180 files changed, 1976 insertions, 993 deletions

diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 959d41acc108..d7d32c28829b 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -67,6 +67,8 @@ enum ec_command {
 #define ACPI_EC_DELAY           500     /* Wait 500ms max. during EC ops */
 #define ACPI_EC_UDELAY_GLK      1000    /* Wait 1ms max. to get global lock */
 #define ACPI_EC_MSI_UDELAY      550     /* Wait 550us for MSI EC */
+#define ACPI_EC_CLEAR_MAX       100     /* Maximum number of events to query
+                                         * when trying to clear the EC */
 
 enum {
         EC_FLAGS_QUERY_PENDING,         /* Query is pending */
@@ -116,6 +118,7 @@ EXPORT_SYMBOL(first_ec);
 static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
 static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
 static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
+static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
 
 /* --------------------------------------------------------------------------
                              Transaction Management
@@ -440,6 +443,29 @@ acpi_handle ec_get_handle(void)
 
 EXPORT_SYMBOL(ec_get_handle);
 
+static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
+
+/*
+ * Clears stale _Q events that might have accumulated in the EC.
+ * Run with locked ec mutex.
+ */
+static void acpi_ec_clear(struct acpi_ec *ec)
+{
+        int i, status;
+        u8 value = 0;
+
+        for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
+                status = acpi_ec_query_unlocked(ec, &value);
+                if (status || !value)
+                        break;
+        }
+
+        if (unlikely(i == ACPI_EC_CLEAR_MAX))
+                pr_warn("Warning: Maximum of %d stale EC events cleared\n", i);
+        else
+                pr_info("%d stale EC events cleared\n", i);
+}
+
 void acpi_ec_block_transactions(void)
 {
         struct acpi_ec *ec = first_ec;
@@ -463,6 +489,10 @@ void acpi_ec_unblock_transactions(void)
         mutex_lock(&ec->mutex);
         /* Allow transactions to be carried out again */
         clear_bit(EC_FLAGS_BLOCKED, &ec->flags);
+
+        if (EC_FLAGS_CLEAR_ON_RESUME)
+                acpi_ec_clear(ec);
+
         mutex_unlock(&ec->mutex);
 }
 
@@ -821,6 +851,13 @@ static int acpi_ec_add(struct acpi_device *device)
 
         /* EC is fully operational, allow queries */
         clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+
+        /* Clear stale _Q events if hardware might require that */
+        if (EC_FLAGS_CLEAR_ON_RESUME) {
+                mutex_lock(&ec->mutex);
+                acpi_ec_clear(ec);
+                mutex_unlock(&ec->mutex);
+        }
         return ret;
 }
 
@@ -922,6 +959,30 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
         return 0;
 }
 
+/*
+ * On some hardware it is necessary to clear events accumulated by the EC during
+ * sleep. These ECs stop reporting GPEs until they are manually polled, if too
+ * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=44161
+ *
+ * Ideally, the EC should also be instructed NOT to accumulate events during
+ * sleep (which Windows seems to do somehow), but the interface to control this
+ * behaviour is not known at this time.
+ *
+ * Models known to be affected are Samsung 530Uxx/535Uxx/540Uxx/550Pxx/900Xxx,
+ * however it is very likely that other Samsung models are affected.
+ *
+ * On systems which don't accumulate _Q events during sleep, this extra check
+ * should be harmless.
+ */
+static int ec_clear_on_resume(const struct dmi_system_id *id)
+{
+        pr_debug("Detected system needing EC poll on resume.\n");
+        EC_FLAGS_CLEAR_ON_RESUME = 1;
+        return 0;
+}
+
 static struct dmi_system_id ec_dmi_table[] __initdata = {
         {
         ec_skip_dsdt_scan, "Compal JFL92", {
@@ -965,6 +1026,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
         ec_validate_ecdt, "ASUS hardware", {
         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
         DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
+        {
+        ec_clear_on_resume, "Samsung hardware", {
+        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
         {},
 };
 
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 28baa05b8018..84243c32e29c 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -56,6 +56,12 @@ struct throttling_tstate {
         int target_state;               /* target T-state */
 };
 
+struct acpi_processor_throttling_arg {
+        struct acpi_processor *pr;
+        int target_state;
+        bool force;
+};
+
 #define THROTTLING_PRECHANGE       (1)
 #define THROTTLING_POSTCHANGE      (2)
 
@@ -1060,16 +1066,24 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
         return 0;
 }
 
+static long acpi_processor_throttling_fn(void *data)
+{
+        struct acpi_processor_throttling_arg *arg = data;
+        struct acpi_processor *pr = arg->pr;
+
+        return pr->throttling.acpi_processor_set_throttling(pr,
+                        arg->target_state, arg->force);
+}
+
 int acpi_processor_set_throttling(struct acpi_processor *pr,
                                                 int state, bool force)
 {
-        cpumask_var_t saved_mask;
         int ret = 0;
         unsigned int i;
         struct acpi_processor *match_pr;
         struct acpi_processor_throttling *p_throttling;
+        struct acpi_processor_throttling_arg arg;
         struct throttling_tstate t_state;
-        cpumask_var_t online_throttling_cpus;
 
         if (!pr)
                 return -EINVAL;
@@ -1080,14 +1094,6 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
         if ((state < 0) || (state > (pr->throttling.state_count - 1)))
                 return -EINVAL;
 
-        if (!alloc_cpumask_var(&saved_mask, GFP_KERNEL))
-                return -ENOMEM;
-
-        if (!alloc_cpumask_var(&online_throttling_cpus, GFP_KERNEL)) {
-                free_cpumask_var(saved_mask);
-                return -ENOMEM;
-        }
-
         if (cpu_is_offline(pr->id)) {
                 /*
                  * the cpu pointed by pr->id is offline. Unnecessary to change
@@ -1096,17 +1102,15 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
                 return -ENODEV;
         }
 
-        cpumask_copy(saved_mask, &current->cpus_allowed);
         t_state.target_state = state;
         p_throttling = &(pr->throttling);
-        cpumask_and(online_throttling_cpus, cpu_online_mask,
-                    p_throttling->shared_cpu_map);
+
         /*
          * The throttling notifier will be called for every
          * affected cpu in order to get one proper T-state.
          * The notifier event is THROTTLING_PRECHANGE.
          */
-        for_each_cpu(i, online_throttling_cpus) {
+        for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) {
                 t_state.cpu = i;
                 acpi_processor_throttling_notifier(THROTTLING_PRECHANGE,
                                                         &t_state);
@@ -1118,21 +1122,18 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
          * it can be called only for the cpu pointed by pr.
          */
         if (p_throttling->shared_type == DOMAIN_COORD_TYPE_SW_ANY) {
-                /* FIXME: use work_on_cpu() */
-                if (set_cpus_allowed_ptr(current, cpumask_of(pr->id))) {
-                        /* Can't migrate to the pr->id CPU. Exit */
-                        ret = -ENODEV;
-                        goto exit;
-                }
-                ret = p_throttling->acpi_processor_set_throttling(pr,
-                                                t_state.target_state, force);
+                arg.pr = pr;
+                arg.target_state = state;
+                arg.force = force;
+                ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, &arg);
         } else {
                 /*
                  * When the T-state coordination is SW_ALL or HW_ALL,
                  * it is necessary to set T-state for every affected
                  * cpus.
                  */
-                for_each_cpu(i, online_throttling_cpus) {
+                for_each_cpu_and(i, cpu_online_mask,
+                    p_throttling->shared_cpu_map) {
                         match_pr = per_cpu(processors, i);
                         /*
                          * If the pointer is invalid, we will report the
@@ -1153,13 +1154,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
                                         "on CPU %d\n", i));
                                 continue;
                         }
-                        t_state.cpu = i;
-                        /* FIXME: use work_on_cpu() */
-                        if (set_cpus_allowed_ptr(current, cpumask_of(i)))
-                                continue;
-                        ret = match_pr->throttling.
-                                acpi_processor_set_throttling(
-                                match_pr, t_state.target_state, force);
+
+                        arg.pr = match_pr;
+                        arg.target_state = state;
+                        arg.force = force;
+                        ret = work_on_cpu(pr->id, acpi_processor_throttling_fn,
+                                &arg);
                 }
         }
         /*
@@ -1168,17 +1168,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
          * affected cpu to update the T-states.
          * The notifier event is THROTTLING_POSTCHANGE
          */
-        for_each_cpu(i, online_throttling_cpus) {
+        for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) {
                 t_state.cpu = i;
                 acpi_processor_throttling_notifier(THROTTLING_POSTCHANGE,
                                                         &t_state);
         }
-        /* restore the previous state */
-        /* FIXME: use work_on_cpu() */
-        set_cpus_allowed_ptr(current, saved_mask);
-exit:
-        free_cpumask_var(online_throttling_cpus);
-        free_cpumask_var(saved_mask);
+
         return ret;
 }
 
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index b7201fc6f1e1..0bdacc5e26a3 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -77,18 +77,24 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res)
         switch (ares->type) {
         case ACPI_RESOURCE_TYPE_MEMORY24:
                 memory24 = &ares->data.memory24;
+                if (!memory24->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, memory24->minimum,
                                          memory24->address_length,
                                          memory24->write_protect);
                 break;
         case ACPI_RESOURCE_TYPE_MEMORY32:
                 memory32 = &ares->data.memory32;
+                if (!memory32->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, memory32->minimum,
                                          memory32->address_length,
                                          memory32->write_protect);
                 break;
         case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
                 fixed_memory32 = &ares->data.fixed_memory32;
+                if (!fixed_memory32->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, fixed_memory32->address,
                                          fixed_memory32->address_length,
                                          fixed_memory32->write_protect);
@@ -144,12 +150,16 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res)
         switch (ares->type) {
         case ACPI_RESOURCE_TYPE_IO:
                 io = &ares->data.io;
+                if (!io->address_length)
+                        return false;
                 acpi_dev_get_ioresource(res, io->minimum,
                                         io->address_length,
                                         io->io_decode);
                 break;
         case ACPI_RESOURCE_TYPE_FIXED_IO:
                 fixed_io = &ares->data.fixed_io;
+                if (!fixed_io->address_length)
+                        return false;
                 acpi_dev_get_ioresource(res, fixed_io->address,
                                         fixed_io->address_length,
                                         ACPI_DECODE_10);
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index b718806657cd..b0f6c4a2a119 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -807,7 +807,12 @@ int __init acpi_sleep_init(void)
         acpi_sleep_hibernate_setup();
 
         status = acpi_get_sleep_type_data(ACPI_STATE_S5, &type_a, &type_b);
-        if (ACPI_SUCCESS(status)) {
+        /*
+         * Check both ACPI S5 object and ACPI sleep registers to
+         * install pm_power_off_prepare/pm_power_off hook
+         */
+        if (ACPI_SUCCESS(status) && acpi_gbl_FADT.sleep_control.address
+            && acpi_gbl_FADT.sleep_status.address) {
                 sleep_states[ACPI_STATE_S5] = 1;
                 pm_power_off_prepare = acpi_power_off_prepare;
                 pm_power_off = acpi_power_off;
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 8a97ddfa6122..c30df50e4440 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -1580,6 +1580,7 @@ static int fw_pm_notify(struct notifier_block *notify_block,
         switch (mode) {
         case PM_HIBERNATION_PREPARE:
         case PM_SUSPEND_PREPARE:
+        case PM_RESTORE_PREPARE:
                 kill_requests_without_uevent();
                 device_cache_fw_images();
                 break;
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 8184451b57c0..422b7d84f686 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -874,7 +874,7 @@ bio_pageinc(struct bio *bio)
                 /* Non-zero page count for non-head members of
                  * compound pages is no longer allowed by the kernel.
                  */
-                page = compound_trans_head(bv.bv_page);
+                page = compound_head(bv.bv_page);
                 atomic_inc(&page->_count);
         }
 }
@@ -887,7 +887,7 @@ bio_pagedec(struct bio *bio)
         struct bvec_iter iter;
 
         bio_for_each_segment(bv, bio, iter) {
-                page = compound_trans_head(bv.bv_page);
+                page = compound_head(bv.bv_page);
                 atomic_dec(&page->_count);
         }
 }
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index b52e9a6d6aad..54174cb32feb 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -53,7 +53,7 @@
 #define MTIP_FTL_REBUILD_TIMEOUT_MS     2400000
 
