201 files changed, 2562 insertions, 1428 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index d32cb8d288eb..d3a888cfa0ea 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3242,6 +3242,12 @@ F:	Documentation/firmware_class/
 F:      drivers/base/firmware*.c
 F:      include/linux/firmware.h
 
+FLASHSYSTEM DRIVER (IBM FlashSystem 70/80 PCI SSD Flash Card)
+M:      Joshua Morris <josh.h.morris@us.ibm.com>
+M:      Philip Kelleher <pjk1939@linux.vnet.ibm.com>
+S:      Maintained
+F:      drivers/block/rsxx/
+
 FLOPPY DRIVER
 M:      Jiri Kosina <jkosina@suse.cz>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/floppy.git
@@ -5059,9 +5065,8 @@ S:	Maintained
 F:      drivers/net/ethernet/marvell/sk*
 
 MARVELL LIBERTAS WIRELESS DRIVER
-M:      Dan Williams <dcbw@redhat.com>
 L:      libertas-dev@lists.infradead.org
-S:      Maintained
+S:      Orphan
 F:      drivers/net/wireless/libertas/
 
 MARVELL MV643XX ETHERNET DRIVER
@@ -5563,6 +5568,7 @@ F:	include/uapi/linux/if_*
 F:      include/uapi/linux/netdevice.h
 
 NETXEN (1/10) GbE SUPPORT
+M:      Manish Chopra <manish.chopra@qlogic.com>
 M:      Sony Chacko <sony.chacko@qlogic.com>
 M:      Rajesh Borundia <rajesh.borundia@qlogic.com>
 L:      netdev@vger.kernel.org
@@ -6209,7 +6215,7 @@ F:	include/linux/power_supply.h
 F:      drivers/power/
 
 PNP SUPPORT
-M:      Adam Belay <abelay@mit.edu>
+M:      Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 M:      Bjorn Helgaas <bhelgaas@google.com>
 S:      Maintained
 F:      drivers/pnp/
@@ -6553,12 +6559,6 @@ S:	Maintained
 F:      Documentation/blockdev/ramdisk.txt
 F:      drivers/block/brd.c
 
-RAMSAM DRIVER (IBM RamSan 70/80 PCI SSD Flash Card)
-M:      Joshua Morris <josh.h.morris@us.ibm.com>
-M:      Philip Kelleher <pjk1939@linux.vnet.ibm.com>
-S:      Maintained
-F:      drivers/block/rsxx/
-
 RANDOM NUMBER DRIVER
 M:      Theodore Ts'o" <tytso@mit.edu>
 S:      Maintained
@@ -7708,9 +7708,10 @@ F:	include/linux/swiotlb.h
 
 SYNOPSYS ARC ARCHITECTURE
 M:      Vineet Gupta <vgupta@synopsys.com>
-L:      linux-snps-arc@vger.kernel.org
 S:      Supported
 F:      arch/arc/
+F:      Documentation/devicetree/bindings/arc/
+F:      drivers/tty/serial/arc-uart.c
 
 SYSV FILESYSTEM
 M:      Christoph Hellwig <hch@infradead.org>
diff --git a/Makefile b/Makefile
index 54d2b2a0fef0..58a165b02af1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 9
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Unicycling Gorilla
 
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/dma-mapping.h b/arch/arc/include/asm/dma-mapping.h
index 31f77aec0823..45b8e0cea176 100644
--- a/arch/arc/include/asm/dma-mapping.h
+++ b/arch/arc/include/asm/dma-mapping.h
@@ -126,7 +126,7 @@ dma_map_sg(struct device *dev, struct scatterlist *sg,
         int i;
 
         for_each_sg(sg, s, nents, i)
-                sg->dma_address = dma_map_page(dev, sg_page(s), s->offset,
+                s->dma_address = dma_map_page(dev, sg_page(s), s->offset,
                                                s->length, dir);
 
         return nents;
diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h
index f4c8d36ebecb..a26282857683 100644
--- a/arch/arc/include/asm/elf.h
+++ b/arch/arc/include/asm/elf.h
@@ -72,7 +72,4 @@ extern int elf_check_arch(const struct elf32_hdr *);
  */
 #define ELF_PLATFORM    (NULL)
 
-#define SET_PERSONALITY(ex) \
-        set_personality(PER_LINUX | (current->personality & (~PER_MASK)))
-
 #endif
diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
index 23daa326fc9b..eb2ae53187d9 100644
--- a/arch/arc/include/asm/entry.h
+++ b/arch/arc/include/asm/entry.h
@@ -415,7 +415,7 @@
  *-------------------------------------------------------------*/
 .macro SAVE_ALL_EXCEPTION   marker
 
-        st      \marker, [sp, 8]
+        st      \marker, [sp, 8]        /* orig_r8 */
         st      r0, [sp, 4]    /* orig_r0, needed only for sys calls */
 
         /* Restore r9 used to code the early prologue */
diff --git a/arch/arc/include/asm/kgdb.h b/arch/arc/include/asm/kgdb.h
index f3c4934f0ca9..4930957ca3d3 100644
--- a/arch/arc/include/asm/kgdb.h
+++ b/arch/arc/include/asm/kgdb.h
@@ -13,7 +13,7 @@
 
 #ifdef CONFIG_KGDB
 
-#include <asm/user.h>
+#include <asm/ptrace.h>
 
 /* to ensure compatibility with Linux 2.6.35, we don't implement the get/set
  * register API yet */
@@ -53,9 +53,7 @@ enum arc700_linux_regnums {
 };
 
 #else
-static inline void kgdb_trap(struct pt_regs *regs, int param)
-{
-}
+#define kgdb_trap(regs, param)
 #endif
 
 #endif  /* __ARC_KGDB_H__ */
diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 8ae783d20a81..6179de7e07c2 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -123,7 +123,7 @@ static inline long regs_return_value(struct pt_regs *regs)
 #define orig_r8_IS_SCALL                0x0001
 #define orig_r8_IS_SCALL_RESTARTED      0x0002
 #define orig_r8_IS_BRKPT                0x0004
-#define orig_r8_IS_EXCPN                0x0004
+#define orig_r8_IS_EXCPN                0x0008
 #define orig_r8_IS_IRQ1                 0x0010
 #define orig_r8_IS_IRQ2                 0x0020
 
diff --git a/arch/arc/include/asm/syscalls.h b/arch/arc/include/asm/syscalls.h
index e53a5340ba4f..dd785befe7fd 100644
--- a/arch/arc/include/asm/syscalls.h
+++ b/arch/arc/include/asm/syscalls.h
@@ -16,8 +16,6 @@
 #include <linux/types.h>
 
 int sys_clone_wrapper(int, int, int, int, int);
-int sys_fork_wrapper(void);
-int sys_vfork_wrapper(void);
 int sys_cacheflush(uint32_t, uint32_t uint32_t);
 int sys_arc_settls(void *);
 int sys_arc_gettls(void);
diff --git a/arch/arc/include/uapi/asm/ptrace.h b/arch/arc/include/uapi/asm/ptrace.h
index 6afa4f702075..30333cec0fef 100644
--- a/arch/arc/include/uapi/asm/ptrace.h
+++ b/arch/arc/include/uapi/asm/ptrace.h
@@ -28,14 +28,14 @@
 */
 struct user_regs_struct {
 
-        struct scratch {
+        struct {
                 long pad;
                 long bta, lp_start, lp_end, lp_count;
                 long status32, ret, blink, fp, gp;
                 long r12, r11, r10, r9, r8, r7, r6, r5, r4, r3, r2, r1, r0;
                 long sp;
         } scratch;
-        struct callee {
+        struct {
                 long pad;
                 long r25, r24, r23, r22, r21, r20;
                 long r19, r18, r17, r16, r15, r14, r13;
diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
index ef6800ba2f03..91eeab81f52d 100644
--- a/arch/arc/kernel/entry.S
+++ b/arch/arc/kernel/entry.S
@@ -452,7 +452,7 @@ tracesys:
         ; using ERET won't work since next-PC has already committed
         lr  r12, [efa]
         GET_CURR_TASK_FIELD_PTR   TASK_THREAD, r11
-        st  r12, [r11, THREAD_FAULT_ADDR]
+        st  r12, [r11, THREAD_FAULT_ADDR]       ; thread.fault_address
 
         ; PRE Sys Call Ptrace hook
         mov r0, sp                      ; pt_regs needed
@@ -792,31 +792,6 @@ ARC_EXIT ret_from_fork
 
 ;################### Special Sys Call Wrappers ##########################
 
-; TBD: call do_fork directly from here
-ARC_ENTRY sys_fork_wrapper
-        SAVE_CALLEE_SAVED_USER
-        bl  @sys_fork
-        DISCARD_CALLEE_SAVED_USER
-
-        GET_CURR_THR_INFO_FLAGS   r10
-        btst r10, TIF_SYSCALL_TRACE
-        bnz  tracesys_exit
-
-        b ret_from_system_call
-ARC_EXIT sys_fork_wrapper
-
-ARC_ENTRY sys_vfork_wrapper
-        SAVE_CALLEE_SAVED_USER
-        bl  @sys_vfork
-        DISCARD_CALLEE_SAVED_USER
-
-        GET_CURR_THR_INFO_FLAGS   r10
-        btst r10, TIF_SYSCALL_TRACE
-        bnz  tracesys_exit
-
-        b ret_from_system_call
-ARC_EXIT sys_vfork_wrapper
-
 ARC_ENTRY sys_clone_wrapper
         SAVE_CALLEE_SAVED_USER
         bl  @sys_clone
diff --git a/arch/arc/kernel/kgdb.c b/arch/arc/kernel/kgdb.c
index 2888ba5be47e..52bdc83c1495 100644
--- a/arch/arc/kernel/kgdb.c
+++ b/arch/arc/kernel/kgdb.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/kgdb.h>
+#include <linux/sched.h>
 #include <asm/disasm.h>
 #include <asm/cacheflush.h>
 
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index dc0f968dae0a..2d95ac07df7b 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -232,10 +232,8 @@ char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
 
         n += scnprintf(buf + n, len - n, "\n");
 
-#ifdef _ASM_GENERIC_UNISTD_H
         n += scnprintf(buf + n, len - n,
-                       "OS ABI [v2]\t: asm-generic/{unistd,stat,fcntl}\n");
-#endif
+                       "OS ABI [v3]\t: no-legacy-syscalls\n");
 
         return buf;
 }
diff --git a/arch/arc/kernel/sys.c b/arch/arc/kernel/sys.c
index f6bdd07583f3..9d6c1ca26af6 100644
--- a/arch/arc/kernel/sys.c
+++ b/arch/arc/kernel/sys.c
@@ -6,8 +6,6 @@
 #include <asm/syscalls.h>
 
 #define sys_clone       sys_clone_wrapper
-#define sys_fork        sys_fork_wrapper
-#define sys_vfork       sys_vfork_wrapper
 
 #undef __SYSCALL
 #define __SYSCALL(nr, call) [nr] = (call),
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 224b44ab534e..70b8cd4021c4 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -261,7 +261,7 @@ static void __init create_mapping(phys_addr_t phys, unsigned long virt,
 void __iomem * __init early_io_map(phys_addr_t phys, unsigned long virt)
 {
         unsigned long size, mask;
-        bool page64k = IS_ENABLED(ARM64_64K_PAGES);
+        bool page64k = IS_ENABLED(CONFIG_ARM64_64K_PAGES);
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd;
diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
index e34f565f595a..6f7dc8b7b35c 100644
--- a/arch/ia64/kernel/process.c
+++ b/arch/ia64/kernel/process.c
@@ -291,7 +291,6 @@ cpu_idle (void)
                 }
 
                 if (!need_resched()) {
-                        void (*idle)(void);
 #ifdef CONFIG_SMP
                         min_xtp();
 #endif
@@ -299,9 +298,7 @@ cpu_idle (void)
                         if (mark_idle)
                                 (*mark_idle)(1);
 
-                        if (!idle)
-                                idle = default_idle;
-                        (*idle)();
+                        default_idle();
                         if (mark_idle)
                                 (*mark_idle)(0);
 #ifdef CONFIG_SMP
diff --git a/arch/powerpc/kernel/epapr_paravirt.c b/arch/powerpc/kernel/epapr_paravirt.c
index f3eab8594d9f..d44a571e45a7 100644
--- a/arch/powerpc/kernel/epapr_paravirt.c
+++ b/arch/powerpc/kernel/epapr_paravirt.c
@@ -23,8 +23,10 @@
 #include <asm/code-patching.h>
 #include <asm/machdep.h>
 
+#if !defined(CONFIG_64BIT) || defined(CONFIG_PPC_BOOK3E_64)
 extern void epapr_ev_idle(void);
 extern u32 epapr_ev_idle_start[];
+#endif
 
 bool epapr_paravirt_enabled;
 
@@ -47,11 +49,15 @@ static int __init epapr_paravirt_init(void)
 
         for (i = 0; i < (len / 4); i++) {
                 patch_instruction(epapr_hypercall_start + i, insts[i]);
+#if !defined(CONFIG_64BIT) || defined(CONFIG_PPC_BOOK3E_64)
                 patch_instruction(epapr_ev_idle_start + i, insts[i]);
+#endif
         }
 
+#if !defined(CONFIG_64BIT) || defined(CONFIG_PPC_BOOK3E_64)
         if (of_get_property(hyper_node, "has-idle", NULL))
                 ppc_md.power_save = epapr_ev_idle;
+#endif
 
         epapr_paravirt_enabled = true;
 
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 200afa5bcfb7..56bd92362ce1 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1066,78 +1066,6 @@ unrecov_user_slb:
 #endif /* __DISABLED__ */
 
 
-/*
- * r13 points to the PACA, r9 contains the saved CR,
- * r12 contain the saved SRR1, SRR0 is still ready for return
- * r3 has the faulting address
- * r9 - r13 are saved in paca->exslb.
- * r3 is saved in paca->slb_r3
- * We assume we aren't going to take any exceptions during this procedure.
- */
-_GLOBAL(slb_miss_realmode)
-        mflr    r10
-#ifdef CONFIG_RELOCATABLE
-        mtctr   r11
-#endif
-
-        stw     r9,PACA_EXSLB+EX_CCR(r13)       /* save CR in exc. frame */
-        std     r10,PACA_EXSLB+EX_LR(r13)       /* save LR */
-
-        bl      .slb_allocate_realmode
-
-        /* All done -- return from exception. */
-
-        ld      r10,PACA_EXSLB+EX_LR(r13)
-        ld      r3,PACA_EXSLB+EX_R3(r13)
-        lwz     r9,PACA_EXSLB+EX_CCR(r13)       /* get saved CR */
-
-        mtlr    r10
-
-        andi.   r10,r12,MSR_RI  /* check for unrecoverable exception */
-        beq-    2f
-
-.machine        push
-.machine        "power4"
-        mtcrf   0x80,r9
-        mtcrf   0x01,r9         /* slb_allocate uses cr0 and cr7 */
-.machine        pop
-
-        RESTORE_PPR_PACA(PACA_EXSLB, r9)
-        ld      r9,PACA_EXSLB+EX_R9(r13)
-        ld      r10,PACA_EXSLB+EX_R10(r13)
-        ld      r11,PACA_EXSLB+EX_R11(r13)
-        ld      r12,PACA_EXSLB+EX_R12(r13)
-        ld      r13,PACA_EXSLB+EX_R13(r13)
-        rfid
-        b       .       /* prevent speculative execution */
-
-2:      mfspr   r11,SPRN_SRR0
-        ld      r10,PACAKBASE(r13)
-        LOAD_HANDLER(r10,unrecov_slb)
-        mtspr   SPRN_SRR0,r10
-        ld      r10,PACAKMSR(r13)
-        mtspr   SPRN_SRR1,r10
-        rfid
-        b       .
-
-unrecov_slb:
-        EXCEPTION_PROLOG_COMMON(0x4100, PACA_EXSLB)
-        DISABLE_INTS
-        bl      .save_nvgprs
-1:      addi    r3,r1,STACK_FRAME_OVERHEAD
-        bl      .unrecoverable_exception
-        b       1b
-
-
-#ifdef CONFIG_PPC_970_NAP
-power4_fixup_nap:
-        andc    r9,r9,r10
-        std     r9,TI_LOCAL_FLAGS(r11)
-        ld      r10,_LINK(r1)           /* make idle task do the */
-        std     r10,_NIP(r1)            /* equivalent of a blr */
-        blr
-#endif
-
         .align  7
         .globl alignment_common
 alignment_common:
@@ -1336,6 +1264,78 @@ _GLOBAL(opal_mc_secondary_handler)
 
 
 /*
+ * r13 points to the PACA, r9 contains the saved CR,
+ * r12 contain the saved SRR1, SRR0 is still ready for return
+ * r3 has the faulting address
+ * r9 - r13 are saved in paca->exslb.
+ * r3 is saved in paca->slb_r3
+ * We assume we aren't going to take any exceptions during this procedure.
+ */
+_GLOBAL(slb_miss_realmode)
+        mflr    r10
+#ifdef CONFIG_RELOCATABLE
+        mtctr   r11
+#endif
+
+        stw     r9,PACA_EXSLB+EX_CCR(r13)       /* save CR in exc. frame */
+        std     r10,PACA_EXSLB+EX_LR(r13)       /* save LR */
+
+        bl      .slb_allocate_realmode
+
+        /* All done -- return from exception. */
+
+        ld      r10,PACA_EXSLB+EX_LR(r13)
+        ld      r3,PACA_EXSLB+EX_R3(r13)
+        lwz     r9,PACA_EXSLB+EX_CCR(r13)       /* get saved CR */
+
+        mtlr    r10
+
+        andi.   r10,r12,MSR_RI  /* check for unrecoverable exception */
+        beq-    2f
+
+.machine        push
+.machine        "power4"
+        mtcrf   0x80,r9
+        mtcrf   0x01,r9         /* slb_allocate uses cr0 and cr7 */
+.machine        pop
+
+        RESTORE_PPR_PACA(PACA_EXSLB, r9)
+        ld      r9,PACA_EXSLB+EX_R9(r13)
+        ld      r10,PACA_EXSLB+EX_R10(r13)
+        ld      r11,PACA_EXSLB+EX_R11(r13)
+        ld      r12,PACA_EXSLB+EX_R12(r13)
+        ld      r13,PACA_EXSLB+EX_R13(r13)
+        rfid
+        b       .       /* prevent speculative execution */
+
+2:      mfspr   r11,SPRN_SRR0
+        ld      r10,PACAKBASE(r13)
+        LOAD_HANDLER(r10,unrecov_slb)
+        mtspr   SPRN_SRR0,r10
+        ld      r10,PACAKMSR(r13)
+        mtspr   SPRN_SRR1,r10
+        rfid
+        b       .
+
+unrecov_slb:
+        EXCEPTION_PROLOG_COMMON(0x4100, PACA_EXSLB)
+        DISABLE_INTS
+        bl      .save_nvgprs
+1:      addi    r3,r1,STACK_FRAME_OVERHEAD
+        bl      .unrecoverable_exception
+        b       1b
+
+
+#ifdef CONFIG_PPC_970_NAP
+power4_fixup_nap:
+        andc    r9,r9,r10
+        std     r9,TI_LOCAL_FLAGS(r11)
+        ld      r10,_LINK(r1)           /* make idle task do the */
+        std     r10,_NIP(r1)            /* equivalent of a blr */
+        blr
+#endif
+
+/*
  * Hash table stuff
  */
         .align  7
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index d1e15f7b59c6..7a5aa1a7864e 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -1004,15 +1004,8 @@ void __cpuinit setup_cpu(int boot)
 
 #ifdef CONFIG_BLK_DEV_INITRD
 
-/*
- * Note that the kernel can potentially support other compression
- * techniques than gz, though we don't do so by default.  If we ever
- * decide to do so we can either look for other filename extensions,
- * or just allow a file with this name to be compressed with an
- * arbitrary compressor (somewhat counterintuitively).
- */
 static int __initdata set_initramfs_file;
-static char __initdata initramfs_file[128] = "initramfs.cpio.gz";
+static char __initdata initramfs_file[128] = "initramfs";
 
 static int __init setup_initramfs_file(char *str)
 {
@@ -1026,9 +1019,9 @@ static int __init setup_initramfs_file(char *str)
 early_param("initramfs_file", setup_initramfs_file);
 
 /*
- * We look for an "initramfs.cpio.gz" file in the hvfs.
- * If there is one, we allocate some memory for it and it will be
- * unpacked to the initramfs.
+ * We look for a file called "initramfs" in the hvfs.  If there is one, we
+ * allocate some memory for it and it will be unpacked to the initramfs.
+ * If it's compressed, the initd code will uncompress it first.
  */
 static void __init load_hv_initrd(void)
 {
@@ -1038,10 +1031,16 @@ static void __init load_hv_initrd(void)
 
         fd = hv_fs_findfile((HV_VirtAddr) initramfs_file);
         if (fd == HV_ENOENT) {
-                if (set_initramfs_file)
+                if (set_initramfs_file) {
                         pr_warning("No such hvfs initramfs file '%s'\n",
                                    initramfs_file);
-                return;
+                        return;
+                } else {
+                        /* Try old backwards-compatible name. */
+                        fd = hv_fs_findfile((HV_VirtAddr)"initramfs.cpio.gz");
+                        if (fd == HV_ENOENT)
+                                return;
+                }
         }
         BUG_ON(fd < 0);
         stat = hv_fs_fstat(fd);
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index c20d1ce62dc6..e709884d0ef9 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -382,14 +382,14 @@ HYPERVISOR_console_io(int cmd, int count, char *str)
         return _hypercall3(int, console_io, cmd, count, str);
 }
 
-extern int __must_check HYPERVISOR_physdev_op_compat(int, void *);
+extern int __must_check xen_physdev_op_compat(int, void *);
 
 static inline int
 HYPERVISOR_physdev_op(int cmd, void *arg)
 {
         int rc = _hypercall2(int, physdev_op, cmd, arg);
         if (unlikely(rc == -ENOSYS))
-                rc = HYPERVISOR_physdev_op_compat(cmd, arg);
+                rc = xen_physdev_op_compat(cmd, arg);
         return rc;
 }
 
diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
index 892ce40a7470..7a060f4b411f 100644
--- a/arch/x86/include/uapi/asm/msr-index.h
+++ b/arch/x86/include/uapi/asm/msr-index.h
@@ -44,6 +44,7 @@
 #define SNB_C1_AUTO_UNDEMOTE            (1UL << 27)
 #define SNB_C3_AUTO_UNDEMOTE            (1UL << 28)
 
+#define MSR_PLATFORM_INFO               0x000000ce
 #define MSR_MTRRcap                     0x000000fe
 #define MSR_IA32_BBL_CR_CTL             0x00000119
 #define MSR_IA32_BBL_CR_CTL3            0x0000011e
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index e8e34938c57d..6afbb2ca9a0a 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1467,8 +1467,6 @@ static void __init xen_write_cr3_init(unsigned long cr3)
         __xen_write_cr3(true, cr3);
 
         xen_mc_issue(PARAVIRT_LAZY_CPU);  /* interrupts restored */
-
-        pv_mmu_ops.write_cr3 = &xen_write_cr3;
 }
 #endif
 
@@ -2122,6 +2120,7 @@ static void __init xen_post_allocator_init(void)
 #endif
 
 #ifdef CONFIG_X86_64
+        pv_mmu_ops.write_cr3 = &xen_write_cr3;
         SetPagePinned(virt_to_page(level3_user_vsyscall));
 #endif
         xen_mark_init_mm_pinned();
diff --git a/block/blk-flush.c b/block/blk-flush.c
index db8f1b507857..cc2b827a853c 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -444,7 +444,7 @@ int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask,
          * copied from blk_rq_pos(rq).
          */
         if (error_sector)
-               *error_sector = bio->bi_sector;
+                *error_sector = bio->bi_sector;
 
         if (!bio_flagged(bio, BIO_UPTODATE))
                 ret = -EIO;
diff --git a/block/partition-generic.c b/block/partition-generic.c
index 789cdea05893..ae95ee6a58aa 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -257,6 +257,7 @@ void delete_partition(struct gendisk *disk, int partno)
 
         hd_struct_put(part);
 }
+EXPORT_SYMBOL(delete_partition);
 
 static ssize_t whole_disk_show(struct device *dev,
                                struct device_attribute *attr, char *buf)
diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
index 1e5d8a40101e..fefc2ca7cc3e 100644
--- a/drivers/acpi/apei/cper.c
+++ b/drivers/acpi/apei/cper.c
@@ -405,7 +405,7 @@ int apei_estatus_check(const struct acpi_hest_generic_status *estatus)
                 return rc;
         data_len = estatus->data_length;
         gdata = (struct acpi_hest_generic_data *)(estatus + 1);
-        while (data_len > sizeof(*gdata)) {
+        while (data_len >= sizeof(*gdata)) {
                 gedata_len = gdata->error_data_length;
                 if (gedata_len > data_len - sizeof(*gdata))
                         return -EINVAL;
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 0ac546d5e53f..5ff173066127 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -646,6 +646,7 @@ static void handle_root_bridge_insertion(acpi_handle handle)
 
 static void handle_root_bridge_removal(struct acpi_device *device)
 {
+        acpi_status status;
         struct acpi_eject_event *ej_event;
 
         ej_event = kmalloc(sizeof(*ej_event), GFP_KERNEL);
@@ -661,7 +662,9 @@ static void handle_root_bridge_removal(struct acpi_device *device)
         ej_event->device = device;
         ej_event->event = ACPI_NOTIFY_EJECT_REQUEST;
 
-        acpi_bus_hot_remove_device(ej_event);
+        status = acpi_os_hotplug_execute(acpi_bus_hot_remove_device, ej_event);
+        if (ACPI_FAILURE(status))
+                kfree(ej_event);
 }
 
 static void _handle_hotplug_event_root(struct work_struct *work)
@@ -676,8 +679,9 @@ static void _handle_hotplug_event_root(struct work_struct *work)
         handle = hp_work->handle;
         type = hp_work->type;
 
-        root = acpi_pci_find_root(handle);
+        acpi_scan_lock_acquire();
 
+        root = acpi_pci_find_root(handle);
         acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
 
         switch (type) {
@@ -711,6 +715,7 @@ static void _handle_hotplug_event_root(struct work_struct *work)
                 break;
         }
 
+        acpi_scan_lock_release();
         kfree(hp_work); /* allocated in handle_hotplug_event_bridge */
         kfree(buffer.pointer);
 }
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 24213033fbae..9c1a435d10e6 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -193,6 +193,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
         },
         {
         .callback = init_nvs_nosave,
+        .ident = "Sony Vaio VGN-FW21M",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW21M"),
+                },
+        },
+        {
+        .callback = init_nvs_nosave,
         .ident = "Sony Vaio VPCEB17FX",
         .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 5dc0daed8fac..b81ddfea1da0 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -532,11 +532,11 @@ config BLK_DEV_RBD
           If unsure, say N.
 
 config BLK_DEV_RSXX
-        tristate "RamSam PCIe Flash SSD Device Driver"
+        tristate "IBM FlashSystem 70/80 PCIe SSD Device Driver"
         depends on PCI
         help
           Device driver for IBM's high speed PCIe SSD
-          storage devices: RamSan-70 and RamSan-80.
+          storage devices: FlashSystem-70 and FlashSystem-80.
 
           To compile this driver as a module, choose M here: the
           module will be called rsxx.
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 25ef5c014fca..92b6d7c51e39 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -51,8 +51,9 @@ new_skb(ulong len)
 {
         struct sk_buff *skb;
 
-        skb = alloc_skb(len, GFP_ATOMIC);
+        skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC);
         if (skb) {
+                skb_reserve(skb, MAX_HEADER);
                 skb_reset_mac_header(skb);
                 skb_reset_network_header(skb);
                 skb->protocol = __constant_htons(ETH_P_AOE);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index ade58bc8f3c4..1c1b8e544aa2 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -4206,7 +4206,7 @@ static int cciss_find_cfgtables(ctlr_info_t *h)
         if (rc)
                 return rc;
         h->cfgtable = remap_pci_mem(pci_resource_start(h->pdev,
-                cfg_base_addr_index) + cfg_offset, sizeof(h->cfgtable));
+                cfg_base_addr_index) + cfg_offset, sizeof(*h->cfgtable));
         if (!h->cfgtable)
                 return -ENOMEM;
         rc = write_driver_ver_to_cfgtable(h->cfgtable);
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 747bb2af69dc..fe5f6403417f 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1044,12 +1044,29 @@ static int loop_clr_fd(struct loop_device *lo)
         lo->lo_state = Lo_unbound;
         /* This is safe: open() is still holding a reference. */
         module_put(THIS_MODULE);
-        if (lo->lo_flags & LO_FLAGS_PARTSCAN && bdev)
-                ioctl_by_bdev(bdev, BLKRRPART, 0);
         lo->lo_flags = 0;
         if (!part_shift)
                 lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
         mutex_unlock(&lo->lo_ctl_mutex);
+
+        /*
+         * Remove all partitions, since BLKRRPART won't remove user
+         * added partitions when max_part=0
+         */
+        if (bdev) {
+                struct disk_part_iter piter;
+                struct hd_struct *part;
+
+                mutex_lock_nested(&bdev->bd_mutex, 1);
+                invalidate_partition(bdev->bd_disk, 0);
+                disk_part_iter_init(&piter, bdev->bd_disk,
+                                        DISK_PITER_INCL_EMPTY);
+                while ((part = disk_part_iter_next(&piter)))
+                        delete_partition(bdev->bd_disk, part->partno);
+                disk_part_iter_exit(&piter);
+                mutex_unlock(&bdev->bd_mutex);
+        }
+
         /*
          * Need not hold lo_ctl_mutex to fput backing file.
          * Calling fput holding lo_ctl_mutex triggers a circular
@@ -1623,6 +1640,7 @@ static int loop_add(struct loop_device **l, int i)
                 goto out_free_dev;
         i = err;
 
+        err = -ENOMEM;
         lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
         if (!lo->lo_queue)
                 goto out_free_dev;
diff --git a/drivers/block/mg_disk.c b/drivers/block/mg_disk.c
index 1788f491e0fb..076ae7f1b781 100644
--- a/drivers/block/mg_disk.c
+++ b/drivers/block/mg_disk.c
@@ -890,8 +890,10 @@ static int mg_probe(struct platform_device *plat_dev)
         gpio_direction_output(host->rst, 1);
 
         /* reset out pin */
-        if (!(prv_data->dev_attr & MG_DEV_MASK))
+        if (!(prv_data->dev_attr & MG_DEV_MASK)) {
+                err = -EINVAL;
                 goto probe_err_3a;
+        }
 
         if (prv_data->dev_attr != MG_BOOT_DEV) {
                 rsc = platform_get_resource_byname(plat_dev, IORESOURCE_IO,
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 11cc9522cdd4..92250af84e7d 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4224,6 +4224,7 @@ static int mtip_pci_probe(struct pci_dev *pdev,
         dd->isr_workq = create_workqueue(dd->workq_name);
         if (!dd->isr_workq) {
                 dev_warn(&pdev->dev, "Can't create wq %d\n", dd->instance);
+                rv = -ENOMEM;
                 goto block_initialize_err;
         }
 
@@ -4282,7 +4283,8 @@ static int mtip_pci_probe(struct pci_dev *pdev,
         INIT_WORK(&dd->work[7].work, mtip_workq_sdbf7);
 
         pci_set_master(pdev);
-        if (pci_enable_msi(pdev)) {
+        rv = pci_enable_msi(pdev);
+        if (rv) {
                 dev_warn(&pdev->dev,
                         "Unable to enable MSI interrupt.\n");
                 goto block_initialize_err;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 6c81a4c040b9..f556f8a8b3f9 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1264,6 +1264,32 @@ static bool obj_request_done_test(struct rbd_obj_request *obj_request)
         return atomic_read(&obj_request->done) != 0;
 }
 
+static void
+rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+{
+        dout("%s: obj %p img %p result %d %llu/%llu\n", __func__,
+                obj_request, obj_request->img_request, obj_request->result,
+                obj_request->xferred, obj_request->length);
+        /*
+         * ENOENT means a hole in the image.  We zero-fill the
+         * entire length of the request.  A short read also implies
+         * zero-fill to the end of the request.  Either way we
+         * update the xferred count to indicate the whole request
+         * was satisfied.
+         */
+        BUG_ON(obj_request->type != OBJ_REQUEST_BIO);
+        if (obj_request->result == -ENOENT) {
+                zero_bio_chain(obj_request->bio_list, 0);
+                obj_request->result = 0;
+                obj_request->xferred = obj_request->length;
+        } else if (obj_request->xferred < obj_request->length &&
+                        !obj_request->result) {
+                zero_bio_chain(obj_request->bio_list, obj_request->xferred);
+                obj_request->xferred = obj_request->length;
+        }
+        obj_request_done_set(obj_request);
+}
+
 static void rbd_obj_request_complete(struct rbd_obj_request *obj_request)
 {
         dout("%s: obj %p cb %p\n", __func__, obj_request,
@@ -1284,23 +1310,10 @@ static void rbd_osd_read_callback(struct rbd_obj_request *obj_request)
 {
         dout("%s: obj %p result %d %llu/%llu\n", __func__, obj_request,
                 obj_request->result, obj_request->xferred, obj_request->length);
-        /*
-         * ENOENT means a hole in the object.  We zero-fill the
-         * entire length of the request.  A short read also implies
-         * zero-fill to the end of the request.  Either way we
-         * update the xferred count to indicate the whole request
-         * was satisfied.
-         */
-        if (obj_request->result == -ENOENT) {
-                zero_bio_chain(obj_request->bio_list, 0);
-                obj_request->result = 0;
-                obj_request->xferred = obj_request->length;
-        } else if (obj_request->xferred < obj_request->length &&
-                        !obj_request->result) {
-                zero_bio_chain(obj_request->bio_list, obj_request->xferred);
-                obj_request->xferred = obj_request->length;
-        }
-        obj_request_done_set(obj_request);
+        if (obj_request->img_request)
+                rbd_img_obj_request_read_callback(obj_request);
+        else
+                obj_request_done_set(obj_request);
 }
 
 static void rbd_osd_write_callback(struct rbd_obj_request *obj_request)
diff --git a/drivers/block/rsxx/Makefile b/drivers/block/rsxx/Makefile
index f35cd0b71f7b..b1c53c0aa450 100644
--- a/drivers/block/rsxx/Makefile
+++ b/drivers/block/rsxx/Makefile
@@ -1,2 +1,2 @@
 obj-$(CONFIG_BLK_DEV_RSXX) += rsxx.o
-rsxx-y := config.o core.o cregs.o dev.o dma.o
+rsxx-objs := config.o core.o cregs.o dev.o dma.o
diff --git a/drivers/block/rsxx/config.c b/drivers/block/rsxx/config.c
index a295e7e9ee41..10cd530d3e10 100644
--- a/drivers/block/rsxx/config.c
+++ b/drivers/block/rsxx/config.c
@@ -29,15 +29,13 @@
 #include "rsxx_priv.h"
 #include "rsxx_cfg.h"
 
-static void initialize_config(void *config)
+static void initialize_config(struct rsxx_card_cfg *cfg)
 {
-        struct rsxx_card_cfg *cfg = config;
-
         cfg->hdr.version = RSXX_CFG_VERSION;
 
         cfg->data.block_size        = RSXX_HW_BLK_SIZE;
         cfg->data.stripe_size       = RSXX_HW_BLK_SIZE;
-        cfg->data.vendor_id         = RSXX_VENDOR_ID_TMS_IBM;
+        cfg->data.vendor_id         = RSXX_VENDOR_ID_IBM;
         cfg->data.cache_order       = (-1);
         cfg->data.intr_coal.mode    = RSXX_INTR_COAL_DISABLED;
         cfg->data.intr_coal.count   = 0;
@@ -181,7 +179,7 @@ int rsxx_load_config(struct rsxx_cardinfo *card)
         } else {
                 dev_info(CARD_TO_DEV(card),
                         "Initializing card configuration.\n");
-                initialize_config(card);
+                initialize_config(&card->config);
                 st = rsxx_save_config(card);
                 if (st)
                         return st;
diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
index e5162487686a..5af21f2db29c 100644
--- a/drivers/block/rsxx/core.c
+++ b/drivers/block/rsxx/core.c
@@ -30,6 +30,7 @@
 #include <linux/reboot.h>
 #include <linux/slab.h>
 #include <linux/bitops.h>
+#include <linux/delay.h>
 
 #include <linux/genhd.h>
 #include <linux/idr.h>
@@ -39,8 +40,8 @@
 
 #define NO_LEGACY 0
 
-MODULE_DESCRIPTION("IBM RamSan PCIe Flash SSD Device Driver");
-MODULE_AUTHOR("IBM <support@ramsan.com>");
+MODULE_DESCRIPTION("IBM FlashSystem 70/80 PCIe SSD Device Driver");
+MODULE_AUTHOR("Joshua Morris/Philip Kelleher, IBM");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRIVER_VERSION);
 
@@ -52,6 +53,13 @@ static DEFINE_IDA(rsxx_disk_ida);
 static DEFINE_SPINLOCK(rsxx_ida_lock);
 
 /*----------------- Interrupt Control & Handling -------------------*/
+
+static void rsxx_mask_interrupts(struct rsxx_cardinfo *card)
+{
+        card->isr_mask = 0;
+        card->ier_mask = 0;
+}
+
 static void __enable_intr(unsigned int *mask, unsigned int intr)
 {
         *mask |= intr;
@@ -71,7 +79,8 @@ static void __disable_intr(unsigned int *mask, unsigned int intr)
  */
 void rsxx_enable_ier(struct rsxx_cardinfo *card, unsigned int intr)
 {
-        if (unlikely(card->halt))
+        if (unlikely(card->halt) ||
+            unlikely(card->eeh_state))
                 return;
 
         __enable_intr(&card->ier_mask, intr);
@@ -80,6 +89,9 @@ void rsxx_enable_ier(struct rsxx_cardinfo *card, unsigned int intr)
 
 void rsxx_disable_ier(struct rsxx_cardinfo *card, unsigned int intr)
 {
+        if (unlikely(card->eeh_state))
+                return;
+
         __disable_intr(&card->ier_mask, intr);
         iowrite32(card->ier_mask, card->regmap + IER);
 }
@@ -87,7 +99,8 @@ void rsxx_disable_ier(struct rsxx_cardinfo *card, unsigned int intr)
 void rsxx_enable_ier_and_isr(struct rsxx_cardinfo *card,
                                  unsigned int intr)
 {
-        if (unlikely(card->halt))
+        if (unlikely(card->halt) ||
+            unlikely(card->eeh_state))
                 return;
 
         __enable_intr(&card->isr_mask, intr);
@@ -97,6 +110,9 @@ void rsxx_enable_ier_and_isr(struct rsxx_cardinfo *card,
 void rsxx_disable_ier_and_isr(struct rsxx_cardinfo *card,
                                   unsigned int intr)
 {
+        if (unlikely(card->eeh_state))
+                return;
+
         __disable_intr(&card->isr_mask, intr);
         __disable_intr(&card->ier_mask, intr);
         iowrite32(card->ier_mask, card->regmap + IER);
@@ -115,6 +131,9 @@ static irqreturn_t rsxx_isr(int irq, void *pdata)
         do {
                 reread_isr = 0;
 
+                if (unlikely(card->eeh_state))
+                        break;
+
                 isr = ioread32(card->regmap + ISR);
                 if (isr == 0xffffffff) {
                         /*
@@ -161,9 +180,9 @@ static irqreturn_t rsxx_isr(int irq, void *pdata)
 }
 
