142 files changed, 1430 insertions, 887 deletions
diff --git a/drivers/amba/tegra-ahb.c b/drivers/amba/tegra-ahb.c
index 093c43554963..1f44e56cc65d 100644
--- a/drivers/amba/tegra-ahb.c
+++ b/drivers/amba/tegra-ahb.c
@@ -158,7 +158,7 @@ int tegra_ahb_enable_smmu(struct device_node *dn)
 EXPORT_SYMBOL(tegra_ahb_enable_smmu);
 #endif
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
 static int tegra_ahb_suspend(struct device *dev)
 {
        int i;
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 3e751b74615e..a5a3ebcbdd2c 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -59,15 +59,16 @@ config ATA_ACPI
          option libata.noacpi=1
 config SATA_ZPODD
-        bool "SATA Zero Power ODD Support"
+        bool "SATA Zero Power Optical Disc Drive (ZPODD) support"
        depends on ATA_ACPI
        default n
        help
-          This option adds support for SATA ZPODD. It requires both
+          This option adds support for SATA Zero Power Optical Disc
-          ODD and the platform support, and if enabled, will automatically
+          Drive (ZPODD). It requires both the ODD and the platform
-          power on/off the ODD when certain condition is satisfied. This
+          support, and if enabled, will automatically power on/off the
-          does not impact user's experience of the ODD, only power is saved
+          ODD when certain condition is satisfied. This does not impact
-          when ODD is not in use(i.e. no disc inside).
+          end user's experience of the ODD, only power is saved when
+          the ODD is not in use (i.e. no disc inside).
          If unsure, say N.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index a99112cfd8b1..6a67b07de494 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -281,6 +281,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
        { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
        { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
+        { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Wellsburg RAID */
+        { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Wellsburg RAID */
        { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
        { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */
        { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index d2ba439cfe54..ffdd32d22602 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -1547,6 +1547,10 @@ static bool piix_broken_system_poweroff(struct pci_dev *pdev)
 static int prefer_ms_hyperv = 1;
 module_param(prefer_ms_hyperv, int, 0);
+MODULE_PARM_DESC(prefer_ms_hyperv,
+        "Prefer Hyper-V paravirtualization drivers instead of ATA, "
+        "0 - Use ATA drivers, "
+        "1 (Default) - Use the paravirtualization drivers.");
 static void piix_ignore_devices_quirk(struct ata_host *host)
 {
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index beea3115577e..8a52dab412e2 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -1027,7 +1027,7 @@ static void ata_acpi_register_power_resource(struct ata_device *dev)
        handle = ata_dev_acpi_handle(dev);
        if (handle)
-                acpi_dev_pm_remove_dependent(handle, &sdev->sdev_gendev);
+                acpi_dev_pm_add_dependent(handle, &sdev->sdev_gendev);
 }
 static void ata_acpi_unregister_power_resource(struct ata_device *dev)
diff --git a/drivers/ata/pata_samsung_cf.c b/drivers/ata/pata_samsung_cf.c
index 70b0e01372b3..6ef27e98c508 100644
--- a/drivers/ata/pata_samsung_cf.c
+++ b/drivers/ata/pata_samsung_cf.c
@@ -661,18 +661,7 @@ static struct platform_driver pata_s3c_driver = {
        },
 };
-static int __init pata_s3c_init(void)
+module_platform_driver_probe(pata_s3c_driver, pata_s3c_probe);
-{
-        return platform_driver_probe(&pata_s3c_driver, pata_s3c_probe);
-}
-static void __exit pata_s3c_exit(void)
-{
-        platform_driver_unregister(&pata_s3c_driver);
-}
-module_init(pata_s3c_init);
-module_exit(pata_s3c_exit);
 MODULE_AUTHOR("Abhilash Kesavan, <a.kesavan@samsung.com>");
 MODULE_DESCRIPTION("low-level driver for Samsung PATA controller");
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 124b2c1d9c0b..608f82fed632 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1511,8 +1511,7 @@ error_exit_with_cleanup:
        if (hcr_base)
                iounmap(hcr_base);
-        if (host_priv)
+        kfree(host_priv);
-                kfree(host_priv);
        return retval;
 }
diff --git a/drivers/block/nvme.c b/drivers/block/nvme.c
index 07fb2dfaae13..9dcefe40380b 100644
--- a/drivers/block/nvme.c
+++ b/drivers/block/nvme.c
@@ -135,6 +135,7 @@ static inline void _nvme_check_size(void)
        BUILD_BUG_ON(sizeof(struct nvme_id_ctrl) != 4096);
        BUILD_BUG_ON(sizeof(struct nvme_id_ns) != 4096);
        BUILD_BUG_ON(sizeof(struct nvme_lba_range_type) != 64);
+        BUILD_BUG_ON(sizeof(struct nvme_smart_log) != 512);
 }
 typedef void (*nvme_completion_fn)(struct nvme_dev *, void *,
@@ -237,7 +238,8 @@ static void *free_cmdid(struct nvme_queue *nvmeq, int cmdid,
                *fn = special_completion;
                return CMD_CTX_INVALID;
        }
-        *fn = info[cmdid].fn;
+        if (fn)
+                *fn = info[cmdid].fn;
        ctx = info[cmdid].ctx;
        info[cmdid].fn = special_completion;
        info[cmdid].ctx = CMD_CTX_COMPLETED;
@@ -335,6 +337,7 @@ nvme_alloc_iod(unsigned nseg, unsigned nbytes, gfp_t gfp)
                iod->offset = offsetof(struct nvme_iod, sg[nseg]);
                iod->npages = -1;
                iod->length = nbytes;
+                iod->nents = 0;
        }
        return iod;
@@ -375,7 +378,8 @@ static void bio_completion(struct nvme_dev *dev, void *ctx,
        struct bio *bio = iod->private;
        u16 status = le16_to_cpup(&cqe->status) >> 1;
-        dma_unmap_sg(&dev->pci_dev->dev, iod->sg, iod->nents,
+        if (iod->nents)
+                dma_unmap_sg(&dev->pci_dev->dev, iod->sg, iod->nents,
                        bio_data_dir(bio) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
        nvme_free_iod(dev, iod);
        if (status) {
@@ -589,7 +593,7 @@ static int nvme_submit_bio_queue(struct nvme_queue *nvmeq, struct nvme_ns *ns,
        result = nvme_map_bio(nvmeq->q_dmadev, iod, bio, dma_dir, psegs);
        if (result < 0)
-                goto free_iod;
+                goto free_cmdid;
        length = result;
        cmnd->rw.command_id = cmdid;
@@ -609,6 +613,8 @@ static int nvme_submit_bio_queue(struct nvme_queue *nvmeq, struct nvme_ns *ns,
        return 0;
+ free_cmdid:
+        free_cmdid(nvmeq, cmdid, NULL);
 free_iod:
        nvme_free_iod(nvmeq->dev, iod);
 nomem:
@@ -835,8 +841,8 @@ static int nvme_identify(struct nvme_dev *dev, unsigned nsid, unsigned cns,
        return nvme_submit_admin_cmd(dev, &c, NULL);
 }
-static int nvme_get_features(struct nvme_dev *dev, unsigned fid,
+static int nvme_get_features(struct nvme_dev *dev, unsigned fid, unsigned nsid,
-                                unsigned nsid, dma_addr_t dma_addr)
+                                        dma_addr_t dma_addr, u32 *result)
 {
        struct nvme_command c;
@@ -846,7 +852,7 @@ static int nvme_get_features(struct nvme_dev *dev, unsigned fid,
        c.features.prp1 = cpu_to_le64(dma_addr);
        c.features.fid = cpu_to_le32(fid);
-        return nvme_submit_admin_cmd(dev, &c, NULL);
+        return nvme_submit_admin_cmd(dev, &c, result);
 }
 static int nvme_set_features(struct nvme_dev *dev, unsigned fid,
@@ -906,6 +912,10 @@ static void nvme_free_queue(struct nvme_dev *dev, int qid)
        spin_lock_irq(&nvmeq->q_lock);
        nvme_cancel_ios(nvmeq, false);
+        while (bio_list_peek(&nvmeq->sq_cong)) {
+                struct bio *bio = bio_list_pop(&nvmeq->sq_cong);
+                bio_endio(bio, -EIO);
+        }
        spin_unlock_irq(&nvmeq->q_lock);
        irq_set_affinity_hint(vector, NULL);
@@ -1230,12 +1240,17 @@ static int nvme_user_admin_cmd(struct nvme_dev *dev,
        if (length != cmd.data_len)
                status = -ENOMEM;
        else
-                status = nvme_submit_admin_cmd(dev, &c, NULL);
+                status = nvme_submit_admin_cmd(dev, &c, &cmd.result);
        if (cmd.data_len) {
                nvme_unmap_user_pages(dev, cmd.opcode & 1, iod);
                nvme_free_iod(dev, iod);
        }
+        if (!status && copy_to_user(&ucmd->result, &cmd.result,
+                                                        sizeof(cmd.result)))
+                status = -EFAULT;
        return status;
 }
@@ -1523,9 +1538,9 @@ static int nvme_dev_add(struct nvme_dev *dev)
                        continue;
                res = nvme_get_features(dev, NVME_FEAT_LBA_RANGE, i,
-                                                        dma_addr + 4096);
+                                                        dma_addr + 4096, NULL);
                if (res)
-                        continue;
+                        memset(mem + 4096, 0, 4096);
                ns = nvme_alloc_ns(dev, i, mem, mem + 4096);
                if (ns)
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a8a41e07a221..b282af181b44 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -74,8 +74,10 @@ static struct usb_device_id ath3k_table[] = {
        /* Atheros AR3012 with sflash firmware*/
        { USB_DEVICE(0x0CF3, 0x3004) },
+        { USB_DEVICE(0x0CF3, 0x3008) },
        { USB_DEVICE(0x0CF3, 0x311D) },
        { USB_DEVICE(0x13d3, 0x3375) },
+        { USB_DEVICE(0x04CA, 0x3004) },
        { USB_DEVICE(0x04CA, 0x3005) },
        { USB_DEVICE(0x04CA, 0x3006) },
        { USB_DEVICE(0x04CA, 0x3008) },
@@ -106,8 +108,10 @@ static struct usb_device_id ath3k_blist_tbl[] = {
        /* Atheros AR3012 with sflash firmware*/
        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7e351e345476..e547851870e7 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -132,8 +132,10 @@ static struct usb_device_id blacklist_table[] = {
        /* Atheros 3012 with sflash firmware */
        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/clk/clk-vt8500.c b/drivers/clk/clk-vt8500.c
index b5538bba7a10..09c63315e579 100644
--- a/drivers/clk/clk-vt8500.c
+++ b/drivers/clk/clk-vt8500.c
@@ -157,7 +157,7 @@ static int vt8500_dclk_set_rate(struct clk_hw *hw, unsigned long rate,
        divisor =  parent_rate / rate;
        /* If prate / rate would be decimal, incr the divisor */
-        if (rate * divisor < *prate)
+        if (rate * divisor < parent_rate)
                divisor++;
        if (divisor == cdev->div_mask + 1)
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 910b0116c128..e1d13c463c90 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -2048,12 +2048,18 @@ static int init_csrows(struct mem_ctl_info *mci)
                edac_dbg(1, "MC node: %d, csrow: %d\n",
                            pvt->mc_node_id, i);
-                if (row_dct0)
+                if (row_dct0) {
                        nr_pages = amd64_csrow_nr_pages(pvt, 0, i);
+                        csrow->channels[0]->dimm->nr_pages = nr_pages;
+                }
                /* K8 has only one DCT */
-                if (boot_cpu_data.x86 != 0xf && row_dct1)
+                if (boot_cpu_data.x86 != 0xf && row_dct1) {
-                        nr_pages += amd64_csrow_nr_pages(pvt, 1, i);
+                        int row_dct1_pages = amd64_csrow_nr_pages(pvt, 1, i);
+                        csrow->channels[1]->dimm->nr_pages = row_dct1_pages;
+                        nr_pages += row_dct1_pages;
+                }
                mtype = amd64_determine_memory_type(pvt, i);
@@ -2072,9 +2078,7 @@ static int init_csrows(struct mem_ctl_info *mci)
                        dimm = csrow->channels[j]->dimm;
                        dimm->mtype = mtype;
                        dimm->edac_mode = edac_mode;
-                        dimm->nr_pages = nr_pages;
                }
-                csrow->nr_pages = nr_pages;
        }
        return empty;
@@ -2419,7 +2423,6 @@ static int amd64_init_one_instance(struct pci_dev *F2)
        mci->pvt_info = pvt;
        mci->pdev = &pvt->F2->dev;
-        mci->csbased = 1;
        setup_mci_misc_attrs(mci, fam_type);
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index cdb81aa73ab7..27e86d938262 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -86,7 +86,7 @@ static void edac_mc_dump_dimm(struct dimm_info *dimm, int number)
        edac_dimm_info_location(dimm, location, sizeof(location));
        edac_dbg(4, "%s%i: %smapped as virtual row %d, chan %d\n",
-                 dimm->mci->mem_is_per_rank ? "rank" : "dimm",
+                 dimm->mci->csbased ? "rank" : "dimm",
                 number, location, dimm->csrow, dimm->cschannel);
        edac_dbg(4, "  dimm = %p\n", dimm);
        edac_dbg(4, "  dimm->label = '%s'\n", dimm->label);
@@ -341,7 +341,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
        memcpy(mci->layers, layers, sizeof(*layer) * n_layers);
        mci->nr_csrows = tot_csrows;
        mci->num_cschannel = tot_channels;
-        mci->mem_is_per_rank = per_rank;
+        mci->csbased = per_rank;
        /*
         * Alocate and fill the csrow/channels structs
@@ -1235,7 +1235,7 @@ void edac_mc_handle_error(const enum hw_event_mc_err_type type,
                         * incrementing the compat API counters
                         */
                        edac_dbg(4, "%s csrows map: (%d,%d)\n",
-                                 mci->mem_is_per_rank ? "rank" : "dimm",
+                                 mci->csbased ? "rank" : "dimm",
                                 dimm->csrow, dimm->cschannel);
                        if (row == -1)
                                row = dimm->csrow;
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 4f4b6137d74e..5899a76eec3b 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -143,7 +143,7 @@ static const char *edac_caps[] = {
 * and the per-dimm/per-rank one
 */
 #define DEVICE_ATTR_LEGACY(_name, _mode, _show, _store) \
-        struct device_attribute dev_attr_legacy_##_name = __ATTR(_name, _mode, _show, _store)
+        static struct device_attribute dev_attr_legacy_##_name = __ATTR(_name, _mode, _show, _store)
 struct dev_ch_attribute {
        struct device_attribute attr;
@@ -180,9 +180,6 @@ static ssize_t csrow_size_show(struct device *dev,
        int i;
        u32 nr_pages = 0;
-        if (csrow->mci->csbased)
-                return sprintf(data, "%u\n", PAGES_TO_MiB(csrow->nr_pages));
        for (i = 0; i < csrow->nr_channels; i++)
                nr_pages += csrow->channels[i]->dimm->nr_pages;
        return sprintf(data, "%u\n", PAGES_TO_MiB(nr_pages));
@@ -612,7 +609,7 @@ static int edac_create_dimm_object(struct mem_ctl_info *mci,
        device_initialize(&dimm->dev);
        dimm->dev.parent = &mci->dev;
-        if (mci->mem_is_per_rank)
+        if (mci->csbased)
                dev_set_name(&dimm->dev, "rank%d", index);
        else
                dev_set_name(&dimm->dev, "dimm%d", index);
@@ -778,14 +775,10 @@ static ssize_t mci_size_mb_show(struct device *dev,
        for (csrow_idx = 0; csrow_idx < mci->nr_csrows; csrow_idx++) {
                struct csrow_info *csrow = mci->csrows[csrow_idx];
-                if (csrow->mci->csbased) {
+                for (j = 0; j < csrow->nr_channels; j++) {
-                        total_pages += csrow->nr_pages;
+                        struct dimm_info *dimm = csrow->channels[j]->dimm;
-                } else {
-                        for (j = 0; j < csrow->nr_channels; j++) {
-                                struct dimm_info *dimm = csrow->channels[j]->dimm;
-                                total_pages += dimm->nr_pages;
+                        total_pages += dimm->nr_pages;
-                        }
                }
        }
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index c194f4e680ad..e2acfdbf7d3c 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1634,7 +1634,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
        unsigned vblank = (pt->vactive_vblank_hi & 0xf) << 8 | pt->vblank_lo;
        unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc0) << 2 | pt->hsync_offset_lo;
        unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x30) << 4 | pt->hsync_pulse_width_lo;
-        unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) >> 2 | pt->vsync_offset_pulse_width_lo >> 4;
+        unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) << 2 | pt->vsync_offset_pulse_width_lo >> 4;
        unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x3) << 4 | (pt->vsync_offset_pulse_width_lo & 0xf);
        /* ignore tiny modes */
@@ -1715,6 +1715,7 @@ set_size:
        }
        mode->type = DRM_MODE_TYPE_DRIVER;
+        mode->vrefresh = drm_mode_vrefresh(mode);
        drm_mode_set_name(mode);
        return mode;
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index aae31489c893..7299ea45dd03 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -103,7 +103,7 @@ static const char *cache_level_str(int type)
 static void
 describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
 {
-        seq_printf(m, "%p: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
+        seq_printf(m, "%pK: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
                   &obj->base,
                   get_pin_flag(obj),
                   get_tiling_flag(obj),
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 2f2daebd0eef..3b11ab0fbc96 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -732,6 +732,8 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
                   int count)
 {
        int i;
+        int relocs_total = 0;
+        int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
        for (i = 0; i < count; i++) {
                char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
@@ -740,10 +742,13 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
                if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS)
                        return -EINVAL;
-                /* First check for malicious input causing overflow */
+                /* First check for malicious input causing overflow in
-                if (exec[i].relocation_count >
+                 * the worst case where we need to allocate the entire
-                    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
+                 * relocation tree as a single array.
+                 */
+                if (exec[i].relocation_count > relocs_max - relocs_total)
                        return -EINVAL;
+                relocs_total += exec[i].relocation_count;
                length = exec[i].relocation_count *
                        sizeof(struct drm_i915_gem_relocation_entry);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 6f728e5ee793..d7d4afe01341 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -820,6 +820,7 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
        struct intel_link_m_n m_n;
        int pipe = intel_crtc->pipe;
        enum transcoder cpu_transcoder = intel_crtc->cpu_transcoder;
+        int target_clock;
        /*
         * Find the lane count in the intel_encoder private
@@ -835,13 +836,22 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
                }
        }
+        target_clock = mode->clock;
+        for_each_encoder_on_crtc(dev, crtc, intel_encoder) {
+                if (intel_encoder->type == INTEL_OUTPUT_EDP) {
+                        target_clock = intel_edp_target_clock(intel_encoder,
+                                                              mode);
+                        break;
+                }
+        }
        /*
         * Compute the GMCH and Link ratios. The '3' here is
         * the number of bytes_per_pixel post-LUT, which we always
         * set up for 8-bits of R/G/B, or 3 bytes total.
         */
        intel_link_compute_m_n(intel_crtc->bpp, lane_count,
-                               mode->clock, adjusted_mode->clock, &m_n);
+                               target_clock, adjusted_mode->clock, &m_n);
        if (IS_HASWELL(dev)) {
                I915_WRITE(PIPE_DATA_M1(cpu_transcoder),
@@ -1930,7 +1940,7 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
                for (i = 0; i < intel_dp->lane_count; i++)
                        if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
                                break;
-                if (i == intel_dp->lane_count && voltage_tries == 5) {
+                if (i == intel_dp->lane_count) {
                        ++loop_tries;
                        if (loop_tries == 5) {
                                DRM_DEBUG_KMS("too many full retries, give up\n");
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index acf8aec9ada7..ef4744e1bf0b 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -203,7 +203,13 @@ intel_gpio_setup(struct intel_gmbus *bus, u32 pin)
        algo->data = bus;
 }
-#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 4)
+/*
+ * gmbus on gen4 seems to be able to generate legacy interrupts even when in MSI
+ * mode. This results in spurious interrupt warnings if the legacy irq no. is
+ * shared with another device. The kernel then disables that interrupt source
+ * and so prevents the other device from working properly.