 /* unaligned IO handling */
-#define MTIP_MAX_UNALIGNED_SLOTS        8
+#define MTIP_MAX_UNALIGNED_SLOTS        2
 
 /* Macro to extract the tag bit number from a tag value. */
 #define MTIP_TAG_BIT(tag)       (tag & 0x1F)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 011e55d820b1..51c557cfd92b 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -612,6 +612,8 @@ static ssize_t disksize_store(struct device *dev,
 
         disksize = PAGE_ALIGN(disksize);
         meta = zram_meta_alloc(disksize);
+        if (!meta)
+                return -ENOMEM;
         down_write(&zram->init_lock);
         if (zram->init_done) {
                 up_write(&zram->init_lock);
diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
index bd313f7816a8..c1af80bcdf20 100644
--- a/drivers/clk/at91/clk-master.c
+++ b/drivers/clk/at91/clk-master.c
@@ -242,7 +242,7 @@ of_at91_clk_master_setup(struct device_node *np, struct at91_pmc *pmc,
 
         irq = irq_of_parse_and_map(np, 0);
         if (!irq)
-                return;
+                goto out_free_characteristics;
 
         clk = at91_clk_register_master(pmc, irq, name, num_parents,
                                        parent_names, layout,
diff --git a/drivers/clk/clk-nomadik.c b/drivers/clk/clk-nomadik.c
index 6a934a5296bd..05e04ce0f148 100644
--- a/drivers/clk/clk-nomadik.c
+++ b/drivers/clk/clk-nomadik.c
@@ -494,6 +494,9 @@ static const struct file_operations nomadik_src_clk_debugfs_ops = {
 
 static int __init nomadik_src_clk_init_debugfs(void)
 {
+        /* Vital for multiplatform */
+        if (!src_base)
+                return -ENODEV;
         src_pcksr0_boot = readl(src_base + SRC_PCKSR0);
         src_pcksr1_boot = readl(src_base + SRC_PCKSR1);
         debugfs_create_file("nomadik-src-clk", S_IFREG | S_IRUGO,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 5517944495d8..c42e608af6bb 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2226,24 +2226,25 @@ EXPORT_SYMBOL_GPL(devm_clk_unregister);
  */
 int __clk_get(struct clk *clk)
 {
-        if (clk && !try_module_get(clk->owner))
-                return 0;
+        if (clk) {
+                if (!try_module_get(clk->owner))
+                        return 0;
 
-        kref_get(&clk->ref);
+                kref_get(&clk->ref);
+        }
         return 1;
 }
 
 void __clk_put(struct clk *clk)
 {
-        if (WARN_ON_ONCE(IS_ERR(clk)))
+        if (!clk || WARN_ON_ONCE(IS_ERR(clk)))
                 return;
 
         clk_prepare_lock();
         kref_put(&clk->ref, __clk_release);
         clk_prepare_unlock();
 
-        if (clk)
-                module_put(clk->owner);
+        module_put(clk->owner);
 }
 
 /***        clk rate change notifiers        ***/
diff --git a/drivers/clk/keystone/gate.c b/drivers/clk/keystone/gate.c
index 17a598398a53..86f1e362eafb 100644
--- a/drivers/clk/keystone/gate.c
+++ b/drivers/clk/keystone/gate.c
@@ -179,6 +179,7 @@ static struct clk *clk_register_psc(struct device *dev,
 
         init.name = name;
         init.ops = &clk_psc_ops;
+        init.flags = 0;
         init.parent_names = (parent_name ? &parent_name : NULL);
         init.num_parents = (parent_name ? 1 : 0);
 
diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
index 81a202d12a7a..bef198a83863 100644
--- a/drivers/clk/mvebu/armada-370.c
+++ b/drivers/clk/mvebu/armada-370.c
@@ -141,13 +141,6 @@ static const struct coreclk_soc_desc a370_coreclks = {
         .num_ratios = ARRAY_SIZE(a370_coreclk_ratios),
 };
 
-static void __init a370_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &a370_coreclks);
-}
-CLK_OF_DECLARE(a370_core_clk, "marvell,armada-370-core-clock",
-               a370_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -168,9 +161,15 @@ static const struct clk_gating_soc_desc a370_gating_desc[] __initconst = {
         { }
 };
 
-static void __init a370_clk_gating_init(struct device_node *np)
+static void __init a370_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, a370_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,armada-370-gating-clock");
+
+        mvebu_coreclk_setup(np, &a370_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, a370_gating_desc);
 }
-CLK_OF_DECLARE(a370_clk_gating, "marvell,armada-370-gating-clock",
-               a370_clk_gating_init);
+CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
+
diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
index 9922c4475aa8..b3094315a3c0 100644
--- a/drivers/clk/mvebu/armada-xp.c
+++ b/drivers/clk/mvebu/armada-xp.c
@@ -158,13 +158,6 @@ static const struct coreclk_soc_desc axp_coreclks = {
         .num_ratios = ARRAY_SIZE(axp_coreclk_ratios),
 };
 
-static void __init axp_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &axp_coreclks);
-}
-CLK_OF_DECLARE(axp_core_clk, "marvell,armada-xp-core-clock",
-               axp_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -202,9 +195,14 @@ static const struct clk_gating_soc_desc axp_gating_desc[] __initconst = {
         { }
 };
 
-static void __init axp_clk_gating_init(struct device_node *np)
+static void __init axp_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, axp_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,armada-xp-gating-clock");
+
+        mvebu_coreclk_setup(np, &axp_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, axp_gating_desc);
 }
-CLK_OF_DECLARE(axp_clk_gating, "marvell,armada-xp-gating-clock",
-               axp_clk_gating_init);
+CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
index 38aee1e3f242..b8c2424ac926 100644
--- a/drivers/clk/mvebu/dove.c
+++ b/drivers/clk/mvebu/dove.c
@@ -154,12 +154,6 @@ static const struct coreclk_soc_desc dove_coreclks = {
         .num_ratios = ARRAY_SIZE(dove_coreclk_ratios),
 };
 
-static void __init dove_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &dove_coreclks);
-}
-CLK_OF_DECLARE(dove_core_clk, "marvell,dove-core-clock", dove_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -186,9 +180,14 @@ static const struct clk_gating_soc_desc dove_gating_desc[] __initconst = {
         { }
 };
 
-static void __init dove_clk_gating_init(struct device_node *np)
+static void __init dove_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, dove_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,dove-gating-clock");
+
+        mvebu_coreclk_setup(np, &dove_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, dove_gating_desc);
 }
-CLK_OF_DECLARE(dove_clk_gating, "marvell,dove-gating-clock",
-               dove_clk_gating_init);
+CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
index 2636a55f29f9..ddb666a86500 100644
--- a/drivers/clk/mvebu/kirkwood.c
+++ b/drivers/clk/mvebu/kirkwood.c
@@ -193,13 +193,6 @@ static const struct coreclk_soc_desc kirkwood_coreclks = {
         .num_ratios = ARRAY_SIZE(kirkwood_coreclk_ratios),
 };
 
-static void __init kirkwood_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &kirkwood_coreclks);
-}
-CLK_OF_DECLARE(kirkwood_core_clk, "marvell,kirkwood-core-clock",
-               kirkwood_coreclk_init);
-
 static const struct coreclk_soc_desc mv88f6180_coreclks = {
         .get_tclk_freq = kirkwood_get_tclk_freq,
         .get_cpu_freq = mv88f6180_get_cpu_freq,
@@ -208,13 +201,6 @@ static const struct coreclk_soc_desc mv88f6180_coreclks = {
         .num_ratios = ARRAY_SIZE(kirkwood_coreclk_ratios),
 };
 
-static void __init mv88f6180_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &mv88f6180_coreclks);
-}
-CLK_OF_DECLARE(mv88f6180_core_clk, "marvell,mv88f6180-core-clock",
-               mv88f6180_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -239,9 +225,21 @@ static const struct clk_gating_soc_desc kirkwood_gating_desc[] __initconst = {
         { }
 };
 
-static void __init kirkwood_clk_gating_init(struct device_node *np)
+static void __init kirkwood_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, kirkwood_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,kirkwood-gating-clock");
+
+
+        if (of_device_is_compatible(np, "marvell,mv88f6180-core-clock"))
+                mvebu_coreclk_setup(np, &mv88f6180_coreclks);
+        else
+                mvebu_coreclk_setup(np, &kirkwood_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
 }
-CLK_OF_DECLARE(kirkwood_clk_gating, "marvell,kirkwood-gating-clock",
-               kirkwood_clk_gating_init);
+CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
+               kirkwood_clk_init);
+CLK_OF_DECLARE(mv88f6180_clk, "marvell,mv88f6180-core-clock",
+               kirkwood_clk_init);
diff --git a/drivers/clk/shmobile/clk-rcar-gen2.c b/drivers/clk/shmobile/clk-rcar-gen2.c
index a59ec217a124..99c27b1c625b 100644
--- a/drivers/clk/shmobile/clk-rcar-gen2.c
+++ b/drivers/clk/shmobile/clk-rcar-gen2.c
@@ -26,6 +26,8 @@ struct rcar_gen2_cpg {
         void __iomem *reg;
 };
 
+#define CPG_FRQCRB                      0x00000004
+#define CPG_FRQCRB_KICK                 BIT(31)
 #define CPG_SDCKCR                      0x00000074
 #define CPG_PLL0CR                      0x000000d8
 #define CPG_FRQCRC                      0x000000e0
@@ -45,6 +47,7 @@ struct rcar_gen2_cpg {
 struct cpg_z_clk {
         struct clk_hw hw;
         void __iomem *reg;
+        void __iomem *kick_reg;
 };
 
 #define to_z_clk(_hw)   container_of(_hw, struct cpg_z_clk, hw)
@@ -83,17 +86,45 @@ static int cpg_z_clk_set_rate(struct clk_hw *hw, unsigned long rate,
 {
         struct cpg_z_clk *zclk = to_z_clk(hw);
         unsigned int mult;
-        u32 val;
+        u32 val, kick;
+        unsigned int i;
 
         mult = div_u64((u64)rate * 32, parent_rate);
         mult = clamp(mult, 1U, 32U);
 
+        if (clk_readl(zclk->kick_reg) & CPG_FRQCRB_KICK)
+                return -EBUSY;
+
         val = clk_readl(zclk->reg);
         val &= ~CPG_FRQCRC_ZFC_MASK;
         val |= (32 - mult) << CPG_FRQCRC_ZFC_SHIFT;
         clk_writel(val, zclk->reg);
 
