35 files changed, 553 insertions, 206 deletions

diff --git a/drivers/block/nvme.c b/drivers/block/nvme.c
index 38a2d0631882..ad16c68c8645 100644
--- a/drivers/block/nvme.c
+++ b/drivers/block/nvme.c
@@ -79,6 +79,7 @@ struct nvme_dev {
         char serial[20];
         char model[40];
         char firmware_rev[8];
+        u32 max_hw_sectors;
 };
 
 /*
@@ -835,15 +836,15 @@ static int nvme_identify(struct nvme_dev *dev, unsigned nsid, unsigned cns,
 }
 
 static int nvme_get_features(struct nvme_dev *dev, unsigned fid,
-                                unsigned dword11, dma_addr_t dma_addr)
+                                unsigned nsid, dma_addr_t dma_addr)
 {
         struct nvme_command c;
 
         memset(&c, 0, sizeof(c));
         c.features.opcode = nvme_admin_get_features;
+        c.features.nsid = cpu_to_le32(nsid);
         c.features.prp1 = cpu_to_le64(dma_addr);
         c.features.fid = cpu_to_le32(fid);
-        c.features.dword11 = cpu_to_le32(dword11);
 
         return nvme_submit_admin_cmd(dev, &c, NULL);
 }
@@ -862,11 +863,51 @@ static int nvme_set_features(struct nvme_dev *dev, unsigned fid,
         return nvme_submit_admin_cmd(dev, &c, result);
 }
 
+/**
+ * nvme_cancel_ios - Cancel outstanding I/Os
+ * @queue: The queue to cancel I/Os on
+ * @timeout: True to only cancel I/Os which have timed out
+ */
+static void nvme_cancel_ios(struct nvme_queue *nvmeq, bool timeout)
+{
+        int depth = nvmeq->q_depth - 1;
+        struct nvme_cmd_info *info = nvme_cmd_info(nvmeq);
+        unsigned long now = jiffies;
+        int cmdid;
+
+        for_each_set_bit(cmdid, nvmeq->cmdid_data, depth) {
+                void *ctx;
+                nvme_completion_fn fn;
+                static struct nvme_completion cqe = {
+                        .status = cpu_to_le16(NVME_SC_ABORT_REQ) << 1,
+                };
+
+                if (timeout && !time_after(now, info[cmdid].timeout))
+                        continue;
+                dev_warn(nvmeq->q_dmadev, "Cancelling I/O %d\n", cmdid);
+                ctx = cancel_cmdid(nvmeq, cmdid, &fn);
+                fn(nvmeq->dev, ctx, &cqe);
+        }
+}
+
+static void nvme_free_queue_mem(struct nvme_queue *nvmeq)
+{
+        dma_free_coherent(nvmeq->q_dmadev, CQ_SIZE(nvmeq->q_depth),
+                                (void *)nvmeq->cqes, nvmeq->cq_dma_addr);
+        dma_free_coherent(nvmeq->q_dmadev, SQ_SIZE(nvmeq->q_depth),
+                                        nvmeq->sq_cmds, nvmeq->sq_dma_addr);
+        kfree(nvmeq);
+}
+
 static void nvme_free_queue(struct nvme_dev *dev, int qid)
 {
         struct nvme_queue *nvmeq = dev->queues[qid];
         int vector = dev->entry[nvmeq->cq_vector].vector;
 
+        spin_lock_irq(&nvmeq->q_lock);
+        nvme_cancel_ios(nvmeq, false);
+        spin_unlock_irq(&nvmeq->q_lock);
+
         irq_set_affinity_hint(vector, NULL);
         free_irq(vector, nvmeq);
 
@@ -876,18 +917,15 @@ static void nvme_free_queue(struct nvme_dev *dev, int qid)
                 adapter_delete_cq(dev, qid);
         }
 
-        dma_free_coherent(nvmeq->q_dmadev, CQ_SIZE(nvmeq->q_depth),
-                                (void *)nvmeq->cqes, nvmeq->cq_dma_addr);
-        dma_free_coherent(nvmeq->q_dmadev, SQ_SIZE(nvmeq->q_depth),
-                                        nvmeq->sq_cmds, nvmeq->sq_dma_addr);
-        kfree(nvmeq);
+        nvme_free_queue_mem(nvmeq);
 }
 
 static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid,
                                                         int depth, int vector)
 {
         struct device *dmadev = &dev->pci_dev->dev;
-        unsigned extra = (depth / 8) + (depth * sizeof(struct nvme_cmd_info));
+        unsigned extra = DIV_ROUND_UP(depth, 8) + (depth *
+                                                sizeof(struct nvme_cmd_info));
         struct nvme_queue *nvmeq = kzalloc(sizeof(*nvmeq) + extra, GFP_KERNEL);
         if (!nvmeq)
                 return NULL;
@@ -975,7 +1013,7 @@ static __devinit struct nvme_queue *nvme_create_queue(struct nvme_dev *dev,
 
 static int __devinit nvme_configure_admin_queue(struct nvme_dev *dev)
 {
-        int result;
+        int result = 0;
         u32 aqa;
         u64 cap;
         unsigned long timeout;
@@ -1005,17 +1043,22 @@ static int __devinit nvme_configure_admin_queue(struct nvme_dev *dev)
         timeout = ((NVME_CAP_TIMEOUT(cap) + 1) * HZ / 2) + jiffies;
         dev->db_stride = NVME_CAP_STRIDE(cap);
 
-        while (!(readl(&dev->bar->csts) & NVME_CSTS_RDY)) {
+        while (!result && !(readl(&dev->bar->csts) & NVME_CSTS_RDY)) {
                 msleep(100);
                 if (fatal_signal_pending(current))
-                        return -EINTR;
+                        result = -EINTR;
                 if (time_after(jiffies, timeout)) {
                         dev_err(&dev->pci_dev->dev,
                                 "Device not ready; aborting initialisation\n");
-                        return -ENODEV;
+                        result = -ENODEV;
                 }
         }
 
+        if (result) {
+                nvme_free_queue_mem(nvmeq);
+                return result;
+        }
+
         result = queue_request_irq(dev, nvmeq, "nvme admin");
         dev->queues[0] = nvmeq;
         return result;
@@ -1037,6 +1080,8 @@ static struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
         offset = offset_in_page(addr);
         count = DIV_ROUND_UP(offset + length, PAGE_SIZE);
         pages = kcalloc(count, sizeof(*pages), GFP_KERNEL);
+        if (!pages)
+                return ERR_PTR(-ENOMEM);
 
         err = get_user_pages_fast(addr, count, 1, pages);
         if (err < count) {
@@ -1146,14 +1191,13 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
         return status;
 }
 
-static int nvme_user_admin_cmd(struct nvme_ns *ns,
+static int nvme_user_admin_cmd(struct nvme_dev *dev,
                                         struct nvme_admin_cmd __user *ucmd)
 {
-        struct nvme_dev *dev = ns->dev;
         struct nvme_admin_cmd cmd;
         struct nvme_command c;
         int status, length;
-        struct nvme_iod *iod;
+        struct nvme_iod *uninitialized_var(iod);
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -1204,7 +1248,7 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
         case NVME_IOCTL_ID:
                 return ns->ns_id;
         case NVME_IOCTL_ADMIN_CMD:
-                return nvme_user_admin_cmd(ns, (void __user *)arg);
+                return nvme_user_admin_cmd(ns->dev, (void __user *)arg);
         case NVME_IOCTL_SUBMIT_IO:
                 return nvme_submit_io(ns, (void __user *)arg);
         default:
@@ -1218,26 +1262,6 @@ static const struct block_device_operations nvme_fops = {
         .compat_ioctl   = nvme_ioctl,
 };
 