+ */
+#define HAS_GMBUS_IRQ(dev) (INTEL_INFO(dev)->gen >= 5)
 static int
 gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
                     u32 gmbus2_status,
@@ -214,6 +220,9 @@ gmbus_wait_hw_status(struct drm_i915_private *dev_priv,
        u32 gmbus2 = 0;
        DEFINE_WAIT(wait);
+        if (!HAS_GMBUS_IRQ(dev_priv->dev))
+                gmbus4_irq_en = 0;
        /* Important: The hw handles only the first bit, so set only one! Since
         * we also need to check for NAKs besides the hw ready/idle signal, we
         * need to wake up periodically and check that ourselves. */
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index a274b9906ef8..fe22bb780e1d 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -382,19 +382,19 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
        m = n = p = 0;
        vcomax = 800000;
        vcomin = 400000;
-        pllreffreq = 3333;
+        pllreffreq = 33333;
        delta = 0xffffffff;
        permitteddelta = clock * 5 / 1000;
-        for (testp = 16; testp > 0; testp--) {
+        for (testp = 16; testp > 0; testp >>= 1) {
                if (clock * testp > vcomax)
                        continue;
                if (clock * testp < vcomin)
                        continue;
                for (testm = 1; testm < 33; testm++) {
-                        for (testn = 1; testn < 257; testn++) {
+                        for (testn = 17; testn < 257; testn++) {
                                computed = (pllreffreq * testn) /
                                        (testm * testp);
                                if (computed > clock)
@@ -404,11 +404,11 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
                                if (tmpdelta < delta) {
                                        delta = tmpdelta;
                                        n = testn - 1;
-                                        m = (testm - 1) | ((n >> 1) & 0x80);
+                                        m = (testm - 1);
                                        p = testp - 1;
                                }
                                if ((clock * testp) >= 600000)
-                                        p |= 80;
+                                        p |= 0x80;
                        }
                }
        }
diff --git a/drivers/gpu/drm/nouveau/core/core/object.c b/drivers/gpu/drm/nouveau/core/core/object.c
index 0daab62ea14c..3b2e7b6304d3 100644
--- a/drivers/gpu/drm/nouveau/core/core/object.c
+++ b/drivers/gpu/drm/nouveau/core/core/object.c
@@ -278,7 +278,6 @@ nouveau_object_del(struct nouveau_object *client, u32 _parent, u32 _handle)
        struct nouveau_object *parent = NULL;
        struct nouveau_object *namedb = NULL;
        struct nouveau_handle *handle = NULL;
-        int ret = -EINVAL;
        parent = nouveau_handle_ref(client, _parent);
        if (!parent)
@@ -295,7 +294,7 @@ nouveau_object_del(struct nouveau_object *client, u32 _parent, u32 _handle)
        }
        nouveau_object_ref(NULL, &parent);
-        return ret;
+        return handle ? 0 : -EINVAL;
 }
 int
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/therm.h b/drivers/gpu/drm/nouveau/core/include/subdev/therm.h
index 6b17b614629f..0b20fc0d19c1 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/therm.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/therm.h
@@ -4,7 +4,7 @@
 #include <core/device.h>
 #include <core/subdev.h>
-enum nouveau_therm_mode {
+enum nouveau_therm_fan_mode {
        NOUVEAU_THERM_CTRL_NONE = 0,
        NOUVEAU_THERM_CTRL_MANUAL = 1,
        NOUVEAU_THERM_CTRL_AUTO = 2,
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/base.c b/drivers/gpu/drm/nouveau/core/subdev/therm/base.c
index f794dc89a3b2..a00a5a76e2d6 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/base.c
@@ -134,7 +134,7 @@ nouveau_therm_alarm(struct nouveau_alarm *alarm)
 }
 int
-nouveau_therm_mode(struct nouveau_therm *therm, int mode)
+nouveau_therm_fan_mode(struct nouveau_therm *therm, int mode)
 {
        struct nouveau_therm_priv *priv = (void *)therm;
        struct nouveau_device *device = nv_device(therm);
@@ -149,10 +149,15 @@ nouveau_therm_mode(struct nouveau_therm *therm, int mode)
            (mode != NOUVEAU_THERM_CTRL_NONE && device->card_type >= NV_C0))
                return -EINVAL;
+        /* do not allow automatic fan management if the thermal sensor is
+         * not available */
+        if (priv->mode == 2 && therm->temp_get(therm) < 0)
+                return -EINVAL;
        if (priv->mode == mode)
                return 0;
-        nv_info(therm, "Thermal management: %s\n", name[mode]);
+        nv_info(therm, "fan management: %s\n", name[mode]);
        nouveau_therm_update(therm, mode);
        return 0;
 }
@@ -213,7 +218,7 @@ nouveau_therm_attr_set(struct nouveau_therm *therm,
                priv->fan->bios.max_duty = value;
                return 0;
        case NOUVEAU_THERM_ATTR_FAN_MODE:
-                return nouveau_therm_mode(therm, value);
+                return nouveau_therm_fan_mode(therm, value);
        case NOUVEAU_THERM_ATTR_THRS_FAN_BOOST:
                priv->bios_sensor.thrs_fan_boost.temp = value;
                priv->sensor.program_alarms(therm);
@@ -263,7 +268,7 @@ _nouveau_therm_init(struct nouveau_object *object)
                return ret;
        if (priv->suspend >= 0)
-                nouveau_therm_mode(therm, priv->mode);
+                nouveau_therm_fan_mode(therm, priv->mode);
        priv->sensor.program_alarms(therm);
        return 0;
 }
@@ -313,11 +318,12 @@ nouveau_therm_create_(struct nouveau_object *parent,
 int
 nouveau_therm_preinit(struct nouveau_therm *therm)
 {
-        nouveau_therm_ic_ctor(therm);
        nouveau_therm_sensor_ctor(therm);
+        nouveau_therm_ic_ctor(therm);
        nouveau_therm_fan_ctor(therm);
-        nouveau_therm_mode(therm, NOUVEAU_THERM_CTRL_NONE);
+        nouveau_therm_fan_mode(therm, NOUVEAU_THERM_CTRL_NONE);
+        nouveau_therm_sensor_preinit(therm);
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c b/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
index e24090bac195..8b3adec5fbb1 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
@@ -32,6 +32,7 @@ probe_monitoring_device(struct nouveau_i2c_port *i2c,
                        struct i2c_board_info *info)
 {
        struct nouveau_therm_priv *priv = (void *)nouveau_therm(i2c);
+        struct nvbios_therm_sensor *sensor = &priv->bios_sensor;
        struct i2c_client *client;
        request_module("%s%s", I2C_MODULE_PREFIX, info->type);
@@ -46,8 +47,9 @@ probe_monitoring_device(struct nouveau_i2c_port *i2c,
        }
        nv_info(priv,
-                "Found an %s at address 0x%x (controlled by lm_sensors)\n",
+                "Found an %s at address 0x%x (controlled by lm_sensors, "
-                info->type, info->addr);
+                "temp offset %+i C)\n",
+                info->type, info->addr, sensor->offset_constant);
        priv->ic = client;
        return true;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
index 0f5363edb964..a70d1b7e397b 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
@@ -29,54 +29,83 @@ struct nv40_therm_priv {
        struct nouveau_therm_priv base;
 };
+enum nv40_sensor_style { INVALID_STYLE = -1, OLD_STYLE = 0, NEW_STYLE = 1 };
+static enum nv40_sensor_style
+nv40_sensor_style(struct nouveau_therm *therm)
+{
+        struct nouveau_device *device = nv_device(therm);
+        switch (device->chipset) {
+        case 0x43:
+        case 0x44:
+        case 0x4a:
+        case 0x47:
+                return OLD_STYLE;
+        case 0x46:
+        case 0x49:
+        case 0x4b:
+        case 0x4e:
+        case 0x4c:
+        case 0x67:
+        case 0x68:
+        case 0x63:
+                return NEW_STYLE;
+        default:
+                return INVALID_STYLE;
+        }
+}
 static int
 nv40_sensor_setup(struct nouveau_therm *therm)
 {
-        struct nouveau_device *device = nv_device(therm);
+        enum nv40_sensor_style style = nv40_sensor_style(therm);
        /* enable ADC readout and disable the ALARM threshold */
-        if (device->chipset >= 0x46) {
+        if (style == NEW_STYLE) {
                nv_mask(therm, 0x15b8, 0x80000000, 0);
                nv_wr32(therm, 0x15b0, 0x80003fff);
-                mdelay(10); /* wait for the temperature to stabilize */
+                mdelay(20); /* wait for the temperature to stabilize */
                return nv_rd32(therm, 0x15b4) & 0x3fff;
-        } else {
+        } else if (style == OLD_STYLE) {
                nv_wr32(therm, 0x15b0, 0xff);
+                mdelay(20); /* wait for the temperature to stabilize */
                return nv_rd32(therm, 0x15b4) & 0xff;
-        }
+        } else
+                return -ENODEV;
 }
 static int
 nv40_temp_get(struct nouveau_therm *therm)
 {
        struct nouveau_therm_priv *priv = (void *)therm;
-        struct nouveau_device *device = nv_device(therm);
        struct nvbios_therm_sensor *sensor = &priv->bios_sensor;
+        enum nv40_sensor_style style = nv40_sensor_style(therm);
        int core_temp;
-        if (device->chipset >= 0x46) {
+        if (style == NEW_STYLE) {
                nv_wr32(therm, 0x15b0, 0x80003fff);
                core_temp = nv_rd32(therm, 0x15b4) & 0x3fff;
-        } else {
+        } else if (style == OLD_STYLE) {
                nv_wr32(therm, 0x15b0, 0xff);
                core_temp = nv_rd32(therm, 0x15b4) & 0xff;
-        }
+        } else
+                return -ENODEV;
-        /* Setup the sensor if the temperature is 0 */
-        if (core_temp == 0)
-                core_temp = nv40_sensor_setup(therm);
-        if (sensor->slope_div == 0)
+        /* if the slope or the offset is unset, do no use the sensor */
-                sensor->slope_div = 1;
+        if (!sensor->slope_div || !sensor->slope_mult ||
-        if (sensor->offset_den == 0)
+            !sensor->offset_num || !sensor->offset_den)
-                sensor->offset_den = 1;
+            return -ENODEV;
-        if (sensor->slope_mult < 1)
-                sensor->slope_mult = 1;
        core_temp = core_temp * sensor->slope_mult / sensor->slope_div;
        core_temp = core_temp + sensor->offset_num / sensor->offset_den;
        core_temp = core_temp + sensor->offset_constant - 8;
+        /* reserve negative temperatures for errors */
+        if (core_temp < 0)
+                core_temp = 0;
        return core_temp;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/priv.h b/drivers/gpu/drm/nouveau/core/subdev/therm/priv.h
index 06b98706b3fc..438d9824b774 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/priv.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/priv.h
@@ -102,7 +102,7 @@ struct nouveau_therm_priv {
        struct i2c_client *ic;
 };
-int nouveau_therm_mode(struct nouveau_therm *therm, int mode);
+int nouveau_therm_fan_mode(struct nouveau_therm *therm, int mode);
 int nouveau_therm_attr_get(struct nouveau_therm *therm,
                       enum nouveau_therm_attr_type type);
 int nouveau_therm_attr_set(struct nouveau_therm *therm,
@@ -122,6 +122,7 @@ int nouveau_therm_fan_sense(struct nouveau_therm *therm);
 int nouveau_therm_preinit(struct nouveau_therm *);
+void nouveau_therm_sensor_preinit(struct nouveau_therm *);
 void nouveau_therm_sensor_set_threshold_state(struct nouveau_therm *therm,
                                             enum nouveau_therm_thrs thrs,
                                             enum nouveau_therm_thrs_state st);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
index b37624af8297..470f6a47b656 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
@@ -34,10 +34,6 @@ nouveau_therm_temp_set_defaults(struct nouveau_therm *therm)
 {
        struct nouveau_therm_priv *priv = (void *)therm;
-        priv->bios_sensor.slope_mult = 1;
-        priv->bios_sensor.slope_div = 1;
-        priv->bios_sensor.offset_num = 0;
-        priv->bios_sensor.offset_den = 1;
        priv->bios_sensor.offset_constant = 0;
        priv->bios_sensor.thrs_fan_boost.temp = 90;
@@ -60,11 +56,6 @@ nouveau_therm_temp_safety_checks(struct nouveau_therm *therm)
        struct nouveau_therm_priv *priv = (void *)therm;
        struct nvbios_therm_sensor *s = &priv->bios_sensor;
-        if (!priv->bios_sensor.slope_div)
-                priv->bios_sensor.slope_div = 1;
-        if (!priv->bios_sensor.offset_den)
-                priv->bios_sensor.offset_den = 1;
        /* enforce a minimum hysteresis on thresholds */
        s->thrs_fan_boost.hysteresis = max_t(u8, s->thrs_fan_boost.hysteresis, 2);
        s->thrs_down_clock.hysteresis = max_t(u8, s->thrs_down_clock.hysteresis, 2);
@@ -106,16 +97,16 @@ void nouveau_therm_sensor_event(struct nouveau_therm *therm,
        const char *thresolds[] = {
                "fanboost", "downclock", "critical", "shutdown"
        };
-        uint8_t temperature = therm->temp_get(therm);
+        int temperature = therm->temp_get(therm);
        if (thrs < 0 || thrs > 3)
                return;
        if (dir == NOUVEAU_THERM_THRS_FALLING)
-                nv_info(therm, "temperature (%u C) went below the '%s' threshold\n",
+                nv_info(therm, "temperature (%i C) went below the '%s' threshold\n",
                        temperature, thresolds[thrs]);
        else
-                nv_info(therm, "temperature (%u C) hit the '%s' threshold\n",
+                nv_info(therm, "temperature (%i C) hit the '%s' threshold\n",
                        temperature, thresolds[thrs]);
        active = (dir == NOUVEAU_THERM_THRS_RISING);
@@ -123,7 +114,7 @@ void nouveau_therm_sensor_event(struct nouveau_therm *therm,
        case NOUVEAU_THERM_THRS_FANBOOST:
                if (active) {
                        nouveau_therm_fan_set(therm, true, 100);
-                        nouveau_therm_mode(therm, NOUVEAU_THERM_CTRL_AUTO);
+                        nouveau_therm_fan_mode(therm, NOUVEAU_THERM_CTRL_AUTO);
                }
                break;
        case NOUVEAU_THERM_THRS_DOWNCLOCK:
@@ -202,7 +193,7 @@ alarm_timer_callback(struct nouveau_alarm *alarm)
                                             NOUVEAU_THERM_THRS_SHUTDOWN);
        /* schedule the next poll in one second */
-        if (list_empty(&alarm->head))
+        if (therm->temp_get(therm) >= 0 && list_empty(&alarm->head))
                ptimer->alarm(ptimer, 1000 * 1000 * 1000, alarm);
        spin_unlock_irqrestore(&priv->sensor.alarm_program_lock, flags);
@@ -225,6 +216,17 @@ nouveau_therm_program_alarms_polling(struct nouveau_therm *therm)
        alarm_timer_callback(&priv->sensor.therm_poll_alarm);
 }
+void
+nouveau_therm_sensor_preinit(struct nouveau_therm *therm)
+{
+        const char *sensor_avail = "yes";
+        if (therm->temp_get(therm) < 0)
+                sensor_avail = "no";
+        nv_info(therm, "internal sensor: %s\n", sensor_avail);
+}
 int
 nouveau_therm_sensor_ctor(struct nouveau_therm *therm)
 {
diff --git a/drivers/gpu/drm/nouveau/nouveau_pm.c b/drivers/gpu/drm/nouveau/nouveau_pm.c
index bb54098c6d97..936b442a6ab7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_pm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_pm.c
@@ -402,8 +402,12 @@ nouveau_hwmon_show_temp(struct device *d, struct device_attribute *a, char *buf)
        struct drm_device *dev = dev_get_drvdata(d);
        struct nouveau_drm *drm = nouveau_drm(dev);
        struct nouveau_therm *therm = nouveau_therm(drm->device);
+        int temp = therm->temp_get(therm);
-        return snprintf(buf, PAGE_SIZE, "%d\n", therm->temp_get(therm) * 1000);
+        if (temp < 0)
+                return temp;
+        return snprintf(buf, PAGE_SIZE, "%d\n", temp * 1000);
 }
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, nouveau_hwmon_show_temp,
                                                  NULL, 0);
@@ -871,7 +875,12 @@ static SENSOR_DEVICE_ATTR(pwm1_max, S_IRUGO | S_IWUSR,
                          nouveau_hwmon_get_pwm1_max,
                          nouveau_hwmon_set_pwm1_max, 0);
-static struct attribute *hwmon_attributes[] = {
+static struct attribute *hwmon_default_attributes[] = {
+        &sensor_dev_attr_name.dev_attr.attr,
+        &sensor_dev_attr_update_rate.dev_attr.attr,
+        NULL
+};
+static struct attribute *hwmon_temp_attributes[] = {
        &sensor_dev_attr_temp1_input.dev_attr.attr,
        &sensor_dev_attr_temp1_auto_point1_pwm.dev_attr.attr,
        &sensor_dev_attr_temp1_auto_point1_temp.dev_attr.attr,
@@ -882,8 +891,6 @@ static struct attribute *hwmon_attributes[] = {
        &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr,
        &sensor_dev_attr_temp1_emergency.dev_attr.attr,
        &sensor_dev_attr_temp1_emergency_hyst.dev_attr.attr,
-        &sensor_dev_attr_name.dev_attr.attr,
-        &sensor_dev_attr_update_rate.dev_attr.attr,
        NULL
 };
 static struct attribute *hwmon_fan_rpm_attributes[] = {
@@ -898,8 +905,11 @@ static struct attribute *hwmon_pwm_fan_attributes[] = {
        NULL
 };
-static const struct attribute_group hwmon_attrgroup = {
+static const struct attribute_group hwmon_default_attrgroup = {
-        .attrs = hwmon_attributes,
+        .attrs = hwmon_default_attributes,
+};
+static const struct attribute_group hwmon_temp_attrgroup = {
+        .attrs = hwmon_temp_attributes,
 };
 static const struct attribute_group hwmon_fan_rpm_attrgroup = {
        .attrs = hwmon_fan_rpm_attributes,
@@ -931,13 +941,22 @@ nouveau_hwmon_init(struct drm_device *dev)
        }
        dev_set_drvdata(hwmon_dev, dev);
-        /* default sysfs entries */
+        /* set the default attributes */
-        ret = sysfs_create_group(&hwmon_dev->kobj, &hwmon_attrgroup);
+        ret = sysfs_create_group(&hwmon_dev->kobj, &hwmon_default_attrgroup);
        if (ret) {
                if (ret)
                        goto error;
        }
+        /* if the card has a working thermal sensor */
+        if (therm->temp_get(therm) >= 0) {
+                ret = sysfs_create_group(&hwmon_dev->kobj, &hwmon_temp_attrgroup);
+                if (ret) {
+                        if (ret)
+                                goto error;
+                }
+        }
        /* if the card has a pwm fan */
        /*XXX: incorrect, need better detection for this, some boards have
         *     the gpio entries for pwm fan control even when there's no
@@ -979,11 +998,10 @@ nouveau_hwmon_fini(struct drm_device *dev)
        struct nouveau_pm *pm = nouveau_pm(dev);
        if (pm->hwmon) {
-                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_attrgroup);
+                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_default_attrgroup);
-                sysfs_remove_group(&pm->hwmon->kobj,
+                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_temp_attrgroup);
-                                   &hwmon_pwm_fan_attrgroup);
+                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_pwm_fan_attrgroup);
-                sysfs_remove_group(&pm->hwmon->kobj,
+                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_fan_rpm_attrgroup);
-                                   &hwmon_fan_rpm_attrgroup);
                hwmon_device_unregister(pm->hwmon);
        }
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 2db57990f65c..7f0e6c3f37d1 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -524,6 +524,8 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        swap_interval <<= 4;
        if (swap_interval == 0)
                swap_interval |= 0x100;
+        if (chan == NULL)
+                evo_sync(crtc->dev);
        push = evo_wait(sync, 128);
        if (unlikely(push == NULL))
@@ -586,8 +588,6 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                sync->addr ^= 0x10;
                sync->data++;
                FIRE_RING (chan);
-        } else {
-                evo_sync(crtc->dev);
        }
        /* queue the flip */
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index d4c633e12863..27769e724b6d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -468,13 +468,19 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                    (rdev->pdev->device == 0x9907) ||
                    (rdev->pdev->device == 0x9908) ||
                    (rdev->pdev->device == 0x9909) ||
+                    (rdev->pdev->device == 0x990B) ||
+                    (rdev->pdev->device == 0x990C) ||
+                    (rdev->pdev->device == 0x990F) ||
                    (rdev->pdev->device == 0x9910) ||
-                    (rdev->pdev->device == 0x9917)) {
+                    (rdev->pdev->device == 0x9917) ||
+                    (rdev->pdev->device == 0x9999)) {
                        rdev->config.cayman.max_simds_per_se = 6;
                        rdev->config.cayman.max_backends_per_se = 2;
                } else if ((rdev->pdev->device == 0x9903) ||
                           (rdev->pdev->device == 0x9904) ||
                           (rdev->pdev->device == 0x990A) ||
+                           (rdev->pdev->device == 0x990D) ||
+                           (rdev->pdev->device == 0x990E) ||
                           (rdev->pdev->device == 0x9913) ||
                           (rdev->pdev->device == 0x9918)) {
                        rdev->config.cayman.max_simds_per_se = 4;
@@ -483,6 +489,9 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                           (rdev->pdev->device == 0x9990) ||
                           (rdev->pdev->device == 0x9991) ||
                           (rdev->pdev->device == 0x9994) ||
+                           (rdev->pdev->device == 0x9995) ||
+                           (rdev->pdev->device == 0x9996) ||
+                           (rdev->pdev->device == 0x999A) ||
                           (rdev->pdev->device == 0x99A0)) {
                        rdev->config.cayman.max_simds_per_se = 3;
                        rdev->config.cayman.max_backends_per_se = 1;
@@ -616,11 +625,22 @@ static void cayman_gpu_init(struct radeon_device *rdev)
        WREG32(DMA_TILING_CONFIG + DMA0_REGISTER_OFFSET, gb_addr_config);
        WREG32(DMA_TILING_CONFIG + DMA1_REGISTER_OFFSET, gb_addr_config);
-        tmp = gb_addr_config & NUM_PIPES_MASK;
+        if ((rdev->config.cayman.max_backends_per_se == 1) &&
-        tmp = r6xx_remap_render_backend(rdev, tmp,
+            (rdev->flags & RADEON_IS_IGP)) {
-                                        rdev->config.cayman.max_backends_per_se *
+                if ((disabled_rb_mask & 3) == 1) {
-                                        rdev->config.cayman.max_shader_engines,
+                        /* RB0 disabled, RB1 enabled */
-                                        CAYMAN_MAX_BACKENDS, disabled_rb_mask);
+                        tmp = 0x11111111;
+                } else {
+                        /* RB1 disabled, RB0 enabled */
+                        tmp = 0x00000000;
+                }
+        } else {
+                tmp = gb_addr_config & NUM_PIPES_MASK;
+                tmp = r6xx_remap_render_backend(rdev, tmp,
+                                                rdev->config.cayman.max_backends_per_se *
+                                                rdev->config.cayman.max_shader_engines,
+                                                CAYMAN_MAX_BACKENDS, disabled_rb_mask);
+        }
        WREG32(GB_BACKEND_MAP, tmp);
        cgts_tcc_disable = 0xffff0000;
@@ -1771,6 +1791,7 @@ int cayman_resume(struct radeon_device *rdev)
 int cayman_suspend(struct radeon_device *rdev)
 {
        r600_audio_fini(rdev);
+        radeon_vm_manager_fini(rdev);
        cayman_cp_enable(rdev, false);
        cayman_dma_stop(rdev);
        evergreen_irq_suspend(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
index bedda9caadd9..6e05a2e75a46 100644
--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
+++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
@@ -122,10 +122,7 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
                goto out_cleanup;
        }
-        /* r100 doesn't have dma engine so skip the test */
+        if (rdev->asic->copy.dma) {
-        /* also, VRAM-to-VRAM test doesn't make much sense for DMA */
-        /* skip it as well if domains are the same */
-        if ((rdev->asic->copy.dma) && (sdomain != ddomain)) {
                time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
                                                RADEON_BENCHMARK_COPY_DMA, n);
                if (time < 0)
@@ -135,13 +132,15 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
                                                     sdomain, ddomain, "dma");
        }
-        time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+        if (rdev->asic->copy.blit) {
-                                        RADEON_BENCHMARK_COPY_BLIT, n);
+                time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
-        if (time < 0)
+                                                RADEON_BENCHMARK_COPY_BLIT, n);
-                goto out_cleanup;
+                if (time < 0)
-        if (time > 0)
+                        goto out_cleanup;
-                radeon_benchmark_log_results(n, size, time,
+                if (time > 0)
-                                             sdomain, ddomain, "blit");
+                        radeon_benchmark_log_results(n, size, time,
+                                                     sdomain, ddomain, "blit");
+        }
 out_cleanup:
        if (sobj) {
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 9128120da044..bafbe3216952 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -4469,6 +4469,7 @@ int si_resume(struct radeon_device *rdev)
 int si_suspend(struct radeon_device *rdev)
 {
+        radeon_vm_manager_fini(rdev);
        si_cp_enable(rdev, false);
        cayman_dma_stop(rdev);
        si_irq_suspend(rdev);
diff --git a/drivers/hwmon/lm75.h b/drivers/hwmon/lm75.h
index 668ff4721323..5cde94e56f17 100644
--- a/drivers/hwmon/lm75.h
+++ b/drivers/hwmon/lm75.h
@@ -25,7 +25,7 @@
    which contains this code, we don't worry about the wasted space.
 */
-#include <linux/hwmon.h>
+#include <linux/kernel.h>
 /* straight from the datasheet */
 #define LM75_TEMP_MIN (-55000)
diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig
index 46cde098c11c..e380c6eef3af 100644
--- a/drivers/i2c/Kconfig
+++ b/drivers/i2c/Kconfig
@@ -4,7 +4,6 @@
 menuconfig I2C
        tristate "I2C support"
-        depends on !S390
        select RT_MUTEXES
        ---help---
          I2C (pronounce: I-squared-C) is a slow serial bus protocol used in
@@ -76,6 +75,7 @@ config I2C_HELPER_AUTO
 config I2C_SMBUS
        tristate "SMBus-specific protocols" if !I2C_HELPER_AUTO
+        depends on GENERIC_HARDIRQS
        help
          Say Y here if you want support for SMBus extensions to the I2C
          specification. At the moment, the only supported extension is
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index a3725de92384..adfee98486b1 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -114,7 +114,7 @@ config I2C_I801
 config I2C_ISCH
        tristate "Intel SCH SMBus 1.0"
-        depends on PCI
+        depends on PCI && GENERIC_HARDIRQS
        select LPC_SCH
        help
          Say Y here if you want to use SMBus controller on the Intel SCH
@@ -543,6 +543,7 @@ config I2C_NUC900
 config I2C_OCORES
        tristate "OpenCores I2C Controller"
+        depends on GENERIC_HARDIRQS
        help
          If you say yes to this option, support will be included for the
          OpenCores I2C controller. For details see
@@ -777,7 +778,7 @@ config I2C_DIOLAN_U2C
 config I2C_PARPORT
        tristate "Parallel port adapter"
-        depends on PARPORT
+        depends on PARPORT && GENERIC_HARDIRQS
        select I2C_ALGOBIT
        select I2C_SMBUS
        help
@@ -802,6 +803,7 @@ config I2C_PARPORT
 config I2C_PARPORT_LIGHT
        tristate "Parallel port adapter (light)"
+        depends on GENERIC_HARDIRQS
        select I2C_ALGOBIT
        select I2C_SMBUS
        help
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index e9205ee8cf94..130f02cc9d94 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -80,6 +80,7 @@
 /* PCI DIDs for the Intel SMBus Message Transport (SMT) Devices */
 #define PCI_DEVICE_ID_INTEL_S1200_SMT0  0x0c59
 #define PCI_DEVICE_ID_INTEL_S1200_SMT1  0x0c5a
+#define PCI_DEVICE_ID_INTEL_AVOTON_SMT  0x1f15
 #define ISMT_DESC_ENTRIES       32      /* number of descriptor entries */
 #define ISMT_MAX_RETRIES        3       /* number of SMBus retries to attempt */
@@ -185,6 +186,7 @@ struct ismt_priv {
 static const DEFINE_PCI_DEVICE_TABLE(ismt_ids) = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_S1200_SMT0) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_S1200_SMT1) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_AVOTON_SMT) },
        { 0, }
 };
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index 36704e3ab3fa..b714776b6ddd 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -411,7 +411,11 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev)
        int clk_multiplier = I2C_CLK_MULTIPLIER_STD_FAST_MODE;
        u32 clk_divisor;
-        tegra_i2c_clock_enable(i2c_dev);
+        err = tegra_i2c_clock_enable(i2c_dev);
+        if (err < 0) {
+                dev_err(i2c_dev->dev, "Clock enable failed %d\n", err);
+                return err;
+        }
        tegra_periph_reset_assert(i2c_dev->div_clk);
        udelay(2);
@@ -628,7 +632,12 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
        if (i2c_dev->is_suspended)
                return -EBUSY;
-        tegra_i2c_clock_enable(i2c_dev);
+        ret = tegra_i2c_clock_enable(i2c_dev);
+        if (ret < 0) {
+                dev_err(i2c_dev->dev, "Clock enable failed %d\n", ret);
+                return ret;
+        }
        for (i = 0; i < num; i++) {
                enum msg_end_type end_type = MSG_END_STOP;
                if (i < (num - 1)) {
diff --git a/drivers/i2c/muxes/i2c-mux-pca9541.c b/drivers/i2c/muxes/i2c-mux-pca9541.c
index f3b8f9a6a89b..966a18a5d12d 100644
--- a/drivers/i2c/muxes/i2c-mux-pca9541.c
+++ b/drivers/i2c/muxes/i2c-mux-pca9541.c
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2010 Ericsson AB.
 *
- * Author: Guenter Roeck <guenter.roeck@ericsson.com>
+ * Author: Guenter Roeck <linux@roeck-us.net>
 *
 * Derived from:
 *  pca954x.c
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 565bfb161c1a..a3fde52840ca 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1575,6 +1575,12 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
        neigh = dst_neigh_lookup(ep->dst,
                        &ep->com.cm_id->remote_addr.sin_addr.s_addr);
+        if (!neigh) {
+                pr_err("%s - cannot alloc neigh.\n", __func__);
+                err = -ENOMEM;
+                goto fail4;
+        }
        /* get a l2t entry */
        if (neigh->dev->flags & IFF_LOOPBACK) {
                PDBG("%s LOOPBACK\n", __func__);
@@ -3053,6 +3059,12 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
        dst = &rt->dst;
        neigh = dst_neigh_lookup_skb(dst, skb);
+        if (!neigh) {
+                pr_err("%s - failed to allocate neigh!\n",
+                       __func__);
+                goto free_dst;
+        }
        if (neigh->dev->flags & IFF_LOOPBACK) {
                pdev = ip_dev_find(&init_net, iph->daddr);
                e = cxgb4_l2t_get(dev->rdev.lldi.l2t, neigh,
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 7cd74e29cbc8..9135606c8649 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -158,14 +158,10 @@ static unsigned int get_time_pit(void)
 #define GET_TIME(x)     rdtscl(x)
 #define DELTA(x,y)      ((y)-(x))
 #define TIME_NAME       "TSC"
-#elif defined(__alpha__)
+#elif defined(__alpha__) || defined(CONFIG_MN10300) || defined(CONFIG_ARM) || defined(CONFIG_TILE)
 #define GET_TIME(x)     do { x = get_cycles(); } while (0)
 #define DELTA(x,y)      ((y)-(x))
-#define TIME_NAME       "PCC"
+#define TIME_NAME       "get_cycles"
-#elif defined(CONFIG_MN10300) || defined(CONFIG_TILE)
-#define GET_TIME(x)     do { x = get_cycles(); } while (0)
-#define DELTA(x, y)     ((x) - (y))
-#define TIME_NAME       "TSC"
 #else
 #define FAKE_TIME
 static unsigned long analog_faketime = 0;
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index 5313c9ea44dc..d9edcc94c2a8 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -237,7 +237,8 @@ config HISAX_MIC
 config HISAX_NETJET
        bool "NETjet card"
-        depends on PCI && (BROKEN || !(SPARC || PPC || PARISC || M68K || (MIPS && !CPU_LITTLE_ENDIAN) || FRV || (XTENSA && !CPU_LITTLE_ENDIAN)))
+        depends on PCI && (BROKEN || !(PPC || PARISC || M68K || (MIPS && !CPU_LITTLE_ENDIAN) || FRV || (XTENSA && !CPU_LITTLE_ENDIAN)))
+        depends on VIRT_TO_BUS
        help
          This enables HiSax support for the NetJet from Traverse
          Technologies.
@@ -248,7 +249,8 @@ config HISAX_NETJET
 config HISAX_NETJET_U
        bool "NETspider U card"
-        depends on PCI && (BROKEN || !(SPARC || PPC || PARISC || M68K || (MIPS && !CPU_LITTLE_ENDIAN) || FRV || (XTENSA && !CPU_LITTLE_ENDIAN)))
+        depends on PCI && (BROKEN || !(PPC || PARISC || M68K || (MIPS && !CPU_LITTLE_ENDIAN) || FRV || (XTENSA && !CPU_LITTLE_ENDIAN)))
+        depends on VIRT_TO_BUS
        help
          This enables HiSax support for the Netspider U interface ISDN card
          from Traverse Technologies.