-        return 0;
+        /*
+         * Set KICK bit in FRQCRB to update hardware setting and wait for
+         * clock change completion.
+         */
+        kick = clk_readl(zclk->kick_reg);
+        kick |= CPG_FRQCRB_KICK;
+        clk_writel(kick, zclk->kick_reg);
+
+        /*
+         * Note: There is no HW information about the worst case latency.
+         *
+         * Using experimental measurements, it seems that no more than
+         * ~10 iterations are needed, independently of the CPU rate.
+         * Since this value might be dependant of external xtal rate, pll1
+         * rate or even the other emulation clocks rate, use 1000 as a
+         * "super" safe value.
+         */
+        for (i = 1000; i; i--) {
+                if (!(clk_readl(zclk->kick_reg) & CPG_FRQCRB_KICK))
+                        return 0;
+
+                cpu_relax();
+        }
+
+        return -ETIMEDOUT;
 }
 
 static const struct clk_ops cpg_z_clk_ops = {
@@ -120,6 +151,7 @@ static struct clk * __init cpg_z_clk_register(struct rcar_gen2_cpg *cpg)
         init.num_parents = 1;
 
         zclk->reg = cpg->reg + CPG_FRQCRC;
+        zclk->kick_reg = cpg->reg + CPG_FRQCRB;
         zclk->hw.init = &init;
 
         clk = clk_register(NULL, &zclk->hw);
@@ -186,7 +218,7 @@ rcar_gen2_cpg_register_clock(struct device_node *np, struct rcar_gen2_cpg *cpg,
                              const char *name)
 {
         const struct clk_div_table *table = NULL;
-        const char *parent_name = "main";
+        const char *parent_name;
         unsigned int shift;
         unsigned int mult = 1;
         unsigned int div = 1;
@@ -201,23 +233,31 @@ rcar_gen2_cpg_register_clock(struct device_node *np, struct rcar_gen2_cpg *cpg,
                  * the multiplier value.
                  */
                 u32 value = clk_readl(cpg->reg + CPG_PLL0CR);
+                parent_name = "main";
                 mult = ((value >> 24) & ((1 << 7) - 1)) + 1;
         } else if (!strcmp(name, "pll1")) {
+                parent_name = "main";
                 mult = config->pll1_mult / 2;
         } else if (!strcmp(name, "pll3")) {
+                parent_name = "main";
                 mult = config->pll3_mult;
         } else if (!strcmp(name, "lb")) {
+                parent_name = "pll1_div2";
                 div = cpg_mode & BIT(18) ? 36 : 24;
         } else if (!strcmp(name, "qspi")) {
+                parent_name = "pll1_div2";
                 div = (cpg_mode & (BIT(3) | BIT(2) | BIT(1))) == BIT(2)
-                    ? 16 : 20;
+                    ? 8 : 10;
         } else if (!strcmp(name, "sdh")) {
+                parent_name = "pll1_div2";
                 table = cpg_sdh_div_table;
                 shift = 8;
         } else if (!strcmp(name, "sd0")) {
+                parent_name = "pll1_div2";
                 table = cpg_sd01_div_table;
                 shift = 4;
         } else if (!strcmp(name, "sd1")) {
+                parent_name = "pll1_div2";
                 table = cpg_sd01_div_table;
                 shift = 0;
         } else if (!strcmp(name, "z")) {
diff --git a/drivers/clk/tegra/clk-divider.c b/drivers/clk/tegra/clk-divider.c
index 4d75b1f37e3a..290f9c1a3749 100644
--- a/drivers/clk/tegra/clk-divider.c
+++ b/drivers/clk/tegra/clk-divider.c
@@ -59,7 +59,7 @@ static int get_div(struct tegra_clk_frac_div *divider, unsigned long rate,
                 return 0;
 
         if (divider_ux1 > get_max_div(divider))
-                return -EINVAL;
+                return get_max_div(divider);
 
         return divider_ux1;
 }
diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
index cf0c323f2c36..c39613c519af 100644
--- a/drivers/clk/tegra/clk-id.h
+++ b/drivers/clk/tegra/clk-id.h
@@ -180,9 +180,13 @@ enum clk_id {
         tegra_clk_sbc6_8,
         tegra_clk_sclk,
         tegra_clk_sdmmc1,
+        tegra_clk_sdmmc1_8,
         tegra_clk_sdmmc2,
+        tegra_clk_sdmmc2_8,
         tegra_clk_sdmmc3,
+        tegra_clk_sdmmc3_8,
         tegra_clk_sdmmc4,
+        tegra_clk_sdmmc4_8,
         tegra_clk_se,
         tegra_clk_soc_therm,
         tegra_clk_sor0,
diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
index 5c35885f4a7c..1fa5c3f33b20 100644
--- a/drivers/clk/tegra/clk-tegra-periph.c
+++ b/drivers/clk/tegra/clk-tegra-periph.c
@@ -371,9 +371,7 @@ static const char *mux_pllp3_pllc_clkm[] = {
 static const char *mux_pllm_pllc_pllp_plla_pllc2_c3_clkm[] = {
         "pll_m", "pll_c", "pll_p", "pll_a", "pll_c2", "pll_c3", "clk_m"
 };
-static u32 mux_pllm_pllc_pllp_plla_pllc2_c3_clkm_idx[] = {
-        [0] = 0, [1] = 1, [2] = 2, [3] = 3, [4] = 4, [5] = 6,
-};
+#define mux_pllm_pllc_pllp_plla_pllc2_c3_clkm_idx NULL
 
 static const char *mux_pllm_pllc2_c_c3_pllp_plla_pllc4[] = {
         "pll_m", "pll_c2", "pll_c", "pll_c3", "pll_p", "pll_a_out0", "pll_c4",
@@ -465,6 +463,10 @@ static struct tegra_periph_init_data periph_clks[] = {
         MUX("adx1", mux_plla_pllc_pllp_clkm, CLK_SOURCE_ADX1, 180, TEGRA_PERIPH_ON_APB, tegra_clk_adx1),
         MUX("amx1", mux_plla_pllc_pllp_clkm, CLK_SOURCE_AMX1, 185, TEGRA_PERIPH_ON_APB, tegra_clk_amx1),
         MUX("vi_sensor2", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_VI_SENSOR2, 20, TEGRA_PERIPH_NO_RESET, tegra_clk_vi_sensor2),
+        MUX8("sdmmc1", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC1, 14, 0, tegra_clk_sdmmc1_8),
+        MUX8("sdmmc2", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC2, 9, 0, tegra_clk_sdmmc2_8),
+        MUX8("sdmmc3", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC3, 69, 0, tegra_clk_sdmmc3_8),
+        MUX8("sdmmc4", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC4, 15, 0, tegra_clk_sdmmc4_8),
         MUX8("sbc1", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC1, 41, TEGRA_PERIPH_ON_APB, tegra_clk_sbc1_8),
         MUX8("sbc2", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC2, 44, TEGRA_PERIPH_ON_APB, tegra_clk_sbc2_8),
         MUX8("sbc3", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC3, 46, TEGRA_PERIPH_ON_APB, tegra_clk_sbc3_8),
@@ -492,7 +494,7 @@ static struct tegra_periph_init_data periph_clks[] = {
         UART("uartb", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTB, 7, tegra_clk_uartb),
         UART("uartc", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTC, 55, tegra_clk_uartc),
         UART("uartd", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTD, 65, tegra_clk_uartd),
-        UART("uarte", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTE, 65, tegra_clk_uarte),
+        UART("uarte", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTE, 66, tegra_clk_uarte),
         XUSB("xusb_host_src", mux_clkm_pllp_pllc_pllre, CLK_SOURCE_XUSB_HOST_SRC, 143, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_host_src),
         XUSB("xusb_falcon_src", mux_clkm_pllp_pllc_pllre, CLK_SOURCE_XUSB_FALCON_SRC, 143, TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_falcon_src),
         XUSB("xusb_fs_src", mux_clkm_48M_pllp_480M, CLK_SOURCE_XUSB_FS_SRC, 143, TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_fs_src),
diff --git a/drivers/clk/tegra/clk-tegra-super-gen4.c b/drivers/clk/tegra/clk-tegra-super-gen4.c
index 05dce4aa2c11..feb3201c85ce 100644
--- a/drivers/clk/tegra/clk-tegra-super-gen4.c
+++ b/drivers/clk/tegra/clk-tegra-super-gen4.c
@@ -120,7 +120,7 @@ void __init tegra_super_clk_gen4_init(void __iomem *clk_base,
                                         ARRAY_SIZE(cclk_lp_parents),
                                         CLK_SET_RATE_PARENT,
                                         clk_base + CCLKLP_BURST_POLICY,
-                                        0, 4, 8, 9, NULL);
+                                        TEGRA_DIVIDER_2, 4, 8, 9, NULL);
                 *dt_clk = clk;
         }
 
diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
index 90d9d25f2228..80431f0fb268 100644
--- a/drivers/clk/tegra/clk-tegra114.c
+++ b/drivers/clk/tegra/clk-tegra114.c
@@ -682,12 +682,12 @@ static struct tegra_clk tegra114_clks[tegra_clk_max] __initdata = {
         [tegra_clk_timer] = { .dt_id = TEGRA114_CLK_TIMER, .present = true },
         [tegra_clk_uarta] = { .dt_id = TEGRA114_CLK_UARTA, .present = true },
         [tegra_clk_uartd] = { .dt_id = TEGRA114_CLK_UARTD, .present = true },
-        [tegra_clk_sdmmc2] = { .dt_id = TEGRA114_CLK_SDMMC2, .present = true },
+        [tegra_clk_sdmmc2_8] = { .dt_id = TEGRA114_CLK_SDMMC2, .present = true },
         [tegra_clk_i2s1] = { .dt_id = TEGRA114_CLK_I2S1, .present = true },
         [tegra_clk_i2c1] = { .dt_id = TEGRA114_CLK_I2C1, .present = true },
         [tegra_clk_ndflash] = { .dt_id = TEGRA114_CLK_NDFLASH, .present = true },
-        [tegra_clk_sdmmc1] = { .dt_id = TEGRA114_CLK_SDMMC1, .present = true },
-        [tegra_clk_sdmmc4] = { .dt_id = TEGRA114_CLK_SDMMC4, .present = true },
+        [tegra_clk_sdmmc1_8] = { .dt_id = TEGRA114_CLK_SDMMC1, .present = true },
+        [tegra_clk_sdmmc4_8] = { .dt_id = TEGRA114_CLK_SDMMC4, .present = true },
         [tegra_clk_pwm] = { .dt_id = TEGRA114_CLK_PWM, .present = true },
         [tegra_clk_i2s0] = { .dt_id = TEGRA114_CLK_I2S0, .present = true },
         [tegra_clk_i2s2] = { .dt_id = TEGRA114_CLK_I2S2, .present = true },
@@ -723,7 +723,7 @@ static struct tegra_clk tegra114_clks[tegra_clk_max] __initdata = {
         [tegra_clk_bsev] = { .dt_id = TEGRA114_CLK_BSEV, .present = true },
         [tegra_clk_i2c3] = { .dt_id = TEGRA114_CLK_I2C3, .present = true },
         [tegra_clk_sbc4_8] = { .dt_id = TEGRA114_CLK_SBC4, .present = true },
-        [tegra_clk_sdmmc3] = { .dt_id = TEGRA114_CLK_SDMMC3, .present = true },
+        [tegra_clk_sdmmc3_8] = { .dt_id = TEGRA114_CLK_SDMMC3, .present = true },
         [tegra_clk_owr] = { .dt_id = TEGRA114_CLK_OWR, .present = true },
         [tegra_clk_csite] = { .dt_id = TEGRA114_CLK_CSITE, .present = true },
         [tegra_clk_la] = { .dt_id = TEGRA114_CLK_LA, .present = true },
diff --git a/drivers/clk/tegra/clk-tegra124.c b/drivers/clk/tegra/clk-tegra124.c
index aff86b5bc745..166e02f16c8a 100644
--- a/drivers/clk/tegra/clk-tegra124.c
+++ b/drivers/clk/tegra/clk-tegra124.c
@@ -516,11 +516,11 @@ static struct div_nmp pllp_nmp = {
 };
 
 static struct tegra_clk_pll_freq_table pll_p_freq_table[] = {
-        {12000000, 216000000, 432, 12, 1, 8},
-        {13000000, 216000000, 432, 13, 1, 8},
-        {16800000, 216000000, 360, 14, 1, 8},
-        {19200000, 216000000, 360, 16, 1, 8},
-        {26000000, 216000000, 432, 26, 1, 8},
+        {12000000, 408000000, 408, 12, 0, 8},
+        {13000000, 408000000, 408, 13, 0, 8},
+        {16800000, 408000000, 340, 14, 0, 8},
+        {19200000, 408000000, 340, 16, 0, 8},
+        {26000000, 408000000, 408, 26, 0, 8},
         {0, 0, 0, 0, 0, 0},
 };
 