 /*----------------- Card Event Handler -------------------*/
-static char *rsxx_card_state_to_str(unsigned int state)
+static const char * const rsxx_card_state_to_str(unsigned int state)
 {
-        static char *state_strings[] = {
+        static const char * const state_strings[] = {
                 "Unknown", "Shutdown", "Starting", "Formatting",
                 "Uninitialized", "Good", "Shutting Down",
                 "Fault", "Read Only Fault", "dStroying"
@@ -304,6 +323,192 @@ static int card_shutdown(struct rsxx_cardinfo *card)
         return 0;
 }
 
+static int rsxx_eeh_frozen(struct pci_dev *dev)
+{
+        struct rsxx_cardinfo *card = pci_get_drvdata(dev);
+        int i;
+        int st;
+
+        dev_warn(&dev->dev, "IBM FlashSystem PCI: preparing for slot reset.\n");
+
+        card->eeh_state = 1;
+        rsxx_mask_interrupts(card);
+
+        /*
+         * We need to guarantee that the write for eeh_state and masking
+         * interrupts does not become reordered. This will prevent a possible
+         * race condition with the EEH code.
+         */
+        wmb();
+
+        pci_disable_device(dev);
+
+        st = rsxx_eeh_save_issued_dmas(card);
+        if (st)
+                return st;
+
+        rsxx_eeh_save_issued_creg(card);
+
+        for (i = 0; i < card->n_targets; i++) {
+                if (card->ctrl[i].status.buf)
+                        pci_free_consistent(card->dev, STATUS_BUFFER_SIZE8,
+                                            card->ctrl[i].status.buf,
+                                            card->ctrl[i].status.dma_addr);
+                if (card->ctrl[i].cmd.buf)
+                        pci_free_consistent(card->dev, COMMAND_BUFFER_SIZE8,
+                                            card->ctrl[i].cmd.buf,
+                                            card->ctrl[i].cmd.dma_addr);
+        }
+
+        return 0;
+}
+
+static void rsxx_eeh_failure(struct pci_dev *dev)
+{
+        struct rsxx_cardinfo *card = pci_get_drvdata(dev);
+        int i;
+
+        dev_err(&dev->dev, "IBM FlashSystem PCI: disabling failed card.\n");
+
+        card->eeh_state = 1;
+
+        for (i = 0; i < card->n_targets; i++)
+                del_timer_sync(&card->ctrl[i].activity_timer);
+
+        rsxx_eeh_cancel_dmas(card);
+}
+
+static int rsxx_eeh_fifo_flush_poll(struct rsxx_cardinfo *card)
+{
+        unsigned int status;
+        int iter = 0;
+
+        /* We need to wait for the hardware to reset */
+        while (iter++ < 10) {
+                status = ioread32(card->regmap + PCI_RECONFIG);
+
+                if (status & RSXX_FLUSH_BUSY) {
+                        ssleep(1);
+                        continue;
+                }
+
+                if (status & RSXX_FLUSH_TIMEOUT)
+                        dev_warn(CARD_TO_DEV(card), "HW: flash controller timeout\n");
+                return 0;
+        }
+
+        /* Hardware failed resetting itself. */
+        return -1;
+}
+
+static pci_ers_result_t rsxx_error_detected(struct pci_dev *dev,
+                                            enum pci_channel_state error)
+{
+        int st;
+
+        if (dev->revision < RSXX_EEH_SUPPORT)
+                return PCI_ERS_RESULT_NONE;
+
+        if (error == pci_channel_io_perm_failure) {
+                rsxx_eeh_failure(dev);
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+
+        st = rsxx_eeh_frozen(dev);
+        if (st) {
+                dev_err(&dev->dev, "Slot reset setup failed\n");
+                rsxx_eeh_failure(dev);
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+
+        return PCI_ERS_RESULT_NEED_RESET;
+}
+
+static pci_ers_result_t rsxx_slot_reset(struct pci_dev *dev)
+{
+        struct rsxx_cardinfo *card = pci_get_drvdata(dev);
+        unsigned long flags;
+        int i;
+        int st;
+
+        dev_warn(&dev->dev,
+                "IBM FlashSystem PCI: recovering from slot reset.\n");
+
+        st = pci_enable_device(dev);
+        if (st)
+                goto failed_hw_setup;
+
+        pci_set_master(dev);
+
+        st = rsxx_eeh_fifo_flush_poll(card);
+        if (st)
+                goto failed_hw_setup;
+
+        rsxx_dma_queue_reset(card);
+
+        for (i = 0; i < card->n_targets; i++) {
+                st = rsxx_hw_buffers_init(dev, &card->ctrl[i]);
+                if (st)
+                        goto failed_hw_buffers_init;
+        }
+
+        if (card->config_valid)
+                rsxx_dma_configure(card);
+
+        /* Clears the ISR register from spurious interrupts */
+        st = ioread32(card->regmap + ISR);
+
+        card->eeh_state = 0;
+
+        st = rsxx_eeh_remap_dmas(card);
+        if (st)
+                goto failed_remap_dmas;
+
+        spin_lock_irqsave(&card->irq_lock, flags);
+        if (card->n_targets & RSXX_MAX_TARGETS)
+                rsxx_enable_ier_and_isr(card, CR_INTR_ALL_G);
+        else
+                rsxx_enable_ier_and_isr(card, CR_INTR_ALL_C);
+        spin_unlock_irqrestore(&card->irq_lock, flags);
+
+        rsxx_kick_creg_queue(card);
+
+        for (i = 0; i < card->n_targets; i++) {
+                spin_lock(&card->ctrl[i].queue_lock);
+                if (list_empty(&card->ctrl[i].queue)) {
+                        spin_unlock(&card->ctrl[i].queue_lock);
+                        continue;
+                }
+                spin_unlock(&card->ctrl[i].queue_lock);
+
+                queue_work(card->ctrl[i].issue_wq,
+                                &card->ctrl[i].issue_dma_work);
+        }
+
+        dev_info(&dev->dev, "IBM FlashSystem PCI: recovery complete.\n");
+
+        return PCI_ERS_RESULT_RECOVERED;
+
+failed_hw_buffers_init:
+failed_remap_dmas:
+        for (i = 0; i < card->n_targets; i++) {
+                if (card->ctrl[i].status.buf)
+                        pci_free_consistent(card->dev,
+                                        STATUS_BUFFER_SIZE8,
+                                        card->ctrl[i].status.buf,
+                                        card->ctrl[i].status.dma_addr);
+                if (card->ctrl[i].cmd.buf)
+                        pci_free_consistent(card->dev,
+                                        COMMAND_BUFFER_SIZE8,
+                                        card->ctrl[i].cmd.buf,
+                                        card->ctrl[i].cmd.dma_addr);
+        }
+failed_hw_setup:
+        rsxx_eeh_failure(dev);
+        return PCI_ERS_RESULT_DISCONNECT;
+
+}
+
 /*----------------- Driver Initialization & Setup -------------------*/
 /* Returns:   0 if the driver is compatible with the device
              -1 if the driver is NOT compatible with the device */
@@ -383,6 +588,7 @@ static int rsxx_pci_probe(struct pci_dev *dev,
 
         spin_lock_init(&card->irq_lock);
         card->halt = 0;
+        card->eeh_state = 0;
 
         spin_lock_irq(&card->irq_lock);
         rsxx_disable_ier_and_isr(card, CR_INTR_ALL);
@@ -538,9 +744,6 @@ static void rsxx_pci_remove(struct pci_dev *dev)
         rsxx_disable_ier_and_isr(card, CR_INTR_EVENT);
         spin_unlock_irqrestore(&card->irq_lock, flags);
 
-        /* Prevent work_structs from re-queuing themselves. */
-        card->halt = 1;
-
         cancel_work_sync(&card->event_work);
 
         rsxx_destroy_dev(card);
@@ -549,6 +752,10 @@ static void rsxx_pci_remove(struct pci_dev *dev)
         spin_lock_irqsave(&card->irq_lock, flags);
         rsxx_disable_ier_and_isr(card, CR_INTR_ALL);
         spin_unlock_irqrestore(&card->irq_lock, flags);
+
+        /* Prevent work_structs from re-queuing themselves. */
+        card->halt = 1;
+
         free_irq(dev->irq, card);
 
         if (!force_legacy)
@@ -592,11 +799,14 @@ static void rsxx_pci_shutdown(struct pci_dev *dev)
         card_shutdown(card);
 }
 
+static const struct pci_error_handlers rsxx_err_handler = {
+        .error_detected = rsxx_error_detected,
+        .slot_reset     = rsxx_slot_reset,
+};
+
 static DEFINE_PCI_DEVICE_TABLE(rsxx_pci_ids) = {
-        {PCI_DEVICE(PCI_VENDOR_ID_TMS_IBM, PCI_DEVICE_ID_RS70_FLASH)},
-        {PCI_DEVICE(PCI_VENDOR_ID_TMS_IBM, PCI_DEVICE_ID_RS70D_FLASH)},
-        {PCI_DEVICE(PCI_VENDOR_ID_TMS_IBM, PCI_DEVICE_ID_RS80_FLASH)},
-        {PCI_DEVICE(PCI_VENDOR_ID_TMS_IBM, PCI_DEVICE_ID_RS81_FLASH)},
+        {PCI_DEVICE(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_FS70_FLASH)},
+        {PCI_DEVICE(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_FS80_FLASH)},
         {0,},
 };
 
@@ -609,6 +819,7 @@ static struct pci_driver rsxx_pci_driver = {
         .remove         = rsxx_pci_remove,
         .suspend        = rsxx_pci_suspend,
         .shutdown       = rsxx_pci_shutdown,
+        .err_handler    = &rsxx_err_handler,
 };
 
 static int __init rsxx_core_init(void)
diff --git a/drivers/block/rsxx/cregs.c b/drivers/block/rsxx/cregs.c
index 80bbe639fccd..4b5c020a0a65 100644
--- a/drivers/block/rsxx/cregs.c
+++ b/drivers/block/rsxx/cregs.c
@@ -58,7 +58,7 @@ static struct kmem_cache *creg_cmd_pool;
 #error Unknown endianess!!! Aborting...
 #endif
 
-static void copy_to_creg_data(struct rsxx_cardinfo *card,
+static int copy_to_creg_data(struct rsxx_cardinfo *card,
                               int cnt8,
                               void *buf,
                               unsigned int stream)
@@ -66,6 +66,9 @@ static void copy_to_creg_data(struct rsxx_cardinfo *card,
         int i = 0;
         u32 *data = buf;
 
+        if (unlikely(card->eeh_state))
+                return -EIO;
+
         for (i = 0; cnt8 > 0; i++, cnt8 -= 4) {
                 /*
                  * Firmware implementation makes it necessary to byte swap on
@@ -76,10 +79,12 @@ static void copy_to_creg_data(struct rsxx_cardinfo *card,
                 else
                         iowrite32(data[i], card->regmap + CREG_DATA(i));
         }
+
+        return 0;
 }
 
 
-static void copy_from_creg_data(struct rsxx_cardinfo *card,
+static int copy_from_creg_data(struct rsxx_cardinfo *card,
                                 int cnt8,
                                 void *buf,
                                 unsigned int stream)
@@ -87,6 +92,9 @@ static void copy_from_creg_data(struct rsxx_cardinfo *card,
         int i = 0;
         u32 *data = buf;
 
+        if (unlikely(card->eeh_state))
+                return -EIO;
+
         for (i = 0; cnt8 > 0; i++, cnt8 -= 4) {
                 /*
                  * Firmware implementation makes it necessary to byte swap on
@@ -97,41 +105,31 @@ static void copy_from_creg_data(struct rsxx_cardinfo *card,
                 else
                         data[i] = ioread32(card->regmap + CREG_DATA(i));
         }
-}
-
-static struct creg_cmd *pop_active_cmd(struct rsxx_cardinfo *card)
-{
-        struct creg_cmd *cmd;
 
-        /*
-         * Spin lock is needed because this can be called in atomic/interrupt
-         * context.
-         */
-        spin_lock_bh(&card->creg_ctrl.lock);
-        cmd = card->creg_ctrl.active_cmd;
-        card->creg_ctrl.active_cmd = NULL;
-        spin_unlock_bh(&card->creg_ctrl.lock);
-
-        return cmd;
+        return 0;
 }
 
 static void creg_issue_cmd(struct rsxx_cardinfo *card, struct creg_cmd *cmd)
 {
+        int st;
+
+        if (unlikely(card->eeh_state))
+                return;
+
         iowrite32(cmd->addr, card->regmap + CREG_ADD);
         iowrite32(cmd->cnt8, card->regmap + CREG_CNT);
 
         if (cmd->op == CREG_OP_WRITE) {
-                if (cmd->buf)
-                        copy_to_creg_data(card, cmd->cnt8,
-                                          cmd->buf, cmd->stream);
+                if (cmd->buf) {
+                        st = copy_to_creg_data(card, cmd->cnt8,
+                                               cmd->buf, cmd->stream);
+                        if (st)
+                                return;
+                }
         }
 
-        /*
-         * Data copy must complete before initiating the command. This is
-         * needed for weakly ordered processors (i.e. PowerPC), so that all
-         * neccessary registers are written before we kick the hardware.
-         */
-        wmb();
+        if (unlikely(card->eeh_state))
+                return;
 
         /* Setting the valid bit will kick off the command. */
         iowrite32(cmd->op, card->regmap + CREG_CMD);
@@ -196,11 +194,11 @@ static int creg_queue_cmd(struct rsxx_cardinfo *card,
         cmd->cb_private = cb_private;
         cmd->status     = 0;
 
-        spin_lock(&card->creg_ctrl.lock);
+        spin_lock_bh(&card->creg_ctrl.lock);
         list_add_tail(&cmd->list, &card->creg_ctrl.queue);
         card->creg_ctrl.q_depth++;
         creg_kick_queue(card);
-        spin_unlock(&card->creg_ctrl.lock);
+        spin_unlock_bh(&card->creg_ctrl.lock);
 
         return 0;
 }
@@ -210,7 +208,11 @@ static void creg_cmd_timed_out(unsigned long data)
         struct rsxx_cardinfo *card = (struct rsxx_cardinfo *) data;
         struct creg_cmd *cmd;
 
-        cmd = pop_active_cmd(card);
+        spin_lock(&card->creg_ctrl.lock);
+        cmd = card->creg_ctrl.active_cmd;
+        card->creg_ctrl.active_cmd = NULL;
+        spin_unlock(&card->creg_ctrl.lock);
+
         if (cmd == NULL) {
                 card->creg_ctrl.creg_stats.creg_timeout++;
                 dev_warn(CARD_TO_DEV(card),
@@ -247,7 +249,11 @@ static void creg_cmd_done(struct work_struct *work)
         if (del_timer_sync(&card->creg_ctrl.cmd_timer) == 0)
                 card->creg_ctrl.creg_stats.failed_cancel_timer++;
 
-        cmd = pop_active_cmd(card);
+        spin_lock_bh(&card->creg_ctrl.lock);
+        cmd = card->creg_ctrl.active_cmd;
+        card->creg_ctrl.active_cmd = NULL;
+        spin_unlock_bh(&card->creg_ctrl.lock);
+
         if (cmd == NULL) {
                 dev_err(CARD_TO_DEV(card),
                         "Spurious creg interrupt!\n");
@@ -287,7 +293,7 @@ static void creg_cmd_done(struct work_struct *work)
                         goto creg_done;
                 }
 
-                copy_from_creg_data(card, cnt8, cmd->buf, cmd->stream);
+                st = copy_from_creg_data(card, cnt8, cmd->buf, cmd->stream);
         }
 
 creg_done:
@@ -296,10 +302,10 @@ creg_done:
 
         kmem_cache_free(creg_cmd_pool, cmd);
 
-        spin_lock(&card->creg_ctrl.lock);
+        spin_lock_bh(&card->creg_ctrl.lock);
         card->creg_ctrl.active = 0;
         creg_kick_queue(card);
-        spin_unlock(&card->creg_ctrl.lock);
+        spin_unlock_bh(&card->creg_ctrl.lock);
 }
 
 static void creg_reset(struct rsxx_cardinfo *card)
@@ -324,7 +330,7 @@ static void creg_reset(struct rsxx_cardinfo *card)
                 "Resetting creg interface for recovery\n");
 
         /* Cancel outstanding commands */
-        spin_lock(&card->creg_ctrl.lock);
+        spin_lock_bh(&card->creg_ctrl.lock);
         list_for_each_entry_safe(cmd, tmp, &card->creg_ctrl.queue, list) {
                 list_del(&cmd->list);
                 card->creg_ctrl.q_depth--;
@@ -345,7 +351,7 @@ static void creg_reset(struct rsxx_cardinfo *card)
 
                 card->creg_ctrl.active = 0;
         }
-        spin_unlock(&card->creg_ctrl.lock);
+        spin_unlock_bh(&card->creg_ctrl.lock);
 
         card->creg_ctrl.reset = 0;
         spin_lock_irqsave(&card->irq_lock, flags);
@@ -399,12 +405,12 @@ static int __issue_creg_rw(struct rsxx_cardinfo *card,
                 return st;
 
         /*
-         * This timeout is neccessary for unresponsive hardware. The additional
+         * This timeout is necessary for unresponsive hardware. The additional
          * 20 seconds to used to guarantee that each cregs requests has time to
          * complete.
          */
-        timeout = msecs_to_jiffies((CREG_TIMEOUT_MSEC *
-                                card->creg_ctrl.q_depth) + 20000);
+        timeout = msecs_to_jiffies(CREG_TIMEOUT_MSEC *
+                                   card->creg_ctrl.q_depth + 20000);
 
         /*
          * The creg interface is guaranteed to complete. It has a timeout
@@ -690,6 +696,32 @@ int rsxx_reg_access(struct rsxx_cardinfo *card,
         return 0;
 }
 
+void rsxx_eeh_save_issued_creg(struct rsxx_cardinfo *card)
+{
+        struct creg_cmd *cmd = NULL;
+
+        cmd = card->creg_ctrl.active_cmd;
+        card->creg_ctrl.active_cmd = NULL;
+
+        if (cmd) {
+                del_timer_sync(&card->creg_ctrl.cmd_timer);
+
+                spin_lock_bh(&card->creg_ctrl.lock);
+                list_add(&cmd->list, &card->creg_ctrl.queue);
+                card->creg_ctrl.q_depth++;
+                card->creg_ctrl.active = 0;
+                spin_unlock_bh(&card->creg_ctrl.lock);
+        }
+}
+
+void rsxx_kick_creg_queue(struct rsxx_cardinfo *card)
+{
+        spin_lock_bh(&card->creg_ctrl.lock);
+        if (!list_empty(&card->creg_ctrl.queue))
+                creg_kick_queue(card);
+        spin_unlock_bh(&card->creg_ctrl.lock);
+}
+
 /*------------ Initialization & Setup --------------*/
 int rsxx_creg_setup(struct rsxx_cardinfo *card)
 {
@@ -712,7 +744,7 @@ void rsxx_creg_destroy(struct rsxx_cardinfo *card)
         int cnt = 0;
 
         /* Cancel outstanding commands */
-        spin_lock(&card->creg_ctrl.lock);
+        spin_lock_bh(&card->creg_ctrl.lock);
         list_for_each_entry_safe(cmd, tmp, &card->creg_ctrl.queue, list) {
                 list_del(&cmd->list);
                 if (cmd->cb)
@@ -737,7 +769,7 @@ void rsxx_creg_destroy(struct rsxx_cardinfo *card)
                         "Canceled active creg command\n");
                 kmem_cache_free(creg_cmd_pool, cmd);
         }
-        spin_unlock(&card->creg_ctrl.lock);
+        spin_unlock_bh(&card->creg_ctrl.lock);
 
         cancel_work_sync(&card->creg_ctrl.done_work);
 }
diff --git a/drivers/block/rsxx/dma.c b/drivers/block/rsxx/dma.c
index 63176e67662f..0607513cfb41 100644
--- a/drivers/block/rsxx/dma.c
+++ b/drivers/block/rsxx/dma.c
@@ -28,7 +28,7 @@
 struct rsxx_dma {
         struct list_head         list;
         u8                       cmd;
-        unsigned int             laddr;     /* Logical address on the ramsan */
+        unsigned int             laddr;     /* Logical address */
         struct {
                 u32              off;
                 u32              cnt;
@@ -81,9 +81,6 @@ enum rsxx_hw_status {
         HW_STATUS_FAULT         = 0x08,
 };
 
-#define STATUS_BUFFER_SIZE8     4096
-#define COMMAND_BUFFER_SIZE8    4096
-
 static struct kmem_cache *rsxx_dma_pool;
 
 struct dma_tracker {
@@ -122,7 +119,7 @@ static unsigned int rsxx_get_dma_tgt(struct rsxx_cardinfo *card, u64 addr8)
         return tgt;
 }
 
-static void rsxx_dma_queue_reset(struct rsxx_cardinfo *card)
+void rsxx_dma_queue_reset(struct rsxx_cardinfo *card)
 {
         /* Reset all DMA Command/Status Queues */
         iowrite32(DMA_QUEUE_RESET, card->regmap + RESET);
@@ -210,7 +207,8 @@ static void dma_intr_coal_auto_tune(struct rsxx_cardinfo *card)
         u32 q_depth = 0;
         u32 intr_coal;
 
-        if (card->config.data.intr_coal.mode != RSXX_INTR_COAL_AUTO_TUNE)
+        if (card->config.data.intr_coal.mode != RSXX_INTR_COAL_AUTO_TUNE ||
+            unlikely(card->eeh_state))
                 return;
 
         for (i = 0; i < card->n_targets; i++)
@@ -223,31 +221,26 @@ static void dma_intr_coal_auto_tune(struct rsxx_cardinfo *card)
 }
 
 /*----------------- RSXX DMA Handling -------------------*/
-static void rsxx_complete_dma(struct rsxx_cardinfo *card,
+static void rsxx_complete_dma(struct rsxx_dma_ctrl *ctrl,
                                   struct rsxx_dma *dma,
                                   unsigned int status)
 {
         if (status & DMA_SW_ERR)
-                printk_ratelimited(KERN_ERR
-                                   "SW Error in DMA(cmd x%02x, laddr x%08x)\n",
-                                   dma->cmd, dma->laddr);
+                ctrl->stats.dma_sw_err++;
         if (status & DMA_HW_FAULT)
-                printk_ratelimited(KERN_ERR
-                                   "HW Fault in DMA(cmd x%02x, laddr x%08x)\n",
-                                   dma->cmd, dma->laddr);
+                ctrl->stats.dma_hw_fault++;
         if (status & DMA_CANCELLED)
-                printk_ratelimited(KERN_ERR
-                                   "DMA Cancelled(cmd x%02x, laddr x%08x)\n",
-                                   dma->cmd, dma->laddr);
+                ctrl->stats.dma_cancelled++;
 
         if (dma->dma_addr)
-                pci_unmap_page(card->dev, dma->dma_addr, get_dma_size(dma),
+                pci_unmap_page(ctrl->card->dev, dma->dma_addr,
+                               get_dma_size(dma),
                                dma->cmd == HW_CMD_BLK_WRITE ?
                                            PCI_DMA_TODEVICE :
                                            PCI_DMA_FROMDEVICE);
 
         if (dma->cb)
-                dma->cb(card, dma->cb_data, status ? 1 : 0);
+                dma->cb(ctrl->card, dma->cb_data, status ? 1 : 0);
 
         kmem_cache_free(rsxx_dma_pool, dma);
 }
@@ -330,14 +323,15 @@ static void rsxx_handle_dma_error(struct rsxx_dma_ctrl *ctrl,
         if (requeue_cmd)
                 rsxx_requeue_dma(ctrl, dma);
         else
-                rsxx_complete_dma(ctrl->card, dma, status);
+                rsxx_complete_dma(ctrl, dma, status);
 }
 
 static void dma_engine_stalled(unsigned long data)
 {
         struct rsxx_dma_ctrl *ctrl = (struct rsxx_dma_ctrl *)data;
 
-        if (atomic_read(&ctrl->stats.hw_q_depth) == 0)
+        if (atomic_read(&ctrl->stats.hw_q_depth) == 0 ||
+            unlikely(ctrl->card->eeh_state))
                 return;
 
         if (ctrl->cmd.idx != ioread32(ctrl->regmap + SW_CMD_IDX)) {
@@ -369,7 +363,8 @@ static void rsxx_issue_dmas(struct work_struct *work)
         ctrl = container_of(work, struct rsxx_dma_ctrl, issue_dma_work);
         hw_cmd_buf = ctrl->cmd.buf;
 
-        if (unlikely(ctrl->card->halt))
+        if (unlikely(ctrl->card->halt) ||
+            unlikely(ctrl->card->eeh_state))
                 return;
 
         while (1) {
@@ -397,7 +392,7 @@ static void rsxx_issue_dmas(struct work_struct *work)
                  */
                 if (unlikely(ctrl->card->dma_fault)) {
                         push_tracker(ctrl->trackers, tag);
-                        rsxx_complete_dma(ctrl->card, dma, DMA_CANCELLED);
+                        rsxx_complete_dma(ctrl, dma, DMA_CANCELLED);
                         continue;
                 }
 
@@ -432,19 +427,15 @@ static void rsxx_issue_dmas(struct work_struct *work)
 
         /* Let HW know we've queued commands. */
         if (cmds_pending) {
-                /*
-                 * We must guarantee that the CPU writes to 'ctrl->cmd.buf'
-                 * (which is in PCI-consistent system-memory) from the loop
-                 * above make it into the coherency domain before the
-                 * following PIO "trigger" updating the cmd.idx.  A WMB is
-                 * sufficient. We need not explicitly CPU cache-flush since
-                 * the memory is a PCI-consistent (ie; coherent) mapping.
-                 */
-                wmb();
-
                 atomic_add(cmds_pending, &ctrl->stats.hw_q_depth);
                 mod_timer(&ctrl->activity_timer,
                           jiffies + DMA_ACTIVITY_TIMEOUT);
+
+                if (unlikely(ctrl->card->eeh_state)) {
+                        del_timer_sync(&ctrl->activity_timer);
+                        return;
+                }
+
                 iowrite32(ctrl->cmd.idx, ctrl->regmap + SW_CMD_IDX);
         }
 }
@@ -463,7 +454,8 @@ static void rsxx_dma_done(struct work_struct *work)
         hw_st_buf = ctrl->status.buf;
 
         if (unlikely(ctrl->card->halt) ||
-            unlikely(ctrl->card->dma_fault))
+            unlikely(ctrl->card->dma_fault) ||
+            unlikely(ctrl->card->eeh_state))
                 return;
 
         count = le16_to_cpu(hw_st_buf[ctrl->status.idx].count);
@@ -508,7 +500,7 @@ static void rsxx_dma_done(struct work_struct *work)
                 if (status)
                         rsxx_handle_dma_error(ctrl, dma, status);
                 else
-                        rsxx_complete_dma(ctrl->card, dma, 0);
+                        rsxx_complete_dma(ctrl, dma, 0);
 
                 push_tracker(ctrl->trackers, tag);
 
@@ -727,20 +719,54 @@ bvec_err:
 
 
 /*----------------- DMA Engine Initialization & Setup -------------------*/
+int rsxx_hw_buffers_init(struct pci_dev *dev, struct rsxx_dma_ctrl *ctrl)
+{
+        ctrl->status.buf = pci_alloc_consistent(dev, STATUS_BUFFER_SIZE8,
+                                &ctrl->status.dma_addr);
+        ctrl->cmd.buf = pci_alloc_consistent(dev, COMMAND_BUFFER_SIZE8,
+                                &ctrl->cmd.dma_addr);
+        if (ctrl->status.buf == NULL || ctrl->cmd.buf == NULL)
+                return -ENOMEM;
+
+        memset(ctrl->status.buf, 0xac, STATUS_BUFFER_SIZE8);
+        iowrite32(lower_32_bits(ctrl->status.dma_addr),
+                ctrl->regmap + SB_ADD_LO);
+        iowrite32(upper_32_bits(ctrl->status.dma_addr),
+                ctrl->regmap + SB_ADD_HI);
+
+        memset(ctrl->cmd.buf, 0x83, COMMAND_BUFFER_SIZE8);
+        iowrite32(lower_32_bits(ctrl->cmd.dma_addr), ctrl->regmap + CB_ADD_LO);
+        iowrite32(upper_32_bits(ctrl->cmd.dma_addr), ctrl->regmap + CB_ADD_HI);
+
+        ctrl->status.idx = ioread32(ctrl->regmap + HW_STATUS_CNT);
+        if (ctrl->status.idx > RSXX_MAX_OUTSTANDING_CMDS) {
+                dev_crit(&dev->dev, "Failed reading status cnt x%x\n",
+                        ctrl->status.idx);
+                return -EINVAL;
+        }
+        iowrite32(ctrl->status.idx, ctrl->regmap + HW_STATUS_CNT);
+        iowrite32(ctrl->status.idx, ctrl->regmap + SW_STATUS_CNT);
+
+        ctrl->cmd.idx = ioread32(ctrl->regmap + HW_CMD_IDX);
+        if (ctrl->cmd.idx > RSXX_MAX_OUTSTANDING_CMDS) {
+                dev_crit(&dev->dev, "Failed reading cmd cnt x%x\n",
+                        ctrl->status.idx);
+                return -EINVAL;
+        }
+        iowrite32(ctrl->cmd.idx, ctrl->regmap + HW_CMD_IDX);
+        iowrite32(ctrl->cmd.idx, ctrl->regmap + SW_CMD_IDX);
+
+        return 0;
+}
+
 static int rsxx_dma_ctrl_init(struct pci_dev *dev,
                                   struct rsxx_dma_ctrl *ctrl)
 {
         int i;
+        int st;
 
         memset(&ctrl->stats, 0, sizeof(ctrl->stats));
 
-        ctrl->status.buf = pci_alloc_consistent(dev, STATUS_BUFFER_SIZE8,
-                                                &ctrl->status.dma_addr);
-        ctrl->cmd.buf = pci_alloc_consistent(dev, COMMAND_BUFFER_SIZE8,
-                                             &ctrl->cmd.dma_addr);
-        if (ctrl->status.buf == NULL || ctrl->cmd.buf == NULL)
-                return -ENOMEM;
-
         ctrl->trackers = vmalloc(DMA_TRACKER_LIST_SIZE8);
         if (!ctrl->trackers)
                 return -ENOMEM;
@@ -770,35 +796,9 @@ static int rsxx_dma_ctrl_init(struct pci_dev *dev,
         INIT_WORK(&ctrl->issue_dma_work, rsxx_issue_dmas);
         INIT_WORK(&ctrl->dma_done_work, rsxx_dma_done);
 
-        memset(ctrl->status.buf, 0xac, STATUS_BUFFER_SIZE8);
-        iowrite32(lower_32_bits(ctrl->status.dma_addr),
-                  ctrl->regmap + SB_ADD_LO);
-        iowrite32(upper_32_bits(ctrl->status.dma_addr),
-                  ctrl->regmap + SB_ADD_HI);
-
-        memset(ctrl->cmd.buf, 0x83, COMMAND_BUFFER_SIZE8);
-        iowrite32(lower_32_bits(ctrl->cmd.dma_addr), ctrl->regmap + CB_ADD_LO);
-        iowrite32(upper_32_bits(ctrl->cmd.dma_addr), ctrl->regmap + CB_ADD_HI);
-
-        ctrl->status.idx = ioread32(ctrl->regmap + HW_STATUS_CNT);
-        if (ctrl->status.idx > RSXX_MAX_OUTSTANDING_CMDS) {
-                dev_crit(&dev->dev, "Failed reading status cnt x%x\n",
-                         ctrl->status.idx);
-                return -EINVAL;
-        }
-        iowrite32(ctrl->status.idx, ctrl->regmap + HW_STATUS_CNT);
-        iowrite32(ctrl->status.idx, ctrl->regmap + SW_STATUS_CNT);
-
-        ctrl->cmd.idx = ioread32(ctrl->regmap + HW_CMD_IDX);
-        if (ctrl->cmd.idx > RSXX_MAX_OUTSTANDING_CMDS) {
-                dev_crit(&dev->dev, "Failed reading cmd cnt x%x\n",
-                         ctrl->status.idx);
-                return -EINVAL;
-        }
-        iowrite32(ctrl->cmd.idx, ctrl->regmap + HW_CMD_IDX);
-        iowrite32(ctrl->cmd.idx, ctrl->regmap + SW_CMD_IDX);
-
-        wmb();
+        st = rsxx_hw_buffers_init(dev, ctrl);
+        if (st)
+                return st;
 
         return 0;
 }
@@ -834,7 +834,7 @@ static int rsxx_dma_stripe_setup(struct rsxx_cardinfo *card,
         return 0;
 }
 
-static int rsxx_dma_configure(struct rsxx_cardinfo *card)
+int rsxx_dma_configure(struct rsxx_cardinfo *card)
 {
         u32 intr_coal;
 
@@ -980,6 +980,103 @@ void rsxx_dma_destroy(struct rsxx_cardinfo *card)
         }
 }
 
+int rsxx_eeh_save_issued_dmas(struct rsxx_cardinfo *card)
+{
+        int i;
+        int j;
+        int cnt;
+        struct rsxx_dma *dma;
+        struct list_head *issued_dmas;
+
+        issued_dmas = kzalloc(sizeof(*issued_dmas) * card->n_targets,
+                              GFP_KERNEL);
+        if (!issued_dmas)
+                return -ENOMEM;
+
+        for (i = 0; i < card->n_targets; i++) {
+                INIT_LIST_HEAD(&issued_dmas[i]);
+                cnt = 0;
+                for (j = 0; j < RSXX_MAX_OUTSTANDING_CMDS; j++) {
+                        dma = get_tracker_dma(card->ctrl[i].trackers, j);
+                        if (dma == NULL)
+                                continue;
+
+                        if (dma->cmd == HW_CMD_BLK_WRITE)
+                                card->ctrl[i].stats.writes_issued--;
+                        else if (dma->cmd == HW_CMD_BLK_DISCARD)
+                                card->ctrl[i].stats.discards_issued--;
+                        else
+                                card->ctrl[i].stats.reads_issued--;
+
+                        list_add_tail(&dma->list, &issued_dmas[i]);
+                        push_tracker(card->ctrl[i].trackers, j);
+                        cnt++;
+                }
+
+                spin_lock(&card->ctrl[i].queue_lock);
+                list_splice(&issued_dmas[i], &card->ctrl[i].queue);
+
+                atomic_sub(cnt, &card->ctrl[i].stats.hw_q_depth);
+                card->ctrl[i].stats.sw_q_depth += cnt;
+                card->ctrl[i].e_cnt = 0;
+
+                list_for_each_entry(dma, &card->ctrl[i].queue, list) {
+                        if (dma->dma_addr)
+                                pci_unmap_page(card->dev, dma->dma_addr,
+                                               get_dma_size(dma),
+                                               dma->cmd == HW_CMD_BLK_WRITE ?
+                                               PCI_DMA_TODEVICE :
+                                               PCI_DMA_FROMDEVICE);
+                }
+                spin_unlock(&card->ctrl[i].queue_lock);
+        }
+
+        kfree(issued_dmas);
+
+        return 0;
+}
+
+void rsxx_eeh_cancel_dmas(struct rsxx_cardinfo *card)
+{
+        struct rsxx_dma *dma;
+        struct rsxx_dma *tmp;
+        int i;
+
+        for (i = 0; i < card->n_targets; i++) {
+                spin_lock(&card->ctrl[i].queue_lock);
+                list_for_each_entry_safe(dma, tmp, &card->ctrl[i].queue, list) {
+                        list_del(&dma->list);
+
+                        rsxx_complete_dma(&card->ctrl[i], dma, DMA_CANCELLED);
+                }
+                spin_unlock(&card->ctrl[i].queue_lock);
+        }
+}
+
+int rsxx_eeh_remap_dmas(struct rsxx_cardinfo *card)
+{
+        struct rsxx_dma *dma;
+        int i;
+
+        for (i = 0; i < card->n_targets; i++) {
+                spin_lock(&card->ctrl[i].queue_lock);
+                list_for_each_entry(dma, &card->ctrl[i].queue, list) {
+                        dma->dma_addr = pci_map_page(card->dev, dma->page,
+                                        dma->pg_off, get_dma_size(dma),
+                                        dma->cmd == HW_CMD_BLK_WRITE ?
+                                        PCI_DMA_TODEVICE :
+                                        PCI_DMA_FROMDEVICE);
+                        if (!dma->dma_addr) {
+                                spin_unlock(&card->ctrl[i].queue_lock);
+                                kmem_cache_free(rsxx_dma_pool, dma);
+                                return -ENOMEM;
+                        }
+                }
+                spin_unlock(&card->ctrl[i].queue_lock);
+        }
+
+        return 0;
+}
 
 int rsxx_dma_init(void)
 {
diff --git a/drivers/block/rsxx/rsxx.h b/drivers/block/rsxx/rsxx.h
index 2e50b65902b7..24ba3642bd89 100644
--- a/drivers/block/rsxx/rsxx.h
+++ b/drivers/block/rsxx/rsxx.h
@@ -27,15 +27,17 @@
 
 /*----------------- IOCTL Definitions -------------------*/
 
+#define RSXX_MAX_DATA 8
+
 struct rsxx_reg_access {
         __u32 addr;
         __u32 cnt;
         __u32 stat;
         __u32 stream;
-        __u32 data[8];
+        __u32 data[RSXX_MAX_DATA];
 };
 
-#define RSXX_MAX_REG_CNT        (8 * (sizeof(__u32)))
+#define RSXX_MAX_REG_CNT        (RSXX_MAX_DATA * (sizeof(__u32)))
 
 #define RSXX_IOC_MAGIC 'r'
 
diff --git a/drivers/block/rsxx/rsxx_cfg.h b/drivers/block/rsxx/rsxx_cfg.h
index c025fe5fdb70..f384c943846d 100644
--- a/drivers/block/rsxx/rsxx_cfg.h
+++ b/drivers/block/rsxx/rsxx_cfg.h
@@ -58,7 +58,7 @@ struct rsxx_card_cfg {
 };
 
 /* Vendor ID Values */
-#define RSXX_VENDOR_ID_TMS_IBM          0
+#define RSXX_VENDOR_ID_IBM              0
 #define RSXX_VENDOR_ID_DSI              1
 #define RSXX_VENDOR_COUNT               2
 
diff --git a/drivers/block/rsxx/rsxx_priv.h b/drivers/block/rsxx/rsxx_priv.h
index a1ac907d8f4c..382e8bf5c03b 100644
--- a/drivers/block/rsxx/rsxx_priv.h
+++ b/drivers/block/rsxx/rsxx_priv.h
@@ -45,16 +45,13 @@
 
 struct proc_cmd;
 
-#define PCI_VENDOR_ID_TMS_IBM           0x15B6
-#define PCI_DEVICE_ID_RS70_FLASH        0x0019
-#define PCI_DEVICE_ID_RS70D_FLASH       0x001A
-#define PCI_DEVICE_ID_RS80_FLASH        0x001C
-#define PCI_DEVICE_ID_RS81_FLASH        0x001E
+#define PCI_DEVICE_ID_FS70_FLASH        0x04A9
+#define PCI_DEVICE_ID_FS80_FLASH        0x04AA
 
 #define RS70_PCI_REV_SUPPORTED  4
 
 #define DRIVER_NAME "rsxx"
-#define DRIVER_VERSION "3.7"
+#define DRIVER_VERSION "4.0"
 