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 3c955e10a618..c6083132c4b8 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1025,6 +1025,8 @@ void dm_bufio_prefetch(struct dm_bufio_client *c,
 {
        struct blk_plug plug;
+        BUG_ON(dm_bufio_in_request());
        blk_start_plug(&plug);
        dm_bufio_lock(c);
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index fbd3625f2748..83e995fece88 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -83,6 +83,8 @@ struct cache_disk_superblock {
        __le32 read_misses;
        __le32 write_hits;
        __le32 write_misses;
+        __le32 policy_version[CACHE_POLICY_VERSION_SIZE];
 } __packed;
 struct dm_cache_metadata {
@@ -109,6 +111,7 @@ struct dm_cache_metadata {
        bool clean_when_opened:1;
        char policy_name[CACHE_POLICY_NAME_SIZE];
+        unsigned policy_version[CACHE_POLICY_VERSION_SIZE];
        size_t policy_hint_size;
        struct dm_cache_statistics stats;
 };
@@ -268,7 +271,8 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
        memset(disk_super->uuid, 0, sizeof(disk_super->uuid));
        disk_super->magic = cpu_to_le64(CACHE_SUPERBLOCK_MAGIC);
        disk_super->version = cpu_to_le32(CACHE_VERSION);
-        memset(disk_super->policy_name, 0, CACHE_POLICY_NAME_SIZE);
+        memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name));
+        memset(disk_super->policy_version, 0, sizeof(disk_super->policy_version));
        disk_super->policy_hint_size = 0;
        r = dm_sm_copy_root(cmd->metadata_sm, &disk_super->metadata_space_map_root,
@@ -284,7 +288,6 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
        disk_super->metadata_block_size = cpu_to_le32(DM_CACHE_METADATA_BLOCK_SIZE >> SECTOR_SHIFT);
        disk_super->data_block_size = cpu_to_le32(cmd->data_block_size);
        disk_super->cache_blocks = cpu_to_le32(0);
-        memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name));
        disk_super->read_hits = cpu_to_le32(0);
        disk_super->read_misses = cpu_to_le32(0);
@@ -478,6 +481,9 @@ static void read_superblock_fields(struct dm_cache_metadata *cmd,
        cmd->data_block_size = le32_to_cpu(disk_super->data_block_size);
        cmd->cache_blocks = to_cblock(le32_to_cpu(disk_super->cache_blocks));
        strncpy(cmd->policy_name, disk_super->policy_name, sizeof(cmd->policy_name));
+        cmd->policy_version[0] = le32_to_cpu(disk_super->policy_version[0]);
+        cmd->policy_version[1] = le32_to_cpu(disk_super->policy_version[1]);
+        cmd->policy_version[2] = le32_to_cpu(disk_super->policy_version[2]);
        cmd->policy_hint_size = le32_to_cpu(disk_super->policy_hint_size);
        cmd->stats.read_hits = le32_to_cpu(disk_super->read_hits);
@@ -572,6 +578,9 @@ static int __commit_transaction(struct dm_cache_metadata *cmd,
        disk_super->discard_nr_blocks = cpu_to_le64(from_dblock(cmd->discard_nr_blocks));
        disk_super->cache_blocks = cpu_to_le32(from_cblock(cmd->cache_blocks));
        strncpy(disk_super->policy_name, cmd->policy_name, sizeof(disk_super->policy_name));
+        disk_super->policy_version[0] = cpu_to_le32(cmd->policy_version[0]);
+        disk_super->policy_version[1] = cpu_to_le32(cmd->policy_version[1]);
+        disk_super->policy_version[2] = cpu_to_le32(cmd->policy_version[2]);
        disk_super->read_hits = cpu_to_le32(cmd->stats.read_hits);
        disk_super->read_misses = cpu_to_le32(cmd->stats.read_misses);
@@ -854,18 +863,43 @@ struct thunk {
        bool hints_valid;
 };
+static bool policy_unchanged(struct dm_cache_metadata *cmd,
+                             struct dm_cache_policy *policy)
+{
+        const char *policy_name = dm_cache_policy_get_name(policy);
+        const unsigned *policy_version = dm_cache_policy_get_version(policy);
+        size_t policy_hint_size = dm_cache_policy_get_hint_size(policy);
+        /*
+         * Ensure policy names match.
+         */
+        if (strncmp(cmd->policy_name, policy_name, sizeof(cmd->policy_name)))
+                return false;
+        /*
+         * Ensure policy major versions match.
+         */
+        if (cmd->policy_version[0] != policy_version[0])
+                return false;
+        /*
+         * Ensure policy hint sizes match.
+         */
+        if (cmd->policy_hint_size != policy_hint_size)
+                return false;
+        return true;
+}
 static bool hints_array_initialized(struct dm_cache_metadata *cmd)
 {
        return cmd->hint_root && cmd->policy_hint_size;
 }
 static bool hints_array_available(struct dm_cache_metadata *cmd,
-                                  const char *policy_name)
+                                  struct dm_cache_policy *policy)
 {
-        bool policy_names_match = !strncmp(cmd->policy_name, policy_name,
+        return cmd->clean_when_opened && policy_unchanged(cmd, policy) &&
-                                           sizeof(cmd->policy_name));
-        return cmd->clean_when_opened && policy_names_match &&
                hints_array_initialized(cmd);
 }
@@ -899,7 +933,8 @@ static int __load_mapping(void *context, uint64_t cblock, void *leaf)
        return r;
 }
-static int __load_mappings(struct dm_cache_metadata *cmd, const char *policy_name,
+static int __load_mappings(struct dm_cache_metadata *cmd,
+                           struct dm_cache_policy *policy,
                           load_mapping_fn fn, void *context)
 {
        struct thunk thunk;
@@ -909,18 +944,19 @@ static int __load_mappings(struct dm_cache_metadata *cmd, const char *policy_nam
        thunk.cmd = cmd;
        thunk.respect_dirty_flags = cmd->clean_when_opened;
-        thunk.hints_valid = hints_array_available(cmd, policy_name);
+        thunk.hints_valid = hints_array_available(cmd, policy);
        return dm_array_walk(&cmd->info, cmd->root, __load_mapping, &thunk);
 }
-int dm_cache_load_mappings(struct dm_cache_metadata *cmd, const char *policy_name,
+int dm_cache_load_mappings(struct dm_cache_metadata *cmd,
+                           struct dm_cache_policy *policy,
                           load_mapping_fn fn, void *context)
 {
        int r;
        down_read(&cmd->root_lock);
-        r = __load_mappings(cmd, policy_name, fn, context);
+        r = __load_mappings(cmd, policy, fn, context);
        up_read(&cmd->root_lock);
        return r;
@@ -979,7 +1015,7 @@ static int __dirty(struct dm_cache_metadata *cmd, dm_cblock_t cblock, bool dirty
                /* nothing to be done */
                return 0;
-        value = pack_value(oblock, flags | (dirty ? M_DIRTY : 0));
+        value = pack_value(oblock, (flags & ~M_DIRTY) | (dirty ? M_DIRTY : 0));
        __dm_bless_for_disk(&value);
        r = dm_array_set_value(&cmd->info, cmd->root, from_cblock(cblock),
@@ -1070,13 +1106,15 @@ static int begin_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy *po
        __le32 value;
        size_t hint_size;
        const char *policy_name = dm_cache_policy_get_name(policy);
+        const unsigned *policy_version = dm_cache_policy_get_version(policy);
        if (!policy_name[0] ||
            (strlen(policy_name) > sizeof(cmd->policy_name) - 1))
                return -EINVAL;
-        if (strcmp(cmd->policy_name, policy_name)) {
+        if (!policy_unchanged(cmd, policy)) {
                strncpy(cmd->policy_name, policy_name, sizeof(cmd->policy_name));
+                memcpy(cmd->policy_version, policy_version, sizeof(cmd->policy_version));
                hint_size = dm_cache_policy_get_hint_size(policy);
                if (!hint_size)
diff --git a/drivers/md/dm-cache-metadata.h b/drivers/md/dm-cache-metadata.h
index 135864ea0eee..f45cef21f3d0 100644
--- a/drivers/md/dm-cache-metadata.h
+++ b/drivers/md/dm-cache-metadata.h
@@ -89,7 +89,7 @@ typedef int (*load_mapping_fn)(void *context, dm_oblock_t oblock,
                               dm_cblock_t cblock, bool dirty,
                               uint32_t hint, bool hint_valid);
 int dm_cache_load_mappings(struct dm_cache_metadata *cmd,
-                           const char *policy_name,
+                           struct dm_cache_policy *policy,
                           load_mapping_fn fn,
                           void *context);
diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c
index cc05d70b3cb8..b04d1f904d07 100644
--- a/drivers/md/dm-cache-policy-cleaner.c
+++ b/drivers/md/dm-cache-policy-cleaner.c
@@ -17,7 +17,6 @@
 /*----------------------------------------------------------------*/
 #define DM_MSG_PREFIX "cache cleaner"
-#define CLEANER_VERSION "1.0.0"
 /* Cache entry struct. */
 struct wb_cache_entry {
@@ -434,6 +433,7 @@ static struct dm_cache_policy *wb_create(dm_cblock_t cache_size,
 static struct dm_cache_policy_type wb_policy_type = {
        .name = "cleaner",
+        .version = {1, 0, 0},
        .hint_size = 0,
        .owner = THIS_MODULE,
        .create = wb_create
@@ -446,7 +446,10 @@ static int __init wb_init(void)
        if (r < 0)
                DMERR("register failed %d", r);
        else
-                DMINFO("version " CLEANER_VERSION " loaded");
+                DMINFO("version %u.%u.%u loaded",
+                       wb_policy_type.version[0],
+                       wb_policy_type.version[1],
+                       wb_policy_type.version[2]);
        return r;
 }
diff --git a/drivers/md/dm-cache-policy-internal.h b/drivers/md/dm-cache-policy-internal.h
index 52a75beeced5..0928abdc49f0 100644
--- a/drivers/md/dm-cache-policy-internal.h
+++ b/drivers/md/dm-cache-policy-internal.h
@@ -117,6 +117,8 @@ void dm_cache_policy_destroy(struct dm_cache_policy *p);
 */
 const char *dm_cache_policy_get_name(struct dm_cache_policy *p);
+const unsigned *dm_cache_policy_get_version(struct dm_cache_policy *p);
 size_t dm_cache_policy_get_hint_size(struct dm_cache_policy *p);
 /*----------------------------------------------------------------*/
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 964153255076..dc112a7137fe 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -14,7 +14,6 @@
 #include <linux/vmalloc.h>
 #define DM_MSG_PREFIX "cache-policy-mq"
-#define MQ_VERSION      "1.0.0"
 static struct kmem_cache *mq_entry_cache;
@@ -1133,6 +1132,7 @@ bad_cache_alloc:
 static struct dm_cache_policy_type mq_policy_type = {
        .name = "mq",
+        .version = {1, 0, 0},
        .hint_size = 4,
        .owner = THIS_MODULE,
        .create = mq_create
@@ -1140,6 +1140,7 @@ static struct dm_cache_policy_type mq_policy_type = {
 static struct dm_cache_policy_type default_policy_type = {
        .name = "default",
+        .version = {1, 0, 0},
        .hint_size = 4,
        .owner = THIS_MODULE,
        .create = mq_create
@@ -1164,7 +1165,10 @@ static int __init mq_init(void)
        r = dm_cache_policy_register(&default_policy_type);
        if (!r) {
-                DMINFO("version " MQ_VERSION " loaded");
+                DMINFO("version %u.%u.%u loaded",
+                       mq_policy_type.version[0],
+                       mq_policy_type.version[1],
+                       mq_policy_type.version[2]);
                return 0;
        }
diff --git a/drivers/md/dm-cache-policy.c b/drivers/md/dm-cache-policy.c
index 2cbf5fdaac52..21c03c570c06 100644
--- a/drivers/md/dm-cache-policy.c
+++ b/drivers/md/dm-cache-policy.c
@@ -150,6 +150,14 @@ const char *dm_cache_policy_get_name(struct dm_cache_policy *p)
 }
 EXPORT_SYMBOL_GPL(dm_cache_policy_get_name);
+const unsigned *dm_cache_policy_get_version(struct dm_cache_policy *p)
+{
+        struct dm_cache_policy_type *t = p->private;
+        return t->version;
+}
+EXPORT_SYMBOL_GPL(dm_cache_policy_get_version);
 size_t dm_cache_policy_get_hint_size(struct dm_cache_policy *p)
 {
        struct dm_cache_policy_type *t = p->private;
diff --git a/drivers/md/dm-cache-policy.h b/drivers/md/dm-cache-policy.h
index f0f51b260544..558bdfdabf5f 100644
--- a/drivers/md/dm-cache-policy.h
+++ b/drivers/md/dm-cache-policy.h
@@ -196,6 +196,7 @@ struct dm_cache_policy {
 * We maintain a little register of the different policy types.
 */
 #define CACHE_POLICY_NAME_SIZE 16
+#define CACHE_POLICY_VERSION_SIZE 3
 struct dm_cache_policy_type {
        /* For use by the register code only. */
@@ -206,6 +207,7 @@ struct dm_cache_policy_type {
         * what gets passed on the target line to select your policy.
         */
        char name[CACHE_POLICY_NAME_SIZE];
+        unsigned version[CACHE_POLICY_VERSION_SIZE];
        /*
         * Policies may store a hint for each each cache block.
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 0f4e84b15c30..66120bd46d15 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -142,6 +142,7 @@ struct cache {
        spinlock_t lock;
        struct bio_list deferred_bios;
        struct bio_list deferred_flush_bios;
+        struct bio_list deferred_writethrough_bios;
        struct list_head quiesced_migrations;
        struct list_head completed_migrations;
        struct list_head need_commit_migrations;
@@ -158,7 +159,7 @@ struct cache {
        /*
         * origin_blocks entries, discarded if set.
         */
-        sector_t discard_block_size; /* a power of 2 times sectors per block */
+        uint32_t discard_block_size; /* a power of 2 times sectors per block */
        dm_dblock_t discard_nr_blocks;
        unsigned long *discard_bitset;
@@ -199,6 +200,11 @@ struct per_bio_data {
        bool tick:1;
        unsigned req_nr:2;
        struct dm_deferred_entry *all_io_entry;
+        /* writethrough fields */
+        struct cache *cache;
+        dm_cblock_t cblock;
+        bio_end_io_t *saved_bi_end_io;
 };
 struct dm_cache_migration {
@@ -412,17 +418,24 @@ static bool block_size_is_power_of_two(struct cache *cache)
        return cache->sectors_per_block_shift >= 0;
 }
+static dm_block_t block_div(dm_block_t b, uint32_t n)
+{
+        do_div(b, n);
+        return b;
+}
 static dm_dblock_t oblock_to_dblock(struct cache *cache, dm_oblock_t oblock)
 {
-        sector_t discard_blocks = cache->discard_block_size;
+        uint32_t discard_blocks = cache->discard_block_size;
        dm_block_t b = from_oblock(oblock);
        if (!block_size_is_power_of_two(cache))
-                (void) sector_div(discard_blocks, cache->sectors_per_block);
+                discard_blocks = discard_blocks / cache->sectors_per_block;
        else
                discard_blocks >>= cache->sectors_per_block_shift;
-        (void) sector_div(b, discard_blocks);
+        b = block_div(b, discard_blocks);
        return to_dblock(b);
 }
@@ -609,6 +622,56 @@ static void issue(struct cache *cache, struct bio *bio)
        spin_unlock_irqrestore(&cache->lock, flags);
 }
+static void defer_writethrough_bio(struct cache *cache, struct bio *bio)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&cache->lock, flags);
+        bio_list_add(&cache->deferred_writethrough_bios, bio);
+        spin_unlock_irqrestore(&cache->lock, flags);
+        wake_worker(cache);
+}
+static void writethrough_endio(struct bio *bio, int err)
+{
+        struct per_bio_data *pb = get_per_bio_data(bio);
+        bio->bi_end_io = pb->saved_bi_end_io;
+        if (err) {
+                bio_endio(bio, err);
+                return;
+        }
+        remap_to_cache(pb->cache, bio, pb->cblock);
+        /*
+         * We can't issue this bio directly, since we're in interrupt
+         * context.  So it get's put on a bio list for processing by the
+         * worker thread.
+         */
+        defer_writethrough_bio(pb->cache, bio);
+}
+/*
+ * When running in writethrough mode we need to send writes to clean blocks
+ * to both the cache and origin devices.  In future we'd like to clone the
+ * bio and send them in parallel, but for now we're doing them in
+ * series as this is easier.
+ */
+static void remap_to_origin_then_cache(struct cache *cache, struct bio *bio,
+                                       dm_oblock_t oblock, dm_cblock_t cblock)
+{
+        struct per_bio_data *pb = get_per_bio_data(bio);
+        pb->cache = cache;
+        pb->cblock = cblock;
+        pb->saved_bi_end_io = bio->bi_end_io;
+        bio->bi_end_io = writethrough_endio;
+        remap_to_origin_clear_discard(pb->cache, bio, oblock);
+}
 /*----------------------------------------------------------------
 * Migration processing
 *
@@ -1002,7 +1065,7 @@ static void process_discard_bio(struct cache *cache, struct bio *bio)
        dm_block_t end_block = bio->bi_sector + bio_sectors(bio);
        dm_block_t b;
-        (void) sector_div(end_block, cache->discard_block_size);
+        end_block = block_div(end_block, cache->discard_block_size);
        for (b = start_block; b < end_block; b++)
                set_discard(cache, to_dblock(b));
@@ -1070,14 +1133,9 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
                inc_hit_counter(cache, bio);
                pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
-                if (is_writethrough_io(cache, bio, lookup_result.cblock)) {
+                if (is_writethrough_io(cache, bio, lookup_result.cblock))
-                        /*
+                        remap_to_origin_then_cache(cache, bio, block, lookup_result.cblock);
-                         * No need to mark anything dirty in write through mode.
+                else
-                         */
-                        pb->req_nr == 0 ?
-                                remap_to_cache(cache, bio, lookup_result.cblock) :
-                                remap_to_origin_clear_discard(cache, bio, block);
-                } else
                        remap_to_cache_dirty(cache, bio, block, lookup_result.cblock);
                issue(cache, bio);
@@ -1086,17 +1144,8 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
        case POLICY_MISS:
                inc_miss_counter(cache, bio);
                pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
+                remap_to_origin_clear_discard(cache, bio, block);
-                if (pb->req_nr != 0) {
+                issue(cache, bio);
-                        /*
-                         * This is a duplicate writethrough io that is no
-                         * longer needed because the block has been demoted.
-                         */
-                        bio_endio(bio, 0);
-                } else {
-                        remap_to_origin_clear_discard(cache, bio, block);
-                        issue(cache, bio);
-                }
                break;
        case POLICY_NEW:
@@ -1217,6 +1266,23 @@ static void process_deferred_flush_bios(struct cache *cache, bool submit_bios)
                submit_bios ? generic_make_request(bio) : bio_io_error(bio);
 }
+static void process_deferred_writethrough_bios(struct cache *cache)
+{
+        unsigned long flags;
+        struct bio_list bios;
+        struct bio *bio;
+        bio_list_init(&bios);
+        spin_lock_irqsave(&cache->lock, flags);
+        bio_list_merge(&bios, &cache->deferred_writethrough_bios);
+        bio_list_init(&cache->deferred_writethrough_bios);
+        spin_unlock_irqrestore(&cache->lock, flags);
+        while ((bio = bio_list_pop(&bios)))
+                generic_make_request(bio);
+}
 static void writeback_some_dirty_blocks(struct cache *cache)
 {
        int r = 0;
@@ -1313,6 +1379,7 @@ static int more_work(struct cache *cache)
        else
                return !bio_list_empty(&cache->deferred_bios) ||
                        !bio_list_empty(&cache->deferred_flush_bios) ||
+                        !bio_list_empty(&cache->deferred_writethrough_bios) ||
                        !list_empty(&cache->quiesced_migrations) ||
                        !list_empty(&cache->completed_migrations) ||
                        !list_empty(&cache->need_commit_migrations);
@@ -1331,6 +1398,8 @@ static void do_worker(struct work_struct *ws)
                writeback_some_dirty_blocks(cache);
+                process_deferred_writethrough_bios(cache);
                if (commit_if_needed(cache)) {
                        process_deferred_flush_bios(cache, false);
@@ -1756,8 +1825,11 @@ static int create_cache_policy(struct cache *cache, struct cache_args *ca,
        }
        r = set_config_values(cache->policy, ca->policy_argc, ca->policy_argv);
-        if (r)
+        if (r) {
+                *error = "Error setting cache policy's config values";
                dm_cache_policy_destroy(cache->policy);
+                cache->policy = NULL;
+        }
        return r;
 }
@@ -1793,8 +1865,6 @@ static sector_t calculate_discard_block_size(sector_t cache_block_size,
 #define DEFAULT_MIGRATION_THRESHOLD (2048 * 100)
-static unsigned cache_num_write_bios(struct dm_target *ti, struct bio *bio);
 static int cache_create(struct cache_args *ca, struct cache **result)
 {
        int r = 0;
@@ -1821,9 +1891,6 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        memcpy(&cache->features, &ca->features, sizeof(cache->features));
-        if (cache->features.write_through)
-                ti->num_write_bios = cache_num_write_bios;
        cache->callbacks.congested_fn = cache_is_congested;
        dm_table_add_target_callbacks(ti->table, &cache->callbacks);
@@ -1835,7 +1902,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        /* FIXME: factor out this whole section */
        origin_blocks = cache->origin_sectors = ca->origin_sectors;
-        (void) sector_div(origin_blocks, ca->block_size);
+        origin_blocks = block_div(origin_blocks, ca->block_size);
        cache->origin_blocks = to_oblock(origin_blocks);
        cache->sectors_per_block = ca->block_size;
@@ -1848,7 +1915,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
                dm_block_t cache_size = ca->cache_sectors;
                cache->sectors_per_block_shift = -1;
-                (void) sector_div(cache_size, ca->block_size);
+                cache_size = block_div(cache_size, ca->block_size);
                cache->cache_size = to_cblock(cache_size);
        } else {
                cache->sectors_per_block_shift = __ffs(ca->block_size);
@@ -1873,6 +1940,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        spin_lock_init(&cache->lock);
        bio_list_init(&cache->deferred_bios);
        bio_list_init(&cache->deferred_flush_bios);
+        bio_list_init(&cache->deferred_writethrough_bios);
        INIT_LIST_HEAD(&cache->quiesced_migrations);
        INIT_LIST_HEAD(&cache->completed_migrations);
        INIT_LIST_HEAD(&cache->need_commit_migrations);
@@ -2002,6 +2070,8 @@ static int cache_ctr(struct dm_target *ti, unsigned argc, char **argv)
                goto out;
        r = cache_create(ca, &cache);
+        if (r)
+                goto out;
        r = copy_ctr_args(cache, argc - 3, (const char **)argv + 3);
        if (r) {
@@ -2016,20 +2086,6 @@ out:
        return r;
 }
-static unsigned cache_num_write_bios(struct dm_target *ti, struct bio *bio)
-{
-        int r;
-        struct cache *cache = ti->private;
-        dm_oblock_t block = get_bio_block(cache, bio);
-        dm_cblock_t cblock;
-        r = policy_lookup(cache->policy, block, &cblock);
-        if (r < 0)
-                return 2;       /* assume the worst */
-        return (!r && !is_dirty(cache, cblock)) ? 2 : 1;
-}
 static int cache_map(struct dm_target *ti, struct bio *bio)
 {
        struct cache *cache = ti->private;
@@ -2097,18 +2153,12 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
                inc_hit_counter(cache, bio);
                pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
-                if (is_writethrough_io(cache, bio, lookup_result.cblock)) {
+                if (is_writethrough_io(cache, bio, lookup_result.cblock))
-                        /*
+                        remap_to_origin_then_cache(cache, bio, block, lookup_result.cblock);
-                         * No need to mark anything dirty in write through mode.
+                else
-                         */
-                        pb->req_nr == 0 ?
-                                remap_to_cache(cache, bio, lookup_result.cblock) :
-                                remap_to_origin_clear_discard(cache, bio, block);
-                        cell_defer(cache, cell, false);
-                } else {
                        remap_to_cache_dirty(cache, bio, block, lookup_result.cblock);
-                        cell_defer(cache, cell, false);
-                }
+                cell_defer(cache, cell, false);
                break;
        case POLICY_MISS:
@@ -2319,8 +2369,7 @@ static int cache_preresume(struct dm_target *ti)
        }
        if (!cache->loaded_mappings) {
-                r = dm_cache_load_mappings(cache->cmd,
+                r = dm_cache_load_mappings(cache->cmd, cache->policy,
-                                           dm_cache_policy_get_name(cache->policy),
                                           load_mapping, cache);
                if (r) {
                        DMERR("could not load cache mappings");
@@ -2535,7 +2584,7 @@ static void cache_io_hints(struct dm_target *ti, struct queue_limits *limits)
 static struct target_type cache_target = {
        .name = "cache",
-        .version = {1, 0, 0},
+        .version = {1, 1, 0},
        .module = THIS_MODULE,
        .ctr = cache_ctr,
        .dtr = cache_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 009339d62828..004ad1652b73 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1577,6 +1577,11 @@ static bool data_dev_supports_discard(struct pool_c *pt)
        return q && blk_queue_discard(q);
 }
+static bool is_factor(sector_t block_size, uint32_t n)
+{
+        return !sector_div(block_size, n);
+}
 /*
 * If discard_passdown was enabled verify that the data device
 * supports discards.  Disable discard_passdown if not.
@@ -1602,7 +1607,7 @@ static void disable_passdown_if_not_supported(struct pool_c *pt)
        else if (data_limits->discard_granularity > block_size)
                reason = "discard granularity larger than a block";
-        else if (block_size & (data_limits->discard_granularity - 1))
+        else if (!is_factor(block_size, data_limits->discard_granularity))
                reason = "discard granularity not a factor of block size";
        if (reason) {
@@ -2544,7 +2549,7 @@ static struct target_type pool_target = {
        .name = "thin-pool",
        .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                    DM_TARGET_IMMUTABLE,
-        .version = {1, 6, 1},
+        .version = {1, 7, 0},
        .module = THIS_MODULE,
        .ctr = pool_ctr,
        .dtr = pool_dtr,
@@ -2831,7 +2836,7 @@ static int thin_iterate_devices(struct dm_target *ti,
 static struct target_type thin_target = {
        .name = "thin",
-        .version = {1, 7, 1},
+        .version = {1, 8, 0},
        .module = THIS_MODULE,
        .ctr = thin_ctr,
        .dtr = thin_dtr,
diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
index 6ad538375c3c..a746f1d21c66 100644
--- a/drivers/md/dm-verity.c
+++ b/drivers/md/dm-verity.c
@@ -93,6 +93,13 @@ struct dm_verity_io {
         */
 };
+struct dm_verity_prefetch_work {
+        struct work_struct work;
+        struct dm_verity *v;
+        sector_t block;
+        unsigned n_blocks;
+};
 static struct shash_desc *io_hash_desc(struct dm_verity *v, struct dm_verity_io *io)
 {
        return (struct shash_desc *)(io + 1);
@@ -424,15 +431,18 @@ static void verity_end_io(struct bio *bio, int error)
 * The root buffer is not prefetched, it is assumed that it will be cached
 * all the time.