-static void nvme_timeout_ios(struct nvme_queue *nvmeq)
-{
-        int depth = nvmeq->q_depth - 1;
-        struct nvme_cmd_info *info = nvme_cmd_info(nvmeq);
-        unsigned long now = jiffies;
-        int cmdid;
-
-        for_each_set_bit(cmdid, nvmeq->cmdid_data, depth) {
-                void *ctx;
-                nvme_completion_fn fn;
-                static struct nvme_completion cqe = { .status = cpu_to_le16(NVME_SC_ABORT_REQ) << 1, };
-
-                if (!time_after(now, info[cmdid].timeout))
-                        continue;
-                dev_warn(nvmeq->q_dmadev, "Timing out I/O %d\n", cmdid);
-                ctx = cancel_cmdid(nvmeq, cmdid, &fn);
-                fn(nvmeq->dev, ctx, &cqe);
-        }
-}
-
 static void nvme_resubmit_bios(struct nvme_queue *nvmeq)
 {
         while (bio_list_peek(&nvmeq->sq_cong)) {
@@ -1269,7 +1293,7 @@ static int nvme_kthread(void *data)
                                 spin_lock_irq(&nvmeq->q_lock);
                                 if (nvme_process_cq(nvmeq))
                                         printk("process_cq did something\n");
-                                nvme_timeout_ios(nvmeq);
+                                nvme_cancel_ios(nvmeq, true);
                                 nvme_resubmit_bios(nvmeq);
                                 spin_unlock_irq(&nvmeq->q_lock);
                         }
@@ -1339,6 +1363,9 @@ static struct nvme_ns *nvme_alloc_ns(struct nvme_dev *dev, int nsid,
         ns->disk = disk;
         lbaf = id->flbas & 0xf;
         ns->lba_shift = id->lbaf[lbaf].ds;
+        blk_queue_logical_block_size(ns->queue, 1 << ns->lba_shift);
+        if (dev->max_hw_sectors)
+                blk_queue_max_hw_sectors(ns->queue, dev->max_hw_sectors);
 
         disk->major = nvme_major;
         disk->minors = NVME_MINORS;
@@ -1383,7 +1410,7 @@ static int set_queue_count(struct nvme_dev *dev, int count)
 
 static int __devinit nvme_setup_io_queues(struct nvme_dev *dev)
 {
-        int result, cpu, i, nr_io_queues, db_bar_size;
+        int result, cpu, i, nr_io_queues, db_bar_size, q_depth;
 
         nr_io_queues = num_online_cpus();
         result = set_queue_count(dev, nr_io_queues);
@@ -1429,9 +1456,10 @@ static int __devinit nvme_setup_io_queues(struct nvme_dev *dev)
                 cpu = cpumask_next(cpu, cpu_online_mask);
         }
 
+        q_depth = min_t(int, NVME_CAP_MQES(readq(&dev->bar->cap)) + 1,
+                                                                NVME_Q_DEPTH);
         for (i = 0; i < nr_io_queues; i++) {
-                dev->queues[i + 1] = nvme_create_queue(dev, i + 1,
-                                                        NVME_Q_DEPTH, i);
+                dev->queues[i + 1] = nvme_create_queue(dev, i + 1, q_depth, i);
                 if (IS_ERR(dev->queues[i + 1]))
                         return PTR_ERR(dev->queues[i + 1]);
                 dev->queue_count++;
@@ -1480,6 +1508,10 @@ static int __devinit nvme_dev_add(struct nvme_dev *dev)
         memcpy(dev->serial, ctrl->sn, sizeof(ctrl->sn));
         memcpy(dev->model, ctrl->mn, sizeof(ctrl->mn));
         memcpy(dev->firmware_rev, ctrl->fr, sizeof(ctrl->fr));
+        if (ctrl->mdts) {
+                int shift = NVME_CAP_MPSMIN(readq(&dev->bar->cap)) + 12;
+                dev->max_hw_sectors = 1 << (ctrl->mdts + shift - 9);
+        }
 
         id_ns = mem;
         for (i = 1; i <= nn; i++) {
@@ -1523,8 +1555,6 @@ static int nvme_dev_remove(struct nvme_dev *dev)
         list_del(&dev->node);
         spin_unlock(&dev_list_lock);
 
-        /* TODO: wait all I/O finished or cancel them */
-
         list_for_each_entry_safe(ns, next, &dev->namespaces, list) {
                 list_del(&ns->list);
                 del_gendisk(ns->disk);
@@ -1560,15 +1590,33 @@ static void nvme_release_prp_pools(struct nvme_dev *dev)
         dma_pool_destroy(dev->prp_small_pool);
 }
 
-/* XXX: Use an ida or something to let remove / add work correctly */
-static void nvme_set_instance(struct nvme_dev *dev)
+static DEFINE_IDA(nvme_instance_ida);
+
+static int nvme_set_instance(struct nvme_dev *dev)
 {
-        static int instance;
-        dev->instance = instance++;
+        int instance, error;
+
+        do {
+                if (!ida_pre_get(&nvme_instance_ida, GFP_KERNEL))
+                        return -ENODEV;
+
+                spin_lock(&dev_list_lock);
+                error = ida_get_new(&nvme_instance_ida, &instance);
+                spin_unlock(&dev_list_lock);
+        } while (error == -EAGAIN);
+
+        if (error)
+                return -ENODEV;
+
+        dev->instance = instance;
+        return 0;
 }
 
 static void nvme_release_instance(struct nvme_dev *dev)
 {
+        spin_lock(&dev_list_lock);
+        ida_remove(&nvme_instance_ida, dev->instance);
+        spin_unlock(&dev_list_lock);
 }
 
 static int __devinit nvme_probe(struct pci_dev *pdev,
@@ -1601,7 +1649,10 @@ static int __devinit nvme_probe(struct pci_dev *pdev,
         pci_set_drvdata(pdev, dev);
         dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
         dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
-        nvme_set_instance(dev);
+        result = nvme_set_instance(dev);
+        if (result)
+                goto disable;
+
         dev->entry[0].vector = pdev->irq;
 
         result = nvme_setup_prp_pools(dev);
@@ -1704,15 +1755,17 @@ static struct pci_driver nvme_driver = {
 
 static int __init nvme_init(void)
 {
-        int result = -EBUSY;
+        int result;
 
         nvme_thread = kthread_run(nvme_kthread, NULL, "nvme");
         if (IS_ERR(nvme_thread))
                 return PTR_ERR(nvme_thread);
 
-        nvme_major = register_blkdev(nvme_major, "nvme");
-        if (nvme_major <= 0)
+        result = register_blkdev(nvme_major, "nvme");
+        if (result < 0)
                 goto kill_kthread;
+        else if (result > 0)
+                nvme_major = result;
 
         result = pci_register_driver(&nvme_driver);
         if (result)
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 9917943a3572..54a55f03115d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -246,13 +246,12 @@ static int rbd_open(struct block_device *bdev, fmode_t mode)
 {
         struct rbd_device *rbd_dev = bdev->bd_disk->private_data;
 
-        rbd_get_dev(rbd_dev);
-
-        set_device_ro(bdev, rbd_dev->read_only);
-
         if ((mode & FMODE_WRITE) && rbd_dev->read_only)
                 return -EROFS;
 
+        rbd_get_dev(rbd_dev);
+        set_device_ro(bdev, rbd_dev->read_only);
+
         return 0;
 }
 
diff --git a/drivers/gpio/gpio-lpc32xx.c b/drivers/gpio/gpio-lpc32xx.c
index 8a420f13905e..ed94b4ea72e9 100644
--- a/drivers/gpio/gpio-lpc32xx.c
+++ b/drivers/gpio/gpio-lpc32xx.c
@@ -308,6 +308,7 @@ static int lpc32xx_gpio_dir_output_p012(struct gpio_chip *chip, unsigned pin,
 {
         struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
 
+        __set_gpio_level_p012(group, pin, value);
         __set_gpio_dir_p012(group, pin, 0);
 
         return 0;
@@ -318,6 +319,7 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,
 {
         struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
 