 /* Block size is 4096 */
 #define RSXX_HW_BLK_SHIFT               12
@@ -67,6 +64,9 @@ struct proc_cmd;
 #define RSXX_MAX_OUTSTANDING_CMDS       255
 #define RSXX_CS_IDX_MASK                0xff
 
+#define STATUS_BUFFER_SIZE8     4096
+#define COMMAND_BUFFER_SIZE8    4096
+
 #define RSXX_MAX_TARGETS        8
 
 struct dma_tracker_list;
@@ -91,6 +91,9 @@ struct rsxx_dma_stats {
         u32 discards_failed;
         u32 done_rescheduled;
         u32 issue_rescheduled;
+        u32 dma_sw_err;
+        u32 dma_hw_fault;
+        u32 dma_cancelled;
         u32 sw_q_depth;         /* Number of DMAs on the SW queue. */
         atomic_t hw_q_depth;    /* Number of DMAs queued to HW. */
 };
@@ -116,6 +119,7 @@ struct rsxx_dma_ctrl {
 struct rsxx_cardinfo {
         struct pci_dev          *dev;
         unsigned int            halt;
+        unsigned int            eeh_state;
 
         void                    __iomem *regmap;
         spinlock_t              irq_lock;
@@ -224,6 +228,7 @@ enum rsxx_pci_regmap {
         PERF_RD512_HI   = 0xac,
         PERF_WR512_LO   = 0xb0,
         PERF_WR512_HI   = 0xb4,
+        PCI_RECONFIG    = 0xb8,
 };
 
 enum rsxx_intr {
@@ -237,6 +242,8 @@ enum rsxx_intr {
         CR_INTR_DMA5    = 0x00000080,
         CR_INTR_DMA6    = 0x00000100,
         CR_INTR_DMA7    = 0x00000200,
+        CR_INTR_ALL_C   = 0x0000003f,
+        CR_INTR_ALL_G   = 0x000003ff,
         CR_INTR_DMA_ALL = 0x000003f5,
         CR_INTR_ALL     = 0xffffffff,
 };
@@ -253,8 +260,14 @@ enum rsxx_pci_reset {
         DMA_QUEUE_RESET         = 0x00000001,
 };
 
+enum rsxx_hw_fifo_flush {
+        RSXX_FLUSH_BUSY         = 0x00000002,
+        RSXX_FLUSH_TIMEOUT      = 0x00000004,
+};
+
 enum rsxx_pci_revision {
         RSXX_DISCARD_SUPPORT = 2,
+        RSXX_EEH_SUPPORT     = 3,
 };
 
 enum rsxx_creg_cmd {
@@ -360,11 +373,17 @@ int rsxx_dma_setup(struct rsxx_cardinfo *card);
 void rsxx_dma_destroy(struct rsxx_cardinfo *card);
 int rsxx_dma_init(void);
 void rsxx_dma_cleanup(void);
+void rsxx_dma_queue_reset(struct rsxx_cardinfo *card);
+int rsxx_dma_configure(struct rsxx_cardinfo *card);
 int rsxx_dma_queue_bio(struct rsxx_cardinfo *card,
                            struct bio *bio,
                            atomic_t *n_dmas,
                            rsxx_dma_cb cb,
                            void *cb_data);
+int rsxx_hw_buffers_init(struct pci_dev *dev, struct rsxx_dma_ctrl *ctrl);
+int rsxx_eeh_save_issued_dmas(struct rsxx_cardinfo *card);
+void rsxx_eeh_cancel_dmas(struct rsxx_cardinfo *card);
+int rsxx_eeh_remap_dmas(struct rsxx_cardinfo *card);
 
 /***** cregs.c *****/
 int rsxx_creg_write(struct rsxx_cardinfo *card, u32 addr,
@@ -389,10 +408,11 @@ int rsxx_creg_setup(struct rsxx_cardinfo *card);
 void rsxx_creg_destroy(struct rsxx_cardinfo *card);
 int rsxx_creg_init(void);
 void rsxx_creg_cleanup(void);
-
 int rsxx_reg_access(struct rsxx_cardinfo *card,
                         struct rsxx_reg_access __user *ucmd,
                         int read);
+void rsxx_eeh_save_issued_creg(struct rsxx_cardinfo *card);
+void rsxx_kick_creg_queue(struct rsxx_cardinfo *card);
 
 
 
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index de1f319f7bd7..dd5b2fed97e9 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -164,7 +164,7 @@ static void make_response(struct xen_blkif *blkif, u64 id,
 
 #define foreach_grant_safe(pos, n, rbtree, node) \
         for ((pos) = container_of(rb_first((rbtree)), typeof(*(pos)), node), \
-             (n) = rb_next(&(pos)->node); \
+             (n) = (&(pos)->node != NULL) ? rb_next(&(pos)->node) : NULL; \
              &(pos)->node != NULL; \
              (pos) = container_of(n, typeof(*(pos)), node), \
              (n) = (&(pos)->node != NULL) ? rb_next(&(pos)->node) : NULL)
@@ -381,8 +381,8 @@ irqreturn_t xen_blkif_be_int(int irq, void *dev_id)
 
 static void print_stats(struct xen_blkif *blkif)
 {
-        pr_info("xen-blkback (%s): oo %3d  |  rd %4d  |  wr %4d  |  f %4d"
-                 "  |  ds %4d\n",
+        pr_info("xen-blkback (%s): oo %3llu  |  rd %4llu  |  wr %4llu  |  f %4llu"
+                 "  |  ds %4llu\n",
                  current->comm, blkif->st_oo_req,
                  blkif->st_rd_req, blkif->st_wr_req,
                  blkif->st_f_req, blkif->st_ds_req);
@@ -442,7 +442,7 @@ int xen_blkif_schedule(void *arg)
 }
 
 struct seg_buf {
-        unsigned long buf;
+        unsigned int offset;
         unsigned int nsec;
 };
 /*
@@ -621,30 +621,21 @@ static int xen_blkbk_map(struct blkif_request *req,
                                  * If this is a new persistent grant
                                  * save the handler
                                  */
-                                persistent_gnts[i]->handle = map[j].handle;
-                                persistent_gnts[i]->dev_bus_addr =
-                                        map[j++].dev_bus_addr;
+                                persistent_gnts[i]->handle = map[j++].handle;
                         }
                         pending_handle(pending_req, i) =
                                 persistent_gnts[i]->handle;
 
                         if (ret)
                                 continue;
-
-                        seg[i].buf = persistent_gnts[i]->dev_bus_addr |
-                                (req->u.rw.seg[i].first_sect << 9);
                 } else {
-                        pending_handle(pending_req, i) = map[j].handle;
+                        pending_handle(pending_req, i) = map[j++].handle;
                         bitmap_set(pending_req->unmap_seg, i, 1);
 
-                        if (ret) {
-                                j++;
+                        if (ret)
                                 continue;
-                        }
-
-                        seg[i].buf = map[j++].dev_bus_addr |
-                                (req->u.rw.seg[i].first_sect << 9);
                 }
+                seg[i].offset = (req->u.rw.seg[i].first_sect << 9);
         }
         return ret;
 }
@@ -679,6 +670,16 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
         return err;
 }
 
+static int dispatch_other_io(struct xen_blkif *blkif,
+                             struct blkif_request *req,
+                             struct pending_req *pending_req)
+{
+        free_req(pending_req);
+        make_response(blkif, req->u.other.id, req->operation,
+                      BLKIF_RSP_EOPNOTSUPP);
+        return -EIO;
+}
+
 static void xen_blk_drain_io(struct xen_blkif *blkif)
 {
         atomic_set(&blkif->drain, 1);
@@ -800,17 +801,30 @@ __do_block_io_op(struct xen_blkif *blkif)
 
                 /* Apply all sanity checks to /private copy/ of request. */
                 barrier();
-                if (unlikely(req.operation == BLKIF_OP_DISCARD)) {
+
+                switch (req.operation) {
+                case BLKIF_OP_READ:
+                case BLKIF_OP_WRITE:
+                case BLKIF_OP_WRITE_BARRIER:
+                case BLKIF_OP_FLUSH_DISKCACHE:
+                        if (dispatch_rw_block_io(blkif, &req, pending_req))
+                                goto done;
+                        break;
+                case BLKIF_OP_DISCARD:
                         free_req(pending_req);
                         if (dispatch_discard_io(blkif, &req))
-                                break;
-                } else if (dispatch_rw_block_io(blkif, &req, pending_req))
+                                goto done;
                         break;
+                default:
+                        if (dispatch_other_io(blkif, &req, pending_req))
+                                goto done;
+                        break;
+                }
 
                 /* Yield point for this unbounded loop. */
                 cond_resched();
         }
-
+done:
         return more_to_do;
 }
 
@@ -904,7 +918,8 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
                 pr_debug(DRV_PFX "access denied: %s of [%llu,%llu] on dev=%04x\n",
                          operation == READ ? "read" : "write",
                          preq.sector_number,
-                         preq.sector_number + preq.nr_sects, preq.dev);
+                         preq.sector_number + preq.nr_sects,
+                         blkif->vbd.pdevice);
                 goto fail_response;
         }
 
@@ -947,7 +962,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
                        (bio_add_page(bio,
                                      pages[i],
                                      seg[i].nsec << 9,
-                                     seg[i].buf & ~PAGE_MASK) == 0)) {
+                                     seg[i].offset) == 0)) {
 
                         bio = bio_alloc(GFP_KERNEL, nseg-i);
                         if (unlikely(bio == NULL))
@@ -977,13 +992,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
                 bio->bi_end_io  = end_block_io_op;
         }
 
-        /*
-         * We set it one so that the last submit_bio does not have to call
-         * atomic_inc.
-         */
         atomic_set(&pending_req->pendcnt, nbio);
-
-        /* Get a reference count for the disk queue and start sending I/O */
         blk_start_plug(&plug);
 
         for (i = 0; i < nbio; i++)
@@ -1011,6 +1020,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
  fail_put_bio:
         for (i = 0; i < nbio; i++)
                 bio_put(biolist[i]);
+        atomic_set(&pending_req->pendcnt, 1);
         __end_block_io_op(pending_req, -EINVAL);
         msleep(1); /* back off a bit */
         return -EIO;
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 6072390c7f57..60103e2517ba 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -77,11 +77,18 @@ struct blkif_x86_32_request_discard {
         uint64_t       nr_sectors;
 } __attribute__((__packed__));
 
+struct blkif_x86_32_request_other {
+        uint8_t        _pad1;
+        blkif_vdev_t   _pad2;
+        uint64_t       id;           /* private guest value, echoed in resp  */
+} __attribute__((__packed__));
+
 struct blkif_x86_32_request {
         uint8_t        operation;    /* BLKIF_OP_???                         */
         union {
                 struct blkif_x86_32_request_rw rw;
                 struct blkif_x86_32_request_discard discard;
+                struct blkif_x86_32_request_other other;
         } u;
 } __attribute__((__packed__));
 
@@ -113,11 +120,19 @@ struct blkif_x86_64_request_discard {
         uint64_t       nr_sectors;
 } __attribute__((__packed__));
 
+struct blkif_x86_64_request_other {
+        uint8_t        _pad1;
+        blkif_vdev_t   _pad2;
+        uint32_t       _pad3;        /* offsetof(blkif_..,u.discard.id)==8   */
+        uint64_t       id;           /* private guest value, echoed in resp  */
+} __attribute__((__packed__));
+
 struct blkif_x86_64_request {
         uint8_t        operation;    /* BLKIF_OP_???                         */
         union {
                 struct blkif_x86_64_request_rw rw;
                 struct blkif_x86_64_request_discard discard;
+                struct blkif_x86_64_request_other other;
         } u;
 } __attribute__((__packed__));
 
@@ -172,7 +187,6 @@ struct persistent_gnt {
         struct page *page;
         grant_ref_t gnt;
         grant_handle_t handle;
-        uint64_t dev_bus_addr;
         struct rb_node node;
 };
 
@@ -208,13 +222,13 @@ struct xen_blkif {
 
         /* statistics */
         unsigned long           st_print;
-        int                     st_rd_req;
-        int                     st_wr_req;
-        int                     st_oo_req;
-        int                     st_f_req;
-        int                     st_ds_req;
-        int                     st_rd_sect;
-        int                     st_wr_sect;
+        unsigned long long                      st_rd_req;
+        unsigned long long                      st_wr_req;
+        unsigned long long                      st_oo_req;
+        unsigned long long                      st_f_req;
+        unsigned long long                      st_ds_req;
+        unsigned long long                      st_rd_sect;
+        unsigned long long                      st_wr_sect;
 
         wait_queue_head_t       waiting_to_free;
 };
@@ -278,6 +292,11 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
                 dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                 break;
         default:
+                /*
+                 * Don't know how to translate this op. Only get the
+                 * ID so failure can be reported to the frontend.
+                 */
+                dst->u.other.id = src->u.other.id;
                 break;
         }
 }
@@ -309,6 +328,11 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
                 dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                 break;
         default:
+                /*
+                 * Don't know how to translate this op. Only get the
+                 * ID so failure can be reported to the frontend.
+                 */
+                dst->u.other.id = src->u.other.id;
                 break;
         }
 }
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 5e237f630c47..8bfd1bcf95ec 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -230,13 +230,13 @@ int __init xen_blkif_interface_init(void)
         }                                                               \
         static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL)
 
-VBD_SHOW(oo_req,  "%d\n", be->blkif->st_oo_req);
-VBD_SHOW(rd_req,  "%d\n", be->blkif->st_rd_req);
-VBD_SHOW(wr_req,  "%d\n", be->blkif->st_wr_req);
-VBD_SHOW(f_req,  "%d\n", be->blkif->st_f_req);
-VBD_SHOW(ds_req,  "%d\n", be->blkif->st_ds_req);
-VBD_SHOW(rd_sect, "%d\n", be->blkif->st_rd_sect);
-VBD_SHOW(wr_sect, "%d\n", be->blkif->st_wr_sect);
+VBD_SHOW(oo_req,  "%llu\n", be->blkif->st_oo_req);
+VBD_SHOW(rd_req,  "%llu\n", be->blkif->st_rd_req);
+VBD_SHOW(wr_req,  "%llu\n", be->blkif->st_wr_req);
+VBD_SHOW(f_req,  "%llu\n", be->blkif->st_f_req);
+VBD_SHOW(ds_req,  "%llu\n", be->blkif->st_ds_req);
+VBD_SHOW(rd_sect, "%llu\n", be->blkif->st_rd_sect);
+VBD_SHOW(wr_sect, "%llu\n", be->blkif->st_wr_sect);
 
 static struct attribute *xen_vbdstat_attrs[] = {
         &dev_attr_oo_req.attr,
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index c3dae2e0f290..a894f88762d8 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -44,7 +44,7 @@
 #include <linux/mutex.h>
 #include <linux/scatterlist.h>
 #include <linux/bitmap.h>
-#include <linux/llist.h>
+#include <linux/list.h>
 
 #include <xen/xen.h>
 #include <xen/xenbus.h>
@@ -68,13 +68,12 @@ enum blkif_state {
 struct grant {
         grant_ref_t gref;
         unsigned long pfn;
-        struct llist_node node;
+        struct list_head node;
 };
 
 struct blk_shadow {
         struct blkif_request req;
         struct request *request;
-        unsigned long frame[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         struct grant *grants_used[BLKIF_MAX_SEGMENTS_PER_REQUEST];
 };
 
@@ -105,7 +104,7 @@ struct blkfront_info
         struct work_struct work;
         struct gnttab_free_callback callback;
         struct blk_shadow shadow[BLK_RING_SIZE];
-        struct llist_head persistent_gnts;
+        struct list_head persistent_gnts;
         unsigned int persistent_gnts_c;
         unsigned long shadow_free;
         unsigned int feature_flush;
@@ -165,6 +164,69 @@ static int add_id_to_freelist(struct blkfront_info *info,
         return 0;
 }
 
+static int fill_grant_buffer(struct blkfront_info *info, int num)
+{
+        struct page *granted_page;
+        struct grant *gnt_list_entry, *n;
+        int i = 0;
+
+        while(i < num) {
+                gnt_list_entry = kzalloc(sizeof(struct grant), GFP_NOIO);
+                if (!gnt_list_entry)
+                        goto out_of_memory;
+
+                granted_page = alloc_page(GFP_NOIO);
+                if (!granted_page) {
+                        kfree(gnt_list_entry);
+                        goto out_of_memory;
+                }
+
+                gnt_list_entry->pfn = page_to_pfn(granted_page);
+                gnt_list_entry->gref = GRANT_INVALID_REF;
+                list_add(&gnt_list_entry->node, &info->persistent_gnts);
+                i++;
+        }
+
+        return 0;
+
+out_of_memory:
+        list_for_each_entry_safe(gnt_list_entry, n,
+                                 &info->persistent_gnts, node) {
+                list_del(&gnt_list_entry->node);
+                __free_page(pfn_to_page(gnt_list_entry->pfn));
+                kfree(gnt_list_entry);
+                i--;
+        }
+        BUG_ON(i != 0);
+        return -ENOMEM;
+}
+
+static struct grant *get_grant(grant_ref_t *gref_head,
+                               struct blkfront_info *info)
+{
+        struct grant *gnt_list_entry;
+        unsigned long buffer_mfn;
+
+        BUG_ON(list_empty(&info->persistent_gnts));
+        gnt_list_entry = list_first_entry(&info->persistent_gnts, struct grant,
+                                          node);
+        list_del(&gnt_list_entry->node);
+
+        if (gnt_list_entry->gref != GRANT_INVALID_REF) {
+                info->persistent_gnts_c--;
+                return gnt_list_entry;
+        }
+
+        /* Assign a gref to this page */
+        gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);
+        BUG_ON(gnt_list_entry->gref == -ENOSPC);
+        buffer_mfn = pfn_to_mfn(gnt_list_entry->pfn);
+        gnttab_grant_foreign_access_ref(gnt_list_entry->gref,
+                                        info->xbdev->otherend_id,
+                                        buffer_mfn, 0);
+        return gnt_list_entry;
+}
+
 static const char *op_name(int op)
 {
         static const char *const names[] = {
@@ -293,7 +355,6 @@ static int blkif_ioctl(struct block_device *bdev, fmode_t mode,
 static int blkif_queue_request(struct request *req)
 {
         struct blkfront_info *info = req->rq_disk->private_data;
-        unsigned long buffer_mfn;
         struct blkif_request *ring_req;
         unsigned long id;
         unsigned int fsect, lsect;
@@ -306,7 +367,6 @@ static int blkif_queue_request(struct request *req)
          */
         bool new_persistent_gnts;
         grant_ref_t gref_head;
-        struct page *granted_page;
         struct grant *gnt_list_entry = NULL;
         struct scatterlist *sg;
 
@@ -370,41 +430,8 @@ static int blkif_queue_request(struct request *req)
                         fsect = sg->offset >> 9;
                         lsect = fsect + (sg->length >> 9) - 1;
 
-                        if (info->persistent_gnts_c) {
-                                BUG_ON(llist_empty(&info->persistent_gnts));
-                                gnt_list_entry = llist_entry(
-                                        llist_del_first(&info->persistent_gnts),
-                                        struct grant, node);
-
-                                ref = gnt_list_entry->gref;
-                                buffer_mfn = pfn_to_mfn(gnt_list_entry->pfn);
-                                info->persistent_gnts_c--;
-                        } else {
-                                ref = gnttab_claim_grant_reference(&gref_head);
-                                BUG_ON(ref == -ENOSPC);
-
-                                gnt_list_entry =
-                                        kmalloc(sizeof(struct grant),
-                                                         GFP_ATOMIC);
-                                if (!gnt_list_entry)
-                                        return -ENOMEM;
-
-                                granted_page = alloc_page(GFP_ATOMIC);
-                                if (!granted_page) {
-                                        kfree(gnt_list_entry);
-                                        return -ENOMEM;
-                                }
-
-                                gnt_list_entry->pfn =
-                                        page_to_pfn(granted_page);
-                                gnt_list_entry->gref = ref;
-
-                                buffer_mfn = pfn_to_mfn(page_to_pfn(
-                                                                granted_page));
-                                gnttab_grant_foreign_access_ref(ref,
-                                        info->xbdev->otherend_id,
-                                        buffer_mfn, 0);
-                        }
+                        gnt_list_entry = get_grant(&gref_head, info);
+                        ref = gnt_list_entry->gref;
 
                         info->shadow[id].grants_used[i] = gnt_list_entry;
 
@@ -435,7 +462,6 @@ static int blkif_queue_request(struct request *req)
                                 kunmap_atomic(shared_data);
                         }
 
-                        info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn);
                         ring_req->u.rw.seg[i] =
                                         (struct blkif_request_segment) {
                                                 .gref       = ref,
@@ -790,9 +816,8 @@ static void blkif_restart_queue(struct work_struct *work)
 
 static void blkif_free(struct blkfront_info *info, int suspend)
 {
-        struct llist_node *all_gnts;
-        struct grant *persistent_gnt, *tmp;
-        struct llist_node *n;
+        struct grant *persistent_gnt;
+        struct grant *n;
 
         /* Prevent new requests being issued until we fix things up. */
         spin_lock_irq(&info->io_lock);
@@ -803,22 +828,20 @@ static void blkif_free(struct blkfront_info *info, int suspend)
                 blk_stop_queue(info->rq);
 
         /* Remove all persistent grants */
-        if (info->persistent_gnts_c) {
-                all_gnts = llist_del_all(&info->persistent_gnts);
-                persistent_gnt = llist_entry(all_gnts, typeof(*(persistent_gnt)), node);
-                while (persistent_gnt) {
-                        gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
+        if (!list_empty(&info->persistent_gnts)) {
+                list_for_each_entry_safe(persistent_gnt, n,
+                                         &info->persistent_gnts, node) {
+                        list_del(&persistent_gnt->node);
+                        if (persistent_gnt->gref != GRANT_INVALID_REF) {
+                                gnttab_end_foreign_access(persistent_gnt->gref,
+                                                          0, 0UL);
+                                info->persistent_gnts_c--;
+                        }
                         __free_page(pfn_to_page(persistent_gnt->pfn));
-                        tmp = persistent_gnt;
-                        n = persistent_gnt->node.next;
-                        if (n)
-                                persistent_gnt = llist_entry(n, typeof(*(persistent_gnt)), node);
-                        else
-                                persistent_gnt = NULL;
-                        kfree(tmp);
+                        kfree(persistent_gnt);
                 }
-                info->persistent_gnts_c = 0;
         }
+        BUG_ON(info->persistent_gnts_c != 0);
 
         /* No more gnttab callback work. */
         gnttab_cancel_free_callback(&info->callback);
@@ -875,7 +898,7 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
         }
         /* Add the persistent grant into the list of free grants */
         for (i = 0; i < s->req.u.rw.nr_segments; i++) {
-                llist_add(&s->grants_used[i]->node, &info->persistent_gnts);
+                list_add(&s->grants_used[i]->node, &info->persistent_gnts);
                 info->persistent_gnts_c++;
         }
 }
@@ -1013,6 +1036,12 @@ static int setup_blkring(struct xenbus_device *dev,
 
         sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
 
+        /* Allocate memory for grants */
+        err = fill_grant_buffer(info, BLK_RING_SIZE *
+                                      BLKIF_MAX_SEGMENTS_PER_REQUEST);
+        if (err)
+                goto fail;
+
         err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring));
         if (err < 0) {
                 free_page((unsigned long)sring);
@@ -1171,7 +1200,7 @@ static int blkfront_probe(struct xenbus_device *dev,
         spin_lock_init(&info->io_lock);
         info->xbdev = dev;
         info->vdevice = vdevice;
-        init_llist_head(&info->persistent_gnts);
+        INIT_LIST_HEAD(&info->persistent_gnts);
         info->persistent_gnts_c = 0;
         info->connected = BLKIF_STATE_DISCONNECTED;
         INIT_WORK(&info->work, blkif_restart_queue);
@@ -1203,11 +1232,10 @@ static int blkif_recover(struct blkfront_info *info)
         int j;
 
         /* Stage 1: Make a safe copy of the shadow state. */
-        copy = kmalloc(sizeof(info->shadow),
+        copy = kmemdup(info->shadow, sizeof(info->shadow),
                        GFP_NOIO | __GFP_REPEAT | __GFP_HIGH);
         if (!copy)
                 return -ENOMEM;
-        memcpy(copy, info->shadow, sizeof(info->shadow));
 
         /* Stage 2: Set up free list. */
         memset(&info->shadow, 0, sizeof(info->shadow));
@@ -1236,7 +1264,7 @@ static int blkif_recover(struct blkfront_info *info)
                                 gnttab_grant_foreign_access_ref(
                                         req->u.rw.seg[j].gref,
                                         info->xbdev->otherend_id,
-                                        pfn_to_mfn(info->shadow[req->u.rw.id].frame[j]),
+                                        pfn_to_mfn(copy[i].grants_used[j]->pfn),
                                         0);
                 }
                 info->shadow[req->u.rw.id].req = *req;
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 937bc286591f..57a8774f0b4e 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -730,7 +730,6 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
             policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) {
                 cpumask_copy(policy->cpus, perf->shared_cpu_map);
         }
-        cpumask_copy(policy->related_cpus, perf->shared_cpu_map);
 
 #ifdef CONFIG_SMP
         dmi_check_system(sw_any_bug_dmi_table);
@@ -742,7 +741,6 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
         if (check_amd_hwpstate_cpu(cpu) && !acpi_pstate_strict) {
                 cpumask_clear(policy->cpus);
                 cpumask_set_cpu(cpu, policy->cpus);
-                cpumask_copy(policy->related_cpus, cpu_sibling_mask(cpu));
                 policy->shared_type = CPUFREQ_SHARED_TYPE_HW;
                 pr_info_once(PFX "overriding BIOS provided _PSD data\n");
         }
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 2fd779eb1ed1..bfd6273fd873 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -180,15 +180,19 @@ static void cpufreq_stats_free_sysfs(unsigned int cpu)
 {
         struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
 
-        if (!cpufreq_frequency_get_table(cpu))
+        if (!policy)
                 return;
 
-        if (policy && !policy_is_shared(policy)) {
+        if (!cpufreq_frequency_get_table(cpu))
+                goto put_ref;
+
+        if (!policy_is_shared(policy)) {
                 pr_debug("%s: Free sysfs stat\n", __func__);
                 sysfs_remove_group(&policy->kobj, &stats_attr_group);
         }
-        if (policy)
-                cpufreq_cpu_put(policy);
+
+put_ref:
+        cpufreq_cpu_put(policy);
 }
 
 static int cpufreq_stats_create_table(struct cpufreq_policy *policy,
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index f6dd1e761129..ad72922919ed 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -358,14 +358,14 @@ static void intel_pstate_sysfs_expose_params(void)
 static int intel_pstate_min_pstate(void)
 {
         u64 value;
-        rdmsrl(0xCE, value);
+        rdmsrl(MSR_PLATFORM_INFO, value);
         return (value >> 40) & 0xFF;
 }
 
 static int intel_pstate_max_pstate(void)
 {
         u64 value;
-        rdmsrl(0xCE, value);
+        rdmsrl(MSR_PLATFORM_INFO, value);
         return (value >> 8) & 0xFF;
 }
 
@@ -373,7 +373,7 @@ static int intel_pstate_turbo_pstate(void)
 {
         u64 value;
         int nont, ret;
-        rdmsrl(0x1AD, value);
+        rdmsrl(MSR_NHM_TURBO_RATIO_LIMIT, value);
         nont = intel_pstate_max_pstate();
         ret = ((value) & 255);
         if (ret <= nont)
@@ -454,7 +454,7 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu,
                                         sample->idletime_us * 100,
                                         sample->duration_us);
         core_pct = div64_u64(sample->aperf * 100, sample->mperf);
-        sample->freq = cpu->pstate.turbo_pstate * core_pct * 1000;
+        sample->freq = cpu->pstate.max_pstate * core_pct * 1000;
 
         sample->core_pct_busy = div_s64((sample->pstate_pct_busy * core_pct),
                                         100);
@@ -752,6 +752,29 @@ static struct cpufreq_driver intel_pstate_driver = {
 
 static int __initdata no_load;
 
+static int intel_pstate_msrs_not_valid(void)
+{
+        /* Check that all the msr's we are using are valid. */
+        u64 aperf, mperf, tmp;
+
+        rdmsrl(MSR_IA32_APERF, aperf);
+        rdmsrl(MSR_IA32_MPERF, mperf);
+
+        if (!intel_pstate_min_pstate() ||
+                !intel_pstate_max_pstate() ||
+                !intel_pstate_turbo_pstate())
+                return -ENODEV;
+
+        rdmsrl(MSR_IA32_APERF, tmp);
+        if (!(tmp - aperf))
+                return -ENODEV;
+
+        rdmsrl(MSR_IA32_MPERF, tmp);
+        if (!(tmp - mperf))
+                return -ENODEV;
+
+        return 0;
+}
 static int __init intel_pstate_init(void)
 {
         int cpu, rc = 0;
@@ -764,6 +787,9 @@ static int __init intel_pstate_init(void)
         if (!id)
                 return -ENODEV;
 
+        if (intel_pstate_msrs_not_valid())
+                return -ENODEV;
+
         pr_info("Intel P-state driver initializing.\n");
 
         all_cpu_data = vmalloc(sizeof(void *) * num_possible_cpus());
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index b2a0a0726a54..cf268b14ae9a 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -1650,11 +1650,7 @@ struct caam_alg_template {
 };
 
 static struct caam_alg_template driver_algs[] = {
-        /*
-         * single-pass ipsec_esp descriptor
-         * authencesn(*,*) is also registered, although not present
-         * explicitly here.
-         */
+        /* single-pass ipsec_esp descriptor */
         {
                 .name = "authenc(hmac(md5),cbc(aes))",
                 .driver_name = "authenc-hmac-md5-cbc-aes-caam",
@@ -2217,9 +2213,7 @@ static int __init caam_algapi_init(void)
         for (i = 0; i < ARRAY_SIZE(driver_algs); i++) {
                 /* TODO: check if h/w supports alg */
                 struct caam_crypto_alg *t_alg;
-                bool done = false;
 
-authencesn:
                 t_alg = caam_alg_alloc(ctrldev, &driver_algs[i]);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
@@ -2233,25 +2227,8 @@ authencesn:
                         dev_warn(ctrldev, "%s alg registration failed\n",
                                 t_alg->crypto_alg.cra_driver_name);
                         kfree(t_alg);
-                } else {
+                } else
                         list_add_tail(&t_alg->entry, &priv->alg_list);
-                        if (driver_algs[i].type == CRYPTO_ALG_TYPE_AEAD &&
-                            !memcmp(driver_algs[i].name, "authenc", 7) &&
-                            !done) {
-                                char *name;
-
-                                name = driver_algs[i].name;
-                                memmove(name + 10, name + 7, strlen(name) - 7);
-                                memcpy(name + 7, "esn", 3);
-
-                                name = driver_algs[i].driver_name;
-                                memmove(name + 10, name + 7, strlen(name) - 7);
-                                memcpy(name + 7, "esn", 3);
-
-                                done = true;
-                                goto authencesn;
-                        }
-                }
         }
         if (!list_empty(&priv->alg_list))
                 dev_info(ctrldev, "%s algorithms registered in /proc/crypto\n",
diff --git a/drivers/crypto/caam/compat.h b/drivers/crypto/caam/compat.h
index cf15e7813801..762aeff626ac 100644
--- a/drivers/crypto/caam/compat.h
+++ b/drivers/crypto/caam/compat.h
@@ -23,7 +23,6 @@
 #include <linux/types.h>
 #include <linux/debugfs.h>
 #include <linux/circ_buf.h>
-#include <linux/string.h>
 #include <net/xfrm.h>
 
 #include <crypto/algapi.h>
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 09b184adf31b..5b2b5e61e4f9 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -38,7 +38,6 @@
 #include <linux/spinlock.h>
 #include <linux/rtnetlink.h>
 #include <linux/slab.h>
-#include <linux/string.h>
 
 #include <crypto/algapi.h>
 #include <crypto/aes.h>
@@ -1974,11 +1973,7 @@ struct talitos_alg_template {
 };
 
 static struct talitos_alg_template driver_algs[] = {
-        /*
-         * AEAD algorithms. These use a single-pass ipsec_esp descriptor.
-         * authencesn(*,*) is also registered, although not present
-         * explicitly here.
-         */
+        /* AEAD algorithms.  These use a single-pass ipsec_esp descriptor */
         {       .type = CRYPTO_ALG_TYPE_AEAD,
                 .alg.crypto = {
                         .cra_name = "authenc(hmac(sha1),cbc(aes))",
@@ -2820,9 +2815,7 @@ static int talitos_probe(struct platform_device *ofdev)
                 if (hw_supports(dev, driver_algs[i].desc_hdr_template)) {
                         struct talitos_crypto_alg *t_alg;
                         char *name = NULL;
-                        bool authenc = false;
 
-authencesn:
                         t_alg = talitos_alg_alloc(dev, &driver_algs[i]);
                         if (IS_ERR(t_alg)) {
                                 err = PTR_ERR(t_alg);
@@ -2837,8 +2830,6 @@ authencesn:
                                 err = crypto_register_alg(
                                                 &t_alg->algt.alg.crypto);
                                 name = t_alg->algt.alg.crypto.cra_driver_name;
-                                authenc = authenc ? !authenc :
-                                          !(bool)memcmp(name, "authenc", 7);
                                 break;
                         case CRYPTO_ALG_TYPE_AHASH:
                                 err = crypto_register_ahash(
@@ -2851,25 +2842,8 @@ authencesn:
                                 dev_err(dev, "%s alg registration failed\n",
                                         name);
                                 kfree(t_alg);
-                        } else {
+                        } else
                                 list_add_tail(&t_alg->entry, &priv->alg_list);
-                                if (authenc) {
-                                        struct crypto_alg *alg =
-                                                &driver_algs[i].alg.crypto;
-
-                                        name = alg->cra_name;
-                                        memmove(name + 10, name + 7,
-                                                strlen(name) - 7);
-                                        memcpy(name + 7, "esn", 3);
-
-                                        name = alg->cra_driver_name;
-                                        memmove(name + 10, name + 7,
-                                                strlen(name) - 7);
-                                        memcpy(name + 7, "esn", 3);
-
-                                        goto authencesn;
-                                }
-                        }
                 }
         }
         if (!list_empty(&priv->alg_list))
diff --git a/drivers/dma/dw_dmac.c b/drivers/dma/dw_dmac.c
index c599558faeda..43a5329d4483 100644
--- a/drivers/dma/dw_dmac.c
+++ b/drivers/dma/dw_dmac.c
@@ -1001,6 +1001,13 @@ static inline void convert_burst(u32 *maxburst)
                 *maxburst = 0;
 }
 
+static inline void convert_slave_id(struct dw_dma_chan *dwc)
+{
+        struct dw_dma *dw = to_dw_dma(dwc->chan.device);
+
+        dwc->dma_sconfig.slave_id -= dw->request_line_base;
+}
+
 static int
 set_runtime_config(struct dma_chan *chan, struct dma_slave_config *sconfig)
 {
@@ -1015,6 +1022,7 @@ set_runtime_config(struct dma_chan *chan, struct dma_slave_config *sconfig)
 
         convert_burst(&dwc->dma_sconfig.src_maxburst);
         convert_burst(&dwc->dma_sconfig.dst_maxburst);
+        convert_slave_id(dwc);
 
         return 0;
 }
@@ -1276,9 +1284,9 @@ static struct dma_chan *dw_dma_xlate(struct of_phandle_args *dma_spec,
         if (dma_spec->args_count != 3)
                 return NULL;
 
-        fargs.req = be32_to_cpup(dma_spec->args+0);
-        fargs.src = be32_to_cpup(dma_spec->args+1);
-        fargs.dst = be32_to_cpup(dma_spec->args+2);
+        fargs.req = dma_spec->args[0];
+        fargs.src = dma_spec->args[1];
+        fargs.dst = dma_spec->args[2];
 
         if (WARN_ON(fargs.req >= DW_DMA_MAX_NR_REQUESTS ||
                     fargs.src >= dw->nr_masters ||
@@ -1628,6 +1636,7 @@ dw_dma_parse_dt(struct platform_device *pdev)
 
 static int dw_probe(struct platform_device *pdev)
 {
+        const struct platform_device_id *match;
         struct dw_dma_platform_data *pdata;
         struct resource         *io;
         struct dw_dma           *dw;
@@ -1711,6 +1720,11 @@ static int dw_probe(struct platform_device *pdev)
                 memcpy(dw->data_width, pdata->data_width, 4);
         }
 
+        /* Get the base request line if set */
+        match = platform_get_device_id(pdev);
+        if (match)
+                dw->request_line_base = (unsigned int)match->driver_data;
+
         /* Calculate all channel mask before DMA setup */
         dw->all_chan_mask = (1 << nr_channels) - 1;
 
@@ -1906,7 +1920,8 @@ MODULE_DEVICE_TABLE(of, dw_dma_id_table);
 #endif
 
 static const struct platform_device_id dw_dma_ids[] = {
-        { "INTL9C60", 0 },
+        /* Name,        Request Line Base */
+        { "INTL9C60",   (kernel_ulong_t)16 },
         { }
 };
 
diff --git a/drivers/dma/dw_dmac_regs.h b/drivers/dma/dw_dmac_regs.h
index cf0ce5c77d60..4d02c3669b75 100644
--- a/drivers/dma/dw_dmac_regs.h
+++ b/drivers/dma/dw_dmac_regs.h
@@ -247,6 +247,7 @@ struct dw_dma {
         /* hardware configuration */
         unsigned char           nr_masters;
         unsigned char           data_width[4];
+        unsigned int            request_line_base;
 
         struct dw_dma_chan      chan[0];
 };
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index b70e3815c459..8f3c947b0029 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -32,6 +32,38 @@
 #define DEV_NAME                        "max77693-muic"
 #define DELAY_MS_DEFAULT                20000           /* unit: millisecond */
 
+/*
+ * Default value of MAX77693 register to bring up MUIC device.
+ * If user don't set some initial value for MUIC device through platform data,
+ * extcon-max77693 driver use 'default_init_data' to bring up base operation
+ * of MAX77693 MUIC device.
+ */
+struct max77693_reg_data default_init_data[] = {
+        {
+                /* STATUS2 - [3]ChgDetRun */
+                .addr = MAX77693_MUIC_REG_STATUS2,
+                .data = STATUS2_CHGDETRUN_MASK,
+        }, {
+                /* INTMASK1 - Unmask [3]ADC1KM,[0]ADCM */
+                .addr = MAX77693_MUIC_REG_INTMASK1,
+                .data = INTMASK1_ADC1K_MASK
+                        | INTMASK1_ADC_MASK,
+        }, {
+                /* INTMASK2 - Unmask [0]ChgTypM */
+                .addr = MAX77693_MUIC_REG_INTMASK2,
+                .data = INTMASK2_CHGTYP_MASK,
+        }, {
+                /* INTMASK3 - Mask all of interrupts */
+                .addr = MAX77693_MUIC_REG_INTMASK3,
+                .data = 0x0,
+        }, {
+                /* CDETCTRL2 */
+                .addr = MAX77693_MUIC_REG_CDETCTRL2,
+                .data = CDETCTRL2_VIDRMEN_MASK
+                        | CDETCTRL2_DXOVPEN_MASK,
+        },
+};
+
 enum max77693_muic_adc_debounce_time {
         ADC_DEBOUNCE_TIME_5MS = 0,
         ADC_DEBOUNCE_TIME_10MS,
@@ -1045,8 +1077,9 @@ static int max77693_muic_probe(struct platform_device *pdev)
 {
         struct max77693_dev *max77693 = dev_get_drvdata(pdev->dev.parent);
         struct max77693_platform_data *pdata = dev_get_platdata(max77693->dev);
-        struct max77693_muic_platform_data *muic_pdata = pdata->muic_data;
         struct max77693_muic_info *info;
+        struct max77693_reg_data *init_data;
+        int num_init_data;
         int delay_jiffies;
         int ret;
         int i;
@@ -1145,15 +1178,25 @@ static int max77693_muic_probe(struct platform_device *pdev)
                 goto err_irq;
         }
 
