Pointer Base                     */
+        ffreg_t abr_base;       /* ABR Pointer Base                     */
-        freg_t  ubr_base;       /* UBR Pointer Base                     */
+        ffreg_t ubr_base;       /* UBR Pointer Base                     */
-        u_int   filler24;
+        u_int   filler24;
-        freg_t  vbrwq_base;     /* VBR Wait Queue Base                  */
+        ffreg_t vbrwq_base;     /* VBR Wait Queue Base                  */
-        freg_t  abrwq_base;     /* ABR Wait Queue Base                  */
+        ffreg_t abrwq_base;     /* ABR Wait Queue Base                  */
-        freg_t  ubrwq_base;     /* UBR Wait Queue Base                  */
+        ffreg_t ubrwq_base;     /* UBR Wait Queue Base                  */
-        freg_t  vct_base;       /* Main VC Table Base                   */
+        ffreg_t vct_base;       /* Main VC Table Base                   */
-        freg_t  vcte_base;      /* Extended Main VC Table Base          */
+        ffreg_t vcte_base;      /* Extended Main VC Table Base          */
-        u_int   filler2a[0x2C - 0x2A];
+        u_int   filler2a[0x2C - 0x2A];
-        freg_t  cbr_tab_beg;    /* CBR Table Begin                      */
+        ffreg_t cbr_tab_beg;    /* CBR Table Begin                      */
-        freg_t  cbr_tab_end;    /* CBR Table End                        */
+        ffreg_t cbr_tab_end;    /* CBR Table End                        */
-        freg_t  cbr_pointer;    /* CBR Pointer                          */
+        ffreg_t cbr_pointer;    /* CBR Pointer                          */
-        u_int   filler2f[0x30 - 0x2F];
+        u_int   filler2f[0x30 - 0x2F];
-        freg_t  prq_st_adr;     /* Packet Ready Queue Start Address     */
+        ffreg_t prq_st_adr;     /* Packet Ready Queue Start Address     */
-        freg_t  prq_ed_adr;     /* Packet Ready Queue End Address       */
+        ffreg_t prq_ed_adr;     /* Packet Ready Queue End Address       */
-        freg_t  prq_rd_ptr;     /* Packet Ready Queue read pointer      */
+        ffreg_t prq_rd_ptr;     /* Packet Ready Queue read pointer      */
-        freg_t  prq_wr_ptr;     /* Packet Ready Queue write pointer     */
+        ffreg_t prq_wr_ptr;     /* Packet Ready Queue write pointer     */
-        freg_t  tcq_st_adr;     /* Transmit Complete Queue Start Address*/
+        ffreg_t tcq_st_adr;     /* Transmit Complete Queue Start Address*/
-        freg_t  tcq_ed_adr;     /* Transmit Complete Queue End Address  */
+        ffreg_t tcq_ed_adr;     /* Transmit Complete Queue End Address  */
-        freg_t  tcq_rd_ptr;     /* Transmit Complete Queue read pointer */
+        ffreg_t tcq_rd_ptr;     /* Transmit Complete Queue read pointer */
-        freg_t  tcq_wr_ptr;     /* Transmit Complete Queue write pointer*/
+        ffreg_t tcq_wr_ptr;     /* Transmit Complete Queue write pointer*/
-        u_int   filler38[0x40 - 0x38];
+        u_int   filler38[0x40 - 0x38];
-        freg_t  queue_base;     /* Base address for PRQ and TCQ         */
+        ffreg_t queue_base;     /* Base address for PRQ and TCQ         */
-        freg_t  desc_base;      /* Base address of descriptor table     */
+        ffreg_t desc_base;      /* Base address of descriptor table     */
-        u_int   filler42[0x45 - 0x42];
+        u_int   filler42[0x45 - 0x42];
-        freg_t  mode_reg_0;     /* Mode register 0                      */
+        ffreg_t mode_reg_0;     /* Mode register 0                      */
-        freg_t  mode_reg_1;     /* Mode register 1                      */
+        ffreg_t mode_reg_1;     /* Mode register 1                      */
-        freg_t  intr_status_reg;/* Interrupt Status register            */
+        ffreg_t intr_status_reg;/* Interrupt Status register            */
-        freg_t  mask_reg;       /* Mask Register                        */
+        ffreg_t mask_reg;       /* Mask Register                        */
-        freg_t  cell_ctr_high1; /* Total cell transfer count (high)     */
+        ffreg_t cell_ctr_high1; /* Total cell transfer count (high)     */
-        freg_t  cell_ctr_lo1;   /* Total cell transfer count (low)      */
+        ffreg_t cell_ctr_lo1;   /* Total cell transfer count (low)      */
-        freg_t  state_reg;      /* Status register                      */
+        ffreg_t state_reg;      /* Status register                      */
-        u_int   filler4c[0x58 - 0x4c];
+        u_int   filler4c[0x58 - 0x4c];
-        freg_t  curr_desc_num;  /* Contains the current descriptor num  */
+        ffreg_t curr_desc_num;  /* Contains the current descriptor num  */
-        freg_t  next_desc;      /* Next descriptor                      */
+        ffreg_t next_desc;      /* Next descriptor                      */
-        freg_t  next_vc;        /* Next VC                              */
+        ffreg_t next_vc;        /* Next VC                              */
-        u_int   filler5b[0x5d - 0x5b];
+        u_int   filler5b[0x5d - 0x5b];
-        freg_t  present_slot_cnt;/* Present slot count                  */
+        ffreg_t present_slot_cnt;/* Present slot count                  */
-        u_int   filler5e[0x6a - 0x5e];
+        u_int   filler5e[0x6a - 0x5e];
-        freg_t  new_desc_num;   /* New descriptor number                */
+        ffreg_t new_desc_num;   /* New descriptor number                */
-        freg_t  new_vc;         /* New VC                               */
+        ffreg_t new_vc;         /* New VC                               */
-        freg_t  sched_tbl_ptr;  /* Schedule table pointer               */
+        ffreg_t sched_tbl_ptr;  /* Schedule table pointer               */
-        freg_t  vbrwq_wptr;     /* VBR wait queue write pointer         */
+        ffreg_t vbrwq_wptr;     /* VBR wait queue write pointer         */
-        freg_t  vbrwq_rptr;     /* VBR wait queue read pointer          */
+        ffreg_t vbrwq_rptr;     /* VBR wait queue read pointer          */
-        freg_t  abrwq_wptr;     /* ABR wait queue write pointer         */
+        ffreg_t abrwq_wptr;     /* ABR wait queue write pointer         */
-        freg_t  abrwq_rptr;     /* ABR wait queue read pointer          */
+        ffreg_t abrwq_rptr;     /* ABR wait queue read pointer          */
-        freg_t  ubrwq_wptr;     /* UBR wait queue write pointer         */
+        ffreg_t ubrwq_wptr;     /* UBR wait queue write pointer         */
-        freg_t  ubrwq_rptr;     /* UBR wait queue read pointer          */
+        ffreg_t ubrwq_rptr;     /* UBR wait queue read pointer          */
-        freg_t  cbr_vc;         /* CBR VC                               */
+        ffreg_t cbr_vc;         /* CBR VC                               */
-        freg_t  vbr_sb_vc;      /* VBR SB VC                            */
+        ffreg_t vbr_sb_vc;      /* VBR SB VC                            */
-        freg_t  abr_sb_vc;      /* ABR SB VC                            */
+        ffreg_t abr_sb_vc;      /* ABR SB VC                            */
-        freg_t  ubr_sb_vc;      /* UBR SB VC                            */
+        ffreg_t ubr_sb_vc;      /* UBR SB VC                            */
-        freg_t  vbr_next_link;  /* VBR next link                        */
+        ffreg_t vbr_next_link;  /* VBR next link                        */
-        freg_t  abr_next_link;  /* ABR next link                        */
+        ffreg_t abr_next_link;  /* ABR next link                        */
-        freg_t  ubr_next_link;  /* UBR next link                        */
+        ffreg_t ubr_next_link;  /* UBR next link                        */
-        u_int   filler7a[0x7c-0x7a];
+        u_int   filler7a[0x7c-0x7a];
-        freg_t  out_rate_head;  /* Out of rate head                     */
+        ffreg_t out_rate_head;  /* Out of rate head                     */
-        u_int   filler7d[0xca-0x7d]; /* pad out to full address space   */
+        u_int   filler7d[0xca-0x7d]; /* pad out to full address space   */
-        freg_t  cell_ctr_high1_nc;/* Total cell transfer count (high)   */
+        ffreg_t cell_ctr_high1_nc;/* Total cell transfer count (high)   */
-        freg_t  cell_ctr_lo1_nc;/* Total cell transfer count (low)      */
+        ffreg_t cell_ctr_lo1_nc;/* Total cell transfer count (low)      */
-        u_int   fillercc[0x100-0xcc]; /* pad out to full address space   */
+        u_int   fillercc[0x100-0xcc]; /* pad out to full address space   */
 } ffredn_t;
 typedef struct _rfredn_t {
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 19e3fbfd5757..cb0c45488572 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -94,11 +94,16 @@ void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 #ifdef CONFIG_BCMA_DRIVER_GPIO
 /* driver_gpio.c */
 int bcma_gpio_init(struct bcma_drv_cc *cc);
+int bcma_gpio_unregister(struct bcma_drv_cc *cc);
 #else
 static inline int bcma_gpio_init(struct bcma_drv_cc *cc)
 {
        return -ENOTSUPP;
 }
+static inline int bcma_gpio_unregister(struct bcma_drv_cc *cc)
+{
+        return 0;
+}
 #endif /* CONFIG_BCMA_DRIVER_GPIO */
 #endif
diff --git a/drivers/bcma/driver_chipcommon_nflash.c b/drivers/bcma/driver_chipcommon_nflash.c
index dbda91e4dff5..1f0b83e18f68 100644
--- a/drivers/bcma/driver_chipcommon_nflash.c
+++ b/drivers/bcma/driver_chipcommon_nflash.c
@@ -21,7 +21,7 @@ int bcma_nflash_init(struct bcma_drv_cc *cc)
        struct bcma_bus *bus = cc->core->bus;
        if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
-            cc->core->id.rev != 0x38) {
+            cc->core->id.rev != 38) {
                bcma_err(bus, "NAND flash on unsupported board!\n");
                return -ENOTSUPP;
        }
diff --git a/drivers/bcma/driver_gpio.c b/drivers/bcma/driver_gpio.c
index 9a6f585da2d9..71f755c06fc6 100644
--- a/drivers/bcma/driver_gpio.c
+++ b/drivers/bcma/driver_gpio.c
@@ -96,3 +96,8 @@ int bcma_gpio_init(struct bcma_drv_cc *cc)
        return gpiochip_add(chip);
 }
+int bcma_gpio_unregister(struct bcma_drv_cc *cc)
+{
+        return gpiochip_remove(&cc->gpio);
+}
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 4a92f647b58b..324f9debda88 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -268,6 +268,13 @@ int bcma_bus_register(struct bcma_bus *bus)
 void bcma_bus_unregister(struct bcma_bus *bus)
 {
        struct bcma_device *cores[3];
+        int err;
+        err = bcma_gpio_unregister(&bus->drv_cc);
+        if (err == -EBUSY)
+                bcma_err(bus, "Some GPIOs are still in use.\n");
+        else if (err)
+                bcma_err(bus, "Can not unregister GPIO driver: %i\n", err);
        cores[0] = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
        cores[1] = bcma_find_core(bus, BCMA_CORE_PCIE);
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index f58a4a4b4dfb..2b8303ad63c9 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -168,7 +168,7 @@ static void wake_all_senders(struct drbd_tconn *tconn) {
 }
 /* must hold resource->req_lock */
-static void start_new_tl_epoch(struct drbd_tconn *tconn)
+void start_new_tl_epoch(struct drbd_tconn *tconn)
 {
        /* no point closing an epoch, if it is empty, anyways. */
        if (tconn->current_tle_writes == 0)
diff --git a/drivers/block/drbd/drbd_req.h b/drivers/block/drbd/drbd_req.h
index 016de6b8bb57..c08d22964d06 100644
--- a/drivers/block/drbd/drbd_req.h
+++ b/drivers/block/drbd/drbd_req.h
@@ -267,6 +267,7 @@ struct bio_and_error {
        int error;
 };
+extern void start_new_tl_epoch(struct drbd_tconn *tconn);
 extern void drbd_req_destroy(struct kref *kref);
 extern void _req_may_be_done(struct drbd_request *req,
                struct bio_and_error *m);
diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c
index 53bf6182bac4..0fe220cfb9e9 100644
--- a/drivers/block/drbd/drbd_state.c
+++ b/drivers/block/drbd/drbd_state.c
@@ -931,6 +931,7 @@ __drbd_set_state(struct drbd_conf *mdev, union drbd_state ns,
        enum drbd_state_rv rv = SS_SUCCESS;
        enum sanitize_state_warnings ssw;
        struct after_state_chg_work *ascw;
+        bool did_remote, should_do_remote;
        os = drbd_read_state(mdev);
@@ -981,11 +982,17 @@ __drbd_set_state(struct drbd_conf *mdev, union drbd_state ns,
            (os.disk != D_DISKLESS && ns.disk == D_DISKLESS))
                atomic_inc(&mdev->local_cnt);
+        did_remote = drbd_should_do_remote(mdev->state);
        mdev->state.i = ns.i;
+        should_do_remote = drbd_should_do_remote(mdev->state);
        mdev->tconn->susp = ns.susp;
        mdev->tconn->susp_nod = ns.susp_nod;
        mdev->tconn->susp_fen = ns.susp_fen;
+        /* put replicated vs not-replicated requests in seperate epochs */
+        if (did_remote != should_do_remote)
+                start_new_tl_epoch(mdev->tconn);
        if (os.disk == D_ATTACHING && ns.disk >= D_NEGOTIATING)
                drbd_print_uuids(mdev, "attached to UUIDs");
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 9694dd99bbbc..3fd100990453 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -626,12 +626,13 @@ static void mtip_timeout_function(unsigned long int data)
                }
        }
-        if (cmdto_cnt && !test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
+        if (cmdto_cnt) {
                print_tags(port->dd, "timed out", tagaccum, cmdto_cnt);
+                if (!test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
-                mtip_restart_port(port);
+                        mtip_restart_port(port);
+                        wake_up_interruptible(&port->svc_wait);
+                }
                clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
-                wake_up_interruptible(&port->svc_wait);
        }
        if (port->ic_pause_timer) {
@@ -3887,7 +3888,12 @@ static int mtip_block_remove(struct driver_data *dd)
         * Delete our gendisk structure. This also removes the device
         * from /dev
         */
-        del_gendisk(dd->disk);
+        if (dd->disk) {
+                if (dd->disk->queue)
+                        del_gendisk(dd->disk);
+                else
+                        put_disk(dd->disk);
+        }
        spin_lock(&rssd_index_lock);
        ida_remove(&rssd_index_ida, dd->index);
@@ -3921,7 +3927,13 @@ static int mtip_block_shutdown(struct driver_data *dd)
                "Shutting down %s ...\n", dd->disk->disk_name);
        /* Delete our gendisk structure, and cleanup the blk queue. */
-        del_gendisk(dd->disk);
+        if (dd->disk) {
+                if (dd->disk->queue)
+                        del_gendisk(dd->disk);
+                else
+                        put_disk(dd->disk);
+        }
        spin_lock(&rssd_index_lock);
        ida_remove(&rssd_index_ida, dd->index);
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 74374fb762aa..5ac841ff6cc7 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -161,10 +161,12 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
 static void make_response(struct xen_blkif *blkif, u64 id,
                          unsigned short op, int st);
-#define foreach_grant(pos, rbtree, node) \
+#define foreach_grant_safe(pos, n, rbtree, node) \
-        for ((pos) = container_of(rb_first((rbtree)), typeof(*(pos)), node); \
+        for ((pos) = container_of(rb_first((rbtree)), typeof(*(pos)), node), \
+             (n) = rb_next(&(pos)->node); \
             &(pos)->node != NULL; \
-             (pos) = container_of(rb_next(&(pos)->node), typeof(*(pos)), node))
+             (pos) = container_of(n, typeof(*(pos)), node), \
+             (n) = (&(pos)->node != NULL) ? rb_next(&(pos)->node) : NULL)
 static void add_persistent_gnt(struct rb_root *root,
@@ -217,10 +219,11 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
        struct gnttab_unmap_grant_ref unmap[BLKIF_MAX_SEGMENTS_PER_REQUEST];
        struct page *pages[BLKIF_MAX_SEGMENTS_PER_REQUEST];
        struct persistent_gnt *persistent_gnt;
+        struct rb_node *n;
        int ret = 0;
        int segs_to_unmap = 0;
-        foreach_grant(persistent_gnt, root, node) {
+        foreach_grant_safe(persistent_gnt, n, root, node) {
                BUG_ON(persistent_gnt->handle ==
                        BLKBACK_INVALID_HANDLE);
                gnttab_set_unmap_op(&unmap[segs_to_unmap],
@@ -230,9 +233,6 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
                        persistent_gnt->handle);
                pages[segs_to_unmap] = persistent_gnt->page;
-                rb_erase(&persistent_gnt->node, root);
-                kfree(persistent_gnt);
-                num--;
                if (++segs_to_unmap == BLKIF_MAX_SEGMENTS_PER_REQUEST ||
                        !rb_next(&persistent_gnt->node)) {
@@ -241,6 +241,10 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
                        BUG_ON(ret);
                        segs_to_unmap = 0;
                }
+                rb_erase(&persistent_gnt->node, root);
+                kfree(persistent_gnt);
+                num--;
        }
        BUG_ON(num != 0);
 }
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 96e9b00db081..11043c18ac5a 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -792,6 +792,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
 {
        struct llist_node *all_gnts;
        struct grant *persistent_gnt;
+        struct llist_node *n;
        /* Prevent new requests being issued until we fix things up. */
        spin_lock_irq(&info->io_lock);
@@ -804,7 +805,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
        /* Remove all persistent grants */
        if (info->persistent_gnts_c) {
                all_gnts = llist_del_all(&info->persistent_gnts);
-                llist_for_each_entry(persistent_gnt, all_gnts, node) {
+                llist_for_each_entry_safe(persistent_gnt, n, all_gnts, node) {
                        gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
                        __free_page(pfn_to_page(persistent_gnt->pfn));
                        kfree(persistent_gnt);
@@ -835,7 +836,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
 static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                             struct blkif_response *bret)
 {
-        int i;
+        int i = 0;
        struct bio_vec *bvec;
        struct req_iterator iter;
        unsigned long flags;
@@ -852,7 +853,8 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                 */
                rq_for_each_segment(bvec, s->request, iter) {
                        BUG_ON((bvec->bv_offset + bvec->bv_len) > PAGE_SIZE);
-                        i = offset >> PAGE_SHIFT;
+                        if (bvec->bv_offset < offset)
+                                i++;
                        BUG_ON(i >= s->req.u.rw.nr_segments);
                        shared_data = kmap_atomic(
                                pfn_to_page(s->grants_used[i]->pfn));
@@ -861,7 +863,7 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                                bvec->bv_len);
                        bvec_kunmap_irq(bvec_data, &flags);
                        kunmap_atomic(shared_data);
-                        offset += bvec->bv_len;
+                        offset = bvec->bv_offset + bvec->bv_len;
                }
        }
        /* Add the persistent grant into the list of free grants */
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 684b0d53764f..ee4dbeafb377 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2062,7 +2062,8 @@ static void virtcons_remove(struct virtio_device *vdev)
        /* Disable interrupts for vqs */
        vdev->config->reset(vdev);
        /* Finish up work that's lined up */
-        cancel_work_sync(&portdev->control_work);
+        if (use_multiport(portdev))
+                cancel_work_sync(&portdev->control_work);
        list_for_each_entry_safe(port, port2, &portdev->ports, list)
                unplug_port(port);
diff --git a/drivers/gpu/drm/nouveau/core/core/falcon.c b/drivers/gpu/drm/nouveau/core/core/falcon.c
index 6b0843c33877..e05c15777588 100644
--- a/drivers/gpu/drm/nouveau/core/core/falcon.c
+++ b/drivers/gpu/drm/nouveau/core/core/falcon.c
@@ -73,8 +73,11 @@ _nouveau_falcon_init(struct nouveau_object *object)
        nv_debug(falcon, "data limit: %d\n", falcon->data.limit);
        /* wait for 'uc halted' to be signalled before continuing */
-        if (falcon->secret) {
+        if (falcon->secret && falcon->version < 4) {
-                nv_wait(falcon, 0x008, 0x00000010, 0x00000010);
+                if (!falcon->version)
+                        nv_wait(falcon, 0x008, 0x00000010, 0x00000010);
+                else
+                        nv_wait(falcon, 0x180, 0x80000000, 0);
                nv_wo32(falcon, 0x004, 0x00000010);
        }
diff --git a/drivers/gpu/drm/nouveau/core/core/subdev.c b/drivers/gpu/drm/nouveau/core/core/subdev.c
index f74c30aa33a0..48f06378d3f9 100644
--- a/drivers/gpu/drm/nouveau/core/core/subdev.c
+++ b/drivers/gpu/drm/nouveau/core/core/subdev.c
@@ -99,7 +99,7 @@ nouveau_subdev_create_(struct nouveau_object *parent,
        if (ret)
                return ret;
-        mutex_init(&subdev->mutex);
+        __mutex_init(&subdev->mutex, subname, &oclass->lock_class_key);
        subdev->name = subname;
        if (parent) {
diff --git a/drivers/gpu/drm/nouveau/core/include/core/object.h b/drivers/gpu/drm/nouveau/core/include/core/object.h
index 5982935ee23a..106bb19fdd9a 100644
--- a/drivers/gpu/drm/nouveau/core/include/core/object.h
+++ b/drivers/gpu/drm/nouveau/core/include/core/object.h
@@ -50,10 +50,13 @@ int  nouveau_object_fini(struct nouveau_object *, bool suspend);
 extern struct nouveau_ofuncs nouveau_object_ofuncs;
+/* Don't allocate dynamically, because lockdep needs lock_class_keys to be in
+ * ".data". */
 struct nouveau_oclass {
        u32 handle;
-        struct nouveau_ofuncs *ofuncs;
+        struct nouveau_ofuncs * const ofuncs;
-        struct nouveau_omthds *omthds;
+        struct nouveau_omthds * const omthds;
+        struct lock_class_key lock_class_key;
 };
 #define nv_oclass(o)    nv_object(o)->oclass
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/base.c b/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
index d6d16007ec1a..d62045f454b2 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
@@ -86,8 +86,8 @@ nouveau_fb_preinit(struct nouveau_fb *pfb)
                        return ret;
        }
-        if (!nouveau_mm_initialised(&pfb->tags) && tags) {
+        if (!nouveau_mm_initialised(&pfb->tags)) {
-                ret = nouveau_mm_init(&pfb->tags, 0, ++tags, 1);
+                ret = nouveau_mm_init(&pfb->tags, 0, tags ? ++tags : 0, 1);
                if (ret)
                        return ret;
        }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
index 487cb8c6c204..eac236ed19b2 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
@@ -99,7 +99,7 @@ nv50_fb_vram_init(struct nouveau_fb *pfb)
        struct nouveau_bios *bios = nouveau_bios(device);
        const u32 rsvd_head = ( 256 * 1024) >> 12; /* vga memory */
        const u32 rsvd_tail = (1024 * 1024) >> 12; /* vbios etc */
-        u32 size;
+        u32 size, tags = 0;
        int ret;
        pfb->ram.size = nv_rd32(pfb, 0x10020c);
@@ -140,10 +140,11 @@ nv50_fb_vram_init(struct nouveau_fb *pfb)
                        return ret;
                pfb->ram.ranks = (nv_rd32(pfb, 0x100200) & 0x4) ? 2 : 1;
+                tags = nv_rd32(pfb, 0x100320);
                break;
        }
-        return nv_rd32(pfb, 0x100320);
+        return tags;
 }
 static int
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 69d7b1d0b9d6..1699a9083a2f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -28,6 +28,7 @@
 */
 #include <core/engine.h>
+#include <linux/swiotlb.h>
 #include <subdev/fb.h>
 #include <subdev/vm.h>
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 8b090f1eb51d..5e7aef23825a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -245,6 +245,8 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
        return 0;
 }
+static struct lock_class_key drm_client_lock_class_key;
 static int
 nouveau_drm_load(struct drm_device *dev, unsigned long flags)
 {
@@ -256,6 +258,7 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
        ret = nouveau_cli_create(pdev, "DRM", sizeof(*drm), (void**)&drm);
        if (ret)
                return ret;
+        lockdep_set_class(&drm->client.mutex, &drm_client_lock_class_key);
        dev->dev_private = drm;
        drm->dev = dev;
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 7a445666e71f..ee4cff534f10 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -2909,14 +2909,14 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                return -EINVAL;
                        }
                        if (tiled) {
-                                dst_offset = ib[idx+1];
+                                dst_offset = radeon_get_ib_value(p, idx+1);
                                dst_offset <<= 8;
                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                p->idx += count + 7;
                        } else {
-                                dst_offset = ib[idx+1];
+                                dst_offset = radeon_get_ib_value(p, idx+1);
-                                dst_offset |= ((u64)(ib[idx+2] & 0xff)) << 32;
+                                dst_offset |= ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                ib[idx+2] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
@@ -2954,12 +2954,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                        DRM_ERROR("bad L2T, frame to fields DMA_PACKET_COPY\n");
                                                        return -EINVAL;
                                                }
-                                                dst_offset = ib[idx+1];
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
                                                dst_offset <<= 8;
-                                                dst2_offset = ib[idx+2];