+        __set_gpio_level_p3(group, pin, value);
         __set_gpio_dir_p3(group, pin, 0);
 
         return 0;
@@ -326,6 +328,9 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,
 static int lpc32xx_gpio_dir_out_always(struct gpio_chip *chip, unsigned pin,
         int value)
 {
+        struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
+
+        __set_gpo_level_p3(group, pin, value);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index ff23d88880e5..3ca240b4413d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -179,7 +179,7 @@ nouveau_abi16_ioctl_grobj_alloc(ABI16_IOCTL_ARGS)
                         return 0;
         } else
         if (init->class == 0x906e) {
-                NV_ERROR(dev, "906e not supported yet\n");
+                NV_DEBUG(dev, "906e not supported yet\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/gpu/drm/nouveau/nvc0_fb.c b/drivers/gpu/drm/nouveau/nvc0_fb.c
index f704e942372e..f376c39310df 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fb.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fb.c
@@ -124,6 +124,7 @@ nvc0_fb_init(struct drm_device *dev)
         priv = dev_priv->engine.fb.priv;
 
         nv_wr32(dev, 0x100c10, priv->r100c10 >> 8);
+        nv_mask(dev, 0x17e820, 0x00100000, 0x00000000); /* NV_PLTCG_INTR_EN */
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvc0_fifo.c b/drivers/gpu/drm/nouveau/nvc0_fifo.c
index 7d85553d518c..cd39eb99f5b1 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fifo.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fifo.c
@@ -373,7 +373,8 @@ nvc0_fifo_isr_subfifo_intr(struct drm_device *dev, int unit)
 static void
 nvc0_fifo_isr(struct drm_device *dev)
 {
-        u32 stat = nv_rd32(dev, 0x002100);
+        u32 mask = nv_rd32(dev, 0x002140);
+        u32 stat = nv_rd32(dev, 0x002100) & mask;
 
         if (stat & 0x00000100) {
                 NV_INFO(dev, "PFIFO: unknown status 0x00000100\n");
diff --git a/drivers/gpu/drm/nouveau/nve0_fifo.c b/drivers/gpu/drm/nouveau/nve0_fifo.c
index e98d144e6eb9..281bece751b6 100644
--- a/drivers/gpu/drm/nouveau/nve0_fifo.c
+++ b/drivers/gpu/drm/nouveau/nve0_fifo.c
@@ -345,7 +345,8 @@ nve0_fifo_isr_subfifo_intr(struct drm_device *dev, int unit)
 static void
 nve0_fifo_isr(struct drm_device *dev)
 {
-        u32 stat = nv_rd32(dev, 0x002100);
+        u32 mask = nv_rd32(dev, 0x002140);
+        u32 stat = nv_rd32(dev, 0x002100) & mask;
 
         if (stat & 0x00000100) {
                 NV_INFO(dev, "PFIFO: unknown status 0x00000100\n");
diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index ba055e9ca007..8d9dc44f1f94 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -69,6 +69,13 @@ static int udl_get_modes(struct drm_connector *connector)
 static int udl_mode_valid(struct drm_connector *connector,
                           struct drm_display_mode *mode)
 {
+        struct udl_device *udl = connector->dev->dev_private;
+        if (!udl->sku_pixel_limit)
+                return 0;
+
+        if (mode->vdisplay * mode->hdisplay > udl->sku_pixel_limit)
+                return MODE_VIRTUAL_Y;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index f2fb8f15e2f1..7e0743358dff 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -1018,7 +1018,7 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
         }
 
 
-        event = kzalloc(sizeof(event->event), GFP_KERNEL);
+        event = kzalloc(sizeof(*event), GFP_KERNEL);
         if (unlikely(event == NULL)) {
                 DRM_ERROR("Failed to allocate an event.\n");
                 ret = -ENOMEM;
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index b64502dfa9f4..e89daf1b21b4 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -266,7 +266,7 @@ static void swap_pci_ref(struct pci_dev **from, struct pci_dev *to)
 
 static int iommu_init_device(struct device *dev)
 {
-        struct pci_dev *dma_pdev, *pdev = to_pci_dev(dev);
+        struct pci_dev *dma_pdev = NULL, *pdev = to_pci_dev(dev);
         struct iommu_dev_data *dev_data;
         struct iommu_group *group;
         u16 alias;
@@ -293,7 +293,9 @@ static int iommu_init_device(struct device *dev)
                 dev_data->alias_data = alias_data;
 
                 dma_pdev = pci_get_bus_and_slot(alias >> 8, alias & 0xff);
-        } else
+        }
+
+        if (dma_pdev == NULL)
                 dma_pdev = pci_dev_get(pdev);
 
         /* Account for quirked devices */
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index d8abb90a6c2f..034233eefc82 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1555,6 +1555,7 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
                            unsigned long arg)
 {
         struct multipath *m = ti->private;
+        struct pgpath *pgpath;
         struct block_device *bdev;
         fmode_t mode;
         unsigned long flags;
@@ -1570,12 +1571,14 @@ again:
         if (!m->current_pgpath)
                 __choose_pgpath(m, 0);
 
-        if (m->current_pgpath) {
-                bdev = m->current_pgpath->path.dev->bdev;
-                mode = m->current_pgpath->path.dev->mode;
+        pgpath = m->current_pgpath;
+
+        if (pgpath) {
+                bdev = pgpath->path.dev->bdev;
+                mode = pgpath->path.dev->mode;
         }
 
-        if (m->queue_io)
+        if ((pgpath && m->queue_io) || (!pgpath && m->queue_if_no_path))
                 r = -EAGAIN;
         else if (!bdev)
                 r = -EIO;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index f90069029aae..100368eb7991 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1212,6 +1212,41 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
         return &t->targets[(KEYS_PER_NODE * n) + k];
 }
 
+static int count_device(struct dm_target *ti, struct dm_dev *dev,
+                        sector_t start, sector_t len, void *data)
+{
+        unsigned *num_devices = data;
+
+        (*num_devices)++;
+
+        return 0;
+}
+
+/*
+ * Check whether a table has no data devices attached using each
+ * target's iterate_devices method.
+ * Returns false if the result is unknown because a target doesn't
+ * support iterate_devices.
+ */
+bool dm_table_has_no_data_devices(struct dm_table *table)
+{
+        struct dm_target *uninitialized_var(ti);
+        unsigned i = 0, num_devices = 0;
+
+        while (i < dm_table_get_num_targets(table)) {
+                ti = dm_table_get_target(table, i++);
+
+                if (!ti->type->iterate_devices)
+                        return false;
+
+                ti->type->iterate_devices(ti, count_device, &num_devices);
+                if (num_devices)
+                        return false;
+        }
+
+        return true;
+}
+
 /*
  * Establish the new table's queue_limits and validate them.
  */
@@ -1354,17 +1389,25 @@ static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,
         return q && blk_queue_nonrot(q);
 }
 
-static bool dm_table_is_nonrot(struct dm_table *t)
+static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
+                             sector_t start, sector_t len, void *data)
+{
+        struct request_queue *q = bdev_get_queue(dev->bdev);
+
+        return q && !blk_queue_add_random(q);
+}
+
+static bool dm_table_all_devices_attribute(struct dm_table *t,
+                                           iterate_devices_callout_fn func)
 {
         struct dm_target *ti;
         unsigned i = 0;
 
-        /* Ensure that all underlying device are non-rotational. */
         while (i < dm_table_get_num_targets(t)) {
                 ti = dm_table_get_target(t, i++);
 
                 if (!ti->type->iterate_devices ||
-                    !ti->type->iterate_devices(ti, device_is_nonrot, NULL))
+                    !ti->type->iterate_devices(ti, func, NULL))
                         return 0;
         }
 
@@ -1396,7 +1439,8 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         if (!dm_table_discard_zeroes_data(t))
                 q->limits.discard_zeroes_data = 0;
 