-        /* Initialize MUIC register by using platform data */
-        for (i = 0 ; i < muic_pdata->num_init_data ; i++) {
-                enum max77693_irq_source irq_src = MAX77693_IRQ_GROUP_NR;
+
+        /* Initialize MUIC register by using platform data or default data */
+        if (pdata->muic_data) {
+                init_data = pdata->muic_data->init_data;
+                num_init_data = pdata->muic_data->num_init_data;
+        } else {
+                init_data = default_init_data;
+                num_init_data = ARRAY_SIZE(default_init_data);
+        }
+
+        for (i = 0 ; i < num_init_data ; i++) {
+                enum max77693_irq_source irq_src
+                                = MAX77693_IRQ_GROUP_NR;
 
                 max77693_write_reg(info->max77693->regmap_muic,
-                                muic_pdata->init_data[i].addr,
-                                muic_pdata->init_data[i].data);
+                                init_data[i].addr,
+                                init_data[i].data);
 
-                switch (muic_pdata->init_data[i].addr) {
+                switch (init_data[i].addr) {
                 case MAX77693_MUIC_REG_INTMASK1:
                         irq_src = MUIC_INT1;
                         break;
@@ -1167,22 +1210,40 @@ static int max77693_muic_probe(struct platform_device *pdev)
 
                 if (irq_src < MAX77693_IRQ_GROUP_NR)
                         info->max77693->irq_masks_cur[irq_src]
-                                = muic_pdata->init_data[i].data;
+                                = init_data[i].data;
         }
 
-        /*
-         * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
-         * h/w path of COMP2/COMN1 on CONTROL1 register.
-         */
-        if (muic_pdata->path_uart)
-                info->path_uart = muic_pdata->path_uart;
-        else
-                info->path_uart = CONTROL1_SW_UART;
+        if (pdata->muic_data) {
+                struct max77693_muic_platform_data *muic_pdata = pdata->muic_data;
 
-        if (muic_pdata->path_usb)
-                info->path_usb = muic_pdata->path_usb;
-        else
+                /*
+                 * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
+                 * h/w path of COMP2/COMN1 on CONTROL1 register.
+                 */
+                if (muic_pdata->path_uart)
+                        info->path_uart = muic_pdata->path_uart;
+                else
+                        info->path_uart = CONTROL1_SW_UART;
+
+                if (muic_pdata->path_usb)
+                        info->path_usb = muic_pdata->path_usb;
+                else
+                        info->path_usb = CONTROL1_SW_USB;
+
+                /*
+                 * Default delay time for detecting cable state
+                 * after certain time.
+                 */
+                if (muic_pdata->detcable_delay_ms)
+                        delay_jiffies =
+                                msecs_to_jiffies(muic_pdata->detcable_delay_ms);
+                else
+                        delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        } else {
                 info->path_usb = CONTROL1_SW_USB;
+                info->path_uart = CONTROL1_SW_UART;
+                delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        }
 
         /* Set initial path for UART */
          max77693_muic_set_path(info, info->path_uart, true);
@@ -1208,10 +1269,6 @@ static int max77693_muic_probe(struct platform_device *pdev)
          * driver should notify cable state to upper layer.
          */
         INIT_DELAYED_WORK(&info->wq_detcable, max77693_muic_detect_cable_wq);
-        if (muic_pdata->detcable_delay_ms)
-                delay_jiffies = msecs_to_jiffies(muic_pdata->detcable_delay_ms);
-        else
-                delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
         schedule_delayed_work(&info->wq_detcable, delay_jiffies);
 
         return ret;
diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
index e636d950ad6c..69641bcae325 100644
--- a/drivers/extcon/extcon-max8997.c
+++ b/drivers/extcon/extcon-max8997.c
@@ -712,29 +712,45 @@ static int max8997_muic_probe(struct platform_device *pdev)
                 goto err_irq;
         }
 
-        /* Initialize registers according to platform data */
         if (pdata->muic_pdata) {
-                struct max8997_muic_platform_data *mdata = info->muic_pdata;
-
-                for (i = 0; i < mdata->num_init_data; i++) {
-                        max8997_write_reg(info->muic, mdata->init_data[i].addr,
-                                        mdata->init_data[i].data);
+                struct max8997_muic_platform_data *muic_pdata
+                        = pdata->muic_pdata;
+
+                /* Initialize registers according to platform data */
+                for (i = 0; i < muic_pdata->num_init_data; i++) {
+                        max8997_write_reg(info->muic,
+                                        muic_pdata->init_data[i].addr,
+                                        muic_pdata->init_data[i].data);
                 }
-        }
 
-        /*
-         * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
-         * h/w path of COMP2/COMN1 on CONTROL1 register.
-         */
-        if (pdata->muic_pdata->path_uart)
-                info->path_uart = pdata->muic_pdata->path_uart;
-        else
-                info->path_uart = CONTROL1_SW_UART;
+                /*
+                 * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
+                 * h/w path of COMP2/COMN1 on CONTROL1 register.
+                 */
+                if (muic_pdata->path_uart)
+                        info->path_uart = muic_pdata->path_uart;
+                else
+                        info->path_uart = CONTROL1_SW_UART;
 
-        if (pdata->muic_pdata->path_usb)
-                info->path_usb = pdata->muic_pdata->path_usb;
-        else
+                if (muic_pdata->path_usb)
+                        info->path_usb = muic_pdata->path_usb;
+                else
+                        info->path_usb = CONTROL1_SW_USB;
+
+                /*
+                 * Default delay time for detecting cable state
+                 * after certain time.
+                 */
+                if (muic_pdata->detcable_delay_ms)
+                        delay_jiffies =
+                                msecs_to_jiffies(muic_pdata->detcable_delay_ms);
+                else
+                        delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        } else {
+                info->path_uart = CONTROL1_SW_UART;
                 info->path_usb = CONTROL1_SW_USB;
+                delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        }
 
         /* Set initial path for UART */
          max8997_muic_set_path(info, info->path_uart, true);
@@ -751,10 +767,6 @@ static int max8997_muic_probe(struct platform_device *pdev)
          * driver should notify cable state to upper layer.
          */
         INIT_DELAYED_WORK(&info->wq_detcable, max8997_muic_detect_cable_wq);
-        if (pdata->muic_pdata->detcable_delay_ms)
-                delay_jiffies = msecs_to_jiffies(pdata->muic_pdata->detcable_delay_ms);
-        else
-                delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
         schedule_delayed_work(&info->wq_detcable, delay_jiffies);
 
         return 0;
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 92e47e5c9564..c4388776f4e4 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -590,6 +590,9 @@
 #define USB_VENDOR_ID_MONTEREY          0x0566
 #define USB_DEVICE_ID_GENIUS_KB29E      0x3004
 
+#define USB_VENDOR_ID_MSI               0x1770
+#define USB_DEVICE_ID_MSI_GX680R_LED_PANEL      0xff00
+
 #define USB_VENDOR_ID_NATIONAL_SEMICONDUCTOR 0x0400
 #define USB_DEVICE_ID_N_S_HARMONY       0xc359
 
@@ -684,6 +687,9 @@
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001         0x3001
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008         0x3008
 
+#define USB_VENDOR_ID_REALTEK           0x0bda
+#define USB_DEVICE_ID_REALTEK_READER    0x0152
+
 #define USB_VENDOR_ID_ROCCAT            0x1e7d
 #define USB_DEVICE_ID_ROCCAT_ARVO       0x30d4
 #define USB_DEVICE_ID_ROCCAT_ISKU       0x319c
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 7a1ebb867cf4..82e9211b3ca9 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -621,6 +621,7 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field,
 {
         struct mt_device *td = hid_get_drvdata(hid);
         __s32 quirks = td->mtclass.quirks;
+        struct input_dev *input = field->hidinput->input;
 
         if (hid->claimed & HID_CLAIMED_INPUT) {
                 switch (usage->hid) {
@@ -670,13 +671,16 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field,
                         break;
 
                 default:
+                        if (usage->type)
+                                input_event(input, usage->type, usage->code,
+                                                value);
                         return;
                 }
 
                 if (usage->usage_index + 1 == field->report_count) {
                         /* we only take into account the last report. */
                         if (usage->hid == td->last_slot_field)
-                                mt_complete_slot(td, field->hidinput->input);
+                                mt_complete_slot(td, input);
 
                         if (field->index == td->last_field_index
                                 && td->num_received >= td->num_expected)
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index e0e6abf1cd3b..19b8360f2330 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -73,6 +73,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
@@ -80,6 +81,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SIGMATEL, USB_DEVICE_ID_SIGMATEL_STMP3780, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
index d4e7567b367c..0b899cb6cda1 100644
--- a/drivers/media/i2c/m5mols/m5mols_core.c
+++ b/drivers/media/i2c/m5mols/m5mols_core.c
@@ -724,7 +724,7 @@ static int m5mols_s_stream(struct v4l2_subdev *sd, int enable)
         if (enable) {
                 if (is_code(code, M5MOLS_RESTYPE_MONITOR))
                         ret = m5mols_start_monitor(info);
-                if (is_code(code, M5MOLS_RESTYPE_CAPTURE))
+                else if (is_code(code, M5MOLS_RESTYPE_CAPTURE))
                         ret = m5mols_start_capture(info);
                 else
                         ret = -EINVAL;
diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index ccd18e4ee789..54579e4c740b 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -250,17 +250,19 @@ static u8 SRAM_Table[][60] =
    vdelay       start of active video in 2 * field lines relative to
                 trailing edge of /VRESET pulse (VDELAY register).
    sheight      height of active video in 2 * field lines.
+   extraheight  Added to sheight for cropcap.bounds.height only
    videostart0  ITU-R frame line number of the line corresponding
                 to vdelay in the first field. */
 #define CROPCAP(minhdelayx1, hdelayx1, swidth, totalwidth, sqwidth,      \
-                vdelay, sheight, videostart0)                            \
+                vdelay, sheight, extraheight, videostart0)               \
         .cropcap.bounds.left = minhdelayx1,                              \
         /* * 2 because vertically we count field lines times two, */     \
         /* e.g. 23 * 2 to 23 * 2 + 576 in PAL-BGHI defrect. */           \
         .cropcap.bounds.top = (videostart0) * 2 - (vdelay) + MIN_VDELAY, \
         /* 4 is a safety margin at the end of the line. */               \
         .cropcap.bounds.width = (totalwidth) - (minhdelayx1) - 4,        \
-        .cropcap.bounds.height = (sheight) + (vdelay) - MIN_VDELAY,      \
+        .cropcap.bounds.height = (sheight) + (extraheight) + (vdelay) -  \
+                                 MIN_VDELAY,                             \
         .cropcap.defrect.left = hdelayx1,                                \
         .cropcap.defrect.top = (videostart0) * 2,                        \
         .cropcap.defrect.width = swidth,                                 \
@@ -301,9 +303,10 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* totalwidth */ 1135,
                         /* sqwidth */ 944,
                         /* vdelay */ 0x20,
-                /* bt878 (and bt848?) can capture another
-                   line below active video. */
-                        /* sheight */ (576 + 2) + 0x20 - 2,
+                        /* sheight */ 576,
+                        /* bt878 (and bt848?) can capture another
+                           line below active video. */
+                        /* extraheight */ 2,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_NTSC_M | V4L2_STD_NTSC_M_KR,
@@ -330,6 +333,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 780,
                         /* vdelay */ 0x1a,
                         /* sheight */ 480,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_SECAM,
@@ -355,6 +359,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 944,
                         /* vdelay */ 0x20,
                         /* sheight */ 576,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_PAL_Nc,
@@ -380,6 +385,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 780,
                         /* vdelay */ 0x1a,
                         /* sheight */ 576,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_PAL_M,
@@ -405,6 +411,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 780,
                         /* vdelay */ 0x1a,
                         /* sheight */ 480,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_PAL_N,
@@ -430,6 +437,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 944,
                         /* vdelay */ 0x20,
                         /* sheight */ 576,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_NTSC_M_JP,
@@ -455,6 +463,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 780,
                         /* vdelay */ 0x16,
                         /* sheight */ 480,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 /* that one hopefully works with the strange timing
@@ -484,6 +493,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 944,
                         /* vdelay */ 0x1a,
                         /* sheight */ 480,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         }
 };
diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
index 82d9f6ac12f3..33b5ffc8d66d 100644
--- a/drivers/media/platform/exynos-gsc/gsc-core.c
+++ b/drivers/media/platform/exynos-gsc/gsc-core.c
@@ -1054,16 +1054,18 @@ static int gsc_m2m_suspend(struct gsc_dev *gsc)
 
 static int gsc_m2m_resume(struct gsc_dev *gsc)
 {
+        struct gsc_ctx *ctx;
         unsigned long flags;
 
         spin_lock_irqsave(&gsc->slock, flags);
         /* Clear for full H/W setup in first run after resume */
+        ctx = gsc->m2m.ctx;
         gsc->m2m.ctx = NULL;
         spin_unlock_irqrestore(&gsc->slock, flags);
 
         if (test_and_clear_bit(ST_M2M_SUSPENDED, &gsc->state))
-                gsc_m2m_job_finish(gsc->m2m.ctx,
-                                    VB2_BUF_STATE_ERROR);
+                gsc_m2m_job_finish(ctx, VB2_BUF_STATE_ERROR);
+
         return 0;
 }
 
@@ -1204,7 +1206,7 @@ static int gsc_resume(struct device *dev)
         /* Do not resume if the device was idle before system suspend */
         spin_lock_irqsave(&gsc->slock, flags);
         if (!test_and_clear_bit(ST_SUSPEND, &gsc->state) ||
-            !gsc_m2m_active(gsc)) {
+            !gsc_m2m_opened(gsc)) {
                 spin_unlock_irqrestore(&gsc->slock, flags);
                 return 0;
         }
diff --git a/drivers/media/platform/s5p-fimc/fimc-core.c b/drivers/media/platform/s5p-fimc/fimc-core.c
index e3916bde45cf..0f513dd19f86 100644
--- a/drivers/media/platform/s5p-fimc/fimc-core.c
+++ b/drivers/media/platform/s5p-fimc/fimc-core.c
@@ -850,16 +850,18 @@ static int fimc_m2m_suspend(struct fimc_dev *fimc)
 
 static int fimc_m2m_resume(struct fimc_dev *fimc)
 {
+        struct fimc_ctx *ctx;
         unsigned long flags;
 
         spin_lock_irqsave(&fimc->slock, flags);
         /* Clear for full H/W setup in first run after resume */
+        ctx = fimc->m2m.ctx;
         fimc->m2m.ctx = NULL;
         spin_unlock_irqrestore(&fimc->slock, flags);
 
         if (test_and_clear_bit(ST_M2M_SUSPENDED, &fimc->state))
-                fimc_m2m_job_finish(fimc->m2m.ctx,
-                                    VB2_BUF_STATE_ERROR);
+                fimc_m2m_job_finish(ctx, VB2_BUF_STATE_ERROR);
+
         return 0;
 }
 
diff --git a/drivers/media/platform/s5p-fimc/fimc-lite-reg.c b/drivers/media/platform/s5p-fimc/fimc-lite-reg.c
index f0af0754a7b4..ac9663ce2a49 100644
--- a/drivers/media/platform/s5p-fimc/fimc-lite-reg.c
+++ b/drivers/media/platform/s5p-fimc/fimc-lite-reg.c
@@ -128,10 +128,10 @@ static const u32 src_pixfmt_map[8][3] = {
 void flite_hw_set_source_format(struct fimc_lite *dev, struct flite_frame *f)
 {
         enum v4l2_mbus_pixelcode pixelcode = dev->fmt->mbus_code;
-        unsigned int i = ARRAY_SIZE(src_pixfmt_map);
+        int i = ARRAY_SIZE(src_pixfmt_map);
         u32 cfg;
 
-        while (i-- >= 0) {
+        while (--i >= 0) {
                 if (src_pixfmt_map[i][0] == pixelcode)
                         break;
         }
@@ -224,9 +224,9 @@ static void flite_hw_set_out_order(struct fimc_lite *dev, struct flite_frame *f)
                 { V4L2_MBUS_FMT_VYUY8_2X8, FLITE_REG_CIODMAFMT_CRYCBY },
         };
         u32 cfg = readl(dev->regs + FLITE_REG_CIODMAFMT);
-        unsigned int i = ARRAY_SIZE(pixcode);
+        int i = ARRAY_SIZE(pixcode);
 
-        while (i-- >= 0)
+        while (--i >= 0)
                 if (pixcode[i][0] == dev->fmt->mbus_code)
                         break;
         cfg &= ~FLITE_REG_CIODMAFMT_YCBCR_ORDER_MASK;
diff --git a/drivers/media/platform/s5p-fimc/fimc-lite.c b/drivers/media/platform/s5p-fimc/fimc-lite.c
index bfc4206935c8..bbc35de7db27 100644
--- a/drivers/media/platform/s5p-fimc/fimc-lite.c
+++ b/drivers/media/platform/s5p-fimc/fimc-lite.c
@@ -1408,6 +1408,7 @@ static const struct v4l2_ctrl_config fimc_lite_ctrl = {
         .id     = V4L2_CTRL_CLASS_USER | 0x1001,
         .type   = V4L2_CTRL_TYPE_BOOLEAN,
         .name   = "Test Pattern 640x480",
+        .step   = 1,
 };
 
 static int fimc_lite_create_capture_subdev(struct fimc_lite *fimc)
diff --git a/drivers/media/platform/s5p-fimc/fimc-mdevice.c b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
index a17fcb2d5d41..cd38d708ab58 100644
--- a/drivers/media/platform/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
@@ -827,7 +827,7 @@ static int fimc_md_link_notify(struct media_pad *source,
         struct fimc_pipeline *pipeline;
         struct v4l2_subdev *sd;
         struct mutex *lock;
-        int ret = 0;
+        int i, ret = 0;
         int ref_count;
 
         if (media_entity_type(sink->entity) != MEDIA_ENT_T_V4L2_SUBDEV)
@@ -854,29 +854,28 @@ static int fimc_md_link_notify(struct media_pad *source,
                 return 0;
         }
 
+        mutex_lock(lock);
+        ref_count = fimc ? fimc->vid_cap.refcnt : fimc_lite->ref_count;
+
         if (!(flags & MEDIA_LNK_FL_ENABLED)) {
-                int i;
-                mutex_lock(lock);
-                ret = __fimc_pipeline_close(pipeline);
+                if (ref_count > 0) {
+                        ret = __fimc_pipeline_close(pipeline);
+                        if (!ret && fimc)
+                                fimc_ctrls_delete(fimc->vid_cap.ctx);
+                }
                 for (i = 0; i < IDX_MAX; i++)
                         pipeline->subdevs[i] = NULL;
-                if (fimc)
-                        fimc_ctrls_delete(fimc->vid_cap.ctx);
-                mutex_unlock(lock);
-                return ret;
+        } else if (ref_count > 0) {
+                /*
+                 * Link activation. Enable power of pipeline elements only if
+                 * the pipeline is already in use, i.e. its video node is open.
+                 * Recreate the controls destroyed during the link deactivation.
+                 */
+                ret = __fimc_pipeline_open(pipeline,
+                                           source->entity, true);
+                if (!ret && fimc)
+                        ret = fimc_capture_ctrls_create(fimc);
         }
-        /*
-         * Link activation. Enable power of pipeline elements only if the
-         * pipeline is already in use, i.e. its video node is opened.
-         * Recreate the controls destroyed during the link deactivation.
-         */
-        mutex_lock(lock);
-
-        ref_count = fimc ? fimc->vid_cap.refcnt : fimc_lite->ref_count;
-        if (ref_count > 0)
-                ret = __fimc_pipeline_open(pipeline, source->entity, true);
-        if (!ret && fimc)
-                ret = fimc_capture_ctrls_create(fimc);
 
         mutex_unlock(lock);
         return ret ? -EPIPE : ret;
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index e84703c314ce..1cb6d57987c6 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -276,7 +276,7 @@ static void s5p_mfc_handle_frame_new(struct s5p_mfc_ctx *ctx, unsigned int err)
         unsigned int frame_type;
 
         dspl_y_addr = s5p_mfc_hw_call(dev->mfc_ops, get_dspl_y_adr, dev);
-        frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_dec_frame_type, dev);
+        frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_disp_frame_type, ctx);
 
         /* If frame is same as previous then skip and do not dequeue */
         if (frame_type == S5P_FIMV_DECODE_FRAME_SKIPPED) {
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
index 2356fd52a169..4f6b553c4b2d 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
@@ -232,6 +232,7 @@ static struct mfc_control controls[] = {
                 .minimum = 0,
                 .maximum = 1,
                 .default_value = 0,
+                .step = 1,
                 .menu_skip_mask = 0,
         },
         {
diff --git a/drivers/media/rc/Kconfig b/drivers/media/rc/Kconfig
index 19f3563c61da..5a79c333d45e 100644
--- a/drivers/media/rc/Kconfig
+++ b/drivers/media/rc/Kconfig
@@ -291,7 +291,7 @@ config IR_TTUSBIR
 
 config IR_RX51
         tristate "Nokia N900 IR transmitter diode"
-        depends on OMAP_DM_TIMER && LIRC && !ARCH_MULTIPLATFORM
+        depends on OMAP_DM_TIMER && ARCH_OMAP2PLUS && LIRC && !ARCH_MULTIPLATFORM
         ---help---
            Say Y or M here if you want to enable support for the IR
            transmitter diode built in the Nokia N900 (RX51) device.
diff --git a/drivers/media/v4l2-core/Makefile b/drivers/media/v4l2-core/Makefile
index a9d355230e8e..768aaf62d5dc 100644
--- a/drivers/media/v4l2-core/Makefile
+++ b/drivers/media/v4l2-core/Makefile
@@ -10,7 +10,7 @@ ifeq ($(CONFIG_COMPAT),y)
   videodev-objs += v4l2-compat-ioctl32.o
 endif
 
-obj-$(CONFIG_VIDEO_DEV) += videodev.o
+obj-$(CONFIG_VIDEO_V4L2) += videodev.o
 obj-$(CONFIG_VIDEO_V4L2_INT_DEVICE) += v4l2-int-device.o
 obj-$(CONFIG_VIDEO_V4L2) += v4l2-common.o
 
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index 45ea7185c003..642c6223fa6c 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -152,6 +152,20 @@ static void mei_me_intr_disable(struct mei_device *dev)
 }
 
 /**
+ * mei_me_hw_reset_release - release device from the reset
+ *
+ * @dev: the device structure
+ */
+static void mei_me_hw_reset_release(struct mei_device *dev)
+{
+        struct mei_me_hw *hw = to_me_hw(dev);
+        u32 hcsr = mei_hcsr_read(hw);
+
+        hcsr |= H_IG;
+        hcsr &= ~H_RST;
+        mei_hcsr_set(hw, hcsr);
+}
+/**
  * mei_me_hw_reset - resets fw via mei csr register.
  *
  * @dev: the device structure
@@ -169,18 +183,14 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
         if (intr_enable)
                 hcsr |= H_IE;
         else
-                hcsr &= ~H_IE;
-
-        mei_hcsr_set(hw, hcsr);
-
-        hcsr = mei_hcsr_read(hw) | H_IG;
-        hcsr &= ~H_RST;
+                hcsr |= ~H_IE;
 
         mei_hcsr_set(hw, hcsr);
 
-        hcsr = mei_hcsr_read(hw);
+        if (dev->dev_state == MEI_DEV_POWER_DOWN)
+                mei_me_hw_reset_release(dev);
 
-        dev_dbg(&dev->pdev->dev, "current HCSR = 0x%08x.\n", hcsr);
+        dev_dbg(&dev->pdev->dev, "current HCSR = 0x%08x.\n", mei_hcsr_read(hw));
 }
 
 /**
@@ -466,7 +476,8 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
                         mutex_unlock(&dev->device_lock);
                         return IRQ_HANDLED;
                 } else {
-                        dev_dbg(&dev->pdev->dev, "FW not ready.\n");
+                        dev_dbg(&dev->pdev->dev, "Reset Completed.\n");
+                        mei_me_hw_reset_release(dev);
                         mutex_unlock(&dev->device_lock);
                         return IRQ_HANDLED;
                 }
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 6ec530168afb..356179991a2e 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -183,6 +183,24 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
         mei_cl_all_write_clear(dev);
 }
 
+void mei_stop(struct mei_device *dev)
+{
+        dev_dbg(&dev->pdev->dev, "stopping the device.\n");
+
+        mutex_lock(&dev->device_lock);
+
+        cancel_delayed_work(&dev->timer_work);
+
+        mei_wd_stop(dev);
+
+        dev->dev_state = MEI_DEV_POWER_DOWN;
+        mei_reset(dev, 0);
+
+        mutex_unlock(&dev->device_lock);
+
+        flush_scheduled_work();
+}
+
 
 
 
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index cb80166161f0..97873812e33b 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -381,6 +381,7 @@ static inline unsigned long mei_secs_to_jiffies(unsigned long sec)
 void mei_device_init(struct mei_device *dev);
 void mei_reset(struct mei_device *dev, int interrupts);
 int mei_hw_init(struct mei_device *dev);
+void mei_stop(struct mei_device *dev);
 
 /*
  *  MEI interrupt functions prototype
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index b40ec0601ab0..b8b5c9c3ad03 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -247,44 +247,14 @@ static void mei_remove(struct pci_dev *pdev)
 
         hw = to_me_hw(dev);
 
-        mutex_lock(&dev->device_lock);
-
-        cancel_delayed_work(&dev->timer_work);
 
-        mei_wd_stop(dev);
+        dev_err(&pdev->dev, "stop\n");
+        mei_stop(dev);
 
         mei_pdev = NULL;
 
-        if (dev->iamthif_cl.state == MEI_FILE_CONNECTED) {
-                dev->iamthif_cl.state = MEI_FILE_DISCONNECTING;
-                mei_cl_disconnect(&dev->iamthif_cl);
-        }
-        if (dev->wd_cl.state == MEI_FILE_CONNECTED) {
-                dev->wd_cl.state = MEI_FILE_DISCONNECTING;
-                mei_cl_disconnect(&dev->wd_cl);
-        }
-
-        /* Unregistering watchdog device */
         mei_watchdog_unregister(dev);
 
-        /* remove entry if already in list */
-        dev_dbg(&pdev->dev, "list del iamthif and wd file list.\n");
-
-        if (dev->open_handle_count > 0)
-                dev->open_handle_count--;
-        mei_cl_unlink(&dev->wd_cl);
-
-        if (dev->open_handle_count > 0)
-                dev->open_handle_count--;
-        mei_cl_unlink(&dev->iamthif_cl);
-
-        dev->iamthif_current_cb = NULL;
-        dev->me_clients_num = 0;
-
-        mutex_unlock(&dev->device_lock);
-
-        flush_scheduled_work();
-
         /* disable interrupts */
         mei_disable_interrupts(dev);
 
@@ -308,28 +278,20 @@ static int mei_pci_suspend(struct device *device)
 {
         struct pci_dev *pdev = to_pci_dev(device);
         struct mei_device *dev = pci_get_drvdata(pdev);
-        int err;
 
         if (!dev)
                 return -ENODEV;
-        mutex_lock(&dev->device_lock);
 
-        cancel_delayed_work(&dev->timer_work);
+        dev_err(&pdev->dev, "suspend\n");
 
-        /* Stop watchdog if exists */
-        err = mei_wd_stop(dev);
-        /* Set new mei state */
-        if (dev->dev_state == MEI_DEV_ENABLED ||
-            dev->dev_state == MEI_DEV_RECOVERING_FROM_RESET) {
-                dev->dev_state = MEI_DEV_POWER_DOWN;
-                mei_reset(dev, 0);
-        }
-        mutex_unlock(&dev->device_lock);
+        mei_stop(dev);
+
+        mei_disable_interrupts(dev);
 
         free_irq(pdev->irq, dev);
         pci_disable_msi(pdev);
 
-        return err;
+        return 0;
 }
 
 static int mei_pci_resume(struct device *device)
diff --git a/drivers/misc/vmw_vmci/vmci_datagram.c b/drivers/misc/vmw_vmci/vmci_datagram.c
index ed5c433cd493..f3cdd904fe4d 100644
--- a/drivers/misc/vmw_vmci/vmci_datagram.c
+++ b/drivers/misc/vmw_vmci/vmci_datagram.c
@@ -42,9 +42,11 @@ struct datagram_entry {
 
 struct delayed_datagram_info {
         struct datagram_entry *entry;
-        struct vmci_datagram msg;
         struct work_struct work;
         bool in_dg_host_queue;
+        /* msg and msg_payload must be together. */
+        struct vmci_datagram msg;
+        u8 msg_payload[];
 };
 
 /* Number of in-flight host->host datagrams */
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index db103e03ba05..ea7a388f4843 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -527,7 +527,7 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                 goto out;
         }
         if (new_value < 0) {
-                pr_err("%s: Invalid arp_interval value %d not in range 1-%d; rejected.\n",
+                pr_err("%s: Invalid arp_interval value %d not in range 0-%d; rejected.\n",
                        bond->dev->name, new_value, INT_MAX);
                 ret = -EINVAL;
                 goto out;
@@ -542,14 +542,15 @@ static ssize_t bonding_store_arp_interval(struct device *d,
         pr_info("%s: Setting ARP monitoring interval to %d.\n",
                 bond->dev->name, new_value);
         bond->params.arp_interval = new_value;
-        if (bond->params.miimon) {
-                pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
-                        bond->dev->name, bond->dev->name);
-                bond->params.miimon = 0;
-        }
-        if (!bond->params.arp_targets[0]) {
-                pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
-                        bond->dev->name);
+        if (new_value) {
+                if (bond->params.miimon) {
+                        pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
+                                bond->dev->name, bond->dev->name);
+                        bond->params.miimon = 0;
+                }
+                if (!bond->params.arp_targets[0])
+                        pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
+                                bond->dev->name);
         }
         if (bond->dev->flags & IFF_UP) {
                 /* If the interface is up, we may need to fire off
@@ -557,10 +558,13 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                  * timer will get fired off when the open function
                  * is called.
                  */
-                cancel_delayed_work_sync(&bond->mii_work);
-                queue_delayed_work(bond->wq, &bond->arp_work, 0);
+                if (!new_value) {
+                        cancel_delayed_work_sync(&bond->arp_work);
+                } else {
+                        cancel_delayed_work_sync(&bond->mii_work);
+                        queue_delayed_work(bond->wq, &bond->arp_work, 0);
+                }
         }
-
 out:
         rtnl_unlock();
         return ret;
@@ -702,7 +706,7 @@ static ssize_t bonding_store_downdelay(struct device *d,
         }
         if (new_value < 0) {
                 pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
-                       bond->dev->name, new_value, 1, INT_MAX);
+                       bond->dev->name, new_value, 0, INT_MAX);
                 ret = -EINVAL;
                 goto out;
         } else {
@@ -757,8 +761,8 @@ static ssize_t bonding_store_updelay(struct device *d,
                 goto out;
         }
         if (new_value < 0) {
-                pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
-                       bond->dev->name, new_value, 1, INT_MAX);
+                pr_err("%s: Invalid up delay value %d not in range %d-%d; rejected.\n",
+                       bond->dev->name, new_value, 0, INT_MAX);
                 ret = -EINVAL;
                 goto out;
         } else {
@@ -968,37 +972,37 @@ static ssize_t bonding_store_miimon(struct device *d,
         }
         if (new_value < 0) {
                 pr_err("%s: Invalid miimon value %d not in range %d-%d; rejected.\n",
-                       bond->dev->name, new_value, 1, INT_MAX);
+                       bond->dev->name, new_value, 0, INT_MAX);
                 ret = -EINVAL;
                 goto out;
-        } else {
-                pr_info("%s: Setting MII monitoring interval to %d.\n",
-                        bond->dev->name, new_value);
-                bond->params.miimon = new_value;
-                if (bond->params.updelay)
-                        pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
-                                bond->dev->name,
-                                bond->params.updelay * bond->params.miimon);
-                if (bond->params.downdelay)
-                        pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
-                                bond->dev->name,
-                                bond->params.downdelay * bond->params.miimon);
-                if (bond->params.arp_interval) {
-                        pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
-                                bond->dev->name);
-                        bond->params.arp_interval = 0;
-                        if (bond->params.arp_validate) {
-                                bond->params.arp_validate =
-                                        BOND_ARP_VALIDATE_NONE;
-                        }
-                }
-
-                if (bond->dev->flags & IFF_UP) {
-                        /* If the interface is up, we may need to fire off
-                         * the MII timer. If the interface is down, the
-                         * timer will get fired off when the open function
-                         * is called.
-                         */
+        }
+        pr_info("%s: Setting MII monitoring interval to %d.\n",
+                bond->dev->name, new_value);
+        bond->params.miimon = new_value;
+        if (bond->params.updelay)
+                pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
+                        bond->dev->name,
+                        bond->params.updelay * bond->params.miimon);
+        if (bond->params.downdelay)
+                pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
+                        bond->dev->name,
+                        bond->params.downdelay * bond->params.miimon);
+        if (new_value && bond->params.arp_interval) {
+                pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
+                        bond->dev->name);
+                bond->params.arp_interval = 0;
+                if (bond->params.arp_validate)
+                        bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
+        }
+        if (bond->dev->flags & IFF_UP) {
+                /* If the interface is up, we may need to fire off
+                 * the MII timer. If the interface is down, the
+                 * timer will get fired off when the open function
+                 * is called.
+                 */
+                if (!new_value) {
+                        cancel_delayed_work_sync(&bond->mii_work);
+                } else {
                         cancel_delayed_work_sync(&bond->arp_work);
                         queue_delayed_work(bond->wq, &bond->mii_work, 0);
                 }
diff --git a/drivers/net/can/sja1000/Kconfig b/drivers/net/can/sja1000/Kconfig
index b39ca5b3ea7f..ff2ba86cd4a4 100644
--- a/drivers/net/can/sja1000/Kconfig
+++ b/drivers/net/can/sja1000/Kconfig
@@ -46,6 +46,7 @@ config CAN_EMS_PCI
 config CAN_PEAK_PCMCIA
         tristate "PEAK PCAN-PC Card"
         depends on PCMCIA
+        depends on HAS_IOPORT
         ---help---
           This driver is for the PCAN-PC Card PCMCIA adapter (1 or 2 channels)
           from PEAK-System (http://www.peak-system.com). To compile this
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index a042cdc260dc..3c18d7d000ed 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -348,7 +348,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
          */
         if ((priv->read_reg(priv, REG_CR) & REG_CR_BASICCAN_INITIAL_MASK) ==
             REG_CR_BASICCAN_INITIAL &&
-            (priv->read_reg(priv, REG_SR) == REG_SR_BASICCAN_INITIAL) &&
+            (priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_BASICCAN_INITIAL) &&
             (priv->read_reg(priv, REG_IR) == REG_IR_BASICCAN_INITIAL))
                 flag = 1;
 
@@ -360,7 +360,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
          * See states on p. 23 of the Datasheet.
          */
         if (priv->read_reg(priv, REG_MOD) == REG_MOD_PELICAN_INITIAL &&
-            priv->read_reg(priv, REG_SR) == REG_SR_PELICAN_INITIAL &&
+            priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_PELICAN_INITIAL &&
             priv->read_reg(priv, REG_IR) == REG_IR_PELICAN_INITIAL)
                 return flag;
 
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index daf4013a8fc7..e4df307eaa90 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -92,7 +92,7 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
          */
         spin_lock_irqsave(&priv->cmdreg_lock, flags);
         priv->write_reg(priv, REG_CMR, val);
-        priv->read_reg(priv, REG_SR);
+        priv->read_reg(priv, SJA1000_REG_SR);
         spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
 }
 
@@ -502,7 +502,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
 
         while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
                 n++;
-                status = priv->read_reg(priv, REG_SR);
+                status = priv->read_reg(priv, SJA1000_REG_SR);
                 /* check for absent controller due to hw unplug */
                 if (status == 0xFF && sja1000_is_absent(priv))
                         return IRQ_NONE;
@@ -530,7 +530,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         /* receive interrupt */
                         while (status & SR_RBS) {
                                 sja1000_rx(dev);
-                                status = priv->read_reg(priv, REG_SR);
+                                status = priv->read_reg(priv, SJA1000_REG_SR);
                                 /* check for absent controller */
                                 if (status == 0xFF && sja1000_is_absent(priv))
                                         return IRQ_NONE;
diff --git a/drivers/net/can/sja1000/sja1000.h b/drivers/net/can/sja1000/sja1000.h
index afa99847a510..aa48e053da27 100644
--- a/drivers/net/can/sja1000/sja1000.h
+++ b/drivers/net/can/sja1000/sja1000.h
@@ -56,7 +56,7 @@
 /* SJA1000 registers - manual section 6.4 (Pelican Mode) */
 #define REG_MOD         0x00
 #define REG_CMR         0x01
-#define REG_SR          0x02
+#define SJA1000_REG_SR          0x02
 #define REG_IR          0x03
 #define REG_IER         0x04
 #define REG_ALC         0x0B
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e.h b/drivers/net/ethernet/atheros/atl1e/atl1e.h
index 829b5ad71d0d..edfdf6b950e7 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e.h
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e.h
@@ -438,7 +438,6 @@ struct atl1e_adapter {
         struct atl1e_hw        hw;
         struct atl1e_hw_stats  hw_stats;
 
-        bool have_msi;
         u32 wol;
         u16 link_speed;
         u16 link_duplex;
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index e1f1b2a0673a..7e0a822289c3 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -1847,34 +1847,19 @@ static void atl1e_free_irq(struct atl1e_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
 
         free_irq(adapter->pdev->irq, netdev);
-
-        if (adapter->have_msi)
-                pci_disable_msi(adapter->pdev);
 }
 
 static int atl1e_request_irq(struct atl1e_adapter *adapter)
 {
         struct pci_dev    *pdev   = adapter->pdev;
         struct net_device *netdev = adapter->netdev;
-        int flags = 0;
         int err = 0;
 
-        adapter->have_msi = true;
-        err = pci_enable_msi(pdev);
-        if (err) {
-                netdev_dbg(netdev,
-                           "Unable to allocate MSI interrupt Error: %d\n", err);
-                adapter->have_msi = false;
-        }
-
-        if (!adapter->have_msi)
-                flags |= IRQF_SHARED;
-        err = request_irq(pdev->irq, atl1e_intr, flags, netdev->name, netdev);
+        err = request_irq(pdev->irq, atl1e_intr, IRQF_SHARED, netdev->name,
+                          netdev);
         if (err) {
                 netdev_dbg(adapter->netdev,
                            "Unable to allocate interrupt Error: %d\n", err);
-                if (adapter->have_msi)
-                        pci_disable_msi(pdev);
                 return err;
         }
         netdev_dbg(netdev, "atl1e_request_irq OK\n");
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index dea7d7d1f730..a4416b09f209 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14756,8 +14756,11 @@ static void tg3_read_vpd(struct tg3 *tp)
                 if (j + len > block_end)
                         goto partno;
 