@@ -570,6 +570,15 @@ static struct tegra_clk_pll_params pll_a_params = {
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_USE_LOCK,
 };
 
+static struct div_nmp plld_nmp = {
+        .divm_shift = 0,
+        .divm_width = 5,
+        .divn_shift = 8,
+        .divn_width = 11,
+        .divp_shift = 20,
+        .divp_width = 3,
+};
+
 static struct tegra_clk_pll_freq_table pll_d_freq_table[] = {
         {12000000, 216000000, 864, 12, 4, 12},
         {13000000, 216000000, 864, 13, 4, 12},
@@ -603,19 +612,18 @@ static struct tegra_clk_pll_params pll_d_params = {
         .lock_mask = PLL_BASE_LOCK,
         .lock_enable_bit_idx = PLLDU_MISC_LOCK_ENABLE,
         .lock_delay = 1000,
-        .div_nmp = &pllp_nmp,
+        .div_nmp = &plld_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
                  TEGRA_PLL_USE_LOCK,
 };
 
 static struct tegra_clk_pll_freq_table tegra124_pll_d2_freq_table[] = {
-        { 12000000, 148500000,  99, 1, 8},
-        { 12000000, 594000000,  99, 1, 1},
-        { 13000000, 594000000,  91, 1, 1},      /* actual: 591.5 MHz */
-        { 16800000, 594000000,  71, 1, 1},      /* actual: 596.4 MHz */
-        { 19200000, 594000000,  62, 1, 1},      /* actual: 595.2 MHz */
-        { 26000000, 594000000,  91, 2, 1},      /* actual: 591.5 MHz */
+        { 12000000, 594000000,  99, 1, 2},
+        { 13000000, 594000000,  91, 1, 2},      /* actual: 591.5 MHz */
+        { 16800000, 594000000,  71, 1, 2},      /* actual: 596.4 MHz */
+        { 19200000, 594000000,  62, 1, 2},      /* actual: 595.2 MHz */
+        { 26000000, 594000000,  91, 2, 2},      /* actual: 591.5 MHz */
         { 0, 0, 0, 0, 0, 0 },
 };
 
@@ -753,21 +761,19 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
         [tegra_clk_rtc] = { .dt_id = TEGRA124_CLK_RTC, .present = true },
         [tegra_clk_timer] = { .dt_id = TEGRA124_CLK_TIMER, .present = true },
         [tegra_clk_uarta] = { .dt_id = TEGRA124_CLK_UARTA, .present = true },
-        [tegra_clk_sdmmc2] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
+        [tegra_clk_sdmmc2_8] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
         [tegra_clk_i2s1] = { .dt_id = TEGRA124_CLK_I2S1, .present = true },
         [tegra_clk_i2c1] = { .dt_id = TEGRA124_CLK_I2C1, .present = true },
         [tegra_clk_ndflash] = { .dt_id = TEGRA124_CLK_NDFLASH, .present = true },
-        [tegra_clk_sdmmc1] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
-        [tegra_clk_sdmmc4] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
+        [tegra_clk_sdmmc1_8] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
+        [tegra_clk_sdmmc4_8] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
         [tegra_clk_pwm] = { .dt_id = TEGRA124_CLK_PWM, .present = true },
         [tegra_clk_i2s2] = { .dt_id = TEGRA124_CLK_I2S2, .present = true },
-        [tegra_clk_gr2d] = { .dt_id = TEGRA124_CLK_GR_2D, .present = true },
         [tegra_clk_usbd] = { .dt_id = TEGRA124_CLK_USBD, .present = true },
         [tegra_clk_isp_8] = { .dt_id = TEGRA124_CLK_ISP, .present = true },
-        [tegra_clk_gr3d] = { .dt_id = TEGRA124_CLK_GR_3D, .present = true },
         [tegra_clk_disp2] = { .dt_id = TEGRA124_CLK_DISP2, .present = true },
         [tegra_clk_disp1] = { .dt_id = TEGRA124_CLK_DISP1, .present = true },
-        [tegra_clk_host1x] = { .dt_id = TEGRA124_CLK_HOST1X, .present = true },
+        [tegra_clk_host1x_8] = { .dt_id = TEGRA124_CLK_HOST1X, .present = true },
         [tegra_clk_vcp] = { .dt_id = TEGRA124_CLK_VCP, .present = true },
         [tegra_clk_i2s0] = { .dt_id = TEGRA124_CLK_I2S0, .present = true },
         [tegra_clk_apbdma] = { .dt_id = TEGRA124_CLK_APBDMA, .present = true },
@@ -794,7 +800,7 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
         [tegra_clk_uartd] = { .dt_id = TEGRA124_CLK_UARTD, .present = true },
         [tegra_clk_i2c3] = { .dt_id = TEGRA124_CLK_I2C3, .present = true },
         [tegra_clk_sbc4] = { .dt_id = TEGRA124_CLK_SBC4, .present = true },
-        [tegra_clk_sdmmc3] = { .dt_id = TEGRA124_CLK_SDMMC3, .present = true },
+        [tegra_clk_sdmmc3_8] = { .dt_id = TEGRA124_CLK_SDMMC3, .present = true },
         [tegra_clk_pcie] = { .dt_id = TEGRA124_CLK_PCIE, .present = true },
         [tegra_clk_owr] = { .dt_id = TEGRA124_CLK_OWR, .present = true },
         [tegra_clk_afi] = { .dt_id = TEGRA124_CLK_AFI, .present = true },
@@ -1286,9 +1292,9 @@ static void __init tegra124_pll_init(void __iomem *clk_base,
         clk_register_clkdev(clk, "pll_d2", NULL);
         clks[TEGRA124_CLK_PLL_D2] = clk;
 
-        /* PLLD2_OUT0 ?? */
+        /* PLLD2_OUT0 */
         clk = clk_register_fixed_factor(NULL, "pll_d2_out0", "pll_d2",
-                                        CLK_SET_RATE_PARENT, 1, 2);
+                                        CLK_SET_RATE_PARENT, 1, 1);
         clk_register_clkdev(clk, "pll_d2_out0", NULL);
         clks[TEGRA124_CLK_PLL_D2_OUT0] = clk;
 
diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c
index dbace152b2fa..dace2b1b5ae6 100644
--- a/drivers/clk/tegra/clk-tegra20.c
+++ b/drivers/clk/tegra/clk-tegra20.c
@@ -574,6 +574,8 @@ static struct tegra_clk tegra20_clks[tegra_clk_max] __initdata = {
         [tegra_clk_tvdac] = { .dt_id = TEGRA20_CLK_TVDAC, .present = true },
         [tegra_clk_vi_sensor] = { .dt_id = TEGRA20_CLK_VI_SENSOR, .present = true },
         [tegra_clk_afi] = { .dt_id = TEGRA20_CLK_AFI, .present = true },
+        [tegra_clk_fuse] = { .dt_id = TEGRA20_CLK_FUSE, .present = true },
+        [tegra_clk_kfuse] = { .dt_id = TEGRA20_CLK_KFUSE, .present = true },
 };
 
 static unsigned long tegra20_clk_measure_input_freq(void)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index cb003a6b72c8..cf485d928903 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1109,6 +1109,21 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 goto err_set_policy_cpu;
         }
 
+        /* related cpus should atleast have policy->cpus */
+        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
+
+        /*
+         * affected cpus must always be the one, which are online. We aren't
+         * managing offline cpus here.
+         */
+        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
+
+        if (!frozen) {
+                policy->user_policy.min = policy->min;
+                policy->user_policy.max = policy->max;
+        }
+
+        down_write(&policy->rwsem);
         write_lock_irqsave(&cpufreq_driver_lock, flags);
         for_each_cpu(j, policy->cpus)
                 per_cpu(cpufreq_cpu_data, j) = policy;
@@ -1162,20 +1177,6 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 }
         }
 
-        /* related cpus should atleast have policy->cpus */
-        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
-
-        /*
-         * affected cpus must always be the one, which are online. We aren't
-         * managing offline cpus here.
-         */
-        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
-
-        if (!frozen) {
-                policy->user_policy.min = policy->min;
-                policy->user_policy.max = policy->max;
-        }
-
         blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
                                      CPUFREQ_START, policy);
 
@@ -1206,6 +1207,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 policy->user_policy.policy = policy->policy;
                 policy->user_policy.governor = policy->governor;
         }
+        up_write(&policy->rwsem);
 
         kobject_uevent(&policy->kobj, KOBJ_ADD);
         up_read(&cpufreq_rwsem);
@@ -1546,23 +1548,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)
  */
 unsigned int cpufreq_get(unsigned int cpu)
 {
-        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
+        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
         unsigned int ret_freq = 0;
 
-        if (cpufreq_disabled() || !cpufreq_driver)
-                return -ENOENT;
-
-        BUG_ON(!policy);
-
-        if (!down_read_trylock(&cpufreq_rwsem))
-                return 0;
-
-        down_read(&policy->rwsem);
-
-        ret_freq = __cpufreq_get(cpu);
+        if (policy) {
+                down_read(&policy->rwsem);
+                ret_freq = __cpufreq_get(cpu);
+                up_read(&policy->rwsem);
 
-        up_read(&policy->rwsem);
-        up_read(&cpufreq_rwsem);
+                cpufreq_cpu_put(policy);
+        }
 
         return ret_freq;
 }
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index e90816105921..2cd36b9297f3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -39,9 +39,10 @@
 #define BYT_TURBO_RATIOS        0x66c
 
 
-#define FRAC_BITS 8
+#define FRAC_BITS 6
 #define int_tofp(X) ((int64_t)(X) << FRAC_BITS)
 #define fp_toint(X) ((X) >> FRAC_BITS)
+#define FP_ROUNDUP(X) ((X) += 1 << FRAC_BITS)
 
 static inline int32_t mul_fp(int32_t x, int32_t y)
 {
@@ -556,18 +557,20 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
 static inline void intel_pstate_calc_busy(struct cpudata *cpu,
                                         struct sample *sample)
 {
-        u64 core_pct;
-        u64 c0_pct;
+        int32_t core_pct;
+        int32_t c0_pct;
 
-        core_pct = div64_u64(sample->aperf * 100, sample->mperf);
+        core_pct = div_fp(int_tofp((sample->aperf)),
+                        int_tofp((sample->mperf)));
+        core_pct = mul_fp(core_pct, int_tofp(100));
+        FP_ROUNDUP(core_pct);
+
+        c0_pct = div_fp(int_tofp(sample->mperf), int_tofp(sample->tsc));
 
-        c0_pct = div64_u64(sample->mperf * 100, sample->tsc);
         sample->freq = fp_toint(
-                mul_fp(int_tofp(cpu->pstate.max_pstate),
-                        int_tofp(core_pct * 1000)));
+                mul_fp(int_tofp(cpu->pstate.max_pstate * 1000), core_pct));
 
-        sample->core_pct_busy = mul_fp(int_tofp(core_pct),
-                                div_fp(int_tofp(c0_pct + 1), int_tofp(100)));
+        sample->core_pct_busy = mul_fp(core_pct, c0_pct);
 }
 
 static inline void intel_pstate_sample(struct cpudata *cpu)
@@ -579,6 +582,10 @@ static inline void intel_pstate_sample(struct cpudata *cpu)
         rdmsrl(MSR_IA32_MPERF, mperf);
         tsc = native_read_tsc();
 