-        if (dm_table_is_nonrot(t))
+        /* Ensure that all underlying devices are non-rotational. */
+        if (dm_table_all_devices_attribute(t, device_is_nonrot))
                 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
         else
                 queue_flag_clear_unlocked(QUEUE_FLAG_NONROT, q);
@@ -1404,6 +1448,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         dm_table_set_integrity(t);
 
         /*
+         * Determine whether or not this queue's I/O timings contribute
+         * to the entropy pool, Only request-based targets use this.
+         * Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
+         * have it set.
+         */
+        if (blk_queue_add_random(q) && dm_table_all_devices_attribute(t, device_is_not_random))
+                queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, q);
+
+        /*
          * QUEUE_FLAG_STACKABLE must be set after all queue settings are
          * visible to other CPUs because, once the flag is set, incoming bios
          * are processed by request-based dm, which refers to the queue
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index af1fc3b2c2ad..c29410af1e22 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -509,9 +509,9 @@ enum pool_mode {
 struct pool_features {
         enum pool_mode mode;
 
-        unsigned zero_new_blocks:1;
-        unsigned discard_enabled:1;
-        unsigned discard_passdown:1;
+        bool zero_new_blocks:1;
+        bool discard_enabled:1;
+        bool discard_passdown:1;
 };
 
 struct thin_c;
@@ -580,7 +580,8 @@ struct pool_c {
         struct dm_target_callbacks callbacks;
 
         dm_block_t low_water_blocks;
-        struct pool_features pf;
+        struct pool_features requested_pf; /* Features requested during table load */
+        struct pool_features adjusted_pf;  /* Features used after adjusting for constituent devices */
 };
 
 /*
@@ -1839,6 +1840,47 @@ static void __requeue_bios(struct pool *pool)
 /*----------------------------------------------------------------
  * Binding of control targets to a pool object
  *--------------------------------------------------------------*/
+static bool data_dev_supports_discard(struct pool_c *pt)
+{
+        struct request_queue *q = bdev_get_queue(pt->data_dev->bdev);
+
+        return q && blk_queue_discard(q);
+}
+
+/*
+ * If discard_passdown was enabled verify that the data device
+ * supports discards.  Disable discard_passdown if not.
+ */
+static void disable_passdown_if_not_supported(struct pool_c *pt)
+{
+        struct pool *pool = pt->pool;
+        struct block_device *data_bdev = pt->data_dev->bdev;
+        struct queue_limits *data_limits = &bdev_get_queue(data_bdev)->limits;
+        sector_t block_size = pool->sectors_per_block << SECTOR_SHIFT;
+        const char *reason = NULL;
+        char buf[BDEVNAME_SIZE];
+
+        if (!pt->adjusted_pf.discard_passdown)
+                return;
+
+        if (!data_dev_supports_discard(pt))
+                reason = "discard unsupported";
+
+        else if (data_limits->max_discard_sectors < pool->sectors_per_block)
+                reason = "max discard sectors smaller than a block";
+
+        else if (data_limits->discard_granularity > block_size)
+                reason = "discard granularity larger than a block";
+
+        else if (block_size & (data_limits->discard_granularity - 1))
+                reason = "discard granularity not a factor of block size";
+
+        if (reason) {
+                DMWARN("Data device (%s) %s: Disabling discard passdown.", bdevname(data_bdev, buf), reason);
+                pt->adjusted_pf.discard_passdown = false;
+        }
+}
+
 static int bind_control_target(struct pool *pool, struct dm_target *ti)
 {
         struct pool_c *pt = ti->private;
@@ -1847,31 +1889,16 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
          * We want to make sure that degraded pools are never upgraded.
          */
         enum pool_mode old_mode = pool->pf.mode;
-        enum pool_mode new_mode = pt->pf.mode;
+        enum pool_mode new_mode = pt->adjusted_pf.mode;
 
         if (old_mode > new_mode)
                 new_mode = old_mode;
 
         pool->ti = ti;
         pool->low_water_blocks = pt->low_water_blocks;
-        pool->pf = pt->pf;
-        set_pool_mode(pool, new_mode);
+        pool->pf = pt->adjusted_pf;
 
-        /*
-         * If discard_passdown was enabled verify that the data device
-         * supports discards.  Disable discard_passdown if not; otherwise
-         * -EOPNOTSUPP will be returned.
-         */
-        /* FIXME: pull this out into a sep fn. */
-        if (pt->pf.discard_passdown) {
-                struct request_queue *q = bdev_get_queue(pt->data_dev->bdev);
-                if (!q || !blk_queue_discard(q)) {
-                        char buf[BDEVNAME_SIZE];
-                        DMWARN("Discard unsupported by data device (%s): Disabling discard passdown.",
-                               bdevname(pt->data_dev->bdev, buf));
-                        pool->pf.discard_passdown = 0;
-                }
-        }
+        set_pool_mode(pool, new_mode);
 
         return 0;
 }
@@ -1889,9 +1916,9 @@ static void unbind_control_target(struct pool *pool, struct dm_target *ti)
 static void pool_features_init(struct pool_features *pf)
 {
         pf->mode = PM_WRITE;
-        pf->zero_new_blocks = 1;
-        pf->discard_enabled = 1;
-        pf->discard_passdown = 1;
+        pf->zero_new_blocks = true;
+        pf->discard_enabled = true;
+        pf->discard_passdown = true;
 }
 
 static void __pool_destroy(struct pool *pool)
@@ -2119,13 +2146,13 @@ static int parse_pool_features(struct dm_arg_set *as, struct pool_features *pf,
                 argc--;
 
                 if (!strcasecmp(arg_name, "skip_block_zeroing"))
-                        pf->zero_new_blocks = 0;
+                        pf->zero_new_blocks = false;
 
                 else if (!strcasecmp(arg_name, "ignore_discard"))
-                        pf->discard_enabled = 0;
+                        pf->discard_enabled = false;
 
                 else if (!strcasecmp(arg_name, "no_discard_passdown"))
-                        pf->discard_passdown = 0;
+                        pf->discard_passdown = false;
 
                 else if (!strcasecmp(arg_name, "read_only"))
                         pf->mode = PM_READ_ONLY;
@@ -2259,8 +2286,9 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
         pt->metadata_dev = metadata_dev;
         pt->data_dev = data_dev;
         pt->low_water_blocks = low_water_blocks;
-        pt->pf = pf;
+        pt->adjusted_pf = pt->requested_pf = pf;
         ti->num_flush_requests = 1;
+
         /*
          * Only need to enable discards if the pool should pass
          * them down to the data device.  The thin device's discard
@@ -2268,12 +2296,14 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
          */
         if (pf.discard_enabled && pf.discard_passdown) {
                 ti->num_discard_requests = 1;
+
                 /*
                  * Setting 'discards_supported' circumvents the normal
                  * stacking of discard limits (this keeps the pool and
                  * thin devices' discard limits consistent).
                  */
                 ti->discards_supported = true;
+                ti->discard_zeroes_data_unsupported = true;
         }
         ti->private = pt;
 
@@ -2703,7 +2733,7 @@ static int pool_status(struct dm_target *ti, status_type_t type,
                        format_dev_t(buf2, pt->data_dev->bdev->bd_dev),
                        (unsigned long)pool->sectors_per_block,
                        (unsigned long long)pt->low_water_blocks);
-                emit_flags(&pt->pf, result, sz, maxlen);
+                emit_flags(&pt->requested_pf, result, sz, maxlen);
                 break;
         }
 
@@ -2732,20 +2762,21 @@ static int pool_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
         return min(max_size, q->merge_bvec_fn(q, bvm, biovec));
 }
 
-static void set_discard_limits(struct pool *pool, struct queue_limits *limits)
+static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits)
 {
-        /*
-         * FIXME: these limits may be incompatible with the pool's data device
-         */
+        struct pool *pool = pt->pool;
+        struct queue_limits *data_limits;
+
         limits->max_discard_sectors = pool->sectors_per_block;
 