-                memcpy(tp->fw_ver, &vpd_data[j], len);
-                strncat(tp->fw_ver, " bc ", vpdlen - len - 1);
+                if (len >= sizeof(tp->fw_ver))
+                        len = sizeof(tp->fw_ver) - 1;
+                memset(tp->fw_ver, 0, sizeof(tp->fw_ver));
+                snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len,
+                         &vpd_data[j]);
         }
 
 partno:
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index a170065b5973..b0ebc9f6d55e 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -163,6 +163,7 @@
 #define XGMAC_FLOW_CTRL_FCB_BPA 0x00000001      /* Flow Control Busy ... */
 
 /* XGMAC_INT_STAT reg */
+#define XGMAC_INT_STAT_PMTIM    0x00800000      /* PMT Interrupt Mask */
 #define XGMAC_INT_STAT_PMT      0x0080          /* PMT Interrupt Status */
 #define XGMAC_INT_STAT_LPI      0x0040          /* LPI Interrupt Status */
 
@@ -960,6 +961,9 @@ static int xgmac_hw_init(struct net_device *dev)
         writel(DMA_INTR_DEFAULT_MASK, ioaddr + XGMAC_DMA_STATUS);
         writel(DMA_INTR_DEFAULT_MASK, ioaddr + XGMAC_DMA_INTR_ENA);
 
+        /* Mask power mgt interrupt */
+        writel(XGMAC_INT_STAT_PMTIM, ioaddr + XGMAC_INT_STAT);
+
         /* XGMAC requires AXI bus init. This is a 'magic number' for now */
         writel(0x0077000E, ioaddr + XGMAC_DMA_AXI_BUS);
 
@@ -1141,6 +1145,9 @@ static int xgmac_rx(struct xgmac_priv *priv, int limit)
                 struct sk_buff *skb;
                 int frame_len;
 
+                if (!dma_ring_cnt(priv->rx_head, priv->rx_tail, DMA_RX_RING_SZ))
+                        break;
+
                 entry = priv->rx_tail;
                 p = priv->dma_rx + entry;
                 if (desc_get_owner(p))
@@ -1825,7 +1832,7 @@ static void xgmac_pmt(void __iomem *ioaddr, unsigned long mode)
         unsigned int pmt = 0;
 
         if (mode & WAKE_MAGIC)
-                pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_MAGIC_PKT;
+                pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_MAGIC_PKT_EN;
         if (mode & WAKE_UCAST)
                 pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_GLBL_UNICAST;
 
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index f38f677f8420..9105465b2a1a 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -257,6 +257,107 @@ static void dm9000_dumpblk_32bit(void __iomem *reg, int count)
                 tmp = readl(reg);
 }
 
+/*
+ * Sleep, either by using msleep() or if we are suspending, then
+ * use mdelay() to sleep.
+ */
+static void dm9000_msleep(board_info_t *db, unsigned int ms)
+{
+        if (db->in_suspend)
+                mdelay(ms);
+        else
+                msleep(ms);
+}
+
+/* Read a word from phyxcer */
+static int
+dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
+{
+        board_info_t *db = netdev_priv(dev);
+        unsigned long flags;
+        unsigned int reg_save;
+        int ret;
+
+        mutex_lock(&db->addr_lock);
+
+        spin_lock_irqsave(&db->lock, flags);
+
+        /* Save previous register address */
+        reg_save = readb(db->io_addr);
+
+        /* Fill the phyxcer register into REG_0C */
+        iow(db, DM9000_EPAR, DM9000_PHY | reg);
+
+        /* Issue phyxcer read command */
+        iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS);
+
+        writeb(reg_save, db->io_addr);
+        spin_unlock_irqrestore(&db->lock, flags);
+
+        dm9000_msleep(db, 1);           /* Wait read complete */
+
+        spin_lock_irqsave(&db->lock, flags);
+        reg_save = readb(db->io_addr);
+
+        iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer read command */
+
+        /* The read data keeps on REG_0D & REG_0E */
+        ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
+
+        /* restore the previous address */
+        writeb(reg_save, db->io_addr);
+        spin_unlock_irqrestore(&db->lock, flags);
+
+        mutex_unlock(&db->addr_lock);
+
+        dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
+        return ret;
+}
+
+/* Write a word to phyxcer */
+static void
+dm9000_phy_write(struct net_device *dev,
+                 int phyaddr_unused, int reg, int value)
+{
+        board_info_t *db = netdev_priv(dev);
+        unsigned long flags;
+        unsigned long reg_save;
+
+        dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
+        mutex_lock(&db->addr_lock);
+
+        spin_lock_irqsave(&db->lock, flags);
+
+        /* Save previous register address */
+        reg_save = readb(db->io_addr);
+
+        /* Fill the phyxcer register into REG_0C */
+        iow(db, DM9000_EPAR, DM9000_PHY | reg);
+
+        /* Fill the written data into REG_0D & REG_0E */
+        iow(db, DM9000_EPDRL, value);
+        iow(db, DM9000_EPDRH, value >> 8);
+
+        /* Issue phyxcer write command */
+        iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW);
+
+        writeb(reg_save, db->io_addr);
+        spin_unlock_irqrestore(&db->lock, flags);
+
+        dm9000_msleep(db, 1);           /* Wait write complete */
+
+        spin_lock_irqsave(&db->lock, flags);
+        reg_save = readb(db->io_addr);
+
+        iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer write command */
+
+        /* restore the previous address */
+        writeb(reg_save, db->io_addr);
+
+        spin_unlock_irqrestore(&db->lock, flags);
+        mutex_unlock(&db->addr_lock);
+}
+
 /* dm9000_set_io
  *
  * select the specified set of io routines to use with the
@@ -795,6 +896,9 @@ dm9000_init_dm9000(struct net_device *dev)
 
         iow(db, DM9000_GPCR, GPCR_GEP_CNTL);    /* Let GPIO0 output */
 
+        dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */
+        dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */
+
         ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
 
         /* if wol is needed, then always set NCR_WAKEEN otherwise we end
@@ -1201,109 +1305,6 @@ dm9000_open(struct net_device *dev)
         return 0;
 }
 
-/*
- * Sleep, either by using msleep() or if we are suspending, then
- * use mdelay() to sleep.
- */
-static void dm9000_msleep(board_info_t *db, unsigned int ms)
-{
-        if (db->in_suspend)
-                mdelay(ms);
-        else
-                msleep(ms);
-}
-
-/*
- *   Read a word from phyxcer
- */
-static int
-dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
-{
-        board_info_t *db = netdev_priv(dev);
-        unsigned long flags;
-        unsigned int reg_save;
-        int ret;
-
-        mutex_lock(&db->addr_lock);
-
-        spin_lock_irqsave(&db->lock,flags);
-
-        /* Save previous register address */
-        reg_save = readb(db->io_addr);
-
-        /* Fill the phyxcer register into REG_0C */
-        iow(db, DM9000_EPAR, DM9000_PHY | reg);
-
-        iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS);   /* Issue phyxcer read command */
-
-        writeb(reg_save, db->io_addr);
-        spin_unlock_irqrestore(&db->lock,flags);
-
-        dm9000_msleep(db, 1);           /* Wait read complete */
-
-        spin_lock_irqsave(&db->lock,flags);
-        reg_save = readb(db->io_addr);
-
-        iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer read command */
-
-        /* The read data keeps on REG_0D & REG_0E */
-        ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
-
-        /* restore the previous address */
-        writeb(reg_save, db->io_addr);
-        spin_unlock_irqrestore(&db->lock,flags);
-
-        mutex_unlock(&db->addr_lock);
-
-        dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
-        return ret;
-}
-
-/*
- *   Write a word to phyxcer
- */
-static void
-dm9000_phy_write(struct net_device *dev,
-                 int phyaddr_unused, int reg, int value)
-{
-        board_info_t *db = netdev_priv(dev);
-        unsigned long flags;
-        unsigned long reg_save;
-
-        dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
-        mutex_lock(&db->addr_lock);
-
-        spin_lock_irqsave(&db->lock,flags);
-
-        /* Save previous register address */
-        reg_save = readb(db->io_addr);
-
-        /* Fill the phyxcer register into REG_0C */
-        iow(db, DM9000_EPAR, DM9000_PHY | reg);
-
-        /* Fill the written data into REG_0D & REG_0E */
-        iow(db, DM9000_EPDRL, value);
-        iow(db, DM9000_EPDRH, value >> 8);
-
-        iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW);   /* Issue phyxcer write command */
-
-        writeb(reg_save, db->io_addr);
-        spin_unlock_irqrestore(&db->lock, flags);
-
-        dm9000_msleep(db, 1);           /* Wait write complete */
-
-        spin_lock_irqsave(&db->lock,flags);
-        reg_save = readb(db->io_addr);
-
-        iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer write command */
-
-        /* restore the previous address */
-        writeb(reg_save, db->io_addr);
-
-        spin_unlock_irqrestore(&db->lock, flags);
-        mutex_unlock(&db->addr_lock);
-}
-
 static void
 dm9000_shutdown(struct net_device *dev)
 {
@@ -1502,7 +1503,12 @@ dm9000_probe(struct platform_device *pdev)
         db->flags |= DM9000_PLATF_SIMPLE_PHY;
 #endif
 
-        dm9000_reset(db);
+        /* Fixing bug on dm9000_probe, takeover dm9000_reset(db),
+         * Need 'NCR_MAC_LBK' bit to indeed stable our DM9000 fifo
+         * while probe stage.
+         */
+
+        iow(db, DM9000_NCR, NCR_MAC_LBK | NCR_RST);
 
         /* try multiple times, DM9000 sometimes gets the read wrong */
         for (i = 0; i < 8; i++) {
diff --git a/drivers/net/ethernet/davicom/dm9000.h b/drivers/net/ethernet/davicom/dm9000.h
index 55688bd1a3ef..9ce058adabab 100644
--- a/drivers/net/ethernet/davicom/dm9000.h
+++ b/drivers/net/ethernet/davicom/dm9000.h
@@ -69,7 +69,9 @@
 #define NCR_WAKEEN          (1<<6)
 #define NCR_FCOL            (1<<4)
 #define NCR_FDX             (1<<3)
-#define NCR_LBK             (3<<1)
+
+#define NCR_RESERVED        (3<<1)
+#define NCR_MAC_LBK         (1<<1)
 #define NCR_RST             (1<<0)
 
 #define NSR_SPEED           (1<<7)
@@ -167,5 +169,12 @@
 #define ISR_LNKCHNG             (1<<5)
 #define ISR_UNDERRUN            (1<<4)
 
+/* Davicom MII registers.
+ */
+
+#define MII_DM_DSPCR            0x1b    /* DSP Control Register */
+
+#define DSPCR_INIT_PARAM        0xE100  /* DSP init parameter */
+
 #endif /* _DM9000X_H_ */
 
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 2b78a1ebe903..a82a70345bbf 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -344,6 +344,53 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NETDEV_TX_OK;
 }
 
+/* Init RX & TX buffer descriptors
+ */
+static void fec_enet_bd_init(struct net_device *dev)
+{
+        struct fec_enet_private *fep = netdev_priv(dev);
+        struct bufdesc *bdp;
+        unsigned int i;
+
+        /* Initialize the receive buffer descriptors. */
+        bdp = fep->rx_bd_base;
+        for (i = 0; i < RX_RING_SIZE; i++) {
+
+                /* Initialize the BD for every fragment in the page. */
+                if (bdp->cbd_bufaddr)
+                        bdp->cbd_sc = BD_ENET_RX_EMPTY;
+                else
+                        bdp->cbd_sc = 0;
+                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
+        }
+
+        /* Set the last buffer to wrap */
+        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
+        bdp->cbd_sc |= BD_SC_WRAP;
+
+        fep->cur_rx = fep->rx_bd_base;
+
+        /* ...and the same for transmit */
+        bdp = fep->tx_bd_base;
+        fep->cur_tx = bdp;
+        for (i = 0; i < TX_RING_SIZE; i++) {
+
+                /* Initialize the BD for every fragment in the page. */
+                bdp->cbd_sc = 0;
+                if (bdp->cbd_bufaddr && fep->tx_skbuff[i]) {
+                        dev_kfree_skb_any(fep->tx_skbuff[i]);
+                        fep->tx_skbuff[i] = NULL;
+                }
+                bdp->cbd_bufaddr = 0;
+                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
+        }
+
+        /* Set the last buffer to wrap */
+        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
+        bdp->cbd_sc |= BD_SC_WRAP;
+        fep->dirty_tx = bdp;
+}
+
 /* This function is called to start or restart the FEC during a link
  * change.  This only happens when switching between half and full
  * duplex.
@@ -387,6 +434,8 @@ fec_restart(struct net_device *ndev, int duplex)
         /* Set maximum receive buffer size. */
         writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE);
 
+        fec_enet_bd_init(ndev);
+
         /* Set receive and transmit descriptor base. */
         writel(fep->bd_dma, fep->hwp + FEC_R_DES_START);
         if (fep->bufdesc_ex)
@@ -396,7 +445,6 @@ fec_restart(struct net_device *ndev, int duplex)
                 writel((unsigned long)fep->bd_dma + sizeof(struct bufdesc)
                         * RX_RING_SIZE, fep->hwp + FEC_X_DES_START);
 
-        fep->cur_rx = fep->rx_bd_base;
 
         for (i = 0; i <= TX_RING_MOD_MASK; i++) {
                 if (fep->tx_skbuff[i]) {
@@ -1594,8 +1642,6 @@ static int fec_enet_init(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
         struct bufdesc *cbd_base;
-        struct bufdesc *bdp;
-        unsigned int i;
 
         /* Allocate memory for buffer descriptors. */
         cbd_base = dma_alloc_coherent(NULL, PAGE_SIZE, &fep->bd_dma,
@@ -1603,6 +1649,7 @@ static int fec_enet_init(struct net_device *ndev)
         if (!cbd_base)
                 return -ENOMEM;
 
+        memset(cbd_base, 0, PAGE_SIZE);
         spin_lock_init(&fep->hw_lock);
 
         fep->netdev = ndev;
@@ -1626,35 +1673,6 @@ static int fec_enet_init(struct net_device *ndev)
         writel(FEC_RX_DISABLED_IMASK, fep->hwp + FEC_IMASK);
         netif_napi_add(ndev, &fep->napi, fec_enet_rx_napi, FEC_NAPI_WEIGHT);
 
-        /* Initialize the receive buffer descriptors. */
-        bdp = fep->rx_bd_base;
-        for (i = 0; i < RX_RING_SIZE; i++) {
-
-                /* Initialize the BD for every fragment in the page. */
-                bdp->cbd_sc = 0;
-                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
-        }
-
-        /* Set the last buffer to wrap */
-        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
-        bdp->cbd_sc |= BD_SC_WRAP;
-
-        /* ...and the same for transmit */
-        bdp = fep->tx_bd_base;
-        fep->cur_tx = bdp;
-        for (i = 0; i < TX_RING_SIZE; i++) {
-
-                /* Initialize the BD for every fragment in the page. */
-                bdp->cbd_sc = 0;
-                bdp->cbd_bufaddr = 0;
-                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
-        }
-
-        /* Set the last buffer to wrap */
-        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
-        bdp->cbd_sc |= BD_SC_WRAP;
-        fep->dirty_tx = bdp;
-
         fec_restart(ndev, 0);
 
         return 0;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index a9f9c7906769..82a967c95598 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -1052,6 +1052,10 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
                 txdr->buffer_info[i].dma =
                         dma_map_single(&pdev->dev, skb->data, skb->len,
                                        DMA_TO_DEVICE);
+                if (dma_mapping_error(&pdev->dev, txdr->buffer_info[i].dma)) {
+                        ret_val = 4;
+                        goto err_nomem;
+                }
                 tx_desc->buffer_addr = cpu_to_le64(txdr->buffer_info[i].dma);
                 tx_desc->lower.data = cpu_to_le32(skb->len);
                 tx_desc->lower.data |= cpu_to_le32(E1000_TXD_CMD_EOP |
@@ -1068,7 +1072,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
         rxdr->buffer_info = kcalloc(rxdr->count, sizeof(struct e1000_buffer),
                                     GFP_KERNEL);
         if (!rxdr->buffer_info) {
-                ret_val = 4;
+                ret_val = 5;
                 goto err_nomem;
         }
 
@@ -1076,7 +1080,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
         rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
                                         GFP_KERNEL | __GFP_ZERO);
         if (!rxdr->desc) {
-                ret_val = 5;
+                ret_val = 6;
                 goto err_nomem;
         }
         rxdr->next_to_use = rxdr->next_to_clean = 0;
@@ -1099,7 +1103,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
 
                 skb = alloc_skb(E1000_RXBUFFER_2048 + NET_IP_ALIGN, GFP_KERNEL);
                 if (!skb) {
-                        ret_val = 6;
+                        ret_val = 7;
                         goto err_nomem;
                 }
                 skb_reserve(skb, NET_IP_ALIGN);
@@ -1108,6 +1112,10 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
                 rxdr->buffer_info[i].dma =
                         dma_map_single(&pdev->dev, skb->data,
                                        E1000_RXBUFFER_2048, DMA_FROM_DEVICE);
+                if (dma_mapping_error(&pdev->dev, rxdr->buffer_info[i].dma)) {
+                        ret_val = 8;
+                        goto err_nomem;
+                }
                 rx_desc->buffer_addr = cpu_to_le64(rxdr->buffer_info[i].dma);
                 memset(skb->data, 0x00, skb->len);
         }
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 858d2a3b3672..b18fad5b579e 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -846,11 +846,16 @@ check_page:
                         }
                 }
 
-                if (!buffer_info->dma)
+                if (!buffer_info->dma) {
                         buffer_info->dma = dma_map_page(&pdev->dev,
                                                         buffer_info->page, 0,
                                                         PAGE_SIZE,
                                                         DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
+                                adapter->alloc_rx_buff_failed++;
+                                break;
+                        }
+                }
 
                 rx_desc = E1000_RX_DESC_EXT(*rx_ring, i);
                 rx_desc->read.buffer_addr = cpu_to_le64(buffer_info->dma);
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index 74464c348454..5dc119fd95a8 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -2154,6 +2154,10 @@ map_skb:
                                                   skb->data,
                                                   adapter->rx_buffer_len,
                                                   DMA_FROM_DEVICE);
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
+                        adapter->alloc_rx_buff_failed++;
+                        break;
+                }
 
                 rx_desc = IXGB_RX_DESC(*rx_ring, i);
                 rx_desc->buff_addr = cpu_to_le64(buffer_info->dma);
@@ -2163,7 +2167,8 @@ map_skb:
                 rx_desc->status = 0;
 
 
-                if (++i == rx_ring->count) i = 0;
+                if (++i == rx_ring->count)
+                        i = 0;
                 buffer_info = &rx_ring->buffer_info[i];
         }
 
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index fc07ca35721b..6a0e671fcecd 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -1067,7 +1067,7 @@ static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 space)
                 sky2_write32(hw, RB_ADDR(q, RB_RX_UTHP), tp);
                 sky2_write32(hw, RB_ADDR(q, RB_RX_LTHP), space/2);
 
-                tp = space - 2048/8;
+                tp = space - 8192/8;
                 sky2_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp);
                 sky2_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4);
         } else {
diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
index 615ac63ea860..ec6dcd80152b 100644
--- a/drivers/net/ethernet/marvell/sky2.h
+++ b/drivers/net/ethernet/marvell/sky2.h
@@ -2074,7 +2074,7 @@ enum {
         GM_IS_RX_FF_OR  = 1<<1, /* Receive FIFO Overrun */
         GM_IS_RX_COMPL  = 1<<0, /* Frame Reception Complete */
 
-#define GMAC_DEF_MSK     GM_IS_TX_FF_UR
+#define GMAC_DEF_MSK     (GM_IS_TX_FF_UR | GM_IS_RX_FF_OR)
 };
 
 /*      GMAC_LINK_CTRL  16 bit  GMAC Link Control Reg (YUKON only) */
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 33bcb63d56a2..8fb481252e2c 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -528,7 +528,7 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
         for (; rxfc != 0; rxfc--) {
                 rxh = ks8851_rdreg32(ks, KS_RXFHSR);
                 rxstat = rxh & 0xffff;
-                rxlen = rxh >> 16;
+                rxlen = (rxh >> 16) & 0xfff;
 
                 netif_dbg(ks, rx_status, ks->netdev,
                           "rx: stat 0x%04x, len 0x%04x\n", rxstat, rxlen);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index da604059b148..a7499cbf4503 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1517,10 +1517,7 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
                 if (felic_stat & ECSR_LCHNG) {
                         /* Link Changed */
                         if (mdp->cd->no_psr || mdp->no_ether_link) {
-                                if (mdp->link == PHY_DOWN)
-                                        link_stat = 0;
-                                else
-                                        link_stat = PHY_ST_LINK;
+                                goto ignore_link;
                         } else {
                                 link_stat = (sh_eth_read(ndev, PSR));
                                 if (mdp->ether_link_active_low)
@@ -1543,6 +1540,7 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
                 }
         }
 
+ignore_link:
         if (intr_status & EESR_TWB) {
                 /* Write buck end. unused write back interrupt */
                 if (intr_status & EESR_TABT)    /* Transmit Abort int */
@@ -1627,12 +1625,18 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
         struct sh_eth_private *mdp = netdev_priv(ndev);
         struct sh_eth_cpu_data *cd = mdp->cd;
         irqreturn_t ret = IRQ_NONE;
-        u32 intr_status = 0;
+        unsigned long intr_status;
 
         spin_lock(&mdp->lock);
 
-        /* Get interrpt stat */
+        /* Get interrupt status */
         intr_status = sh_eth_read(ndev, EESR);
+        /* Mask it with the interrupt mask, forcing ECI interrupt to be always
+         * enabled since it's the one that  comes thru regardless of the mask,
+         * and we need to fully handle it in sh_eth_error() in order to quench
+         * it as it doesn't get cleared by just writing 1 to the ECI bit...
+         */
+        intr_status &= sh_eth_read(ndev, EESIPR) | DMAC_M_ECI;
         /* Clear interrupt */
         if (intr_status & (EESR_FRC | EESR_RMAF | EESR_RRF |
                         EESR_RTLF | EESR_RTSF | EESR_PRE | EESR_CERF |
@@ -1674,7 +1678,7 @@ static void sh_eth_adjust_link(struct net_device *ndev)
         struct phy_device *phydev = mdp->phydev;
         int new_state = 0;
 
-        if (phydev->link != PHY_DOWN) {
+        if (phydev->link) {
                 if (phydev->duplex != mdp->duplex) {
                         new_state = 1;
                         mdp->duplex = phydev->duplex;
@@ -1688,17 +1692,21 @@ static void sh_eth_adjust_link(struct net_device *ndev)
                         if (mdp->cd->set_rate)
                                 mdp->cd->set_rate(ndev);
                 }
-                if (mdp->link == PHY_DOWN) {
+                if (!mdp->link) {
                         sh_eth_write(ndev,
                                 (sh_eth_read(ndev, ECMR) & ~ECMR_TXF), ECMR);
                         new_state = 1;
                         mdp->link = phydev->link;
+                        if (mdp->cd->no_psr || mdp->no_ether_link)
+                                sh_eth_rcv_snd_enable(ndev);
                 }
         } else if (mdp->link) {
                 new_state = 1;
-                mdp->link = PHY_DOWN;
+                mdp->link = 0;
                 mdp->speed = 0;
                 mdp->duplex = -1;
+                if (mdp->cd->no_psr || mdp->no_ether_link)
+                        sh_eth_rcv_snd_disable(ndev);
         }
 
         if (new_state && netif_msg_link(mdp))
@@ -1715,7 +1723,7 @@ static int sh_eth_phy_init(struct net_device *ndev)
         snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT,
                 mdp->mii_bus->id , mdp->phy_id);
 
-        mdp->link = PHY_DOWN;
+        mdp->link = 0;
         mdp->speed = 0;
         mdp->duplex = -1;
 
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index e5292973900b..1ddc9f235bcb 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -503,7 +503,7 @@ struct sh_eth_private {
         u32 phy_id;                                     /* PHY ID */
         struct mii_bus *mii_bus;        /* MDIO bus control */
         struct phy_device *phydev;      /* PHY device control */
-        enum phy_state link;
+        int link;
         phy_interface_t phy_interface;
         int msg_enable;
         int speed;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 7aebc0cb35e1..1d740423a053 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -458,7 +458,7 @@ void cpsw_tx_handler(void *token, int len, int status)
          * queue is stopped then start the queue as we have free desc for tx
          */
         if (unlikely(netif_queue_stopped(ndev)))
-                netif_start_queue(ndev);
+                netif_wake_queue(ndev);
         cpts_tx_timestamp(priv->cpts, skb);
         priv->stats.tx_packets++;
         priv->stats.tx_bytes += len;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 8121a3d5897c..6a0b47715a84 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1053,7 +1053,7 @@ static void emac_tx_handler(void *token, int len, int status)
          * queue is stopped then start the queue as we have free desc for tx
          */
         if (unlikely(netif_queue_stopped(ndev)))
-                netif_start_queue(ndev);
+                netif_wake_queue(ndev);
         ndev->stats.tx_packets++;
         ndev->stats.tx_bytes += len;
         dev_kfree_skb_any(skb);
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 9abe51710f22..1a15ec14c386 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -914,8 +914,12 @@ static int smsc75xx_set_rx_max_frame_length(struct usbnet *dev, int size)
 static int smsc75xx_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct usbnet *dev = netdev_priv(netdev);
+        int ret;
+
+        if (new_mtu > MAX_SINGLE_PACKET_SIZE)
+                return -EINVAL;
 
-        int ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu);
+        ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu + ETH_HLEN);
         if (ret < 0) {
                 netdev_warn(dev->net, "Failed to set mac rx frame length\n");
                 return ret;
@@ -1324,7 +1328,7 @@ static int smsc75xx_reset(struct usbnet *dev)
 
         netif_dbg(dev, ifup, dev->net, "FCT_TX_CTL set to 0x%08x\n", buf);
 
-        ret = smsc75xx_set_rx_max_frame_length(dev, 1514);
+        ret = smsc75xx_set_rx_max_frame_length(dev, dev->net->mtu + ETH_HLEN);
         if (ret < 0) {
                 netdev_warn(dev->net, "Failed to set max rx frame length\n");
                 return ret;
@@ -2134,8 +2138,8 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                         else if (rx_cmd_a & (RX_CMD_A_LONG | RX_CMD_A_RUNT))
                                 dev->net->stats.rx_frame_errors++;
                 } else {
-                        /* ETH_FRAME_LEN + 4(CRC) + 2(COE) + 4(Vlan) */
-                        if (unlikely(size > (ETH_FRAME_LEN + 12))) {
+                        /* MAX_SINGLE_PACKET_SIZE + 4(CRC) + 2(COE) + 4(Vlan) */
+                        if (unlikely(size > (MAX_SINGLE_PACKET_SIZE + ETH_HLEN + 12))) {
                                 netif_dbg(dev, rx_err, dev->net,
                                           "size err rx_cmd_a=0x%08x\n",
                                           rx_cmd_a);
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 39c84ecf6a42..7fdac6c7b3ea 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -170,7 +170,8 @@ void ath_rx_poll(unsigned long data)
 {
         struct ath_softc *sc = (struct ath_softc *)data;
 
-        ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+        if (!test_bit(SC_OP_INVALID, &sc->sc_flags))
+                ieee80211_queue_work(sc->hw, &sc->hw_check_work);
 }
 
 /*
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index f73cbb512f7c..523355b87659 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1482,8 +1482,12 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         const struct b43_dma_ops *ops;
         struct b43_dmaring *ring;
         struct b43_dmadesc_meta *meta;
+        static const struct b43_txstatus fake; /* filled with 0 */
+        const struct b43_txstatus *txstat;
         int slot, firstused;
         bool frame_succeed;
+        int skip;
+        static u8 err_out1, err_out2;
 
         ring = parse_cookie(dev, status->cookie, &slot);
         if (unlikely(!ring))
@@ -1496,13 +1500,36 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         firstused = ring->current_slot - ring->used_slots + 1;
         if (firstused < 0)
                 firstused = ring->nr_slots + firstused;
+
+        skip = 0;
         if (unlikely(slot != firstused)) {
                 /* This possibly is a firmware bug and will result in
-                 * malfunction, memory leaks and/or stall of DMA functionality. */
-                b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. "
-                       "Expected %d, but got %d\n",
-                       ring->index, firstused, slot);
-                return;
+                 * malfunction, memory leaks and/or stall of DMA functionality.
+                 */
+                if (slot == next_slot(ring, next_slot(ring, firstused))) {
+                        /* If a single header/data pair was missed, skip over
+                         * the first two slots in an attempt to recover.
+                         */
+                        slot = firstused;
+                        skip = 2;
+                        if (!err_out1) {
+                                /* Report the error once. */
+                                b43dbg(dev->wl,
+                                       "Skip on DMA ring %d slot %d.\n",
+                                       ring->index, slot);
+                                err_out1 = 1;
+                        }
+                } else {
+                        /* More than a single header/data pair were missed.
+                         * Report this error once.
+                         */
+                        if (!err_out2)
+                                b43dbg(dev->wl,
+                                       "Out of order TX status report on DMA ring %d. Expected %d, but got %d\n",
+                                       ring->index, firstused, slot);
+                        err_out2 = 1;
+                        return;
+                }
         }
 
         ops = ring->ops;
@@ -1517,11 +1544,13 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                                slot, firstused, ring->index);
                         break;
                 }
+
                 if (meta->skb) {
                         struct b43_private_tx_info *priv_info =
-                                b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
+                             b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
 
-                        unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len, 1);
+                        unmap_descbuffer(ring, meta->dmaaddr,
+                                         meta->skb->len, 1);
                         kfree(priv_info->bouncebuffer);
                         priv_info->bouncebuffer = NULL;
                 } else {
@@ -1533,8 +1562,9 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                         struct ieee80211_tx_info *info;
 
                         if (unlikely(!meta->skb)) {
-                                /* This is a scatter-gather fragment of a frame, so
-                                 * the skb pointer must not be NULL. */
+                                /* This is a scatter-gather fragment of a frame,
+                                 * so the skb pointer must not be NULL.
+                                 */
                                 b43dbg(dev->wl, "TX status unexpected NULL skb "
                                        "at slot %d (first=%d) on ring %d\n",
                                        slot, firstused, ring->index);
@@ -1545,9 +1575,18 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
 
                         /*
                          * Call back to inform the ieee80211 subsystem about
-                         * the status of the transmission.
+                         * the status of the transmission. When skipping over
+                         * a missed TX status report, use a status structure
+                         * filled with zeros to indicate that the frame was not
+                         * sent (frame_count 0) and not acknowledged
                          */
-                        frame_succeed = b43_fill_txstatus_report(dev, info, status);
+                        if (unlikely(skip))
+                                txstat = &fake;
+                        else
+                                txstat = status;
+
+                        frame_succeed = b43_fill_txstatus_report(dev, info,
+                                                                 txstat);
 #ifdef CONFIG_B43_DEBUG
                         if (frame_succeed)
                                 ring->nr_succeed_tx_packets++;
@@ -1575,12 +1614,14 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                 /* Everything unmapped and free'd. So it's not used anymore. */
                 ring->used_slots--;
 
-                if (meta->is_last_fragment) {
+                if (meta->is_last_fragment && !skip) {
                         /* This is the last scatter-gather
                          * fragment of the frame. We are done. */
                         break;
                 }
                 slot = next_slot(ring, slot);
+                if (skip > 0)
+                        --skip;
         }
         if (ring->stopped) {
                 B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME);
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 3c35382ee6c2..e8486c1e091a 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -1564,7 +1564,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
         u16 clip_off[2] = { 0xFFFF, 0xFFFF };
 
         u8 vcm_final = 0;
-        s8 offset[4];
+        s32 offset[4];
         s32 results[8][4] = { };
         s32 results_min[4] = { };
         s32 poll_results[4] = { };
@@ -1615,7 +1615,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
                 }
                 for (i = 0; i < 4; i += 2) {
                         s32 curr;
-                        s32 mind = 40;
+                        s32 mind = 0x100000;
                         s32 minpoll = 249;
                         u8 minvcm = 0;
                         if (2 * core != i)
@@ -1732,7 +1732,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
         u8 regs_save_radio[2];
         u16 regs_save_phy[2];
 
-        s8 offset[4];
+        s32 offset[4];
         u8 core;
         u8 rail;
 
@@ -1799,7 +1799,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
         }
 
         for (i = 0; i < 4; i++) {
-                s32 mind = 40;
+                s32 mind = 0x100000;
                 u8 minvcm = 0;
                 s32 minpoll = 249;
                 s32 curr;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index 21a824232478..18d37645e2cd 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1137,9 +1137,8 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
         gain0_15 = ((biq1 & 0xf) << 12) |
                    ((tia & 0xf) << 8) |
                    ((lna2 & 0x3) << 6) |
-                   ((lna2 & 0x3) << 4) |
-                   ((lna1 & 0x3) << 2) |
-                   ((lna1 & 0x3) << 0);
+                   ((lna2 &
+                     0x3) << 4) | ((lna1 & 0x3) << 2) | ((lna1 & 0x3) << 0);
 
         mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0);
         mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0);
@@ -1157,8 +1156,6 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
         }
 
         mod_phy_reg(pi, 0x44d, (0x1 << 0), (!trsw) << 0);
-        mod_phy_reg(pi, 0x4b1, (0x3 << 11), lna1 << 11);
-        mod_phy_reg(pi, 0x4e6, (0x3 << 3), lna1 << 3);
 
 }
 
@@ -1331,43 +1328,6 @@ static u32 wlc_lcnphy_measure_digital_power(struct brcms_phy *pi, u16 nsamples)
         return (iq_est.i_pwr + iq_est.q_pwr) / nsamples;
 }
 
-static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
-                                      u16 tia_gain, u16 lna2_gain)
-{
-        u32 i_thresh_l, q_thresh_l;
-        u32 i_thresh_h, q_thresh_h;
-        struct lcnphy_iq_est iq_est_h, iq_est_l;
-
-        wlc_lcnphy_set_rx_gain_by_distribution(pi, 0, 0, 0, biq1_gain, tia_gain,
-                                               lna2_gain, 0);
-
-        wlc_lcnphy_rx_gain_override_enable(pi, true);
-        wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
-        udelay(500);
-        write_radio_reg(pi, RADIO_2064_REG112, 0);
-        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
-                return false;
-
-        wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
-        udelay(500);
-        write_radio_reg(pi, RADIO_2064_REG112, 0);
-        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
-                return false;
-
-        i_thresh_l = (iq_est_l.i_pwr << 1);
-        i_thresh_h = (iq_est_l.i_pwr << 2) + iq_est_l.i_pwr;
-
-        q_thresh_l = (iq_est_l.q_pwr << 1);
-        q_thresh_h = (iq_est_l.q_pwr << 2) + iq_est_l.q_pwr;
-        if ((iq_est_h.i_pwr > i_thresh_l) &&
-            (iq_est_h.i_pwr < i_thresh_h) &&
-            (iq_est_h.q_pwr > q_thresh_l) &&
-            (iq_est_h.q_pwr < q_thresh_h))
-                return true;
-
-        return false;
-}
-
 static bool
 wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                      const struct lcnphy_rx_iqcomp *iqcomp,
@@ -1382,8 +1342,8 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
             RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old,
             rfoverride3_old, rfoverride3val_old, rfoverride4_old,
             rfoverride4val_old, afectrlovr_old, afectrlovrval_old;
-        int tia_gain, lna2_gain, biq1_gain;
-        bool set_gain;
+        int tia_gain;
+        u32 received_power, rx_pwr_threshold;
         u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl;
         u16 values_to_save[11];
         s16 *ptr;
@@ -1408,134 +1368,126 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                 goto cal_done;
         }
 
-        WARN_ON(module != 1);
-        tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
-        wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
-
-        for (i = 0; i < 11; i++)
-                values_to_save[i] =
-                        read_radio_reg(pi, rxiq_cal_rf_reg[i]);
-        Core1TxControl_old = read_phy_reg(pi, 0x631);
-
-        or_phy_reg(pi, 0x631, 0x0015);
-
-        RFOverride0_old = read_phy_reg(pi, 0x44c);
-        RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
-        rfoverride2_old = read_phy_reg(pi, 0x4b0);
-        rfoverride2val_old = read_phy_reg(pi, 0x4b1);
-        rfoverride3_old = read_phy_reg(pi, 0x4f9);
-        rfoverride3val_old = read_phy_reg(pi, 0x4fa);
-        rfoverride4_old = read_phy_reg(pi, 0x938);
-        rfoverride4val_old = read_phy_reg(pi, 0x939);
-        afectrlovr_old = read_phy_reg(pi, 0x43b);
-        afectrlovrval_old = read_phy_reg(pi, 0x43c);
-        old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
-        old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
-
-        tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-        if (tx_gain_override_old) {
-                wlc_lcnphy_get_tx_gain(pi, &old_gains);
-                tx_gain_index_old = pi_lcn->lcnphy_current_index;
-        }
-
-        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
+        if (module == 1) {
 
-        mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
+                tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
+                wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
 
-        mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
+                for (i = 0; i < 11; i++)
+                        values_to_save[i] =
+                                read_radio_reg(pi, rxiq_cal_rf_reg[i]);
+                Core1TxControl_old = read_phy_reg(pi, 0x631);
+
+                or_phy_reg(pi, 0x631, 0x0015);
+
+                RFOverride0_old = read_phy_reg(pi, 0x44c);
+                RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
+                rfoverride2_old = read_phy_reg(pi, 0x4b0);
+                rfoverride2val_old = read_phy_reg(pi, 0x4b1);
+                rfoverride3_old = read_phy_reg(pi, 0x4f9);
+                rfoverride3val_old = read_phy_reg(pi, 0x4fa);
+                rfoverride4_old = read_phy_reg(pi, 0x938);
+                rfoverride4val_old = read_phy_reg(pi, 0x939);
+                afectrlovr_old = read_phy_reg(pi, 0x43b);
+                afectrlovrval_old = read_phy_reg(pi, 0x43c);
+                old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
+                old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
+
+                tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
+                if (tx_gain_override_old) {
+                        wlc_lcnphy_get_tx_gain(pi, &old_gains);
+                        tx_gain_index_old = pi_lcn->lcnphy_current_index;
+                }
 
-        write_radio_reg(pi, RADIO_2064_REG116, 0x06);
-        write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
-        write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
-        write_radio_reg(pi, RADIO_2064_REG098, 0x03);
-        write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
-        mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
-        write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
-        write_radio_reg(pi, RADIO_2064_REG114, 0x01);
-        write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
-        write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
-
-        mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
-        mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
-        mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
-        mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
-        mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
-        mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
-        mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
+                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
 
-        mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
+                mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
 
-        write_phy_reg(pi, 0x6da, 0xffff);
-        or_phy_reg(pi, 0x6db, 0x3);
+                mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
 