+                                                dst2_offset = radeon_get_ib_value(p, idx+2);
                                                dst2_offset <<= 8;
-                                                src_offset = ib[idx+8];
+                                                src_offset = radeon_get_ib_value(p, idx+8);
-                                                src_offset |= ((u64)(ib[idx+9] & 0xff)) << 32;
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
                                                if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                        dev_warn(p->dev, "DMA L2T, frame to fields src buffer too small (%llu %lu)\n",
                                                                 src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3014,12 +3014,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                        DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
                                                        return -EINVAL;
                                                }
-                                                dst_offset = ib[idx+1];
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
                                                dst_offset <<= 8;
-                                                dst2_offset = ib[idx+2];
+                                                dst2_offset = radeon_get_ib_value(p, idx+2);
                                                dst2_offset <<= 8;
-                                                src_offset = ib[idx+8];
+                                                src_offset = radeon_get_ib_value(p, idx+8);
-                                                src_offset |= ((u64)(ib[idx+9] & 0xff)) << 32;
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
                                                if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                        dev_warn(p->dev, "DMA L2T, broadcast src buffer too small (%llu %lu)\n",
                                                                 src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3046,22 +3046,22 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                /* detile bit */
                                                if (idx_value & (1 << 31)) {
                                                        /* tiled src, linear dst */
-                                                        src_offset = ib[idx+1];
+                                                        src_offset = radeon_get_ib_value(p, idx+1);
                                                        src_offset <<= 8;
                                                        ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
-                                                        dst_offset = ib[idx+7];
+                                                        dst_offset = radeon_get_ib_value(p, idx+7);
-                                                        dst_offset |= ((u64)(ib[idx+8] & 0xff)) << 32;
+                                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
                                                        ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                                        ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
                                                } else {
                                                        /* linear src, tiled dst */
-                                                        src_offset = ib[idx+7];
+                                                        src_offset = radeon_get_ib_value(p, idx+7);
-                                                        src_offset |= ((u64)(ib[idx+8] & 0xff)) << 32;
+                                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
                                                        ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
                                                        ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
-                                                        dst_offset = ib[idx+1];
+                                                        dst_offset = radeon_get_ib_value(p, idx+1);
                                                        dst_offset <<= 8;
                                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                                }
@@ -3098,12 +3098,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                        DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
                                                        return -EINVAL;
                                                }
-                                                dst_offset = ib[idx+1];
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
                                                dst_offset <<= 8;
-                                                dst2_offset = ib[idx+2];
+                                                dst2_offset = radeon_get_ib_value(p, idx+2);
                                                dst2_offset <<= 8;
-                                                src_offset = ib[idx+8];
+                                                src_offset = radeon_get_ib_value(p, idx+8);
-                                                src_offset |= ((u64)(ib[idx+9] & 0xff)) << 32;
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
                                                if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                        dev_warn(p->dev, "DMA L2T, broadcast src buffer too small (%llu %lu)\n",
                                                                 src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3135,22 +3135,22 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                /* detile bit */
                                                if (idx_value & (1 << 31)) {
                                                        /* tiled src, linear dst */
-                                                        src_offset = ib[idx+1];
+                                                        src_offset = radeon_get_ib_value(p, idx+1);
                                                        src_offset <<= 8;
                                                        ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
-                                                        dst_offset = ib[idx+7];
+                                                        dst_offset = radeon_get_ib_value(p, idx+7);
-                                                        dst_offset |= ((u64)(ib[idx+8] & 0xff)) << 32;
+                                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
                                                        ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                                        ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
                                                } else {
                                                        /* linear src, tiled dst */
-                                                        src_offset = ib[idx+7];
+                                                        src_offset = radeon_get_ib_value(p, idx+7);
-                                                        src_offset |= ((u64)(ib[idx+8] & 0xff)) << 32;
+                                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
                                                        ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
                                                        ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
-                                                        dst_offset = ib[idx+1];
+                                                        dst_offset = radeon_get_ib_value(p, idx+1);
                                                        dst_offset <<= 8;
                                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                                }
@@ -3176,10 +3176,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                        switch (misc) {
                                        case 0:
                                                /* L2L, byte */
-                                                src_offset = ib[idx+2];
+                                                src_offset = radeon_get_ib_value(p, idx+2);
-                                                src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
-                                                dst_offset = ib[idx+1];
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
-                                                dst_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
+                                                dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
                                                if ((src_offset + count) > radeon_bo_size(src_reloc->robj)) {
                                                        dev_warn(p->dev, "DMA L2L, byte src buffer too small (%llu %lu)\n",
                                                                 src_offset + count, radeon_bo_size(src_reloc->robj));
@@ -3216,12 +3216,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                        DRM_ERROR("bad L2L, dw, broadcast DMA_PACKET_COPY\n");
                                                        return -EINVAL;
                                                }
-                                                dst_offset = ib[idx+1];
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
-                                                dst_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
+                                                dst_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
-                                                dst2_offset = ib[idx+2];
+                                                dst2_offset = radeon_get_ib_value(p, idx+2);
-                                                dst2_offset |= ((u64)(ib[idx+5] & 0xff)) << 32;
+                                                dst2_offset |= ((u64)(radeon_get_ib_value(p, idx+5) & 0xff)) << 32;
-                                                src_offset = ib[idx+3];
+                                                src_offset = radeon_get_ib_value(p, idx+3);
-                                                src_offset |= ((u64)(ib[idx+6] & 0xff)) << 32;
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
                                                if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                        dev_warn(p->dev, "DMA L2L, dw, broadcast src buffer too small (%llu %lu)\n",
                                                                 src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3251,10 +3251,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                        }
                                } else {
                                        /* L2L, dw */
-                                        src_offset = ib[idx+2];
+                                        src_offset = radeon_get_ib_value(p, idx+2);
-                                        src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
+                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
-                                        dst_offset = ib[idx+1];
+                                        dst_offset = radeon_get_ib_value(p, idx+1);
-                                        dst_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
+                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
                                        if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                dev_warn(p->dev, "DMA L2L, dw src buffer too small (%llu %lu)\n",
                                                         src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3279,8 +3279,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                DRM_ERROR("bad DMA_PACKET_CONSTANT_FILL\n");
                                return -EINVAL;
                        }
-                        dst_offset = ib[idx+1];
+                        dst_offset = radeon_get_ib_value(p, idx+1);
-                        dst_offset |= ((u64)(ib[idx+3] & 0x00ff0000)) << 16;
+                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0x00ff0000)) << 16;
                        if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
                                dev_warn(p->dev, "DMA constant fill buffer too small (%llu %lu)\n",
                                         dst_offset, radeon_bo_size(dst_reloc->robj));
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 69ec24ab8d63..9b2512bf1a46 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -2623,14 +2623,14 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                return -EINVAL;
                        }
                        if (tiled) {
-                                dst_offset = ib[idx+1];
+                                dst_offset = radeon_get_ib_value(p, idx+1);
                                dst_offset <<= 8;
                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                p->idx += count + 5;
                        } else {
-                                dst_offset = ib[idx+1];
+                                dst_offset = radeon_get_ib_value(p, idx+1);
-                                dst_offset |= ((u64)(ib[idx+2] & 0xff)) << 32;
+                                dst_offset |= ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                ib[idx+2] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
@@ -2658,32 +2658,32 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                /* detile bit */
                                if (idx_value & (1 << 31)) {
                                        /* tiled src, linear dst */
-                                        src_offset = ib[idx+1];
+                                        src_offset = radeon_get_ib_value(p, idx+1);
                                        src_offset <<= 8;
                                        ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
-                                        dst_offset = ib[idx+5];
+                                        dst_offset = radeon_get_ib_value(p, idx+5);
-                                        dst_offset |= ((u64)(ib[idx+6] & 0xff)) << 32;
+                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
                                        ib[idx+5] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                        ib[idx+6] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
                                } else {
                                        /* linear src, tiled dst */
-                                        src_offset = ib[idx+5];
+                                        src_offset = radeon_get_ib_value(p, idx+5);
-                                        src_offset |= ((u64)(ib[idx+6] & 0xff)) << 32;
+                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
                                        ib[idx+5] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
                                        ib[idx+6] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
-                                        dst_offset = ib[idx+1];
+                                        dst_offset = radeon_get_ib_value(p, idx+1);
                                        dst_offset <<= 8;
                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                }
                                p->idx += 7;
                        } else {
                                if (p->family >= CHIP_RV770) {
-                                        src_offset = ib[idx+2];
+                                        src_offset = radeon_get_ib_value(p, idx+2);
-                                        src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
+                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
-                                        dst_offset = ib[idx+1];
+                                        dst_offset = radeon_get_ib_value(p, idx+1);
-                                        dst_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
+                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                        ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
@@ -2691,10 +2691,10 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                        ib[idx+4] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
                                        p->idx += 5;
                                } else {
-                                        src_offset = ib[idx+2];
+                                        src_offset = radeon_get_ib_value(p, idx+2);
-                                        src_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
+                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
-                                        dst_offset = ib[idx+1];
+                                        dst_offset = radeon_get_ib_value(p, idx+1);
-                                        dst_offset |= ((u64)(ib[idx+3] & 0xff0000)) << 16;
+                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff0000)) << 16;
                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                        ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
@@ -2724,8 +2724,8 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                DRM_ERROR("bad DMA_PACKET_WRITE\n");
                                return -EINVAL;
                        }
-                        dst_offset = ib[idx+1];
+                        dst_offset = radeon_get_ib_value(p, idx+1);
-                        dst_offset |= ((u64)(ib[idx+3] & 0x00ff0000)) << 16;
+                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0x00ff0000)) << 16;
                        if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
                                dev_warn(p->dev, "DMA constant fill buffer too small (%llu %lu)\n",
                                         dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 1d8ff2f850ba..93f760e27a92 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -38,6 +38,7 @@
 #include <drm/radeon_drm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/swiotlb.h>
 #include "radeon_reg.h"
 #include "radeon.h"
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 44420fca7dfa..8be35c809c7b 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -429,7 +429,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
        struct ttm_bo_device *bdev = bo->bdev;
        struct ttm_bo_driver *driver = bdev->driver;
-        fbo = kzalloc(sizeof(*fbo), GFP_KERNEL);
+        fbo = kmalloc(sizeof(*fbo), GFP_KERNEL);
        if (!fbo)
                return -ENOMEM;
@@ -448,7 +448,12 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
        fbo->vm_node = NULL;
        atomic_set(&fbo->cpu_writers, 0);
-        fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
+        spin_lock(&bdev->fence_lock);
+        if (bo->sync_obj)
+                fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
+        else
+                fbo->sync_obj = NULL;
+        spin_unlock(&bdev->fence_lock);
        kref_init(&fbo->list_kref);
        kref_init(&fbo->kref);
        fbo->destroy = &ttm_transfered_destroy;
@@ -661,13 +666,11 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
                 */
                set_bit(TTM_BO_PRIV_FLAG_MOVING, &bo->priv_flags);
-                /* ttm_buffer_object_transfer accesses bo->sync_obj */
-                ret = ttm_buffer_object_transfer(bo, &ghost_obj);
                spin_unlock(&bdev->fence_lock);
                if (tmp_obj)
                        driver->sync_obj_unref(&tmp_obj);
+                ret = ttm_buffer_object_transfer(bo, &ghost_obj);
                if (ret)
                        return ret;
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 4850d03870c2..35275099cafd 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -263,20 +263,15 @@ static void remove_qp(struct qib_ibdev *dev, struct qib_qp *qp)
                struct qib_qp __rcu **qpp;
                qpp = &dev->qp_table[n];
-                q = rcu_dereference_protected(*qpp,
+                for (; (q = rcu_dereference_protected(*qpp,
-                        lockdep_is_held(&dev->qpt_lock));
+                                lockdep_is_held(&dev->qpt_lock))) != NULL;
-                for (; q; qpp = &q->next) {
+                                qpp = &q->next)
                        if (q == qp) {
                                atomic_dec(&qp->refcount);
                                *qpp = qp->next;
                                rcu_assign_pointer(qp->next, NULL);
-                                q = rcu_dereference_protected(*qpp,
-                                        lockdep_is_held(&dev->qpt_lock));
                                break;
                        }
-                        q = rcu_dereference_protected(*qpp,
-                                lockdep_is_held(&dev->qpt_lock));
-                }
        }
        spin_unlock_irqrestore(&dev->qpt_lock, flags);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 03103d2bd641..67b0c1d23678 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -741,6 +741,9 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
        tx_req->mapping = addr;
+        skb_orphan(skb);
+        skb_dst_drop(skb);
        rc = post_send(priv, tx, tx->tx_head & (ipoib_sendq_size - 1),
                       addr, skb->len);
        if (unlikely(rc)) {
@@ -752,9 +755,6 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
                dev->trans_start = jiffies;
                ++tx->tx_head;
-                skb_orphan(skb);
-                skb_dst_drop(skb);
                if (++priv->tx_outstanding == ipoib_sendq_size) {
                        ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
                                  tx->qp->qp_num);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index a1bca70e20aa..2cfa76f5d99e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -600,6 +600,9 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                netif_stop_queue(dev);
        }
+        skb_orphan(skb);
+        skb_dst_drop(skb);
        rc = post_send(priv, priv->tx_head & (ipoib_sendq_size - 1),
                       address->ah, qpn, tx_req, phead, hlen);
        if (unlikely(rc)) {
@@ -615,9 +618,6 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                address->last_send = priv->tx_head;
                ++priv->tx_head;
-                skb_orphan(skb);
-                skb_dst_drop(skb);
        }
        if (unlikely(priv->tx_outstanding > MAX_SEND_CQE))
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 358cd7ee905b..7cd74e29cbc8 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -162,7 +162,7 @@ static unsigned int get_time_pit(void)
 #define GET_TIME(x)     do { x = get_cycles(); } while (0)
 #define DELTA(x,y)      ((y)-(x))
 #define TIME_NAME       "PCC"
-#elif defined(CONFIG_MN10300)
+#elif defined(CONFIG_MN10300) || defined(CONFIG_TILE)
 #define GET_TIME(x)     do { x = get_cycles(); } while (0)
 #define DELTA(x, y)     ((x) - (y))
 #define TIME_NAME       "TSC"
diff --git a/drivers/media/radio/radio-keene.c b/drivers/media/radio/radio-keene.c
index e10e525f33e5..296941a9ae25 100644
--- a/drivers/media/radio/radio-keene.c
+++ b/drivers/media/radio/radio-keene.c
@@ -374,6 +374,7 @@ static int usb_keene_probe(struct usb_interface *intf,
        radio->vdev.ioctl_ops = &usb_keene_ioctl_ops;
        radio->vdev.lock = &radio->lock;
        radio->vdev.release = video_device_release_empty;
+        radio->vdev.vfl_dir = VFL_DIR_TX;
        radio->usbdev = interface_to_usbdev(intf);
        radio->intf = intf;
diff --git a/drivers/media/radio/radio-si4713.c b/drivers/media/radio/radio-si4713.c
index a082e400ed0f..1507c9d508d7 100644
--- a/drivers/media/radio/radio-si4713.c
+++ b/drivers/media/radio/radio-si4713.c
@@ -250,6 +250,7 @@ static struct video_device radio_si4713_vdev_template = {
        .name                   = "radio-si4713",
        .release                = video_device_release,
        .ioctl_ops              = &radio_si4713_ioctl_ops,
+        .vfl_dir                = VFL_DIR_TX,
 };
 /* Platform driver interface */
diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c
index c48be195bbad..cabbe3adf435 100644
--- a/drivers/media/radio/radio-wl1273.c
+++ b/drivers/media/radio/radio-wl1273.c
@@ -1971,6 +1971,7 @@ static struct video_device wl1273_viddev_template = {
        .ioctl_ops              = &wl1273_ioctl_ops,
        .name                   = WL1273_FM_DRIVER_NAME,
        .release                = wl1273_vdev_release,
+        .vfl_dir                = VFL_DIR_TX,
 };
 static int wl1273_fm_radio_remove(struct platform_device *pdev)
diff --git a/drivers/media/radio/wl128x/fmdrv_v4l2.c b/drivers/media/radio/wl128x/fmdrv_v4l2.c
index 048de4536036..0a8ee8fab924 100644
--- a/drivers/media/radio/wl128x/fmdrv_v4l2.c
+++ b/drivers/media/radio/wl128x/fmdrv_v4l2.c
@@ -518,6 +518,16 @@ static struct video_device fm_viddev_template = {
        .ioctl_ops = &fm_drv_ioctl_ops,
        .name = FM_DRV_NAME,
        .release = video_device_release,
+        /*
+         * To ensure both the tuner and modulator ioctls are accessible we
+         * set the vfl_dir to M2M to indicate this.
+         *
+         * It is not really a mem2mem device of course, but it can both receive
+         * and transmit using the same radio device. It's the only radio driver
+         * that does this and it should really be split in two radio devices,
+         * but that would affect applications using this driver.