 */
-static void verity_prefetch_io(struct dm_verity *v, struct dm_verity_io *io)
+static void verity_prefetch_io(struct work_struct *work)
 {
+        struct dm_verity_prefetch_work *pw =
+                container_of(work, struct dm_verity_prefetch_work, work);
+        struct dm_verity *v = pw->v;
        int i;
        for (i = v->levels - 2; i >= 0; i--) {
                sector_t hash_block_start;
                sector_t hash_block_end;
-                verity_hash_at_level(v, io->block, i, &hash_block_start, NULL);
+                verity_hash_at_level(v, pw->block, i, &hash_block_start, NULL);
-                verity_hash_at_level(v, io->block + io->n_blocks - 1, i, &hash_block_end, NULL);
+                verity_hash_at_level(v, pw->block + pw->n_blocks - 1, i, &hash_block_end, NULL);
                if (!i) {
                        unsigned cluster = ACCESS_ONCE(dm_verity_prefetch_cluster);
@@ -452,6 +462,25 @@ no_prefetch_cluster:
                dm_bufio_prefetch(v->bufio, hash_block_start,
                                  hash_block_end - hash_block_start + 1);
        }
+        kfree(pw);
+}
+static void verity_submit_prefetch(struct dm_verity *v, struct dm_verity_io *io)
+{
+        struct dm_verity_prefetch_work *pw;
+        pw = kmalloc(sizeof(struct dm_verity_prefetch_work),
+                GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN);
+        if (!pw)
+                return;
+        INIT_WORK(&pw->work, verity_prefetch_io);
+        pw->v = v;
+        pw->block = io->block;
+        pw->n_blocks = io->n_blocks;
+        queue_work(v->verify_wq, &pw->work);
 }
 /*
@@ -498,7 +527,7 @@ static int verity_map(struct dm_target *ti, struct bio *bio)
        memcpy(io->io_vec, bio_iovec(bio),
               io->io_vec_size * sizeof(struct bio_vec));
-        verity_prefetch_io(v, io);
+        verity_submit_prefetch(v, io);
        generic_make_request(bio);
@@ -858,7 +887,7 @@ bad:
 static struct target_type verity_target = {
        .name           = "verity",
-        .version        = {1, 1, 1},
+        .version        = {1, 2, 0},
        .module         = THIS_MODULE,
        .ctr            = verity_ctr,
        .dtr            = verity_dtr,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index fcb878f88796..aeceedfc530b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7663,10 +7663,8 @@ static int remove_and_add_spares(struct mddev *mddev)
                                removed++;
                        }
                }
-        if (removed)
+        if (removed && mddev->kobj.sd)
-                sysfs_notify(&mddev->kobj, NULL,
+                sysfs_notify(&mddev->kobj, NULL, "degraded");
-                             "degraded");
        rdev_for_each(rdev, mddev) {
                if (rdev->raid_disk >= 0 &&
diff --git a/drivers/md/md.h b/drivers/md/md.h
index eca59c3074ef..d90fb1a879e1 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -506,7 +506,7 @@ static inline char * mdname (struct mddev * mddev)
 static inline int sysfs_link_rdev(struct mddev *mddev, struct md_rdev *rdev)
 {
        char nm[20];
-        if (!test_bit(Replacement, &rdev->flags)) {
+        if (!test_bit(Replacement, &rdev->flags) && mddev->kobj.sd) {
                sprintf(nm, "rd%d", rdev->raid_disk);
                return sysfs_create_link(&mddev->kobj, &rdev->kobj, nm);
        } else
@@ -516,7 +516,7 @@ static inline int sysfs_link_rdev(struct mddev *mddev, struct md_rdev *rdev)
 static inline void sysfs_unlink_rdev(struct mddev *mddev, struct md_rdev *rdev)
 {
        char nm[20];
-        if (!test_bit(Replacement, &rdev->flags)) {
+        if (!test_bit(Replacement, &rdev->flags) && mddev->kobj.sd) {
                sprintf(nm, "rd%d", rdev->raid_disk);
                sysfs_remove_link(&mddev->kobj, nm);
        }
diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
index c4f28133ef82..b88757cd0d1d 100644
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -139,15 +139,8 @@ struct child {
        struct btree_node *n;
 };
-static struct dm_btree_value_type le64_type = {
+static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt,
-        .context = NULL,
+                      struct btree_node *parent,
-        .size = sizeof(__le64),
-        .inc = NULL,
-        .dec = NULL,
-        .equal = NULL
-};
-static int init_child(struct dm_btree_info *info, struct btree_node *parent,
                      unsigned index, struct child *result)
 {
        int r, inc;
@@ -164,7 +157,7 @@ static int init_child(struct dm_btree_info *info, struct btree_node *parent,
        result->n = dm_block_data(result->block);
        if (inc)
-                inc_children(info->tm, result->n, &le64_type);
+                inc_children(info->tm, result->n, vt);
        *((__le64 *) value_ptr(parent, index)) =
                cpu_to_le64(dm_block_location(result->block));
@@ -236,7 +229,7 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent,
 }
 static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
-                      unsigned left_index)
+                      struct dm_btree_value_type *vt, unsigned left_index)
 {
        int r;
        struct btree_node *parent;
@@ -244,11 +237,11 @@ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
        parent = dm_block_data(shadow_current(s));
-        r = init_child(info, parent, left_index, &left);
+        r = init_child(info, vt, parent, left_index, &left);
        if (r)
                return r;
-        r = init_child(info, parent, left_index + 1, &right);
+        r = init_child(info, vt, parent, left_index + 1, &right);
        if (r) {
                exit_child(info, &left);
                return r;
@@ -368,7 +361,7 @@ static void __rebalance3(struct dm_btree_info *info, struct btree_node *parent,
 }
 static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
-                      unsigned left_index)
+                      struct dm_btree_value_type *vt, unsigned left_index)
 {
        int r;
        struct btree_node *parent = dm_block_data(shadow_current(s));
@@ -377,17 +370,17 @@ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
        /*
         * FIXME: fill out an array?
         */
-        r = init_child(info, parent, left_index, &left);
+        r = init_child(info, vt, parent, left_index, &left);
        if (r)
                return r;
-        r = init_child(info, parent, left_index + 1, &center);
+        r = init_child(info, vt, parent, left_index + 1, &center);
        if (r) {
                exit_child(info, &left);
                return r;
        }
-        r = init_child(info, parent, left_index + 2, &right);
+        r = init_child(info, vt, parent, left_index + 2, &right);
        if (r) {
                exit_child(info, &left);
                exit_child(info, &center);
@@ -434,7 +427,8 @@ static int get_nr_entries(struct dm_transaction_manager *tm,
 }
 static int rebalance_children(struct shadow_spine *s,
-                              struct dm_btree_info *info, uint64_t key)
+                              struct dm_btree_info *info,
+                              struct dm_btree_value_type *vt, uint64_t key)
 {
        int i, r, has_left_sibling, has_right_sibling;
        uint32_t child_entries;
@@ -472,13 +466,13 @@ static int rebalance_children(struct shadow_spine *s,
        has_right_sibling = i < (le32_to_cpu(n->header.nr_entries) - 1);
        if (!has_left_sibling)
-                r = rebalance2(s, info, i);
+                r = rebalance2(s, info, vt, i);
        else if (!has_right_sibling)
-                r = rebalance2(s, info, i - 1);
+                r = rebalance2(s, info, vt, i - 1);
        else
-                r = rebalance3(s, info, i - 1);
+                r = rebalance3(s, info, vt, i - 1);
        return r;
 }
@@ -529,7 +523,7 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
                if (le32_to_cpu(n->header.flags) & LEAF_NODE)
                        return do_leaf(n, key, index);
-                r = rebalance_children(s, info, key);
+                r = rebalance_children(s, info, vt, key);
                if (r)
                        break;
@@ -550,6 +544,14 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
        return r;
 }
+static struct dm_btree_value_type le64_type = {
+        .context = NULL,
+        .size = sizeof(__le64),
+        .inc = NULL,
+        .dec = NULL,
+        .equal = NULL
+};
 int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
                    uint64_t *keys, dm_block_t *new_root)
 {
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 3ee2912889e7..24909eb13fec 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -671,9 +671,11 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        bi->bi_next = NULL;
                        if (rrdev)
                                set_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags);
-                        trace_block_bio_remap(bdev_get_queue(bi->bi_bdev),
-                                              bi, disk_devt(conf->mddev->gendisk),
+                        if (conf->mddev->gendisk)
-                                              sh->dev[i].sector);
+                                trace_block_bio_remap(bdev_get_queue(bi->bi_bdev),
+                                                      bi, disk_devt(conf->mddev->gendisk),
+                                                      sh->dev[i].sector);
                        generic_make_request(bi);
                }
                if (rrdev) {
@@ -701,9 +703,10 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        rbi->bi_io_vec[0].bv_offset = 0;
                        rbi->bi_size = STRIPE_SIZE;
                        rbi->bi_next = NULL;
-                        trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
+                        if (conf->mddev->gendisk)
-                                              rbi, disk_devt(conf->mddev->gendisk),
+                                trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
-                                              sh->dev[i].sector);
+                                                      rbi, disk_devt(conf->mddev->gendisk),
+                                                      sh->dev[i].sector);
                        generic_make_request(rbi);
                }
                if (!rdev && !rrdev) {
@@ -2280,17 +2283,6 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
        int level = conf->level;
        if (rcw) {
-                /* if we are not expanding this is a proper write request, and
-                 * there will be bios with new data to be drained into the
-                 * stripe cache
-                 */
-                if (!expand) {
-                        sh->reconstruct_state = reconstruct_state_drain_run;
-                        set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
-                } else
-                        sh->reconstruct_state = reconstruct_state_run;
-                set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
                for (i = disks; i--; ) {
                        struct r5dev *dev = &sh->dev[i];
@@ -2303,6 +2295,21 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                                s->locked++;
                        }
                }
+                /* if we are not expanding this is a proper write request, and
+                 * there will be bios with new data to be drained into the
+                 * stripe cache
+                 */
+                if (!expand) {
+                        if (!s->locked)
+                                /* False alarm, nothing to do */
+                                return;
+                        sh->reconstruct_state = reconstruct_state_drain_run;
+                        set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
+                } else
+                        sh->reconstruct_state = reconstruct_state_run;
+                set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
                if (s->locked + conf->max_degraded == disks)
                        if (!test_and_set_bit(STRIPE_FULL_WRITE, &sh->state))
                                atomic_inc(&conf->pending_full_writes);
@@ -2311,11 +2318,6 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                BUG_ON(!(test_bit(R5_UPTODATE, &sh->dev[pd_idx].flags) ||
                        test_bit(R5_Wantcompute, &sh->dev[pd_idx].flags)));
-                sh->reconstruct_state = reconstruct_state_prexor_drain_run;
-                set_bit(STRIPE_OP_PREXOR, &s->ops_request);
-                set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
-                set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
                for (i = disks; i--; ) {
                        struct r5dev *dev = &sh->dev[i];
                        if (i == pd_idx)
@@ -2330,6 +2332,13 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                                s->locked++;
                        }
                }
+                if (!s->locked)
+                        /* False alarm - nothing to do */
+                        return;
+                sh->reconstruct_state = reconstruct_state_prexor_drain_run;
+                set_bit(STRIPE_OP_PREXOR, &s->ops_request);
+                set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
+                set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
        }
        /* keep the parity disk(s) locked while asynchronous operations
@@ -2564,6 +2573,8 @@ handle_failed_sync(struct r5conf *conf, struct stripe_head *sh,
        int i;
        clear_bit(STRIPE_SYNCING, &sh->state);
+        if (test_and_clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags))
+                wake_up(&conf->wait_for_overlap);
        s->syncing = 0;
        s->replacing = 0;
        /* There is nothing more to do for sync/check/repair.
@@ -2737,6 +2748,7 @@ static void handle_stripe_clean_event(struct r5conf *conf,
 {
        int i;
        struct r5dev *dev;
+        int discard_pending = 0;
        for (i = disks; i--; )
                if (sh->dev[i].written) {
@@ -2765,9 +2777,23 @@ static void handle_stripe_clean_event(struct r5conf *conf,
                                                STRIPE_SECTORS,
                                         !test_bit(STRIPE_DEGRADED, &sh->state),
                                                0);
-                        }
+                        } else if (test_bit(R5_Discard, &dev->flags))
-                } else if (test_bit(R5_Discard, &sh->dev[i].flags))
+                                discard_pending = 1;
-                        clear_bit(R5_Discard, &sh->dev[i].flags);
+                }
+        if (!discard_pending &&
+            test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) {
+                clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags);
+                clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
+                if (sh->qd_idx >= 0) {
+                        clear_bit(R5_Discard, &sh->dev[sh->qd_idx].flags);
+                        clear_bit(R5_UPTODATE, &sh->dev[sh->qd_idx].flags);
+                }
+                /* now that discard is done we can proceed with any sync */
+                clear_bit(STRIPE_DISCARD, &sh->state);
+                if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
+                        set_bit(STRIPE_HANDLE, &sh->state);
+        }
        if (test_and_clear_bit(STRIPE_FULL_WRITE, &sh->state))
                if (atomic_dec_and_test(&conf->pending_full_writes))
@@ -2826,8 +2852,10 @@ static void handle_stripe_dirtying(struct r5conf *conf,
        set_bit(STRIPE_HANDLE, &sh->state);
        if (rmw < rcw && rmw > 0) {
                /* prefer read-modify-write, but need to get some data */
-                blk_add_trace_msg(conf->mddev->queue, "raid5 rmw %llu %d",
+                if (conf->mddev->queue)
-                                  (unsigned long long)sh->sector, rmw);
+                        blk_add_trace_msg(conf->mddev->queue,
+                                          "raid5 rmw %llu %d",
+                                          (unsigned long long)sh->sector, rmw);
                for (i = disks; i--; ) {
                        struct r5dev *dev = &sh->dev[i];
                        if ((dev->towrite || i == sh->pd_idx) &&
@@ -2877,7 +2905,7 @@ static void handle_stripe_dirtying(struct r5conf *conf,
                                }
                        }
                }
-                if (rcw)
+                if (rcw && conf->mddev->queue)
                        blk_add_trace_msg(conf->mddev->queue, "raid5 rcw %llu %d %d %d",
                                          (unsigned long long)sh->sector,
                                          rcw, qread, test_bit(STRIPE_DELAYED, &sh->state));
@@ -3417,9 +3445,15 @@ static void handle_stripe(struct stripe_head *sh)
                return;
        }
-        if (test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
+        if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
-                set_bit(STRIPE_SYNCING, &sh->state);
+                spin_lock(&sh->stripe_lock);
-                clear_bit(STRIPE_INSYNC, &sh->state);
+                /* Cannot process 'sync' concurrently with 'discard' */
+                if (!test_bit(STRIPE_DISCARD, &sh->state) &&
+                    test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
+                        set_bit(STRIPE_SYNCING, &sh->state);
+                        clear_bit(STRIPE_INSYNC, &sh->state);
+                }
+                spin_unlock(&sh->stripe_lock);
        }
        clear_bit(STRIPE_DELAYED, &sh->state);
@@ -3579,6 +3613,8 @@ static void handle_stripe(struct stripe_head *sh)
            test_bit(STRIPE_INSYNC, &sh->state)) {
                md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
                clear_bit(STRIPE_SYNCING, &sh->state);
+                if (test_and_clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags))
+                        wake_up(&conf->wait_for_overlap);
        }
        /* If the failed drives are just a ReadError, then we might need
@@ -3982,9 +4018,10 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
                atomic_inc(&conf->active_aligned_reads);
                spin_unlock_irq(&conf->device_lock);
-                trace_block_bio_remap(bdev_get_queue(align_bi->bi_bdev),
+                if (mddev->gendisk)
-                                      align_bi, disk_devt(mddev->gendisk),
+                        trace_block_bio_remap(bdev_get_queue(align_bi->bi_bdev),
-                                      raid_bio->bi_sector);
+                                              align_bi, disk_devt(mddev->gendisk),
+                                              raid_bio->bi_sector);
                generic_make_request(align_bi);
                return 1;
        } else {
@@ -4078,7 +4115,8 @@ static void raid5_unplug(struct blk_plug_cb *blk_cb, bool from_schedule)
                }
                spin_unlock_irq(&conf->device_lock);
        }
-        trace_block_unplug(mddev->queue, cnt, !from_schedule);
+        if (mddev->queue)
+                trace_block_unplug(mddev->queue, cnt, !from_schedule);
        kfree(cb);
 }
@@ -4141,6 +4179,13 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
                sh = get_active_stripe(conf, logical_sector, 0, 0, 0);
                prepare_to_wait(&conf->wait_for_overlap, &w,
                                TASK_UNINTERRUPTIBLE);
+                set_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags);
+                if (test_bit(STRIPE_SYNCING, &sh->state)) {
+                        release_stripe(sh);
+                        schedule();
+                        goto again;
+                }
+                clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags);
                spin_lock_irq(&sh->stripe_lock);
                for (d = 0; d < conf->raid_disks; d++) {
                        if (d == sh->pd_idx || d == sh->qd_idx)
@@ -4153,6 +4198,7 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
                                goto again;
                        }
                }
+                set_bit(STRIPE_DISCARD, &sh->state);
                finish_wait(&conf->wait_for_overlap, &w);
                for (d = 0; d < conf->raid_disks; d++) {
                        if (d == sh->pd_idx || d == sh->qd_idx)
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 18b2c4a8a1fd..b0b663b119a8 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -221,10 +221,6 @@ struct stripe_head {
        struct stripe_operations {
                int                  target, target2;
                enum sum_check_flags zero_sum_result;
-                #ifdef CONFIG_MULTICORE_RAID456
-                unsigned long        request;
-                wait_queue_head_t    wait_for_ops;
-                #endif
        } ops;
        struct r5dev {
                /* rreq and rvec are used for the replacement device when
@@ -323,6 +319,7 @@ enum {
        STRIPE_COMPUTE_RUN,
        STRIPE_OPS_REQ_PENDING,
        STRIPE_ON_UNPLUG_LIST,
+        STRIPE_DISCARD,
 };
 /*
diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c
index 63feb75cc8e0..9279a9174f84 100644
--- a/drivers/mtd/bcm47xxpart.c
+++ b/drivers/mtd/bcm47xxpart.c
@@ -19,6 +19,12 @@
 /* 10 parts were found on sflash on Netgear WNDR4500 */
 #define BCM47XXPART_MAX_PARTS           12
+/*
+ * Amount of bytes we read when analyzing each block of flash memory.
+ * Set it big enough to allow detecting partition and reading important data.
+ */
+#define BCM47XXPART_BYTES_TO_READ       0x404
 /* Magics */
 #define BOARD_DATA_MAGIC                0x5246504D      /* MPFR */
 #define POT_MAGIC1                      0x54544f50      /* POTT */
@@ -57,17 +63,15 @@ static int bcm47xxpart_parse(struct mtd_info *master,
        struct trx_header *trx;
        int trx_part = -1;
        int last_trx_part = -1;
-        int max_bytes_to_read = 0x8004;
+        int possible_nvram_sizes[] = { 0x8000, 0xF000, 0x10000, };
        if (blocksize <= 0x10000)
                blocksize = 0x10000;
-        if (blocksize == 0x20000)
-                max_bytes_to_read = 0x18004;
        /* Alloc */
        parts = kzalloc(sizeof(struct mtd_partition) * BCM47XXPART_MAX_PARTS,
                        GFP_KERNEL);
-        buf = kzalloc(max_bytes_to_read, GFP_KERNEL);
+        buf = kzalloc(BCM47XXPART_BYTES_TO_READ, GFP_KERNEL);
        /* Parse block by block looking for magics */
        for (offset = 0; offset <= master->size - blocksize;
@@ -82,7 +86,7 @@ static int bcm47xxpart_parse(struct mtd_info *master,
                }
                /* Read beginning of the block */
-                if (mtd_read(master, offset, max_bytes_to_read,
+                if (mtd_read(master, offset, BCM47XXPART_BYTES_TO_READ,
                             &bytes_read, (uint8_t *)buf) < 0) {
                        pr_err("mtd_read error while parsing (offset: 0x%X)!\n",
                               offset);
@@ -96,20 +100,6 @@ static int bcm47xxpart_parse(struct mtd_info *master,
                        continue;
                }
-                /* Standard NVRAM */
-                if (buf[0x000 / 4] == NVRAM_HEADER ||
-                    buf[0x1000 / 4] == NVRAM_HEADER ||
-                    buf[0x8000 / 4] == NVRAM_HEADER ||
-                    (blocksize == 0x20000 && (
-                      buf[0x10000 / 4] == NVRAM_HEADER ||
-                      buf[0x11000 / 4] == NVRAM_HEADER ||
-                      buf[0x18000 / 4] == NVRAM_HEADER))) {
-                        bcm47xxpart_add_part(&parts[curr_part++], "nvram",
-                                             offset, 0);
-                        offset = rounddown(offset, blocksize);
-                        continue;
-                }
                /*
                 * board_data starts with board_id which differs across boards,
                 * but we can use 'MPFR' (hopefully) magic at 0x100
@@ -178,6 +168,30 @@ static int bcm47xxpart_parse(struct mtd_info *master,
                        continue;
                }
        }
+        /* Look for NVRAM at the end of the last block. */
+        for (i = 0; i < ARRAY_SIZE(possible_nvram_sizes); i++) {
+                if (curr_part > BCM47XXPART_MAX_PARTS) {
+                        pr_warn("Reached maximum number of partitions, scanning stopped!\n");
+                        break;
+                }
+                offset = master->size - possible_nvram_sizes[i];
+                if (mtd_read(master, offset, 0x4, &bytes_read,
+                             (uint8_t *)buf) < 0) {
+                        pr_err("mtd_read error while reading at offset 0x%X!\n",
+                               offset);
+                        continue;
+                }
+                /* Standard NVRAM */
+                if (buf[0] == NVRAM_HEADER) {
+                        bcm47xxpart_add_part(&parts[curr_part++], "nvram",
+                                             master->size - blocksize, 0);
+                        break;
+                }
+        }
        kfree(buf);
        /*
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 43214151b882..42c63927609d 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1523,6 +1523,14 @@ static int nand_do_read_ops(struct mtd_info *mtd, loff_t from,
                                        oobreadlen -= toread;
                                }
                        }
+                        if (chip->options & NAND_NEED_READRDY) {
+                                /* Apply delay or wait for ready/busy pin */
+                                if (!chip->dev_ready)
+                                        udelay(chip->chip_delay);
+                                else
+                                        nand_wait_ready(mtd);
+                        }
                } else {
                        memcpy(buf, chip->buffers->databuf + col, bytes);
                        buf += bytes;
@@ -1787,6 +1795,14 @@ static int nand_do_read_oob(struct mtd_info *mtd, loff_t from,
                len = min(len, readlen);
                buf = nand_transfer_oob(chip, buf, ops, len);
+                if (chip->options & NAND_NEED_READRDY) {
+                        /* Apply delay or wait for ready/busy pin */
+                        if (!chip->dev_ready)
+                                udelay(chip->chip_delay);
+                        else
+                                nand_wait_ready(mtd);
+                }
                readlen -= len;
                if (!readlen)
                        break;
diff --git a/drivers/mtd/nand/nand_ids.c b/drivers/mtd/nand/nand_ids.c
index e3aa2748a6e7..9c612388e5de 100644
--- a/drivers/mtd/nand/nand_ids.c
+++ b/drivers/mtd/nand/nand_ids.c
@@ -22,49 +22,51 @@
 *       512     512 Byte page size
 */
 struct nand_flash_dev nand_flash_ids[] = {
+#define SP_OPTIONS NAND_NEED_READRDY
+#define SP_OPTIONS16 (SP_OPTIONS | NAND_BUSWIDTH_16)
 #ifdef CONFIG_MTD_NAND_MUSEUM_IDS
-        {"NAND 1MiB 5V 8-bit",          0x6e, 256, 1, 0x1000, 0},
+        {"NAND 1MiB 5V 8-bit",          0x6e, 256, 1, 0x1000, SP_OPTIONS},
-        {"NAND 2MiB 5V 8-bit",          0x64, 256, 2, 0x1000, 0},
+        {"NAND 2MiB 5V 8-bit",          0x64, 256, 2, 0x1000, SP_OPTIONS},
-        {"NAND 4MiB 5V 8-bit",          0x6b, 512, 4, 0x2000, 0},
+        {"NAND 4MiB 5V 8-bit",          0x6b, 512, 4, 0x2000, SP_OPTIONS},
-        {"NAND 1MiB 3,3V 8-bit",        0xe8, 256, 1, 0x1000, 0},
+        {"NAND 1MiB 3,3V 8-bit",        0xe8, 256, 1, 0x1000, SP_OPTIONS},
-        {"NAND 1MiB 3,3V 8-bit",        0xec, 256, 1, 0x1000, 0},
+        {"NAND 1MiB 3,3V 8-bit",        0xec, 256, 1, 0x1000, SP_OPTIONS},
-        {"NAND 2MiB 3,3V 8-bit",        0xea, 256, 2, 0x1000, 0},
+        {"NAND 2MiB 3,3V 8-bit",        0xea, 256, 2, 0x1000, SP_OPTIONS},
-        {"NAND 4MiB 3,3V 8-bit",        0xd5, 512, 4, 0x2000, 0},
+        {"NAND 4MiB 3,3V 8-bit",        0xd5, 512, 4, 0x2000, SP_OPTIONS},
-        {"NAND 4MiB 3,3V 8-bit",        0xe3, 512, 4, 0x2000, 0},
+        {"NAND 4MiB 3,3V 8-bit",        0xe3, 512, 4, 0x2000, SP_OPTIONS},
-        {"NAND 4MiB 3,3V 8-bit",        0xe5, 512, 4, 0x2000, 0},
+        {"NAND 4MiB 3,3V 8-bit",        0xe5, 512, 4, 0x2000, SP_OPTIONS},
-        {"NAND 8MiB 3,3V 8-bit",        0xd6, 512, 8, 0x2000, 0},
+        {"NAND 8MiB 3,3V 8-bit",        0xd6, 512, 8, 0x2000, SP_OPTIONS},
-        {"NAND 8MiB 1,8V 8-bit",        0x39, 512, 8, 0x2000, 0},
+        {"NAND 8MiB 1,8V 8-bit",        0x39, 512, 8, 0x2000, SP_OPTIONS},
-        {"NAND 8MiB 3,3V 8-bit",        0xe6, 512, 8, 0x2000, 0},
+        {"NAND 8MiB 3,3V 8-bit",        0xe6, 512, 8, 0x2000, SP_OPTIONS},
-        {"NAND 8MiB 1,8V 16-bit",       0x49, 512, 8, 0x2000, NAND_BUSWIDTH_16},
+        {"NAND 8MiB 1,8V 16-bit",       0x49, 512, 8, 0x2000, SP_OPTIONS16},
-        {"NAND 8MiB 3,3V 16-bit",       0x59, 512, 8, 0x2000, NAND_BUSWIDTH_16},
+        {"NAND 8MiB 3,3V 16-bit",       0x59, 512, 8, 0x2000, SP_OPTIONS16},
 #endif
-        {"NAND 16MiB 1,8V 8-bit",       0x33, 512, 16, 0x4000, 0},
+        {"NAND 16MiB 1,8V 8-bit",       0x33, 512, 16, 0x4000, SP_OPTIONS},
-        {"NAND 16MiB 3,3V 8-bit",       0x73, 512, 16, 0x4000, 0},
+        {"NAND 16MiB 3,3V 8-bit",       0x73, 512, 16, 0x4000, SP_OPTIONS},
-        {"NAND 16MiB 1,8V 16-bit",      0x43, 512, 16, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 16MiB 1,8V 16-bit",      0x43, 512, 16, 0x4000, SP_OPTIONS16},
-        {"NAND 16MiB 3,3V 16-bit",      0x53, 512, 16, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 16MiB 3,3V 16-bit",      0x53, 512, 16, 0x4000, SP_OPTIONS16},
-        {"NAND 32MiB 1,8V 8-bit",       0x35, 512, 32, 0x4000, 0},
+        {"NAND 32MiB 1,8V 8-bit",       0x35, 512, 32, 0x4000, SP_OPTIONS},
-        {"NAND 32MiB 3,3V 8-bit",       0x75, 512, 32, 0x4000, 0},
+        {"NAND 32MiB 3,3V 8-bit",       0x75, 512, 32, 0x4000, SP_OPTIONS},
-        {"NAND 32MiB 1,8V 16-bit",      0x45, 512, 32, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 32MiB 1,8V 16-bit",      0x45, 512, 32, 0x4000, SP_OPTIONS16},
-        {"NAND 32MiB 3,3V 16-bit",      0x55, 512, 32, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 32MiB 3,3V 16-bit",      0x55, 512, 32, 0x4000, SP_OPTIONS16},
-        {"NAND 64MiB 1,8V 8-bit",       0x36, 512, 64, 0x4000, 0},
+        {"NAND 64MiB 1,8V 8-bit",       0x36, 512, 64, 0x4000, SP_OPTIONS},
-        {"NAND 64MiB 3,3V 8-bit",       0x76, 512, 64, 0x4000, 0},
+        {"NAND 64MiB 3,3V 8-bit",       0x76, 512, 64, 0x4000, SP_OPTIONS},
-        {"NAND 64MiB 1,8V 16-bit",      0x46, 512, 64, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 64MiB 1,8V 16-bit",      0x46, 512, 64, 0x4000, SP_OPTIONS16},
-        {"NAND 64MiB 3,3V 16-bit",      0x56, 512, 64, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 64MiB 3,3V 16-bit",      0x56, 512, 64, 0x4000, SP_OPTIONS16},
-        {"NAND 128MiB 1,8V 8-bit",      0x78, 512, 128, 0x4000, 0},
+        {"NAND 128MiB 1,8V 8-bit",      0x78, 512, 128, 0x4000, SP_OPTIONS},
-        {"NAND 128MiB 1,8V 8-bit",      0x39, 512, 128, 0x4000, 0},
+        {"NAND 128MiB 1,8V 8-bit",      0x39, 512, 128, 0x4000, SP_OPTIONS},
-        {"NAND 128MiB 3,3V 8-bit",      0x79, 512, 128, 0x4000, 0},
+        {"NAND 128MiB 3,3V 8-bit",      0x79, 512, 128, 0x4000, SP_OPTIONS},
-        {"NAND 128MiB 1,8V 16-bit",     0x72, 512, 128, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 128MiB 1,8V 16-bit",     0x72, 512, 128, 0x4000, SP_OPTIONS16},
-        {"NAND 128MiB 1,8V 16-bit",     0x49, 512, 128, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 128MiB 1,8V 16-bit",     0x49, 512, 128, 0x4000, SP_OPTIONS16},
-        {"NAND 128MiB 3,3V 16-bit",     0x74, 512, 128, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 128MiB 3,3V 16-bit",     0x74, 512, 128, 0x4000, SP_OPTIONS16},
-        {"NAND 128MiB 3,3V 16-bit",     0x59, 512, 128, 0x4000, NAND_BUSWIDTH_16},
+        {"NAND 128MiB 3,3V 16-bit",     0x59, 512, 128, 0x4000, SP_OPTIONS16},
-        {"NAND 256MiB 3,3V 8-bit",      0x71, 512, 256, 0x4000, 0},
+        {"NAND 256MiB 3,3V 8-bit",      0x71, 512, 256, 0x4000, SP_OPTIONS},
        /*
         * These are the new chips with large page size. The pagesize and the
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 8b4e96e01d6c..6bbd90e1123c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1746,6 +1746,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        bond_compute_features(bond);
+        bond_update_speed_duplex(new_slave);
        read_lock(&bond->lock);
        new_slave->last_arp_rx = jiffies -
@@ -1798,8 +1800,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                new_slave->link == BOND_LINK_DOWN ? "DOWN" :
                        (new_slave->link == BOND_LINK_UP ? "UP" : "BACK"));
-        bond_update_speed_duplex(new_slave);
        if (USES_PRIMARY(bond->params.mode) && bond->params.primary[0]) {
                /* if there is a primary slave, remember it */
                if (strcmp(bond->params.primary, new_slave->dev->name) == 0) {
@@ -2374,8 +2374,6 @@ static void bond_miimon_commit(struct bonding *bond)
                                bond_set_backup_slave(slave);
                        }
-                        bond_update_speed_duplex(slave);
                        pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n",
                                bond->dev->name, slave->dev->name,
                                slave->speed, slave->duplex ? "full" : "half");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index a923bc4d5a1f..4046f97378c2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2760,6 +2760,7 @@ load_error2:
        bp->port.pmf = 0;
 load_error1:
        bnx2x_napi_disable(bp);
+        bnx2x_del_all_napi(bp);
        /* clear pf_load status, as it was already set */
        if (IS_PF(bp))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
index 364e37ecbc5c..198f6f1c9ad5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
@@ -459,8 +459,9 @@ struct bnx2x_fw_port_stats_old {
 #define UPDATE_QSTAT(s, t) \
        do { \
-                qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi); \
                qstats->t##_lo = qstats_old->t##_lo + le32_to_cpu(s.lo); \
+                qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi) \
+                        + ((qstats->t##_lo < qstats_old->t##_lo) ? 1 : 0); \
        } while (0)
 #define UPDATE_QSTAT_OLD(f) \
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 93729f942358..67d2663b3974 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -4130,6 +4130,14 @@ static void tg3_phy_copper_begin(struct tg3 *tp)
                tp->link_config.active_speed = tp->link_config.speed;
                tp->link_config.active_duplex = tp->link_config.duplex;
+                if (tg3_asic_rev(tp) == ASIC_REV_5714) {
+                        /* With autoneg disabled, 5715 only links up when the
+                         * advertisement register has the configured speed
+                         * enabled.