-        wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
-        set_gain = false;
-
-        lna2_gain = 3;
-        while ((lna2_gain >= 0) && !set_gain) {
-                tia_gain = 4;
-
-                while ((tia_gain >= 0) && !set_gain) {
-                        biq1_gain = 6;
-
-                        while ((biq1_gain >= 0) && !set_gain) {
-                                set_gain = wlc_lcnphy_rx_iq_cal_gain(pi,
-                                                                     (u16)
-                                                                     biq1_gain,
-                                                                     (u16)
-                                                                     tia_gain,
-                                                                     (u16)
-                                                                     lna2_gain);
-                                biq1_gain -= 1;
-                        }
+                write_radio_reg(pi, RADIO_2064_REG116, 0x06);
+                write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
+                write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
+                write_radio_reg(pi, RADIO_2064_REG098, 0x03);
+                write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
+                mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
+                write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
+                write_radio_reg(pi, RADIO_2064_REG114, 0x01);
+                write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
+                write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
+
+                mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
+                mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
+                mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
+                mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
+                mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
+                mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
+                mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
+
+                mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
+
+                wlc_lcnphy_start_tx_tone(pi, 2000, 120, 0);
+                write_phy_reg(pi, 0x6da, 0xffff);
+                or_phy_reg(pi, 0x6db, 0x3);
+                wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
+                wlc_lcnphy_rx_gain_override_enable(pi, true);
+
+                tia_gain = 8;
+                rx_pwr_threshold = 950;
+                while (tia_gain > 0) {
                         tia_gain -= 1;
+                        wlc_lcnphy_set_rx_gain_by_distribution(pi,
+                                                               0, 0, 2, 2,
+                                                               (u16)
+                                                               tia_gain, 1, 0);
+                        udelay(500);
+
+                        received_power =
+                                wlc_lcnphy_measure_digital_power(pi, 2000);
+                        if (received_power < rx_pwr_threshold)
+                                break;
                 }
-                lna2_gain -= 1;
-        }
+                result = wlc_lcnphy_calc_rx_iq_comp(pi, 0xffff);
 
-        if (set_gain)
-                result = wlc_lcnphy_calc_rx_iq_comp(pi, 1024);
-        else
-                result = false;
+                wlc_lcnphy_stop_tx_tone(pi);
 
-        wlc_lcnphy_stop_tx_tone(pi);
+                write_phy_reg(pi, 0x631, Core1TxControl_old);
 
-        write_phy_reg(pi, 0x631, Core1TxControl_old);
-
-        write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
-        write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-        write_phy_reg(pi, 0x4b0, rfoverride2_old);
-        write_phy_reg(pi, 0x4b1, rfoverride2val_old);
-        write_phy_reg(pi, 0x4f9, rfoverride3_old);
-        write_phy_reg(pi, 0x4fa, rfoverride3val_old);
-        write_phy_reg(pi, 0x938, rfoverride4_old);
-        write_phy_reg(pi, 0x939, rfoverride4val_old);
-        write_phy_reg(pi, 0x43b, afectrlovr_old);
-        write_phy_reg(pi, 0x43c, afectrlovrval_old);
-        write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
-        write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
+                write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
+                write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
+                write_phy_reg(pi, 0x4b0, rfoverride2_old);
+                write_phy_reg(pi, 0x4b1, rfoverride2val_old);
+                write_phy_reg(pi, 0x4f9, rfoverride3_old);
+                write_phy_reg(pi, 0x4fa, rfoverride3val_old);
+                write_phy_reg(pi, 0x938, rfoverride4_old);
+                write_phy_reg(pi, 0x939, rfoverride4val_old);
+                write_phy_reg(pi, 0x43b, afectrlovr_old);
+                write_phy_reg(pi, 0x43c, afectrlovrval_old);
+                write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
+                write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
 
-        wlc_lcnphy_clear_trsw_override(pi);
+                wlc_lcnphy_clear_trsw_override(pi);
 
-        mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
+                mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
 
-        for (i = 0; i < 11; i++)
-                write_radio_reg(pi, rxiq_cal_rf_reg[i],
-                                values_to_save[i]);
+                for (i = 0; i < 11; i++)
+                        write_radio_reg(pi, rxiq_cal_rf_reg[i],
+                                        values_to_save[i]);
 
-        if (tx_gain_override_old)
-                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
-        else
-                wlc_lcnphy_disable_tx_gain_override(pi);
+                if (tx_gain_override_old)
+                        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
+                else
+                        wlc_lcnphy_disable_tx_gain_override(pi);
 
-        wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
-        wlc_lcnphy_rx_gain_override_enable(pi, false);
+                wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
+                wlc_lcnphy_rx_gain_override_enable(pi, false);
+        }
 
 cal_done:
         kfree(ptr);
@@ -1829,17 +1781,6 @@ wlc_lcnphy_radio_2064_channel_tune_4313(struct brcms_phy *pi, u8 channel)
                 write_radio_reg(pi, RADIO_2064_REG038, 3);
                 write_radio_reg(pi, RADIO_2064_REG091, 7);
         }
-
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                u8 reg038[14] = {0xd, 0xe, 0xd, 0xd, 0xd, 0xc,
-                        0xa, 0xb, 0xb, 0x3, 0x3, 0x2, 0x0, 0x0};
-
-                write_radio_reg(pi, RADIO_2064_REG02A, 0xf);
-                write_radio_reg(pi, RADIO_2064_REG091, 0x3);
-                write_radio_reg(pi, RADIO_2064_REG038, 0x3);
-
-                write_radio_reg(pi, RADIO_2064_REG038, reg038[channel - 1]);
-        }
 }
 
 static int
@@ -2034,16 +1975,6 @@ wlc_lcnphy_set_tssi_mux(struct brcms_phy *pi, enum lcnphy_tssi_mode pos)
                 } else {
                         mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1);
                         mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
-                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x4, 1<<2);
-                        mod_radio_reg(pi, RADIO_2064_REG036, 0x10, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x10, 1<<4);
-                        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x77);
-                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, 0xe<<1);
-                        mod_radio_reg(pi, RADIO_2064_REG112, 0x80, 1<<7);
-                        mod_radio_reg(pi, RADIO_2064_REG005, 0x7, 1<<1);
-                        mod_radio_reg(pi, RADIO_2064_REG029, 0xf0, 0<<4);
                 }
         } else {
                 mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2);
@@ -2130,14 +2061,12 @@ static void wlc_lcnphy_pwrctrl_rssiparams(struct brcms_phy *pi)
                     (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12));
 
         mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5));
-        mod_radio_reg(pi, RADIO_2064_REG07C, (1 << 0), (1 << 0));
 }
 
 static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 {
         struct phytbl_info tab;
         u32 rfseq, ind;
-        u8 tssi_sel;
 
         tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
         tab.tbl_width = 32;
@@ -2159,13 +2088,7 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 
         mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4);
 
-        if (pi->sh->boardflags & BFL_FEM) {
-                tssi_sel = 0x1;
-                wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
-        } else {
-                tssi_sel = 0xe;
-                wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_POST_PA);
-        }
+        wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
         mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14);
 
         mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15);
@@ -2201,10 +2124,9 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
         mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0);
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
-                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, tssi_sel);
+                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, 0xe);
                 mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4);
         } else {
-                mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, tssi_sel << 1);
                 mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1);
                 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3);
         }
@@ -2251,10 +2173,6 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 
         mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8);
 
-        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x0);
-        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
-        mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
-
         wlc_lcnphy_pwrctrl_rssiparams(pi);
 }
 
@@ -2873,8 +2791,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
                 read_radio_reg(pi, RADIO_2064_REG007) & 1;
         u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10;
         u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4;
-        u8 SAVE_bbmult = wlc_lcnphy_get_bbmult(pi);
-
         idleTssi = read_phy_reg(pi, 0x4ab);
         suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) &
                          MCTL_EN_MAC));
@@ -2892,12 +2808,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
         mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4);
         mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2);
         wlc_lcnphy_tssi_setup(pi);
-
-        mod_phy_reg(pi, 0x4d7, (0x1 << 0), (1 << 0));
-        mod_phy_reg(pi, 0x4d7, (0x1 << 6), (1 << 6));
-
-        wlc_lcnphy_set_bbmult(pi, 0x0);
-
         wlc_phy_do_dummy_tx(pi, true, OFF);
         idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0))
                     >> 0);
@@ -2919,7 +2829,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
 
         mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12);
 
-        wlc_lcnphy_set_bbmult(pi, SAVE_bbmult);
         wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old);
         wlc_lcnphy_set_tx_gain(pi, &old_gains);
         wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl);
@@ -3133,11 +3042,6 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
                         wlc_lcnphy_write_table(pi, &tab);
                         tab.tbl_offset++;
                 }
-                mod_phy_reg(pi, 0x4d0, (0x1 << 0), (0) << 0);
-                mod_phy_reg(pi, 0x4d3, (0xff << 0), (0) << 0);
-                mod_phy_reg(pi, 0x4d3, (0xff << 8), (0) << 8);
-                mod_phy_reg(pi, 0x4d0, (0x1 << 4), (0) << 4);
-                mod_phy_reg(pi, 0x4d0, (0x1 << 2), (0) << 2);
 
                 mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7);
 
@@ -3939,6 +3843,7 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
         target_gains.pad_gain = 21;
         target_gains.dac_gain = 0;
         wlc_lcnphy_set_tx_gain(pi, &target_gains);
+        wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) {
 
@@ -3949,7 +3854,6 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
                                         lcnphy_recal ? LCNPHY_CAL_RECAL :
                                         LCNPHY_CAL_FULL), false);
         } else {
-                wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
                 wlc_lcnphy_tx_iqlo_soft_cal_full(pi);
         }
 
@@ -4374,22 +4278,17 @@ wlc_lcnphy_load_tx_gain_table(struct brcms_phy *pi,
         if (CHSPEC_IS5G(pi->radio_chanspec))
                 pa_gain = 0x70;
         else
-                pa_gain = 0x60;
+                pa_gain = 0x70;
 
         if (pi->sh->boardflags & BFL_FEM)
                 pa_gain = 0x10;
-
         tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
         tab.tbl_width = 32;
         tab.tbl_len = 1;
         tab.tbl_ptr = &val;
 
         for (j = 0; j < 128; j++) {
-                if (pi->sh->boardflags & BFL_FEM)
-                        gm_gain = gain_table[j].gm;
-                else
-                        gm_gain = 15;
-
+                gm_gain = gain_table[j].gm;
                 val = (((u32) pa_gain << 24) |
                        (gain_table[j].pad << 16) |
                        (gain_table[j].pga << 8) | gm_gain);
@@ -4600,10 +4499,7 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
 
         write_phy_reg(pi, 0x4ea, 0x4688);
 
-        if (pi->sh->boardflags & BFL_FEM)
-                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
-        else
-                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 3 << 0);
+        mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
 
         mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6);
 
@@ -4614,13 +4510,6 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
         wlc_lcnphy_rcal(pi);
 
         wlc_lcnphy_rc_cal(pi);
-
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                write_radio_reg(pi, RADIO_2064_REG032, 0x6f);
-                write_radio_reg(pi, RADIO_2064_REG033, 0x19);
-                write_radio_reg(pi, RADIO_2064_REG039, 0xe);
-        }
-
 }
 
 static void wlc_lcnphy_radio_init(struct brcms_phy *pi)
@@ -4650,20 +4539,22 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
                 wlc_lcnphy_write_table(pi, &tab);
         }
 
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
-                tab.tbl_width = 16;
-                tab.tbl_ptr = &val;
-                tab.tbl_len = 1;
+        tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
+        tab.tbl_width = 16;
+        tab.tbl_ptr = &val;
+        tab.tbl_len = 1;
 
-                val = 150;
-                tab.tbl_offset = 0;
-                wlc_lcnphy_write_table(pi, &tab);
+        val = 114;
+        tab.tbl_offset = 0;
+        wlc_lcnphy_write_table(pi, &tab);
 
-                val = 220;
-                tab.tbl_offset = 1;
-                wlc_lcnphy_write_table(pi, &tab);
-        }
+        val = 130;
+        tab.tbl_offset = 1;
+        wlc_lcnphy_write_table(pi, &tab);
+
+        val = 6;
+        tab.tbl_offset = 8;
+        wlc_lcnphy_write_table(pi, &tab);
 
         if (CHSPEC_IS2G(pi->radio_chanspec)) {
                 if (pi->sh->boardflags & BFL_FEM)
@@ -5055,7 +4946,6 @@ void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
                 wlc_lcnphy_load_tx_iir_filter(pi, true, 3);
 
         mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
-        wlc_lcnphy_tssi_setup(pi);
 }
 
 void wlc_phy_detach_lcnphy(struct brcms_phy *pi)
@@ -5094,7 +4984,8 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
         if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
                 return false;
 
-        if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
+        if ((pi->sh->boardflags & BFL_FEM) &&
+            (LCNREV_IS(pi->pubpi.phy_rev, 1))) {
                 if (pi_lcn->lcnphy_tempsense_option == 3) {
                         pi->hwpwrctrl = true;
                         pi->hwpwrctrl_capable = true;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
index b7e95acc2084..622c01ca72c5 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
@@ -1992,70 +1992,70 @@ static const u16 dot11lcn_sw_ctrl_tbl_4313_epa_rev0[] = {
 };
 
 static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = {
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
 };
 
 static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = {
diff --git a/drivers/net/wireless/iwlegacy/4965-rs.c b/drivers/net/wireless/iwlegacy/4965-rs.c
index e8324b5e5bfe..6c7493c2d698 100644
--- a/drivers/net/wireless/iwlegacy/4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/4965-rs.c
@@ -2152,7 +2152,7 @@ il4965_rs_initialize_lq(struct il_priv *il, struct ieee80211_conf *conf,
         int rate_idx;
         int i;
         u32 rate;
-        u8 use_green = il4965_rs_use_green(il, sta);
+        u8 use_green;
         u8 active_tbl = 0;
         u8 valid_tx_ant;
         struct il_station_priv *sta_priv;
@@ -2160,6 +2160,7 @@ il4965_rs_initialize_lq(struct il_priv *il, struct ieee80211_conf *conf,
         if (!sta || !lq_sta)
                 return;
 
+        use_green = il4965_rs_use_green(il, sta);
         sta_priv = (void *)sta->drv_priv;
 
         i = lq_sta->last_txrate_idx;
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index cddf77c36b36..87c006c9c573 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -1262,6 +1262,15 @@ int iwl_dvm_send_cmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         }
 
         /*
+         * This can happen upon FW ASSERT: we clear the STATUS_FW_ERROR flag
+         * in iwl_down but cancel the workers only later.
+         */
+        if (!priv->ucode_loaded) {
+                IWL_ERR(priv, "Fw not loaded - dropping CMD: %x\n", cmd->id);
+                return -EIO;
+        }
+
+        /*
          * Synchronous commands from this op-mode must hold
          * the mutex, this ensures we don't try to send two
          * (or more) synchronous commands at a time.
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 166019afc2d0..0a1cdc5e856b 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -367,6 +367,8 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
                 return -EIO;
         }
 
+        priv->ucode_loaded = true;
+
         if (ucode_type != IWL_UCODE_WOWLAN) {
                 /* delay a bit to give rfkill time to run */
                 msleep(5);
@@ -380,8 +382,6 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
                 return ret;
         }
 
-        priv->ucode_loaded = true;
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 6649e377e9cd..50ba0a468f94 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -475,6 +475,10 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans_pcie->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans_pcie->status);
         iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
         if (hw_rfkill && !run_in_rfkill)
                 return -ERFKILL;
@@ -641,6 +645,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
 
 static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         bool hw_rfkill;
         int err;
 
@@ -656,6 +661,10 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         iwl_enable_rfkill_int(trans);
 
         hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans_pcie->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans_pcie->status);
         iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
 
         return 0;
@@ -694,6 +703,10 @@ static void iwl_trans_pcie_stop_hw(struct iwl_trans *trans,
                  * op_mode.
                  */
                 hw_rfkill = iwl_is_rfkill_set(trans);
+                if (hw_rfkill)
+                        set_bit(STATUS_RFKILL, &trans_pcie->status);
+                else
+                        clear_bit(STATUS_RFKILL, &trans_pcie->status);
                 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
         }
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 005e2cfb2f41..282a5cafa913 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1262,7 +1262,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
                 int copy = 0;
 
-                if (!cmd->len)
+                if (!cmd->len[i])
                         continue;
 
                 /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 6283294398bf..8cd8cdc91a7e 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1508,6 +1508,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 }
                 memcpy(adapter->upld_buf, skb->data,
                        min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len));
+                skb_push(skb, INTF_HEADER_LEN);
                 if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
                                            PCI_DMA_FROMDEVICE))
                         return -1;
diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
index 81a1fe661579..71a73ec5af8d 100644
--- a/drivers/staging/comedi/drivers/s626.c
+++ b/drivers/staging/comedi/drivers/s626.c
@@ -1483,7 +1483,7 @@ static int s626_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
         case TRIG_NONE:
                 /*  continous acquisition */
                 devpriv->ai_continous = 1;
-                devpriv->ai_sample_count = 0;
+                devpriv->ai_sample_count = 1;
                 break;
         }
 
diff --git a/drivers/staging/zcache/Kconfig b/drivers/staging/zcache/Kconfig
index 73582705e8c5..5c3714530961 100644
--- a/drivers/staging/zcache/Kconfig
+++ b/drivers/staging/zcache/Kconfig
@@ -15,7 +15,7 @@ config RAMSTER
         depends on CONFIGFS_FS=y && SYSFS=y && !HIGHMEM && ZCACHE=y
         depends on NET
         # must ensure struct page is 8-byte aligned
-        select HAVE_ALIGNED_STRUCT_PAGE if !64_BIT
+        select HAVE_ALIGNED_STRUCT_PAGE if !64BIT
         default n
         help
           RAMster allows RAM on other machines in a cluster to be utilized
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 2030b608136d..3243ea790eab 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1139,8 +1139,10 @@ target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb)
                 return ret;
 
         ret = target_check_reservation(cmd);
-        if (ret)
+        if (ret) {
+                cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
                 return ret;
+        }
 
         ret = dev->transport->parse_cdb(cmd);
         if (ret)
diff --git a/drivers/tty/serial/8250/8250.c b/drivers/tty/serial/8250/8250_core.c
index cf6a5383748a..35f9c96aada9 100644
--- a/drivers/tty/serial/8250/8250.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -3418,6 +3418,7 @@ MODULE_PARM_DESC(probe_rsa, "Probe I/O ports for RSA");
 #endif
 MODULE_ALIAS_CHARDEV_MAJOR(TTY_MAJOR);
 
+#ifdef CONFIG_SERIAL_8250_DEPRECATED_OPTIONS
 #ifndef MODULE
 /* This module was renamed to 8250_core in 3.7.  Keep the old "8250" name
  * working as well for the module options so we don't break people.  We
@@ -3432,7 +3433,7 @@ MODULE_ALIAS_CHARDEV_MAJOR(TTY_MAJOR);
 static void __used s8250_options(void)
 {
 #undef MODULE_PARAM_PREFIX
-#define MODULE_PARAM_PREFIX "8250."
+#define MODULE_PARAM_PREFIX "8250_core."
 
         module_param_cb(share_irqs, &param_ops_uint, &share_irqs, 0644);
         module_param_cb(nr_uarts, &param_ops_uint, &nr_uarts, 0644);
@@ -3444,5 +3445,6 @@ static void __used s8250_options(void)
 #endif
 }
 #else
-MODULE_ALIAS("8250");
+MODULE_ALIAS("8250_core");
+#endif
 #endif
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index aa76825229dc..26e3a97ab157 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1554,6 +1554,7 @@ pci_wch_ch353_setup(struct serial_private *priv,
 #define PCI_DEVICE_ID_PLX_CRONYX_OMEGA  0xc001
 #define PCI_DEVICE_ID_INTEL_PATSBURG_KT 0x1d3d
 #define PCI_VENDOR_ID_WCH               0x4348
+#define PCI_DEVICE_ID_WCH_CH352_2S      0x3253
 #define PCI_DEVICE_ID_WCH_CH353_4S      0x3453
 #define PCI_DEVICE_ID_WCH_CH353_2S1PF   0x5046
 #define PCI_DEVICE_ID_WCH_CH353_2S1P    0x7053
@@ -2172,6 +2173,14 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                 .subdevice      = PCI_ANY_ID,
                 .setup          = pci_wch_ch353_setup,
         },
+        /* WCH CH352 2S card (16550 clone) */
+        {
+                .vendor         = PCI_VENDOR_ID_WCH,
+                .device         = PCI_DEVICE_ID_WCH_CH352_2S,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .setup          = pci_wch_ch353_setup,
+        },
         /*
          * ASIX devices with FIFO bug
          */
@@ -4870,6 +4879,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_b0_bt_2_115200 },
 
+        {       PCI_VENDOR_ID_WCH, PCI_DEVICE_ID_WCH_CH352_2S,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0, pbn_b0_bt_2_115200 },
+
         /*
          * Commtech, Inc. Fastcom adapters
          */
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index 2ef9537bcb2c..80fe91e64a52 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -33,6 +33,23 @@ config SERIAL_8250
           Most people will say Y or M here, so that they can use serial mice,
           modems and similar devices connecting to the standard serial ports.
 
+config SERIAL_8250_DEPRECATED_OPTIONS
+        bool "Support 8250_core.* kernel options (DEPRECATED)"
+        depends on SERIAL_8250
+        default y
+        ---help---
+          In 3.7 we renamed 8250 to 8250_core by mistake, so now we have to
+          accept kernel parameters in both forms like 8250_core.nr_uarts=4 and
+          8250.nr_uarts=4. We now renamed the module back to 8250, but if
+          anybody noticed in 3.7 and changed their userspace we still have to
+          keep the 8350_core.* options around until they revert the changes
+          they already did.
+
+          If 8250 is built as a module, this adds 8250_core alias instead. 
+
+          If you did not notice yet and/or you have userspace from pre-3.7, it
+          is safe (and recommended) to say N here.
+
 config SERIAL_8250_PNP
         bool "8250/16550 PNP device support" if EXPERT
         depends on SERIAL_8250 && PNP
diff --git a/drivers/tty/serial/8250/Makefile b/drivers/tty/serial/8250/Makefile
index a23838a4d535..36d68d054307 100644
--- a/drivers/tty/serial/8250/Makefile
+++ b/drivers/tty/serial/8250/Makefile
@@ -2,10 +2,10 @@
 # Makefile for the 8250 serial device drivers.
 #
 
-obj-$(CONFIG_SERIAL_8250)               += 8250_core.o
-8250_core-y                             := 8250.o
-8250_core-$(CONFIG_SERIAL_8250_PNP)     += 8250_pnp.o
-8250_core-$(CONFIG_SERIAL_8250_DMA)     += 8250_dma.o
+obj-$(CONFIG_SERIAL_8250)               += 8250.o
+8250-y                                  := 8250_core.o
+8250-$(CONFIG_SERIAL_8250_PNP)          += 8250_pnp.o
+8250-$(CONFIG_SERIAL_8250_DMA)          += 8250_dma.o
 obj-$(CONFIG_SERIAL_8250_GSC)           += 8250_gsc.o
 obj-$(CONFIG_SERIAL_8250_PCI)           += 8250_pci.o
 obj-$(CONFIG_SERIAL_8250_HP300)         += 8250_hp300.o
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index d4a7c241b751..3467462869ce 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -158,7 +158,7 @@ struct atmel_uart_port {
 };
 
 static struct atmel_uart_port atmel_ports[ATMEL_MAX_UART];
-static unsigned long atmel_ports_in_use;
+static DECLARE_BITMAP(atmel_ports_in_use, ATMEL_MAX_UART);
 
 #ifdef SUPPORT_SYSRQ
 static struct console atmel_console;
@@ -1769,15 +1769,14 @@ static int atmel_serial_probe(struct platform_device *pdev)
         if (ret < 0)
                 /* port id not found in platform data nor device-tree aliases:
                  * auto-enumerate it */
-                ret = find_first_zero_bit(&atmel_ports_in_use,
-                                sizeof(atmel_ports_in_use));
+                ret = find_first_zero_bit(atmel_ports_in_use, ATMEL_MAX_UART);
 
-        if (ret > ATMEL_MAX_UART) {
+        if (ret >= ATMEL_MAX_UART) {
                 ret = -ENODEV;
                 goto err;
         }
 
-        if (test_and_set_bit(ret, &atmel_ports_in_use)) {
+        if (test_and_set_bit(ret, atmel_ports_in_use)) {
                 /* port already in use */
                 ret = -EBUSY;
                 goto err;
@@ -1857,7 +1856,7 @@ static int atmel_serial_remove(struct platform_device *pdev)
 
         /* "port" is allocated statically, so we shouldn't free it */
 
-        clear_bit(port->line, &atmel_ports_in_use);
+        clear_bit(port->line, atmel_ports_in_use);
 
         clk_put(atmel_port->clk);
 
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index ba451c7209fc..f36bbba1ac8b 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -578,6 +578,8 @@ static int xuartps_startup(struct uart_port *port)
         /* Receive Timeout register is enabled with value of 10 */
         xuartps_writel(10, XUARTPS_RXTOUT_OFFSET);
 
+        /* Clear out any pending interrupts before enabling them */
+        xuartps_writel(xuartps_readl(XUARTPS_ISR_OFFSET), XUARTPS_ISR_OFFSET);
 
         /* Set the Interrupt Registers with desired interrupts */
         xuartps_writel(XUARTPS_IXR_TXEMPTY | XUARTPS_IXR_PARITY |
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 99b34a30354f..f9ec44cbb82f 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2412,6 +2412,14 @@ int usb_hcd_is_primary_hcd(struct usb_hcd *hcd)
 }
 EXPORT_SYMBOL_GPL(usb_hcd_is_primary_hcd);
 
+int usb_hcd_find_raw_port_number(struct usb_hcd *hcd, int port1)
+{
+        if (!hcd->driver->find_raw_port_number)
+                return port1;
+
+        return hcd->driver->find_raw_port_number(hcd, port1);
+}
+
 static int usb_hcd_request_irqs(struct usb_hcd *hcd,
                 unsigned int irqnum, unsigned long irqflags)
 {
diff --git a/drivers/usb/core/usb-acpi.c b/drivers/usb/core/usb-acpi.c
index b6f4bad3f756..255c14464bf2 100644
--- a/drivers/usb/core/usb-acpi.c
+++ b/drivers/usb/core/usb-acpi.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/acpi.h>
 #include <linux/pci.h>
+#include <linux/usb/hcd.h>
 #include <acpi/acpi_bus.h>
 
 #include "usb.h"
@@ -188,8 +189,13 @@ static int usb_acpi_find_device(struct device *dev, acpi_handle *handle)
                  * connected to.
                  */
                 if (!udev->parent) {
-                        *handle = acpi_get_child(DEVICE_ACPI_HANDLE(&udev->dev),
+                        struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+                        int raw_port_num;
+
+                        raw_port_num = usb_hcd_find_raw_port_number(hcd,
                                 port_num);
+                        *handle = acpi_get_child(DEVICE_ACPI_HANDLE(&udev->dev),
+                                raw_port_num);
                         if (!*handle)
                                 return -ENODEV;
                 } else {
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 5a0c541daf89..c7525b1cad74 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -145,6 +145,7 @@ config USB_LPC32XX
         tristate "LPC32XX USB Peripheral Controller"
         depends on ARCH_LPC32XX
         select USB_ISP1301
+        select USB_OTG_UTILS
         help
            This option selects the USB device controller in the LPC32xx SoC.
 
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index b476daf49f6f..010f686d8881 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1214,6 +1214,7 @@ itd_urb_transaction (
 
                 memset (itd, 0, sizeof *itd);
                 itd->itd_dma = itd_dma;
+                itd->frame = 9999;              /* an invalid value */
                 list_add (&itd->itd_list, &sched->td_list);
         }
         spin_unlock_irqrestore (&ehci->lock, flags);
@@ -1915,6 +1916,7 @@ sitd_urb_transaction (
 
                 memset (sitd, 0, sizeof *sitd);
                 sitd->sitd_dma = sitd_dma;
+                sitd->frame = 9999;             /* an invalid value */
                 list_add (&sitd->sitd_list, &iso_sched->td_list);
         }
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 35616ffbe3ae..6dc238c592bc 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1022,44 +1022,24 @@ void xhci_copy_ep0_dequeue_into_input_ctx(struct xhci_hcd *xhci,
  * is attached to (or the roothub port its ancestor hub is attached to).  All we
  * know is the index of that port under either the USB 2.0 or the USB 3.0
  * roothub, but that doesn't give us the real index into the HW port status
- * registers.  Scan through the xHCI roothub port array, looking for the Nth
- * entry of the correct port speed.  Return the port number of that entry.
+ * registers. Call xhci_find_raw_port_number() to get real index.
  */
 static u32 xhci_find_real_port_number(struct xhci_hcd *xhci,
                 struct usb_device *udev)
 {
         struct usb_device *top_dev;
-        unsigned int num_similar_speed_ports;
-        unsigned int faked_port_num;
-        int i;
+        struct usb_hcd *hcd;
+
+        if (udev->speed == USB_SPEED_SUPER)
+                hcd = xhci->shared_hcd;
+        else
+                hcd = xhci->main_hcd;
 
         for (top_dev = udev; top_dev->parent && top_dev->parent->parent;
                         top_dev = top_dev->parent)
                 /* Found device below root hub */;
-        faked_port_num = top_dev->portnum;
-        for (i = 0, num_similar_speed_ports = 0;
-                        i < HCS_MAX_PORTS(xhci->hcs_params1); i++) {
-                u8 port_speed = xhci->port_array[i];
-
-                /*
-                 * Skip ports that don't have known speeds, or have duplicate
-                 * Extended Capabilities port speed entries.
-                 */
-                if (port_speed == 0 || port_speed == DUPLICATE_ENTRY)
-                        continue;
 
-                /*
-                 * USB 3.0 ports are always under a USB 3.0 hub.  USB 2.0 and
-                 * 1.1 ports are under the USB 2.0 hub.  If the port speed
-                 * matches the device speed, it's a similar speed port.
-                 */
-                if ((port_speed == 0x03) == (udev->speed == USB_SPEED_SUPER))
-                        num_similar_speed_ports++;
-                if (num_similar_speed_ports == faked_port_num)
-                        /* Roothub ports are numbered from 1 to N */
-                        return i+1;
-        }
-        return 0;
+        return  xhci_find_raw_port_number(hcd, top_dev->portnum);
 }
 
 /* Setup an xHCI virtual device for a Set Address command */
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index af259e0ec172..1a30c380043c 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -313,6 +313,7 @@ static const struct hc_driver xhci_pci_hc_driver = {
         .set_usb2_hw_lpm =      xhci_set_usb2_hardware_lpm,
         .enable_usb3_lpm_timeout =      xhci_enable_usb3_lpm_timeout,
         .disable_usb3_lpm_timeout =     xhci_disable_usb3_lpm_timeout,
+        .find_raw_port_number = xhci_find_raw_port_number,
 };
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 882875465301..1969c001b3f9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1599,14 +1599,20 @@ static void handle_port_status(struct xhci_hcd *xhci,
         max_ports = HCS_MAX_PORTS(xhci->hcs_params1);
         if ((port_id <= 0) || (port_id > max_ports)) {
                 xhci_warn(xhci, "Invalid port id %d\n", port_id);
-                bogus_port_status = true;
-                goto cleanup;
+                inc_deq(xhci, xhci->event_ring);
+                return;
         }
 
         /* Figure out which usb_hcd this port is attached to:
          * is it a USB 3.0 port or a USB 2.0/1.1 port?
          */
         major_revision = xhci->port_array[port_id - 1];
+
+        /* Find the right roothub. */
+        hcd = xhci_to_hcd(xhci);
+        if ((major_revision == 0x03) != (hcd->speed == HCD_USB3))
+                hcd = xhci->shared_hcd;
+
         if (major_revision == 0) {
                 xhci_warn(xhci, "Event for port %u not in "
                                 "Extended Capabilities, ignoring.\n",
@@ -1629,10 +1635,6 @@ static void handle_port_status(struct xhci_hcd *xhci,
          * into the index into the ports on the correct split roothub, and the
          * correct bus_state structure.
          */
-        /* Find the right roothub. */
-        hcd = xhci_to_hcd(xhci);
-        if ((major_revision == 0x03) != (hcd->speed == HCD_USB3))
-                hcd = xhci->shared_hcd;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
         if (hcd->speed == HCD_USB3)
                 port_array = xhci->usb3_ports;
@@ -2027,8 +2029,8 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 if (event_trb != ep_ring->dequeue &&
                                 event_trb != td->last_trb)
                         td->urb->actual_length =
-                                td->urb->transfer_buffer_length
-                                - TRB_LEN(le32_to_cpu(event->transfer_len));
+                                td->urb->transfer_buffer_length -
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                 else
                         td->urb->actual_length = 0;
 
@@ -2060,7 +2062,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 /* Maybe the event was for the data stage? */
                         td->urb->actual_length =
                                 td->urb->transfer_buffer_length -
-                                TRB_LEN(le32_to_cpu(event->transfer_len));
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                         xhci_dbg(xhci, "Waiting for status "
                                         "stage event\n");
                         return 0;
@@ -2096,7 +2098,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
         /* handle completion code */
         switch (trb_comp_code) {
         case COMP_SUCCESS:
-                if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
+                if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
                         frame->status = 0;
                         break;
                 }
@@ -2141,7 +2143,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                 len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2]));
                 }
                 len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
-                        TRB_LEN(le32_to_cpu(event->transfer_len));
+                        EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
 
                 if (trb_comp_code != COMP_STOP_INVAL) {
                         frame->actual_length = len;
@@ -2199,7 +2201,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
         case COMP_SUCCESS:
                 /* Double check that the HW transferred everything. */
                 if (event_trb != td->last_trb ||
-                                TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+                    EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
                         xhci_warn(xhci, "WARN Successful completion "
                                         "on short TX\n");
                         if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
@@ -2227,18 +2229,18 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                 "%d bytes untransferred\n",
                                 td->urb->ep->desc.bEndpointAddress,
                                 td->urb->transfer_buffer_length,
-                                TRB_LEN(le32_to_cpu(event->transfer_len)));
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
         /* Fast path - was this the last TRB in the TD for this URB? */
         if (event_trb == td->last_trb) {
-                if (TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+                if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
                         td->urb->actual_length =
                                 td->urb->transfer_buffer_length -
-                                TRB_LEN(le32_to_cpu(event->transfer_len));
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                         if (td->urb->transfer_buffer_length <
                                         td->urb->actual_length) {
                                 xhci_warn(xhci, "HC gave bad length "
                                                 "of %d bytes left\n",
-                                          TRB_LEN(le32_to_cpu(event->transfer_len)));
+                                          EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
                                 td->urb->actual_length = 0;
                                 if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
                                         *status = -EREMOTEIO;
@@ -2280,7 +2282,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 if (trb_comp_code != COMP_STOP_INVAL)
                         td->urb->actual_length +=
                                 TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
-                                TRB_LEN(le32_to_cpu(event->transfer_len));
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
         }
 
         return finish_td(xhci, td, event_trb, event, ep, status, false);
@@ -2368,7 +2370,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
          * transfer type
          */
         case COMP_SUCCESS:
-                if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
+                if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
                         break;
                 if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
                         trb_comp_code = COMP_SHORT_TX;
@@ -2461,14 +2463,21 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                  * TD list.
                  */
                 if (list_empty(&ep_ring->td_list)) {
-                        xhci_warn(xhci, "WARN Event TRB for slot %d ep %d "
-                                        "with no TDs queued?\n",
-                                  TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
-                                  ep_index);
-                        xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
-                                 (le32_to_cpu(event->flags) &
-                                  TRB_TYPE_BITMASK)>>10);
-                        xhci_print_trb_offsets(xhci, (union xhci_trb *) event);
+                        /*
+                         * A stopped endpoint may generate an extra completion
+                         * event if the device was suspended.  Don't print
+                         * warnings.
+                         */
+                        if (!(trb_comp_code == COMP_STOP ||
+                                                trb_comp_code == COMP_STOP_INVAL)) {
+                                xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n",
+                                                TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
+                                                ep_index);
+                                xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
+                                                (le32_to_cpu(event->flags) &
+                                                 TRB_TYPE_BITMASK)>>10);
+                                xhci_print_trb_offsets(xhci, (union xhci_trb *) event);
+                        }
                         if (ep->skip) {
                                 ep->skip = false;
                                 xhci_dbg(xhci, "td_list is empty while skip "
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 849470b18831..53b8f89a0b1c 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3779,6 +3779,28 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
         return 0;
 }
 
+/*
+ * Transfer the port index into real index in the HW port status
+ * registers. Caculate offset between the port's PORTSC register
+ * and port status base. Divide the number of per port register
+ * to get the real index. The raw port number bases 1.
+ */
+int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1)
+{
+        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        __le32 __iomem *base_addr = &xhci->op_regs->port_status_base;
+        __le32 __iomem *addr;
+        int raw_port;
+
+        if (hcd->speed != HCD_USB3)
+                addr = xhci->usb2_ports[port1 - 1];
+        else
+                addr = xhci->usb3_ports[port1 - 1];
+
+        raw_port = (addr - base_addr)/NUM_PORT_REGS + 1;
+        return raw_port;
+}
+
 #ifdef CONFIG_USB_SUSPEND
 
 /* BESL to HIRD Encoding array for USB2 LPM */
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 2c510e4a7d4c..63582719e0fb 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -972,6 +972,10 @@ struct xhci_transfer_event {
         __le32  flags;
 };
 
+/* Transfer event TRB length bit mask */
+/* bits 0:23 */
+#define EVENT_TRB_LEN(p)                ((p) & 0xffffff)
+
 /** Transfer Event bit fields **/
 #define TRB_TO_EP_ID(p) (((p) >> 16) & 0x1f)
 
@@ -1829,6 +1833,7 @@ void xhci_test_and_clear_bit(struct xhci_hcd *xhci, __le32 __iomem **port_array,
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
                 char *buf, u16 wLength);
 int xhci_hub_status_data(struct usb_hcd *hcd, char *buf);
+int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1);
 
 #ifdef CONFIG_PM
 int xhci_bus_suspend(struct usb_hcd *hcd);
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 65217a590068..90549382eba5 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -38,6 +38,7 @@ config USB_ISP1301
         tristate "NXP ISP1301 USB transceiver support"
         depends on USB || USB_GADGET
         depends on I2C
+        select USB_OTG_UTILS
         help
           Say Y here to add support for the NXP ISP1301 USB transceiver driver.
           This chip is typically used as USB transceiver for USB host, gadget
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d4809d551473..9886180e45f1 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -640,6 +640,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_RM_CANVIEW_PID) },
         { USB_DEVICE(ACTON_VID, ACTON_SPECTRAPRO_PID) },
         { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
+        { USB_DEVICE(MITSUBISHI_VID, MITSUBISHI_FXUSB_PID) },
         { USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) },
         { USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
         { USB_DEVICE(BANDB_VID, BANDB_USO9ML2_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 9d359e189a64..e79861eeed4c 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -584,6 +584,13 @@
 #define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
 
 /*
+ * Mitsubishi Electric Corp. (http://www.meau.com)
+ * Submitted by Konstantin Holoborodko
+ */
+#define MITSUBISHI_VID          0x06D3
+#define MITSUBISHI_FXUSB_PID    0x0284 /* USB/RS422 converters: FX-USB-AW/-BD */
+
+/*
  * Definitions for B&B Electronics products.
  */
 #define BANDB_VID               0x0856  /* B&B Electronics Vendor ID */
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 2e70efa08b77..5d9b178484fd 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -903,6 +903,7 @@ static int usb_serial_probe(struct usb_interface *interface,
                 port->port.ops = &serial_port_ops;
                 port->serial = serial;
                 spin_lock_init(&port->lock);
+                init_waitqueue_head(&port->delta_msr_wait);
                 /* Keep this for private driver use for the moment but
                    should probably go away */
                 INIT_WORK(&port->work, usb_serial_port_work);
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index 43fb11ee2e8d..2968b4934659 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -60,6 +60,15 @@ enum {
         VHOST_SCSI_VQ_IO = 2,
 };
 