+         */
+        .vfl_dir = VFL_DIR_M2M,
 };
 int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 1877ed7ca086..1c9e09fbdff8 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1053,6 +1053,7 @@ static ssize_t bonding_store_primary(struct device *d,
                pr_info("%s: Setting primary slave to None.\n",
                        bond->dev->name);
                bond->primary_slave = NULL;
+                memset(bond->params.primary, 0, sizeof(bond->params.primary));
                bond_select_active_slave(bond);
                goto out;
        }
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 58607f196c9e..2282b1ae9765 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -488,8 +488,12 @@ static void c_can_setup_receive_object(struct net_device *dev, int iface,
        priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface),
                        IFX_WRITE_LOW_16BIT(mask));
+        /* According to C_CAN documentation, the reserved bit
+         * in IFx_MASK2 register is fixed 1
+         */
        priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface),
-                        IFX_WRITE_HIGH_16BIT(mask));
+                        IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface),
                        IFX_WRITE_LOW_16BIT(id));
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 4eba17b83ba8..f1b3df167ff2 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -36,13 +36,13 @@
 #define DRV_VER                 "4.4.161.0u"
 #define DRV_NAME                "be2net"
-#define BE_NAME                 "ServerEngines BladeEngine2 10Gbps NIC"
+#define BE_NAME                 "Emulex BladeEngine2"
-#define BE3_NAME                "ServerEngines BladeEngine3 10Gbps NIC"
+#define BE3_NAME                "Emulex BladeEngine3"
-#define OC_NAME                 "Emulex OneConnect 10Gbps NIC"
+#define OC_NAME                 "Emulex OneConnect"
 #define OC_NAME_BE              OC_NAME "(be3)"
 #define OC_NAME_LANCER          OC_NAME "(Lancer)"
 #define OC_NAME_SH              OC_NAME "(Skyhawk)"
-#define DRV_DESC                "ServerEngines BladeEngine 10Gbps NIC Driver"
+#define DRV_DESC                "Emulex OneConnect 10Gbps NIC Driver"
 #define BE_VENDOR_ID            0x19a2
 #define EMULEX_VENDOR_ID        0x10df
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 5c995700e534..4d6f3c54427a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -25,7 +25,7 @@
 MODULE_VERSION(DRV_VER);
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
 MODULE_DESCRIPTION(DRV_DESC " " DRV_VER);
-MODULE_AUTHOR("ServerEngines Corporation");
+MODULE_AUTHOR("Emulex Corporation");
 MODULE_LICENSE("GPL");
 static unsigned int num_vfs;
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index 02a12b69555f..4dab6fc265a2 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -232,6 +232,7 @@
 #define E1000_CTRL_FRCDPX   0x00001000  /* Force Duplex */
 #define E1000_CTRL_LANPHYPC_OVERRIDE 0x00010000 /* SW control of LANPHYPC */
 #define E1000_CTRL_LANPHYPC_VALUE    0x00020000 /* SW value of LANPHYPC */
+#define E1000_CTRL_MEHE     0x00080000  /* Memory Error Handling Enable */
 #define E1000_CTRL_SWDPIN0  0x00040000  /* SWDPIN 0 value */
 #define E1000_CTRL_SWDPIN1  0x00080000  /* SWDPIN 1 value */
 #define E1000_CTRL_SWDPIO0  0x00400000  /* SWDPIN 0 Input or output */
@@ -389,6 +390,12 @@
 #define E1000_PBS_16K E1000_PBA_16K
+/* Uncorrectable/correctable ECC Error counts and enable bits */
+#define E1000_PBECCSTS_CORR_ERR_CNT_MASK        0x000000FF
+#define E1000_PBECCSTS_UNCORR_ERR_CNT_MASK      0x0000FF00
+#define E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT     8
+#define E1000_PBECCSTS_ECC_ENABLE               0x00010000
 #define IFS_MAX       80
 #define IFS_MIN       40
 #define IFS_RATIO     4
@@ -408,6 +415,7 @@
 #define E1000_ICR_RXSEQ         0x00000008 /* Rx sequence error */
 #define E1000_ICR_RXDMT0        0x00000010 /* Rx desc min. threshold (0) */
 #define E1000_ICR_RXT0          0x00000080 /* Rx timer intr (ring 0) */
+#define E1000_ICR_ECCER         0x00400000 /* Uncorrectable ECC Error */
 #define E1000_ICR_INT_ASSERTED  0x80000000 /* If this bit asserted, the driver should claim the interrupt */
 #define E1000_ICR_RXQ0          0x00100000 /* Rx Queue 0 Interrupt */
 #define E1000_ICR_RXQ1          0x00200000 /* Rx Queue 1 Interrupt */
@@ -443,6 +451,7 @@
 #define E1000_IMS_RXSEQ     E1000_ICR_RXSEQ     /* Rx sequence error */
 #define E1000_IMS_RXDMT0    E1000_ICR_RXDMT0    /* Rx desc min. threshold */
 #define E1000_IMS_RXT0      E1000_ICR_RXT0      /* Rx timer intr */
+#define E1000_IMS_ECCER     E1000_ICR_ECCER     /* Uncorrectable ECC Error */
 #define E1000_IMS_RXQ0      E1000_ICR_RXQ0      /* Rx Queue 0 Interrupt */
 #define E1000_IMS_RXQ1      E1000_ICR_RXQ1      /* Rx Queue 1 Interrupt */
 #define E1000_IMS_TXQ0      E1000_ICR_TXQ0      /* Tx Queue 0 Interrupt */
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index 6782a2eea1bc..7e95f221d60b 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -309,6 +309,8 @@ struct e1000_adapter {
        struct napi_struct napi;
+        unsigned int uncorr_errors;     /* uncorrectable ECC errors */
+        unsigned int corr_errors;       /* correctable ECC errors */
        unsigned int restart_queue;
        u32 txd_cmd;
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index f95bc6ee1c22..fd4772a2691c 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -108,6 +108,8 @@ static const struct e1000_stats e1000_gstrings_stats[] = {
        E1000_STAT("dropped_smbus", stats.mgpdc),
        E1000_STAT("rx_dma_failed", rx_dma_failed),
        E1000_STAT("tx_dma_failed", tx_dma_failed),
+        E1000_STAT("uncorr_ecc_errors", uncorr_errors),
+        E1000_STAT("corr_ecc_errors", corr_errors),
 };
 #define E1000_GLOBAL_STATS_LEN  ARRAY_SIZE(e1000_gstrings_stats)
diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h
index cf217777586c..b88676ff3d86 100644
--- a/drivers/net/ethernet/intel/e1000e/hw.h
+++ b/drivers/net/ethernet/intel/e1000e/hw.h
@@ -77,6 +77,7 @@ enum e1e_registers {
 #define E1000_POEMB     E1000_PHY_CTRL  /* PHY OEM Bits */
        E1000_PBA      = 0x01000, /* Packet Buffer Allocation - RW */
        E1000_PBS      = 0x01008, /* Packet Buffer Size */
+        E1000_PBECCSTS = 0x0100C, /* Packet Buffer ECC Status - RW */
        E1000_EEMNGCTL = 0x01010, /* MNG EEprom Control */
        E1000_EEWR     = 0x0102C, /* EEPROM Write Register - RW */
        E1000_FLOP     = 0x0103C, /* FLASH Opcode Register */
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 976336547607..24d9f61956f0 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -3624,6 +3624,17 @@ static void e1000_initialize_hw_bits_ich8lan(struct e1000_hw *hw)
        if (hw->mac.type == e1000_ich8lan)
                reg |= (E1000_RFCTL_IPV6_EX_DIS | E1000_RFCTL_NEW_IPV6_EXT_DIS);
        ew32(RFCTL, reg);
+        /* Enable ECC on Lynxpoint */
+        if (hw->mac.type == e1000_pch_lpt) {
+                reg = er32(PBECCSTS);
+                reg |= E1000_PBECCSTS_ECC_ENABLE;
+                ew32(PBECCSTS, reg);
+                reg = er32(CTRL);
+                reg |= E1000_CTRL_MEHE;
+                ew32(CTRL, reg);
+        }
 }
 /**
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index fbf75fdca994..643c883dd795 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1678,6 +1678,23 @@ static irqreturn_t e1000_intr_msi(int irq, void *data)
                        mod_timer(&adapter->watchdog_timer, jiffies + 1);
        }
+        /* Reset on uncorrectable ECC error */
+        if ((icr & E1000_ICR_ECCER) && (hw->mac.type == e1000_pch_lpt)) {
+                u32 pbeccsts = er32(PBECCSTS);
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+                /* Do the reset outside of interrupt context */
+                schedule_work(&adapter->reset_task);
+                /* return immediately since reset is imminent */
+                return IRQ_HANDLED;
+        }
        if (napi_schedule_prep(&adapter->napi)) {
                adapter->total_tx_bytes = 0;
                adapter->total_tx_packets = 0;
@@ -1741,6 +1758,23 @@ static irqreturn_t e1000_intr(int irq, void *data)
                        mod_timer(&adapter->watchdog_timer, jiffies + 1);
        }
+        /* Reset on uncorrectable ECC error */
+        if ((icr & E1000_ICR_ECCER) && (hw->mac.type == e1000_pch_lpt)) {
+                u32 pbeccsts = er32(PBECCSTS);
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+                /* Do the reset outside of interrupt context */
+                schedule_work(&adapter->reset_task);
+                /* return immediately since reset is imminent */
+                return IRQ_HANDLED;
+        }
        if (napi_schedule_prep(&adapter->napi)) {
                adapter->total_tx_bytes = 0;
                adapter->total_tx_packets = 0;
@@ -2104,6 +2138,8 @@ static void e1000_irq_enable(struct e1000_adapter *adapter)
        if (adapter->msix_entries) {
                ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574);
                ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER | E1000_IMS_LSC);
+        } else if (hw->mac.type == e1000_pch_lpt) {
+                ew32(IMS, IMS_ENABLE_MASK | E1000_IMS_ECCER);
        } else {
                ew32(IMS, IMS_ENABLE_MASK);
        }
@@ -4251,6 +4287,16 @@ static void e1000e_update_stats(struct e1000_adapter *adapter)
        adapter->stats.mgptc += er32(MGTPTC);
        adapter->stats.mgprc += er32(MGTPRC);
        adapter->stats.mgpdc += er32(MGTPDC);
+        /* Correctable ECC Errors */
+        if (hw->mac.type == e1000_pch_lpt) {
+                u32 pbeccsts = er32(PBECCSTS);
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+        }
 }
 /**
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index a6542d75374c..5163af314990 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -380,7 +380,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                }
        }
-        if ((dev_cap->flags &
+        if ((dev->caps.flags &
            (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) &&
            mlx4_is_master(dev))
                dev->caps.function_caps |= MLX4_FUNC_CAP_64B_EQE_CQE;
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index 7992b3e05d3d..78ace59efd29 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -1801,7 +1801,7 @@ static void rhine_tx(struct net_device *dev)
                                         rp->tx_skbuff[entry]->len,
                                         PCI_DMA_TODEVICE);
                }
-                dev_kfree_skb_irq(rp->tx_skbuff[entry]);
+                dev_kfree_skb(rp->tx_skbuff[entry]);
                rp->tx_skbuff[entry] = NULL;
                entry = (++rp->dirty_tx) % TX_RING_SIZE;
        }
@@ -2010,11 +2010,7 @@ static void rhine_slow_event_task(struct work_struct *work)
        if (intr_status & IntrPCIErr)
                netif_warn(rp, hw, dev, "PCI error\n");
-        napi_disable(&rp->napi);
+        iowrite16(RHINE_EVENT & 0xffff, rp->base + IntrEnable);
-        rhine_irq_disable(rp);
-        /* Slow and safe. Consider __napi_schedule as a replacement ? */
-        napi_enable(&rp->napi);
-        napi_schedule(&rp->napi);
 out_unlock:
        mutex_unlock(&rp->task_lock);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index cc09b67c23bc..2917a86f4c43 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -298,11 +298,12 @@ static void tun_flow_cleanup(unsigned long data)
 }
 static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
-                            u16 queue_index)
+                            struct tun_file *tfile)
 {
        struct hlist_head *head;
        struct tun_flow_entry *e;
        unsigned long delay = tun->ageing_time;
+        u16 queue_index = tfile->queue_index;
        if (!rxhash)
                return;
@@ -311,7 +312,9 @@ static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
        rcu_read_lock();
-        if (tun->numqueues == 1)
+        /* We may get a very small possibility of OOO during switching, not
+         * worth to optimize.*/
+        if (tun->numqueues == 1 || tfile->detached)
                goto unlock;
        e = tun_flow_find(head, rxhash);
@@ -411,21 +414,21 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
        tun = rtnl_dereference(tfile->tun);
-        if (tun) {
+        if (tun && !tfile->detached) {
                u16 index = tfile->queue_index;
                BUG_ON(index >= tun->numqueues);
                dev = tun->dev;
                rcu_assign_pointer(tun->tfiles[index],
                                   tun->tfiles[tun->numqueues - 1]);
-                rcu_assign_pointer(tfile->tun, NULL);
                ntfile = rtnl_dereference(tun->tfiles[index]);
                ntfile->queue_index = index;
                --tun->numqueues;
-                if (clean)
+                if (clean) {
+                        rcu_assign_pointer(tfile->tun, NULL);
                        sock_put(&tfile->sk);
-                else
+                } else
                        tun_disable_queue(tun, tfile);
                synchronize_net();
@@ -439,10 +442,13 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
        }
        if (clean) {
-                if (tun && tun->numqueues == 0 && tun->numdisabled == 0 &&
+                if (tun && tun->numqueues == 0 && tun->numdisabled == 0) {
-                    !(tun->flags & TUN_PERSIST))
+                        netif_carrier_off(tun->dev);
-                        if (tun->dev->reg_state == NETREG_REGISTERED)
+                        if (!(tun->flags & TUN_PERSIST) &&
+                            tun->dev->reg_state == NETREG_REGISTERED)
                                unregister_netdevice(tun->dev);
+                }
                BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
                                 &tfile->socket.flags));
@@ -470,6 +476,10 @@ static void tun_detach_all(struct net_device *dev)
                rcu_assign_pointer(tfile->tun, NULL);
                --tun->numqueues;
        }
+        list_for_each_entry(tfile, &tun->disabled, next) {
+                wake_up_all(&tfile->wq.wait);
+                rcu_assign_pointer(tfile->tun, NULL);
+        }
        BUG_ON(tun->numqueues != 0);
        synchronize_net();
@@ -500,7 +510,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file)
                goto out;
        err = -EINVAL;
-        if (rtnl_dereference(tfile->tun))
+        if (rtnl_dereference(tfile->tun) && !tfile->detached)
                goto out;
        err = -EBUSY;
@@ -1199,7 +1209,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
        tun->dev->stats.rx_packets++;
        tun->dev->stats.rx_bytes += len;
-        tun_flow_update(tun, rxhash, tfile->queue_index);
+        tun_flow_update(tun, rxhash, tfile);
        return total_len;
 }
@@ -1658,10 +1668,10 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
                    device_create_file(&tun->dev->dev, &dev_attr_group))
                        pr_err("Failed to create tun sysfs files\n");
-                netif_carrier_on(tun->dev);
        }
+        netif_carrier_on(tun->dev);
        tun_debug(KERN_INFO, tun, "tun_set_iff\n");
        if (ifr->ifr_flags & IFF_NO_PI)
@@ -1813,7 +1823,7 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
                ret = tun_attach(tun, file);
        } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
                tun = rtnl_dereference(tfile->tun);
-                if (!tun || !(tun->flags & TUN_TAP_MQ))
+                if (!tun || !(tun->flags & TUN_TAP_MQ) || tfile->detached)
                        ret = -EINVAL;
                else
                        __tun_detach(tfile, false);
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 9197b2c72ca3..00d3b2d37828 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1215,6 +1215,9 @@ static const struct usb_device_id cdc_devs[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x46),
          .driver_info = (unsigned long)&wwan_info,
        },
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x76),
+          .driver_info = (unsigned long)&wwan_info,
+        },
        /* Infineon(now Intel) HSPA Modem platform */
        { USB_DEVICE_AND_INTERFACE_INFO(0x1519, 0x0443,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 575a5839ee34..c8e05e27f38c 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -351,6 +351,10 @@ static const struct usb_device_id products[] = {
                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57),
                .driver_info        = (unsigned long)&qmi_wwan_info,
        },
+        {       /* HUAWEI_INTERFACE_NDIS_CONTROL_QUALCOMM */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
        /* 2. Combined interface devices matching on class+protocol */
        {       /* Huawei E367 and possibly others in "Windows mode" */
@@ -361,6 +365,14 @@ static const struct usb_device_id products[] = {
                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
                .driver_info        = (unsigned long)&qmi_wwan_info,
        },
+        {       /* HUAWEI_NDIS_SINGLE_INTERFACE_VDF */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x37),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
+        {       /* HUAWEI_INTERFACE_NDIS_HW_QUALCOMM */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x67),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
        {       /* Pantech UML290, P4200 and more */
                USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
                .driver_info        = (unsigned long)&qmi_wwan_info,
@@ -461,6 +473,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
+        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index f34b2ebee815..5e33606c1366 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -380,6 +380,12 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
        unsigned long           lockflags;
        size_t                  size = dev->rx_urb_size;
+        /* prevent rx skb allocation when error ratio is high */
+        if (test_bit(EVENT_RX_KILL, &dev->flags)) {
+                usb_free_urb(urb);
+                return -ENOLINK;
+        }
        skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
        if (!skb) {
                netif_dbg(dev, rx_err, dev->net, "no rx skb\n");
@@ -539,6 +545,17 @@ block:
                break;
        }
+        /* stop rx if packet error rate is high */
+        if (++dev->pkt_cnt > 30) {
+                dev->pkt_cnt = 0;
+                dev->pkt_err = 0;
+        } else {
+                if (state == rx_cleanup)
+                        dev->pkt_err++;
+                if (dev->pkt_err > 20)
+                        set_bit(EVENT_RX_KILL, &dev->flags);
+        }
        state = defer_bh(dev, skb, &dev->rxq, state);
        if (urb) {
@@ -791,6 +808,11 @@ int usbnet_open (struct net_device *net)
                   (dev->driver_info->flags & FLAG_FRAMING_AX) ? "ASIX" :
                   "simple");
+        /* reset rx error state */
+        dev->pkt_cnt = 0;
+        dev->pkt_err = 0;
+        clear_bit(EVENT_RX_KILL, &dev->flags);
        // delay posting reads until we're fully open
        tasklet_schedule (&dev->bh);
        if (info->manage_power) {
@@ -1103,13 +1125,11 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
        if (info->tx_fixup) {
                skb = info->tx_fixup (dev, skb, GFP_ATOMIC);
                if (!skb) {
-                        if (netif_msg_tx_err(dev)) {
+                        /* packet collected; minidriver waiting for more */
-                                netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
+                        if (info->flags & FLAG_MULTI_PACKET)
-                                goto drop;
-                        } else {
-                                /* cdc_ncm collected packet; waits for more */
                                goto not_drop;
-                        }
+                        netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
+                        goto drop;
                }
        }
        length = skb->len;
@@ -1254,6 +1274,9 @@ static void usbnet_bh (unsigned long param)
                }
        }
+        /* restart RX again after disabling due to high error rate */
+        clear_bit(EVENT_RX_KILL, &dev->flags);
        // waiting for all pending urbs to complete?
        if (dev->wait) {
                if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index dc8913c6238c..12c6440d1649 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -154,8 +154,7 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
        if (ret & 1) { /* Link is up. */
                printk(KERN_INFO "%s: NIC Link is Up %d Mbps\n",
                       adapter->netdev->name, adapter->link_speed);
-                if (!netif_carrier_ok(adapter->netdev))
+                netif_carrier_on(adapter->netdev);
-                        netif_carrier_on(adapter->netdev);
                if (affectTxQueue) {
                        for (i = 0; i < adapter->num_tx_queues; i++)
@@ -165,8 +164,7 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
        } else {
                printk(KERN_INFO "%s: NIC Link is Down\n",
                       adapter->netdev->name);
-                if (netif_carrier_ok(adapter->netdev))
+                netif_carrier_off(adapter->netdev);
-                        netif_carrier_off(adapter->netdev);
                if (affectTxQueue) {
                        for (i = 0; i < adapter->num_tx_queues; i++)
@@ -3061,6 +3059,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
        netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
        netif_set_real_num_rx_queues(adapter->netdev, adapter->num_rx_queues);
+        netif_carrier_off(netdev);
        err = register_netdev(netdev);
        if (err) {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 0f71d1d4339d..e5fd20994bec 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -36,6 +36,7 @@
 #include "debug.h"
 #define N_TX_QUEUES     4 /* #tx queues on mac80211<->driver interface */
+#define BRCMS_FLUSH_TIMEOUT     500 /* msec */
 /* Flags we support */
 #define MAC_FILTERS (FIF_PROMISC_IN_BSS | \
@@ -708,16 +709,29 @@ static void brcms_ops_rfkill_poll(struct ieee80211_hw *hw)
        wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
 }
+static bool brcms_tx_flush_completed(struct brcms_info *wl)
+{
+        bool result;
+        spin_lock_bh(&wl->lock);
+        result = brcms_c_tx_flush_completed(wl->wlc);
+        spin_unlock_bh(&wl->lock);
+        return result;
+}
 static void brcms_ops_flush(struct ieee80211_hw *hw, bool drop)
 {
        struct brcms_info *wl = hw->priv;
+        int ret;
        no_printk("%s: drop = %s\n", __func__, drop ? "true" : "false");
-        /* wait for packet queue and dma fifos to run empty */
+        ret = wait_event_timeout(wl->tx_flush_wq,
-        spin_lock_bh(&wl->lock);
+                                 brcms_tx_flush_completed(wl),
-        brcms_c_wait_for_tx_completion(wl->wlc, drop);
+                                 msecs_to_jiffies(BRCMS_FLUSH_TIMEOUT));
-        spin_unlock_bh(&wl->lock);
+        brcms_dbg_mac80211(wl->wlc->hw->d11core,
+                           "ret=%d\n", jiffies_to_msecs(ret));
 }
 static const struct ieee80211_ops brcms_ops = {
@@ -772,6 +786,7 @@ void brcms_dpc(unsigned long data)
 done:
        spin_unlock_bh(&wl->lock);
+        wake_up(&wl->tx_flush_wq);
 }
 /*
@@ -1020,6 +1035,8 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
        atomic_set(&wl->callbacks, 0);
+        init_waitqueue_head(&wl->tx_flush_wq);
        /* setup the bottom half handler */
        tasklet_init(&wl->tasklet, brcms_dpc, (unsigned long) wl);
@@ -1609,13 +1626,3 @@ bool brcms_rfkill_set_hw_state(struct brcms_info *wl)
        spin_lock_bh(&wl->lock);
        return blocked;
 }
-/*
- * precondition: perimeter lock has been acquired
- */
-void brcms_msleep(struct brcms_info *wl, uint ms)
-{
-        spin_unlock_bh(&wl->lock);
-        msleep(ms);
-        spin_lock_bh(&wl->lock);
-}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 9358bd5ebd35..947ccacf43e6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -68,6 +68,8 @@ struct brcms_info {
        spinlock_t lock;        /* per-device perimeter lock */
        spinlock_t isr_lock;    /* per-device ISR synchronization lock */
+        /* tx flush */
+        wait_queue_head_t tx_flush_wq;
        /* timer related fields */
        atomic_t callbacks;     /* # outstanding callback functions */
@@ -100,7 +102,6 @@ extern struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
 extern void brcms_free_timer(struct brcms_timer *timer);
 extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
 extern bool brcms_del_timer(struct brcms_timer *timer);
-extern void brcms_msleep(struct brcms_info *wl, uint ms);
 extern void brcms_dpc(unsigned long data);
 extern void brcms_timer(struct brcms_timer *t);
 extern void brcms_fatal_error(struct brcms_info *wl);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 17594de4199e..8b5839008af3 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1027,7 +1027,6 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 static bool
 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
 {
-        bool morepending = false;
        struct bcma_device *core;
        struct tx_status txstatus, *txs;
        u32 s1, s2;
@@ -1041,23 +1040,20 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
        txs = &txstatus;
        core = wlc_hw->d11core;
        *fatal = false;
-        s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
-        while (!(*fatal)
-               && (s1 & TXS_V)) {
-                /* !give others some time to run! */
-                if (n >= max_tx_num) {
-                        morepending = true;
-                        break;
-                }
+        while (n < max_tx_num) {
+                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
                if (s1 == 0xffffffff) {
                        brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
                                  __func__);
                        *fatal = true;
                        return false;
                }
-                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
+                /* only process when valid */
+                if (!(s1 & TXS_V))
+                        break;
+                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
                txs->status = s1 & TXS_STATUS_MASK;
                txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
                txs->sequence = s2 & TXS_SEQ_MASK;
@@ -1065,15 +1061,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
                txs->lasttxtime = 0;
                *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
+                if (*fatal == true)
-                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
+                        return false;
                n++;
        }
-        if (*fatal)
+        return n >= max_tx_num;
-                return false;
-        return morepending;
 }
 static void brcms_c_tbtt(struct brcms_c_info *wlc)
@@ -7518,25 +7511,16 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
        return wlc->band->bandunit;
 }
-void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
+bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
 {
-        int timeout = 20;
        int i;
        /* Kick DMA to send any pending AMPDU */
        for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
                if (wlc->hw->di[i])
-                        dma_txflush(wlc->hw->di[i]);
+                        dma_kick_tx(wlc->hw->di[i]);
-        /* wait for queue and DMA fifos to run dry */
-        while (brcms_txpktpendtot(wlc) > 0) {
-                brcms_msleep(wlc->wl, 1);
-                if (--timeout == 0)
-                        break;
-        }