+                         */
+                        tg3_writephy(tp, MII_ADVERTISE, ADVERTISE_ALL);
+                }
                bmcr = 0;
                switch (tp->link_config.speed) {
                default:
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 4ce62031f62f..8049268ce0f2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -497,8 +497,9 @@ int t4_memory_write(struct adapter *adap, int mtype, u32 addr, u32 len,
 }
 #define EEPROM_STAT_ADDR   0x7bfc
-#define VPD_BASE           0
 #define VPD_LEN            512
+#define VPD_BASE           0x400
+#define VPD_BASE_OLD       0
 /**
 *      t4_seeprom_wp - enable/disable EEPROM write protection
@@ -524,7 +525,7 @@ int t4_seeprom_wp(struct adapter *adapter, bool enable)
 int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
 {
        u32 cclk_param, cclk_val;
-        int i, ret;
+        int i, ret, addr;
        int ec, sn;
        u8 *vpd, csum;
        unsigned int vpdr_len, kw_offset, id_len;
@@ -533,7 +534,12 @@ int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
        if (!vpd)
                return -ENOMEM;
-        ret = pci_read_vpd(adapter->pdev, VPD_BASE, VPD_LEN, vpd);
+        ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(u32), vpd);
+        if (ret < 0)
+                goto out;
+        addr = *vpd == 0x82 ? VPD_BASE : VPD_BASE_OLD;
+        ret = pci_read_vpd(adapter->pdev, addr, VPD_LEN, vpd);
        if (ret < 0)
                goto out;
diff --git a/drivers/net/ethernet/dec/tulip/Kconfig b/drivers/net/ethernet/dec/tulip/Kconfig
index 0c37fb2cc867..1df33c799c00 100644
--- a/drivers/net/ethernet/dec/tulip/Kconfig
+++ b/drivers/net/ethernet/dec/tulip/Kconfig
@@ -108,6 +108,7 @@ config TULIP_DM910X
 config DE4X5
        tristate "Generic DECchip & DIGITAL EtherWORKS PCI/EISA"
        depends on (PCI || EISA)
+        depends on VIRT_TO_BUS || ALPHA || PPC || SPARC
        select CRC32
        ---help---
          This is support for the DIGITAL series of PCI/EISA Ethernet cards.
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index 069a155d16ed..e3f39372ce25 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -934,24 +934,28 @@ static void fec_enet_adjust_link(struct net_device *ndev)
                goto spin_unlock;
        }
-        /* Duplex link change */
        if (phy_dev->link) {
-                if (fep->full_duplex != phy_dev->duplex) {
+                if (!fep->link) {
-                        fec_restart(ndev, phy_dev->duplex);
-                        /* prevent unnecessary second fec_restart() below */
                        fep->link = phy_dev->link;
                        status_change = 1;
                }
-        }
-        /* Link on or off change */
+                if (fep->full_duplex != phy_dev->duplex)
-        if (phy_dev->link != fep->link) {
+                        status_change = 1;
-                fep->link = phy_dev->link;
-                if (phy_dev->link)
+                if (phy_dev->speed != fep->speed) {
+                        fep->speed = phy_dev->speed;
+                        status_change = 1;
+                }
+                /* if any of the above changed restart the FEC */
+                if (status_change)
                        fec_restart(ndev, phy_dev->duplex);
-                else
+        } else {
+                if (fep->link) {
                        fec_stop(ndev);
-                status_change = 1;
+                        status_change = 1;
+                }
        }
 spin_unlock:
@@ -1437,6 +1441,7 @@ fec_enet_close(struct net_device *ndev)
        struct fec_enet_private *fep = netdev_priv(ndev);
        /* Don't know what to do yet. */
+        napi_disable(&fep->napi);
        fep->opened = 0;
        netif_stop_queue(ndev);
        fec_stop(ndev);
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index f5390071efd0..eb4372962839 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -240,6 +240,7 @@ struct fec_enet_private {
        phy_interface_t phy_interface;
        int     link;
        int     full_duplex;
+        int     speed;
        struct  completion mdio_done;
        int     irq[FEC_IRQ_NUM];
        int     bufdesc_ex;
diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
index 0ad790cc473c..eaa8e874a3cb 100644
--- a/drivers/net/ethernet/sfc/nic.c
+++ b/drivers/net/ethernet/sfc/nic.c
@@ -376,7 +376,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count)
                return false;
        tx_queue->empty_read_count = 0;
-        return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0;
+        return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0
+                && tx_queue->write_count - write_count == 1;
 }
 /* For each entry inserted into the software descriptor ring, create a
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 01ffbc486982..75c48558e6fd 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -905,7 +905,7 @@ static netdev_tx_t cpsw_ndo_start_xmit(struct sk_buff *skb,
        /* If there is no more tx desc left free then we need to
         * tell the kernel to stop sending us tx frames.
         */
-        if (unlikely(cpdma_check_free_tx_desc(priv->txch)))
+        if (unlikely(!cpdma_check_free_tx_desc(priv->txch)))
                netif_stop_queue(ndev);
        return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 52c05366599a..ae1b77aa199f 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1102,7 +1102,7 @@ static int emac_dev_xmit(struct sk_buff *skb, struct net_device *ndev)
        /* If there is no more tx desc left free then we need to
         * tell the kernel to stop sending us tx frames.
         */
-        if (unlikely(cpdma_check_free_tx_desc(priv->txchan)))
+        if (unlikely(!cpdma_check_free_tx_desc(priv->txchan)))
                netif_stop_queue(ndev);
        return NETDEV_TX_OK;
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 37add21a3d7d..59ac143dec25 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -666,6 +666,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
                goto done;
        spin_lock_irqsave(&target_list_lock, flags);
+restart:
        list_for_each_entry(nt, &target_list, list) {
                netconsole_target_get(nt);
                if (nt->np.dev == dev) {
@@ -678,15 +679,17 @@ static int netconsole_netdev_event(struct notifier_block *this,
                        case NETDEV_UNREGISTER:
                                /*
                                 * rtnl_lock already held
+                                 * we might sleep in __netpoll_cleanup()
                                 */
-                                if (nt->np.dev) {
+                                spin_unlock_irqrestore(&target_list_lock, flags);
-                                        __netpoll_cleanup(&nt->np);
+                                __netpoll_cleanup(&nt->np);
-                                        dev_put(nt->np.dev);
+                                spin_lock_irqsave(&target_list_lock, flags);
-                                        nt->np.dev = NULL;
+                                dev_put(nt->np.dev);
-                                }
+                                nt->np.dev = NULL;
                                nt->enabled = 0;
                                stopped = true;
-                                break;
+                                netconsole_target_put(nt);
+                                goto restart;
                        }
                }
                netconsole_target_put(nt);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 3b6e9b83342d..7c769d8e25ad 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -268,7 +268,7 @@ config USB_NET_SMSC75XX
        select CRC16
        select CRC32
        help
-          This option adds support for SMSC LAN95XX based USB 2.0
+          This option adds support for SMSC LAN75XX based USB 2.0
          Gigabit Ethernet adapters.
 config USB_NET_SMSC95XX
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 248d2dc765a5..16c842997291 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -68,18 +68,9 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
        struct cdc_ncm_ctx *ctx;
        struct usb_driver *subdriver = ERR_PTR(-ENODEV);
        int ret = -ENODEV;
-        u8 data_altsetting = CDC_NCM_DATA_ALTSETTING_NCM;
+        u8 data_altsetting = cdc_ncm_select_altsetting(dev, intf);
        struct cdc_mbim_state *info = (void *)&dev->data;
-        /* see if interface supports MBIM alternate setting */
-        if (intf->num_altsetting == 2) {
-                if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
-                        usb_set_interface(dev->udev,
-                                          intf->cur_altsetting->desc.bInterfaceNumber,
-                                          CDC_NCM_COMM_ALTSETTING_MBIM);
-                data_altsetting = CDC_NCM_DATA_ALTSETTING_MBIM;
-        }
        /* Probably NCM, defer for cdc_ncm_bind */
        if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
                goto err;
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 61b74a2b89ac..4709fa3497cf 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -55,6 +55,14 @@
 #define DRIVER_VERSION                          "14-Mar-2012"
+#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
+static bool prefer_mbim = true;
+#else
+static bool prefer_mbim;
+#endif
+module_param(prefer_mbim, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(prefer_mbim, "Prefer MBIM setting on dual NCM/MBIM functions");
 static void cdc_ncm_txpath_bh(unsigned long param);
 static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx);
 static enum hrtimer_restart cdc_ncm_tx_timer_cb(struct hrtimer *hr_timer);
@@ -550,9 +558,12 @@ void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf)
 }
 EXPORT_SYMBOL_GPL(cdc_ncm_unbind);
-static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+/* Select the MBIM altsetting iff it is preferred and available,
+ * returning the number of the corresponding data interface altsetting
+ */
+u8 cdc_ncm_select_altsetting(struct usbnet *dev, struct usb_interface *intf)
 {
-        int ret;
+        struct usb_host_interface *alt;
        /* The MBIM spec defines a NCM compatible default altsetting,
         * which we may have matched:
@@ -568,23 +579,27 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
         *   endpoint descriptors, shall be constructed according to
         *   the rules given in section 6 (USB Device Model) of this
         *   specification."
-         *
-         * Do not bind to such interfaces, allowing cdc_mbim to handle
-         * them
         */
-#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
+        if (prefer_mbim && intf->num_altsetting == 2) {
-        if ((intf->num_altsetting == 2) &&
+                alt = usb_altnum_to_altsetting(intf, CDC_NCM_COMM_ALTSETTING_MBIM);
-            !usb_set_interface(dev->udev,
+                if (alt && cdc_ncm_comm_intf_is_mbim(alt) &&
-                               intf->cur_altsetting->desc.bInterfaceNumber,
+                    !usb_set_interface(dev->udev,
-                               CDC_NCM_COMM_ALTSETTING_MBIM)) {
+                                       intf->cur_altsetting->desc.bInterfaceNumber,
-                if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
+                                       CDC_NCM_COMM_ALTSETTING_MBIM))
-                        return -ENODEV;
+                        return CDC_NCM_DATA_ALTSETTING_MBIM;
-                else
-                        usb_set_interface(dev->udev,
-                                          intf->cur_altsetting->desc.bInterfaceNumber,
-                                          CDC_NCM_COMM_ALTSETTING_NCM);
        }
-#endif
+        return CDC_NCM_DATA_ALTSETTING_NCM;
+}
+EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting);
+static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int ret;
+        /* MBIM backwards compatible function? */
+        cdc_ncm_select_altsetting(dev, intf);
+        if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
+                return -ENODEV;
        /* NCM data altsetting is always 1 */
        ret = cdc_ncm_bind_common(dev, intf, 1);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index efb5c7c33a28..968d5d50751d 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -139,16 +139,9 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
        BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data) < sizeof(struct qmi_wwan_state)));
-        /* control and data is shared? */
+        /* set up initial state */
-        if (intf->cur_altsetting->desc.bNumEndpoints == 3) {
+        info->control = intf;
-                info->control = intf;
+        info->data = intf;
-                info->data = intf;
-                goto shared;
-        }
-        /* else require a single interrupt status endpoint on control intf */
-        if (intf->cur_altsetting->desc.bNumEndpoints != 1)
-                goto err;
        /* and a number of CDC descriptors */
        while (len > 3) {
@@ -207,25 +200,14 @@ next_desc:
                buf += h->bLength;
        }
-        /* did we find all the required ones? */
+        /* Use separate control and data interfaces if we found a CDC Union */
-        if (!(found & (1 << USB_CDC_HEADER_TYPE)) ||
+        if (cdc_union) {
-            !(found & (1 << USB_CDC_UNION_TYPE))) {
+                info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
-                dev_err(&intf->dev, "CDC functional descriptors missing\n");
+                if (desc->bInterfaceNumber != cdc_union->bMasterInterface0 || !info->data) {
-                goto err;
+                        dev_err(&intf->dev, "bogus CDC Union: master=%u, slave=%u\n",
-        }
+                                cdc_union->bMasterInterface0, cdc_union->bSlaveInterface0);
+                        goto err;
-        /* verify CDC Union */
+                }
-        if (desc->bInterfaceNumber != cdc_union->bMasterInterface0) {
-                dev_err(&intf->dev, "bogus CDC Union: master=%u\n", cdc_union->bMasterInterface0);
-                goto err;
-        }
-        /* need to save these for unbind */
-        info->control = intf;
-        info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
-        if (!info->data) {
-                dev_err(&intf->dev, "bogus CDC Union: slave=%u\n", cdc_union->bSlaveInterface0);
-                goto err;
        }
        /* errors aren't fatal - we can live with the dynamic address */
@@ -235,11 +217,12 @@ next_desc:
        }
        /* claim data interface and set it up */
-        status = usb_driver_claim_interface(driver, info->data, dev);
+        if (info->control != info->data) {
-        if (status < 0)
+                status = usb_driver_claim_interface(driver, info->data, dev);
-                goto err;
+                if (status < 0)
+                        goto err;
+        }
-shared:
        status = qmi_wwan_register_subdriver(dev);
        if (status < 0 && info->control != info->data) {
                usb_set_intfdata(info->data, NULL);
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 246aa62a4817..2fe0ceba4400 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1117,10 +1117,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
                adhoc_join->bss_descriptor.bssid,
                adhoc_join->bss_descriptor.ssid);
-        for (i = 0; bss_desc->supported_rates[i] &&
+        for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
-                        i < MWIFIEX_SUPPORTED_RATES;
+                    bss_desc->supported_rates[i]; i++)
-                        i++)
+                ;
-                        ;
        rates_size = i;
        /* Copy Data Rates from the Rates recorded in scan response */
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 44d6ead43341..2bf4efa33186 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -55,10 +55,10 @@ config RT61PCI
 config RT2800PCI
        tristate "Ralink rt27xx/rt28xx/rt30xx (PCI/PCIe/PCMCIA) support"
-        depends on PCI || RALINK_RT288X || RALINK_RT305X
+        depends on PCI || SOC_RT288X || SOC_RT305X
        select RT2800_LIB
        select RT2X00_LIB_PCI if PCI
-        select RT2X00_LIB_SOC if RALINK_RT288X || RALINK_RT305X
+        select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
        select RT2X00_LIB_FIRMWARE
        select RT2X00_LIB_CRYPTO
        select CRC_CCITT
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 48a01aa21f1c..ded73da4de0b 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -89,7 +89,7 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
 }
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
        void __iomem *base_addr = ioremap(0x1F040000, EEPROM_SIZE);
@@ -107,7 +107,7 @@ static inline int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
        return -ENOMEM;
 }
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 #ifdef CONFIG_PCI
 static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
@@ -1177,7 +1177,7 @@ MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
 #endif /* CONFIG_PCI */
 MODULE_LICENSE("GPL");
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800soc_probe(struct platform_device *pdev)
 {
        return rt2x00soc_probe(pdev, &rt2800pci_ops);
@@ -1194,7 +1194,7 @@ static struct platform_driver rt2800soc_driver = {
        .suspend        = rt2x00soc_suspend,
        .resume         = rt2x00soc_resume,
 };
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 #ifdef CONFIG_PCI
 static int rt2800pci_probe(struct pci_dev *pci_dev,
@@ -1217,7 +1217,7 @@ static int __init rt2800pci_init(void)
 {
        int ret = 0;
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
        ret = platform_driver_register(&rt2800soc_driver);
        if (ret)
                return ret;
@@ -1225,7 +1225,7 @@ static int __init rt2800pci_init(void)
 #ifdef CONFIG_PCI
        ret = pci_register_driver(&rt2800pci_driver);
        if (ret) {
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
                platform_driver_unregister(&rt2800soc_driver);
 #endif
                return ret;
@@ -1240,7 +1240,7 @@ static void __exit rt2800pci_exit(void)
 #ifdef CONFIG_PCI
        pci_unregister_driver(&rt2800pci_driver);
 #endif
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
        platform_driver_unregister(&rt2800soc_driver);
 #endif
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index b1ccff474c79..c08d0f4c5f3d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1377,74 +1377,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw)
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
 {
-        /* dummy routine needed for callback from rtl_op_configure_filter() */
-}
-/*========================================================================== */
-static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw,
-                              enum nl80211_iftype type)
-{
        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
        struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
+        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
-        u8 filterout_non_associated_bssid = false;
-        switch (type) {
+        if (rtlpriv->psc.rfpwr_state != ERFON)
-        case NL80211_IFTYPE_ADHOC:
+                return;
-        case NL80211_IFTYPE_STATION:
-                filterout_non_associated_bssid = true;
+        if (check_bssid) {
-                break;
+                u8 tmp;
-        case NL80211_IFTYPE_UNSPECIFIED:
-        case NL80211_IFTYPE_AP:
-        default:
-                break;
-        }
-        if (filterout_non_associated_bssid) {
                if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        switch (rtlphy->current_io_type) {
+                        reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                        case IO_CMD_RESUME_DM_BY_SCAN:
+                        tmp = BIT(4);
-                                reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* enable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
-                                break;
-                        case IO_CMD_PAUSE_DM_BY_SCAN:
-                                reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* disable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
-                                break;
-                        }
                } else {
-                        reg_rcr |= (RCR_CBSSID);
+                        reg_rcr |= RCR_CBSSID;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                        tmp = BIT(4) | BIT(5);
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5)));
                }
-        } else if (filterout_non_associated_bssid == false) {
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                                              (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp);
+        } else {
+                u8 tmp;
                if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+                        reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                        tmp = BIT(4);
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
                } else {
-                        reg_rcr &= (~RCR_CBSSID);
+                        reg_rcr &= ~RCR_CBSSID;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                        tmp = BIT(4) | BIT(5);
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0);
                }
+                reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                              HW_VAR_RCR, (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0);
        }
 }
+/*========================================================================== */
 int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
 {
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
        if (_rtl92cu_set_media_status(hw, type))
                return -EOPNOTSUPP;
-        _rtl92cu_set_check_bssid(hw, type);
+        if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
+                if (type != NL80211_IFTYPE_AP)
+                        rtl92cu_set_check_bssid(hw, true);
+        } else {
+                rtl92cu_set_check_bssid(hw, false);
+        }
        return 0;
 }
@@ -2058,8 +2041,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
                               (shortgi_rate << 4) | (shortgi_rate);
        }
        rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
-        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
-                 rtl_read_dword(rtlpriv, REG_ARFR0));
 }
 void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index ab886b7ee327..b41ac7756a4b 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -100,6 +100,27 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
        return min((size_t)(image - rom), size);
 }
+static loff_t pci_find_rom(struct pci_dev *pdev, size_t *size)
+{
+        struct resource *res = &pdev->resource[PCI_ROM_RESOURCE];
+        loff_t start;
+        /* assign the ROM an address if it doesn't have one */
+        if (res->parent == NULL && pci_assign_resource(pdev, PCI_ROM_RESOURCE))
+                return 0;
+        start = pci_resource_start(pdev, PCI_ROM_RESOURCE);
+        *size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
+        if (*size == 0)
+                return 0;
+        /* Enable ROM space decodes */
+        if (pci_enable_rom(pdev))
+                return 0;
+        return start;
+}
 /**
 * pci_map_rom - map a PCI ROM to kernel space
 * @pdev: pointer to pci device struct
@@ -114,21 +135,15 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
 void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
 {
        struct resource *res = &pdev->resource[PCI_ROM_RESOURCE];
-        loff_t start;
+        loff_t start = 0;
        void __iomem *rom;
        /*
-         * Some devices may provide ROMs via a source other than the BAR
-         */
-        if (pdev->rom && pdev->romlen) {
-                *size = pdev->romlen;
-                return phys_to_virt(pdev->rom);
-        /*
         * IORESOURCE_ROM_SHADOW set on x86, x86_64 and IA64 supports legacy
         * memory map if the VGA enable bit of the Bridge Control register is
         * set for embedded VGA.