+/*
+ * VIRTIO_RING_F_EVENT_IDX seems broken. Not sure the bug is in
+ * kernel but disabling it helps.
+ * TODO: debug and remove the workaround.
+ */
+enum {
+        VHOST_SCSI_FEATURES = VHOST_FEATURES & (~VIRTIO_RING_F_EVENT_IDX)
+};
+
 #define VHOST_SCSI_MAX_TARGET   256
 #define VHOST_SCSI_MAX_VQ       128
 
@@ -946,7 +955,7 @@ static void vhost_scsi_flush(struct vhost_scsi *vs)
 
 static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
 {
-        if (features & ~VHOST_FEATURES)
+        if (features & ~VHOST_SCSI_FEATURES)
                 return -EOPNOTSUPP;
 
         mutex_lock(&vs->dev.mutex);
@@ -992,7 +1001,7 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
                         return -EFAULT;
                 return 0;
         case VHOST_GET_FEATURES:
-                features = VHOST_FEATURES;
+                features = VHOST_SCSI_FEATURES;
                 if (copy_to_user(featurep, &features, sizeof features))
                         return -EFAULT;
                 return 0;
diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/omap/omapfb_main.c
index e31f5b33b501..d40612c31a98 100644
--- a/drivers/video/omap/omapfb_main.c
+++ b/drivers/video/omap/omapfb_main.c
@@ -32,6 +32,8 @@
 
 #include <linux/omap-dma.h>
 
+#include <mach/hardware.h>
+
 #include "omapfb.h"
 #include "lcdc.h"
 
diff --git a/drivers/video/omap2/displays/panel-tpo-td043mtea1.c b/drivers/video/omap2/displays/panel-tpo-td043mtea1.c
index 6b6643911d29..048c98381ef6 100644
--- a/drivers/video/omap2/displays/panel-tpo-td043mtea1.c
+++ b/drivers/video/omap2/displays/panel-tpo-td043mtea1.c
@@ -63,6 +63,9 @@ struct tpo_td043_device {
         u32 power_on_resume:1;
 };
 
+/* used to pass spi_device from SPI to DSS portion of the driver */
+static struct tpo_td043_device *g_tpo_td043;
+
 static int tpo_td043_write(struct spi_device *spi, u8 addr, u8 data)
 {
         struct spi_message      m;
@@ -403,7 +406,7 @@ static void tpo_td043_disable(struct omap_dss_device *dssdev)
 
 static int tpo_td043_probe(struct omap_dss_device *dssdev)
 {
-        struct tpo_td043_device *tpo_td043 = dev_get_drvdata(&dssdev->dev);
+        struct tpo_td043_device *tpo_td043 = g_tpo_td043;
         int nreset_gpio = dssdev->reset_gpio;
         int ret = 0;
 
@@ -440,6 +443,8 @@ static int tpo_td043_probe(struct omap_dss_device *dssdev)
         if (ret)
                 dev_warn(&dssdev->dev, "failed to create sysfs files\n");
 
+        dev_set_drvdata(&dssdev->dev, tpo_td043);
+
         return 0;
 
 fail_gpio_req:
@@ -505,6 +510,9 @@ static int tpo_td043_spi_probe(struct spi_device *spi)
                 return -ENODEV;
         }
 
+        if (g_tpo_td043 != NULL)
+                return -EBUSY;
+
         spi->bits_per_word = 16;
         spi->mode = SPI_MODE_0;
 
@@ -521,7 +529,7 @@ static int tpo_td043_spi_probe(struct spi_device *spi)
         tpo_td043->spi = spi;
         tpo_td043->nreset_gpio = dssdev->reset_gpio;
         dev_set_drvdata(&spi->dev, tpo_td043);
-        dev_set_drvdata(&dssdev->dev, tpo_td043);
+        g_tpo_td043 = tpo_td043;
 
         omap_dss_register_driver(&tpo_td043_driver);
 
@@ -534,6 +542,7 @@ static int tpo_td043_spi_remove(struct spi_device *spi)
 
         omap_dss_unregister_driver(&tpo_td043_driver);
         kfree(tpo_td043);
+        g_tpo_td043 = NULL;
 
         return 0;
 }
diff --git a/drivers/video/omap2/dss/dss_features.c b/drivers/video/omap2/dss/dss_features.c
index d7d66ef5cb58..7f791aeda4d2 100644
--- a/drivers/video/omap2/dss/dss_features.c
+++ b/drivers/video/omap2/dss/dss_features.c
@@ -202,12 +202,10 @@ static const enum omap_dss_output_id omap3630_dss_supported_outputs[] = {
 
 static const enum omap_dss_output_id omap4_dss_supported_outputs[] = {
         /* OMAP_DSS_CHANNEL_LCD */
-        OMAP_DSS_OUTPUT_DPI | OMAP_DSS_OUTPUT_DBI |
-        OMAP_DSS_OUTPUT_DSI1,
+        OMAP_DSS_OUTPUT_DBI | OMAP_DSS_OUTPUT_DSI1,
 
         /* OMAP_DSS_CHANNEL_DIGIT */
-        OMAP_DSS_OUTPUT_VENC | OMAP_DSS_OUTPUT_HDMI |
-        OMAP_DSS_OUTPUT_DPI,
+        OMAP_DSS_OUTPUT_VENC | OMAP_DSS_OUTPUT_HDMI,
 
         /* OMAP_DSS_CHANNEL_LCD2 */
         OMAP_DSS_OUTPUT_DPI | OMAP_DSS_OUTPUT_DBI |
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 5a32232cf7c1..67af155cf602 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -182,7 +182,7 @@ config XEN_PRIVCMD
 
 config XEN_STUB
         bool "Xen stub drivers"
-        depends on XEN && X86_64
+        depends on XEN && X86_64 && BROKEN
         default n
         help
           Allow kernel to install stub drivers, to reserve space for Xen drivers,
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index d17aa41a9041..aa85881d17b2 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -403,11 +403,23 @@ static void unmask_evtchn(int port)
 
         if (unlikely((cpu != cpu_from_evtchn(port))))
                 do_hypercall = 1;
-        else
+        else {
+                /*
+                 * Need to clear the mask before checking pending to
+                 * avoid a race with an event becoming pending.
+                 *
+                 * EVTCHNOP_unmask will only trigger an upcall if the
+                 * mask bit was set, so if a hypercall is needed
+                 * remask the event.
+                 */
+                sync_clear_bit(port, BM(&s->evtchn_mask[0]));
                 evtchn_pending = sync_test_bit(port, BM(&s->evtchn_pending[0]));
 
-        if (unlikely(evtchn_pending && xen_hvm_domain()))
-                do_hypercall = 1;
+                if (unlikely(evtchn_pending && xen_hvm_domain())) {
+                        sync_set_bit(port, BM(&s->evtchn_mask[0]));
+                        do_hypercall = 1;
+                }
+        }
 
         /* Slow path (hypercall) if this is a non-local port or if this is
          * an hvm domain and an event is pending (hvm domains don't have
@@ -418,8 +430,6 @@ static void unmask_evtchn(int port)
         } else {
                 struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu);
 
-                sync_clear_bit(port, BM(&s->evtchn_mask[0]));
-
                 /*
                  * The following is basically the equivalent of
                  * 'hw_resend_irq'. Just like a real IO-APIC we 'lose
diff --git a/drivers/xen/fallback.c b/drivers/xen/fallback.c
index 0ef7c4d40f86..b04fb64c5a91 100644
--- a/drivers/xen/fallback.c
+++ b/drivers/xen/fallback.c
@@ -44,7 +44,7 @@ int xen_event_channel_op_compat(int cmd, void *arg)
 }
 EXPORT_SYMBOL_GPL(xen_event_channel_op_compat);
 
-int HYPERVISOR_physdev_op_compat(int cmd, void *arg)
+int xen_physdev_op_compat(int cmd, void *arg)
 {
         struct physdev_op op;
         int rc;
@@ -78,3 +78,4 @@ int HYPERVISOR_physdev_op_compat(int cmd, void *arg)
 
         return rc;
 }
+EXPORT_SYMBOL_GPL(xen_physdev_op_compat);
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index f3278a6603ca..90e34ac7e522 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -505,6 +505,9 @@ static int __init xen_acpi_processor_init(void)
 
                 pr = per_cpu(processors, i);
                 perf = per_cpu_ptr(acpi_perf_data, i);
+                if (!pr)
+                        continue;
+
                 pr->performance = perf;
                 rc = acpi_processor_get_performance_info(pr);
                 if (rc)
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 9204126f1560..a2278ba7fb27 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -17,6 +17,7 @@
 #include <xen/events.h>
 #include <asm/xen/pci.h>
 #include <asm/xen/hypervisor.h>
+#include <xen/interface/physdev.h>
 #include "pciback.h"
 #include "conf_space.h"
 #include "conf_space_quirks.h"
@@ -85,37 +86,52 @@ static struct pcistub_device *pcistub_device_alloc(struct pci_dev *dev)
 static void pcistub_device_release(struct kref *kref)
 {
         struct pcistub_device *psdev;
+        struct pci_dev *dev;
         struct xen_pcibk_dev_data *dev_data;
 
         psdev = container_of(kref, struct pcistub_device, kref);
-        dev_data = pci_get_drvdata(psdev->dev);
+        dev = psdev->dev;
+        dev_data = pci_get_drvdata(dev);
 
-        dev_dbg(&psdev->dev->dev, "pcistub_device_release\n");
+        dev_dbg(&dev->dev, "pcistub_device_release\n");
 
-        xen_unregister_device_domain_owner(psdev->dev);
+        xen_unregister_device_domain_owner(dev);
 
         /* Call the reset function which does not take lock as this
          * is called from "unbind" which takes a device_lock mutex.
          */
-        __pci_reset_function_locked(psdev->dev);
-        if (pci_load_and_free_saved_state(psdev->dev,
-                                          &dev_data->pci_saved_state)) {
-                dev_dbg(&psdev->dev->dev, "Could not reload PCI state\n");
-        } else
-                pci_restore_state(psdev->dev);
+        __pci_reset_function_locked(dev);
+        if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
+                dev_dbg(&dev->dev, "Could not reload PCI state\n");
+        else
+                pci_restore_state(dev);
+
+        if (pci_find_capability(dev, PCI_CAP_ID_MSIX)) {
+                struct physdev_pci_device ppdev = {
+                        .seg = pci_domain_nr(dev->bus),
+                        .bus = dev->bus->number,
+                        .devfn = dev->devfn
+                };
+                int err = HYPERVISOR_physdev_op(PHYSDEVOP_release_msix,
+                                                &ppdev);
+
+                if (err)
+                        dev_warn(&dev->dev, "MSI-X release failed (%d)\n",
+                                 err);
+        }
 
         /* Disable the device */
-        xen_pcibk_reset_device(psdev->dev);
+        xen_pcibk_reset_device(dev);
 
         kfree(dev_data);
-        pci_set_drvdata(psdev->dev, NULL);
+        pci_set_drvdata(dev, NULL);
 
         /* Clean-up the device */
-        xen_pcibk_config_free_dyn_fields(psdev->dev);
-        xen_pcibk_config_free_dev(psdev->dev);
+        xen_pcibk_config_free_dyn_fields(dev);
+        xen_pcibk_config_free_dev(dev);
 
-        psdev->dev->dev_flags &= ~PCI_DEV_FLAGS_ASSIGNED;
-        pci_dev_put(psdev->dev);
+        dev->dev_flags &= ~PCI_DEV_FLAGS_ASSIGNED;
+        pci_dev_put(dev);
 
         kfree(psdev);
 }
@@ -355,6 +371,19 @@ static int pcistub_init_device(struct pci_dev *dev)
         if (err)
                 goto config_release;
 
+        if (pci_find_capability(dev, PCI_CAP_ID_MSIX)) {
+                struct physdev_pci_device ppdev = {
+                        .seg = pci_domain_nr(dev->bus),
+                        .bus = dev->bus->number,
+                        .devfn = dev->devfn
+                };
+
+                err = HYPERVISOR_physdev_op(PHYSDEVOP_prepare_msix, &ppdev);
+                if (err)
+                        dev_err(&dev->dev, "MSI-X preparation failed (%d)\n",
+                                err);
+        }
+
         /* We need the device active to save the state. */
         dev_dbg(&dev->dev, "save state of device\n");
         pci_save_state(dev);
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index ecd25a1b4e51..ca9d8f1a3bb6 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -651,6 +651,8 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,
         if (tree_mod_dont_log(fs_info, NULL))
                 return 0;
 
+        __tree_mod_log_free_eb(fs_info, old_root);
+
         ret = tree_mod_alloc(fs_info, flags, &tm);
         if (ret < 0)
                 goto out;
@@ -736,7 +738,7 @@ tree_mod_log_search(struct btrfs_fs_info *fs_info, u64 start, u64 min_seq)
 static noinline void
 tree_mod_log_eb_copy(struct btrfs_fs_info *fs_info, struct extent_buffer *dst,
                      struct extent_buffer *src, unsigned long dst_offset,
-                     unsigned long src_offset, int nr_items)
+                     unsigned long src_offset, int nr_items, int log_removal)
 {
         int ret;
         int i;
@@ -750,10 +752,12 @@ tree_mod_log_eb_copy(struct btrfs_fs_info *fs_info, struct extent_buffer *dst,
         }
 
         for (i = 0; i < nr_items; i++) {
-                ret = tree_mod_log_insert_key_locked(fs_info, src,
-                                                     i + src_offset,
-                                                     MOD_LOG_KEY_REMOVE);
-                BUG_ON(ret < 0);
+                if (log_removal) {
+                        ret = tree_mod_log_insert_key_locked(fs_info, src,
+                                                        i + src_offset,
+                                                        MOD_LOG_KEY_REMOVE);
+                        BUG_ON(ret < 0);
+                }
                 ret = tree_mod_log_insert_key_locked(fs_info, dst,
                                                      i + dst_offset,
                                                      MOD_LOG_KEY_ADD);
@@ -927,7 +931,6 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                         ret = btrfs_dec_ref(trans, root, buf, 1, 1);
                         BUG_ON(ret); /* -ENOMEM */
                 }
-                tree_mod_log_free_eb(root->fs_info, buf);
                 clean_tree_block(trans, root, buf);
                 *last_ref = 1;
         }
@@ -1046,6 +1049,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
                 btrfs_set_node_ptr_generation(parent, parent_slot,
                                               trans->transid);
                 btrfs_mark_buffer_dirty(parent);
+                tree_mod_log_free_eb(root->fs_info, buf);
                 btrfs_free_tree_block(trans, root, buf, parent_start,
                                       last_ref);
         }
@@ -1750,7 +1754,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                         goto enospc;
                 }
 
-                tree_mod_log_free_eb(root->fs_info, root->node);
                 tree_mod_log_set_root_pointer(root, child);
                 rcu_assign_pointer(root->node, child);
 
@@ -2995,7 +2998,7 @@ static int push_node_left(struct btrfs_trans_handle *trans,
                 push_items = min(src_nritems - 8, push_items);
 
         tree_mod_log_eb_copy(root->fs_info, dst, src, dst_nritems, 0,
-                             push_items);
+                             push_items, 1);
         copy_extent_buffer(dst, src,
                            btrfs_node_key_ptr_offset(dst_nritems),
                            btrfs_node_key_ptr_offset(0),
@@ -3066,7 +3069,7 @@ static int balance_node_right(struct btrfs_trans_handle *trans,
                                       sizeof(struct btrfs_key_ptr));
 
         tree_mod_log_eb_copy(root->fs_info, dst, src, 0,
-                             src_nritems - push_items, push_items);
+                             src_nritems - push_items, push_items, 1);
         copy_extent_buffer(dst, src,
                            btrfs_node_key_ptr_offset(0),
                            btrfs_node_key_ptr_offset(src_nritems - push_items),
@@ -3218,12 +3221,18 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
         int mid;
         int ret;
         u32 c_nritems;
+        int tree_mod_log_removal = 1;
 
         c = path->nodes[level];
         WARN_ON(btrfs_header_generation(c) != trans->transid);
         if (c == root->node) {
                 /* trying to split the root, lets make a new one */
                 ret = insert_new_root(trans, root, path, level + 1);
+                /*
+                 * removal of root nodes has been logged by
+                 * tree_mod_log_set_root_pointer due to locking
+                 */
+                tree_mod_log_removal = 0;
                 if (ret)
                         return ret;
         } else {
@@ -3261,7 +3270,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
                             (unsigned long)btrfs_header_chunk_tree_uuid(split),
                             BTRFS_UUID_SIZE);
 
-        tree_mod_log_eb_copy(root->fs_info, split, c, 0, mid, c_nritems - mid);
+        tree_mod_log_eb_copy(root->fs_info, split, c, 0, mid, c_nritems - mid,
+                             tree_mod_log_removal);
         copy_extent_buffer(split, c,
                            btrfs_node_key_ptr_offset(0),
                            btrfs_node_key_ptr_offset(mid),
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 7d84651e850b..6d19a0a554aa 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1291,6 +1291,7 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans,
                                       0, objectid, NULL, 0, 0, 0);
         if (IS_ERR(leaf)) {
                 ret = PTR_ERR(leaf);
+                leaf = NULL;
                 goto fail;
         }
 
@@ -1334,11 +1335,16 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans,
 
         btrfs_tree_unlock(leaf);
 
+        return root;
+
 fail:
-        if (ret)
-                return ERR_PTR(ret);
+        if (leaf) {
+                btrfs_tree_unlock(leaf);
+                free_extent_buffer(leaf);
+        }
+        kfree(root);
 
-        return root;
+        return ERR_PTR(ret);
 }
 
 static struct btrfs_root *alloc_log_tree(struct btrfs_trans_handle *trans,
@@ -3253,7 +3259,7 @@ void btrfs_free_fs_root(struct btrfs_fs_info *fs_info, struct btrfs_root *root)
         if (btrfs_root_refs(&root->root_item) == 0)
                 synchronize_srcu(&fs_info->subvol_srcu);
 
-        if (fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
+        if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) {
                 btrfs_free_log(NULL, root);
                 btrfs_free_log_root_tree(NULL, fs_info);
         }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 9ac2eca681eb..3d551231caba 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -257,7 +257,8 @@ static int exclude_super_stripes(struct btrfs_root *root,
                 cache->bytes_super += stripe_len;
                 ret = add_excluded_extent(root, cache->key.objectid,
                                           stripe_len);
-                BUG_ON(ret); /* -ENOMEM */
+                if (ret)
+                        return ret;
         }
 
         for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
@@ -265,13 +266,17 @@ static int exclude_super_stripes(struct btrfs_root *root,
                 ret = btrfs_rmap_block(&root->fs_info->mapping_tree,
                                        cache->key.objectid, bytenr,
                                        0, &logical, &nr, &stripe_len);
-                BUG_ON(ret); /* -ENOMEM */
+                if (ret)
+                        return ret;
 
                 while (nr--) {
                         cache->bytes_super += stripe_len;
                         ret = add_excluded_extent(root, logical[nr],
                                                   stripe_len);
-                        BUG_ON(ret); /* -ENOMEM */
+                        if (ret) {
+                                kfree(logical);
+                                return ret;
+                        }
                 }
 
                 kfree(logical);
@@ -4438,7 +4443,7 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
         spin_lock(&sinfo->lock);
         spin_lock(&block_rsv->lock);
 
-        block_rsv->size = num_bytes;
+        block_rsv->size = min_t(u64, num_bytes, 512 * 1024 * 1024);
 
         num_bytes = sinfo->bytes_used + sinfo->bytes_pinned +
                     sinfo->bytes_reserved + sinfo->bytes_readonly +
@@ -4793,14 +4798,49 @@ out_fail:
          * If the inodes csum_bytes is the same as the original
          * csum_bytes then we know we haven't raced with any free()ers
          * so we can just reduce our inodes csum bytes and carry on.
-         * Otherwise we have to do the normal free thing to account for
-         * the case that the free side didn't free up its reserve
-         * because of this outstanding reservation.
          */
-        if (BTRFS_I(inode)->csum_bytes == csum_bytes)
+        if (BTRFS_I(inode)->csum_bytes == csum_bytes) {
                 calc_csum_metadata_size(inode, num_bytes, 0);
-        else
-                to_free = calc_csum_metadata_size(inode, num_bytes, 0);
+        } else {
+                u64 orig_csum_bytes = BTRFS_I(inode)->csum_bytes;
+                u64 bytes;
+
+                /*
+                 * This is tricky, but first we need to figure out how much we
+                 * free'd from any free-ers that occured during this
+                 * reservation, so we reset ->csum_bytes to the csum_bytes
+                 * before we dropped our lock, and then call the free for the
+                 * number of bytes that were freed while we were trying our
+                 * reservation.
+                 */
+                bytes = csum_bytes - BTRFS_I(inode)->csum_bytes;
+                BTRFS_I(inode)->csum_bytes = csum_bytes;
+                to_free = calc_csum_metadata_size(inode, bytes, 0);
+
+
+                /*
+                 * Now we need to see how much we would have freed had we not
+                 * been making this reservation and our ->csum_bytes were not
+                 * artificially inflated.
+                 */
+                BTRFS_I(inode)->csum_bytes = csum_bytes - num_bytes;
+                bytes = csum_bytes - orig_csum_bytes;
+                bytes = calc_csum_metadata_size(inode, bytes, 0);
+
+                /*
+                 * Now reset ->csum_bytes to what it should be.  If bytes is
+                 * more than to_free then we would have free'd more space had we
+                 * not had an artificially high ->csum_bytes, so we need to free
+                 * the remainder.  If bytes is the same or less then we don't
+                 * need to do anything, the other free-ers did the correct
+                 * thing.
+                 */
+                BTRFS_I(inode)->csum_bytes = orig_csum_bytes - num_bytes;
+                if (bytes > to_free)
+                        to_free = bytes - to_free;
+                else
+                        to_free = 0;
+        }
         spin_unlock(&BTRFS_I(inode)->lock);
         if (dropped)
                 to_free += btrfs_calc_trans_metadata_size(root, dropped);
@@ -7947,7 +7987,17 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                  * info has super bytes accounted for, otherwise we'll think
                  * we have more space than we actually do.
                  */
-                exclude_super_stripes(root, cache);
+                ret = exclude_super_stripes(root, cache);
+                if (ret) {
+                        /*
+                         * We may have excluded something, so call this just in
+                         * case.
+                         */
+                        free_excluded_extents(root, cache);
+                        kfree(cache->free_space_ctl);
+                        kfree(cache);
+                        goto error;
+                }
 
                 /*
                  * check for two cases, either we are full, and therefore
@@ -8089,7 +8139,17 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
 
         cache->last_byte_to_unpin = (u64)-1;
         cache->cached = BTRFS_CACHE_FINISHED;
-        exclude_super_stripes(root, cache);
+        ret = exclude_super_stripes(root, cache);
+        if (ret) {
+                /*
+                 * We may have excluded something, so call this just in
+                 * case.
+                 */
+                free_excluded_extents(root, cache);
+                kfree(cache->free_space_ctl);
+                kfree(cache);
+                return ret;
+        }
 
         add_new_free_space(cache, root->fs_info, chunk_offset,
                            chunk_offset + size);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index f173c5af6461..cdee391fc7bf 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1257,6 +1257,39 @@ int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end)
                                 GFP_NOFS);
 }
 
+int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end)
+{
+        unsigned long index = start >> PAGE_CACHE_SHIFT;
+        unsigned long end_index = end >> PAGE_CACHE_SHIFT;
+        struct page *page;
+
+        while (index <= end_index) {
+                page = find_get_page(inode->i_mapping, index);
+                BUG_ON(!page); /* Pages should be in the extent_io_tree */
+                clear_page_dirty_for_io(page);
+                page_cache_release(page);
+                index++;
+        }
+        return 0;
+}
+
+int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end)
+{
+        unsigned long index = start >> PAGE_CACHE_SHIFT;
+        unsigned long end_index = end >> PAGE_CACHE_SHIFT;
+        struct page *page;
+
+        while (index <= end_index) {
+                page = find_get_page(inode->i_mapping, index);
+                BUG_ON(!page); /* Pages should be in the extent_io_tree */
+                account_page_redirty(page);
+                __set_page_dirty_nobuffers(page);
+                page_cache_release(page);
+                index++;
+        }
+        return 0;
+}
+
 /*
  * helper function to set both pages and extents in the tree writeback
  */
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 6068a1985560..258c92156857 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -325,6 +325,8 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long offset,
                       unsigned long *map_len);
 int extent_range_uptodate(struct extent_io_tree *tree,
                           u64 start, u64 end);
+int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end);
+int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end);
 int extent_clear_unlock_delalloc(struct inode *inode,
                                 struct extent_io_tree *tree,
                                 u64 start, u64 end, struct page *locked_page,
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index ec160202be3e..c4628a201cb3 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -118,9 +118,11 @@ struct btrfs_csum_item *btrfs_lookup_csum(struct btrfs_trans_handle *trans,
                 csums_in_item = btrfs_item_size_nr(leaf, path->slots[0]);
                 csums_in_item /= csum_size;
 
-                if (csum_offset >= csums_in_item) {
+                if (csum_offset == csums_in_item) {
                         ret = -EFBIG;
                         goto fail;
+                } else if (csum_offset > csums_in_item) {
+                        goto fail;
                 }
         }
         item = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_csum_item);
@@ -728,7 +730,6 @@ int btrfs_csum_file_blocks(struct btrfs_trans_handle *trans,
                 return -ENOMEM;
 
         sector_sum = sums->sums;
-        trans->adding_csums = 1;
 again:
         next_offset = (u64)-1;
         found_next = 0;
@@ -899,7 +900,6 @@ next_sector:
                 goto again;
         }
 out:
-        trans->adding_csums = 0;
         btrfs_free_path(path);
         return ret;
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 5b4ea5f55b8f..ade03e6f7bd2 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2142,6 +2142,7 @@ static long btrfs_fallocate(struct file *file, int mode,
 {
         struct inode *inode = file_inode(file);
         struct extent_state *cached_state = NULL;
+        struct btrfs_root *root = BTRFS_I(inode)->root;
         u64 cur_offset;
         u64 last_byte;
         u64 alloc_start;
@@ -2169,6 +2170,11 @@ static long btrfs_fallocate(struct file *file, int mode,
         ret = btrfs_check_data_free_space(inode, alloc_end - alloc_start);
         if (ret)
                 return ret;
+        if (root->fs_info->quota_enabled) {
+                ret = btrfs_qgroup_reserve(root, alloc_end - alloc_start);
+                if (ret)
+                        goto out_reserve_fail;
+        }
 
         /*
          * wait for ordered IO before we have any locks.  We'll loop again
@@ -2272,6 +2278,9 @@ static long btrfs_fallocate(struct file *file, int mode,
                              &cached_state, GFP_NOFS);
 out:
         mutex_unlock(&inode->i_mutex);
+        if (root->fs_info->quota_enabled)
+                btrfs_qgroup_free(root, alloc_end - alloc_start);
+out_reserve_fail:
         /* Let go of our reservation. */
         btrfs_free_reserved_data_space(inode, alloc_end - alloc_start);
         return ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index ca1b767d51f7..09c58a35b429 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -353,6 +353,7 @@ static noinline int compress_file_range(struct inode *inode,
         int i;
         int will_compress;
         int compress_type = root->fs_info->compress_type;
+        int redirty = 0;
 
         /* if this is a small write inside eof, kick off a defrag */
         if ((end - start + 1) < 16 * 1024 &&
@@ -415,6 +416,17 @@ again:
                 if (BTRFS_I(inode)->force_compress)
                         compress_type = BTRFS_I(inode)->force_compress;
 
+                /*
+                 * we need to call clear_page_dirty_for_io on each
+                 * page in the range.  Otherwise applications with the file
+                 * mmap'd can wander in and change the page contents while
+                 * we are compressing them.
+                 *
+                 * If the compression fails for any reason, we set the pages
+                 * dirty again later on.
+                 */
+                extent_range_clear_dirty_for_io(inode, start, end);
+                redirty = 1;
                 ret = btrfs_compress_pages(compress_type,
                                            inode->i_mapping, start,
                                            total_compressed, pages,
@@ -554,6 +566,8 @@ cleanup_and_bail_uncompressed:
                         __set_page_dirty_nobuffers(locked_page);
                         /* unlocked later on in the async handlers */
                 }
+                if (redirty)
+                        extent_range_redirty_for_io(inode, start, end);
                 add_async_extent(async_cow, start, end - start + 1,
                                  0, NULL, 0, BTRFS_COMPRESS_NONE);
                 *num_added += 1;
@@ -1743,8 +1757,10 @@ static noinline int add_pending_csums(struct btrfs_trans_handle *trans,
         struct btrfs_ordered_sum *sum;
 
         list_for_each_entry(sum, list, list) {
+                trans->adding_csums = 1;
                 btrfs_csum_file_blocks(trans,
                        BTRFS_I(inode)->root->fs_info->csum_root, sum);
+                trans->adding_csums = 0;
         }
         return 0;
 }
@@ -3679,11 +3695,9 @@ static struct btrfs_trans_handle *__unlink_start_trans(struct inode *dir,
          * 1 for the dir item
          * 1 for the dir index
          * 1 for the inode ref
-         * 1 for the inode ref in the tree log
-         * 2 for the dir entries in the log
          * 1 for the inode
          */
-        trans = btrfs_start_transaction(root, 8);
+        trans = btrfs_start_transaction(root, 5);
         if (!IS_ERR(trans) || PTR_ERR(trans) != -ENOSPC)
                 return trans;
 
@@ -8127,7 +8141,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
          * inodes.  So 5 * 2 is 10, plus 1 for the new link, so 11 total items
          * should cover the worst case number of items we'll modify.
          */
-        trans = btrfs_start_transaction(root, 20);
+        trans = btrfs_start_transaction(root, 11);
         if (IS_ERR(trans)) {
                 ret = PTR_ERR(trans);
                 goto out_notrans;
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index dc08d77b717e..005c45db699e 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -557,6 +557,7 @@ void btrfs_wait_ordered_extents(struct btrfs_root *root, int delay_iput)
         INIT_LIST_HEAD(&splice);
         INIT_LIST_HEAD(&works);
 
+        mutex_lock(&root->fs_info->ordered_operations_mutex);
         spin_lock(&root->fs_info->ordered_extent_lock);
         list_splice_init(&root->fs_info->ordered_extents, &splice);
         while (!list_empty(&splice)) {
@@ -600,6 +601,7 @@ void btrfs_wait_ordered_extents(struct btrfs_root *root, int delay_iput)
 
                 cond_resched();
         }
+        mutex_unlock(&root->fs_info->ordered_operations_mutex);
 }
 
 /*
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 5471e47d6559..b44124dd2370 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1153,7 +1153,7 @@ int btrfs_qgroup_account_ref(struct btrfs_trans_handle *trans,
         ret = btrfs_find_all_roots(trans, fs_info, node->bytenr,
                                    sgn > 0 ? node->seq - 1 : node->seq, &roots);
         if (ret < 0)
-                goto out;
+                return ret;
 
         spin_lock(&fs_info->qgroup_lock);
         quota_root = fs_info->quota_root;
@@ -1275,7 +1275,6 @@ int btrfs_qgroup_account_ref(struct btrfs_trans_handle *trans,
         ret = 0;
 unlock:
         spin_unlock(&fs_info->qgroup_lock);
-out:
         ulist_free(roots);
         ulist_free(tmp);
 
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 53c3501fa4ca..85e072b956d5 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -542,7 +542,6 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock)
         eb = path->nodes[0];
         ei = btrfs_item_ptr(eb, path->slots[0], struct btrfs_extent_item);
         item_size = btrfs_item_size_nr(eb, path->slots[0]);
-        btrfs_release_path(path);
 
         if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
                 do {
@@ -558,7 +557,9 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock)
                                 ret < 0 ? -1 : ref_level,
                                 ret < 0 ? -1 : ref_root);
                 } while (ret != 1);
+                btrfs_release_path(path);
         } else {
+                btrfs_release_path(path);
                 swarn.path = path;
                 swarn.dev = dev;
                 iterate_extent_inodes(fs_info, found_key.objectid,
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index f7a8b861058b..c85e7c6b4598 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -3945,12 +3945,10 @@ static int is_extent_unchanged(struct send_ctx *sctx,
                     found_key.type != key.type) {
                         key.offset += right_len;
                         break;
-                } else {
-                        if (found_key.offset != key.offset + right_len) {
-                                /* Should really not happen */
-                                ret = -EIO;
-                                goto out;
-                        }
+                }
+                if (found_key.offset != key.offset + right_len) {
+                        ret = 0;
+                        goto out;
                 }
                 key = found_key;
         }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 5989a92236f7..2854c824ab64 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4935,7 +4935,18 @@ int btrfs_rmap_block(struct btrfs_mapping_tree *map_tree,
         em = lookup_extent_mapping(em_tree, chunk_start, 1);
         read_unlock(&em_tree->lock);
 
-        BUG_ON(!em || em->start != chunk_start);
+        if (!em) {
+                printk(KERN_ERR "btrfs: couldn't find em for chunk %Lu\n",
+                       chunk_start);
+                return -EIO;
+        }
+
+        if (em->start != chunk_start) {
+                printk(KERN_ERR "btrfs: bad chunk start, em=%Lu, wanted=%Lu\n",
+                       em->start, chunk_start);
+                free_extent_map(em);
+                return -EIO;
+        }
         map = (struct map_lookup *)em->bdev;
 
         length = em->len;
diff --git a/fs/namespace.c b/fs/namespace.c
index 50ca17d3cb45..d581e45c0a9f 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -798,6 +798,10 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
         }
 
         mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~MNT_WRITE_HOLD;
+        /* Don't allow unprivileged users to change mount flags */
+        if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY))
+                mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
+
         atomic_inc(&sb->s_active);
         mnt->mnt.mnt_sb = sb;
         mnt->mnt.mnt_root = dget(root);
@@ -1713,6 +1717,9 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags)
         if (readonly_request == __mnt_is_readonly(mnt))
                 return 0;
 
+        if (mnt->mnt_flags & MNT_LOCK_READONLY)
+                return -EPERM;
+
         if (readonly_request)
                 error = mnt_make_readonly(real_mount(mnt));
         else
@@ -2339,7 +2346,7 @@ static struct mnt_namespace *dup_mnt_ns(struct mnt_namespace *mnt_ns,
         /* First pass: copy the tree topology */
         copy_flags = CL_COPY_ALL | CL_EXPIRE;
         if (user_ns != mnt_ns->user_ns)
-                copy_flags |= CL_SHARED_TO_SLAVE;
+                copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED;
         new = copy_tree(old, old->mnt.mnt_root, copy_flags);
         if (IS_ERR(new)) {
                 up_write(&namespace_sem);
@@ -2732,6 +2739,51 @@ bool our_mnt(struct vfsmount *mnt)
         return check_mnt(real_mount(mnt));
 }
 
+bool current_chrooted(void)
+{
+        /* Does the current process have a non-standard root */
+        struct path ns_root;
+        struct path fs_root;
+        bool chrooted;
+
+        /* Find the namespace root */
+        ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;
+        ns_root.dentry = ns_root.mnt->mnt_root;
+        path_get(&ns_root);
+        while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
+                ;
+
+        get_fs_root(current->fs, &fs_root);
+
+        chrooted = !path_equal(&fs_root, &ns_root);
+
+        path_put(&fs_root);
+        path_put(&ns_root);
+
+        return chrooted;
+}
+
+void update_mnt_policy(struct user_namespace *userns)
+{
+        struct mnt_namespace *ns = current->nsproxy->mnt_ns;
+        struct mount *mnt;
+
+        down_read(&namespace_sem);
+        list_for_each_entry(mnt, &ns->list, mnt_list) {
+                switch (mnt->mnt.mnt_sb->s_magic) {
+                case SYSFS_MAGIC:
+                        userns->may_mount_sysfs = true;
+                        break;
+                case PROC_SUPER_MAGIC:
+                        userns->may_mount_proc = true;
+                        break;
+                }
+                if (userns->may_mount_sysfs && userns->may_mount_proc)
+                        break;
+        }
+        up_read(&namespace_sem);
+}
+
 static void *mntns_get(struct task_struct *task)
 {
         struct mnt_namespace *ns = NULL;
diff --git a/fs/pnode.c b/fs/pnode.c
index 3e000a51ac0d..8b29d2164da6 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -9,6 +9,7 @@
 #include <linux/mnt_namespace.h>
 #include <linux/mount.h>
 #include <linux/fs.h>
+#include <linux/nsproxy.h>
 #include "internal.h"
 #include "pnode.h"
 
@@ -220,6 +221,7 @@ static struct mount *get_source(struct mount *dest,
 int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry,
                     struct mount *source_mnt, struct list_head *tree_list)
 {
+        struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
         struct mount *m, *child;
         int ret = 0;
         struct mount *prev_dest_mnt = dest_mnt;
@@ -237,6 +239,10 @@ int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry,
 
                 source =  get_source(m, prev_dest_mnt, prev_src_mnt, &type);
 
+                /* Notice when we are propagating across user namespaces */
+                if (m->mnt_ns->user_ns != user_ns)
+                        type |= CL_UNPRIVILEGED;
+
                 child = copy_tree(source, source->mnt.mnt_root, type);
                 if (IS_ERR(child)) {
                         ret = PTR_ERR(child);
diff --git a/fs/pnode.h b/fs/pnode.h
index 19b853a3445c..a0493d5ebfbf 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -23,6 +23,7 @@
 #define CL_MAKE_SHARED          0x08
 #define CL_PRIVATE              0x10
 #define CL_SHARED_TO_SLAVE      0x20
+#define CL_UNPRIVILEGED         0x40
 
 static inline void set_mnt_shared(struct mount *mnt)
 {
diff --git a/fs/proc/root.c b/fs/proc/root.c
index c6e9fac26bac..9c7fab1d23f0 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -16,6 +16,7 @@
 #include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/bitops.h>
+#include <linux/user_namespace.h>
 #include <linux/mount.h>
 #include <linux/pid_namespace.h>
 #include <linux/parser.h>
@@ -108,6 +109,9 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
         } else {
                 ns = task_active_pid_ns(current);
                 options = data;
+
+                if (!current_user_ns()->may_mount_proc)
+                        return ERR_PTR(-EPERM);
         }
 
         sb = sget(fs_type, proc_test_super, proc_set_super, flags, ns);
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 2fbdff6be25c..e14512678c9b 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
                 ino = parent_sd->s_ino;
                 if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
                         filp->f_pos++;
+                else
+                        return 0;
         }
         if (filp->f_pos == 1) {
                 if (parent_sd->s_parent)
@@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
                         ino = parent_sd->s_ino;
                 if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
                         filp->f_pos++;
+                else
+                        return 0;
         }
         mutex_lock(&sysfs_mutex);
         for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);
@@ -1058,10 +1062,21 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
         return 0;
 }
 
+static loff_t sysfs_dir_llseek(struct file *file, loff_t offset, int whence)
+{
+        struct inode *inode = file_inode(file);
+        loff_t ret;
+
+        mutex_lock(&inode->i_mutex);
+        ret = generic_file_llseek(file, offset, whence);
+        mutex_unlock(&inode->i_mutex);
+
+        return ret;
+}
 
 const struct file_operations sysfs_dir_operations = {
         .read           = generic_read_dir,
         .readdir        = sysfs_readdir,
         .release        = sysfs_dir_release,
-        .llseek         = generic_file_llseek,
+        .llseek         = sysfs_dir_llseek,
 };
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 8d924b5ec733..afd83273e6ce 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/magic.h>
 #include <linux/slab.h>
+#include <linux/user_namespace.h>
 