-        WARN_ON_ONCE(timeout == 0);
+        return !brcms_txpktpendtot(wlc);
 }
 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index 4fb2834f4e64..b0f14b7b8616 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -314,8 +314,6 @@ extern void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state);
 extern void brcms_c_scan_start(struct brcms_c_info *wlc);
 extern void brcms_c_scan_stop(struct brcms_c_info *wlc);
 extern int brcms_c_get_curband(struct brcms_c_info *wlc);
-extern void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc,
-                                           bool drop);
 extern int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel);
 extern int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl);
 extern void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
@@ -332,5 +330,6 @@ extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
 extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
 extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
 extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
+extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
 #endif                          /* _BRCM_PUB_H_ */
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 31534f7c0548..279796419ea0 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1153,6 +1153,13 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                        next_reclaimed = ssn;
                }
+                if (tid != IWL_TID_NON_QOS) {
+                        priv->tid_data[sta_id][tid].next_reclaimed =
+                                next_reclaimed;
+                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+                                                  next_reclaimed);
+                }
                iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
                iwlagn_check_ratid_empty(priv, sta_id, tid);
@@ -1203,28 +1210,11 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                        if (!is_agg)
                                iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);
-                        /*
-                         * W/A for FW bug - the seq_ctl isn't updated when the
-                         * queues are flushed. Fetch it from the packet itself
-                         */
-                        if (!is_agg && status == TX_STATUS_FAIL_FIFO_FLUSHED) {
-                                next_reclaimed = le16_to_cpu(hdr->seq_ctrl);
-                                next_reclaimed =
-                                        SEQ_TO_SN(next_reclaimed + 0x10);
-                        }
                        is_offchannel_skb =
                                (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);
                        freed++;
                }
-                if (tid != IWL_TID_NON_QOS) {
-                        priv->tid_data[sta_id][tid].next_reclaimed =
-                                next_reclaimed;
-                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
-                                           next_reclaimed);
-                }
                WARN_ON(!is_agg && freed != 1);
                /*
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 9189a32b7844..973a9d90e9ea 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1563,7 +1563,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
                        scan_rsp->number_of_sets);
                ret = -1;
-                goto done;
+                goto check_next_scan;
        }
        bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1634,7 +1634,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                if (!beacon_size || beacon_size > bytes_left) {
                        bss_info += bytes_left;
                        bytes_left = 0;
-                        return -1;
+                        ret = -1;
+                        goto check_next_scan;
                }
                /* Initialize the current working beacon pointer for this BSS
@@ -1690,7 +1691,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                dev_err(priv->adapter->dev,
                                        "%s: bytes left < IE length\n",
                                        __func__);
-                                goto done;
+                                goto check_next_scan;
                        }
                        if (element_id == WLAN_EID_DS_PARAMS) {
                                channel = *(current_ptr + sizeof(struct ieee_types_header));
@@ -1753,6 +1754,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                }
        }
+check_next_scan:
        spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
        if (list_empty(&adapter->scan_pending_q)) {
                spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -1813,7 +1815,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                }
        }
-done:
        return ret;
 }
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 4494d130b37c..0f8b05185eda 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1004,7 +1004,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                                         is_tx ? "Tx" : "Rx");
                                if (is_tx) {
-                                        rtl_lps_leave(hw);
+                                        schedule_work(&rtlpriv->
+                                                      works.lps_leave_work);
                                        ppsc->last_delaylps_stamp_jiffies =
                                            jiffies;
                                }
@@ -1014,7 +1015,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                }
        } else if (ETH_P_ARP == ether_type) {
                if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                        ppsc->last_delaylps_stamp_jiffies = jiffies;
                }
@@ -1024,7 +1025,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                         "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
                if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                        ppsc->last_delaylps_stamp_jiffies = jiffies;
                }
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index f2ecdeb3a90d..1535efda3d52 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -542,8 +542,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
        WARN_ON(skb_queue_empty(&rx_queue));
        while (!skb_queue_empty(&rx_queue)) {
                _skb = skb_dequeue(&rx_queue);
-                _rtl_usb_rx_process_agg(hw, skb);
+                _rtl_usb_rx_process_agg(hw, _skb);
-                ieee80211_rx_irqsafe(hw, skb);
+                ieee80211_rx_irqsafe(hw, _skb);
        }
 }
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 94b79c3338c4..9d7f1723dd8f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -151,6 +151,9 @@ void xen_netbk_queue_tx_skb(struct xenvif *vif, struct sk_buff *skb);
 /* Notify xenvif that ring now has space to send an skb to the frontend */
 void xenvif_notify_tx_completion(struct xenvif *vif);
+/* Prevent the device from generating any further traffic. */
+void xenvif_carrier_off(struct xenvif *vif);
 /* Returns number of ring slots required to send an skb to the frontend */
 unsigned int xen_netbk_count_skb_slots(struct xenvif *vif, struct sk_buff *skb);
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b7d41f8c338a..b8c5193bd420 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -343,17 +343,22 @@ err:
        return err;
 }
-void xenvif_disconnect(struct xenvif *vif)
+void xenvif_carrier_off(struct xenvif *vif)
 {
        struct net_device *dev = vif->dev;
-        if (netif_carrier_ok(dev)) {
-                rtnl_lock();
+        rtnl_lock();
-                netif_carrier_off(dev); /* discard queued packets */
+        netif_carrier_off(dev); /* discard queued packets */
-                if (netif_running(dev))
+        if (netif_running(dev))
-                        xenvif_down(vif);
+                xenvif_down(vif);
-                rtnl_unlock();
+        rtnl_unlock();
-                xenvif_put(vif);
+        xenvif_put(vif);
-        }
+}
+void xenvif_disconnect(struct xenvif *vif)
+{
+        if (netif_carrier_ok(vif->dev))
+                xenvif_carrier_off(vif);
        atomic_dec(&vif->refcnt);
        wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f2d6b78d901d..2b9520c46e97 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -147,7 +147,8 @@ void xen_netbk_remove_xenvif(struct xenvif *vif)
        atomic_dec(&netbk->netfront_count);
 }
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx);
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+                                  u8 status);
 static void make_tx_response(struct xenvif *vif,
                             struct xen_netif_tx_request *txp,
                             s8       st);
@@ -879,7 +880,7 @@ static void netbk_tx_err(struct xenvif *vif,
        do {
                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                if (cons >= end)
+                if (cons == end)
                        break;
                txp = RING_GET_REQUEST(&vif->tx, cons++);
        } while (1);
@@ -888,6 +889,13 @@ static void netbk_tx_err(struct xenvif *vif,
        xenvif_put(vif);
 }
+static void netbk_fatal_tx_err(struct xenvif *vif)
+{
+        netdev_err(vif->dev, "fatal error; disabling device\n");
+        xenvif_carrier_off(vif);
+        xenvif_put(vif);
+}
 static int netbk_count_requests(struct xenvif *vif,
                                struct xen_netif_tx_request *first,
                                struct xen_netif_tx_request *txp,
@@ -901,19 +909,22 @@ static int netbk_count_requests(struct xenvif *vif,
        do {
                if (frags >= work_to_do) {
-                        netdev_dbg(vif->dev, "Need more frags\n");
+                        netdev_err(vif->dev, "Need more frags\n");
+                        netbk_fatal_tx_err(vif);
                        return -frags;
                }
                if (unlikely(frags >= MAX_SKB_FRAGS)) {
-                        netdev_dbg(vif->dev, "Too many frags\n");
+                        netdev_err(vif->dev, "Too many frags\n");
+                        netbk_fatal_tx_err(vif);
                        return -frags;
                }
                memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags),
                       sizeof(*txp));
                if (txp->size > first->size) {
-                        netdev_dbg(vif->dev, "Frags galore\n");
+                        netdev_err(vif->dev, "Frag is bigger than frame.\n");
+                        netbk_fatal_tx_err(vif);
                        return -frags;
                }
@@ -921,8 +932,9 @@ static int netbk_count_requests(struct xenvif *vif,
                frags++;
                if (unlikely((txp->offset + txp->size) > PAGE_SIZE)) {
-                        netdev_dbg(vif->dev, "txp->offset: %x, size: %u\n",
+                        netdev_err(vif->dev, "txp->offset: %x, size: %u\n",
                                 txp->offset, txp->size);
+                        netbk_fatal_tx_err(vif);
                        return -frags;
                }
        } while ((txp++)->flags & XEN_NETTXF_more_data);
@@ -966,7 +978,7 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
                pending_idx = netbk->pending_ring[index];
                page = xen_netbk_alloc_page(netbk, skb, pending_idx);
                if (!page)
-                        return NULL;
+                        goto err;
                gop->source.u.ref = txp->gref;
                gop->source.domid = vif->domid;
@@ -988,6 +1000,17 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
        }
        return gop;
+err:
+        /* Unwind, freeing all pages and sending error responses. */
+        while (i-- > start) {
+                xen_netbk_idx_release(netbk, frag_get_pending_idx(&frags[i]),
+                                      XEN_NETIF_RSP_ERROR);
+        }
+        /* The head too, if necessary. */
+        if (start)
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
+        return NULL;
 }
 static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
@@ -996,30 +1019,20 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 {
        struct gnttab_copy *gop = *gopp;
        u16 pending_idx = *((u16 *)skb->data);
-        struct pending_tx_info *pending_tx_info = netbk->pending_tx_info;
-        struct xenvif *vif = pending_tx_info[pending_idx].vif;
-        struct xen_netif_tx_request *txp;
        struct skb_shared_info *shinfo = skb_shinfo(skb);
        int nr_frags = shinfo->nr_frags;
        int i, err, start;
        /* Check status of header. */
        err = gop->status;
-        if (unlikely(err)) {
+        if (unlikely(err))
-                pending_ring_idx_t index;
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
-                index = pending_index(netbk->pending_prod++);
-                txp = &pending_tx_info[pending_idx].req;
-                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                netbk->pending_ring[index] = pending_idx;
-                xenvif_put(vif);
-        }
        /* Skip first skb fragment if it is on same page as header fragment. */
        start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
        for (i = start; i < nr_frags; i++) {
                int j, newerr;
-                pending_ring_idx_t index;
                pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
@@ -1028,16 +1041,12 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
                if (likely(!newerr)) {
                        /* Had a previous error? Invalidate this fragment. */
                        if (unlikely(err))
-                                xen_netbk_idx_release(netbk, pending_idx);
+                                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                        continue;
                }
                /* Error on this fragment: respond to client with an error. */
-                txp = &netbk->pending_tx_info[pending_idx].req;
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
-                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                index = pending_index(netbk->pending_prod++);
-                netbk->pending_ring[index] = pending_idx;
-                xenvif_put(vif);
                /* Not the first error? Preceding frags already invalidated. */
                if (err)
@@ -1045,10 +1054,10 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
                /* First error: invalidate header and preceding fragments. */
                pending_idx = *((u16 *)skb->data);
-                xen_netbk_idx_release(netbk, pending_idx);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                for (j = start; j < i; j++) {
                        pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
-                        xen_netbk_idx_release(netbk, pending_idx);
+                        xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                }
                /* Remember the error: invalidate all subsequent fragments. */
@@ -1082,7 +1091,7 @@ static void xen_netbk_fill_frags(struct xen_netbk *netbk, struct sk_buff *skb)
                /* Take an extra reference to offset xen_netbk_idx_release */
                get_page(netbk->mmap_pages[pending_idx]);
-                xen_netbk_idx_release(netbk, pending_idx);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
        }
 }
@@ -1095,7 +1104,8 @@ static int xen_netbk_get_extras(struct xenvif *vif,
        do {
                if (unlikely(work_to_do-- <= 0)) {
-                        netdev_dbg(vif->dev, "Missing extra info\n");
+                        netdev_err(vif->dev, "Missing extra info\n");
+                        netbk_fatal_tx_err(vif);
                        return -EBADR;
                }
@@ -1104,8 +1114,9 @@ static int xen_netbk_get_extras(struct xenvif *vif,
                if (unlikely(!extra.type ||
                             extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
                        vif->tx.req_cons = ++cons;
-                        netdev_dbg(vif->dev,
+                        netdev_err(vif->dev,
                                   "Invalid extra type: %d\n", extra.type);
+                        netbk_fatal_tx_err(vif);
                        return -EINVAL;
                }
@@ -1121,13 +1132,15 @@ static int netbk_set_skb_gso(struct xenvif *vif,
                             struct xen_netif_extra_info *gso)
 {
        if (!gso->u.gso.size) {
-                netdev_dbg(vif->dev, "GSO size must not be zero.\n");
+                netdev_err(vif->dev, "GSO size must not be zero.\n");
+                netbk_fatal_tx_err(vif);
                return -EINVAL;
        }
        /* Currently only TCPv4 S.O. is supported. */
        if (gso->u.gso.type != XEN_NETIF_GSO_TYPE_TCPV4) {
-                netdev_dbg(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
+                netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
+                netbk_fatal_tx_err(vif);
                return -EINVAL;
        }
@@ -1264,9 +1277,25 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                /* Get a netif from the list with work to do. */
                vif = poll_net_schedule_list(netbk);
+                /* This can sometimes happen because the test of
+                 * list_empty(net_schedule_list) at the top of the
+                 * loop is unlocked.  Just go back and have another
+                 * look.
+                 */
                if (!vif)
                        continue;
+                if (vif->tx.sring->req_prod - vif->tx.req_cons >
+                    XEN_NETIF_TX_RING_SIZE) {
+                        netdev_err(vif->dev,
+                                   "Impossible number of requests. "
+                                   "req_prod %d, req_cons %d, size %ld\n",
+                                   vif->tx.sring->req_prod, vif->tx.req_cons,
+                                   XEN_NETIF_TX_RING_SIZE);
+                        netbk_fatal_tx_err(vif);
+                        continue;
+                }
                RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
                if (!work_to_do) {
                        xenvif_put(vif);
@@ -1294,17 +1323,14 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                        work_to_do = xen_netbk_get_extras(vif, extras,
                                                          work_to_do);
                        idx = vif->tx.req_cons;
-                        if (unlikely(work_to_do < 0)) {
+                        if (unlikely(work_to_do < 0))
-                                netbk_tx_err(vif, &txreq, idx);
                                continue;
-                        }
                }
                ret = netbk_count_requests(vif, &txreq, txfrags, work_to_do);
-                if (unlikely(ret < 0)) {
+                if (unlikely(ret < 0))
-                        netbk_tx_err(vif, &txreq, idx - ret);
                        continue;
-                }
                idx += ret;
                if (unlikely(txreq.size < ETH_HLEN)) {
@@ -1316,11 +1342,11 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                /* No crossing a page as the payload mustn't fragment. */
                if (unlikely((txreq.offset + txreq.size) > PAGE_SIZE)) {
-                        netdev_dbg(vif->dev,
+                        netdev_err(vif->dev,
                                   "txreq.offset: %x, size: %u, end: %lu\n",
                                   txreq.offset, txreq.size,
                                   (txreq.offset&~PAGE_MASK) + txreq.size);
-                        netbk_tx_err(vif, &txreq, idx);
+                        netbk_fatal_tx_err(vif);
                        continue;
                }
@@ -1348,8 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                        gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1];
                        if (netbk_set_skb_gso(vif, skb, gso)) {
+                                /* Failure in netbk_set_skb_gso is fatal. */
                                kfree_skb(skb);
-                                netbk_tx_err(vif, &txreq, idx);
                                continue;
                        }
                }
@@ -1448,7 +1474,7 @@ static void xen_netbk_tx_submit(struct xen_netbk *netbk)
                        txp->size -= data_len;
                } else {
                        /* Schedule a response immediately. */
-                        xen_netbk_idx_release(netbk, pending_idx);
+                        xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                }
                if (txp->flags & XEN_NETTXF_csum_blank)
@@ -1500,7 +1526,8 @@ static void xen_netbk_tx_action(struct xen_netbk *netbk)
        xen_netbk_tx_submit(netbk);
 }
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+                                  u8 status)
 {
        struct xenvif *vif;
        struct pending_tx_info *pending_tx_info;
@@ -1514,7 +1541,7 @@ static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
        vif = pending_tx_info->vif;
-        make_tx_response(vif, &pending_tx_info->req, XEN_NETIF_RSP_OKAY);
+        make_tx_response(vif, &pending_tx_info->req, status);
        index = pending_index(netbk->pending_prod++);
        netbk->pending_ring[index] = pending_idx;
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index efaecefe3f8c..a5f3c8ca480e 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -184,8 +184,8 @@ config PINCTRL_SAMSUNG
        select PINMUX
        select PINCONF
-config PINCTRL_EXYNOS4
+config PINCTRL_EXYNOS
-        bool "Pinctrl driver data for Exynos4 SoC"
+        bool "Pinctrl driver data for Samsung EXYNOS SoCs"
        depends on OF && GPIOLIB
        select PINCTRL_SAMSUNG
diff --git a/drivers/pinctrl/Makefile b/drivers/pinctrl/Makefile
index fc4606f27dc7..6e87e52eab5d 100644
--- a/drivers/pinctrl/Makefile
+++ b/drivers/pinctrl/Makefile
@@ -36,7 +36,7 @@ obj-$(CONFIG_PINCTRL_TEGRA30)	+= pinctrl-tegra30.o
 obj-$(CONFIG_PINCTRL_U300)      += pinctrl-u300.o
 obj-$(CONFIG_PINCTRL_COH901)    += pinctrl-coh901.o
 obj-$(CONFIG_PINCTRL_SAMSUNG)   += pinctrl-samsung.o
-obj-$(CONFIG_PINCTRL_EXYNOS4)   += pinctrl-exynos.o
+obj-$(CONFIG_PINCTRL_EXYNOS)    += pinctrl-exynos.o
 obj-$(CONFIG_PINCTRL_EXYNOS5440)        += pinctrl-exynos5440.o
 obj-$(CONFIG_PINCTRL_XWAY)      += pinctrl-xway.o
 obj-$(CONFIG_PINCTRL_LANTIQ)    += pinctrl-lantiq.o
diff --git a/drivers/pinctrl/pinctrl-sirf.c b/drivers/pinctrl/pinctrl-sirf.c
index 498b2ba905de..d02498b30c6e 100644
--- a/drivers/pinctrl/pinctrl-sirf.c
+++ b/drivers/pinctrl/pinctrl-sirf.c
@@ -1246,6 +1246,22 @@ static void __iomem *sirfsoc_rsc_of_iomap(void)
        return of_iomap(np, 0);
 }
+static int sirfsoc_gpio_of_xlate(struct gpio_chip *gc,
+       const struct of_phandle_args *gpiospec,
+       u32 *flags)
+{
+       if (gpiospec->args[0] > SIRFSOC_GPIO_NO_OF_BANKS * SIRFSOC_GPIO_BANK_SIZE)
+               return -EINVAL;
+       if (gc != &sgpio_bank[gpiospec->args[0] / SIRFSOC_GPIO_BANK_SIZE].chip.gc)
+               return -EINVAL;
+       if (flags)
+               *flags = gpiospec->args[1];
+       return gpiospec->args[0] % SIRFSOC_GPIO_BANK_SIZE;
+}
 static int sirfsoc_pinmux_probe(struct platform_device *pdev)
 {
        int ret;
@@ -1736,6 +1752,8 @@ static int sirfsoc_gpio_probe(struct device_node *np)
                bank->chip.gc.ngpio = SIRFSOC_GPIO_BANK_SIZE;
                bank->chip.gc.label = kstrdup(np->full_name, GFP_KERNEL);
                bank->chip.gc.of_node = np;
+                bank->chip.gc.of_xlate = sirfsoc_gpio_of_xlate;
+                bank->chip.gc.of_gpio_n_cells = 2;
                bank->chip.regs = regs;
                bank->id = i;
                bank->is_marco = is_marco;
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index b85040caaea3..cca18a3c0294 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -379,9 +379,10 @@ static struct regulator_desc regulators[] = {
 };
 #ifdef CONFIG_OF
-static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
+static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
                                        struct max77686_platform_data *pdata)
 {
+        struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
        struct device_node *pmic_np, *regulators_np;
        struct max77686_regulator_data *rdata;
        struct of_regulator_match rmatch;
@@ -390,15 +391,15 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
        pmic_np = iodev->dev->of_node;
        regulators_np = of_find_node_by_name(pmic_np, "voltage-regulators");
        if (!regulators_np) {
-                dev_err(iodev->dev, "could not find regulators sub-node\n");
+                dev_err(&pdev->dev, "could not find regulators sub-node\n");
                return -EINVAL;
        }
        pdata->num_regulators = ARRAY_SIZE(regulators);
-        rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
+        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
                             pdata->num_regulators, GFP_KERNEL);
        if (!rdata) {
-                dev_err(iodev->dev,
+                dev_err(&pdev->dev,
                        "could not allocate memory for regulator data\n");
                return -ENOMEM;
        }
@@ -407,7 +408,7 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
                rmatch.name = regulators[i].name;
                rmatch.init_data = NULL;
                rmatch.of_node = NULL;
-                of_regulator_match(iodev->dev, regulators_np, &rmatch, 1);
+                of_regulator_match(&pdev->dev, regulators_np, &rmatch, 1);
                rdata[i].initdata = rmatch.init_data;
                rdata[i].of_node = rmatch.of_node;
        }
@@ -417,7 +418,7 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
        return 0;
 }
 #else
-static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
+static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
                                        struct max77686_platform_data *pdata)
 {
        return 0;
@@ -440,7 +441,7 @@ static int max77686_pmic_probe(struct platform_device *pdev)
        }
        if (iodev->dev->of_node) {
-                ret = max77686_pmic_dt_parse_pdata(iodev, pdata);
+                ret = max77686_pmic_dt_parse_pdata(pdev, pdata);
                if (ret)
                        return ret;
        }
diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c
index d1a77512d83e..d40cf7fdb546 100644
--- a/drivers/regulator/max8907-regulator.c
+++ b/drivers/regulator/max8907-regulator.c
@@ -237,8 +237,7 @@ static int max8907_regulator_parse_dt(struct platform_device *pdev)
                return -EINVAL;
        }
-        ret = of_regulator_match(pdev->dev.parent, regulators,
+        ret = of_regulator_match(&pdev->dev, regulators, max8907_matches,
-                                 max8907_matches,
                                 ARRAY_SIZE(max8907_matches));
        if (ret < 0) {
                dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
index 02be7fcae32f..836908ce505e 100644
--- a/drivers/regulator/max8997.c
+++ b/drivers/regulator/max8997.c
@@ -934,7 +934,7 @@ static struct regulator_desc regulators[] = {
 };
 #ifdef CONFIG_OF
-static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_dvs_gpio(struct platform_device *pdev,
                        struct max8997_platform_data *pdata,
                        struct device_node *pmic_np)
 {
@@ -944,7 +944,7 @@ static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
                gpio = of_get_named_gpio(pmic_np,
                                        "max8997,pmic-buck125-dvs-gpios", i);
                if (!gpio_is_valid(gpio)) {
-                        dev_err(iodev->dev, "invalid gpio[%d]: %d\n", i, gpio);