+        aperf = aperf >> FRAC_BITS;
+        mperf = mperf >> FRAC_BITS;
+        tsc = tsc >> FRAC_BITS;
+
         cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT;
         cpu->samples[cpu->sample_ptr].aperf = aperf;
         cpu->samples[cpu->sample_ptr].mperf = mperf;
@@ -610,7 +617,8 @@ static inline int32_t intel_pstate_get_scaled_busy(struct cpudata *cpu)
         core_busy = cpu->samples[cpu->sample_ptr].core_pct_busy;
         max_pstate = int_tofp(cpu->pstate.max_pstate);
         current_pstate = int_tofp(cpu->pstate.current_pstate);
-        return mul_fp(core_busy, div_fp(max_pstate, current_pstate));
+        core_busy = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
+        return FP_ROUNDUP(core_busy);
 }
 
 static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 4e7918339b12..19041cefabb1 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -449,6 +449,7 @@ static const struct of_device_id sdma_dt_ids[] = {
         { .compatible = "fsl,imx51-sdma", .data = &sdma_imx51, },
         { .compatible = "fsl,imx35-sdma", .data = &sdma_imx35, },
         { .compatible = "fsl,imx31-sdma", .data = &sdma_imx31, },
+        { .compatible = "fsl,imx25-sdma", .data = &sdma_imx25, },
         { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, sdma_dt_ids);
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 87529181efcc..4e3549a16132 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -77,7 +77,8 @@ static irqreturn_t ioat_dma_do_interrupt(int irq, void *data)
         attnstatus = readl(instance->reg_base + IOAT_ATTNSTATUS_OFFSET);
         for_each_set_bit(bit, &attnstatus, BITS_PER_LONG) {
                 chan = ioat_chan_by_index(instance, bit);
-                tasklet_schedule(&chan->cleanup_task);
+                if (test_bit(IOAT_RUN, &chan->state))
+                        tasklet_schedule(&chan->cleanup_task);
         }
 
         writeb(intrctrl, instance->reg_base + IOAT_INTRCTRL_OFFSET);
@@ -93,7 +94,8 @@ static irqreturn_t ioat_dma_do_interrupt_msix(int irq, void *data)
 {
         struct ioat_chan_common *chan = data;
 
-        tasklet_schedule(&chan->cleanup_task);
+        if (test_bit(IOAT_RUN, &chan->state))
+                tasklet_schedule(&chan->cleanup_task);
 
         return IRQ_HANDLED;
 }
@@ -116,7 +118,6 @@ void ioat_init_channel(struct ioatdma_device *device, struct ioat_chan_common *c
         chan->timer.function = device->timer_fn;
         chan->timer.data = data;
         tasklet_init(&chan->cleanup_task, device->cleanup_fn, data);
-        tasklet_disable(&chan->cleanup_task);
 }
 
 /**
@@ -354,13 +355,49 @@ static int ioat1_dma_alloc_chan_resources(struct dma_chan *c)
         writel(((u64) chan->completion_dma) >> 32,
                chan->reg_base + IOAT_CHANCMP_OFFSET_HIGH);
 
-        tasklet_enable(&chan->cleanup_task);
+        set_bit(IOAT_RUN, &chan->state);
         ioat1_dma_start_null_desc(ioat);  /* give chain to dma device */
         dev_dbg(to_dev(chan), "%s: allocated %d descriptors\n",
                 __func__, ioat->desccount);
         return ioat->desccount;
 }
 
+void ioat_stop(struct ioat_chan_common *chan)
+{
+        struct ioatdma_device *device = chan->device;
+        struct pci_dev *pdev = device->pdev;
+        int chan_id = chan_num(chan);
+        struct msix_entry *msix;
+
+        /* 1/ stop irq from firing tasklets
+         * 2/ stop the tasklet from re-arming irqs
+         */
+        clear_bit(IOAT_RUN, &chan->state);
+
+        /* flush inflight interrupts */
+        switch (device->irq_mode) {
+        case IOAT_MSIX:
+                msix = &device->msix_entries[chan_id];
+                synchronize_irq(msix->vector);
+                break;
+        case IOAT_MSI:
+        case IOAT_INTX:
+                synchronize_irq(pdev->irq);
+                break;
+        default:
+                break;
+        }
+
+        /* flush inflight timers */
+        del_timer_sync(&chan->timer);
+
+        /* flush inflight tasklet runs */
+        tasklet_kill(&chan->cleanup_task);
+
+        /* final cleanup now that everything is quiesced and can't re-arm */
+        device->cleanup_fn((unsigned long) &chan->common);
+}
+
 /**
  * ioat1_dma_free_chan_resources - release all the descriptors
  * @chan: the channel to be cleaned
@@ -379,9 +416,7 @@ static void ioat1_dma_free_chan_resources(struct dma_chan *c)
         if (ioat->desccount == 0)
                 return;
 
-        tasklet_disable(&chan->cleanup_task);
-        del_timer_sync(&chan->timer);
-        ioat1_cleanup(ioat);
+        ioat_stop(chan);
 
         /* Delay 100ms after reset to allow internal DMA logic to quiesce
          * before removing DMA descriptor resources.
@@ -526,8 +561,11 @@ ioat1_dma_prep_memcpy(struct dma_chan *c, dma_addr_t dma_dest,
 static void ioat1_cleanup_event(unsigned long data)
 {
         struct ioat_dma_chan *ioat = to_ioat_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat1_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index 11fb877ddca9..e982f00a9843 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -356,6 +356,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
 void ioat_kobject_del(struct ioatdma_device *device);
 int ioat_dma_setup_interrupts(struct ioatdma_device *device);
+void ioat_stop(struct ioat_chan_common *chan);
 extern const struct sysfs_ops ioat_sysfs_ops;
 extern struct ioat_sysfs_entry ioat_version_attr;
 extern struct ioat_sysfs_entry ioat_cap_attr;
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 5d3affe7e976..8d1058085eeb 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -190,8 +190,11 @@ static void ioat2_cleanup(struct ioat2_dma_chan *ioat)
 void ioat2_cleanup_event(unsigned long data)
 {
         struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat2_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
@@ -553,10 +556,10 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
         ioat->issued = 0;
         ioat->tail = 0;
         ioat->alloc_order = order;
+        set_bit(IOAT_RUN, &chan->state);
         spin_unlock_bh(&ioat->prep_lock);
         spin_unlock_bh(&chan->cleanup_lock);
 
-        tasklet_enable(&chan->cleanup_task);
         ioat2_start_null_desc(ioat);
 
         /* check that we got off the ground */
@@ -566,7 +569,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
         } while (i++ < 20 && !is_ioat_active(status) && !is_ioat_idle(status));
 
         if (is_ioat_active(status) || is_ioat_idle(status)) {
-                set_bit(IOAT_RUN, &chan->state);
                 return 1 << ioat->alloc_order;
         } else {
                 u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
@@ -809,11 +811,8 @@ void ioat2_free_chan_resources(struct dma_chan *c)
         if (!ioat->ring)
                 return;
 
-        tasklet_disable(&chan->cleanup_task);
-        del_timer_sync(&chan->timer);
-        device->cleanup_fn((unsigned long) c);
+        ioat_stop(chan);
         device->reset_hw(chan);
-        clear_bit(IOAT_RUN, &chan->state);
 
         spin_lock_bh(&chan->cleanup_lock);
         spin_lock_bh(&ioat->prep_lock);
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 820817e97e62..b9b38a1cf92f 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -464,8 +464,11 @@ static void ioat3_cleanup(struct ioat2_dma_chan *ioat)
 static void ioat3_cleanup_event(unsigned long data)
 {
         struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data);
+        struct ioat_chan_common *chan = &ioat->base;
 
         ioat3_cleanup(ioat);
+        if (!test_bit(IOAT_RUN, &chan->state))
+                return;
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 00a2de957b23..bf18c786ed40 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -1641,6 +1641,7 @@ static void dma_tasklet(unsigned long data)
         struct d40_chan *d40c = (struct d40_chan *) data;
         struct d40_desc *d40d;
         unsigned long flags;
+        bool callback_active;
         dma_async_tx_callback callback;
         void *callback_param;
 
@@ -1668,6 +1669,7 @@ static void dma_tasklet(unsigned long data)
         }
 
         /* Callback to client */
+        callback_active = !!(d40d->txd.flags & DMA_PREP_INTERRUPT);
         callback = d40d->txd.callback;
         callback_param = d40d->txd.callback_param;
 
@@ -1690,7 +1692,7 @@ static void dma_tasklet(unsigned long data)
 
         spin_unlock_irqrestore(&d40c->lock, flags);
 
-        if (callback && (d40d->txd.flags & DMA_PREP_INTERRUPT))
+        if (callback_active && callback)
                 callback(callback_param);
 
         return;
diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
index d63f4798f7d0..57e96a3350f0 100644
--- a/drivers/edac/i7300_edac.c
+++ b/drivers/edac/i7300_edac.c
@@ -943,33 +943,35 @@ static int i7300_get_devices(struct mem_ctl_info *mci)
 
         /* Attempt to 'get' the MCH register we want */
         pdev = NULL;
-        while (!pvt->pci_dev_16_1_fsb_addr_map ||
-               !pvt->pci_dev_16_2_fsb_err_regs) {
-                pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
-                                      PCI_DEVICE_ID_INTEL_I7300_MCH_ERR, pdev);
-                if (!pdev) {
-                        /* End of list, leave */
-                        i7300_printk(KERN_ERR,
-                                "'system address,Process Bus' "
-                                "device not found:"
-                                "vendor 0x%x device 0x%x ERR funcs "
-                                "(broken BIOS?)\n",
-                                PCI_VENDOR_ID_INTEL,
-                                PCI_DEVICE_ID_INTEL_I7300_MCH_ERR);
-                        goto error;
-                }
-
+        while ((pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                      PCI_DEVICE_ID_INTEL_I7300_MCH_ERR,
+                                      pdev))) {
                 /* Store device 16 funcs 1 and 2 */
                 switch (PCI_FUNC(pdev->devfn)) {
                 case 1:
-                        pvt->pci_dev_16_1_fsb_addr_map = pdev;
+                        if (!pvt->pci_dev_16_1_fsb_addr_map)
+                                pvt->pci_dev_16_1_fsb_addr_map =
+                                                        pci_dev_get(pdev);
                         break;
                 case 2:
-                        pvt->pci_dev_16_2_fsb_err_regs = pdev;
+                        if (!pvt->pci_dev_16_2_fsb_err_regs)
+                                pvt->pci_dev_16_2_fsb_err_regs =
+                                                        pci_dev_get(pdev);
                         break;
                 }
         }
 
+        if (!pvt->pci_dev_16_1_fsb_addr_map ||
+            !pvt->pci_dev_16_2_fsb_err_regs) {
+                /* At least one device was not found */
+                i7300_printk(KERN_ERR,
+                        "'system address,Process Bus' device not found:"
+                        "vendor 0x%x device 0x%x ERR funcs (broken BIOS?)\n",
+                        PCI_VENDOR_ID_INTEL,
+                        PCI_DEVICE_ID_INTEL_I7300_MCH_ERR);
+                goto error;
+        }
+
         edac_dbg(1, "System Address, processor bus- PCI Bus ID: %s  %x:%x\n",
                  pci_name(pvt->pci_dev_16_0_fsb_ctlr),
                  pvt->pci_dev_16_0_fsb_ctlr->vendor,
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 87533ca7752e..d871275196f6 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1334,14 +1334,19 @@ static int i7core_get_onedevice(struct pci_dev **prev,
          * is at addr 8086:2c40, instead of 8086:2c41. So, we need
          * to probe for the alternate address in case of failure
          */
-        if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev)
+        if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev) {
+                pci_dev_get(*prev);     /* pci_get_device will put it */
                 pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                       PCI_DEVICE_ID_INTEL_I7_NONCORE_ALT, *prev);
+        }
 
-        if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE && !pdev)
+        if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE &&
+            !pdev) {
+                pci_dev_get(*prev);     /* pci_get_device will put it */
                 pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                       PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE_ALT,
                                       *prev);
+        }
 
         if (!pdev) {
                 if (*prev) {
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index c20602f601ee..98a14f6143a7 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -222,27 +222,19 @@ static void arizona_extcon_pulse_micbias(struct arizona_extcon_info *info)
         struct snd_soc_dapm_context *dapm = arizona->dapm;
         int ret;
 