         */
-        } else if (res->flags & IORESOURCE_ROM_SHADOW) {
+        if (res->flags & IORESOURCE_ROM_SHADOW) {
                /* primary video rom always starts here */
                start = (loff_t)0xC0000;
                *size = 0x20000; /* cover C000:0 through E000:0 */
@@ -139,21 +154,21 @@ void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
                        return (void __iomem *)(unsigned long)
                                pci_resource_start(pdev, PCI_ROM_RESOURCE);
                } else {
-                        /* assign the ROM an address if it doesn't have one */
+                        start = pci_find_rom(pdev, size);
-                        if (res->parent == NULL &&
-                            pci_assign_resource(pdev,PCI_ROM_RESOURCE))
-                                return NULL;
-                        start = pci_resource_start(pdev, PCI_ROM_RESOURCE);
-                        *size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
-                        if (*size == 0)
-                                return NULL;
-                        /* Enable ROM space decodes */
-                        if (pci_enable_rom(pdev))
-                                return NULL;
                }
        }
+        /*
+         * Some devices may provide ROMs via a source other than the BAR
+         */
+        if (!start && pdev->rom && pdev->romlen) {
+                *size = pdev->romlen;
+                return phys_to_virt(pdev->rom);
+        }
+        if (!start)
+                return NULL;
        rom = ioremap(start, *size);
        if (!rom) {
                /* restore enable if ioremap fails */
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index 75933a6aa828..efb7f10e902a 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1277,21 +1277,80 @@ static int alt_gpio_irq_type(struct irq_data *d, unsigned type)
 }
 #ifdef CONFIG_PM
+static u32 wakeups[MAX_GPIO_BANKS];
+static u32 backups[MAX_GPIO_BANKS];
 static int gpio_irq_set_wake(struct irq_data *d, unsigned state)
 {
        struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
        unsigned        bank = at91_gpio->pioc_idx;
+        unsigned mask = 1 << d->hwirq;
        if (unlikely(bank >= MAX_GPIO_BANKS))
                return -EINVAL;
+        if (state)
+                wakeups[bank] |= mask;
+        else
+                wakeups[bank] &= ~mask;
        irq_set_irq_wake(at91_gpio->pioc_virq, state);
        return 0;
 }
+void at91_pinctrl_gpio_suspend(void)
+{
+        int i;
+        for (i = 0; i < gpio_banks; i++) {
+                void __iomem  *pio;
+                if (!gpio_chips[i])
+                        continue;
+                pio = gpio_chips[i]->regbase;
+                backups[i] = __raw_readl(pio + PIO_IMR);
+                __raw_writel(backups[i], pio + PIO_IDR);
+                __raw_writel(wakeups[i], pio + PIO_IER);
+                if (!wakeups[i]) {
+                        clk_unprepare(gpio_chips[i]->clock);
+                        clk_disable(gpio_chips[i]->clock);
+                } else {
+                        printk(KERN_DEBUG "GPIO-%c may wake for %08x\n",
+                               'A'+i, wakeups[i]);
+                }
+        }
+}
+void at91_pinctrl_gpio_resume(void)
+{
+        int i;
+        for (i = 0; i < gpio_banks; i++) {
+                void __iomem  *pio;
+                if (!gpio_chips[i])
+                        continue;
+                pio = gpio_chips[i]->regbase;
+                if (!wakeups[i]) {
+                        if (clk_prepare(gpio_chips[i]->clock) == 0)
+                                clk_enable(gpio_chips[i]->clock);
+                }
+                __raw_writel(wakeups[i], pio + PIO_IDR);
+                __raw_writel(backups[i], pio + PIO_IER);
+        }
+}
 #else
 #define gpio_irq_set_wake       NULL
-#endif
+#endif /* CONFIG_PM */
 static struct irq_chip gpio_irqchip = {
        .name           = "GPIO",
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index 434ebc3a99dc..0a9f27e094ea 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -44,6 +44,7 @@ static DECLARE_COMPLETION(at91_rtc_updated);
 static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
 static void __iomem *at91_rtc_regs;
 static int irq;
+static u32 at91_rtc_imr;
 /*
 * Decode time/date into rtc_time structure
@@ -108,9 +109,11 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
        cr = at91_rtc_read(AT91_RTC_CR);
        at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
+        at91_rtc_imr |= AT91_RTC_ACKUPD;
        at91_rtc_write(AT91_RTC_IER, AT91_RTC_ACKUPD);
        wait_for_completion(&at91_rtc_updated); /* wait for ACKUPD interrupt */
        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD);
+        at91_rtc_imr &= ~AT91_RTC_ACKUPD;
        at91_rtc_write(AT91_RTC_TIMR,
                          bin2bcd(tm->tm_sec) << 0
@@ -142,7 +145,7 @@ static int at91_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
        tm->tm_yday = rtc_year_days(tm->tm_mday, tm->tm_mon, tm->tm_year);
        tm->tm_year = at91_alarm_year - 1900;
-        alrm->enabled = (at91_rtc_read(AT91_RTC_IMR) & AT91_RTC_ALARM)
+        alrm->enabled = (at91_rtc_imr & AT91_RTC_ALARM)
                        ? 1 : 0;
        dev_dbg(dev, "%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
@@ -168,6 +171,7 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        tm.tm_sec = alrm->time.tm_sec;
        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
+        at91_rtc_imr &= ~AT91_RTC_ALARM;
        at91_rtc_write(AT91_RTC_TIMALR,
                  bin2bcd(tm.tm_sec) << 0
                | bin2bcd(tm.tm_min) << 8
@@ -180,6 +184,7 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        if (alrm->enabled) {
                at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
+                at91_rtc_imr |= AT91_RTC_ALARM;
                at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
        }
@@ -196,9 +201,12 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
        if (enabled) {
                at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
+                at91_rtc_imr |= AT91_RTC_ALARM;
                at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
-        } else
+        } else {
                at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
+                at91_rtc_imr &= ~AT91_RTC_ALARM;
+        }
        return 0;
 }
@@ -207,12 +215,10 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 */
 static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
 {
-        unsigned long imr = at91_rtc_read(AT91_RTC_IMR);
        seq_printf(seq, "update_IRQ\t: %s\n",
-                        (imr & AT91_RTC_ACKUPD) ? "yes" : "no");
+                        (at91_rtc_imr & AT91_RTC_ACKUPD) ? "yes" : "no");
        seq_printf(seq, "periodic_IRQ\t: %s\n",
-                        (imr & AT91_RTC_SECEV) ? "yes" : "no");
+                        (at91_rtc_imr & AT91_RTC_SECEV) ? "yes" : "no");
        return 0;
 }
@@ -227,7 +233,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
        unsigned int rtsr;
        unsigned long events = 0;
-        rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read(AT91_RTC_IMR);
+        rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_imr;
        if (rtsr) {             /* this interrupt is shared!  Is it ours? */
                if (rtsr & AT91_RTC_ALARM)
                        events |= (RTC_AF | RTC_IRQF);
@@ -291,6 +297,7 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
                                        AT91_RTC_SECEV | AT91_RTC_TIMEV |
                                        AT91_RTC_CALEV);
+        at91_rtc_imr = 0;
        ret = request_irq(irq, at91_rtc_interrupt,
                                IRQF_SHARED,
@@ -329,6 +336,7 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
                                        AT91_RTC_SECEV | AT91_RTC_TIMEV |
                                        AT91_RTC_CALEV);
+        at91_rtc_imr = 0;
        free_irq(irq, pdev);
        rtc_device_unregister(rtc);
@@ -341,31 +349,35 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
 /* AT91RM9200 RTC Power management control */
-static u32 at91_rtc_imr;
+static u32 at91_rtc_bkpimr;
 static int at91_rtc_suspend(struct device *dev)
 {
        /* this IRQ is shared with DBGU and other hardware which isn't
         * necessarily doing PM like we are...
         */
-        at91_rtc_imr = at91_rtc_read(AT91_RTC_IMR)
+        at91_rtc_bkpimr = at91_rtc_imr & (AT91_RTC_ALARM|AT91_RTC_SECEV);
-                        & (AT91_RTC_ALARM|AT91_RTC_SECEV);
+        if (at91_rtc_bkpimr) {
-        if (at91_rtc_imr) {
+                if (device_may_wakeup(dev)) {
-                if (device_may_wakeup(dev))
                        enable_irq_wake(irq);
-                else
+                } else {
-                        at91_rtc_write(AT91_RTC_IDR, at91_rtc_imr);
+                        at91_rtc_write(AT91_RTC_IDR, at91_rtc_bkpimr);
-        }
+                        at91_rtc_imr &= ~at91_rtc_bkpimr;
+                }
+}
        return 0;
 }
 static int at91_rtc_resume(struct device *dev)
 {
-        if (at91_rtc_imr) {
+        if (at91_rtc_bkpimr) {
-                if (device_may_wakeup(dev))
+                if (device_may_wakeup(dev)) {
                        disable_irq_wake(irq);
-                else
+                } else {
-                        at91_rtc_write(AT91_RTC_IER, at91_rtc_imr);
+                        at91_rtc_imr |= at91_rtc_bkpimr;
+                        at91_rtc_write(AT91_RTC_IER, at91_rtc_bkpimr);
+                }
        }
        return 0;
 }
diff --git a/drivers/rtc/rtc-at91rm9200.h b/drivers/rtc/rtc-at91rm9200.h
index da1945e5f714..5f940b6844cb 100644
--- a/drivers/rtc/rtc-at91rm9200.h
+++ b/drivers/rtc/rtc-at91rm9200.h
@@ -64,7 +64,6 @@
 #define AT91_RTC_SCCR           0x1c                    /* Status Clear Command Register */
 #define AT91_RTC_IER            0x20                    /* Interrupt Enable Register */
 #define AT91_RTC_IDR            0x24                    /* Interrupt Disable Register */
-#define AT91_RTC_IMR            0x28                    /* Interrupt Mask Register */
 #define AT91_RTC_VER            0x2c                    /* Valid Entry Register */
 #define         AT91_RTC_NVTIM          (1 <<  0)               /* Non valid Time */
diff --git a/drivers/rtc/rtc-da9052.c b/drivers/rtc/rtc-da9052.c
index 0dde688ca09b..969abbad7fe3 100644
--- a/drivers/rtc/rtc-da9052.c
+++ b/drivers/rtc/rtc-da9052.c
@@ -239,11 +239,9 @@ static int da9052_rtc_probe(struct platform_device *pdev)
        rtc->da9052 = dev_get_drvdata(pdev->dev.parent);
        platform_set_drvdata(pdev, rtc);
-        rtc->irq = platform_get_irq_byname(pdev, "ALM");
+        rtc->irq =  DA9052_IRQ_ALARM;
-        ret = devm_request_threaded_irq(&pdev->dev, rtc->irq, NULL,
+        ret = da9052_request_irq(rtc->da9052, rtc->irq, "ALM",
-                                da9052_rtc_irq,
+                                da9052_rtc_irq, rtc);
-                                IRQF_TRIGGER_LOW | IRQF_ONESHOT,
-                                "ALM", rtc);
        if (ret != 0) {
                rtc_err(rtc->da9052, "irq registration failed: %d\n", ret);
                return ret;
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 9978ad4433cb..5ac9c935c151 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -135,6 +135,11 @@ static const struct block_device_operations scm_blk_devops = {
        .release = scm_release,
 };
+static bool scm_permit_request(struct scm_blk_dev *bdev, struct request *req)
+{
+        return rq_data_dir(req) != WRITE || bdev->state != SCM_WR_PROHIBIT;
+}
 static void scm_request_prepare(struct scm_request *scmrq)
 {
        struct scm_blk_dev *bdev = scmrq->bdev;
@@ -195,14 +200,18 @@ void scm_request_requeue(struct scm_request *scmrq)
        scm_release_cluster(scmrq);
        blk_requeue_request(bdev->rq, scmrq->request);
+        atomic_dec(&bdev->queued_reqs);
        scm_request_done(scmrq);
        scm_ensure_queue_restart(bdev);
 }
 void scm_request_finish(struct scm_request *scmrq)
 {
+        struct scm_blk_dev *bdev = scmrq->bdev;
        scm_release_cluster(scmrq);
        blk_end_request_all(scmrq->request, scmrq->error);
+        atomic_dec(&bdev->queued_reqs);
        scm_request_done(scmrq);
 }
@@ -218,6 +227,10 @@ static void scm_blk_request(struct request_queue *rq)
                if (req->cmd_type != REQ_TYPE_FS)
                        continue;
+                if (!scm_permit_request(bdev, req)) {
+                        scm_ensure_queue_restart(bdev);
+                        return;
+                }
                scmrq = scm_request_fetch();
                if (!scmrq) {
                        SCM_LOG(5, "no request");
@@ -231,11 +244,13 @@ static void scm_blk_request(struct request_queue *rq)
                        return;
                }
                if (scm_need_cluster_request(scmrq)) {
+                        atomic_inc(&bdev->queued_reqs);
                        blk_start_request(req);
                        scm_initiate_cluster_request(scmrq);
                        return;
                }
                scm_request_prepare(scmrq);
+                atomic_inc(&bdev->queued_reqs);
                blk_start_request(req);
                ret = scm_start_aob(scmrq->aob);
@@ -244,7 +259,6 @@ static void scm_blk_request(struct request_queue *rq)
                        scm_request_requeue(scmrq);
                        return;
                }
-                atomic_inc(&bdev->queued_reqs);
        }
 }
@@ -280,6 +294,38 @@ void scm_blk_irq(struct scm_device *scmdev, void *data, int error)
        tasklet_hi_schedule(&bdev->tasklet);
 }
+static void scm_blk_handle_error(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        unsigned long flags;
+        if (scmrq->error != -EIO)
+                goto restart;
+        /* For -EIO the response block is valid. */
+        switch (scmrq->aob->response.eqc) {
+        case EQC_WR_PROHIBIT:
+                spin_lock_irqsave(&bdev->lock, flags);
+                if (bdev->state != SCM_WR_PROHIBIT)
+                        pr_info("%lu: Write access to the SCM increment is suspended\n",
+                                (unsigned long) bdev->scmdev->address);
+                bdev->state = SCM_WR_PROHIBIT;
+                spin_unlock_irqrestore(&bdev->lock, flags);
+                goto requeue;
+        default:
+                break;
+        }
+restart:
+        if (!scm_start_aob(scmrq->aob))
+                return;
+requeue:
+        spin_lock_irqsave(&bdev->rq_lock, flags);
+        scm_request_requeue(scmrq);
+        spin_unlock_irqrestore(&bdev->rq_lock, flags);
+}
 static void scm_blk_tasklet(struct scm_blk_dev *bdev)
 {
        struct scm_request *scmrq;
@@ -293,11 +339,8 @@ static void scm_blk_tasklet(struct scm_blk_dev *bdev)
                spin_unlock_irqrestore(&bdev->lock, flags);
                if (scmrq->error && scmrq->retries-- > 0) {
-                        if (scm_start_aob(scmrq->aob)) {
+                        scm_blk_handle_error(scmrq);
-                                spin_lock_irqsave(&bdev->rq_lock, flags);
-                                scm_request_requeue(scmrq);
-                                spin_unlock_irqrestore(&bdev->rq_lock, flags);
-                        }
                        /* Request restarted or requeued, handle next. */
                        spin_lock_irqsave(&bdev->lock, flags);
                        continue;
@@ -310,7 +353,6 @@ static void scm_blk_tasklet(struct scm_blk_dev *bdev)
                }
                scm_request_finish(scmrq);
-                atomic_dec(&bdev->queued_reqs);
                spin_lock_irqsave(&bdev->lock, flags);
        }
        spin_unlock_irqrestore(&bdev->lock, flags);
@@ -332,6 +374,7 @@ int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
        }
        bdev->scmdev = scmdev;
+        bdev->state = SCM_OPER;
        spin_lock_init(&bdev->rq_lock);
        spin_lock_init(&bdev->lock);
        INIT_LIST_HEAD(&bdev->finished_requests);
@@ -396,6 +439,18 @@ void scm_blk_dev_cleanup(struct scm_blk_dev *bdev)
        put_disk(bdev->gendisk);
 }
+void scm_blk_set_available(struct scm_blk_dev *bdev)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&bdev->lock, flags);
+        if (bdev->state == SCM_WR_PROHIBIT)
+                pr_info("%lu: Write access to the SCM increment is restored\n",
+                        (unsigned long) bdev->scmdev->address);
+        bdev->state = SCM_OPER;
+        spin_unlock_irqrestore(&bdev->lock, flags);
+}
 static int __init scm_blk_init(void)
 {
        int ret = -EINVAL;
diff --git a/drivers/s390/block/scm_blk.h b/drivers/s390/block/scm_blk.h
index 3c1ccf494647..8b387b32fd62 100644
--- a/drivers/s390/block/scm_blk.h
+++ b/drivers/s390/block/scm_blk.h
@@ -21,6 +21,7 @@ struct scm_blk_dev {
        spinlock_t rq_lock;     /* guard the request queue */
        spinlock_t lock;        /* guard the rest of the blockdev */
        atomic_t queued_reqs;
+        enum {SCM_OPER, SCM_WR_PROHIBIT} state;
        struct list_head finished_requests;
 #ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
        struct list_head cluster_list;
@@ -48,6 +49,7 @@ struct scm_request {
 int scm_blk_dev_setup(struct scm_blk_dev *, struct scm_device *);
 void scm_blk_dev_cleanup(struct scm_blk_dev *);
+void scm_blk_set_available(struct scm_blk_dev *);
 void scm_blk_irq(struct scm_device *, void *, int);
 void scm_request_finish(struct scm_request *);
diff --git a/drivers/s390/block/scm_drv.c b/drivers/s390/block/scm_drv.c
index 9fa0a908607b..5f6180d6ff08 100644
--- a/drivers/s390/block/scm_drv.c
+++ b/drivers/s390/block/scm_drv.c
@@ -13,12 +13,23 @@
 #include <asm/eadm.h>
 #include "scm_blk.h"
-static void notify(struct scm_device *scmdev)
+static void scm_notify(struct scm_device *scmdev, enum scm_event event)
 {
-        pr_info("%lu: The capabilities of the SCM increment changed\n",
+        struct scm_blk_dev *bdev = dev_get_drvdata(&scmdev->dev);
-                (unsigned long) scmdev->address);
-        SCM_LOG(2, "State changed");
+        switch (event) {
-        SCM_LOG_STATE(2, scmdev);
+        case SCM_CHANGE:
+                pr_info("%lu: The capabilities of the SCM increment changed\n",
+                        (unsigned long) scmdev->address);
+                SCM_LOG(2, "State changed");
+                SCM_LOG_STATE(2, scmdev);
+                break;
+        case SCM_AVAIL:
+                SCM_LOG(2, "Increment available");
+                SCM_LOG_STATE(2, scmdev);
+                scm_blk_set_available(bdev);
+                break;
+        }
 }
 static int scm_probe(struct scm_device *scmdev)
@@ -64,7 +75,7 @@ static struct scm_driver scm_drv = {
                .name = "scm_block",
                .owner = THIS_MODULE,
        },
-        .notify = notify,
+        .notify = scm_notify,
        .probe = scm_probe,
        .remove = scm_remove,
        .handler = scm_blk_irq,
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 30a2255389e5..cd798386b622 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -627,6 +627,8 @@ static int __init sclp_detect_standby_memory(void)
        struct read_storage_sccb *sccb;
        int i, id, assigned, rc;
+        if (OLDMEM_BASE) /* No standby memory in kdump mode */
+                return 0;
        if (!early_read_info_sccb_valid)
                return 0;
        if ((sclp_facilities & 0xe00000000000ULL) != 0xe00000000000ULL)
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 31ceef1beb8b..e16c553f6556 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -433,6 +433,20 @@ static void chsc_process_sei_scm_change(struct chsc_sei_nt0_area *sei_area)
                              " failed (rc=%d).\n", ret);
 }
+static void chsc_process_sei_scm_avail(struct chsc_sei_nt0_area *sei_area)
+{
+        int ret;
+        CIO_CRW_EVENT(4, "chsc: scm available information\n");
+        if (sei_area->rs != 7)
+                return;
+        ret = scm_process_availability_information();
+        if (ret)
+                CIO_CRW_EVENT(0, "chsc: process availability information"
+                              " failed (rc=%d).\n", ret);
+}
 static void chsc_process_sei_nt2(struct chsc_sei_nt2_area *sei_area)
 {
        switch (sei_area->cc) {
@@ -468,6 +482,9 @@ static void chsc_process_sei_nt0(struct chsc_sei_nt0_area *sei_area)
        case 12: /* scm change notification */
                chsc_process_sei_scm_change(sei_area);
                break;
+        case 14: /* scm available notification */
+                chsc_process_sei_scm_avail(sei_area);
+                break;
        default: /* other stuff */
                CIO_CRW_EVENT(2, "chsc: sei nt0 unhandled cc=%d\n",
                              sei_area->cc);
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 227e05f674b3..349d5fc47196 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -156,8 +156,10 @@ int chsc_scm_info(struct chsc_scm_info *scm_area, u64 token);
 #ifdef CONFIG_SCM_BUS
 int scm_update_information(void);
+int scm_process_availability_information(void);
 #else /* CONFIG_SCM_BUS */
 static inline int scm_update_information(void) { return 0; }
+static inline int scm_process_availability_information(void) { return 0; }
 #endif /* CONFIG_SCM_BUS */
diff --git a/drivers/s390/cio/scm.c b/drivers/s390/cio/scm.c
index bcf20f3aa51b..46ec25632e8b 100644
--- a/drivers/s390/cio/scm.c
+++ b/drivers/s390/cio/scm.c
@@ -211,7 +211,7 @@ static void scmdev_update(struct scm_device *scmdev, struct sale *sale)
                goto out;
        scmdrv = to_scm_drv(scmdev->dev.driver);
        if (changed && scmdrv->notify)
-                scmdrv->notify(scmdev);
+                scmdrv->notify(scmdev, SCM_CHANGE);
 out:
        device_unlock(&scmdev->dev);
        if (changed)
@@ -297,6 +297,22 @@ int scm_update_information(void)
        return ret;
 }
+static int scm_dev_avail(struct device *dev, void *unused)
+{
+        struct scm_driver *scmdrv = to_scm_drv(dev->driver);
+        struct scm_device *scmdev = to_scm_dev(dev);
+        if (dev->driver && scmdrv->notify)
+                scmdrv->notify(scmdev, SCM_AVAIL);
+        return 0;
+}
+int scm_process_availability_information(void)
+{
+        return bus_for_each_dev(&scm_bus_type, NULL, NULL, scm_dev_avail);
+}
 static int __init scm_init(void)
 {
        int ret;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index d87961d4c0de..8c0622399fcd 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -916,6 +916,7 @@ int qeth_send_control_data(struct qeth_card *, int, struct qeth_cmd_buffer *,
        void *reply_param);
 int qeth_get_priority_queue(struct qeth_card *, struct sk_buff *, int, int);
 int qeth_get_elements_no(struct qeth_card *, void *, struct sk_buff *, int);
+int qeth_get_elements_for_frags(struct sk_buff *);
 int qeth_do_send_packet_fast(struct qeth_card *, struct qeth_qdio_out_q *,
                        struct sk_buff *, struct qeth_hdr *, int, int, int);
 int qeth_do_send_packet(struct qeth_card *, struct qeth_qdio_out_q *,
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 0d8cdff81813..0d73a999983d 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3679,6 +3679,25 @@ int qeth_get_priority_queue(struct qeth_card *card, struct sk_buff *skb,
 }
 EXPORT_SYMBOL_GPL(qeth_get_priority_queue);
+int qeth_get_elements_for_frags(struct sk_buff *skb)
+{
+        int cnt, length, e, elements = 0;
+        struct skb_frag_struct *frag;
+        char *data;
+        for (cnt = 0; cnt < skb_shinfo(skb)->nr_frags; cnt++) {
+                frag = &skb_shinfo(skb)->frags[cnt];
+                data = (char *)page_to_phys(skb_frag_page(frag)) +
+                        frag->page_offset;
+                length = frag->size;
+                e = PFN_UP((unsigned long)data + length - 1) -
+                        PFN_DOWN((unsigned long)data);
+                elements += e;
+        }
+        return elements;
+}
+EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags);
 int qeth_get_elements_no(struct qeth_card *card, void *hdr,
                     struct sk_buff *skb, int elems)
 {
@@ -3686,7 +3705,8 @@ int qeth_get_elements_no(struct qeth_card *card, void *hdr,
        int elements_needed = PFN_UP((unsigned long)skb->data + dlen - 1) -
                PFN_DOWN((unsigned long)skb->data);
-        elements_needed += skb_shinfo(skb)->nr_frags;
+        elements_needed += qeth_get_elements_for_frags(skb);
        if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)) {
                QETH_DBF_MESSAGE(2, "Invalid size of IP packet "
                        "(Number=%d / Length=%d). Discarded.\n",
@@ -3771,12 +3791,23 @@ static inline void __qeth_fill_buffer(struct sk_buff *skb,
        for (cnt = 0; cnt < skb_shinfo(skb)->nr_frags; cnt++) {
                frag = &skb_shinfo(skb)->frags[cnt];
-                buffer->element[element].addr = (char *)
+                data = (char *)page_to_phys(skb_frag_page(frag)) +
-                        page_to_phys(skb_frag_page(frag))
+                        frag->page_offset;
-                        + frag->page_offset;
+                length = frag->size;
-                buffer->element[element].length = frag->size;
+                while (length > 0) {
-                buffer->element[element].eflags = SBAL_EFLAGS_MIDDLE_FRAG;
+                        length_here = PAGE_SIZE -
-                element++;
+                                ((unsigned long) data % PAGE_SIZE);
+                        if (length < length_here)
+                                length_here = length;
+                        buffer->element[element].addr = data;
+                        buffer->element[element].length = length_here;
+                        buffer->element[element].eflags =
+                                SBAL_EFLAGS_MIDDLE_FRAG;
+                        length -= length_here;
+                        data += length_here;
+                        element++;
+                }
        }
        if (buffer->element[element - 1].eflags)
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 091ca0efa1c5..8710337dab3e 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -623,7 +623,7 @@ static int qeth_l3_send_setrouting(struct qeth_card *card,
        return rc;
 }
-static void qeth_l3_correct_routing_type(struct qeth_card *card,
+static int qeth_l3_correct_routing_type(struct qeth_card *card,
                enum qeth_routing_types *type, enum qeth_prot_versions prot)
 {
        if (card->info.type == QETH_CARD_TYPE_IQD) {
@@ -632,7 +632,7 @@ static void qeth_l3_correct_routing_type(struct qeth_card *card,
                case PRIMARY_CONNECTOR:
                case SECONDARY_CONNECTOR:
                case MULTICAST_ROUTER:
-                        return;
+                        return 0;
                default:
                        goto out_inval;
                }
@@ -641,17 +641,18 @@ static void qeth_l3_correct_routing_type(struct qeth_card *card,
                case NO_ROUTER:
                case PRIMARY_ROUTER:
                case SECONDARY_ROUTER:
-                        return;
+                        return 0;
                case MULTICAST_ROUTER:
                        if (qeth_is_ipafunc_supported(card, prot,
                                                      IPA_OSA_MC_ROUTER))
-                                return;
+                                return 0;
                default:
                        goto out_inval;
                }
        }
 out_inval:
        *type = NO_ROUTER;
+        return -EINVAL;
 }
 int qeth_l3_setrouting_v4(struct qeth_card *card)
@@ -660,8 +661,10 @@ int qeth_l3_setrouting_v4(struct qeth_card *card)
        QETH_CARD_TEXT(card, 3, "setrtg4");
-        qeth_l3_correct_routing_type(card, &card->options.route4.type,
+        rc = qeth_l3_correct_routing_type(card, &card->options.route4.type,
                                  QETH_PROT_IPV4);
+        if (rc)
+                return rc;
        rc = qeth_l3_send_setrouting(card, card->options.route4.type,
                                  QETH_PROT_IPV4);
@@ -683,8 +686,10 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
        if (!qeth_is_supported(card, IPA_IPV6))
                return 0;
-        qeth_l3_correct_routing_type(card, &card->options.route6.type,
+        rc = qeth_l3_correct_routing_type(card, &card->options.route6.type,
                                  QETH_PROT_IPV6);
+        if (rc)
+                return rc;
        rc = qeth_l3_send_setrouting(card, card->options.route6.type,
                                  QETH_PROT_IPV6);
@@ -2898,7 +2903,9 @@ static inline int qeth_l3_tso_elements(struct sk_buff *skb)
                tcp_hdr(skb)->doff * 4;
        int tcpd_len = skb->len - (tcpd - (unsigned long)skb->data);
        int elements = PFN_UP(tcpd + tcpd_len - 1) - PFN_DOWN(tcpd);
-        elements += skb_shinfo(skb)->nr_frags;
+        elements += qeth_get_elements_for_frags(skb);
        return elements;
 }
@@ -3348,7 +3355,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                rc = -ENODEV;
                goto out_remove;
        }
-        qeth_trace_features(card);
        if (!card->dev && qeth_l3_setup_netdev(card)) {
                rc = -ENODEV;
@@ -3425,6 +3431,7 @@ contin:
                qeth_l3_set_multicast_list(card->dev);
                rtnl_unlock();
        }
+        qeth_trace_features(card);
        /* let user_space know that device is online */
        kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
        mutex_unlock(&card->conf_mutex);
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index ebc379486267..e70af2406ff9 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -87,6 +87,8 @@ static ssize_t qeth_l3_dev_route_store(struct qeth_card *card,
                        rc = qeth_l3_setrouting_v6(card);
        }
 out:
+        if (rc)
+                route->type = old_route_type;
        mutex_unlock(&card->conf_mutex);
        return rc ? rc : count;
 }
diff --git a/drivers/thermal/dove_thermal.c b/drivers/thermal/dove_thermal.c
index 7b0bfa0e7a9c..3078c403b42d 100644
--- a/drivers/thermal/dove_thermal.c
+++ b/drivers/thermal/dove_thermal.c
@@ -143,22 +143,18 @@ static int dove_thermal_probe(struct platform_device *pdev)
        if (!priv)
                return -ENOMEM;
-        priv->sensor = devm_request_and_ioremap(&pdev->dev, res);
+        priv->sensor = devm_ioremap_resource(&pdev->dev, res);
-        if (!priv->sensor) {
+        if (IS_ERR(priv->sensor))
-                dev_err(&pdev->dev, "Failed to request_ioremap memory\n");
+                return PTR_ERR(priv->sensor);
-                return -EADDRNOTAVAIL;
-        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
        if (!res) {
                dev_err(&pdev->dev, "Failed to get platform resource\n");
                return -ENODEV;
        }
-        priv->control = devm_request_and_ioremap(&pdev->dev, res);
+        priv->control = devm_ioremap_resource(&pdev->dev, res);
-        if (!priv->control) {
+        if (IS_ERR(priv->control))
-                dev_err(&pdev->dev, "Failed to request_ioremap memory\n");
+                return PTR_ERR(priv->control);
-                return -EADDRNOTAVAIL;
-        }
        ret = dove_init_sensor(priv);
        if (ret) {
diff --git a/drivers/thermal/exynos_thermal.c b/drivers/thermal/exynos_thermal.c
index e04ebd8671ac..46568c078dee 100644
--- a/drivers/thermal/exynos_thermal.c
+++ b/drivers/thermal/exynos_thermal.c
@@ -476,7 +476,7 @@ static int exynos_register_thermal(struct thermal_sensor_conf *sensor_conf)
        if (IS_ERR(th_zone->therm_dev)) {
                pr_err("Failed to register thermal zone device\n");
-                ret = -EINVAL;
+                ret = PTR_ERR(th_zone->therm_dev);
                goto err_unregister;
        }
        th_zone->mode = THERMAL_DEVICE_ENABLED;
diff --git a/drivers/thermal/kirkwood_thermal.c b/drivers/thermal/kirkwood_thermal.c
index 65cb4f09e8f6..e5500edb5285 100644
--- a/drivers/thermal/kirkwood_thermal.c
+++ b/drivers/thermal/kirkwood_thermal.c
@@ -85,11 +85,9 @@ static int kirkwood_thermal_probe(struct platform_device *pdev)
        if (!priv)
                return -ENOMEM;
-        priv->sensor = devm_request_and_ioremap(&pdev->dev, res);
+        priv->sensor = devm_ioremap_resource(&pdev->dev, res);
-        if (!priv->sensor) {
+        if (IS_ERR(priv->sensor))
-                dev_err(&pdev->dev, "Failed to request_ioremap memory\n");
+                return PTR_ERR(priv->sensor);
-                return -EADDRNOTAVAIL;
-        }
        thermal = thermal_zone_device_register("kirkwood_thermal", 0, 0,
                                               priv, &ops, NULL, 0, 0);
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 28f091994013..2cc5b6115e3e 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -145,6 +145,7 @@ static int rcar_thermal_update_temp(struct rcar_thermal_priv *priv)
        struct device *dev = rcar_priv_to_dev(priv);
        int i;
        int ctemp, old, new;
+        int ret = -EINVAL;
        mutex_lock(&priv->lock);
@@ -174,7 +175,7 @@ static int rcar_thermal_update_temp(struct rcar_thermal_priv *priv)
        if (!ctemp) {
                dev_err(dev, "thermal sensor was broken\n");
-                return -EINVAL;
+                goto err_out_unlock;
        }
        /*
@@ -192,10 +193,10 @@ static int rcar_thermal_update_temp(struct rcar_thermal_priv *priv)
        dev_dbg(dev, "thermal%d  %d -> %d\n", priv->id, priv->ctemp, ctemp);
        priv->ctemp = ctemp;
+        ret = 0;
+err_out_unlock:
        mutex_unlock(&priv->lock);
+        return ret;
-        return 0;
 }
 static int rcar_thermal_get_temp(struct thermal_zone_device *zone,
@@ -363,6 +364,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
        struct resource *res, *irq;
        int mres = 0;
        int i;
+        int ret = -ENODEV;
        int idle = IDLE_INTERVAL;
        common = devm_kzalloc(dev, sizeof(*common), GFP_KERNEL);
@@ -399,11 +401,9 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                /*
                 * rcar_has_irq_support() will be enabled
                 */
-                common->base = devm_request_and_ioremap(dev, res);
+                common->base = devm_ioremap_resource(dev, res);
-                if (!common->base) {
+                if (IS_ERR(common->base))
-                        dev_err(dev, "Unable to ioremap thermal register\n");
+                        return PTR_ERR(common->base);
-                        return -ENOMEM;
-                }
                /* enable temperature comparation */
                rcar_thermal_common_write(common, ENR, 0x00030303);
@@ -422,11 +422,9 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                        return -ENOMEM;
                }
-                priv->base = devm_request_and_ioremap(dev, res);
+                priv->base = devm_ioremap_resource(dev, res);
-                if (!priv->base) {
+                if (IS_ERR(priv->base))
-                        dev_err(dev, "Unable to ioremap priv register\n");
+                        return PTR_ERR(priv->base);
-                        return -ENOMEM;
-                }
                priv->common = common;
                priv->id = i;
@@ -441,6 +439,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                                                idle);
                if (IS_ERR(priv->zone)) {
                        dev_err(dev, "can't register thermal zone\n");
+                        ret = PTR_ERR(priv->zone);
                        goto error_unregister;
                }
@@ -460,7 +459,7 @@ error_unregister:
        rcar_thermal_for_each_priv(priv, common)
                thermal_zone_device_unregister(priv->zone);
-        return -ENODEV;
+        return ret;
 }
 static int rcar_thermal_remove(struct platform_device *pdev)
diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
index e343d6670854..451687cb9685 100644
--- a/drivers/tty/serial/sunsu.c
+++ b/drivers/tty/serial/sunsu.c
@@ -968,6 +968,7 @@ static struct uart_ops sunsu_pops = {
 #define UART_NR 4
 static struct uart_sunsu_port sunsu_ports[UART_NR];
+static int nr_inst; /* Number of already registered ports */
 #ifdef CONFIG_SERIO
@@ -1337,13 +1338,8 @@ static int __init sunsu_console_setup(struct console *co, char *options)
        printk("Console: ttyS%d (SU)\n",
               (sunsu_reg.minor - 64) + co->index);
-        /*
+        if (co->index > nr_inst)
-         * Check whether an invalid uart number has been specified, and
+                return -ENODEV;
-         * if so, search for the first available port that does have
-         * console support.