+                        dev_err(&pdev->dev, "invalid gpio[%d]: %d\n", i, gpio);
                        return -EINVAL;
                }
                pdata->buck125_gpios[i] = gpio;
@@ -952,22 +952,23 @@ static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
        return 0;
 }
-static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
                                        struct max8997_platform_data *pdata)
 {
+        struct max8997_dev *iodev = dev_get_drvdata(pdev->dev.parent);
        struct device_node *pmic_np, *regulators_np, *reg_np;
        struct max8997_regulator_data *rdata;
        unsigned int i, dvs_voltage_nr = 1, ret;
        pmic_np = iodev->dev->of_node;
        if (!pmic_np) {
-                dev_err(iodev->dev, "could not find pmic sub-node\n");
+                dev_err(&pdev->dev, "could not find pmic sub-node\n");
                return -ENODEV;
        }
        regulators_np = of_find_node_by_name(pmic_np, "regulators");
        if (!regulators_np) {
-                dev_err(iodev->dev, "could not find regulators sub-node\n");
+                dev_err(&pdev->dev, "could not find regulators sub-node\n");
                return -EINVAL;
        }
@@ -976,11 +977,10 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
        for_each_child_of_node(regulators_np, reg_np)
                pdata->num_regulators++;
-        rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
+        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
                                pdata->num_regulators, GFP_KERNEL);
        if (!rdata) {
-                dev_err(iodev->dev, "could not allocate memory for "
+                dev_err(&pdev->dev, "could not allocate memory for regulator data\n");
-                                                "regulator data\n");
                return -ENOMEM;
        }
@@ -991,14 +991,14 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
                                break;
                if (i == ARRAY_SIZE(regulators)) {
-                        dev_warn(iodev->dev, "don't know how to configure "
+                        dev_warn(&pdev->dev, "don't know how to configure regulator %s\n",
-                                "regulator %s\n", reg_np->name);
+                                 reg_np->name);
                        continue;
                }
                rdata->id = i;
-                rdata->initdata = of_get_regulator_init_data(
+                rdata->initdata = of_get_regulator_init_data(&pdev->dev,
-                                                iodev->dev, reg_np);
+                                                             reg_np);
                rdata->reg_node = reg_np;
                rdata++;
        }
@@ -1014,7 +1014,7 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
        if (pdata->buck1_gpiodvs || pdata->buck2_gpiodvs ||
                                                pdata->buck5_gpiodvs) {
-                ret = max8997_pmic_dt_parse_dvs_gpio(iodev, pdata, pmic_np);
+                ret = max8997_pmic_dt_parse_dvs_gpio(pdev, pdata, pmic_np);
                if (ret)
                        return -EINVAL;
@@ -1025,8 +1025,7 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
                } else {
                        if (pdata->buck125_default_idx >= 8) {
                                pdata->buck125_default_idx = 0;
-                                dev_info(iodev->dev, "invalid value for "
+                                dev_info(&pdev->dev, "invalid value for default dvs index, using 0 instead\n");
-                                "default dvs index, using 0 instead\n");
                        }
                }
@@ -1040,28 +1039,28 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
        if (of_property_read_u32_array(pmic_np,
                                "max8997,pmic-buck1-dvs-voltage",
                                pdata->buck1_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck1 voltages not specified\n");
+                dev_err(&pdev->dev, "buck1 voltages not specified\n");
                return -EINVAL;
        }
        if (of_property_read_u32_array(pmic_np,
                                "max8997,pmic-buck2-dvs-voltage",
                                pdata->buck2_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck2 voltages not specified\n");
+                dev_err(&pdev->dev, "buck2 voltages not specified\n");
                return -EINVAL;
        }
        if (of_property_read_u32_array(pmic_np,
                                "max8997,pmic-buck5-dvs-voltage",
                                pdata->buck5_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck5 voltages not specified\n");
+                dev_err(&pdev->dev, "buck5 voltages not specified\n");
                return -EINVAL;
        }
        return 0;
 }
 #else
-static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
                                        struct max8997_platform_data *pdata)
 {
        return 0;
@@ -1085,7 +1084,7 @@ static int max8997_pmic_probe(struct platform_device *pdev)
        }
        if (iodev->dev->of_node) {
-                ret = max8997_pmic_dt_parse_pdata(iodev, pdata);
+                ret = max8997_pmic_dt_parse_pdata(pdev, pdata);
                if (ret)
                        return ret;
        }
diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
index 1f0df4046b86..0a8dd1cbee6f 100644
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -65,7 +65,7 @@ static const struct voltage_map_desc ldo9_voltage_map_desc = {
        .min = 2800000, .step = 100000, .max = 3100000,
 };
 static const struct voltage_map_desc ldo10_voltage_map_desc = {
-        .min = 95000,   .step = 50000,  .max = 1300000,
+        .min = 950000,  .step = 50000,  .max = 1300000,
 };
 static const struct voltage_map_desc ldo1213_voltage_map_desc = {
        .min = 800000,  .step = 100000, .max = 3300000,
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 6f684916fd79..66ca769287ab 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -120,6 +120,12 @@ int of_regulator_match(struct device *dev, struct device_node *node,
        if (!dev || !node)
                return -EINVAL;
+        for (i = 0; i < num_matches; i++) {
+                struct of_regulator_match *match = &matches[i];
+                match->init_data = NULL;
+                match->of_node = NULL;
+        }
        for_each_child_of_node(node, child) {
                name = of_get_property(child,
                                        "regulator-compatible", NULL);
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index bd062a2ffbe2..cd9ea2ea1826 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -174,9 +174,9 @@ static struct regulator_ops s2mps11_buck_ops = {
        .min_uV         = S2MPS11_BUCK_MIN2,                    \
        .uV_step        = S2MPS11_BUCK_STEP2,                   \
        .n_voltages     = S2MPS11_BUCK_N_VOLTAGES,              \
-        .vsel_reg       = S2MPS11_REG_B9CTRL2,                  \
+        .vsel_reg       = S2MPS11_REG_B10CTRL2,                 \
        .vsel_mask      = S2MPS11_BUCK_VSEL_MASK,               \
-        .enable_reg     = S2MPS11_REG_B9CTRL1,                  \
+        .enable_reg     = S2MPS11_REG_B10CTRL1,                 \
        .enable_mask    = S2MPS11_ENABLE_MASK                   \
 }
diff --git a/drivers/regulator/tps65217-regulator.c b/drivers/regulator/tps65217-regulator.c
index 73dce7664126..df395187c063 100644
--- a/drivers/regulator/tps65217-regulator.c
+++ b/drivers/regulator/tps65217-regulator.c
@@ -305,8 +305,8 @@ static struct tps65217_board *tps65217_parse_dt(struct platform_device *pdev)
        if (!regs)
                return NULL;
-        count = of_regulator_match(pdev->dev.parent, regs,
+        count = of_regulator_match(&pdev->dev, regs, reg_matches,
-                                reg_matches, TPS65217_NUM_REGULATOR);
+                                   TPS65217_NUM_REGULATOR);
        of_node_put(regs);
        if ((count < 0) || (count > TPS65217_NUM_REGULATOR))
                return NULL;
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 59c3770fa77d..b0e4c0bc85c3 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -998,7 +998,7 @@ static struct tps65910_board *tps65910_parse_dt_reg_data(
                return NULL;
        }
-        ret = of_regulator_match(pdev->dev.parent, regulators, matches, count);
+        ret = of_regulator_match(&pdev->dev, regulators, matches, count);
        if (ret < 0) {
                dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
                        ret);
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index 10c1a3454e48..81c5077feff3 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -350,7 +350,9 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
        /* Enable the clockwatch on ST Variants */
        if (vendor->clockwatch)
                data |= RTC_CR_CWEN;
-        writel(data | RTC_CR_EN, ldata->base + RTC_CR);
+        else
+                data |= RTC_CR_EN;
+        writel(data, ldata->base + RTC_CR);
        /*
         * On ST PL031 variants, the RTC reset value does not provide correct
diff --git a/drivers/ssb/driver_gpio.c b/drivers/ssb/driver_gpio.c
index 97ac0a38e3d0..eb2753008ef0 100644
--- a/drivers/ssb/driver_gpio.c
+++ b/drivers/ssb/driver_gpio.c
@@ -174,3 +174,15 @@ int ssb_gpio_init(struct ssb_bus *bus)
        return -1;
 }
+int ssb_gpio_unregister(struct ssb_bus *bus)
+{
+        if (ssb_chipco_available(&bus->chipco) ||
+            ssb_extif_available(&bus->extif)) {
+                return gpiochip_remove(&bus->gpio);
+        } else {
+                SSB_WARN_ON(1);
+        }
+        return -1;
+}
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 772ad9b5c304..24dc331b4701 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -443,6 +443,15 @@ static void ssb_devices_unregister(struct ssb_bus *bus)
 void ssb_bus_unregister(struct ssb_bus *bus)
 {
+        int err;
+        err = ssb_gpio_unregister(bus);
+        if (err == -EBUSY)
+                ssb_dprintk(KERN_ERR PFX "Some GPIOs are still in use.\n");
+        else if (err)
+                ssb_dprintk(KERN_ERR PFX
+                            "Can not unregister GPIO driver: %i\n", err);
        ssb_buses_lock();
        ssb_devices_unregister(bus);
        list_del(&bus->list);
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index 6c10b66c796c..da38305a2d22 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -252,11 +252,16 @@ static inline void ssb_extif_init(struct ssb_extif *extif)
 #ifdef CONFIG_SSB_DRIVER_GPIO
 extern int ssb_gpio_init(struct ssb_bus *bus);
+extern int ssb_gpio_unregister(struct ssb_bus *bus);
 #else /* CONFIG_SSB_DRIVER_GPIO */
 static inline int ssb_gpio_init(struct ssb_bus *bus)
 {
        return -ENOTSUPP;
 }
+static inline int ssb_gpio_unregister(struct ssb_bus *bus)
+{
+        return 0;
+}
 #endif /* CONFIG_SSB_DRIVER_GPIO */
 #endif /* LINUX_SSB_PRIVATE_H_ */
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 4225d5e72131..8e64adf8e4d5 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -39,6 +39,7 @@
 #include <asm/unaligned.h>
 #include <linux/platform_device.h>
 #include <linux/workqueue.h>
+#include <linux/pm_runtime.h>
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
@@ -1025,6 +1026,49 @@ static int register_root_hub(struct usb_hcd *hcd)
        return retval;
 }
+/*
+ * usb_hcd_start_port_resume - a root-hub port is sending a resume signal
+ * @bus: the bus which the root hub belongs to
+ * @portnum: the port which is being resumed
+ *
+ * HCDs should call this function when they know that a resume signal is
+ * being sent to a root-hub port.  The root hub will be prevented from
+ * going into autosuspend until usb_hcd_end_port_resume() is called.
+ *
+ * The bus's private lock must be held by the caller.
+ */
+void usb_hcd_start_port_resume(struct usb_bus *bus, int portnum)
+{
+        unsigned bit = 1 << portnum;
+        if (!(bus->resuming_ports & bit)) {
+                bus->resuming_ports |= bit;
+                pm_runtime_get_noresume(&bus->root_hub->dev);
+        }
+}
+EXPORT_SYMBOL_GPL(usb_hcd_start_port_resume);
+/*
+ * usb_hcd_end_port_resume - a root-hub port has stopped sending a resume signal
+ * @bus: the bus which the root hub belongs to
+ * @portnum: the port which is being resumed
+ *
+ * HCDs should call this function when they know that a resume signal has
+ * stopped being sent to a root-hub port.  The root hub will be allowed to
+ * autosuspend again.
+ *
+ * The bus's private lock must be held by the caller.
+ */
+void usb_hcd_end_port_resume(struct usb_bus *bus, int portnum)
+{
+        unsigned bit = 1 << portnum;
+        if (bus->resuming_ports & bit) {
+                bus->resuming_ports &= ~bit;
+                pm_runtime_put_noidle(&bus->root_hub->dev);
+        }
+}
+EXPORT_SYMBOL_GPL(usb_hcd_end_port_resume);
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 957ed2c41482..cbf7168e3ce7 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2838,6 +2838,23 @@ void usb_enable_ltm(struct usb_device *udev)
 EXPORT_SYMBOL_GPL(usb_enable_ltm);
 #ifdef  CONFIG_USB_SUSPEND
+/*
+ * usb_disable_function_remotewakeup - disable usb3.0
+ * device's function remote wakeup
+ * @udev: target device
+ *
+ * Assume there's only one function on the USB 3.0
+ * device and disable remote wake for the first
+ * interface. FIXME if the interface association
+ * descriptor shows there's more than one function.
+ */
+static int usb_disable_function_remotewakeup(struct usb_device *udev)
+{
+        return usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                                USB_REQ_CLEAR_FEATURE, USB_RECIP_INTERFACE,
+                                USB_INTRF_FUNC_SUSPEND, 0, NULL, 0,
+                                USB_CTRL_SET_TIMEOUT);
+}
 /*
 * usb_port_suspend - suspend a usb device's upstream port
@@ -2955,12 +2972,19 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
                dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
                                port1, status);
                /* paranoia:  "should not happen" */
-                if (udev->do_remote_wakeup)
+                if (udev->do_remote_wakeup) {
-                        (void) usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                        if (!hub_is_superspeed(hub->hdev)) {
-                                USB_REQ_CLEAR_FEATURE, USB_RECIP_DEVICE,
+                                (void) usb_control_msg(udev,
-                                USB_DEVICE_REMOTE_WAKEUP, 0,
+                                                usb_sndctrlpipe(udev, 0),
-                                NULL, 0,
+                                                USB_REQ_CLEAR_FEATURE,
-                                USB_CTRL_SET_TIMEOUT);
+                                                USB_RECIP_DEVICE,
+                                                USB_DEVICE_REMOTE_WAKEUP, 0,
+                                                NULL, 0,
+                                                USB_CTRL_SET_TIMEOUT);
+                        } else
+                                (void) usb_disable_function_remotewakeup(udev);
+                }
                /* Try to enable USB2 hardware LPM again */
                if (udev->usb2_hw_lpm_capable == 1)
@@ -3052,20 +3076,30 @@ static int finish_port_resume(struct usb_device *udev)
         * udev->reset_resume
         */
        } else if (udev->actconfig && !udev->reset_resume) {
-                le16_to_cpus(&devstatus);
+                if (!hub_is_superspeed(udev->parent)) {
-                if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP)) {
+                        le16_to_cpus(&devstatus);
-                        status = usb_control_msg(udev,
+                        if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP))
-                                        usb_sndctrlpipe(udev, 0),
+                                status = usb_control_msg(udev,
-                                        USB_REQ_CLEAR_FEATURE,
+                                                usb_sndctrlpipe(udev, 0),
+                                                USB_REQ_CLEAR_FEATURE,
                                                USB_RECIP_DEVICE,
-                                        USB_DEVICE_REMOTE_WAKEUP, 0,
+                                                USB_DEVICE_REMOTE_WAKEUP, 0,
-                                        NULL, 0,
+                                                NULL, 0,
-                                        USB_CTRL_SET_TIMEOUT);
+                                                USB_CTRL_SET_TIMEOUT);
-                        if (status)
+                } else {
-                                dev_dbg(&udev->dev,
+                        status = usb_get_status(udev, USB_RECIP_INTERFACE, 0,
-                                        "disable remote wakeup, status %d\n",
+                                        &devstatus);
-                                        status);
+                        le16_to_cpus(&devstatus);
+                        if (!status && devstatus & (USB_INTRF_STAT_FUNC_RW_CAP
+                                        | USB_INTRF_STAT_FUNC_RW))
+                                status =
+                                        usb_disable_function_remotewakeup(udev);
                }
+                if (status)
+                        dev_dbg(&udev->dev,
+                                "disable remote wakeup, status %d\n",
+                                status);
                status = 0;
        }
        return status;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 09537b2f1002..b416a3fc9959 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -797,6 +797,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                        ehci->reset_done[i] = jiffies + msecs_to_jiffies(25);
                        set_bit(i, &ehci->resuming_ports);
                        ehci_dbg (ehci, "port %d remote wakeup\n", i + 1);
+                        usb_hcd_start_port_resume(&hcd->self, i);
                        mod_timer(&hcd->rh_timer, ehci->reset_done[i]);
                }
        }
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 4ccb97c0678f..4d3b294f203e 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -649,7 +649,11 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf)
                        status = STS_PCD;
                }
        }
-        /* FIXME autosuspend idle root hubs */
+        /* If a resume is in progress, make sure it can finish */
+        if (ehci->resuming_ports)
+                mod_timer(&hcd->rh_timer, jiffies + msecs_to_jiffies(25));
        spin_unlock_irqrestore (&ehci->lock, flags);
        return status ? retval : 0;
 }
@@ -851,6 +855,7 @@ static int ehci_hub_control (
                                /* resume signaling for 20 msec */
                                ehci->reset_done[wIndex] = jiffies
                                                + msecs_to_jiffies(20);
+                                usb_hcd_start_port_resume(&hcd->self, wIndex);
                                /* check the port again */
                                mod_timer(&ehci_to_hcd(ehci)->rh_timer,
                                                ehci->reset_done[wIndex]);
@@ -862,6 +867,7 @@ static int ehci_hub_control (
                                clear_bit(wIndex, &ehci->suspended_ports);
                                set_bit(wIndex, &ehci->port_c_suspend);
                                ehci->reset_done[wIndex] = 0;
+                                usb_hcd_end_port_resume(&hcd->self, wIndex);
                                /* stop resume signaling */
                                temp = ehci_readl(ehci, status_reg);
@@ -950,6 +956,7 @@ static int ehci_hub_control (
                        ehci->reset_done[wIndex] = 0;
                        if (temp & PORT_PE)
                                set_bit(wIndex, &ehci->port_c_suspend);
+                        usb_hcd_end_port_resume(&hcd->self, wIndex);
                }
                if (temp & PORT_OC)
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 3d989028c836..fd252f0cfb3a 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1197,17 +1197,26 @@ static void start_iaa_cycle(struct ehci_hcd *ehci, bool nested)
        if (ehci->async_iaa || ehci->async_unlinking)
                return;
-        /* Do all the waiting QHs at once */
-        ehci->async_iaa = ehci->async_unlink;
-        ehci->async_unlink = NULL;
        /* If the controller isn't running, we don't have to wait for it */
        if (unlikely(ehci->rh_state < EHCI_RH_RUNNING)) {
+                /* Do all the waiting QHs */
+                ehci->async_iaa = ehci->async_unlink;
+                ehci->async_unlink = NULL;
                if (!nested)            /* Avoid recursion */
                        end_unlink_async(ehci);
        /* Otherwise start a new IAA cycle */
        } else if (likely(ehci->rh_state == EHCI_RH_RUNNING)) {
+                struct ehci_qh          *qh;
+                /* Do only the first waiting QH (nVidia bug?) */
+                qh = ehci->async_unlink;
+                ehci->async_iaa = qh;
+                ehci->async_unlink = qh->unlink_next;
+                qh->unlink_next = NULL;
                /* Make sure the unlinks are all visible to the hardware */
                wmb();
@@ -1255,34 +1264,35 @@ static void end_unlink_async(struct ehci_hcd *ehci)
        }
 }
+static void start_unlink_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
 static void unlink_empty_async(struct ehci_hcd *ehci)
 {
-        struct ehci_qh          *qh, *next;
+        struct ehci_qh          *qh;
-        bool                    stopped = (ehci->rh_state < EHCI_RH_RUNNING);
+        struct ehci_qh          *qh_to_unlink = NULL;
        bool                    check_unlinks_later = false;
+        int                     count = 0;
-        /* Unlink all the async QHs that have been empty for a timer cycle */
+        /* Find the last async QH which has been empty for a timer cycle */
-        next = ehci->async->qh_next.qh;
+        for (qh = ehci->async->qh_next.qh; qh; qh = qh->qh_next.qh) {
-        while (next) {
-                qh = next;
-                next = qh->qh_next.qh;
                if (list_empty(&qh->qtd_list) &&
                                qh->qh_state == QH_STATE_LINKED) {
-                        if (!stopped && qh->unlink_cycle ==
+                        ++count;
-                                        ehci->async_unlink_cycle)
+                        if (qh->unlink_cycle == ehci->async_unlink_cycle)
                                check_unlinks_later = true;
                        else
-                                single_unlink_async(ehci, qh);
+                                qh_to_unlink = qh;
                }
        }
-        /* Start a new IAA cycle if any QHs are waiting for it */
+        /* If nothing else is being unlinked, unlink the last empty QH */
-        if (ehci->async_unlink)
+        if (!ehci->async_iaa && !ehci->async_unlink && qh_to_unlink) {
-                start_iaa_cycle(ehci, false);
+                start_unlink_async(ehci, qh_to_unlink);
+                --count;
+        }
-        /* QHs that haven't been empty for long enough will be handled later */
+        /* Other QHs will be handled later */
-        if (check_unlinks_later) {
+        if (count > 0) {
                ehci_enable_event(ehci, EHCI_HRTIMER_ASYNC_UNLINKS, true);
                ++ehci->async_unlink_cycle;
        }
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 69ebee73c0c1..b476daf49f6f 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -213,7 +213,7 @@ static inline unsigned char tt_start_uframe(struct ehci_hcd *ehci, __hc32 mask)
 }
 static const unsigned char
-max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 30, 0 };
+max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 125, 25 };
 /* carryover low/fullspeed bandwidth that crosses uframe boundries */
 static inline void carryover_tt_bandwidth(unsigned short tt_usecs[8])
@@ -2212,11 +2212,11 @@ static void scan_isoc(struct ehci_hcd *ehci)
        }
        ehci->now_frame = now_frame;
+        frame = ehci->last_iso_frame;
        for (;;) {
                union ehci_shadow       q, *q_p;
                __hc32                  type, *hw_p;
-                frame = ehci->last_iso_frame;
 restart:
                /* scan each element in frame's queue for completions */
                q_p = &ehci->pshadow [frame];
@@ -2321,6 +2321,9 @@ restart:
                /* Stop when we have reached the current frame */
                if (frame == now_frame)
                        break;
-                ehci->last_iso_frame = (frame + 1) & fmask;
+                /* The last frame may still have active siTDs */
+                ehci->last_iso_frame = frame;
+                frame = (frame + 1) & fmask;
        }
 }
diff --git a/drivers/usb/host/ehci-timer.c b/drivers/usb/host/ehci-timer.c
index 20dbdcbe9b0f..f904071d70df 100644
--- a/drivers/usb/host/ehci-timer.c
+++ b/drivers/usb/host/ehci-timer.c
@@ -113,14 +113,15 @@ static void ehci_poll_ASS(struct ehci_hcd *ehci)
        if (want != actual) {
-                /* Poll again later, but give up after about 20 ms */
+                /* Poll again later */
-                if (ehci->ASS_poll_count++ < 20) {
+                ehci_enable_event(ehci, EHCI_HRTIMER_POLL_ASS, true);
-                        ehci_enable_event(ehci, EHCI_HRTIMER_POLL_ASS, true);
+                ++ehci->ASS_poll_count;
-                        return;
+                return;
-                }
-                ehci_dbg(ehci, "Waited too long for the async schedule status (%x/%x), giving up\n",
-                                want, actual);
        }
+        if (ehci->ASS_poll_count > 20)
+                ehci_dbg(ehci, "ASS poll count reached %d\n",
+                                ehci->ASS_poll_count);
        ehci->ASS_poll_count = 0;
        /* The status is up-to-date; restart or stop the schedule as needed */
@@ -159,14 +160,14 @@ static void ehci_poll_PSS(struct ehci_hcd *ehci)
        if (want != actual) {
-                /* Poll again later, but give up after about 20 ms */
+                /* Poll again later */
-                if (ehci->PSS_poll_count++ < 20) {
+                ehci_enable_event(ehci, EHCI_HRTIMER_POLL_PSS, true);
-                        ehci_enable_event(ehci, EHCI_HRTIMER_POLL_PSS, true);
+                return;
-                        return;
-                }
-                ehci_dbg(ehci, "Waited too long for the periodic schedule status (%x/%x), giving up\n",
-                                want, actual);
        }
+        if (ehci->PSS_poll_count > 20)
+                ehci_dbg(ehci, "PSS poll count reached %d\n",
+                                ehci->PSS_poll_count);
        ehci->PSS_poll_count = 0;
        /* The status is up-to-date; restart or stop the schedule as needed */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index a3b6d7104ae2..4c338ec03a07 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -780,6 +780,7 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
                                "defaulting to EHCI.\n");
                dev_warn(&xhci_pdev->dev,
                                "USB 3.0 devices will work at USB 2.0 speeds.\n");
+                usb_disable_xhci_ports(xhci_pdev);
                return;
        }
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index 768d54295a20..15d13229ddbb 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -116,6 +116,7 @@ static void uhci_finish_suspend(struct uhci_hcd *uhci, int port,
                }
        }
        clear_bit(port, &uhci->resuming_ports);
+        usb_hcd_end_port_resume(&uhci_to_hcd(uhci)->self, port);
 }
 /* Wait for the UHCI controller in HP's iLO2 server management chip.