-        mutex_lock(&dapm->card->dapm_mutex);
-
         ret = snd_soc_dapm_force_enable_pin(dapm, widget);
         if (ret != 0)
                 dev_warn(arizona->dev, "Failed to enable %s: %d\n",
                          widget, ret);
 
-        mutex_unlock(&dapm->card->dapm_mutex);
-
         snd_soc_dapm_sync(dapm);
 
         if (!arizona->pdata.micd_force_micbias) {
-                mutex_lock(&dapm->card->dapm_mutex);
-
                 ret = snd_soc_dapm_disable_pin(arizona->dapm, widget);
                 if (ret != 0)
                         dev_warn(arizona->dev, "Failed to disable %s: %d\n",
                                  widget, ret);
 
-                mutex_unlock(&dapm->card->dapm_mutex);
-
                 snd_soc_dapm_sync(dapm);
         }
 }
@@ -304,16 +296,12 @@ static void arizona_stop_mic(struct arizona_extcon_info *info)
                                  ARIZONA_MICD_ENA, 0,
                                  &change);
 
-        mutex_lock(&dapm->card->dapm_mutex);
-
         ret = snd_soc_dapm_disable_pin(dapm, widget);
         if (ret != 0)
                 dev_warn(arizona->dev,
                          "Failed to disable %s: %d\n",
                          widget, ret);
 
-        mutex_unlock(&dapm->card->dapm_mutex);
-
         snd_soc_dapm_sync(dapm);
 
         if (info->micd_reva) {
diff --git a/drivers/fmc/fmc-write-eeprom.c b/drivers/fmc/fmc-write-eeprom.c
index ee5b47904130..9bb2cbd5c9f2 100644
--- a/drivers/fmc/fmc-write-eeprom.c
+++ b/drivers/fmc/fmc-write-eeprom.c
@@ -27,7 +27,7 @@ FMC_PARAM_BUSID(fwe_drv);
 /* The "file=" is like the generic "gateware=" used elsewhere */
 static char *fwe_file[FMC_MAX_CARDS];
 static int fwe_file_n;
-module_param_array_named(file, fwe_file, charp, &fwe_file_n, 444);
+module_param_array_named(file, fwe_file, charp, &fwe_file_n, 0444);
 
 static int fwe_run_tlv(struct fmc_device *fmc, const struct firmware *fw,
         int write)
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index acf3a36c9ebc..32982da82694 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -68,15 +68,7 @@ void __armada_drm_queue_unref_work(struct drm_device *dev,
 {
         struct armada_private *priv = dev->dev_private;
 
-        /*
-         * Yes, we really must jump through these hoops just to store a
-         * _pointer_ to something into the kfifo.  This is utterly insane
-         * and idiotic, because it kfifo requires the _data_ pointed to by
-         * the pointer const, not the pointer itself.  Not only that, but
-         * you have to pass a pointer _to_ the pointer you want stored.
-         */
-        const struct drm_framebuffer *silly_api_alert = fb;
-        WARN_ON(!kfifo_put(&priv->fb_unref, &silly_api_alert));
+        WARN_ON(!kfifo_put(&priv->fb_unref, fb));
         schedule_work(&priv->fb_unref_work);
 }
 
diff --git a/drivers/gpu/drm/bochs/Kconfig b/drivers/gpu/drm/bochs/Kconfig
index c8fcf12019f0..5f8b0c2b9a44 100644
--- a/drivers/gpu/drm/bochs/Kconfig
+++ b/drivers/gpu/drm/bochs/Kconfig
@@ -2,6 +2,7 @@ config DRM_BOCHS
         tristate "DRM Support for bochs dispi vga interface (qemu stdvga)"
         depends on DRM && PCI
         select DRM_KMS_HELPER
+        select DRM_KMS_FB_HELPER
         select FB_SYS_FILLRECT
         select FB_SYS_COPYAREA
         select FB_SYS_IMAGEBLIT
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 04f1f02c4019..ec7bb0fc71bc 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -403,7 +403,7 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
 void intel_detect_pch(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct pci_dev *pch;
+        struct pci_dev *pch = NULL;
 
         /* In all current cases, num_pipes is equivalent to the PCH_NOP setting
          * (which really amounts to a PCH but no South Display).
@@ -424,12 +424,9 @@ void intel_detect_pch(struct drm_device *dev)
          * all the ISA bridge devices and check for the first match, instead
          * of only checking the first one.
          */
-        pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, NULL);
-        while (pch) {
-                struct pci_dev *curr = pch;
+        while ((pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, pch))) {
                 if (pch->vendor == PCI_VENDOR_ID_INTEL) {
-                        unsigned short id;
-                        id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
+                        unsigned short id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
                         dev_priv->pch_id = id;
 
                         if (id == INTEL_PCH_IBX_DEVICE_ID_TYPE) {
@@ -461,18 +458,16 @@ void intel_detect_pch(struct drm_device *dev)
                                 DRM_DEBUG_KMS("Found LynxPoint LP PCH\n");
                                 WARN_ON(!IS_HASWELL(dev));
                                 WARN_ON(!IS_ULT(dev));
-                        } else {
-                                goto check_next;
-                        }
-                        pci_dev_put(pch);
+                        } else
+                                continue;
+
                         break;
                 }
-check_next:
-                pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, curr);
-                pci_dev_put(curr);
         }
         if (!pch)
-                DRM_DEBUG_KMS("No PCH found?\n");
+                DRM_DEBUG_KMS("No PCH found.\n");
+
+        pci_dev_put(pch);
 }
 
 bool i915_semaphore_is_enabled(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 1a24e84f2315..d58b4e287e32 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -82,9 +82,22 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
         r = devm_request_mem_region(dev->dev, base, dev_priv->gtt.stolen_size,
                                     "Graphics Stolen Memory");
         if (r == NULL) {
-                DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
-                          base, base + (uint32_t)dev_priv->gtt.stolen_size);
-                base = 0;
+                /*
+                 * One more attempt but this time requesting region from
+                 * base + 1, as we have seen that this resolves the region
+                 * conflict with the PCI Bus.
+                 * This is a BIOS w/a: Some BIOS wrap stolen in the root
+                 * PCI bus, but have an off-by-one error. Hence retry the
+                 * reservation starting from 1 instead of 0.
+                 */
+                r = devm_request_mem_region(dev->dev, base + 1,
+                                            dev_priv->gtt.stolen_size - 1,
+                                            "Graphics Stolen Memory");
+                if (r == NULL) {
+                        DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
+                                  base, base + (uint32_t)dev_priv->gtt.stolen_size);
+                        base = 0;
+                }
         }
 
         return base;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 4c1672809493..9b8a7c7ea7fc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1092,12 +1092,12 @@ static void assert_cursor(struct drm_i915_private *dev_priv,
         struct drm_device *dev = dev_priv->dev;
         bool cur_state;
 
-        if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
-                cur_state = I915_READ(CURCNTR_IVB(pipe)) & CURSOR_MODE;
-        else if (IS_845G(dev) || IS_I865G(dev))
+        if (IS_845G(dev) || IS_I865G(dev))
                 cur_state = I915_READ(_CURACNTR) & CURSOR_ENABLE;
-        else
+        else if (INTEL_INFO(dev)->gen <= 6 || IS_VALLEYVIEW(dev))
                 cur_state = I915_READ(CURCNTR(pipe)) & CURSOR_MODE;
+        else
+                cur_state = I915_READ(CURCNTR_IVB(pipe)) & CURSOR_MODE;
 
         WARN(cur_state != state,
              "cursor on pipe %c assertion failure (expected %s, current %s)\n",
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 6db0d9d17f47..ee3181ebcc92 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -845,7 +845,7 @@ static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
 {
         struct drm_device *dev = intel_hdmi_to_dev(hdmi);
 
-        if (IS_G4X(dev))
+        if (!hdmi->has_hdmi_sink || IS_G4X(dev))
                 return 165000;
         else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
                 return 300000;
@@ -899,8 +899,8 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
          * outputs. We also need to check that the higher clock still fits
          * within limits.
          */
-        if (pipe_config->pipe_bpp > 8*3 && clock_12bpc <= portclock_limit
-            && HAS_PCH_SPLIT(dev)) {
+        if (pipe_config->pipe_bpp > 8*3 && intel_hdmi->has_hdmi_sink &&
+            clock_12bpc <= portclock_limit && HAS_PCH_SPLIT(dev)) {
                 DRM_DEBUG_KMS("picking bpc to 12 for HDMI output\n");
                 desired_bpp = 12*3;
 
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 350de359123a..079ea38f14d9 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -698,7 +698,7 @@ static void i9xx_enable_backlight(struct intel_connector *connector)
                 freq /= 0xff;
 
         ctl = freq << 17;
-        if (IS_GEN2(dev) && panel->backlight.combination_mode)
+        if (panel->backlight.combination_mode)
                 ctl |= BLM_LEGACY_MODE;
         if (IS_PINEVIEW(dev) && panel->backlight.active_low_pwm)
                 ctl |= BLM_POLARITY_PNV;
@@ -979,7 +979,7 @@ static int i9xx_setup_backlight(struct intel_connector *connector)
 
         ctl = I915_READ(BLC_PWM_CTL);
 
-        if (IS_GEN2(dev))
+        if (IS_GEN2(dev) || IS_I915GM(dev) || IS_I945GM(dev))
                 panel->backlight.combination_mode = ctl & BLM_LEGACY_MODE;
 
         if (IS_PINEVIEW(dev))
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index d77cc81900f9..e1fc35a72656 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3493,6 +3493,8 @@ static void valleyview_setup_pctx(struct drm_device *dev)
         u32 pcbr;
         int pctx_size = 24*1024;
 
+        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
+
         pcbr = I915_READ(VLV_PCBR);
         if (pcbr) {
                 /* BIOS set it up already, grab the pre-alloc'd space */
@@ -3542,8 +3544,6 @@ static void valleyview_enable_rps(struct drm_device *dev)
                 I915_WRITE(GTFIFODBG, gtfifodbg);
         }
 
-        valleyview_setup_pctx(dev);
-
         /* If VLV, Forcewake all wells, else re-direct to regular path */
         gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
 
@@ -4395,6 +4395,8 @@ void intel_enable_gt_powersave(struct drm_device *dev)
                 ironlake_enable_rc6(dev);
                 intel_init_emon(dev);
         } else if (IS_GEN6(dev) || IS_GEN7(dev)) {
+                if (IS_VALLEYVIEW(dev))
+                        valleyview_setup_pctx(dev);
                 /*
                  * PCU communication is slow and this doesn't need to be
                  * done at any specific time, so do this out of our fast path
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 0d19f4f94d5a..daa4dd375ab1 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1774,6 +1774,20 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                         return ATOM_PPLL1;
                 DRM_ERROR("unable to allocate a PPLL\n");
                 return ATOM_PPLL_INVALID;
+        } else if (ASIC_IS_DCE41(rdev)) {
+                /* Don't share PLLs on DCE4.1 chips */
+                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(radeon_crtc->encoder))) {
+                        if (rdev->clock.dp_extclk)
+                                /* skip PPLL programming if using ext clock */
+                                return ATOM_PPLL_INVALID;
+                }
+                pll_in_use = radeon_get_pll_use_mask(crtc);
+                if (!(pll_in_use & (1 << ATOM_PPLL1)))
+                        return ATOM_PPLL1;
+                if (!(pll_in_use & (1 << ATOM_PPLL2)))
+                        return ATOM_PPLL2;
+                DRM_ERROR("unable to allocate a PPLL\n");
+                return ATOM_PPLL_INVALID;
         } else if (ASIC_IS_DCE4(rdev)) {
                 /* in DP mode, the DP ref clock can come from PPLL, DCPLL, or ext clock,
                  * depending on the asic:
@@ -1801,7 +1815,7 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                                 if (pll != ATOM_PPLL_INVALID)
                                         return pll;
                         }
-                } else if (!ASIC_IS_DCE41(rdev)) { /* Don't share PLLs on DCE4.1 chips */
+                } else {
                         /* use the same PPLL for all monitors with the same clock */
                         pll = radeon_get_shared_nondp_ppll(crtc);
                         if (pll != ATOM_PPLL_INVALID)
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 2cec2ab02f80..607dc14d195e 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1314,7 +1314,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                         }
                         if (is_dp)
                                 args.v5.ucLaneNum = dp_lane_count;
-                        else if (radeon_encoder->pixel_clock > 165000)
+                        else if (radeon_dig_monitor_is_duallink(encoder, radeon_encoder->pixel_clock))
                                 args.v5.ucLaneNum = 8;
                         else
                                 args.v5.ucLaneNum = 4;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e6419ca7cd37..e22be8458d92 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3046,7 +3046,7 @@ static u32 cik_create_bitmask(u32 bit_width)
 }
 