         /*
-         * This is just a hint, and not enforced.  We have to cope with
-         * bios that cover a block partially.  A discard that spans a block
-         * boundary is not sent to this target.
+         * discard_granularity is just a hint, and not enforced.
          */
-        limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
-        limits->discard_zeroes_data = pool->pf.zero_new_blocks;
+        if (pt->adjusted_pf.discard_passdown) {
+                data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits;
+                limits->discard_granularity = data_limits->discard_granularity;
+        } else
+                limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
 }
 
 static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
@@ -2755,15 +2786,25 @@ static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
 
         blk_limits_io_min(limits, 0);
         blk_limits_io_opt(limits, pool->sectors_per_block << SECTOR_SHIFT);
-        if (pool->pf.discard_enabled)
-                set_discard_limits(pool, limits);
+
+        /*
+         * pt->adjusted_pf is a staging area for the actual features to use.
+         * They get transferred to the live pool in bind_control_target()
+         * called from pool_preresume().
+         */
+        if (!pt->adjusted_pf.discard_enabled)
+                return;
+
+        disable_passdown_if_not_supported(pt);
+
+        set_discard_limits(pt, limits);
 }
 
 static struct target_type pool_target = {
         .name = "thin-pool",
         .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                     DM_TARGET_IMMUTABLE,
-        .version = {1, 3, 0},
+        .version = {1, 4, 0},
         .module = THIS_MODULE,
         .ctr = pool_ctr,
         .dtr = pool_dtr,
@@ -3042,19 +3083,19 @@ static int thin_iterate_devices(struct dm_target *ti,
         return 0;
 }
 
+/*
+ * A thin device always inherits its queue limits from its pool.
+ */
 static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 {
         struct thin_c *tc = ti->private;
-        struct pool *pool = tc->pool;
 
-        blk_limits_io_min(limits, 0);
-        blk_limits_io_opt(limits, pool->sectors_per_block << SECTOR_SHIFT);
-        set_discard_limits(pool, limits);
+        *limits = bdev_get_queue(tc->pool_dev->bdev)->limits;
 }
 
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 3, 0},
+        .version = {1, 4, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
index 254d19268ad2..892ae2766aa6 100644
--- a/drivers/md/dm-verity.c
+++ b/drivers/md/dm-verity.c
@@ -718,8 +718,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
         v->hash_dev_block_bits = ffs(num) - 1;
 
         if (sscanf(argv[5], "%llu%c", &num_ll, &dummy) != 1 ||
-            num_ll << (v->data_dev_block_bits - SECTOR_SHIFT) !=
-            (sector_t)num_ll << (v->data_dev_block_bits - SECTOR_SHIFT)) {
+            (sector_t)(num_ll << (v->data_dev_block_bits - SECTOR_SHIFT))
+            >> (v->data_dev_block_bits - SECTOR_SHIFT) != num_ll) {
                 ti->error = "Invalid data blocks";
                 r = -EINVAL;
                 goto bad;
@@ -733,8 +733,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
         }
 
         if (sscanf(argv[6], "%llu%c", &num_ll, &dummy) != 1 ||
-            num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT) !=
-            (sector_t)num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT)) {
+            (sector_t)(num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT))
+            >> (v->hash_dev_block_bits - SECTOR_SHIFT) != num_ll) {
                 ti->error = "Invalid hash start";
                 r = -EINVAL;
                 goto bad;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 4e09b6ff5b49..67ffa391edcf 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -865,10 +865,14 @@ static void dm_done(struct request *clone, int error, bool mapped)
 {
         int r = error;
         struct dm_rq_target_io *tio = clone->end_io_data;
-        dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
+        dm_request_endio_fn rq_end_io = NULL;
 
-        if (mapped && rq_end_io)
-                r = rq_end_io(tio->ti, clone, error, &tio->info);
+        if (tio->ti) {
+                rq_end_io = tio->ti->type->rq_end_io;
+
+                if (mapped && rq_end_io)
+                        r = rq_end_io(tio->ti, clone, error, &tio->info);
+        }
 
         if (r <= 0)
                 /* The target wants to complete the I/O */
@@ -1588,15 +1592,6 @@ static int map_request(struct dm_target *ti, struct request *clone,
         int r, requeued = 0;
         struct dm_rq_target_io *tio = clone->end_io_data;
 
-        /*
-         * Hold the md reference here for the in-flight I/O.
-         * We can't rely on the reference count by device opener,
-         * because the device may be closed during the request completion
-         * when all bios are completed.
-         * See the comment in rq_completed() too.
-         */
-        dm_get(md);
-
         tio->ti = ti;
         r = ti->type->map_rq(ti, clone, &tio->info);
         switch (r) {
@@ -1628,6 +1623,26 @@ static int map_request(struct dm_target *ti, struct request *clone,
         return requeued;
 }
 
+static struct request *dm_start_request(struct mapped_device *md, struct request *orig)
+{
+        struct request *clone;
+
+        blk_start_request(orig);
+        clone = orig->special;
+        atomic_inc(&md->pending[rq_data_dir(clone)]);
+
+        /*
+         * Hold the md reference here for the in-flight I/O.
+         * We can't rely on the reference count by device opener,
+         * because the device may be closed during the request completion
+         * when all bios are completed.
+         * See the comment in rq_completed() too.
+         */
+        dm_get(md);
+
+        return clone;
+}
+
 /*
  * q->request_fn for request-based dm.
  * Called with the queue lock held.
@@ -1657,14 +1672,21 @@ static void dm_request_fn(struct request_queue *q)
                         pos = blk_rq_pos(rq);
 
                 ti = dm_table_find_target(map, pos);
-                BUG_ON(!dm_target_is_valid(ti));
+                if (!dm_target_is_valid(ti)) {
+                        /*
+                         * Must perform setup, that dm_done() requires,
+                         * before calling dm_kill_unmapped_request
+                         */
+                        DMERR_LIMIT("request attempted access beyond the end of device");
+                        clone = dm_start_request(md, rq);
+                        dm_kill_unmapped_request(clone, -EIO);
+                        continue;
+                }
 
                 if (ti->type->busy && ti->type->busy(ti))
                         goto delay_and_out;
 
-                blk_start_request(rq);
-                clone = rq->special;
-                atomic_inc(&md->pending[rq_data_dir(clone)]);
+                clone = dm_start_request(md, rq);
 
                 spin_unlock(q->queue_lock);
                 if (map_request(ti, clone, md))
@@ -1684,8 +1706,6 @@ delay_and_out:
         blk_delay_queue(q, HZ / 10);
 out:
         dm_table_put(map);
-
-        return;
 }
 
 int dm_underlying_device_busy(struct request_queue *q)
@@ -2409,7 +2429,7 @@ static void dm_queue_flush(struct mapped_device *md)
  */
 struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
 {
-        struct dm_table *map = ERR_PTR(-EINVAL);
+        struct dm_table *live_map, *map = ERR_PTR(-EINVAL);
         struct queue_limits limits;
         int r;
 
@@ -2419,6 +2439,19 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
         if (!dm_suspended_md(md))
                 goto out;
 