-         */
-        if (co->index >= UART_NR)
-                co->index = 0;
        port = &sunsu_ports[co->index].port;
        /*
@@ -1408,7 +1404,6 @@ static enum su_type su_get_type(struct device_node *dp)
 static int su_probe(struct platform_device *op)
 {
-        static int inst;
        struct device_node *dp = op->dev.of_node;
        struct uart_sunsu_port *up;
        struct resource *rp;
@@ -1418,16 +1413,16 @@ static int su_probe(struct platform_device *op)
        type = su_get_type(dp);
        if (type == SU_PORT_PORT) {
-                if (inst >= UART_NR)
+                if (nr_inst >= UART_NR)
                        return -EINVAL;
-                up = &sunsu_ports[inst];
+                up = &sunsu_ports[nr_inst];
        } else {
                up = kzalloc(sizeof(*up), GFP_KERNEL);
                if (!up)
                        return -ENOMEM;
        }
-        up->port.line = inst;
+        up->port.line = nr_inst;
        spin_lock_init(&up->port.lock);
@@ -1461,6 +1456,8 @@ static int su_probe(struct platform_device *op)
                }
                dev_set_drvdata(&op->dev, up);
+                nr_inst++;
                return 0;
        }
@@ -1488,7 +1485,7 @@ static int su_probe(struct platform_device *op)
        dev_set_drvdata(&op->dev, up);
-        inst++;
+        nr_inst++;
        return 0;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 8ac25adf31b4..387dc6c8ad25 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -593,7 +593,6 @@ static void acm_port_destruct(struct tty_port *port)
        dev_dbg(&acm->control->dev, "%s\n", __func__);
-        tty_unregister_device(acm_tty_driver, acm->minor);
        acm_release_minor(acm);
        usb_put_intf(acm->control);
        kfree(acm->country_codes);
@@ -977,6 +976,8 @@ static int acm_probe(struct usb_interface *intf,
        int num_rx_buf;
        int i;
        int combined_interfaces = 0;
+        struct device *tty_dev;
+        int rv = -ENOMEM;
        /* normal quirks */
        quirks = (unsigned long)id->driver_info;
@@ -1339,11 +1340,24 @@ skip_countries:
        usb_set_intfdata(data_interface, acm);
        usb_get_intf(control_interface);
-        tty_port_register_device(&acm->port, acm_tty_driver, minor,
+        tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,
                        &control_interface->dev);
+        if (IS_ERR(tty_dev)) {
+                rv = PTR_ERR(tty_dev);
+                goto alloc_fail8;
+        }
        return 0;
+alloc_fail8:
+        if (acm->country_codes) {
+                device_remove_file(&acm->control->dev,
+                                &dev_attr_wCountryCodes);
+                device_remove_file(&acm->control->dev,
+                                &dev_attr_iCountryCodeRelDate);
+        }
+        device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
 alloc_fail7:
+        usb_set_intfdata(intf, NULL);
        for (i = 0; i < ACM_NW; i++)
                usb_free_urb(acm->wb[i].urb);
 alloc_fail6:
@@ -1359,7 +1373,7 @@ alloc_fail2:
        acm_release_minor(acm);
        kfree(acm);
 alloc_fail:
-        return -ENOMEM;
+        return rv;
 }
 static void stop_data_traffic(struct acm *acm)
@@ -1411,6 +1425,8 @@ static void acm_disconnect(struct usb_interface *intf)
        stop_data_traffic(acm);
+        tty_unregister_device(acm_tty_driver, acm->minor);
        usb_free_urb(acm->ctrlurb);
        for (i = 0; i < ACM_NW; i++)
                usb_free_urb(acm->wb[i].urb);
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 622b4a48e732..2b487d4797bd 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
        struct hc_driver        *driver;
        struct usb_hcd          *hcd;
        int                     retval;
+        int                     hcd_irq = 0;
        if (usb_disabled())
                return -ENODEV;
@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                return -ENODEV;
        dev->current_state = PCI_D0;
-        /* The xHCI driver supports MSI and MSI-X,
+        /*
-         * so don't fail if the BIOS doesn't provide a legacy IRQ.
+         * The xHCI driver has its own irq management
+         * make sure irq setup is not touched for xhci in generic hcd code
         */
-        if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
+        if ((driver->flags & HCD_MASK) != HCD_USB3) {
-                dev_err(&dev->dev,
+                if (!dev->irq) {
-                        "Found HC with no IRQ.  Check BIOS/PCI %s setup!\n",
+                        dev_err(&dev->dev,
-                        pci_name(dev));
+                        "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
-                retval = -ENODEV;
+                                pci_name(dev));
-                goto disable_pci;
+                        retval = -ENODEV;
+                        goto disable_pci;
+                }
+                hcd_irq = dev->irq;
        }
        hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev));
@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
        pci_set_master(dev);
-        retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);
+        retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED);
        if (retval != 0)
                goto unmap_registers;
        set_hs_companion(dev, hcd);
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 71beeb833558..cc9c49c57c80 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -447,14 +447,13 @@ static void rndis_response_complete(struct usb_ep *ep, struct usb_request *req)
 static void rndis_command_complete(struct usb_ep *ep, struct usb_request *req)
 {
        struct f_rndis                  *rndis = req->context;
-        struct usb_composite_dev        *cdev = rndis->port.func.config->cdev;
        int                             status;
        /* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */
 //      spin_lock(&dev->lock);
        status = rndis_msg_parser(rndis->config, (u8 *) req->buf);
        if (status < 0)
-                ERROR(cdev, "RNDIS command error %d, %d/%d\n",
+                pr_err("RNDIS command error %d, %d/%d\n",
                        status, req->actual, req->length);
 //      spin_unlock(&dev->lock);
 }
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index 3953dd4d7186..3b343b23e4b0 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -357,7 +357,7 @@ static int gfs_bind(struct usb_composite_dev *cdev)
                goto error;
        gfs_dev_desc.iProduct = gfs_strings[USB_GADGET_PRODUCT_IDX].id;
-        for (i = func_num; --i; ) {
+        for (i = func_num; i--; ) {
                ret = functionfs_bind(ffs_tab[i].ffs_data, cdev);
                if (unlikely(ret < 0)) {
                        while (++i < func_num)
@@ -413,7 +413,7 @@ static int gfs_unbind(struct usb_composite_dev *cdev)
                gether_cleanup();
        gfs_ether_setup = false;
-        for (i = func_num; --i; )
+        for (i = func_num; i--; )
                if (ffs_tab[i].ffs_data)
                        functionfs_unbind(ffs_tab[i].ffs_data);
diff --git a/drivers/usb/gadget/net2272.c b/drivers/usb/gadget/net2272.c
index d226058e3b88..32524b631959 100644
--- a/drivers/usb/gadget/net2272.c
+++ b/drivers/usb/gadget/net2272.c
@@ -59,7 +59,7 @@ static const char * const ep_name[] = {
 };
 #define DMA_ADDR_INVALID        (~(dma_addr_t)0)
-#ifdef CONFIG_USB_GADGET_NET2272_DMA
+#ifdef CONFIG_USB_NET2272_DMA
 /*
 * use_dma: the NET2272 can use an external DMA controller.
 * Note that since there is no generic DMA api, some functions,
@@ -1495,6 +1495,13 @@ stop_activity(struct net2272 *dev, struct usb_gadget_driver *driver)
        for (i = 0; i < 4; ++i)
                net2272_dequeue_all(&dev->ep[i]);
+        /* report disconnect; the driver is already quiesced */
+        if (driver) {
+                spin_unlock(&dev->lock);
+                driver->disconnect(&dev->gadget);
+                spin_lock(&dev->lock);
+        }
        net2272_usb_reinit(dev);
 }
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index a1b650e11339..3bd0f992fb49 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -1924,7 +1924,6 @@ static int net2280_start(struct usb_gadget *_gadget,
 err_func:
        device_remove_file (&dev->pdev->dev, &dev_attr_function);
 err_unbind:
-        driver->unbind (&dev->gadget);
        dev->gadget.dev.driver = NULL;
        dev->driver = NULL;
        return retval;
@@ -1946,6 +1945,13 @@ stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
        for (i = 0; i < 7; i++)
                nuke (&dev->ep [i]);
+        /* report disconnect; the driver is already quiesced */
+        if (driver) {
+                spin_unlock(&dev->lock);
+                driver->disconnect(&dev->gadget);
+                spin_lock(&dev->lock);
+        }
        usb_reinit (dev);
 }
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index c5034d9c946b..b369292d4b90 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -136,7 +136,7 @@ static struct portmaster {
        pr_debug(fmt, ##arg)
 #endif /* pr_vdebug */
 #else
-#ifndef pr_vdebig
+#ifndef pr_vdebug
 #define pr_vdebug(fmt, arg...) \
        ({ if (0) pr_debug(fmt, ##arg); })
 #endif /* pr_vdebug */
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index 2a9cd369f71c..f8f62c3ed65e 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -216,7 +216,7 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
        usb_gadget_disconnect(udc->gadget);
        udc->driver->disconnect(udc->gadget);
        udc->driver->unbind(udc->gadget);
-        usb_gadget_udc_stop(udc->gadget, udc->driver);
+        usb_gadget_udc_stop(udc->gadget, NULL);
        udc->driver = NULL;
        udc->dev.driver = NULL;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 5726cb144abf..416a6dce5e11 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -302,6 +302,7 @@ static void ehci_quiesce (struct ehci_hcd *ehci)
 static void end_unlink_async(struct ehci_hcd *ehci);
 static void unlink_empty_async(struct ehci_hcd *ehci);
+static void unlink_empty_async_suspended(struct ehci_hcd *ehci);
 static void ehci_work(struct ehci_hcd *ehci);
 static void start_unlink_intr(struct ehci_hcd *ehci, struct ehci_qh *qh);
 static void end_unlink_intr(struct ehci_hcd *ehci, struct ehci_qh *qh);
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 4d3b294f203e..7d06e77f6c4f 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -328,7 +328,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
        ehci->rh_state = EHCI_RH_SUSPENDED;
        end_unlink_async(ehci);
-        unlink_empty_async(ehci);
+        unlink_empty_async_suspended(ehci);
        ehci_handle_intr_unlinks(ehci);
        end_free_itds(ehci);
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 5464665f0b6a..23d136904285 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1316,6 +1316,19 @@ static void unlink_empty_async(struct ehci_hcd *ehci)
        }
 }
+/* The root hub is suspended; unlink all the async QHs */
+static void unlink_empty_async_suspended(struct ehci_hcd *ehci)
+{
+        struct ehci_qh          *qh;
+        while (ehci->async->qh_next.qh) {
+                qh = ehci->async->qh_next.qh;
+                WARN_ON(!list_empty(&qh->qtd_list));
+                single_unlink_async(ehci, qh);
+        }
+        start_iaa_cycle(ehci, false);
+}
 /* makes sure the async qh will become idle */
 /* caller must own ehci->lock */
diff --git a/drivers/usb/host/ehci-timer.c b/drivers/usb/host/ehci-timer.c
index 20dbdcbe9b0f..c3fa1305f830 100644
--- a/drivers/usb/host/ehci-timer.c
+++ b/drivers/usb/host/ehci-timer.c
@@ -304,7 +304,7 @@ static void ehci_iaa_watchdog(struct ehci_hcd *ehci)
         * (a) SMP races against real IAA firing and retriggering, and
         * (b) clean HC shutdown, when IAA watchdog was pending.
         */
-        if (ehci->async_iaa) {
+        if (1) {
                u32 cmd, status;
                /* If we get here, IAA is *REALLY* late.  It's barely
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index f1f01a834ba7..849470b18831 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -350,7 +350,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
         * generate interrupts.  Don't even try to enable MSI.
         */
        if (xhci->quirks & XHCI_BROKEN_MSI)
-                return 0;
+                goto legacy_irq;
        /* unregister the legacy interrupt */
        if (hcd->irq)
@@ -371,6 +371,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                return -EINVAL;
        }
+ legacy_irq:
        /* fall back to legacy interrupt*/
        ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
                        hcd->irq_descr, hcd);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index f791bd0aee6c..2c510e4a7d4c 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -206,8 +206,8 @@ struct xhci_op_regs {
 /* bits 12:31 are reserved (and should be preserved on writes). */
 /* IMAN - Interrupt Management Register */
-#define IMAN_IP         (1 << 1)
+#define IMAN_IE         (1 << 1)
-#define IMAN_IE         (1 << 0)
+#define IMAN_IP         (1 << 0)
 /* USBSTS - USB status - status bitmasks */
 /* HC not running - set to 1 when run/stop bit is cleared. */
diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
index 7c71769d71ff..41613a2b35e8 100644
--- a/drivers/usb/musb/da8xx.c
+++ b/drivers/usb/musb/da8xx.c
@@ -327,7 +327,7 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci)
                u8 devctl = musb_readb(mregs, MUSB_DEVCTL);
                int err;
-                err = musb->int_usb & USB_INTR_VBUSERROR;
+                err = musb->int_usb & MUSB_INTR_VBUSERROR;
                if (err) {
                        /*
                         * The Mentor core doesn't debounce VBUS as needed
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index be18537c5f14..83eddedcd9be 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -141,7 +141,9 @@ static inline void map_dma_buffer(struct musb_request *request,
 static inline void unmap_dma_buffer(struct musb_request *request,
                                struct musb *musb)
 {
-        if (!is_buffer_mapped(request))
+        struct musb_ep *musb_ep = request->ep;
+        if (!is_buffer_mapped(request) || !musb_ep->dma)
                return;
        if (request->request.dma == DMA_ADDR_INVALID) {
@@ -195,7 +197,10 @@ __acquires(ep->musb->lock)
        ep->busy = 1;
        spin_unlock(&musb->lock);
-        unmap_dma_buffer(req, musb);
+        if (!dma_mapping_error(&musb->g.dev, request->dma))
+                unmap_dma_buffer(req, musb);
        if (request->status == 0)
                dev_dbg(musb->controller, "%s done request %p,  %d/%d\n",
                                ep->end_point.name, request,
diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
index cbd904b8fba5..4775f8209e55 100644
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -62,7 +62,6 @@ static int is_irda(struct usb_serial *serial)
 }
 struct ark3116_private {
-        wait_queue_head_t       delta_msr_wait;
        struct async_icount     icount;
        int                     irda;   /* 1 for irda device */
@@ -146,7 +145,6 @@ static int ark3116_port_probe(struct usb_serial_port *port)
        if (!priv)
                return -ENOMEM;
-        init_waitqueue_head(&priv->delta_msr_wait);
        mutex_init(&priv->hw_lock);
        spin_lock_init(&priv->status_lock);
@@ -456,10 +454,14 @@ static int ark3116_ioctl(struct tty_struct *tty,
        case TIOCMIWAIT:
                for (;;) {
                        struct async_icount prev = priv->icount;
-                        interruptible_sleep_on(&priv->delta_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        if ((prev.rng == priv->icount.rng) &&
                            (prev.dsr == priv->icount.dsr) &&
                            (prev.dcd == priv->icount.dcd) &&
@@ -580,7 +582,7 @@ static void ark3116_update_msr(struct usb_serial_port *port, __u8 msr)
                        priv->icount.dcd++;
                if (msr & UART_MSR_TERI)
                        priv->icount.rng++;
-                wake_up_interruptible(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
        }
 }
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index d255f66e708e..07d4650a32ab 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -80,7 +80,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
 struct ch341_private {
        spinlock_t lock; /* access lock */
-        wait_queue_head_t delta_msr_wait; /* wait queue for modem status */
        unsigned baud_rate; /* set baud rate */
        u8 line_control; /* set line control value RTS/DTR */
        u8 line_status; /* active status of modem control inputs */
@@ -252,7 +251,6 @@ static int ch341_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        priv->baud_rate = DEFAULT_BAUD_RATE;
        priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
@@ -298,7 +296,7 @@ static void ch341_dtr_rts(struct usb_serial_port *port, int on)
                priv->line_control &= ~(CH341_BIT_RTS | CH341_BIT_DTR);
        spin_unlock_irqrestore(&priv->lock, flags);
        ch341_set_handshake(port->serial->dev, priv->line_control);
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
 }
 static void ch341_close(struct usb_serial_port *port)
@@ -491,7 +489,7 @@ static void ch341_read_int_callback(struct urb *urb)
                        tty_kref_put(tty);
                }
-                wake_up_interruptible(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
        }
 exit:
@@ -517,11 +515,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (!multi_change) {
-                interruptible_sleep_on(&priv->delta_msr_wait);
+                interruptible_sleep_on(&port->delta_msr_wait);
                /* see if a signal did it */
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->line_status;
                multi_change = priv->multi_status_change;
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 8efa19d0e9fb..ba7352e4187e 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -111,7 +111,6 @@ struct cypress_private {
        int baud_rate;                     /* stores current baud rate in
                                              integer form */
        int isthrottled;                   /* if throttled, discard reads */
-        wait_queue_head_t delta_msr_wait;  /* used for TIOCMIWAIT */
        char prev_status, diff_status;     /* used for TIOCMIWAIT */
        /* we pass a pointer to this as the argument sent to
           cypress_set_termios old_termios */
@@ -449,7 +448,6 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
                kfree(priv);
                return -ENOMEM;
        }
-        init_waitqueue_head(&priv->delta_msr_wait);
        usb_reset_configuration(serial->dev);
@@ -868,12 +866,16 @@ static int cypress_ioctl(struct tty_struct *tty,
        switch (cmd) {
        /* This code comes from drivers/char/serial.c and ftdi_sio.c */
        case TIOCMIWAIT:
-                while (priv != NULL) {
+                for (;;) {
-                        interruptible_sleep_on(&priv->delta_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
-                        else {
+                        if (port->serial->disconnected)
+                                return -EIO;
+                        {
                                char diff = priv->diff_status;
                                if (diff == 0)
                                        return -EIO; /* no change => error */
@@ -1187,7 +1189,7 @@ static void cypress_read_int_callback(struct urb *urb)
        if (priv->current_status != priv->prev_status) {
                priv->diff_status |= priv->current_status ^
                        priv->prev_status;
-                wake_up_interruptible(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
                priv->prev_status = priv->current_status;
        }
        spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/f81232.c b/drivers/usb/serial/f81232.c
index b1b2dc64b50b..a172ad5c5ce8 100644
--- a/drivers/usb/serial/f81232.c
+++ b/drivers/usb/serial/f81232.c
@@ -47,7 +47,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
 struct f81232_private {
        spinlock_t lock;
-        wait_queue_head_t delta_msr_wait;
        u8 line_control;
        u8 line_status;
 };
@@ -111,7 +110,7 @@ static void f81232_process_read_urb(struct urb *urb)
        line_status = priv->line_status;
        priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
        spin_unlock_irqrestore(&priv->lock, flags);
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        if (!urb->actual_length)
                return;
@@ -256,11 +255,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (1) {
-                interruptible_sleep_on(&priv->delta_msr_wait);
+                interruptible_sleep_on(&port->delta_msr_wait);
                /* see if a signal did it */
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->line_status;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -322,7 +324,6 @@ static int f81232_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        usb_set_serial_port_data(port, priv);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index edd162df49ca..d4809d551473 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -69,9 +69,7 @@ struct ftdi_private {
        int flags;              /* some ASYNC_xxxx flags are supported */
        unsigned long last_dtr_rts;     /* saved modem control outputs */
        struct async_icount     icount;
-        wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
        char prev_status;        /* Used for TIOCMIWAIT */
-        bool dev_gone;        /* Used to abort TIOCMIWAIT */
        char transmit_empty;    /* If transmitter is empty or not */
        __u16 interface;        /* FT2232C, FT2232H or FT4232H port interface
                                   (0 for FT232/245) */
@@ -1691,10 +1689,8 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
        kref_init(&priv->kref);
        mutex_init(&priv->cfg_lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        priv->flags = ASYNC_LOW_LATENCY;
-        priv->dev_gone = false;
        if (quirk && quirk->port_probe)
                quirk->port_probe(priv);
@@ -1840,8 +1836,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
 {
        struct ftdi_private *priv = usb_get_serial_port_data(port);
-        priv->dev_gone = true;
+        wake_up_interruptible(&port->delta_msr_wait);
-        wake_up_interruptible_all(&priv->delta_msr_wait);
        remove_sysfs_attrs(port);
@@ -1989,7 +1984,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
                if (diff_status & FTDI_RS0_RLSD)
                        priv->icount.dcd++;
-                wake_up_interruptible_all(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
                priv->prev_status = status;
        }
@@ -2440,11 +2435,15 @@ static int ftdi_ioctl(struct tty_struct *tty,
         */
        case TIOCMIWAIT:
                cprev = priv->icount;
-                while (!priv->dev_gone) {
+                for (;;) {
-                        interruptible_sleep_on(&priv->delta_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = priv->icount;
                        if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
                            ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
@@ -2454,8 +2453,6 @@ static int ftdi_ioctl(struct tty_struct *tty,
                        }
                        cprev = cnow;
                }
-                return -EIO;
-                break;
        case TIOCSERGETLSR:
                return get_lsr_info(port, (struct serial_struct __user *)arg);
                break;
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 1a07b12ef341..81caf5623ee2 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -956,10 +956,7 @@ static void garmin_close(struct usb_serial_port *port)
        if (!serial)
                return;
-        mutex_lock(&port->serial->disc_mutex);
+        garmin_clear(garmin_data_p);
-        if (!port->serial->disconnected)
-                garmin_clear(garmin_data_p);
        /* shutdown our urbs */
        usb_kill_urb(port->read_urb);
@@ -968,8 +965,6 @@ static void garmin_close(struct usb_serial_port *port)
        /* keep reset state so we know that we must start a new session */
        if (garmin_data_p->state != STATE_RESET)
                garmin_data_p->state = STATE_DISCONNECTED;
-        mutex_unlock(&port->serial->disc_mutex);
 }
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index b00e5cbf741f..efd8b978128c 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -110,7 +110,6 @@ struct edgeport_port {
        wait_queue_head_t       wait_chase;             /* for handling sleeping while waiting for chase to finish */
        wait_queue_head_t       wait_open;              /* for handling sleeping while waiting for open to finish */
        wait_queue_head_t       wait_command;           /* for handling sleeping while waiting for command to finish */
-        wait_queue_head_t       delta_msr_wait;         /* for handling sleeping while waiting for msr change to happen */
        struct async_icount     icount;
        struct usb_serial_port  *port;                  /* loop back to the owner of this object */
@@ -884,7 +883,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
        /* initialize our wait queues */
        init_waitqueue_head(&edge_port->wait_open);
        init_waitqueue_head(&edge_port->wait_chase);
-        init_waitqueue_head(&edge_port->delta_msr_wait);
        init_waitqueue_head(&edge_port->wait_command);
        /* initialize our icount structure */
@@ -1669,13 +1667,17 @@ static int edge_ioctl(struct tty_struct *tty,
                dev_dbg(&port->dev, "%s (%d) TIOCMIWAIT\n", __func__,  port->number);
                cprev = edge_port->icount;
                while (1) {
-                        prepare_to_wait(&edge_port->delta_msr_wait,
+                        prepare_to_wait(&port->delta_msr_wait,
                                                &wait, TASK_INTERRUPTIBLE);
                        schedule();
-                        finish_wait(&edge_port->delta_msr_wait, &wait);
+                        finish_wait(&port->delta_msr_wait, &wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = edge_port->icount;
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -2051,7 +2053,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 newMsr)
                        icount->dcd++;
                if (newMsr & EDGEPORT_MSR_DELTA_RI)
                        icount->rng++;
-                wake_up_interruptible(&edge_port->delta_msr_wait);
+                wake_up_interruptible(&edge_port->port->delta_msr_wait);
        }
        /* Save the new modem status */
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index c23776679f70..7777172206de 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -87,9 +87,6 @@ struct edgeport_port {
        int close_pending;
        int lsr_event;
        struct async_icount     icount;
-        wait_queue_head_t       delta_msr_wait; /* for handling sleeping while
-                                                   waiting for msr change to
-                                                   happen */
        struct edgeport_serial  *edge_serial;
        struct usb_serial_port  *port;
        __u8 bUartMode;         /* Port type, 0: RS232, etc. */
@@ -1459,7 +1456,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
                        icount->dcd++;
                if (msr & EDGEPORT_MSR_DELTA_RI)
                        icount->rng++;
-                wake_up_interruptible(&edge_port->delta_msr_wait);
+                wake_up_interruptible(&edge_port->port->delta_msr_wait);
        }
        /* Save the new modem status */
@@ -1754,7 +1751,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
        dev = port->serial->dev;
        memset(&(edge_port->icount), 0x00, sizeof(edge_port->icount));
-        init_waitqueue_head(&edge_port->delta_msr_wait);
        /* turn off loopback */
        status = ti_do_config(edge_port, UMPC_SET_CLR_LOOPBACK, 0);
@@ -2434,10 +2430,14 @@ static int edge_ioctl(struct tty_struct *tty,
                dev_dbg(&port->dev, "%s - TIOCMIWAIT\n", __func__);