 #include "sysfs.h"
 
@@ -111,6 +112,9 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
         struct super_block *sb;
         int error;
 
+        if (!(flags & MS_KERNMOUNT) && !current_user_ns()->may_mount_sysfs)
+                return ERR_PTR(-EPERM);
+
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
                 return ERR_PTR(-ENOMEM);
diff --git a/include/linux/debug_locks.h b/include/linux/debug_locks.h
index a975de1ff59f..3bd46f766751 100644
--- a/include/linux/debug_locks.h
+++ b/include/linux/debug_locks.h
@@ -51,7 +51,7 @@ struct task_struct;
 extern void debug_show_all_locks(void);
 extern void debug_show_held_locks(struct task_struct *task);
 extern void debug_check_no_locks_freed(const void *from, unsigned long len);
-extern void debug_check_no_locks_held(void);
+extern void debug_check_no_locks_held(struct task_struct *task);
 #else
 static inline void debug_show_all_locks(void)
 {
@@ -67,7 +67,7 @@ debug_check_no_locks_freed(const void *from, unsigned long len)
 }
 
 static inline void
-debug_check_no_locks_held(void)
+debug_check_no_locks_held(struct task_struct *task)
 {
 }
 #endif
diff --git a/include/linux/freezer.h b/include/linux/freezer.h
index 043a5cf8b5ba..e70df40d84f6 100644
--- a/include/linux/freezer.h
+++ b/include/linux/freezer.h
@@ -3,7 +3,6 @@
 #ifndef FREEZER_H_INCLUDED
 #define FREEZER_H_INCLUDED
 
-#include <linux/debug_locks.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/atomic.h>
@@ -49,8 +48,6 @@ extern void thaw_kernel_threads(void);
 
 static inline bool try_to_freeze(void)
 {
-        if (!(current->flags & PF_NOFREEZE))
-                debug_check_no_locks_held();
         might_sleep();
         if (likely(!freezing(current)))
                 return false;
diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
index 729eded4b24f..2b93a9a5a1e6 100644
--- a/include/linux/fs_struct.h
+++ b/include/linux/fs_struct.h
@@ -50,4 +50,6 @@ static inline void get_fs_root_and_pwd(struct fs_struct *fs, struct path *root,
         spin_unlock(&fs->lock);
 }
 
+extern bool current_chrooted(void);
+
 #endif /* _LINUX_FS_STRUCT_H */
diff --git a/include/linux/mfd/max77693-private.h b/include/linux/mfd/max77693-private.h
index 5b18ecde69b5..1aa4f13cdfa6 100644
--- a/include/linux/mfd/max77693-private.h
+++ b/include/linux/mfd/max77693-private.h
@@ -106,6 +106,29 @@ enum max77693_muic_reg {
         MAX77693_MUIC_REG_END,
 };
 
+/* MAX77693 INTMASK1~2 Register */
+#define INTMASK1_ADC1K_SHIFT            3
+#define INTMASK1_ADCERR_SHIFT           2
+#define INTMASK1_ADCLOW_SHIFT           1
+#define INTMASK1_ADC_SHIFT              0
+#define INTMASK1_ADC1K_MASK             (1 << INTMASK1_ADC1K_SHIFT)
+#define INTMASK1_ADCERR_MASK            (1 << INTMASK1_ADCERR_SHIFT)
+#define INTMASK1_ADCLOW_MASK            (1 << INTMASK1_ADCLOW_SHIFT)
+#define INTMASK1_ADC_MASK               (1 << INTMASK1_ADC_SHIFT)
+
+#define INTMASK2_VIDRM_SHIFT            5
+#define INTMASK2_VBVOLT_SHIFT           4
+#define INTMASK2_DXOVP_SHIFT            3
+#define INTMASK2_DCDTMR_SHIFT           2
+#define INTMASK2_CHGDETRUN_SHIFT        1
+#define INTMASK2_CHGTYP_SHIFT           0
+#define INTMASK2_VIDRM_MASK             (1 << INTMASK2_VIDRM_SHIFT)
+#define INTMASK2_VBVOLT_MASK            (1 << INTMASK2_VBVOLT_SHIFT)
+#define INTMASK2_DXOVP_MASK             (1 << INTMASK2_DXOVP_SHIFT)
+#define INTMASK2_DCDTMR_MASK            (1 << INTMASK2_DCDTMR_SHIFT)
+#define INTMASK2_CHGDETRUN_MASK         (1 << INTMASK2_CHGDETRUN_SHIFT)
+#define INTMASK2_CHGTYP_MASK            (1 << INTMASK2_CHGTYP_SHIFT)
+
 /* MAX77693 MUIC - STATUS1~3 Register */
 #define STATUS1_ADC_SHIFT               (0)
 #define STATUS1_ADCLOW_SHIFT            (5)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 7acc9dc73c9f..e19ff30ad0a2 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -87,7 +87,6 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_PFNMAP       0x00000400      /* Page-ranges managed without "struct page", just pure PFN */
 #define VM_DENYWRITE    0x00000800      /* ETXTBSY on write attempts.. */
 
-#define VM_POPULATE     0x00001000
 #define VM_LOCKED       0x00002000
 #define VM_IO           0x00004000      /* Memory mapped I/O or similar */
 
diff --git a/include/linux/mman.h b/include/linux/mman.h
index 61c7a87e5d2b..9aa863da287f 100644
--- a/include/linux/mman.h
+++ b/include/linux/mman.h
@@ -79,8 +79,6 @@ calc_vm_flag_bits(unsigned long flags)
 {
         return _calc_vm_trans(flags, MAP_GROWSDOWN,  VM_GROWSDOWN ) |
                _calc_vm_trans(flags, MAP_DENYWRITE,  VM_DENYWRITE ) |
-               ((flags & MAP_LOCKED) ? (VM_LOCKED | VM_POPULATE) : 0) |
-               (((flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE) ?
-                                                        VM_POPULATE : 0);
+               _calc_vm_trans(flags, MAP_LOCKED,     VM_LOCKED    );
 }
 #endif /* _LINUX_MMAN_H */
diff --git a/include/linux/mount.h b/include/linux/mount.h
index d7029f4a191a..73005f9957ea 100644
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -47,6 +47,8 @@ struct mnt_namespace;
 
 #define MNT_INTERNAL    0x4000
 
+#define MNT_LOCK_READONLY       0x400000
+
 struct vfsmount {
         struct dentry *mnt_root;        /* root of the mounted tree */
         struct super_block *mnt_sb;     /* pointer to superblock */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 4491414a9218..a302f7f01f86 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -893,7 +893,7 @@ struct netdev_fcoe_hbainfo {
  *
  * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh)
  * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq,
- *                           struct net_device *dev)
+ *                           struct net_device *dev, u32 filter_mask)
  *
  * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
  *      Called to change device carrier. Soft-devices (like dummy, team, etc)
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 0a78df5f6cfd..59694b5e5e90 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -357,6 +357,7 @@ struct hc_driver {
                  */
         int     (*disable_usb3_lpm_timeout)(struct usb_hcd *,
                         struct usb_device *, enum usb3_link_state state);
+        int     (*find_raw_port_number)(struct usb_hcd *, int);
 };
 
 extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
@@ -396,6 +397,7 @@ extern int usb_hcd_is_primary_hcd(struct usb_hcd *hcd);
 extern int usb_add_hcd(struct usb_hcd *hcd,
                 unsigned int irqnum, unsigned long irqflags);
 extern void usb_remove_hcd(struct usb_hcd *hcd);
+extern int usb_hcd_find_raw_port_number(struct usb_hcd *hcd, int port1);
 
 struct platform_device;
 extern void usb_hcd_platform_shutdown(struct platform_device *dev);
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 4ce009324933..b6b215f13b45 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -26,6 +26,8 @@ struct user_namespace {
         kuid_t                  owner;
         kgid_t                  group;
         unsigned int            proc_inum;
+        bool                    may_mount_sysfs;
+        bool                    may_mount_proc;
 };
 
 extern struct user_namespace init_user_ns;
@@ -82,4 +84,6 @@ static inline void put_user_ns(struct user_namespace *ns)
 
 #endif
 
+void update_mnt_policy(struct user_namespace *userns);
+
 #endif /* _LINUX_USER_H */
diff --git a/include/xen/interface/io/blkif.h b/include/xen/interface/io/blkif.h
index 01c3d62436ef..ffd4652de91c 100644
--- a/include/xen/interface/io/blkif.h
+++ b/include/xen/interface/io/blkif.h
@@ -138,11 +138,21 @@ struct blkif_request_discard {
         uint8_t        _pad3;
 } __attribute__((__packed__));
 
+struct blkif_request_other {
+        uint8_t      _pad1;
+        blkif_vdev_t _pad2;        /* only for read/write requests         */
+#ifdef CONFIG_X86_64
+        uint32_t     _pad3;        /* offsetof(blkif_req..,u.other.id)==8*/
+#endif
+        uint64_t     id;           /* private guest value, echoed in resp  */
+} __attribute__((__packed__));
+
 struct blkif_request {
         uint8_t        operation;    /* BLKIF_OP_???                         */
         union {
                 struct blkif_request_rw rw;
                 struct blkif_request_discard discard;
+                struct blkif_request_other other;
         } u;
 } __attribute__((__packed__));
 
diff --git a/include/xen/interface/physdev.h b/include/xen/interface/physdev.h
index 1844d31f4552..7000bb1f6e96 100644
--- a/include/xen/interface/physdev.h
+++ b/include/xen/interface/physdev.h
@@ -251,6 +251,12 @@ struct physdev_pci_device_add {
 
 #define PHYSDEVOP_pci_device_remove     26
 #define PHYSDEVOP_restore_msi_ext       27
+/*
+ * Dom0 should use these two to announce MMIO resources assigned to
+ * MSI-X capable devices won't (prepare) or may (release) change.
+ */
+#define PHYSDEVOP_prepare_msix          30
+#define PHYSDEVOP_release_msix          31
 struct physdev_pci_device {
     /* IN */
     uint16_t seg;
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 3953fda2e8bd..e4e47f647446 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -330,8 +330,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
                          int flags, const char *dev_name,
                          void *data)
 {
-        if (!(flags & MS_KERNMOUNT))
-                data = current->nsproxy->ipc_ns;
+        if (!(flags & MS_KERNMOUNT)) {
+                struct ipc_namespace *ns = current->nsproxy->ipc_ns;
+                /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
+                 * over the ipc namespace.
+                 */
+                if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+                        return ERR_PTR(-EPERM);
+
+                data = ns;
+        }
         return mount_ns(fs_type, flags, data, mqueue_fill_super);
 }
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 51e485ca9935..60bc027c61c3 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -835,7 +835,7 @@ void do_exit(long code)
         /*
          * Make sure we are holding no locks:
          */
-        debug_check_no_locks_held();
+        debug_check_no_locks_held(tsk);
         /*
          * We can do this unlocked here. The futex code uses this flag
          * just to verify whether the pi state cleanup has been done
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 259db207b5d9..8a0efac4f99d 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -4088,7 +4088,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
 }
 EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
 
-static void print_held_locks_bug(void)
+static void print_held_locks_bug(struct task_struct *curr)
 {
         if (!debug_locks_off())
                 return;
@@ -4097,21 +4097,22 @@ static void print_held_locks_bug(void)
 
         printk("\n");
         printk("=====================================\n");
-        printk("[ BUG: %s/%d still has locks held! ]\n",
-               current->comm, task_pid_nr(current));
+        printk("[ BUG: lock held at task exit time! ]\n");
         print_kernel_ident();
         printk("-------------------------------------\n");
-        lockdep_print_held_locks(current);
+        printk("%s/%d is exiting with locks still held!\n",
+                curr->comm, task_pid_nr(curr));
+        lockdep_print_held_locks(curr);
+
         printk("\nstack backtrace:\n");
         dump_stack();
 }
 
-void debug_check_no_locks_held(void)
+void debug_check_no_locks_held(struct task_struct *task)
 {
-        if (unlikely(current->lockdep_depth > 0))
-                print_held_locks_bug();
+        if (unlikely(task->lockdep_depth > 0))
+                print_held_locks_bug(task);
 }
-EXPORT_SYMBOL_GPL(debug_check_no_locks_held);
 
 void debug_show_all_locks(void)
 {
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index c1c3dc1c6023..bea15bdf82b0 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -181,6 +181,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
         int nr;
         int rc;
         struct task_struct *task, *me = current;
+        int init_pids = thread_group_leader(me) ? 1 : 2;
 
         /* Don't allow any more processes into the pid namespace */
         disable_pid_allocation(pid_ns);
@@ -230,7 +231,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
          */
         for (;;) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
-                if (pid_ns->nr_hashed == 1)
+                if (pid_ns->nr_hashed == init_pids)
                         break;
                 schedule();
         }
diff --git a/kernel/user.c b/kernel/user.c
index e81978e8c03b..8e635a18ab52 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -51,6 +51,8 @@ struct user_namespace init_user_ns = {
         .owner = GLOBAL_ROOT_UID,
         .group = GLOBAL_ROOT_GID,
         .proc_inum = PROC_USER_INIT_INO,
+        .may_mount_sysfs = true,
+        .may_mount_proc = true,
 };
 EXPORT_SYMBOL_GPL(init_user_ns);
 
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index b14f4d342043..a54f26f82eb2 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -61,6 +61,15 @@ int create_user_ns(struct cred *new)
         kgid_t group = new->egid;
         int ret;
 
+        /*
+         * Verify that we can not violate the policy of which files
+         * may be accessed that is specified by the root directory,
+         * by verifing that the root directory is at the root of the
+         * mount namespace which allows all files to be accessed.
+         */
+        if (current_chrooted())
+                return -EPERM;
+
         /* The creator needs a mapping in the parent user namespace
          * or else we won't be able to reasonably tell userspace who
          * created a user_namespace.
@@ -87,6 +96,8 @@ int create_user_ns(struct cred *new)
 
         set_cred_user_ns(new, ns);
 
+        update_mnt_policy(ns);
+
         return 0;
 }
 
diff --git a/mm/fremap.c b/mm/fremap.c
index 4723ac8d2fc2..87da3590c61e 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -204,10 +204,8 @@ get_write_lock:
                         unsigned long addr;
                         struct file *file = get_file(vma->vm_file);
 
-                        vm_flags = vma->vm_flags;
-                        if (!(flags & MAP_NONBLOCK))
-                                vm_flags |= VM_POPULATE;
-                        addr = mmap_region(file, start, size, vm_flags, pgoff);
+                        addr = mmap_region(file, start, size,
+                                        vma->vm_flags, pgoff);
                         fput(file);
                         if (IS_ERR_VALUE(addr)) {
                                 err = addr;
@@ -226,12 +224,6 @@ get_write_lock:
                 mutex_unlock(&mapping->i_mmap_mutex);
         }
 
-        if (!(flags & MAP_NONBLOCK) && !(vma->vm_flags & VM_POPULATE)) {
-                if (!has_write_lock)
-                        goto get_write_lock;
-                vma->vm_flags |= VM_POPULATE;
-        }
-
         if (vma->vm_flags & VM_LOCKED) {
                 /*
                  * drop PG_Mlocked flag for over-mapped range
diff --git a/mm/mlock.c b/mm/mlock.c
index 1c5e33fce639..79b7cf7d1bca 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -358,7 +358,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
 
                 newflags = vma->vm_flags & ~VM_LOCKED;
                 if (on)
-                        newflags |= VM_LOCKED | VM_POPULATE;
+                        newflags |= VM_LOCKED;
 
                 tmp = vma->vm_end;
                 if (tmp > end)
@@ -418,8 +418,7 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
                  * range with the first VMA. Also, skip undesirable VMA types.
                  */
                 nend = min(end, vma->vm_end);
-                if ((vma->vm_flags & (VM_IO | VM_PFNMAP | VM_POPULATE)) !=
-                    VM_POPULATE)
+                if (vma->vm_flags & (VM_IO | VM_PFNMAP))
                         continue;
                 if (nstart < vma->vm_start)
                         nstart = vma->vm_start;
@@ -492,9 +491,9 @@ static int do_mlockall(int flags)
         struct vm_area_struct * vma, * prev = NULL;
 
         if (flags & MCL_FUTURE)
-                current->mm->def_flags |= VM_LOCKED | VM_POPULATE;
+                current->mm->def_flags |= VM_LOCKED;
         else
-                current->mm->def_flags &= ~(VM_LOCKED | VM_POPULATE);
+                current->mm->def_flags &= ~VM_LOCKED;
         if (flags == MCL_FUTURE)
                 goto out;
 
@@ -503,7 +502,7 @@ static int do_mlockall(int flags)
 
                 newflags = vma->vm_flags & ~VM_LOCKED;
                 if (flags & MCL_CURRENT)
-                        newflags |= VM_LOCKED | VM_POPULATE;
+                        newflags |= VM_LOCKED;
 
                 /* Ignore errors */
                 mlock_fixup(vma, &prev, vma->vm_start, vma->vm_end, newflags);
diff --git a/mm/mmap.c b/mm/mmap.c
index 2664a47cec93..6466699b16cb 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1306,7 +1306,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         }
 
         addr = mmap_region(file, addr, len, vm_flags, pgoff);
-        if (!IS_ERR_VALUE(addr) && (vm_flags & VM_POPULATE))
+        if (!IS_ERR_VALUE(addr) &&
+            ((vm_flags & VM_LOCKED) ||
+             (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE))
                 *populate = len;
         return addr;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 2db88dfa99d7..63e25332924d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1624,7 +1624,6 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
         }
 
         skb_orphan(skb);
-        nf_reset(skb);
 
         if (unlikely(!is_skb_forwardable(dev, skb))) {
                 atomic_long_inc(&dev->rx_dropped);
@@ -3318,6 +3317,7 @@ int netdev_rx_handler_register(struct net_device *dev,
         if (dev->rx_handler)
                 return -EBUSY;
 
+        /* Note: rx_handler_data must be set before rx_handler */
         rcu_assign_pointer(dev->rx_handler_data, rx_handler_data);
         rcu_assign_pointer(dev->rx_handler, rx_handler);
 
@@ -3338,6 +3338,11 @@ void netdev_rx_handler_unregister(struct net_device *dev)
 
         ASSERT_RTNL();
         RCU_INIT_POINTER(dev->rx_handler, NULL);
+        /* a reader seeing a non NULL rx_handler in a rcu_read_lock()
+         * section has a guarantee to see a non NULL rx_handler_data
+         * as well.
+         */
+        synchronize_net();
         RCU_INIT_POINTER(dev->rx_handler_data, NULL);
 }
 EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
diff --git a/net/core/flow.c b/net/core/flow.c
index 707fb7b952e8..7102f166482d 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -346,7 +346,7 @@ static void flow_cache_flush_per_cpu(void *data)
         struct flow_flush_info *info = data;
         struct tasklet_struct *tasklet;
 
-        tasklet = this_cpu_ptr(&info->cache->percpu->flush_tasklet);
+        tasklet = &this_cpu_ptr(info->cache->percpu)->flush_tasklet;
         tasklet->data = (unsigned long)info;
         tasklet_schedule(tasklet);
 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d2322d7f0f7b..589d0abb34a0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -496,8 +496,10 @@ static int rtnl_link_fill(struct sk_buff *skb, const struct net_device *dev)
         }
         if (ops->fill_info) {
                 data = nla_nest_start(skb, IFLA_INFO_DATA);
-                if (data == NULL)
+                if (data == NULL) {
+                        err = -EMSGSIZE;
                         goto err_cancel_link;
+                }
                 err = ops->fill_info(skb, dev);
                 if (err < 0)
                         goto err_cancel_data;
diff --git a/net/core/scm.c b/net/core/scm.c
index 905dcc6ad1e3..2dc6cdaaae8a 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -24,6 +24,7 @@
 #include <linux/interrupt.h>
 #include <linux/netdevice.h>
 #include <linux/security.h>
+#include <linux/pid_namespace.h>
 #include <linux/pid.h>
 #include <linux/nsproxy.h>
 #include <linux/slab.h>
@@ -52,7 +53,8 @@ static __inline__ int scm_check_creds(struct ucred *creds)
         if (!uid_valid(uid) || !gid_valid(gid))
                 return -EINVAL;
 
-        if ((creds->pid == task_tgid_vnr(current) || nsown_capable(CAP_SYS_ADMIN)) &&
+        if ((creds->pid == task_tgid_vnr(current) ||
+             ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
             ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
               uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
             ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index e33fe0ab2568..2bab2aa59745 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -118,6 +118,18 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
             ipv6_addr_loopback(&hdr->daddr))
                 goto err;
 
+        /* RFC4291 Errata ID: 3480
+         * Interface-Local scope spans only a single interface on a
+         * node and is useful only for loopback transmission of
+         * multicast.  Packets with interface-local scope received
+         * from another node must be discarded.
+         */
+        if (!(skb->pkt_type == PACKET_LOOPBACK ||
+              dev->flags & IFF_LOOPBACK) &&
+            ipv6_addr_is_multicast(&hdr->daddr) &&
+            IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
+                goto err;
+
         /* RFC4291 2.7
          * Nodes must not originate a packet to a multicast address whose scope
          * field contains the reserved value 0; if such a packet is received, it
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8555f331ea60..5b1e5af25713 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2693,6 +2693,7 @@ static int key_notify_policy_flush(const struct km_event *c)
         hdr->sadb_msg_pid = c->portid;
         hdr->sadb_msg_version = PF_KEY_V2;
         hdr->sadb_msg_errno = (uint8_t) 0;
+        hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
         return 0;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d85282f64405..7530c60fe502 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -349,21 +349,19 @@ static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
 static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
-        int ret = 0;
+        int ret;
 
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return 0;
 
-        mutex_lock(&local->iflist_mtx);
+        ASSERT_RTNL();
 
         if (local->monitor_sdata)
-                goto out_unlock;
+                return 0;
 
         sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
-        if (!sdata) {
-                ret = -ENOMEM;
-                goto out_unlock;
-        }
+        if (!sdata)
+                return -ENOMEM;
 
         /* set up data */
         sdata->local = local;
@@ -377,13 +375,13 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (WARN_ON(ret)) {
                 /* ok .. stupid driver, it asked for this! */
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
         ret = ieee80211_check_queues(sdata);
         if (ret) {
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
         ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
@@ -391,13 +389,14 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (ret) {
                 drv_remove_interface(local, sdata);
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
+        mutex_lock(&local->iflist_mtx);
         rcu_assign_pointer(local->monitor_sdata, sdata);
- out_unlock:
         mutex_unlock(&local->iflist_mtx);
-        return ret;
+
+        return 0;
 }
 
 static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
@@ -407,14 +406,20 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return;
 
+        ASSERT_RTNL();
+
         mutex_lock(&local->iflist_mtx);
 
         sdata = rcu_dereference_protected(local->monitor_sdata,
                                           lockdep_is_held(&local->iflist_mtx));
-        if (!sdata)
-                goto out_unlock;
+        if (!sdata) {
+                mutex_unlock(&local->iflist_mtx);
+                return;
+        }
 
         rcu_assign_pointer(local->monitor_sdata, NULL);
+        mutex_unlock(&local->iflist_mtx);
+
         synchronize_net();
 
         ieee80211_vif_release_channel(sdata);
@@ -422,8 +427,6 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         drv_remove_interface(local, sdata);
 
         kfree(sdata);
- out_unlock:
-        mutex_unlock(&local->iflist_mtx);
 }
 
 /*
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 5ac017f3fcd2..77b5710db241 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1007,7 +1007,8 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                if (ieee80211_vif_is_mesh(&sdata->vif))
+                if (ieee80211_vif_is_mesh(&sdata->vif) &&
+                    ieee80211_sdata_running(sdata))
                         ieee80211_queue_work(&local->hw, &sdata->work);
         rcu_read_unlock();
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index fdc06e381c10..167158646593 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3527,8 +3527,10 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 
         /* Restart STA timers */
         rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                ieee80211_restart_sta_timer(sdata);
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (ieee80211_sdata_running(sdata))
+                        ieee80211_restart_sta_timer(sdata);
+        }
         rcu_read_unlock();
 }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5b4492af4e85..2528b5a4d6d4 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2666,7 +2666,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
 
                 memset(nskb->cb, 0, sizeof(nskb->cb));
 
-                ieee80211_tx_skb(rx->sdata, nskb);
+                if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
+
+                        info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
+                                      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
+                                      IEEE80211_TX_CTL_NO_CCK_RATE;
+                        if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                                info->hw_queue =
+                                        local->hw.offchannel_tx_hw_queue;
+                }
+
+                __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
+                                            status->band);
         }
         dev_kfree_skb(rx->skb);
         return RX_QUEUED;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 3644ad79688a..85458a28ffa0 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -771,6 +771,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
         int ret, i;
+        bool have_key = false;
 
         might_sleep();
 
@@ -798,14 +799,22 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         list_del_rcu(&sta->list);
 
         mutex_lock(&local->key_mtx);
-        for (i = 0; i < NUM_DEFAULT_KEYS; i++)
+        for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
                 __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]),
                                      true);
-        if (sta->ptk)
+                have_key = true;
+        }
+        if (sta->ptk) {
                 __ieee80211_key_free(key_mtx_dereference(local, sta->ptk),
                                      true);
+                have_key = true;
+        }
+
         mutex_unlock(&local->key_mtx);
 
+        if (!have_key)
+                synchronize_net();
+
         sta->dead = true;
 
         local->num_sta--;
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 4e606fcb2534..55786283a3df 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -195,7 +195,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 flow->deficit = q->quantum;
                 flow->dropped = 0;
         }
-        if (++sch->q.qlen < sch->limit)
+        if (++sch->q.qlen <= sch->limit)
                 return NET_XMIT_SUCCESS;
 
         q->drop_overlimit++;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index ffad48109a22..eac7e0ee23c1 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -904,7 +904,7 @@ void psched_ratecfg_precompute(struct psched_ratecfg *r, u32 rate)
         u64 mult;
         int shift;
 
-        r->rate_bps = rate << 3;
+        r->rate_bps = (u64)rate << 3;
         r->shift = 0;
         r->mult = 1;
         /*
diff --git a/net/wireless/core.c b/net/wireless/core.c
index f382cae983ba..00be55530a32 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -212,6 +212,39 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
         rdev_rfkill_poll(rdev);
 }
 
+void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev)
+{
+        lockdep_assert_held(&rdev->devlist_mtx);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_P2P_DEVICE))
+                return;
+
+        if (!wdev->p2p_started)
+                return;
+
+        rdev_stop_p2p_device(rdev, wdev);
+        wdev->p2p_started = false;
+
+        rdev->opencount--;
+
+        if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
+                bool busy = work_busy(&rdev->scan_done_wk);
+
+                /*
+                 * If the work isn't pending or running (in which case it would
+                 * be waiting for the lock we hold) the driver didn't properly
+                 * cancel the scan when the interface was removed. In this case
+                 * warn and leak the scan request object to not crash later.
+                 */
+                WARN_ON(!busy);
+
+                rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, !busy);
+        }
+}
+
 static int cfg80211_rfkill_set_block(void *data, bool blocked)
 {
         struct cfg80211_registered_device *rdev = data;
@@ -221,7 +254,8 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 return 0;
 
         rtnl_lock();
-        mutex_lock(&rdev->devlist_mtx);
+
+        /* read-only iteration need not hold the devlist_mtx */
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->netdev) {
@@ -231,18 +265,18 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 /* otherwise, check iftype */
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_P2P_DEVICE:
-                        if (!wdev->p2p_started)
-                                break;
-                        rdev_stop_p2p_device(rdev, wdev);
-                        wdev->p2p_started = false;
-                        rdev->opencount--;
+                        /* but this requires it */
+                        mutex_lock(&rdev->devlist_mtx);
+                        mutex_lock(&rdev->sched_scan_mtx);
+                        cfg80211_stop_p2p_device(rdev, wdev);
+                        mutex_unlock(&rdev->sched_scan_mtx);
+                        mutex_unlock(&rdev->devlist_mtx);
                         break;
                 default:
                         break;
                 }
         }
 
-        mutex_unlock(&rdev->devlist_mtx);
         rtnl_unlock();
 
         return 0;
@@ -745,17 +779,13 @@ static void wdev_cleanup_work(struct work_struct *work)
         wdev = container_of(work, struct wireless_dev, cleanup_work);
         rdev = wiphy_to_dev(wdev->wiphy);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
 
         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
                 rdev->scan_req->aborted = true;
                 ___cfg80211_scan_done(rdev, true);
         }
 
-        cfg80211_unlock_rdev(rdev);
-
-        mutex_lock(&rdev->sched_scan_mtx);
-
         if (WARN_ON(rdev->sched_scan_req &&
                     rdev->sched_scan_req->dev == wdev->netdev)) {
                 __cfg80211_stop_sched_scan(rdev, false);
@@ -781,21 +811,19 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
                 return;
 
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         list_del_rcu(&wdev->list);
         rdev->devlist_generation++;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_P2P_DEVICE:
-                if (!wdev->p2p_started)
-                        break;
-                rdev_stop_p2p_device(rdev, wdev);
-                wdev->p2p_started = false;
-                rdev->opencount--;
+                cfg80211_stop_p2p_device(rdev, wdev);
                 break;
         default:
                 WARN_ON_ONCE(1);
                 break;
         }
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
 }
 EXPORT_SYMBOL(cfg80211_unregister_wdev);
@@ -945,6 +973,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 cfg80211_update_iface_num(rdev, wdev->iftype, 1);
                 cfg80211_lock_rdev(rdev);
                 mutex_lock(&rdev->devlist_mtx);
+                mutex_lock(&rdev->sched_scan_mtx);
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
 #ifdef CONFIG_CFG80211_WEXT
@@ -976,6 +1005,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         break;
                 }
                 wdev_unlock(wdev);
+                mutex_unlock(&rdev->sched_scan_mtx);
                 rdev->opencount++;
                 mutex_unlock(&rdev->devlist_mtx);
                 cfg80211_unlock_rdev(rdev);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index d5d06fdea961..b5174f65cc9a 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -500,9 +500,14 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
 void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
                                enum nl80211_iftype iftype, int num);
 
+
 void cfg80211_leave(struct cfg80211_registered_device *rdev,
                     struct wireless_dev *wdev);
 
+void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev);
+
+
 #define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
 
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f924d45af1b8..671b69a3c136 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5048,14 +5048,19 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->scan)
                 return -EOPNOTSUPP;
 
-        if (rdev->scan_req)
-                return -EBUSY;
+        mutex_lock(&rdev->sched_scan_mtx);
+        if (rdev->scan_req) {
+                err = -EBUSY;
+                goto unlock;
+        }
 
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
                 n_channels = validate_scan_freqs(
                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
-                if (!n_channels)
-                        return -EINVAL;
+                if (!n_channels) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
         } else {
                 enum ieee80211_band band;
                 n_channels = 0;
@@ -5069,23 +5074,29 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
                         n_ssids++;
 
-        if (n_ssids > wiphy->max_scan_ssids)
-                return -EINVAL;
+        if (n_ssids > wiphy->max_scan_ssids) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         if (info->attrs[NL80211_ATTR_IE])
                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         else
                 ie_len = 0;
 
-        if (ie_len > wiphy->max_scan_ie_len)
-                return -EINVAL;
+        if (ie_len > wiphy->max_scan_ie_len) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         request = kzalloc(sizeof(*request)
                         + sizeof(*request->ssids) * n_ssids
                         + sizeof(*request->channels) * n_channels
                         + ie_len, GFP_KERNEL);
-        if (!request)
-                return -ENOMEM;
+        if (!request) {
+                err = -ENOMEM;
+                goto unlock;
+        }
 
         if (n_ssids)
                 request->ssids = (void *)&request->channels[n_channels];
@@ -5222,6 +5233,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 kfree(request);
         }
 
+ unlock:
+        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -8130,20 +8143,9 @@ static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->stop_p2p_device)
                 return -EOPNOTSUPP;
 
-        if (!wdev->p2p_started)
-                return 0;
-
-        rdev_stop_p2p_device(rdev, wdev);
-        wdev->p2p_started = false;
-
-        mutex_lock(&rdev->devlist_mtx);
-        rdev->opencount--;
-        mutex_unlock(&rdev->devlist_mtx);
-
-        if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
-                rdev->scan_req->aborted = true;
-                ___cfg80211_scan_done(rdev, true);
-        }
+        mutex_lock(&rdev->sched_scan_mtx);
+        cfg80211_stop_p2p_device(rdev, wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 
         return 0;
 }
@@ -8929,7 +8931,7 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (WARN_ON(!req))
                 return 0;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 674aadca0079..fd99ea495b7e 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -169,7 +169,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         union iwreq_data wrqu;
 #endif
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         request = rdev->scan_req;
 
@@ -230,9 +230,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
         rdev = container_of(wk, struct cfg80211_registered_device,
                             scan_done_wk);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
         ___cfg80211_scan_done(rdev, false);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
@@ -698,11 +698,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
         found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
 
         if (found) {
-                found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.signal = tmp->pub.signal;
-                found->pub.capability = tmp->pub.capability;
-                found->ts = tmp->ts;
-
                 /* Update IEs */
                 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
                         const struct cfg80211_bss_ies *old;
@@ -723,6 +718,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 
                         if (found->pub.hidden_beacon_bss &&
                             !list_empty(&found->hidden_list)) {
+                                const struct cfg80211_bss_ies *f;
+
                                 /*
                                  * The found BSS struct is one of the probe
                                  * response members of a group, but we're
@@ -732,6 +729,10 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                  * SSID to showing it, which is confusing so
                                  * drop this information.
                                  */
+
+                                f = rcu_access_pointer(tmp->pub.beacon_ies);
+                                kfree_rcu((struct cfg80211_bss_ies *)f,
+                                          rcu_head);
                                 goto drop;
                         }
 
@@ -761,6 +762,11 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
                 }
+
+                found->pub.beacon_interval = tmp->pub.beacon_interval;
+                found->pub.signal = tmp->pub.signal;
+                found->pub.capability = tmp->pub.capability;
+                found->ts = tmp->ts;
         } else {
                 struct cfg80211_internal_bss *new;
                 struct cfg80211_internal_bss *hidden;
@@ -1056,6 +1062,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
+        mutex_lock(&rdev->sched_scan_mtx);
         if (rdev->scan_req) {
                 err = -EBUSY;
                 goto out;
@@ -1162,6 +1169,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                 dev_hold(dev);
         }
  out:
+        mutex_unlock(&rdev->sched_scan_mtx);
         kfree(creq);
         cfg80211_unlock_rdev(rdev);
         return err;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index bad4c4b5e4eb..ff6f7ae35586 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -85,6 +85,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         ASSERT_RTNL();
         ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (rdev->scan_req)
                 return -EBUSY;
@@ -324,11 +325,9 @@ void cfg80211_sme_scan_done(struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
         wdev_lock(wdev);
         __cfg80211_sme_scan_done(dev);
         wdev_unlock(wdev);
-        mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
 }
 
 void cfg80211_sme_rx_auth(struct net_device *dev,
@@ -928,9 +927,12 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
         int err;
 
         mutex_lock(&rdev->devlist_mtx);
+        /* might request scan - scan_mtx -> wdev_mtx dependency */
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
         wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
 
         return err;
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index ccadef2106ac..3c2033b8f596 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -27,7 +27,8 @@
 #define WIPHY_PR_ARG    __entry->wiphy_name
 
 #define WDEV_ENTRY      __field(u32, id)
-#define WDEV_ASSIGN     (__entry->id) = (wdev ? wdev->identifier : 0)
+#define WDEV_ASSIGN     (__entry->id) = (!IS_ERR_OR_NULL(wdev)  \
+                                         ? wdev->identifier : 0)
 #define WDEV_PR_FMT     "wdev(%u)"
 #define WDEV_PR_ARG     (__entry->id)
 
@@ -1778,7 +1779,7 @@ TRACE_EVENT(rdev_set_mac_acl,
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
-                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
                 __entry->acl_policy = params->acl_policy;
         ),
         TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d",
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index fb9622f6d99c..e79cb5c0655a 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -89,6 +89,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -135,6 +136,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
@@ -190,6 +192,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         err = 0;
@@ -223,6 +226,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
@@ -285,6 +289,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -313,6 +318,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 35754cc8a9e5..8dafe6d3c6e4 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -334,6 +334,70 @@ static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
                 x->xflags &= ~XFRM_TIME_DEFER;
 }
 
+static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
+{
+        u32 seq_diff, oseq_diff;
+        struct km_event c;
+        struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
+        struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
+
+        /* we send notify messages in case
+         *  1. we updated on of the sequence numbers, and the seqno difference
+         *     is at least x->replay_maxdiff, in this case we also update the
+         *     timeout of our timer function
+         *  2. if x->replay_maxage has elapsed since last update,
+         *     and there were changes
+         *
+         *  The state structure must be locked!
+         */
+
+        switch (event) {
+        case XFRM_REPLAY_UPDATE:
+                if (!x->replay_maxdiff)
+                        break;
+
+                if (replay_esn->seq_hi == preplay_esn->seq_hi)
+                        seq_diff = replay_esn->seq - preplay_esn->seq;
+                else
+                        seq_diff = ~preplay_esn->seq + replay_esn->seq + 1;
+
+                if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
+                        oseq_diff = replay_esn->oseq - preplay_esn->oseq;
+                else
+                        oseq_diff = ~preplay_esn->oseq + replay_esn->oseq + 1;
+
+                if (seq_diff < x->replay_maxdiff &&
+                    oseq_diff < x->replay_maxdiff) {
+
+                        if (x->xflags & XFRM_TIME_DEFER)
+                                event = XFRM_REPLAY_TIMEOUT;
+                        else
+                                return;
+                }
+
+                break;
+
+        case XFRM_REPLAY_TIMEOUT:
+                if (memcmp(x->replay_esn, x->preplay_esn,
+                           xfrm_replay_state_esn_len(replay_esn)) == 0) {
+                        x->xflags |= XFRM_TIME_DEFER;
+                        return;
+                }
+
+                break;
+        }
+
+        memcpy(x->preplay_esn, x->replay_esn,
+               xfrm_replay_state_esn_len(replay_esn));
+        c.event = XFRM_MSG_NEWAE;
+        c.data.aevent = event;
+        km_state_notify(x, &c);
+
+        if (x->replay_maxage &&
+            !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
+                x->xflags &= ~XFRM_TIME_DEFER;
+}
+
 static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = 0;
@@ -510,7 +574,7 @@ static struct xfrm_replay xfrm_replay_esn = {
         .advance        = xfrm_replay_advance_esn,
         .check          = xfrm_replay_check_esn,
         .recheck        = xfrm_replay_recheck_esn,
-        .notify         = xfrm_replay_notify_bmp,
+        .notify         = xfrm_replay_notify_esn,
         .overflow       = xfrm_replay_overflow_esn,
 };
 
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index 23414b93771f..13c88fbcf037 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -347,10 +347,8 @@ int yama_ptrace_traceme(struct task_struct *parent)
         /* Only disallow PTRACE_TRACEME on more aggressive settings. */
         switch (ptrace_scope) {
         case YAMA_SCOPE_CAPABILITY:
-                rcu_read_lock();
-                if (!ns_capable(__task_cred(parent)->user_ns, CAP_SYS_PTRACE))
+                if (!has_ns_capability(parent, current_user_ns(), CAP_SYS_PTRACE))
                         rc = -EPERM;
-                rcu_read_unlock();
                 break;
         case YAMA_SCOPE_NO_ATTACH:
                 rc = -EPERM;