+        /*
+         * If the new table has no data devices, retain the existing limits.
+         * This helps multipath with queue_if_no_path if all paths disappear,
+         * then new I/O is queued based on these limits, and then some paths
+         * reappear.
+         */
+        if (dm_table_has_no_data_devices(table)) {
+                live_map = dm_get_live_table(md);
+                if (live_map)
+                        limits = md->queue->limits;
+                dm_table_put(live_map);
+        }
+
         r = dm_calculate_queue_limits(table, &limits);
         if (r) {
                 map = ERR_PTR(r);
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 52eef493d266..6a99fefaa743 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -54,6 +54,7 @@ void dm_table_event_callback(struct dm_table *t,
                              void (*fn)(void *), void *context);
 struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index);
 struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector);
+bool dm_table_has_no_data_devices(struct dm_table *table);
 int dm_calculate_queue_limits(struct dm_table *table,
                               struct queue_limits *limits);
 void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1c2eb38f3c51..0138a727c1f3 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1512,14 +1512,16 @@ static int _enough(struct r10conf *conf, struct geom *geo, int ignore)
         do {
                 int n = conf->copies;
                 int cnt = 0;
+                int this = first;
                 while (n--) {
-                        if (conf->mirrors[first].rdev &&
-                            first != ignore)
+                        if (conf->mirrors[this].rdev &&
+                            this != ignore)
                                 cnt++;
-                        first = (first+1) % geo->raid_disks;
+                        this = (this+1) % geo->raid_disks;
                 }
                 if (cnt == 0)
                         return 0;
+                first = (first + geo->near_copies) % geo->raid_disks;
         } while (first != 0);
         return 1;
 }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 7031b865b3a0..0689173fd9f5 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1591,6 +1591,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
                 #ifdef CONFIG_MULTICORE_RAID456
                 init_waitqueue_head(&nsh->ops.wait_for_ops);
                 #endif
+                spin_lock_init(&nsh->stripe_lock);
 
                 list_add(&nsh->lru, &newstripes);
         }
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index f2f482bec573..a6e74514e662 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -1123,6 +1123,33 @@ static unsigned long mtdchar_get_unmapped_area(struct file *file,
 }
 #endif
 
+static inline unsigned long get_vm_size(struct vm_area_struct *vma)
+{
+        return vma->vm_end - vma->vm_start;
+}
+
+static inline resource_size_t get_vm_offset(struct vm_area_struct *vma)
+{
+        return (resource_size_t) vma->vm_pgoff << PAGE_SHIFT;
+}
+
+/*
+ * Set a new vm offset.
+ *
+ * Verify that the incoming offset really works as a page offset,
+ * and that the offset and size fit in a resource_size_t.
+ */
+static inline int set_vm_offset(struct vm_area_struct *vma, resource_size_t off)
+{
+        pgoff_t pgoff = off >> PAGE_SHIFT;
+        if (off != (resource_size_t) pgoff << PAGE_SHIFT)
+                return -EINVAL;
+        if (off + get_vm_size(vma) - 1 < off)
+                return -EINVAL;
+        vma->vm_pgoff = pgoff;
+        return 0;
+}
+
 /*
  * set up a mapping for shared memory segments
  */
@@ -1132,20 +1159,29 @@ static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma)
         struct mtd_file_info *mfi = file->private_data;
         struct mtd_info *mtd = mfi->mtd;
         struct map_info *map = mtd->priv;
-        unsigned long start;
-        unsigned long off;
-        u32 len;
+        resource_size_t start, off;
+        unsigned long len, vma_len;
 
         if (mtd->type == MTD_RAM || mtd->type == MTD_ROM) {
-                off = vma->vm_pgoff << PAGE_SHIFT;
+                off = get_vm_offset(vma);
                 start = map->phys;
                 len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
                 start &= PAGE_MASK;
-                if ((vma->vm_end - vma->vm_start + off) > len)
+                vma_len = get_vm_size(vma);
+
+                /* Overflow in off+len? */
+                if (vma_len + off < off)
+                        return -EINVAL;
+                /* Does it fit in the mapping? */
+                if (vma_len + off > len)
                         return -EINVAL;
 
                 off += start;
-                vma->vm_pgoff = off >> PAGE_SHIFT;
+                /* Did that overflow? */
+                if (off < start)
+                        return -EINVAL;
+                if (set_vm_offset(vma, off) < 0)
+                        return -EINVAL;
                 vma->vm_flags |= VM_IO | VM_RESERVED;
 
 #ifdef pgprot_noncached
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 79cebd8525ce..e48312f2305d 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -8564,7 +8564,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
 error:
-        iounmap(bp->regview);
+        pci_iounmap(pdev, bp->regview);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/ethernet/octeon/octeon_mgmt.c b/drivers/net/ethernet/octeon/octeon_mgmt.c
index c42bbb16cdae..a688a2ddcfd6 100644
--- a/drivers/net/ethernet/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/octeon/octeon_mgmt.c
@@ -722,10 +722,8 @@ static int octeon_mgmt_init_phy(struct net_device *netdev)
                                    octeon_mgmt_adjust_link, 0,
                                    PHY_INTERFACE_MODE_MII);
 
-        if (IS_ERR(p->phydev)) {
-                p->phydev = NULL;
+        if (!p->phydev)
                 return -1;
-        }
 
         phy_start_aneg(p->phydev);
 
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index e559dfa06d6a..6fa74d530e44 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1101,9 +1101,9 @@ static int pasemi_mac_phy_init(struct net_device *dev)
         phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
                                 PHY_INTERFACE_MODE_SGMII);
 
-        if (IS_ERR(phydev)) {
+        if (!phydev) {
                 printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
-                return PTR_ERR(phydev);
+                return -ENODEV;
         }
 
         mac->phydev = phydev;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
index b8ead696141e..2a179d087207 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
@@ -15,7 +15,7 @@ qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
 
         do {
                 /* give atleast 1ms for firmware to respond */
-                msleep(1);
+                mdelay(1);
 
                 if (++timeout > QLCNIC_OS_CRB_RETRY_COUNT)
                         return QLCNIC_CDRP_RSP_TIMEOUT;
@@ -601,7 +601,7 @@ void qlcnic_fw_destroy_ctx(struct qlcnic_adapter *adapter)
                 qlcnic_fw_cmd_destroy_tx_ctx(adapter);
 
                 /* Allow dma queues to drain after context reset */
-                msleep(20);
+                mdelay(20);
         }
 }
 
diff --git a/drivers/net/phy/bcm87xx.c b/drivers/net/phy/bcm87xx.c
index 2346b38b9837..799789518e87 100644
--- a/drivers/net/phy/bcm87xx.c
+++ b/drivers/net/phy/bcm87xx.c
@@ -229,3 +229,5 @@ static void __exit bcm87xx_exit(void)
                 ARRAY_SIZE(bcm87xx_driver));
 }
 module_exit(bcm87xx_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index cf287e0eb408..2165d5fdb8c0 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -21,6 +21,12 @@
 #include <linux/phy.h>
 #include <linux/micrel_phy.h>
 
+/* Operation Mode Strap Override */
+#define MII_KSZPHY_OMSO                         0x16
+#define KSZPHY_OMSO_B_CAST_OFF                  (1 << 9)
+#define KSZPHY_OMSO_RMII_OVERRIDE               (1 << 1)
+#define KSZPHY_OMSO_MII_OVERRIDE                (1 << 0)
+
 /* general Interrupt control/status reg in vendor specific block. */
 #define MII_KSZPHY_INTCS                        0x1B
 #define KSZPHY_INTCS_JABBER                     (1 << 15)
@@ -101,6 +107,13 @@ static int kszphy_config_init(struct phy_device *phydev)
         return 0;
 }
 