                cprev = edge_port->icount;
                while (1) {
-                        interruptible_sleep_on(&edge_port->delta_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = edge_port->icount;
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -2649,6 +2649,7 @@ static struct usb_serial_driver edgeport_2port_device = {
        .set_termios            = edge_set_termios,
        .tiocmget               = edge_tiocmget,
        .tiocmset               = edge_tiocmset,
+        .get_icount             = edge_get_icount,
        .write                  = edge_write,
        .write_room             = edge_write_room,
        .chars_in_buffer        = edge_chars_in_buffer,
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index a64d420f687b..06d5a60be2c4 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -114,8 +114,6 @@ struct mct_u232_private {
        unsigned char        last_msr;      /* Modem Status Register */
        unsigned int         rx_flags;      /* Throttling flags */
        struct async_icount  icount;
-        wait_queue_head_t    msr_wait;  /* for handling sleeping while waiting
-                                                for msr change to happen */
 };
 #define THROTTLED               0x01
@@ -409,7 +407,6 @@ static int mct_u232_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->msr_wait);
        usb_set_serial_port_data(port, priv);
@@ -601,7 +598,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
                tty_kref_put(tty);
        }
 #endif
-        wake_up_interruptible(&priv->msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        spin_unlock_irqrestore(&priv->lock, flags);
 exit:
        retval = usb_submit_urb(urb, GFP_ATOMIC);
@@ -810,13 +807,17 @@ static int  mct_u232_ioctl(struct tty_struct *tty,
                cprev = mct_u232_port->icount;
                spin_unlock_irqrestore(&mct_u232_port->lock, flags);
                for ( ; ; ) {
-                        prepare_to_wait(&mct_u232_port->msr_wait,
+                        prepare_to_wait(&port->delta_msr_wait,
                                        &wait, TASK_INTERRUPTIBLE);
                        schedule();
-                        finish_wait(&mct_u232_port->msr_wait, &wait);
+                        finish_wait(&port->delta_msr_wait, &wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        spin_lock_irqsave(&mct_u232_port->lock, flags);
                        cnow = mct_u232_port->icount;
                        spin_unlock_irqrestore(&mct_u232_port->lock, flags);
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 809fb329eca5..b8051fa61911 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -219,7 +219,6 @@ struct moschip_port {
        char open;
        char open_ports;
        wait_queue_head_t wait_chase;   /* for handling sleeping while waiting for chase to finish */
-        wait_queue_head_t delta_msr_wait;       /* for handling sleeping while waiting for msr change to happen */
        int delta_msr_cond;
        struct async_icount icount;
        struct usb_serial_port *port;   /* loop back to the owner of this object */
@@ -423,6 +422,9 @@ static void mos7840_handle_new_msr(struct moschip_port *port, __u8 new_msr)
                        icount->rng++;
                        smp_wmb();
                }
+                mos7840_port->delta_msr_cond = 1;
+                wake_up_interruptible(&port->port->delta_msr_wait);
        }
 }
@@ -1127,7 +1129,6 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        /* initialize our wait queues */
        init_waitqueue_head(&mos7840_port->wait_chase);
-        init_waitqueue_head(&mos7840_port->delta_msr_wait);
        /* initialize our icount structure */
        memset(&(mos7840_port->icount), 0x00, sizeof(mos7840_port->icount));
@@ -2017,8 +2018,6 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
                        mos7840_port->read_urb_busy = false;
                }
        }
-        wake_up(&mos7840_port->delta_msr_wait);
-        mos7840_port->delta_msr_cond = 1;
        dev_dbg(&port->dev, "%s - mos7840_port->shadowLCR is End %x\n", __func__,
                mos7840_port->shadowLCR);
 }
@@ -2219,13 +2218,18 @@ static int mos7840_ioctl(struct tty_struct *tty,
                while (1) {
                        /* interruptible_sleep_on(&mos7840_port->delta_msr_wait); */
                        mos7840_port->delta_msr_cond = 0;
-                        wait_event_interruptible(mos7840_port->delta_msr_wait,
+                        wait_event_interruptible(port->delta_msr_wait,
-                                                 (mos7840_port->
+                                                 (port->serial->disconnected ||
+                                                  mos7840_port->
                                                  delta_msr_cond == 1));
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = mos7840_port->icount;
                        smp_rmb();
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index a958fd41b5b3..87c71ccfee87 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -188,7 +188,6 @@ struct oti6858_private {
        u8 setup_done;
        struct delayed_work delayed_setup_work;
-        wait_queue_head_t intr_wait;
        struct usb_serial_port *port;   /* USB port with which associated */
 };
@@ -339,7 +338,6 @@ static int oti6858_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->intr_wait);
        priv->port = port;
        INIT_DELAYED_WORK(&priv->delayed_setup_work, setup_line);
        INIT_DELAYED_WORK(&priv->delayed_write_work, send_data);
@@ -664,11 +662,15 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (1) {
-                wait_event_interruptible(priv->intr_wait,
+                wait_event_interruptible(port->delta_msr_wait,
+                                        port->serial->disconnected ||
                                        priv->status.pin_state != prev);
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->status.pin_state & PIN_MASK;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -763,7 +765,7 @@ static void oti6858_read_int_callback(struct urb *urb)
                if (!priv->transient) {
                        if (xs->pin_state != priv->status.pin_state)
-                                wake_up_interruptible(&priv->intr_wait);
+                                wake_up_interruptible(&port->delta_msr_wait);
                        memcpy(&priv->status, xs, OTI6858_CTRL_PKT_SIZE);
                }
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 54adc9125e5c..3b10018d89a3 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -139,7 +139,6 @@ struct pl2303_serial_private {
 struct pl2303_private {
        spinlock_t lock;
-        wait_queue_head_t delta_msr_wait;
        u8 line_control;
        u8 line_status;
 };
@@ -233,7 +232,6 @@ static int pl2303_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        usb_set_serial_port_data(port, priv);
@@ -607,11 +605,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (1) {
-                interruptible_sleep_on(&priv->delta_msr_wait);
+                interruptible_sleep_on(&port->delta_msr_wait);
                /* see if a signal did it */
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->line_status;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -719,7 +720,7 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
        spin_unlock_irqrestore(&priv->lock, flags);
        if (priv->line_status & UART_BREAK_ERROR)
                usb_serial_handle_break(port);
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        tty = tty_port_tty_get(&port->port);
        if (!tty)
@@ -783,7 +784,7 @@ static void pl2303_process_read_urb(struct urb *urb)
        line_status = priv->line_status;
        priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
        spin_unlock_irqrestore(&priv->lock, flags);
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        if (!urb->actual_length)
                return;
diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
index d643a4d4d770..75f125ddb0c9 100644
--- a/drivers/usb/serial/quatech2.c
+++ b/drivers/usb/serial/quatech2.c
@@ -128,7 +128,6 @@ struct qt2_port_private {
        u8          shadowLSR;
        u8          shadowMSR;
-        wait_queue_head_t   delta_msr_wait; /* Used for TIOCMIWAIT */
        struct async_icount icount;
        struct usb_serial_port *port;
@@ -506,8 +505,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->lock, flags);
        while (1) {
-                wait_event_interruptible(priv->delta_msr_wait,
+                wait_event_interruptible(port->delta_msr_wait,
-                                         ((priv->icount.rng != prev.rng) ||
+                                         (port->serial->disconnected ||
+                                          (priv->icount.rng != prev.rng) ||
                                          (priv->icount.dsr != prev.dsr) ||
                                          (priv->icount.dcd != prev.dcd) ||
                                          (priv->icount.cts != prev.cts)));
@@ -515,6 +515,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                cur = priv->icount;
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -827,7 +830,6 @@ static int qt2_port_probe(struct usb_serial_port *port)
        spin_lock_init(&port_priv->lock);
        spin_lock_init(&port_priv->urb_lock);
-        init_waitqueue_head(&port_priv->delta_msr_wait);
        port_priv->port = port;
        port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -970,7 +972,7 @@ static void qt2_update_msr(struct usb_serial_port *port, unsigned char *ch)
                if (newMSR & UART_MSR_TERI)
                        port_priv->icount.rng++;
-                wake_up_interruptible(&port_priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
        }
 }
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 91ff8e3bddbd..549ef68ff5fa 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -149,7 +149,6 @@ enum spcp8x5_type {
 struct spcp8x5_private {
        spinlock_t      lock;
        enum spcp8x5_type       type;
-        wait_queue_head_t       delta_msr_wait;
        u8                      line_control;
        u8                      line_status;
 };
@@ -179,7 +178,6 @@ static int spcp8x5_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        priv->type = type;
        usb_set_serial_port_data(port , priv);
@@ -475,7 +473,7 @@ static void spcp8x5_process_read_urb(struct urb *urb)
        priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
        spin_unlock_irqrestore(&priv->lock, flags);
        /* wake up the wait for termios */
-        wake_up_interruptible(&priv->delta_msr_wait);
+        wake_up_interruptible(&port->delta_msr_wait);
        if (!urb->actual_length)
                return;
@@ -526,12 +524,15 @@ static int spcp8x5_wait_modem_info(struct usb_serial_port *port,
        while (1) {
                /* wake up in bulk read */
-                interruptible_sleep_on(&priv->delta_msr_wait);
+                interruptible_sleep_on(&port->delta_msr_wait);
                /* see if a signal did it */
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->lock, flags);
                status = priv->line_status;
                spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
index b57cf841c5b6..4b2a19757b4d 100644
--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -61,7 +61,6 @@ struct ssu100_port_private {
        spinlock_t status_lock;
        u8 shadowLSR;
        u8 shadowMSR;
-        wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
        struct async_icount icount;
 };
@@ -355,8 +354,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
        spin_unlock_irqrestore(&priv->status_lock, flags);
        while (1) {
-                wait_event_interruptible(priv->delta_msr_wait,
+                wait_event_interruptible(port->delta_msr_wait,
-                                         ((priv->icount.rng != prev.rng) ||
+                                         (port->serial->disconnected ||
+                                          (priv->icount.rng != prev.rng) ||
                                          (priv->icount.dsr != prev.dsr) ||
                                          (priv->icount.dcd != prev.dcd) ||
                                          (priv->icount.cts != prev.cts)));
@@ -364,6 +364,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
                if (signal_pending(current))
                        return -ERESTARTSYS;
+                if (port->serial->disconnected)
+                        return -EIO;
                spin_lock_irqsave(&priv->status_lock, flags);
                cur = priv->icount;
                spin_unlock_irqrestore(&priv->status_lock, flags);
@@ -445,7 +448,6 @@ static int ssu100_port_probe(struct usb_serial_port *port)
                return -ENOMEM;
        spin_lock_init(&priv->status_lock);
-        init_waitqueue_head(&priv->delta_msr_wait);
        usb_set_serial_port_data(port, priv);
@@ -537,7 +539,7 @@ static void ssu100_update_msr(struct usb_serial_port *port, u8 msr)
                        priv->icount.dcd++;
                if (msr & UART_MSR_TERI)
                        priv->icount.rng++;
-                wake_up_interruptible(&priv->delta_msr_wait);
+                wake_up_interruptible(&port->delta_msr_wait);
        }
 }
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 39cb9b807c3c..73deb029fc05 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -74,7 +74,6 @@ struct ti_port {
        int                     tp_flags;
        int                     tp_closing_wait;/* in .01 secs */
        struct async_icount     tp_icount;
-        wait_queue_head_t       tp_msr_wait;    /* wait for msr change */
        wait_queue_head_t       tp_write_wait;
        struct ti_device        *tp_tdev;
        struct usb_serial_port  *tp_port;
@@ -432,7 +431,6 @@ static int ti_port_probe(struct usb_serial_port *port)
        else
                tport->tp_uart_base_addr = TI_UART2_BASE_ADDR;
        tport->tp_closing_wait = closing_wait;
-        init_waitqueue_head(&tport->tp_msr_wait);
        init_waitqueue_head(&tport->tp_write_wait);
        if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE, GFP_KERNEL)) {
                kfree(tport);
@@ -784,9 +782,13 @@ static int ti_ioctl(struct tty_struct *tty,
                dev_dbg(&port->dev, "%s - TIOCMIWAIT\n", __func__);
                cprev = tport->tp_icount;
                while (1) {
-                        interruptible_sleep_on(&tport->tp_msr_wait);
+                        interruptible_sleep_on(&port->delta_msr_wait);
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+                        if (port->serial->disconnected)
+                                return -EIO;
                        cnow = tport->tp_icount;
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -1392,7 +1394,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
                        icount->dcd++;
                if (msr & TI_MSR_DELTA_RI)
                        icount->rng++;
-                wake_up_interruptible(&tport->tp_msr_wait);
+                wake_up_interruptible(&tport->tp_port->delta_msr_wait);
                spin_unlock_irqrestore(&tport->tp_lock, flags);
        }
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index a19ed74d770d..2e70efa08b77 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -151,6 +151,7 @@ static void destroy_serial(struct kref *kref)
                }
        }
+        usb_put_intf(serial->interface);
        usb_put_dev(serial->dev);
        kfree(serial);
 }
@@ -620,7 +621,7 @@ static struct usb_serial *create_serial(struct usb_device *dev,
        }
        serial->dev = usb_get_dev(dev);
        serial->type = driver;
-        serial->interface = interface;
+        serial->interface = usb_get_intf(interface);
        kref_init(&serial->kref);
        mutex_init(&serial->disc_mutex);
        serial->minor = SERIAL_TTY_NO_MINOR;
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index da04a074e790..1799335288bd 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -496,6 +496,13 @@ UNUSUAL_DEV(  0x04e8, 0x5122, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+/* Added by Dmitry Artamonow <mad_soft@inbox.ru> */
+UNUSUAL_DEV(  0x04e8, 0x5136, 0x0000, 0x9999,
+                "Samsung",
+                "YP-Z3",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64),
 /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
 * Device uses standards-violating 32-byte Bulk Command Block Wrappers and
 * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index 964ff22bf281..aeb00fc2d3be 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -27,6 +27,7 @@
 #include <linux/pci.h>
 #include <linux/uaccess.h>
 #include <linux/vfio.h>
+#include <linux/slab.h>
 #include "vfio_pci_private.h"
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 3639371fa697..a96509187deb 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -22,6 +22,7 @@
 #include <linux/vfio.h>
 #include <linux/wait.h>
 #include <linux/workqueue.h>
+#include <linux/slab.h>
 #include "vfio_pci_private.h"
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 959b1cd89e6a..ec6fb3fa59bb 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -339,7 +339,8 @@ static void handle_tx(struct vhost_net *net)
                                msg.msg_controllen = 0;
                                ubufs = NULL;
                        } else {
-                                struct ubuf_info *ubuf = &vq->ubuf_info[head];
+                                struct ubuf_info *ubuf;
+                                ubuf = vq->ubuf_info + vq->upend_idx;
                                vq->heads[vq->upend_idx].len =
                                        VHOST_DMA_IN_PROGRESS;
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 12cf5f31ee8f..025428e04c33 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -422,17 +422,22 @@ static int atmel_lcdfb_check_var(struct fb_var_screeninfo *var,
                        = var->bits_per_pixel;
                break;
        case 16:
+                /* Older SOCs use IBGR:555 rather than BGR:565. */
+                if (sinfo->have_intensity_bit)
+                        var->green.length = 5;
+                else
+                        var->green.length = 6;
                if (sinfo->lcd_wiring_mode == ATMEL_LCDC_WIRING_RGB) {
-                        /* RGB:565 mode */
+                        /* RGB:5X5 mode */
-                        var->red.offset = 11;
+                        var->red.offset = var->green.length + 5;
                        var->blue.offset = 0;
                } else {
-                        /* BGR:565 mode */
+                        /* BGR:5X5 mode */
                        var->red.offset = 0;
-                        var->blue.offset = 11;
+                        var->blue.offset = var->green.length + 5;
                }
                var->green.offset = 5;
-                var->green.length = 6;
                var->red.length = var->blue.length = 5;
                break;
        case 32:
@@ -679,8 +684,7 @@ static int atmel_lcdfb_setcolreg(unsigned int regno, unsigned int red,
        case FB_VISUAL_PSEUDOCOLOR:
                if (regno < 256) {
-                        if (cpu_is_at91sam9261() || cpu_is_at91sam9263()
+                        if (sinfo->have_intensity_bit) {
-                            || cpu_is_at91sam9rl()) {
                                /* old style I+BGR:555 */
                                val  = ((red   >> 11) & 0x001f);
                                val |= ((green >>  6) & 0x03e0);
@@ -870,6 +874,10 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev)
        }
        sinfo->info = info;
        sinfo->pdev = pdev;
+        if (cpu_is_at91sam9261() || cpu_is_at91sam9263() ||
+                                                        cpu_is_at91sam9rl()) {
+                sinfo->have_intensity_bit = true;
+        }
        strcpy(info->fix.id, sinfo->pdev->name);
        info->flags = ATMEL_LCDFB_FBINFO_DEFAULT;
diff --git a/drivers/video/ep93xx-fb.c b/drivers/video/ep93xx-fb.c
index 3f2519d30715..e06cd5d90c97 100644
--- a/drivers/video/ep93xx-fb.c
+++ b/drivers/video/ep93xx-fb.c
@@ -23,6 +23,7 @@
 #include <linux/slab.h>
 #include <linux/clk.h>
 #include <linux/fb.h>
+#include <linux/io.h>
 #include <linux/platform_data/video-ep93xx.h>
diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
index e3b8f757d2d3..0e9d8c479c35 100644
--- a/drivers/watchdog/sp5100_tco.c
+++ b/drivers/watchdog/sp5100_tco.c
@@ -40,13 +40,12 @@
 #include "sp5100_tco.h"
 /* Module and version information */
-#define TCO_VERSION "0.03"
+#define TCO_VERSION "0.05"
 #define TCO_MODULE_NAME "SP5100 TCO timer"
 #define TCO_DRIVER_NAME   TCO_MODULE_NAME ", v" TCO_VERSION
 /* internal variables */
 static u32 tcobase_phys;
-static u32 resbase_phys;
 static u32 tco_wdt_fired;
 static void __iomem *tcobase;
 static unsigned int pm_iobase;
@@ -54,10 +53,6 @@ static DEFINE_SPINLOCK(tco_lock);	/* Guards the hardware */
 static unsigned long timer_alive;
 static char tco_expect_close;
 static struct pci_dev *sp5100_tco_pci;
-static struct resource wdt_res = {
-        .name = "Watchdog Timer",
-        .flags = IORESOURCE_MEM,
-};
 /* the watchdog platform device */
 static struct platform_device *sp5100_tco_platform_device;
@@ -75,12 +70,6 @@ module_param(nowayout, bool, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started."
                " (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
-static unsigned int force_addr;
-module_param(force_addr, uint, 0);
-MODULE_PARM_DESC(force_addr, "Force the use of specified MMIO address."
-                " ONLY USE THIS PARAMETER IF YOU REALLY KNOW"
-                " WHAT YOU ARE DOING (default=none)");
 /*
 * Some TCO specific functions
 */
@@ -176,39 +165,6 @@ static void tco_timer_enable(void)
        }
 }
-static void tco_timer_disable(void)
-{
-        int val;
-        if (sp5100_tco_pci->revision >= 0x40) {
-                /* For SB800 or later */
-                /* Enable watchdog decode bit and Disable watchdog timer */
-                outb(SB800_PM_WATCHDOG_CONTROL, SB800_IO_PM_INDEX_REG);
-                val = inb(SB800_IO_PM_DATA_REG);
-                val |= SB800_PCI_WATCHDOG_DECODE_EN;
-                val |= SB800_PM_WATCHDOG_DISABLE;
-                outb(val, SB800_IO_PM_DATA_REG);
-        } else {
-                /* For SP5100 or SB7x0 */
-                /* Enable watchdog decode bit */
-                pci_read_config_dword(sp5100_tco_pci,
-                                      SP5100_PCI_WATCHDOG_MISC_REG,
-                                      &val);
-                val |= SP5100_PCI_WATCHDOG_DECODE_EN;
-                pci_write_config_dword(sp5100_tco_pci,
-                                       SP5100_PCI_WATCHDOG_MISC_REG,
-                                       val);
-                /* Disable Watchdog timer */
-                outb(SP5100_PM_WATCHDOG_CONTROL, SP5100_IO_PM_INDEX_REG);
-                val = inb(SP5100_IO_PM_DATA_REG);
-                val |= SP5100_PM_WATCHDOG_DISABLE;
-                outb(val, SP5100_IO_PM_DATA_REG);
-        }
-}
 /*
 *      /dev/watchdog handling
 */
@@ -361,7 +317,7 @@ static unsigned char sp5100_tco_setupdevice(void)
 {
        struct pci_dev *dev = NULL;
        const char *dev_name = NULL;
-        u32 val, tmp_val;
+        u32 val;
        u32 index_reg, data_reg, base_addr;
        /* Match the PCI device */
@@ -459,63 +415,8 @@ static unsigned char sp5100_tco_setupdevice(void)
        } else
                pr_debug("SBResource_MMIO is disabled(0x%04x)\n", val);
-        /*
+        pr_notice("failed to find MMIO address, giving up.\n");
-         * Lastly re-programming the watchdog timer MMIO address,
+        goto  unreg_region;
-         * This method is a last resort...
-         *
-         * Before re-programming, to ensure that the watchdog timer
-         * is disabled, disable the watchdog timer.
-         */
-        tco_timer_disable();
-        if (force_addr) {
-                /*
-                 * Force the use of watchdog timer MMIO address, and aligned to
-                 * 8byte boundary.
-                 */
-                force_addr &= ~0x7;
-                val = force_addr;
-                pr_info("Force the use of 0x%04x as MMIO address\n", val);
-        } else {
-                /*
-                 * Get empty slot into the resource tree for watchdog timer.
-                 */
-                if (allocate_resource(&iomem_resource,
-                                      &wdt_res,
-                                      SP5100_WDT_MEM_MAP_SIZE,
-                                      0xf0000000,
-                                      0xfffffff8,
-                                      0x8,
-                                      NULL,
-                                      NULL)) {
-                        pr_err("MMIO allocation failed\n");
-                        goto unreg_region;
-                }
-                val = resbase_phys = wdt_res.start;
-                pr_debug("Got 0x%04x from resource tree\n", val);
-        }
-        /* Restore to the low three bits */
-        outb(base_addr+0, index_reg);
-        tmp_val = val | (inb(data_reg) & 0x7);
-        /* Re-programming the watchdog timer base address */
-        outb(base_addr+0, index_reg);
-        outb((tmp_val >>  0) & 0xff, data_reg);
-        outb(base_addr+1, index_reg);
-        outb((tmp_val >>  8) & 0xff, data_reg);
-        outb(base_addr+2, index_reg);
-        outb((tmp_val >> 16) & 0xff, data_reg);
-        outb(base_addr+3, index_reg);
-        outb((tmp_val >> 24) & 0xff, data_reg);
-        if (!request_mem_region_exclusive(val, SP5100_WDT_MEM_MAP_SIZE,
-                                                                   dev_name)) {
-                pr_err("MMIO address 0x%04x already in use\n", val);
-                goto unreg_resource;
-        }
 setup_wdt:
        tcobase_phys = val;
@@ -555,9 +456,6 @@ setup_wdt:
 unreg_mem_region:
        release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
-unreg_resource:
-        if (resbase_phys)
-                release_resource(&wdt_res);
 unreg_region:
        release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
 exit:
@@ -567,7 +465,6 @@ exit:
 static int sp5100_tco_init(struct platform_device *dev)
 {
        int ret;
-        char addr_str[16];
        /*
         * Check whether or not the hardware watchdog is there. If found, then
@@ -599,23 +496,14 @@ static int sp5100_tco_init(struct platform_device *dev)
        clear_bit(0, &timer_alive);
        /* Show module parameters */
-        if (force_addr == tcobase_phys)
+        pr_info("initialized (0x%p). heartbeat=%d sec (nowayout=%d)\n",
-                /* The force_addr is vaild */
+                tcobase, heartbeat, nowayout);
-                sprintf(addr_str, "0x%04x", force_addr);
-        else
-                strcpy(addr_str, "none");
-        pr_info("initialized (0x%p). heartbeat=%d sec (nowayout=%d, "
-                "force_addr=%s)\n",
-                tcobase, heartbeat, nowayout, addr_str);
        return 0;
 exit:
        iounmap(tcobase);
        release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
-        if (resbase_phys)
-                release_resource(&wdt_res);
        release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
        return ret;
 }
@@ -630,8 +518,6 @@ static void sp5100_tco_cleanup(void)
        misc_deregister(&sp5100_tco_miscdev);
        iounmap(tcobase);
        release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
-        if (resbase_phys)
-                release_resource(&wdt_res);
        release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
 }
diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h
index 71594a0c14b7..2b28c00da0df 100644
--- a/drivers/watchdog/sp5100_tco.h
+++ b/drivers/watchdog/sp5100_tco.h
@@ -57,7 +57,7 @@
 #define SB800_PM_WATCHDOG_DISABLE       (1 << 2)
 #define SB800_PM_WATCHDOG_SECOND_RES    (3 << 0)
 #define SB800_ACPI_MMIO_DECODE_EN       (1 << 0)
-#define SB800_ACPI_MMIO_SEL             (1 << 2)
+#define SB800_ACPI_MMIO_SEL             (1 << 1)
 #define SB800_PM_WDT_MMIO_OFFSET        0xB00