 /**
- * cik_select_se_sh - select which SE, SH to address
+ * cik_get_rb_disabled - computes the mask of disabled RBs
  *
  * @rdev: radeon_device pointer
  * @max_rb_num: max RBs (render backends) for the asic
@@ -7902,7 +7902,8 @@ int cik_resume(struct radeon_device *rdev)
         /* init golden registers */
         cik_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = cik_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 713a5d359901..94e858751994 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -278,13 +278,15 @@ static int dce6_audio_chipset_supported(struct radeon_device *rdev)
         return !ASIC_IS_NODCE(rdev);
 }
 
-static void dce6_audio_enable(struct radeon_device *rdev,
-                              struct r600_audio_pin *pin,
-                              bool enable)
+void dce6_audio_enable(struct radeon_device *rdev,
+                       struct r600_audio_pin *pin,
+                       bool enable)
 {
+        if (!pin)
+                return;
+
         WREG32_ENDPOINT(pin->offset, AZ_F0_CODEC_PIN_CONTROL_HOTPLUG_CONTROL,
-                        AUDIO_ENABLED);
-        DRM_INFO("%s audio %d support\n", enable ? "Enabling" : "Disabling", pin->id);
+                        enable ? AUDIO_ENABLED : 0);
 }
 
 static const u32 pin_offsets[7] =
@@ -323,7 +325,8 @@ int dce6_audio_init(struct radeon_device *rdev)
                 rdev->audio.pin[i].connected = false;
                 rdev->audio.pin[i].offset = pin_offsets[i];
                 rdev->audio.pin[i].id = i;
-                dce6_audio_enable(rdev, &rdev->audio.pin[i], true);
+                /* disable audio.  it will be set up later */
+                dce6_audio_enable(rdev, &rdev->audio.pin[i], false);
         }
 
         return 0;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 5623e7542d99..27b0ff16082e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -5299,7 +5299,8 @@ int evergreen_resume(struct radeon_device *rdev)
         /* init golden registers */
         evergreen_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = evergreen_startup(rdev);
@@ -5475,9 +5476,9 @@ void evergreen_fini(struct radeon_device *rdev)
         radeon_wb_fini(rdev);
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
-        evergreen_pcie_gart_fini(rdev);
         uvd_v1_0_fini(rdev);
         radeon_uvd_fini(rdev);
+        evergreen_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
         radeon_fence_driver_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index 0c6d5cef4cf1..05b0c95813fd 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -306,6 +306,15 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
                 return;
         offset = dig->afmt->offset;
 
+        /* disable audio prior to setting up hw */
+        if (ASIC_IS_DCE6(rdev)) {
+                dig->afmt->pin = dce6_audio_get_pin(rdev);
+                dce6_audio_enable(rdev, dig->afmt->pin, false);
+        } else {
+                dig->afmt->pin = r600_audio_get_pin(rdev);
+                r600_audio_enable(rdev, dig->afmt->pin, false);
+        }
+
         evergreen_audio_set_dto(encoder, mode->clock);
 
         WREG32(HDMI_VBI_PACKET_CONTROL + offset,
@@ -409,12 +418,16 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
         WREG32(AFMT_RAMP_CONTROL1 + offset, 0x007FFFFF);
         WREG32(AFMT_RAMP_CONTROL2 + offset, 0x00000001);
         WREG32(AFMT_RAMP_CONTROL3 + offset, 0x00000001);
+
+        /* enable audio after to setting up hw */
+        if (ASIC_IS_DCE6(rdev))
+                dce6_audio_enable(rdev, dig->afmt->pin, true);
+        else
+                r600_audio_enable(rdev, dig->afmt->pin, true);
 }
 
 void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
 {
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 
@@ -427,15 +440,6 @@ void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (!enable && !dig->afmt->enabled)
                 return;
 
-        if (enable) {
-                if (ASIC_IS_DCE6(rdev))
-                        dig->afmt->pin = dce6_audio_get_pin(rdev);
-                else
-                        dig->afmt->pin = r600_audio_get_pin(rdev);
-        } else {
-                dig->afmt->pin = NULL;
-        }
-
         dig->afmt->enabled = enable;
 
         DRM_DEBUG("%sabling HDMI interface @ 0x%04X for encoder 0x%x\n",
diff --git a/drivers/gpu/drm/radeon/evergreen_smc.h b/drivers/gpu/drm/radeon/evergreen_smc.h
index 76ada8cfe902..3a03ba37d043 100644
--- a/drivers/gpu/drm/radeon/evergreen_smc.h
+++ b/drivers/gpu/drm/radeon/evergreen_smc.h
@@ -57,7 +57,7 @@ typedef struct SMC_Evergreen_MCRegisters SMC_Evergreen_MCRegisters;
 
 #define EVERGREEN_SMC_FIRMWARE_HEADER_LOCATION 0x100
 
-#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x0
+#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x8
 #define EVERGREEN_SMC_FIRMWARE_HEADER_stateTable      0xC
 #define EVERGREEN_SMC_FIRMWARE_HEADER_mcRegisterTable 0x20
 
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index ea932ac66fc6..bf6300cfd62d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -2105,7 +2105,8 @@ int cayman_resume(struct radeon_device *rdev)
         /* init golden registers */
         ni_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = cayman_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index ef024ce3f7cc..3cc78bb66042 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3942,8 +3942,6 @@ int r100_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r100_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 7c63ef840e86..0b658b34b33a 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -1430,8 +1430,6 @@ int r300_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r300_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 3768aab2710b..802b19220a21 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -325,8 +325,6 @@ int r420_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r420_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index e209eb75024f..98d6053c36c6 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -240,8 +240,6 @@ int r520_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r520_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index cdbc4171fe73..647ef4079217 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2968,7 +2968,8 @@ int r600_resume(struct radeon_device *rdev)
         /* post card */
         atom_asic_init(rdev->mode_info.atom_context);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = r600_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
index 47fc2b886979..bffac10c4296 100644
--- a/drivers/gpu/drm/radeon/r600_audio.c
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -142,12 +142,15 @@ void r600_audio_update_hdmi(struct work_struct *work)
 }
 
 /* enable the audio stream */
-static void r600_audio_enable(struct radeon_device *rdev,
-                              struct r600_audio_pin *pin,
-                              bool enable)
+void r600_audio_enable(struct radeon_device *rdev,
+                       struct r600_audio_pin *pin,
+                       bool enable)
 {
         u32 value = 0;
 
+        if (!pin)
+                return;
+
         if (ASIC_IS_DCE4(rdev)) {
                 if (enable) {
                         value |= 0x81000000; /* Required to enable audio */
@@ -158,7 +161,6 @@ static void r600_audio_enable(struct radeon_device *rdev,
                 WREG32_P(R600_AUDIO_ENABLE,
                          enable ? 0x81000000 : 0x0, ~0x81000000);
         }
-        DRM_INFO("%s audio %d support\n", enable ? "Enabling" : "Disabling", pin->id);
 }
 
 /*
@@ -178,8 +180,8 @@ int r600_audio_init(struct radeon_device *rdev)
         rdev->audio.pin[0].status_bits = 0;
         rdev->audio.pin[0].category_code = 0;
         rdev->audio.pin[0].id = 0;
-
-        r600_audio_enable(rdev, &rdev->audio.pin[0], true);
+        /* disable audio.  it will be set up later */
+        r600_audio_enable(rdev, &rdev->audio.pin[0], false);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 3016fc14f502..85a2bb28aed2 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -329,9 +329,6 @@ static void dce3_2_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         u8 *sadb;
         int sad_count;
 
-        /* XXX: setting this register causes hangs on some asics */
-        return;
-
         list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
                 if (connector->encoder == encoder) {
                         radeon_connector = to_radeon_connector(connector);
@@ -460,6 +457,10 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
                 return;
         offset = dig->afmt->offset;
 
+        /* disable audio prior to setting up hw */
+        dig->afmt->pin = r600_audio_get_pin(rdev);
+        r600_audio_enable(rdev, dig->afmt->pin, false);
+
         r600_audio_set_dto(encoder, mode->clock);
 
         WREG32(HDMI0_VBI_PACKET_CONTROL + offset,
@@ -531,6 +532,9 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
         WREG32(HDMI0_RAMP_CONTROL3 + offset, 0x00000001);
 
         r600_hdmi_audio_workaround(encoder);
+
+        /* enable audio after to setting up hw */
+        r600_audio_enable(rdev, dig->afmt->pin, true);
 }
 
 /*
@@ -651,11 +655,6 @@ void r600_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (!enable && !dig->afmt->enabled)
                 return;
 
-        if (enable)
-                dig->afmt->pin = r600_audio_get_pin(rdev);
-        else
-                dig->afmt->pin = NULL;
-
         /* Older chipsets require setting HDMI and routing manually */
         if (!ASIC_IS_DCE3(rdev)) {
                 if (enable)
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 024db37b1832..e887d027b6d0 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -2747,6 +2747,12 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
 void r600_audio_update_hdmi(struct work_struct *work);
 struct r600_audio_pin *r600_audio_get_pin(struct radeon_device *rdev);
 struct r600_audio_pin *dce6_audio_get_pin(struct radeon_device *rdev);
+void r600_audio_enable(struct radeon_device *rdev,
+                       struct r600_audio_pin *pin,
+                       bool enable);
+void dce6_audio_enable(struct radeon_device *rdev,
+                       struct r600_audio_pin *pin,
+                       bool enable);
 
 /*
  * R600 vram scratch functions
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 485848f889f5..fa9a9c02751e 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -219,7 +219,8 @@ static int radeon_atpx_verify_interface(struct radeon_atpx *atpx)
         memcpy(&output, info->buffer.pointer, size);
 
         /* TODO: check version? */
-        printk("ATPX version %u\n", output.version);
+        printk("ATPX version %u, functions 0x%08x\n",
+               output.version, output.function_bits);
 
         radeon_atpx_parse_functions(&atpx->functions, output.function_bits);
 
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index b012cbbc3ed5..044bc98fb459 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1521,13 +1521,16 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         if (r)
                 DRM_ERROR("ib ring test failed (%d).\n", r);
 
-        if (rdev->pm.dpm_enabled) {
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
                 /* do dpm late init */
                 r = radeon_pm_late_init(rdev);
                 if (r) {
                         rdev->pm.dpm_enabled = false;
                         DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n");
                 }
+        } else {
+                /* resume old pm late */
+                radeon_pm_resume(rdev);
         }
 
         radeon_restore_bios_scratch_regs(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 114d1672d616..2aecd6dc2610 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -537,6 +537,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
 
                 radeon_vm_init(rdev, &fpriv->vm);
 