+static int ksz8021_config_init(struct phy_device *phydev)
+{
+        const u16 val = KSZPHY_OMSO_B_CAST_OFF | KSZPHY_OMSO_RMII_OVERRIDE;
+        phy_write(phydev, MII_KSZPHY_OMSO, val);
+        return 0;
+}
+
 static int ks8051_config_init(struct phy_device *phydev)
 {
         int regval;
@@ -128,9 +141,22 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = ks8737_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8041,
+        .phy_id         = PHY_ID_KSZ8021,
+        .phy_id_mask    = 0x00ffffff,
+        .name           = "Micrel KSZ8021",
+        .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+        .config_init    = ksz8021_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = kszphy_ack_interrupt,
+        .config_intr    = kszphy_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
+        .phy_id         = PHY_ID_KSZ8041,
         .phy_id_mask    = 0x00fffff0,
-        .name           = "Micrel KS8041",
+        .name           = "Micrel KSZ8041",
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
                                 | SUPPORTED_Asym_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -141,9 +167,9 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = kszphy_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8051,
+        .phy_id         = PHY_ID_KSZ8051,
         .phy_id_mask    = 0x00fffff0,
-        .name           = "Micrel KS8051",
+        .name           = "Micrel KSZ8051",
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
                                 | SUPPORTED_Asym_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -154,8 +180,8 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = kszphy_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8001,
-        .name           = "Micrel KS8001 or KS8721",
+        .phy_id         = PHY_ID_KSZ8001,
+        .name           = "Micrel KSZ8001 or KS8721",
         .phy_id_mask    = 0x00ffffff,
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -201,10 +227,11 @@ MODULE_LICENSE("GPL");
 
 static struct mdio_device_id __maybe_unused micrel_tbl[] = {
         { PHY_ID_KSZ9021, 0x000ffffe },
-        { PHY_ID_KS8001, 0x00ffffff },
+        { PHY_ID_KSZ8001, 0x00ffffff },
         { PHY_ID_KS8737, 0x00fffff0 },
-        { PHY_ID_KS8041, 0x00fffff0 },
-        { PHY_ID_KS8051, 0x00fffff0 },
+        { PHY_ID_KSZ8021, 0x00ffffff },
+        { PHY_ID_KSZ8041, 0x00fffff0 },
+        { PHY_ID_KSZ8051, 0x00fffff0 },
         { }
 };
 
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index 6d6192316b30..88e3991464e7 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -56,6 +56,32 @@ static int smsc_phy_config_init(struct phy_device *phydev)
         return smsc_phy_ack_interrupt (phydev);
 }
 
+static int lan87xx_config_init(struct phy_device *phydev)
+{
+        /*
+         * Make sure the EDPWRDOWN bit is NOT set. Setting this bit on
+         * LAN8710/LAN8720 PHY causes the PHY to misbehave, likely due
+         * to a bug on the chip.
+         *
+         * When the system is powered on with the network cable being
+         * disconnected all the way until after ifconfig ethX up is
+         * issued for the LAN port with this PHY, connecting the cable
+         * afterwards does not cause LINK change detection, while the
+         * expected behavior is the Link UP being detected.
+         */
+        int rc = phy_read(phydev, MII_LAN83C185_CTRL_STATUS);
+        if (rc < 0)
+                return rc;
+
+        rc &= ~MII_LAN83C185_EDPWRDOWN;
+
+        rc = phy_write(phydev, MII_LAN83C185_CTRL_STATUS, rc);
+        if (rc < 0)
+                return rc;
+
+        return smsc_phy_ack_interrupt(phydev);
+}
+
 static int lan911x_config_init(struct phy_device *phydev)
 {
         return smsc_phy_ack_interrupt(phydev);
@@ -162,7 +188,7 @@ static struct phy_driver smsc_phy_driver[] = {
         /* basic functions */
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
-        .config_init    = smsc_phy_config_init,
+        .config_init    = lan87xx_config_init,
 
         /* IRQ related */
         .ack_interrupt  = smsc_phy_ack_interrupt,
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index cbf7047decc0..20f31d0d1536 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -570,7 +570,7 @@ static int pppoe_release(struct socket *sock)
 
         po = pppox_sk(sk);
 
-        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
                 dev_put(po->pppoe_dev);
                 po->pppoe_dev = NULL;
         }
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 341b65dbbcd3..f8cd61f449a4 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -848,7 +848,7 @@ static struct netpoll_info *team_netpoll_info(struct team *team)
 }
 #endif
 
-static void __team_port_change_check(struct team_port *port, bool linkup);
+static void __team_port_change_port_added(struct team_port *port, bool linkup);
 
 static int team_port_add(struct team *team, struct net_device *port_dev)
 {
@@ -948,7 +948,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
         team_port_enable(team, port);
         list_add_tail_rcu(&port->list, &team->port_list);
         __team_compute_features(team);
-        __team_port_change_check(port, !!netif_carrier_ok(port_dev));
+        __team_port_change_port_added(port, !!netif_carrier_ok(port_dev));
         __team_options_change_check(team);
 
         netdev_info(dev, "Port device %s added\n", portname);
@@ -983,6 +983,8 @@ err_set_mtu:
         return err;
 }
 
+static void __team_port_change_port_removed(struct team_port *port);
+
 static int team_port_del(struct team *team, struct net_device *port_dev)
 {
         struct net_device *dev = team->dev;
@@ -999,8 +1001,7 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
         __team_option_inst_mark_removed_port(team, port);
         __team_options_change_check(team);
         __team_option_inst_del_port(team, port);
-        port->removed = true;
-        __team_port_change_check(port, false);
+        __team_port_change_port_removed(port);
         team_port_disable(team, port);
         list_del_rcu(&port->list);
         netdev_rx_handler_unregister(port_dev);
@@ -1652,8 +1653,8 @@ static int team_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info)
 
         hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq,
                           &team_nl_family, 0, TEAM_CMD_NOOP);
-        if (IS_ERR(hdr)) {
-                err = PTR_ERR(hdr);
+        if (!hdr) {
+                err = -EMSGSIZE;
                 goto err_msg_put;
         }
 
@@ -1847,8 +1848,8 @@ start_again:
 
         hdr = genlmsg_put(skb, pid, seq, &team_nl_family, flags | NLM_F_MULTI,
                           TEAM_CMD_OPTIONS_GET);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -EMSGSIZE;
 
         if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
                 goto nla_put_failure;
@@ -2067,8 +2068,8 @@ static int team_nl_fill_port_list_get(struct sk_buff *skb,
 
         hdr = genlmsg_put(skb, pid, seq, &team_nl_family, flags,
                           TEAM_CMD_PORT_LIST_GET);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -EMSGSIZE;
 
         if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
                 goto nla_put_failure;
@@ -2251,13 +2252,11 @@ static void __team_options_change_check(struct team *team)
 }
 
 /* rtnl lock is held */
-static void __team_port_change_check(struct team_port *port, bool linkup)
+
+static void __team_port_change_send(struct team_port *port, bool linkup)
 {
         int err;
 
-        if (!port->removed && port->state.linkup == linkup)
-                return;
-
         port->changed = true;
         port->state.linkup = linkup;
         team_refresh_port_linkup(port);
@@ -2282,6 +2281,23 @@ send_event:
 
 }
 
+static void __team_port_change_check(struct team_port *port, bool linkup)
+{
+        if (port->state.linkup != linkup)
+                __team_port_change_send(port, linkup);
+}
+
+static void __team_port_change_port_added(struct team_port *port, bool linkup)
+{
+        __team_port_change_send(port, linkup);
+}
+
+static void __team_port_change_port_removed(struct team_port *port)
+{
+        port->removed = true;
+        __team_port_change_send(port, false);
+}
+
 static void team_port_change_check(struct team_port *port, bool linkup)
 {
         struct team *team = port->team;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index f5ab6e613ec8..376143e8a1aa 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -1253,6 +1253,7 @@ static struct usb_driver smsc75xx_driver = {
         .probe          = usbnet_probe,
         .suspend        = usbnet_suspend,
         .resume         = usbnet_resume,
+        .reset_resume   = usbnet_resume,
         .disconnect     = usbnet_disconnect,
         .disable_hub_initiated_lpm = 1,
 };
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 1e86ea2266d4..dbeebef562d5 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1442,6 +1442,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         return err;
 
 err_free_irq:
+        trans_pcie->irq_requested = false;
         free_irq(trans_pcie->irq, trans);
 error:
         iwl_free_isr_ict(trans);
diff --git a/drivers/sh/pfc/pinctrl.c b/drivers/sh/pfc/pinctrl.c
index a3ac39b79192..0646bf6e7889 100644
--- a/drivers/sh/pfc/pinctrl.c
+++ b/drivers/sh/pfc/pinctrl.c
@@ -208,6 +208,8 @@ static int sh_pfc_gpio_request_enable(struct pinctrl_dev *pctldev,
 