@@ -167,6 +168,8 @@ static void uhci_check_ports(struct uhci_hcd *uhci)
                                set_bit(port, &uhci->resuming_ports);
                                uhci->ports_timeout = jiffies +
                                                msecs_to_jiffies(25);
+                                usb_hcd_start_port_resume(
+                                                &uhci_to_hcd(uhci)->self, port);
                                /* Make sure we see the port again
                                 * after the resuming period is over. */
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 59fb5c677dbe..7f76a49e90d3 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1698,7 +1698,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
                                faked_port_index + 1);
                if (slot_id && xhci->devs[slot_id])
                        xhci_ring_device(xhci, slot_id);
-                if (bus_state->port_remote_wakeup && (1 << faked_port_index)) {
+                if (bus_state->port_remote_wakeup & (1 << faked_port_index)) {
                        bus_state->port_remote_wakeup &=
                                ~(1 << faked_port_index);
                        xhci_test_and_clear_bit(xhci, port_array,
@@ -2589,6 +2589,8 @@ cleanup:
                                (trb_comp_code != COMP_STALL &&
                                        trb_comp_code != COMP_BABBLE))
                                xhci_urb_free_priv(xhci, urb_priv);
+                        else
+                                kfree(urb_priv);
                        usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
                        if ((urb->actual_length != urb->transfer_buffer_length &&
@@ -3108,7 +3110,7 @@ static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len,
         * running_total.
         */
        packets_transferred = (running_total + trb_buff_len) /
-                usb_endpoint_maxp(&urb->ep->desc);
+                GET_MAX_PACKET(usb_endpoint_maxp(&urb->ep->desc));
        if ((total_packet_count - packets_transferred) > 31)
                return 31 << 17;
@@ -3642,7 +3644,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                td_len = urb->iso_frame_desc[i].length;
                td_remain_len = td_len;
                total_packet_count = DIV_ROUND_UP(td_len,
-                                usb_endpoint_maxp(&urb->ep->desc));
+                                GET_MAX_PACKET(
+                                        usb_endpoint_maxp(&urb->ep->desc)));
                /* A zero-length transfer still involves at least one packet. */
                if (total_packet_count == 0)
                        total_packet_count++;
@@ -3664,9 +3667,11 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                td = urb_priv->td[i];
                for (j = 0; j < trbs_per_td; j++) {
                        u32 remainder = 0;
-                        field = TRB_TBC(burst_count) | TRB_TLBPC(residue);
+                        field = 0;
                        if (first_trb) {
+                                field = TRB_TBC(burst_count) |
+                                        TRB_TLBPC(residue);
                                /* Queue the isoc TRB */
                                field |= TRB_TYPE(TRB_ISOC);
                                /* Assume URB_ISO_ASAP is set */
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f14736f647ff..edc0f0dcad83 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -60,6 +60,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
        { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
        { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
+        { USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */
        { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
        { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
        { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ba68835d06a6..90ceef1776c3 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -584,6 +584,7 @@ static struct usb_device_id id_table_combined [] = {
        /*
         * ELV devices:
         */
+        { USB_DEVICE(FTDI_ELV_VID, FTDI_ELV_WS300_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_ELV_USR_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_ELV_MSM1_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_ELV_KL100_PID) },
@@ -670,6 +671,7 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
        { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
        { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
        { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_MHAM_KW_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index fa5d56038276..9d359e189a64 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -147,6 +147,11 @@
 #define XSENS_CONVERTER_6_PID   0xD38E
 #define XSENS_CONVERTER_7_PID   0xD38F
+/**
+ * Zolix (www.zolix.com.cb) product ids
+ */
+#define FTDI_OMNI1509                   0xD491  /* Omni1509 embedded USB-serial */
 /*
 * NDI (www.ndigital.com) product ids
 */
@@ -204,7 +209,7 @@
 /*
 * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
- * All of these devices use FTDI's vendor ID (0x0403).
+ * Almost all of these devices use FTDI's vendor ID (0x0403).
 * Further IDs taken from ELV Windows .inf file.
 *
 * The previously included PID for the UO 100 module was incorrect.
@@ -212,6 +217,8 @@
 *
 * Armin Laeuger originally sent the PID for the UM 100 module.
 */
+#define FTDI_ELV_VID    0x1B1F  /* ELV AG */
+#define FTDI_ELV_WS300_PID      0xC006  /* eQ3 WS 300 PC II */
 #define FTDI_ELV_USR_PID        0xE000  /* ELV Universal-Sound-Recorder */
 #define FTDI_ELV_MSM1_PID       0xE001  /* ELV Mini-Sound-Modul */
 #define FTDI_ELV_KL100_PID      0xE002  /* ELV Kfz-Leistungsmesser KL 100 */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 0d9dac9e7f93..567bc77d6397 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -242,6 +242,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_CC864_DUAL                0x1005
 #define TELIT_PRODUCT_CC864_SINGLE              0x1006
 #define TELIT_PRODUCT_DE910_DUAL                0x1010
+#define TELIT_PRODUCT_LE920                     0x1200
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -453,6 +454,10 @@ static void option_instat_callback(struct urb *urb);
 #define TPLINK_VENDOR_ID                        0x2357
 #define TPLINK_PRODUCT_MA180                    0x0201
+/* Changhong products */
+#define CHANGHONG_VENDOR_ID                     0x2077
+#define CHANGHONG_PRODUCT_CH690                 0x7001
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                OPTION_BLACKLIST_NONE = 0,
@@ -534,6 +539,11 @@ static const struct option_blacklist_info zte_1255_blacklist = {
        .reserved = BIT(3) | BIT(4),
 };
+static const struct option_blacklist_info telit_le920_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(5),
+};
 static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -784,6 +794,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+                .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -1318,6 +1330,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
        { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index aa148c21ea40..24662547dc5b 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -53,6 +53,7 @@ static const struct usb_device_id id_table[] = {
        {DEVICE_G1K(0x05c6, 0x9221)},   /* Generic Gobi QDL device */
        {DEVICE_G1K(0x05c6, 0x9231)},   /* Generic Gobi QDL device */
        {DEVICE_G1K(0x1f45, 0x0001)},   /* Unknown Gobi QDL device */
+        {DEVICE_G1K(0x1bc7, 0x900e)},   /* Telit Gobi QDL device */
        /* Gobi 2000 devices */
        {USB_DEVICE(0x1410, 0xa010)},   /* Novatel Gobi 2000 QDL device */
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index 105d900150c1..16b0bf055eeb 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -92,8 +92,8 @@ int usb_stor_ucr61s2b_init(struct us_data *us)
        return 0;
 }
-/* This places the HUAWEI E220 devices in multi-port mode */
+/* This places the HUAWEI usb dongles in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us)
+static int usb_stor_huawei_feature_init(struct us_data *us)
 {
        int result;
@@ -104,3 +104,75 @@ int usb_stor_huawei_e220_init(struct us_data *us)
        US_DEBUGP("Huawei mode set result is %d\n", result);
        return 0;
 }
+/*
+ * It will send a scsi switch command called rewind' to huawei dongle.
+ * When the dongle receives this command at the first time,
+ * it will reboot immediately. After rebooted, it will ignore this command.
+ * So it is  unnecessary to read its response.
+ */
+static int usb_stor_huawei_scsi_init(struct us_data *us)
+{
+        int result = 0;
+        int act_len = 0;
+        struct bulk_cb_wrap *bcbw = (struct bulk_cb_wrap *) us->iobuf;
+        char rewind_cmd[] = {0x11, 0x06, 0x20, 0x00, 0x00, 0x01, 0x01, 0x00,
+                        0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+        bcbw->Signature = cpu_to_le32(US_BULK_CB_SIGN);
+        bcbw->Tag = 0;
+        bcbw->DataTransferLength = 0;
+        bcbw->Flags = bcbw->Lun = 0;
+        bcbw->Length = sizeof(rewind_cmd);
+        memset(bcbw->CDB, 0, sizeof(bcbw->CDB));
+        memcpy(bcbw->CDB, rewind_cmd, sizeof(rewind_cmd));
+        result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, bcbw,
+                                        US_BULK_CB_WRAP_LEN, &act_len);
+        US_DEBUGP("transfer actual length=%d, result=%d\n", act_len, result);
+        return result;
+}
+/*
+ * It tries to find the supported Huawei USB dongles.
+ * In Huawei, they assign the following product IDs
+ * for all of their mobile broadband dongles,
+ * including the new dongles in the future.
+ * So if the product ID is not included in this list,
+ * it means it is not Huawei's mobile broadband dongles.
+ */
+static int usb_stor_huawei_dongles_pid(struct us_data *us)
+{
+        struct usb_interface_descriptor *idesc;
+        int idProduct;
+        idesc = &us->pusb_intf->cur_altsetting->desc;
+        idProduct = us->pusb_dev->descriptor.idProduct;
+        /* The first port is CDROM,
+         * means the dongle in the single port mode,
+         * and a switch command is required to be sent. */
+        if (idesc && idesc->bInterfaceNumber == 0) {
+                if ((idProduct == 0x1001)
+                        || (idProduct == 0x1003)
+                        || (idProduct == 0x1004)
+                        || (idProduct >= 0x1401 && idProduct <= 0x1500)
+                        || (idProduct >= 0x1505 && idProduct <= 0x1600)
+                        || (idProduct >= 0x1c02 && idProduct <= 0x2202)) {
+                        return 1;
+                }
+        }
+        return 0;
+}
+int usb_stor_huawei_init(struct us_data *us)
+{
+        int result = 0;
+        if (usb_stor_huawei_dongles_pid(us)) {
+                if (us->pusb_dev->descriptor.idProduct >= 0x1446)
+                        result = usb_stor_huawei_scsi_init(us);
+                else
+                        result = usb_stor_huawei_feature_init(us);
+        }
+        return result;
+}
diff --git a/drivers/usb/storage/initializers.h b/drivers/usb/storage/initializers.h
index 529327fbb06b..5376d4fc76f0 100644
--- a/drivers/usb/storage/initializers.h
+++ b/drivers/usb/storage/initializers.h
@@ -46,5 +46,5 @@ int usb_stor_euscsi_init(struct us_data *us);
 * flash reader */
 int usb_stor_ucr61s2b_init(struct us_data *us);
-/* This places the HUAWEI E220 devices in multi-port mode */
+/* This places the HUAWEI usb dongles in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us);
+int usb_stor_huawei_init(struct us_data *us);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index d305a5aa3a5d..72923b56bbf6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1527,335 +1527,10 @@ UNUSUAL_DEV(  0x1210, 0x0003, 0x0100, 0x0100,
 /* Reported by fangxiaozhi <huananhu@huawei.com>
 * This brings the HUAWEI data card devices into multi-port mode
 */
-UNUSUAL_DEV(  0x12d1, 0x1001, 0x0000, 0x0000,
+UNUSUAL_VENDOR_INTF(0x12d1, 0x08, 0x06, 0x50,
                "HUAWEI MOBILE",
                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1003, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1004, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1401, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1402, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1403, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1404, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1405, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1406, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1407, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1408, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1409, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1410, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1411, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1412, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1413, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1414, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1415, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1416, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1417, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1418, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1419, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1420, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1421, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1422, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1423, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1424, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1425, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1426, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1427, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1428, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1429, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1430, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1431, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1432, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1433, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1434, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1435, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1436, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1437, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1438, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1439, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
                0),
 /* Reported by Vilius Bilinkevicius <vilisas AT xxx DOT lt) */
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 31b3e1a61bbd..cf09b6ba71ff 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -120,6 +120,17 @@ MODULE_PARM_DESC(quirks, "supplemental list of device IDs and their quirks");
        .useTransport = use_transport,  \
 }
+#define UNUSUAL_VENDOR_INTF(idVendor, cl, sc, pr, \
+                vendor_name, product_name, use_protocol, use_transport, \
+                init_function, Flags) \
+{ \
+        .vendorName = vendor_name,      \
+        .productName = product_name,    \
+        .useProtocol = use_protocol,    \
+        .useTransport = use_transport,  \
+        .initFunction = init_function,  \
+}
 static struct us_unusual_dev us_unusual_dev_list[] = {
 #       include "unusual_devs.h"
        { }             /* Terminating entry */
@@ -131,6 +142,7 @@ static struct us_unusual_dev for_dynamic_ids =
 #undef UNUSUAL_DEV
 #undef COMPLIANT_DEV
 #undef USUAL_DEV
+#undef UNUSUAL_VENDOR_INTF
 #ifdef CONFIG_LOCKDEP
diff --git a/drivers/usb/storage/usual-tables.c b/drivers/usb/storage/usual-tables.c
index b78a526910fb..5ef8ce74aae4 100644
--- a/drivers/usb/storage/usual-tables.c
+++ b/drivers/usb/storage/usual-tables.c
@@ -41,6 +41,20 @@
 #define USUAL_DEV(useProto, useTrans) \
 { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, useProto, useTrans) }
+/* Define the device is matched with Vendor ID and interface descriptors */
+#define UNUSUAL_VENDOR_INTF(id_vendor, cl, sc, pr, \
+                        vendorName, productName, useProtocol, useTransport, \
+                        initFunction, flags) \
+{ \
+        .match_flags = USB_DEVICE_ID_MATCH_INT_INFO \
+                                | USB_DEVICE_ID_MATCH_VENDOR, \
+        .idVendor    = (id_vendor), \
+        .bInterfaceClass = (cl), \
+        .bInterfaceSubClass = (sc), \
+        .bInterfaceProtocol = (pr), \
+        .driver_info = (flags) \
+}
 struct usb_device_id usb_storage_usb_ids[] = {
 #       include "unusual_devs.h"
        { }             /* Terminating entry */
@@ -50,6 +64,7 @@ MODULE_DEVICE_TABLE(usb, usb_storage_usb_ids);
 #undef UNUSUAL_DEV
 #undef COMPLIANT_DEV
 #undef USUAL_DEV
+#undef UNUSUAL_VENDOR_INTF
 /*
 * The table of devices to ignore
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ebd08b21b234..959b1cd89e6a 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -165,12 +165,16 @@ static void tx_poll_stop(struct vhost_net *net)
 }
 /* Caller must have TX VQ lock */
-static void tx_poll_start(struct vhost_net *net, struct socket *sock)
+static int tx_poll_start(struct vhost_net *net, struct socket *sock)
 {
+        int ret;
        if (unlikely(net->tx_poll_state != VHOST_NET_POLL_STOPPED))
-                return;
+                return 0;
-        vhost_poll_start(net->poll + VHOST_NET_VQ_TX, sock->file);
+        ret = vhost_poll_start(net->poll + VHOST_NET_VQ_TX, sock->file);
-        net->tx_poll_state = VHOST_NET_POLL_STARTED;
+        if (!ret)
+                net->tx_poll_state = VHOST_NET_POLL_STARTED;
+        return ret;
 }
 /* In case of DMA done not in order in lower device driver for some reason.
@@ -642,20 +646,23 @@ static void vhost_net_disable_vq(struct vhost_net *n,
                vhost_poll_stop(n->poll + VHOST_NET_VQ_RX);
 }
-static void vhost_net_enable_vq(struct vhost_net *n,
+static int vhost_net_enable_vq(struct vhost_net *n,
                                struct vhost_virtqueue *vq)
 {
        struct socket *sock;
+        int ret;
        sock = rcu_dereference_protected(vq->private_data,
                                         lockdep_is_held(&vq->mutex));
        if (!sock)
-                return;
+                return 0;
        if (vq == n->vqs + VHOST_NET_VQ_TX) {
                n->tx_poll_state = VHOST_NET_POLL_STOPPED;
-                tx_poll_start(n, sock);
+                ret = tx_poll_start(n, sock);
        } else
-                vhost_poll_start(n->poll + VHOST_NET_VQ_RX, sock->file);
+                ret = vhost_poll_start(n->poll + VHOST_NET_VQ_RX, sock->file);
+        return ret;
 }
 static struct socket *vhost_net_stop_vq(struct vhost_net *n,
@@ -827,15 +834,18 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
                        r = PTR_ERR(ubufs);
                        goto err_ubufs;
                }
-                oldubufs = vq->ubufs;
-                vq->ubufs = ubufs;
                vhost_net_disable_vq(n, vq);
                rcu_assign_pointer(vq->private_data, sock);
-                vhost_net_enable_vq(n, vq);
                r = vhost_init_used(vq);
                if (r)
-                        goto err_vq;
+                        goto err_used;
+                r = vhost_net_enable_vq(n, vq);
+                if (r)
+                        goto err_used;
+                oldubufs = vq->ubufs;
+                vq->ubufs = ubufs;
                n->tx_packets = 0;
                n->tx_zcopy_err = 0;
@@ -859,6 +869,11 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
        mutex_unlock(&n->dev.mutex);
        return 0;
+err_used:
+        rcu_assign_pointer(vq->private_data, oldsock);
+        vhost_net_enable_vq(n, vq);
+        if (ubufs)
+                vhost_ubuf_put_and_wait(ubufs);
 err_ubufs:
        fput(sock->file);
 err_vq:
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 34389f75fe65..9759249e6d90 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -77,26 +77,38 @@ void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
        init_poll_funcptr(&poll->table, vhost_poll_func);
        poll->mask = mask;
        poll->dev = dev;
+        poll->wqh = NULL;
        vhost_work_init(&poll->work, fn);
 }
 /* Start polling a file. We add ourselves to file's wait queue. The caller must
 * keep a reference to a file until after vhost_poll_stop is called. */
-void vhost_poll_start(struct vhost_poll *poll, struct file *file)
+int vhost_poll_start(struct vhost_poll *poll, struct file *file)
 {
        unsigned long mask;
+        int ret = 0;
        mask = file->f_op->poll(file, &poll->table);
        if (mask)
                vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask);
+        if (mask & POLLERR) {
+                if (poll->wqh)
+                        remove_wait_queue(poll->wqh, &poll->wait);
+                ret = -EINVAL;
+        }
+        return ret;
 }
 /* Stop polling a file. After this function returns, it becomes safe to drop the
 * file reference. You must also flush afterwards. */
 void vhost_poll_stop(struct vhost_poll *poll)
 {
-        remove_wait_queue(poll->wqh, &poll->wait);
+        if (poll->wqh) {
+                remove_wait_queue(poll->wqh, &poll->wait);
+                poll->wqh = NULL;
+        }
 }
 static bool vhost_work_seq_done(struct vhost_dev *dev, struct vhost_work *work,
@@ -792,7 +804,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
                fput(filep);
        if (pollstart && vq->handle_kick)
-                vhost_poll_start(&vq->poll, vq->kick);
+                r = vhost_poll_start(&vq->poll, vq->kick);
        mutex_unlock(&vq->mutex);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 2639c58b23ab..17261e277c02 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -42,7 +42,7 @@ void vhost_work_queue(struct vhost_dev *dev, struct vhost_work *work);
 void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
                     unsigned long mask, struct vhost_dev *dev);
-void vhost_poll_start(struct vhost_poll *poll, struct file *file);
+int vhost_poll_start(struct vhost_poll *poll, struct file *file);
 void vhost_poll_stop(struct vhost_poll *poll);
 void vhost_poll_flush(struct vhost_poll *poll);
 void vhost_poll_queue(struct vhost_poll *poll);
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 0be4df39e953..74d77dfa5f63 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -840,7 +840,7 @@ int bind_evtchn_to_irq(unsigned int evtchn)
        if (irq == -1) {
                irq = xen_allocate_irq_dynamic();
-                if (irq == -1)
+                if (irq < 0)
                        goto out;
                irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
@@ -944,7 +944,7 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
        if (irq == -1) {
                irq = xen_allocate_irq_dynamic();
-                if (irq == -1)
+                if (irq < 0)
                        goto out;
                irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 97f5d264c31e..37c1f825f513 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -135,7 +135,6 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
                         struct pci_dev *dev, struct xen_pci_op *op)
 {
        struct xen_pcibk_dev_data *dev_data;
-        int otherend = pdev->xdev->otherend_id;
        int status;
        if (unlikely(verbose_request))
@@ -144,8 +143,9 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
        status = pci_enable_msi(dev);
        if (status) {
-                printk(KERN_ERR "error enable msi for guest %x status %x\n",
+                pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI for guest %u: err %d\n",
-                        otherend, status);
+                                    pci_name(dev), pdev->xdev->otherend_id,
+                                    status);
                op->value = 0;
                return XEN_PCI_ERR_op_failed;
        }
@@ -223,10 +223,10 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
                                                pci_name(dev), i,
                                                op->msix_entries[i].vector);
                }
-        } else {
+        } else
-                printk(KERN_WARNING DRV_NAME ": %s: failed to enable MSI-X: err %d!\n",
+                pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI-X for guest %u: err %d!\n",
-                        pci_name(dev), result);
+                                    pci_name(dev), pdev->xdev->otherend_id,
-        }
+                                    result);
        kfree(entries);
        op->value = result;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index a8b8adc05070..5a3327b8f90d 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4534,7 +4534,7 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
        unsigned nr_extents = 0;
        int extra_reserve = 0;
        enum btrfs_reserve_flush_enum flush = BTRFS_RESERVE_FLUSH_ALL;
-        int ret;
+        int ret = 0;
        bool delalloc_lock = true;
        /* If we are a free space inode we need to not flush since we will be in
@@ -4579,20 +4579,18 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
        csum_bytes = BTRFS_I(inode)->csum_bytes;
        spin_unlock(&BTRFS_I(inode)->lock);
-        if (root->fs_info->quota_enabled) {
+        if (root->fs_info->quota_enabled)
                ret = btrfs_qgroup_reserve(root, num_bytes +
                                           nr_extents * root->leafsize);
-                if (ret) {
-                        spin_lock(&BTRFS_I(inode)->lock);
-                        calc_csum_metadata_size(inode, num_bytes, 0);
-                        spin_unlock(&BTRFS_I(inode)->lock);
-                        if (delalloc_lock)
-                                mutex_unlock(&BTRFS_I(inode)->delalloc_mutex);
-                        return ret;
-                }
-        }
-        ret = reserve_metadata_bytes(root, block_rsv, to_reserve, flush);
+        /*
+         * ret != 0 here means the qgroup reservation failed, we go straight to
+         * the shared error handling then.