                 break;
         case PINMUX_TYPE_GPIO:
+        case PINMUX_TYPE_INPUT:
+        case PINMUX_TYPE_OUTPUT:
                 break;
         default:
                 pr_err("Unsupported mux type (%d), bailing...\n", pinmux_type);
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index d95696584762..3440812b4a84 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -624,7 +624,7 @@ static ssize_t usb_device_read(struct file *file, char __user *buf,
         /* print devices for all busses */
         list_for_each_entry(bus, &usb_bus_list, bus_list) {
                 /* recurse through all children of the root hub */
-                if (!bus->root_hub)
+                if (!bus_to_hcd(bus)->rh_registered)
                         continue;
                 usb_lock_device(bus->root_hub);
                 ret = usb_device_dump(&buf, &nbytes, &skip_bytes, ppos,
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index bc84106ac057..75ba2091f9b4 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1011,10 +1011,7 @@ static int register_root_hub(struct usb_hcd *hcd)
         if (retval) {
                 dev_err (parent_dev, "can't register root hub for %s, %d\n",
                                 dev_name(&usb_dev->dev), retval);
-        }
-        mutex_unlock(&usb_bus_list_lock);
-
-        if (retval == 0) {
+        } else {
                 spin_lock_irq (&hcd_root_hub_lock);
                 hcd->rh_registered = 1;
                 spin_unlock_irq (&hcd_root_hub_lock);
@@ -1023,6 +1020,7 @@ static int register_root_hub(struct usb_hcd *hcd)
                 if (HCD_DEAD(hcd))
                         usb_hc_died (hcd);      /* This time clean up */
         }
+        mutex_unlock(&usb_bus_list_lock);
 
         return retval;
 }
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index aaa8d2bce217..0bf72f943b00 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -467,7 +467,8 @@ static irqreturn_t ohci_hcd_at91_overcurrent_irq(int irq, void *data)
         /* From the GPIO notifying the over-current situation, find
          * out the corresponding port */
         at91_for_each_port(port) {
-                if (gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
+                if (gpio_is_valid(pdata->overcurrent_pin[port]) &&
+                                gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
                         gpio = pdata->overcurrent_pin[port];
                         break;
                 }
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 211a4920b88a..d8dedc7d3910 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -76,9 +76,24 @@ static int virqfd_wakeup(wait_queue_t *wait, unsigned mode, int sync, void *key)
                         schedule_work(&virqfd->inject);
         }
 
-        if (flags & POLLHUP)
-                /* The eventfd is closing, detach from VFIO */
-                virqfd_deactivate(virqfd);
+        if (flags & POLLHUP) {
+                unsigned long flags;
+                spin_lock_irqsave(&virqfd->vdev->irqlock, flags);
+
+                /*
+                 * The eventfd is closing, if the virqfd has not yet been
+                 * queued for release, as determined by testing whether the
+                 * vdev pointer to it is still valid, queue it now.  As
+                 * with kvm irqfds, we know we won't race against the virqfd
+                 * going away because we hold wqh->lock to get here.
+                 */
+                if (*(virqfd->pvirqfd) == virqfd) {
+                        *(virqfd->pvirqfd) = NULL;
+                        virqfd_deactivate(virqfd);
+                }
+
+                spin_unlock_irqrestore(&virqfd->vdev->irqlock, flags);
+        }
 
         return 0;
 }
@@ -93,7 +108,6 @@ static void virqfd_ptable_queue_proc(struct file *file,
 static void virqfd_shutdown(struct work_struct *work)
 {
         struct virqfd *virqfd = container_of(work, struct virqfd, shutdown);
-        struct virqfd **pvirqfd = virqfd->pvirqfd;
         u64 cnt;
 
         eventfd_ctx_remove_wait_queue(virqfd->eventfd, &virqfd->wait, &cnt);
@@ -101,7 +115,6 @@ static void virqfd_shutdown(struct work_struct *work)
         eventfd_ctx_put(virqfd->eventfd);
 
         kfree(virqfd);
-        *pvirqfd = NULL;
 }
 
 static void virqfd_inject(struct work_struct *work)
@@ -122,15 +135,11 @@ static int virqfd_enable(struct vfio_pci_device *vdev,
         int ret = 0;
         unsigned int events;
 
-        if (*pvirqfd)
-                return -EBUSY;
-
         virqfd = kzalloc(sizeof(*virqfd), GFP_KERNEL);
         if (!virqfd)
                 return -ENOMEM;
 
         virqfd->pvirqfd = pvirqfd;
-        *pvirqfd = virqfd;
         virqfd->vdev = vdev;
         virqfd->handler = handler;
         virqfd->thread = thread;
@@ -154,6 +163,23 @@ static int virqfd_enable(struct vfio_pci_device *vdev,
         virqfd->eventfd = ctx;
 
         /*
+         * virqfds can be released by closing the eventfd or directly
+         * through ioctl.  These are both done through a workqueue, so
+         * we update the pointer to the virqfd under lock to avoid
+         * pushing multiple jobs to release the same virqfd.
+         */
+        spin_lock_irq(&vdev->irqlock);
+
+        if (*pvirqfd) {
+                spin_unlock_irq(&vdev->irqlock);
+                ret = -EBUSY;
+                goto fail;
+        }
+        *pvirqfd = virqfd;
+
+        spin_unlock_irq(&vdev->irqlock);
+
+        /*
          * Install our own custom wake-up handling so we are notified via
          * a callback whenever someone signals the underlying eventfd.
          */
@@ -187,19 +213,29 @@ fail:
                 fput(file);
 
         kfree(virqfd);
-        *pvirqfd = NULL;
 
         return ret;
 }
 
-static void virqfd_disable(struct virqfd *virqfd)
+static void virqfd_disable(struct vfio_pci_device *vdev,
+                           struct virqfd **pvirqfd)
 {
-        if (!virqfd)
-                return;
+        unsigned long flags;
+
+        spin_lock_irqsave(&vdev->irqlock, flags);
+
+        if (*pvirqfd) {
+                virqfd_deactivate(*pvirqfd);
+                *pvirqfd = NULL;
+        }
 
-        virqfd_deactivate(virqfd);
+        spin_unlock_irqrestore(&vdev->irqlock, flags);
 
-        /* Block until we know all outstanding shutdown jobs have completed. */
+        /*
+         * Block until we know all outstanding shutdown jobs have completed.
+         * Even if we don't queue the job, flush the wq to be sure it's
+         * been released.
+         */
         flush_workqueue(vfio_irqfd_cleanup_wq);
 }
 
@@ -392,8 +428,8 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd)
 static void vfio_intx_disable(struct vfio_pci_device *vdev)
 {
         vfio_intx_set_signal(vdev, -1);
-        virqfd_disable(vdev->ctx[0].unmask);
-        virqfd_disable(vdev->ctx[0].mask);
+        virqfd_disable(vdev, &vdev->ctx[0].unmask);
+        virqfd_disable(vdev, &vdev->ctx[0].mask);
         vdev->irq_type = VFIO_PCI_NUM_IRQS;
         vdev->num_ctx = 0;
         kfree(vdev->ctx);
@@ -539,8 +575,8 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix)
         vfio_msi_set_block(vdev, 0, vdev->num_ctx, NULL, msix);
 
         for (i = 0; i < vdev->num_ctx; i++) {
-                virqfd_disable(vdev->ctx[i].unmask);
-                virqfd_disable(vdev->ctx[i].mask);
+                virqfd_disable(vdev, &vdev->ctx[i].unmask);
+                virqfd_disable(vdev, &vdev->ctx[i].mask);
         }
 
         if (msix) {
@@ -577,7 +613,7 @@ static int vfio_pci_set_intx_unmask(struct vfio_pci_device *vdev,
                                              vfio_send_intx_eventfd, NULL,
                                              &vdev->ctx[0].unmask, fd);
 
-                virqfd_disable(vdev->ctx[0].unmask);
+                virqfd_disable(vdev, &vdev->ctx[0].unmask);
         }
 
         return 0;