+         */
+        if (ret == 0)
+                ret = reserve_metadata_bytes(root, block_rsv,
+                                             to_reserve, flush);
        if (ret) {
                u64 to_free = 0;
                unsigned dropped;
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 2e8cae63d247..fdb7a8db3b57 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -288,7 +288,8 @@ out:
 void clear_em_logging(struct extent_map_tree *tree, struct extent_map *em)
 {
        clear_bit(EXTENT_FLAG_LOGGING, &em->flags);
-        try_merge_map(tree, em);
+        if (em->in_tree)
+                try_merge_map(tree, em);
 }
 /**
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index f76b1fd160d4..aeb84469d2c4 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -293,15 +293,24 @@ static int __btrfs_run_defrag_inode(struct btrfs_fs_info *fs_info,
        struct btrfs_key key;
        struct btrfs_ioctl_defrag_range_args range;
        int num_defrag;
+        int index;
+        int ret;
        /* get the inode */
        key.objectid = defrag->root;
        btrfs_set_key_type(&key, BTRFS_ROOT_ITEM_KEY);
        key.offset = (u64)-1;
+        index = srcu_read_lock(&fs_info->subvol_srcu);
        inode_root = btrfs_read_fs_root_no_name(fs_info, &key);
        if (IS_ERR(inode_root)) {
-                kmem_cache_free(btrfs_inode_defrag_cachep, defrag);
+                ret = PTR_ERR(inode_root);
-                return PTR_ERR(inode_root);
+                goto cleanup;
+        }
+        if (btrfs_root_refs(&inode_root->root_item) == 0) {
+                ret = -ENOENT;
+                goto cleanup;
        }
        key.objectid = defrag->ino;
@@ -309,9 +318,10 @@ static int __btrfs_run_defrag_inode(struct btrfs_fs_info *fs_info,
        key.offset = 0;
        inode = btrfs_iget(fs_info->sb, &key, inode_root, NULL);
        if (IS_ERR(inode)) {
-                kmem_cache_free(btrfs_inode_defrag_cachep, defrag);
+                ret = PTR_ERR(inode);
-                return PTR_ERR(inode);
+                goto cleanup;
        }
+        srcu_read_unlock(&fs_info->subvol_srcu, index);
        /* do a chunk of defrag */
        clear_bit(BTRFS_INODE_IN_DEFRAG, &BTRFS_I(inode)->runtime_flags);
@@ -346,6 +356,10 @@ static int __btrfs_run_defrag_inode(struct btrfs_fs_info *fs_info,
        iput(inode);
        return 0;
+cleanup:
+        srcu_read_unlock(&fs_info->subvol_srcu, index);
+        kmem_cache_free(btrfs_inode_defrag_cachep, defrag);
+        return ret;
 }
 /*
@@ -1594,9 +1608,10 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
                if (err < 0 && num_written > 0)
                        num_written = err;
        }
-out:
        if (sync)
                atomic_dec(&BTRFS_I(inode)->sync_writers);
+out:
        sb_end_write(inode->i_sb);
        current->backing_dev_info = NULL;
        return num_written ? num_written : err;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 5b22d45d3c6a..338f2597bf7f 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -515,7 +515,6 @@ static noinline int create_subvol(struct btrfs_root *root,
        BUG_ON(ret);
-        d_instantiate(dentry, btrfs_lookup_dentry(dir, dentry));
 fail:
        if (async_transid) {
                *async_transid = trans->transid;
@@ -525,6 +524,10 @@ fail:
        }
        if (err && !ret)
                ret = err;
+        if (!ret)
+                d_instantiate(dentry, btrfs_lookup_dentry(dir, dentry));
        return ret;
 }
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index f10731297040..e5ed56729607 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -836,9 +836,16 @@ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
         * if the disk i_size is already at the inode->i_size, or
         * this ordered extent is inside the disk i_size, we're done
         */
-        if (disk_i_size == i_size || offset <= disk_i_size) {
+        if (disk_i_size == i_size)
+                goto out;
+        /*
+         * We still need to update disk_i_size if outstanding_isize is greater
+         * than disk_i_size.
+         */
+        if (offset <= disk_i_size &&
+            (!ordered || ordered->outstanding_isize <= disk_i_size))
                goto out;
-        }
        /*
         * walk backward from this ordered extent to disk_i_size.
@@ -870,7 +877,7 @@ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
                        break;
                if (test->file_offset >= i_size)
                        break;
-                if (test->file_offset >= disk_i_size) {
+                if (entry_end(test) > disk_i_size) {
                        /*
                         * we don't update disk_i_size now, so record this
                         * undealt i_size. Or we will not know the real
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index bdbb94f245c9..67783e03d121 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -580,20 +580,29 @@ static int scrub_fixup_readpage(u64 inum, u64 offset, u64 root, void *fixup_ctx)
        int corrected = 0;
        struct btrfs_key key;
        struct inode *inode = NULL;
+        struct btrfs_fs_info *fs_info;
        u64 end = offset + PAGE_SIZE - 1;
        struct btrfs_root *local_root;
+        int srcu_index;
        key.objectid = root;
        key.type = BTRFS_ROOT_ITEM_KEY;
        key.offset = (u64)-1;
-        local_root = btrfs_read_fs_root_no_name(fixup->root->fs_info, &key);
-        if (IS_ERR(local_root))
+        fs_info = fixup->root->fs_info;
+        srcu_index = srcu_read_lock(&fs_info->subvol_srcu);
+        local_root = btrfs_read_fs_root_no_name(fs_info, &key);
+        if (IS_ERR(local_root)) {
+                srcu_read_unlock(&fs_info->subvol_srcu, srcu_index);
                return PTR_ERR(local_root);
+        }
        key.type = BTRFS_INODE_ITEM_KEY;
        key.objectid = inum;
        key.offset = 0;
-        inode = btrfs_iget(fixup->root->fs_info->sb, &key, local_root, NULL);
+        inode = btrfs_iget(fs_info->sb, &key, local_root, NULL);
+        srcu_read_unlock(&fs_info->subvol_srcu, srcu_index);
        if (IS_ERR(inode))
                return PTR_ERR(inode);
@@ -606,7 +615,6 @@ static int scrub_fixup_readpage(u64 inum, u64 offset, u64 root, void *fixup_ctx)
        }
        if (PageUptodate(page)) {
-                struct btrfs_fs_info *fs_info;
                if (PageDirty(page)) {
                        /*
                         * we need to write the data to the defect sector. the
@@ -3180,18 +3188,25 @@ static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root, void *ctx)
        u64 physical_for_dev_replace;
        u64 len;
        struct btrfs_fs_info *fs_info = nocow_ctx->sctx->dev_root->fs_info;
+        int srcu_index;
        key.objectid = root;
        key.type = BTRFS_ROOT_ITEM_KEY;
        key.offset = (u64)-1;
+        srcu_index = srcu_read_lock(&fs_info->subvol_srcu);
        local_root = btrfs_read_fs_root_no_name(fs_info, &key);
-        if (IS_ERR(local_root))
+        if (IS_ERR(local_root)) {
+                srcu_read_unlock(&fs_info->subvol_srcu, srcu_index);
                return PTR_ERR(local_root);
+        }
        key.type = BTRFS_INODE_ITEM_KEY;
        key.objectid = inum;
        key.offset = 0;
        inode = btrfs_iget(fs_info->sb, &key, local_root, NULL);
+        srcu_read_unlock(&fs_info->subvol_srcu, srcu_index);
        if (IS_ERR(inode))
                return PTR_ERR(inode);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index f15494699f3b..fc03aa60b684 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -333,12 +333,14 @@ start_transaction(struct btrfs_root *root, u64 num_items, int type,
                                          &root->fs_info->trans_block_rsv,
                                          num_bytes, flush);
                if (ret)
-                        return ERR_PTR(ret);
+                        goto reserve_fail;
        }
 again:
        h = kmem_cache_alloc(btrfs_trans_handle_cachep, GFP_NOFS);
-        if (!h)
+        if (!h) {
-                return ERR_PTR(-ENOMEM);
+                ret = -ENOMEM;
+                goto alloc_fail;
+        }
        /*
         * If we are JOIN_NOLOCK we're already committing a transaction and
@@ -365,11 +367,7 @@ again:
        if (ret < 0) {
                /* We must get the transaction if we are JOIN_NOLOCK. */
                BUG_ON(type == TRANS_JOIN_NOLOCK);
+                goto join_fail;
-                if (type < TRANS_JOIN_NOLOCK)
-                        sb_end_intwrite(root->fs_info->sb);
-                kmem_cache_free(btrfs_trans_handle_cachep, h);
-                return ERR_PTR(ret);
        }
        cur_trans = root->fs_info->running_transaction;
@@ -410,6 +408,19 @@ got_it:
        if (!current->journal_info && type != TRANS_USERSPACE)
                current->journal_info = h;
        return h;
+join_fail:
+        if (type < TRANS_JOIN_NOLOCK)
+                sb_end_intwrite(root->fs_info->sb);
+        kmem_cache_free(btrfs_trans_handle_cachep, h);
+alloc_fail:
+        if (num_bytes)
+                btrfs_block_rsv_release(root, &root->fs_info->trans_block_rsv,
+                                        num_bytes);
+reserve_fail:
+        if (qgroup_reserved)
+                btrfs_qgroup_free(root, qgroup_reserved);
+        return ERR_PTR(ret);
 }
 struct btrfs_trans_handle *btrfs_start_transaction(struct btrfs_root *root,
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 15f6efdf6463..5cbb7f4b1672 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1556,7 +1556,8 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
        ret = 0;
        /* Notify udev that device has changed */
-        btrfs_kobject_uevent(bdev, KOBJ_CHANGE);
+        if (bdev)
+                btrfs_kobject_uevent(bdev, KOBJ_CHANGE);
 error_brelse:
        brelse(bh);
diff --git a/include/linux/llist.h b/include/linux/llist.h
index a5199f6d0e82..d0ab98f73d38 100644
--- a/include/linux/llist.h
+++ b/include/linux/llist.h
@@ -125,6 +125,31 @@ static inline void init_llist_head(struct llist_head *list)
             (pos) = llist_entry((pos)->member.next, typeof(*(pos)), member))
 /**
+ * llist_for_each_entry_safe - iterate safely against remove over some entries
+ * of lock-less list of given type.
+ * @pos:        the type * to use as a loop cursor.
+ * @n:          another type * to use as a temporary storage.
+ * @node:       the fist entry of deleted list entries.
+ * @member:     the name of the llist_node with the struct.
+ *
+ * In general, some entries of the lock-less list can be traversed
+ * safely only after being removed from list, so start with an entry
+ * instead of list head. This variant allows removal of entries
+ * as we iterate.
+ *
+ * If being used on entries deleted from lock-less list directly, the
+ * traverse order is from the newest to the oldest added entry.  If
+ * you want to traverse from the oldest to the newest, you must
+ * reverse the order by yourself before traversing.
+ */
+#define llist_for_each_entry_safe(pos, n, node, member)         \
+        for ((pos) = llist_entry((node), typeof(*(pos)), member),       \
+             (n) = (pos)->member.next;                                  \
+             &(pos)->member != NULL;                                    \
+             (pos) = llist_entry(n, typeof(*(pos)), member),            \
+             (n) = (&(pos)->member != NULL) ? (pos)->member.next : NULL)
+/**
 * llist_empty - tests whether a lock-less list is empty
 * @head:       the list to test
 *
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 689b14b26c8d..4d22d0f6167a 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -357,6 +357,8 @@ struct usb_bus {
        int bandwidth_int_reqs;         /* number of Interrupt requests */
        int bandwidth_isoc_reqs;        /* number of Isoc. requests */
+        unsigned resuming_ports;        /* bit array: resuming root-hub ports */
 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
        struct mon_bus *mon_bus;        /* non-null when associated */
        int monitored;                  /* non-zero when monitored */
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 608050b2545f..0a78df5f6cfd 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -430,6 +430,9 @@ extern void usb_hcd_poll_rh_status(struct usb_hcd *hcd);
 extern void usb_wakeup_notification(struct usb_device *hdev,
                unsigned int portnum);
+extern void usb_hcd_start_port_resume(struct usb_bus *bus, int portnum);
+extern void usb_hcd_end_port_resume(struct usb_bus *bus, int portnum);
 /* The D0/D1 toggle bits ... USE WITH CAUTION (they're almost hcd-internal) */
 #define usb_gettoggle(dev, ep, out) (((dev)->toggle[out] >> (ep)) & 1)
 #define usb_dotoggle(dev, ep, out)  ((dev)->toggle[out] ^= (1 << (ep)))
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 5de7a220e986..0e5ac93bab10 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -33,6 +33,7 @@ struct usbnet {
        wait_queue_head_t       *wait;
        struct mutex            phy_mutex;
        unsigned char           suspend_count;
+        unsigned char           pkt_cnt, pkt_err;
        /* i/o info: pipes etc */
        unsigned                in, out;
@@ -70,6 +71,7 @@ struct usbnet {
 #               define EVENT_DEV_OPEN   7
 #               define EVENT_DEVICE_REPORT_IDLE 8
 #               define EVENT_NO_RUNTIME_PM      9
+#               define EVENT_RX_KILL    10
 };
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
@@ -100,7 +102,6 @@ struct driver_info {
 #define FLAG_LINK_INTR  0x0800          /* updates link (carrier) status */
 #define FLAG_POINTTOPOINT 0x1000        /* possibly use "usb%d" names */
-#define FLAG_NOARP      0x2000          /* device can't do ARP */
 /*
 * Indicates to usbnet, that USB driver accumulates multiple IP packets.
@@ -108,6 +109,7 @@ struct driver_info {
 */
 #define FLAG_MULTI_PACKET       0x2000
 #define FLAG_RX_ASSEMBLE        0x4000  /* rx packets may span >1 frames */
+#define FLAG_NOARP              0x8000  /* device can't do ARP */
        /* init device ... can sleep, or cause probe() failure */
        int     (*bind)(struct usbnet *, struct usb_interface *);
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 498433dd067d..938b7fd11204 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -34,17 +34,17 @@ extern int				udpv6_connect(struct sock *sk,
                                                      struct sockaddr *uaddr,
                                                      int addr_len);
-extern int                      datagram_recv_ctl(struct sock *sk,
+extern int                      ip6_datagram_recv_ctl(struct sock *sk,
-                                                  struct msghdr *msg,
+                                                      struct msghdr *msg,
-                                                  struct sk_buff *skb);
+                                                      struct sk_buff *skb);
-extern int                      datagram_send_ctl(struct net *net,
+extern int                      ip6_datagram_send_ctl(struct net *net,
-                                                  struct sock *sk,
+                                                      struct sock *sk,
-                                                  struct msghdr *msg,
+                                                      struct msghdr *msg,
-                                                  struct flowi6 *fl6,
+                                                      struct flowi6 *fl6,
-                                                  struct ipv6_txoptions *opt,
+                                                      struct ipv6_txoptions *opt,
-                                                  int *hlimit, int *tclass,
+                                                      int *hlimit, int *tclass,
-                                                  int *dontfrag);
+                                                      int *dontfrag);
 #define         LOOPBACK4_IPV6          cpu_to_be32(0x7f000006)
diff --git a/include/uapi/linux/auto_fs.h b/include/uapi/linux/auto_fs.h
index 77cdba9df274..bb991dfe134f 100644
--- a/include/uapi/linux/auto_fs.h
+++ b/include/uapi/linux/auto_fs.h
@@ -28,25 +28,16 @@
 #define AUTOFS_MIN_PROTO_VERSION        AUTOFS_PROTO_VERSION
 /*
- * Architectures where both 32- and 64-bit binaries can be executed
+ * The wait_queue_token (autofs_wqt_t) is part of a structure which is passed
- * on 64-bit kernels need this.  This keeps the structure format
+ * back to the kernel via ioctl from userspace. On architectures where 32- and
- * uniform, and makes sure the wait_queue_token isn't too big to be
+ * 64-bit userspace binaries can be executed it's important that the size of
- * passed back down to the kernel.
+ * autofs_wqt_t stays constant between 32- and 64-bit Linux kernels so that we
- *
+ * do not break the binary ABI interface by changing the structure size.
- * This assumes that on these architectures:
- * mode     32 bit    64 bit
- * -------------------------
- * int      32 bit    32 bit
- * long     32 bit    64 bit
- *
- * If so, 32-bit user-space code should be backwards compatible.
 */
+#if defined(__ia64__) || defined(__alpha__) /* pure 64bit architectures */
-#if defined(__sparc__) || defined(__mips__) || defined(__x86_64__) \
- || defined(__powerpc__) || defined(__s390__)
-typedef unsigned int autofs_wqt_t;
-#else
 typedef unsigned long autofs_wqt_t;
+#else
+typedef unsigned int autofs_wqt_t;
 #endif
 /* Packet types */
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index 50598472dc41..f738e25377ff 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -152,6 +152,12 @@
 #define USB_INTRF_FUNC_SUSPEND_LP       (1 << (8 + 0))
 #define USB_INTRF_FUNC_SUSPEND_RW       (1 << (8 + 1))
+/*
+ * Interface status, Figure 9-5 USB 3.0 spec
+ */
+#define USB_INTRF_STAT_FUNC_RW_CAP     1
+#define USB_INTRF_STAT_FUNC_RW         2
 #define USB_ENDPOINT_HALT               0       /* IN/OUT will STALL */
 /* Bit array elements as returned by the USB_REQ_GET_STATUS request. */
diff --git a/kernel/pid.c b/kernel/pid.c
index de9af600006f..f2c6a6825098 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -331,7 +331,7 @@ out:
        return pid;
 out_unlock:
-        spin_unlock(&pidmap_lock);
+        spin_unlock_irq(&pidmap_lock);
 out_free:
        while (++i <= ns->level)
                free_pidmap(pid->numbers + i);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 09255ec8159c..fbb60b103e64 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3030,7 +3030,9 @@ int memcg_register_cache(struct mem_cgroup *memcg, struct kmem_cache *s,
        if (memcg) {
                s->memcg_params->memcg = memcg;
                s->memcg_params->root_cache = root_cache;
-        }
+        } else
+                s->memcg_params->is_root_cache = true;
        return 0;
 }
diff --git a/mm/mlock.c b/mm/mlock.c
index f0b9ce572fc7..c9bd528b01d2 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -517,11 +517,11 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
 static int do_mlockall(int flags)
 {
        struct vm_area_struct * vma, * prev = NULL;
-        unsigned int def_flags = 0;
        if (flags & MCL_FUTURE)
-                def_flags = VM_LOCKED;
+                current->mm->def_flags |= VM_LOCKED;
-        current->mm->def_flags = def_flags;
+        else
+                current->mm->def_flags &= ~VM_LOCKED;
        if (flags == MCL_FUTURE)
                goto out;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index df2022ff0c8a..9673d96b1ba7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -773,6 +773,10 @@ void __init init_cma_reserved_pageblock(struct page *page)
        set_pageblock_migratetype(page, MIGRATE_CMA);
        __free_pages(page, pageblock_order);
        totalram_pages += pageblock_nr_pages;
+#ifdef CONFIG_HIGHMEM
+        if (PageHighMem(page))
+                totalhigh_pages += pageblock_nr_pages;
+#endif
 }
 #endif
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 25bfce0666eb..4925a02ae7e4 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -249,12 +249,12 @@ static void hci_conn_disconnect(struct hci_conn *conn)
        __u8 reason = hci_proto_disconn_ind(conn);
        switch (conn->type) {
-        case ACL_LINK:
-                hci_acl_disconn(conn, reason);
-                break;
        case AMP_LINK:
                hci_amp_disconn(conn, reason);
                break;
+        default:
+                hci_acl_disconn(conn, reason);
+                break;
        }
 }
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 68a9587c9694..5abefb12891d 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -859,6 +859,19 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
        skb_pull(skb, sizeof(code));
+        /*
+         * The SMP context must be initialized for all other PDUs except
+         * pairing and security requests. If we get any other PDU when
+         * not initialized simply disconnect (done if this function
+         * returns an error).
+         */
+        if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
+            !conn->smp_chan) {
+                BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
+                kfree_skb(skb);
+                return -ENOTSUPP;
+        }
        switch (code) {
        case SMP_CMD_PAIRING_REQ:
                reason = smp_cmd_pairing_req(conn, skb);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b29dacf900f9..e6e1cbe863f5 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1781,10 +1781,13 @@ static ssize_t pktgen_thread_write(struct file *file,
                        return -EFAULT;
                i += len;
                mutex_lock(&pktgen_thread_lock);
-                pktgen_add_device(t, f);
+                ret = pktgen_add_device(t, f);
                mutex_unlock(&pktgen_thread_lock);
-                ret = count;
+                if (!ret) {
-                sprintf(pg_result, "OK: add_device=%s", f);
+                        ret = count;
+                        sprintf(pg_result, "OK: add_device=%s", f);
+                } else
+                        sprintf(pg_result, "ERROR: can not add device %s", f);
                goto out;
        }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a9a2ae3e2213..32443ebc3e89 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -683,7 +683,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
        new->network_header     = old->network_header;
        new->mac_header         = old->mac_header;
        new->inner_transport_header = old->inner_transport_header;
-        new->inner_network_header = old->inner_transport_header;
+        new->inner_network_header = old->inner_network_header;
        skb_dst_copy(new, old);
        new->rxhash             = old->rxhash;
        new->ooo_okay           = old->ooo_okay;
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 291f2ed7cc31..cdf2e707bb10 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -310,6 +310,12 @@ void tcp_slow_start(struct tcp_sock *tp)
 {
        int cnt; /* increase in packets */
        unsigned int delta = 0;
+        u32 snd_cwnd = tp->snd_cwnd;
+        if (unlikely(!snd_cwnd)) {
+                pr_err_once("snd_cwnd is nul, please report this bug.\n");
+                snd_cwnd = 1U;
+        }
        /* RFC3465: ABC Slow start
         * Increase only after a full MSS of bytes is acked
@@ -324,7 +330,7 @@ void tcp_slow_start(struct tcp_sock *tp)
        if (sysctl_tcp_max_ssthresh > 0 && tp->snd_cwnd > sysctl_tcp_max_ssthresh)
                cnt = sysctl_tcp_max_ssthresh >> 1;     /* limited slow start */
        else
-                cnt = tp->snd_cwnd;                     /* exponential increase */
+                cnt = snd_cwnd;                         /* exponential increase */
        /* RFC3465: ABC
         * We MAY increase by 2 if discovered delayed ack
@@ -334,11 +340,11 @@ void tcp_slow_start(struct tcp_sock *tp)
        tp->bytes_acked = 0;
        tp->snd_cwnd_cnt += cnt;
-        while (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
+        while (tp->snd_cwnd_cnt >= snd_cwnd) {
-                tp->snd_cwnd_cnt -= tp->snd_cwnd;
+                tp->snd_cwnd_cnt -= snd_cwnd;
                delta++;
        }
-        tp->snd_cwnd = min(tp->snd_cwnd + delta, tp->snd_cwnd_clamp);
+        tp->snd_cwnd = min(snd_cwnd + delta, tp->snd_cwnd_clamp);
 }
 EXPORT_SYMBOL_GPL(tcp_slow_start);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 18f97ca76b00..ad70a962c20e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3504,6 +3504,11 @@ static bool tcp_process_frto(struct sock *sk, int flag)
                }
        } else {
                if (!(flag & FLAG_DATA_ACKED) && (tp->frto_counter == 1)) {
+                        if (!tcp_packets_in_flight(tp)) {
+                                tcp_enter_frto_loss(sk, 2, flag);
+                                return true;
+                        }
                        /* Prevent sending of new data. */
                        tp->snd_cwnd = min(tp->snd_cwnd,
                                           tcp_packets_in_flight(tp));
@@ -5649,8 +5654,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
         * the remote receives only the retransmitted (regular) SYNs: either
         * the original SYN-data or the corresponding SYN-ACK is lost.
         */
-        syn_drop = (cookie->len <= 0 && data &&
+        syn_drop = (cookie->len <= 0 && data && tp->total_retrans);
-                    inet_csk(sk)->icsk_retransmits);
        tcp_fastopen_cache_set(sk, mss, cookie, syn_drop);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 70b09ef2463b..eadb693eef55 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -496,6 +496,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                 * errors returned from accept().
                 */
                inet_csk_reqsk_queue_drop(sk, req, prev);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
                goto out;
        case TCP_SYN_SENT:
@@ -1500,8 +1501,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         * clogging syn queue with openreqs with exponentially increasing
         * timeout.
         */
-        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
                goto drop;
+        }
        req = inet_reqsk_alloc(&tcp_request_sock_ops);
        if (!req)
@@ -1666,6 +1669,7 @@ drop_and_release:
 drop_and_free:
        reqsk_free(req);
 drop:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
        return 0;
 }
 EXPORT_SYMBOL(tcp_v4_conn_request);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 420e56326384..1b5d8cb9b123 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1660,6 +1660,7 @@ static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
        if (dev->addr_len != IEEE802154_ADDR_LEN)
                return -1;
        memcpy(eui, dev->dev_addr, 8);
+        eui[0] ^= 2;
        return 0;
 }
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 8edf2601065a..7a778b9a7b85 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -380,7 +380,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                if (skb->protocol == htons(ETH_P_IPV6)) {
                        sin->sin6_addr = ipv6_hdr(skb)->saddr;
                        if (np->rxopt.all)
-                                datagram_recv_ctl(sk, msg, skb);
+                                ip6_datagram_recv_ctl(sk, msg, skb);
                        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                sin->sin6_scope_id = IP6CB(skb)->iif;
                } else {
@@ -468,7 +468,8 @@ out:
 }
-int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
+int ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
+                          struct sk_buff *skb)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct inet6_skb_parm *opt = IP6CB(skb);
@@ -597,11 +598,12 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
        }
        return 0;
 }
+EXPORT_SYMBOL_GPL(ip6_datagram_recv_ctl);
-int datagram_send_ctl(struct net *net, struct sock *sk,
+int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
-                      struct msghdr *msg, struct flowi6 *fl6,
+                          struct msghdr *msg, struct flowi6 *fl6,
-                      struct ipv6_txoptions *opt,
+                          struct ipv6_txoptions *opt,
-                      int *hlimit, int *tclass, int *dontfrag)
+                          int *hlimit, int *tclass, int *dontfrag)
 {
        struct in6_pktinfo *src_info;
        struct cmsghdr *cmsg;
@@ -871,4 +873,4 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
 exit_f:
        return err;
 }
-EXPORT_SYMBOL_GPL(datagram_send_ctl);
+EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 29124b7a04c8..d6de4b447250 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -365,8 +365,8 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
                msg.msg_control = (void*)(fl->opt+1);
                memset(&flowi6, 0, sizeof(flowi6));
-                err = datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt, &junk,
+                err = ip6_datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt,
-                                        &junk, &junk);
+                                            &junk, &junk, &junk);
                if (err)
                        goto done;
                err = -EINVAL;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c727e4712751..131dd097736d 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -960,7 +960,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
        int ret;
        if (!ip6_tnl_xmit_ctl(t))
-                return -1;
+                goto tx_err;
        switch (skb->protocol) {
        case htons(ETH_P_IP):
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ee94d31c9d4d..d1e2e8ef29c5 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -476,8 +476,8 @@ sticky_done:
                msg.msg_controllen = optlen;
                msg.msg_control = (void*)(opt+1);
-                retv = datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk, &junk,
+                retv = ip6_datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk,
-                                         &junk);
+                                             &junk, &junk);
                if (retv)
                        goto done;
 update:
@@ -1002,7 +1002,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                release_sock(sk);
                if (skb) {
-                        int err = datagram_recv_ctl(sk, &msg, skb);
+                        int err = ip6_datagram_recv_ctl(sk, &msg, skb);
                        kfree_skb(skb);
                        if (err)
                                return err;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 6cd29b1e8b92..70fa81449997 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -507,7 +507,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        sock_recv_ts_and_drops(msg, sk, skb);
        if (np->rxopt.all)
-                datagram_recv_ctl(sk, msg, skb);
+                ip6_datagram_recv_ctl(sk, msg, skb);
        err = copied;
        if (flags & MSG_TRUNC)
@@ -822,8 +822,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(struct ipv6_txoptions);
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                                            &hlimit, &tclass, &dontfrag);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e229a3bc345d..363d8b7772e8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -928,7 +928,7 @@ restart:
        dst_hold(&rt->dst);
        read_unlock_bh(&table->tb6_lock);
-        if (!rt->n && !(rt->rt6i_flags & RTF_NONEXTHOP))
+        if (!rt->n && !(rt->rt6i_flags & (RTF_NONEXTHOP | RTF_LOCAL)))
                nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
        else if (!(rt->dst.flags & DST_HOST))
                nrt = rt6_alloc_clone(rt, &fl6->daddr);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 93825dd3a7c0..4f43537197ef 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -423,6 +423,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                }
                inet_csk_reqsk_queue_drop(sk, req, prev);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
                goto out;
        case TCP_SYN_SENT:
@@ -958,8 +959,10 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                        goto drop;
        }
-        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
                goto drop;
+        }
        req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
        if (req == NULL)
@@ -1108,6 +1111,7 @@ drop_and_release:
 drop_and_free:
        reqsk_free(req);
 drop:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
        return 0; /* don't send reset */
 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index dfaa29b8b293..fb083295ff0b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -443,7 +443,7 @@ try_again:
                        ip_cmsg_recv(msg, skb);
        } else {
                if (np->rxopt.all)
-                        datagram_recv_ctl(sk, msg, skb);
+                        ip6_datagram_recv_ctl(sk, msg, skb);
        }
        err = copied;
@@ -1153,8 +1153,8 @@ do_udp_sendmsg:
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(*opt);
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                                            &hlimit, &tclass, &dontfrag);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 1a9f3723c13c..2ac884d0e89b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -168,6 +168,51 @@ l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 }
+/* Lookup the tunnel socket, possibly involving the fs code if the socket is
+ * owned by userspace.  A struct sock returned from this function must be
+ * released using l2tp_tunnel_sock_put once you're done with it.
+ */
+struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
+{
+        int err = 0;
+        struct socket *sock = NULL;
+        struct sock *sk = NULL;
+        if (!tunnel)
+                goto out;
+        if (tunnel->fd >= 0) {
+                /* Socket is owned by userspace, who might be in the process
+                 * of closing it.  Look the socket up using the fd to ensure
+                 * consistency.
+                 */
+                sock = sockfd_lookup(tunnel->fd, &err);
+                if (sock)
+                        sk = sock->sk;
+        } else {
+                /* Socket is owned by kernelspace */
+                sk = tunnel->sock;
+        }
+out:
+        return sk;
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_lookup);
+/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
+void l2tp_tunnel_sock_put(struct sock *sk)
+{
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        if (tunnel) {
+                if (tunnel->fd >= 0) {
+                        /* Socket is owned by userspace */
+                        sockfd_put(sk->sk_socket);
+                }
+                sock_put(sk);
+        }
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_put);
 /* Lookup a session by id in the global session list
 */
 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
@@ -1123,8 +1168,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
        struct udphdr *uh;
        struct inet_sock *inet;
        __wsum csum;
-        int old_headroom;
-        int new_headroom;
        int headroom;
        int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
        int udp_len;
@@ -1136,16 +1179,12 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
         */
        headroom = NET_SKB_PAD + sizeof(struct iphdr) +
                uhlen + hdr_len;
-        old_headroom = skb_headroom(skb);
        if (skb_cow_head(skb, headroom)) {
                kfree_skb(skb);
                return NET_XMIT_DROP;
        }
-        new_headroom = skb_headroom(skb);
        skb_orphan(skb);
-        skb->truesize += new_headroom - old_headroom;
        /* Setup L2TP header */
        session->build_header(session, __skb_push(skb, hdr_len));
@@ -1607,6 +1646,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
        tunnel->old_sk_destruct = sk->sk_destruct;
        sk->sk_destruct = &l2tp_tunnel_destruct;
        tunnel->sock = sk;
+        tunnel->fd = fd;
        lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
        sk->sk_allocation = GFP_ATOMIC;
@@ -1642,24 +1682,32 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
 */
 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
-        int err = 0;
+        int err = -EBADF;
-        struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL;
+        struct socket *sock = NULL;
+        struct sock *sk = NULL;
+        sk = l2tp_tunnel_sock_lookup(tunnel);
+        if (!sk)
+                goto out;
+        sock = sk->sk_socket;
+        BUG_ON(!sock);
        /* Force the tunnel socket to close. This will eventually
         * cause the tunnel to be deleted via the normal socket close
         * mechanisms when userspace closes the tunnel socket.
         */
-        if (sock != NULL) {
+        err = inet_shutdown(sock, 2);
-                err = inet_shutdown(sock, 2);
-                /* If the tunnel's socket was created by the kernel,
+        /* If the tunnel's socket was created by the kernel,
-                 * close the socket here since the socket was not
+         * close the socket here since the socket was not
-                 * created by userspace.
+         * created by userspace.
-                 */
+         */
-                if (sock->file == NULL)
+        if (sock->file == NULL)
-                        err = inet_release(sock);
+                err = inet_release(sock);
-        }
+        l2tp_tunnel_sock_put(sk);
+out:
        return err;
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 56d583e083a7..e62204cad4fe 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,7 +188,8 @@ struct l2tp_tunnel {
        int (*recv_payload_hook)(struct sk_buff *skb);
        void (*old_sk_destruct)(struct sock *);
        struct sock             *sock;          /* Parent socket */
-        int                     fd;
+        int                     fd;             /* Parent fd, if tunnel socket
+                                                 * was created by userspace */
        uint8_t                 priv[0];        /* private data */
 };
@@ -228,6 +229,8 @@ out:
        return tunnel;
 }
+extern struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel);
+extern void l2tp_tunnel_sock_put(struct sock *sk);
 extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id);
 extern struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth);
 extern struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname);
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 927547171bc7..8ee4a86ae996 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -554,8 +554,8 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(struct ipv6_txoptions);
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                                            &hlimit, &tclass, &dontfrag);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
@@ -646,7 +646,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                            struct msghdr *msg, size_t len, int noblock,
                            int flags, int *addr_len)
 {
-        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)msg->msg_name;
        size_t copied = 0;
        int err = -EOPNOTSUPP;
@@ -688,8 +688,8 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                        lsa->l2tp_scope_id = IP6CB(skb)->iif;
        }
-        if (inet->cmsg_flags)
+        if (np->rxopt.all)
-                ip_cmsg_recv(msg, skb);
+                ip6_datagram_recv_ctl(sk, msg, skb);
        if (flags & MSG_TRUNC)
                copied = skb->len;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 286366ef8930..716605c241f4 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -388,8 +388,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        struct l2tp_session *session;
        struct l2tp_tunnel *tunnel;
        struct pppol2tp_session *ps;
-        int old_headroom;
-        int new_headroom;
        int uhlen, headroom;
        if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
@@ -408,7 +406,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        if (tunnel == NULL)
                goto abort_put_sess;
-        old_headroom = skb_headroom(skb);
        uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
        headroom = NET_SKB_PAD +
                   sizeof(struct iphdr) + /* IP header */
@@ -418,9 +415,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        if (skb_cow_head(skb, headroom))
                goto abort_put_sess_tun;
-        new_headroom = skb_headroom(skb);
-        skb->truesize += new_headroom - old_headroom;
        /* Setup PPP header */
        __skb_push(skb, sizeof(ppph));
        skb->data[0] = ppph[0];
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index a9327e2e48ce..670cbc3518de 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -35,10 +35,11 @@
 /* Must be called with rcu_read_lock. */
 static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
 {
-        if (unlikely(!vport)) {
+        if (unlikely(!vport))
-                kfree_skb(skb);
+                goto error;
-                return;
-        }
+        if (unlikely(skb_warn_if_lro(skb)))
+                goto error;
        /* Make our own copy of the packet.  Otherwise we will mangle the
         * packet for anyone who came before us (e.g. tcpdump via AF_PACKET).
@@ -50,6 +51,10 @@ static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
        skb_push(skb, ETH_HLEN);
        ovs_vport_receive(vport, skb);
+        return;
+error:
+        kfree_skb(skb);
 }
 /* Called with rcu_read_lock and bottom-halves disabled. */
@@ -169,9 +174,6 @@ static int netdev_send(struct vport *vport, struct sk_buff *skb)
                goto error;
        }
-        if (unlikely(skb_warn_if_lro(skb)))
-                goto error;
        skb->dev = netdev_vport->dev;
        len = skb->len;
        dev_queue_xmit(skb);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e639645e8fec..c111bd0e083a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2361,13 +2361,15 @@ static int packet_release(struct socket *sock)
        packet_flush_mclist(sk);
-        memset(&req_u, 0, sizeof(req_u));
+        if (po->rx_ring.pg_vec) {
+                memset(&req_u, 0, sizeof(req_u));
-        if (po->rx_ring.pg_vec)
                packet_set_ring(sk, &req_u, 1, 0);
+        }
-        if (po->tx_ring.pg_vec)
+        if (po->tx_ring.pg_vec) {
+                memset(&req_u, 0, sizeof(req_u));
                packet_set_ring(sk, &req_u, 1, 1);
+        }
        fanout_release(sk);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 298c0ddfb57e..3d2acc7a9c80 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -438,18 +438,18 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                if (q->rate) {
                        struct sk_buff_head *list = &sch->q;
-                        delay += packet_len_2_sched_time(skb->len, q);
                        if (!skb_queue_empty(list)) {
                                /*
-                                 * Last packet in queue is reference point (now).
+                                 * Last packet in queue is reference point (now),
-                                 * First packet in queue is already in flight,
+                                 * calculate this time bonus and subtract
-                                 * calculate this time bonus and substract
                                 * from delay.
                                 */
-                                delay -= now - netem_skb_cb(skb_peek(list))->time_to_send;
+                                delay -= netem_skb_cb(skb_peek_tail(list))->time_to_send - now;
+                                delay = max_t(psched_tdiff_t, 0, delay);
                                now = netem_skb_cb(skb_peek_tail(list))->time_to_send;
                        }
+                        delay += packet_len_2_sched_time(skb->len, q);
                }
                cb->time_to_send = now + delay;
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 159b9bc5d633..d8420ae614dc 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -71,7 +71,7 @@ void sctp_auth_key_put(struct sctp_auth_bytes *key)
                return;
        if (atomic_dec_and_test(&key->refcnt)) {
-                kfree(key);
+                kzfree(key);
                SCTP_DBG_OBJCNT_DEC(keys);
        }
 }
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 17a001bac2cc..1a9c5fb77310 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -249,6 +249,8 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
 /* Final destructor for endpoint.  */
 static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
 {
+        int i;
        SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
        /* Free up the HMAC transform. */
@@ -271,6 +273,9 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
        sctp_inq_free(&ep->base.inqueue);
        sctp_bind_addr_free(&ep->base.bind_addr);
+        for (i = 0; i < SCTP_HOW_MANY_SECRETS; ++i)
+                memset(&ep->secret_key[i], 0, SCTP_SECRET_SIZE);
        /* Remove and free the port */
        if (sctp_sk(ep->base.sk)->bind_hash)
                sctp_put_port(ep->base.sk);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9e65758cb038..cedd9bf67b8c 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3390,7 +3390,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
        ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey);
 out:
-        kfree(authkey);
+        kzfree(authkey);
        return ret;
 }
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 0a148c9d2a5c..0f679df7d072 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -465,7 +465,7 @@ static int svc_udp_get_dest_address4(struct svc_rqst *rqstp,
 }
 /*
- * See net/ipv6/datagram.c : datagram_recv_ctl
+ * See net/ipv6/datagram.c : ip6_datagram_recv_ctl
 */
 static int svc_udp_get_dest_address6(struct svc_rqst *rqstp,
                                     struct cmsghdr *cmh)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 01592d7d4789..45f1618c8e23 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1358,7 +1358,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                                                  &iwe, IW_EV_UINT_LEN);
        }
-        buf = kmalloc(30, GFP_ATOMIC);
+        buf = kmalloc(31, GFP_ATOMIC);
        if (buf) {
                memset(&iwe, 0, sizeof(iwe));
                iwe.cmd = IWEVCUSTOM;
diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
index a210c8d7b4bc..3b98159d9645 100644
--- a/sound/soc/fsl/Kconfig
+++ b/sound/soc/fsl/Kconfig
@@ -108,13 +108,18 @@ if SND_IMX_SOC
 config SND_SOC_IMX_SSI
        tristate
-config SND_SOC_IMX_PCM_FIQ
+config SND_SOC_IMX_PCM
        tristate
+config SND_SOC_IMX_PCM_FIQ
+        bool
        select FIQ
+        select SND_SOC_IMX_PCM
 config SND_SOC_IMX_PCM_DMA
-        tristate
+        bool
        select SND_SOC_DMAENGINE_PCM
+        select SND_SOC_IMX_PCM
 config SND_SOC_IMX_AUDMUX
        tristate
diff --git a/sound/soc/fsl/Makefile b/sound/soc/fsl/Makefile
index ec1457915d7c..afd34794db53 100644
--- a/sound/soc/fsl/Makefile
+++ b/sound/soc/fsl/Makefile
@@ -41,10 +41,7 @@ endif
 obj-$(CONFIG_SND_SOC_IMX_SSI) += snd-soc-imx-ssi.o
 obj-$(CONFIG_SND_SOC_IMX_AUDMUX) += snd-soc-imx-audmux.o
-obj-$(CONFIG_SND_SOC_IMX_PCM_FIQ) += snd-soc-imx-pcm-fiq.o
+obj-$(CONFIG_SND_SOC_IMX_PCM) += snd-soc-imx-pcm.o
-snd-soc-imx-pcm-fiq-y := imx-pcm-fiq.o imx-pcm.o
-obj-$(CONFIG_SND_SOC_IMX_PCM_DMA) += snd-soc-imx-pcm-dma.o
-snd-soc-imx-pcm-dma-y := imx-pcm-dma.o imx-pcm.o
 # i.MX Machine Support
 snd-soc-eukrea-tlv320-objs := eukrea-tlv320.o
diff --git a/sound/soc/fsl/imx-pcm-dma.c b/sound/soc/fsl/imx-pcm-dma.c
index bf363d8d044a..500f8ce55d78 100644
--- a/sound/soc/fsl/imx-pcm-dma.c
+++ b/sound/soc/fsl/imx-pcm-dma.c
@@ -154,26 +154,7 @@ static struct snd_soc_platform_driver imx_soc_platform_mx2 = {
        .pcm_free       = imx_pcm_free,
 };
-static int imx_soc_platform_probe(struct platform_device *pdev)
+int imx_pcm_dma_init(struct platform_device *pdev)
 {
        return snd_soc_register_platform(&pdev->dev, &imx_soc_platform_mx2);
 }
-static int imx_soc_platform_remove(struct platform_device *pdev)
-{
-        snd_soc_unregister_platform(&pdev->dev);
-        return 0;
-}
-static struct platform_driver imx_pcm_driver = {
-        .driver = {
-                        .name = "imx-pcm-audio",
-                        .owner = THIS_MODULE,
-        },
-        .probe = imx_soc_platform_probe,
-        .remove = imx_soc_platform_remove,
-};
-module_platform_driver(imx_pcm_driver);
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:imx-pcm-audio");
diff --git a/sound/soc/fsl/imx-pcm-fiq.c b/sound/soc/fsl/imx-pcm-fiq.c
index 5ec362ae4d01..920f945cb2f4 100644
--- a/sound/soc/fsl/imx-pcm-fiq.c
+++ b/sound/soc/fsl/imx-pcm-fiq.c
@@ -281,7 +281,7 @@ static struct snd_soc_platform_driver imx_soc_platform_fiq = {
        .pcm_free       = imx_pcm_fiq_free,
 };
-static int imx_soc_platform_probe(struct platform_device *pdev)
+int imx_pcm_fiq_init(struct platform_device *pdev)
 {
        struct imx_ssi *ssi = platform_get_drvdata(pdev);
        int ret;
@@ -314,23 +314,3 @@ failed_register:
        return ret;
 }
-static int imx_soc_platform_remove(struct platform_device *pdev)
-{
-        snd_soc_unregister_platform(&pdev->dev);
-        return 0;
-}
-static struct platform_driver imx_pcm_driver = {
-        .driver = {
-                        .name = "imx-fiq-pcm-audio",
-                        .owner = THIS_MODULE,
-        },
-        .probe = imx_soc_platform_probe,
-        .remove = imx_soc_platform_remove,
-};
-module_platform_driver(imx_pcm_driver);
-MODULE_LICENSE("GPL");
diff --git a/sound/soc/fsl/imx-pcm.c b/sound/soc/fsl/imx-pcm.c
index 0c9f188ddc68..0d0625bfcb65 100644
--- a/sound/soc/fsl/imx-pcm.c
+++ b/sound/soc/fsl/imx-pcm.c
@@ -31,6 +31,7 @@ int snd_imx_pcm_mmap(struct snd_pcm_substream *substream,
                        runtime->dma_bytes);
        return ret;
 }
+EXPORT_SYMBOL_GPL(snd_imx_pcm_mmap);
 static int imx_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, int stream)
 {
@@ -79,6 +80,7 @@ int imx_pcm_new(struct snd_soc_pcm_runtime *rtd)
 out:
        return ret;
 }
+EXPORT_SYMBOL_GPL(imx_pcm_new);
 void imx_pcm_free(struct snd_pcm *pcm)
 {
@@ -100,6 +102,39 @@ void imx_pcm_free(struct snd_pcm *pcm)
                buf->area = NULL;
        }
 }
+EXPORT_SYMBOL_GPL(imx_pcm_free);
+static int imx_pcm_probe(struct platform_device *pdev)
+{
+        if (strcmp(pdev->id_entry->name, "imx-fiq-pcm-audio") == 0)
+                return imx_pcm_fiq_init(pdev);
+        return imx_pcm_dma_init(pdev);
+}
+static int imx_pcm_remove(struct platform_device *pdev)
+{
+        snd_soc_unregister_platform(&pdev->dev);
+        return 0;
+}
+static struct platform_device_id imx_pcm_devtype[] = {
+        { .name = "imx-pcm-audio", },
+        { .name = "imx-fiq-pcm-audio", },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(platform, imx_pcm_devtype);
+static struct platform_driver imx_pcm_driver = {
+        .driver = {
+                        .name = "imx-pcm",
+                        .owner = THIS_MODULE,
+        },
+        .id_table = imx_pcm_devtype,
+        .probe = imx_pcm_probe,
+        .remove = imx_pcm_remove,
+};
+module_platform_driver(imx_pcm_driver);
 MODULE_DESCRIPTION("Freescale i.MX PCM driver");
 MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de>");
diff --git a/sound/soc/fsl/imx-pcm.h b/sound/soc/fsl/imx-pcm.h
index 83c0ed7d55c9..5ae13a13a353 100644
--- a/sound/soc/fsl/imx-pcm.h
+++ b/sound/soc/fsl/imx-pcm.h
@@ -30,4 +30,22 @@ int snd_imx_pcm_mmap(struct snd_pcm_substream *substream,
 int imx_pcm_new(struct snd_soc_pcm_runtime *rtd);
 void imx_pcm_free(struct snd_pcm *pcm);
+#ifdef CONFIG_SND_SOC_IMX_PCM_DMA
+int imx_pcm_dma_init(struct platform_device *pdev);
+#else
+static inline int imx_pcm_dma_init(struct platform_device *pdev)
+{
+        return -ENODEV;
+}
+#endif
+#ifdef CONFIG_SND_SOC_IMX_PCM_FIQ
+int imx_pcm_fiq_init(struct platform_device *pdev);
+#else
+static inline int imx_pcm_fiq_init(struct platform_device *pdev)
+{
+        return -ENODEV;
+}
+#endif
 #endif /* _IMX_PCM_H */