+                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                if (r)
+                        return r;
+
                 /* map the ib pool buffer read only into
                  * virtual address space */
                 bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
@@ -544,6 +548,8 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                 r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
                                           RADEON_VM_PAGE_READABLE |
                                           RADEON_VM_PAGE_SNOOPED);
+
+                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
                 if (r) {
                         radeon_vm_fini(rdev, &fpriv->vm);
                         kfree(fpriv);
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 77f5b0c3edb8..040a2a10ea17 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -714,6 +714,9 @@ int radeon_ttm_init(struct radeon_device *rdev)
                 DRM_ERROR("Failed initializing VRAM heap.\n");
                 return r;
         }
+        /* Change the size here instead of the init above so only lpfn is affected */
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
+
         r = radeon_bo_create(rdev, 256 * 1024, PAGE_SIZE, true,
                              RADEON_GEM_DOMAIN_VRAM,
                              NULL, &rdev->stollen_vga_memory);
@@ -935,7 +938,7 @@ static ssize_t radeon_ttm_gtt_read(struct file *f, char __user *buf,
         while (size) {
                 loff_t p = *pos / PAGE_SIZE;
                 unsigned off = *pos & ~PAGE_MASK;
-                ssize_t cur_size = min(size, PAGE_SIZE - off);
+                size_t cur_size = min_t(size_t, size, PAGE_SIZE - off);
                 struct page *page;
                 void *ptr;
 
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 6781fee1eaad..3e6804b2b2ef 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -171,6 +171,8 @@ void radeon_uvd_fini(struct radeon_device *rdev)
 
         radeon_bo_unref(&rdev->uvd.vcpu_bo);
 
+        radeon_ring_fini(rdev, &rdev->ring[R600_RING_TYPE_UVD_INDEX]);
+
         release_firmware(rdev->uvd_fw);
 }
 
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index b5c2369cda2f..130d5cc50d43 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -474,8 +474,6 @@ int rs400_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs400_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index fdcde7693032..72d3616de08e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -1048,8 +1048,6 @@ int rs600_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs600_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 35950738bd5e..3462b64369bf 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -756,8 +756,6 @@ int rs690_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs690_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 98e8138ff779..237dd29d9f1c 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -586,8 +586,6 @@ int rv515_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r =  rv515_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 6c772e58c784..fef310773aad 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1811,7 +1811,8 @@ int rv770_resume(struct radeon_device *rdev)
         /* init golden registers */
         rv770_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = rv770_startup(rdev);
@@ -1955,9 +1956,9 @@ void rv770_fini(struct radeon_device *rdev)
         radeon_wb_fini(rdev);
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
-        rv770_pcie_gart_fini(rdev);
         uvd_v1_0_fini(rdev);
         radeon_uvd_fini(rdev);
+        rv770_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
         radeon_fence_driver_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 83578324e5d1..9a124d0608b3 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6618,7 +6618,8 @@ int si_resume(struct radeon_device *rdev)
         /* init golden registers */
         si_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = si_startup(rdev);
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 88a529008ce0..c71594754f46 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -104,7 +104,7 @@ static void tegra_drm_context_free(struct tegra_drm_context *context)
 
 static void tegra_drm_lastclose(struct drm_device *drm)
 {
-#ifdef CONFIG_TEGRA_DRM_FBDEV
+#ifdef CONFIG_DRM_TEGRA_FBDEV
         struct tegra_drm *tegra = drm->dev_private;
 
         tegra_fbdev_restore_mode(tegra->fbdev);
diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
index 338f7f6561d7..0266fb40479e 100644
--- a/drivers/gpu/drm/tegra/rgb.c
+++ b/drivers/gpu/drm/tegra/rgb.c
@@ -15,6 +15,7 @@
 struct tegra_rgb {
         struct tegra_output output;
         struct tegra_dc *dc;
+        bool enabled;
 
         struct clk *clk_parent;
         struct clk *clk;
@@ -89,6 +90,9 @@ static int tegra_output_rgb_enable(struct tegra_output *output)
         struct tegra_rgb *rgb = to_rgb(output);
         unsigned long value;
 
+        if (rgb->enabled)
+                return 0;
+
         tegra_dc_write_regs(rgb->dc, rgb_enable, ARRAY_SIZE(rgb_enable));
 
         value = DE_SELECT_ACTIVE | DE_CONTROL_NORMAL;
@@ -122,6 +126,8 @@ static int tegra_output_rgb_enable(struct tegra_output *output)
         tegra_dc_writel(rgb->dc, GENERAL_ACT_REQ << 8, DC_CMD_STATE_CONTROL);
         tegra_dc_writel(rgb->dc, GENERAL_ACT_REQ, DC_CMD_STATE_CONTROL);
 
+        rgb->enabled = true;
+
         return 0;
 }
 
@@ -130,6 +136,9 @@ static int tegra_output_rgb_disable(struct tegra_output *output)
         struct tegra_rgb *rgb = to_rgb(output);
         unsigned long value;
 
+        if (!rgb->enabled)
+                return 0;
+
         value = tegra_dc_readl(rgb->dc, DC_CMD_DISPLAY_POWER_CONTROL);
         value &= ~(PW0_ENABLE | PW1_ENABLE | PW2_ENABLE | PW3_ENABLE |
                    PW4_ENABLE | PM0_ENABLE | PM1_ENABLE);
@@ -144,6 +153,8 @@ static int tegra_output_rgb_disable(struct tegra_output *output)
 
         tegra_dc_write_regs(rgb->dc, rgb_disable, ARRAY_SIZE(rgb_disable));
 
+        rgb->enabled = false;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/svga3d_reg.h b/drivers/gpu/drm/vmwgfx/svga3d_reg.h
index bb594c11605e..f58dc7dd15c5 100644
--- a/drivers/gpu/drm/vmwgfx/svga3d_reg.h
+++ b/drivers/gpu/drm/vmwgfx/svga3d_reg.h
@@ -261,12 +261,7 @@ typedef enum SVGA3dSurfaceFormat {
    /* Planar video formats. */
    SVGA3D_YV12                         = 121,
 
-   /* Shader constant formats. */
-   SVGA3D_SURFACE_SHADERCONST_FLOAT    = 122,
-   SVGA3D_SURFACE_SHADERCONST_INT      = 123,
-   SVGA3D_SURFACE_SHADERCONST_BOOL     = 124,
-
-   SVGA3D_FORMAT_MAX                   = 125,
+   SVGA3D_FORMAT_MAX                   = 122,
 } SVGA3dSurfaceFormat;
 
 typedef uint32 SVGA3dColor; /* a, r, g, b */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 9e4be1725985..07831554dad7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -40,7 +40,7 @@
 #include <drm/ttm/ttm_module.h>
 #include "vmwgfx_fence.h"
 
-#define VMWGFX_DRIVER_DATE "20121114"
+#define VMWGFX_DRIVER_DATE "20140228"
 #define VMWGFX_DRIVER_MAJOR 2
 #define VMWGFX_DRIVER_MINOR 5
 #define VMWGFX_DRIVER_PATCHLEVEL 0
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
index d4a5a19cb8c3..04a64b8cd3cd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
@@ -188,18 +188,20 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv,
 
         bo = otable->page_table->pt_bo;
         cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
-        if (unlikely(cmd == NULL))
-                DRM_ERROR("Failed reserving FIFO space for OTable setup.\n");
-
-        memset(cmd, 0, sizeof(*cmd));
-        cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
-        cmd->header.size = sizeof(cmd->body);
-        cmd->body.type = type;
-        cmd->body.baseAddress = 0;
-        cmd->body.sizeInBytes = 0;
-        cmd->body.validSizeInBytes = 0;
-        cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
-        vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        if (unlikely(cmd == NULL)) {
+                DRM_ERROR("Failed reserving FIFO space for OTable "
+                          "takedown.\n");
+        } else {
+                memset(cmd, 0, sizeof(*cmd));
+                cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
+                cmd->header.size = sizeof(cmd->body);
+                cmd->body.type = type;
+                cmd->body.baseAddress = 0;
+                cmd->body.sizeInBytes = 0;
+                cmd->body.validSizeInBytes = 0;
+                cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
+                vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        }
 
         if (bo) {
                 int ret;
@@ -562,11 +564,12 @@ void vmw_mob_unbind(struct vmw_private *dev_priv,
         if (unlikely(cmd == NULL)) {
                 DRM_ERROR("Failed reserving FIFO space for Memory "
                           "Object unbinding.\n");
+        } else {
+                cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
+                cmd->header.size = sizeof(cmd->body);
+                cmd->body.mobid = mob->id;
+                vmw_fifo_commit(dev_priv, sizeof(*cmd));
         }
-        cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
-        cmd->header.size = sizeof(cmd->body);
-        cmd->body.mobid = mob->id;
-        vmw_fifo_commit(dev_priv, sizeof(*cmd));
         if (bo) {
                 vmw_fence_single_bo(bo, NULL);
                 ttm_bo_unreserve(bo);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 2aa4bc6a4d60..9757b57f8388 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -427,8 +427,7 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
         INIT_LIST_HEAD(&vmw_bo->res_list);
 
         ret = ttm_bo_init(bdev, &vmw_bo->base, size,
-                          (user) ? ttm_bo_type_device :
-                          ttm_bo_type_kernel, placement,
+                          ttm_bo_type_device, placement,
                           0, interruptible,
                           NULL, acc_size, NULL, bo_free);
         return ret;
diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
index 1146e3bba6e1..112f27e51bc7 100644
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -538,7 +538,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev)
 
                 g->base = job->gather_addr_phys[i];
 
-                for (j = 0; j < job->num_gathers; j++)
+                for (j = i + 1; j < job->num_gathers; j++)
                         if (job->gathers[j].bo == g->bo)
                                 job->gathers[j].handled = true;
 
diff --git a/drivers/iio/gyro/Kconfig b/drivers/iio/gyro/Kconfig
index 41c64a43bcab..ac2d69e34c8c 100644
--- a/drivers/iio/gyro/Kconfig
+++ b/drivers/iio/gyro/Kconfig
@@ -70,7 +70,7 @@ config IIO_ST_GYRO_3AXIS
         select IIO_TRIGGERED_BUFFER if (IIO_BUFFER)
         help
           Say yes here to build support for STMicroelectronics gyroscopes:
-          L3G4200D, LSM330DL, L3GD20, L3GD20H, LSM330DLC, L3G4IS, LSM330.
+          L3G4200D, LSM330DL, L3GD20, LSM330DLC, L3G4IS, LSM330.
 
           This driver can also be built as a module. If so, these modules
           will be created:
diff --git a/drivers/iio/gyro/st_gyro.h b/drivers/iio/gyro/st_gyro.h
index f8f2bf84a5a2..c197360c450b 100644
--- a/drivers/iio/gyro/st_gyro.h
+++ b/drivers/iio/gyro/st_gyro.h
@@ -19,7 +19,6 @@
 #define LSM330DL_GYRO_DEV_NAME          "lsm330dl_gyro"
 #define LSM330DLC_GYRO_DEV_NAME         "lsm330dlc_gyro"
 #define L3GD20_GYRO_DEV_NAME            "l3gd20"
-#define L3GD20H_GYRO_DEV_NAME           "l3gd20h"
 #define L3G4IS_GYRO_DEV_NAME            "l3g4is_ui"
 #define LSM330_GYRO_DEV_NAME            "lsm330_gyro"
 
diff --git a/drivers/iio/gyro/st_gyro_core.c b/drivers/iio/gyro/st_gyro_core.c
index d53d91adfb55..a8e174a47bc4 100644
--- a/drivers/iio/gyro/st_gyro_core.c
+++ b/drivers/iio/gyro/st_gyro_core.c
@@ -167,11 +167,10 @@ static const struct st_sensors st_gyro_sensors[] = {
                 .wai = ST_GYRO_2_WAI_EXP,
                 .sensors_supported = {
                         [0] = L3GD20_GYRO_DEV_NAME,
-                        [1] = L3GD20H_GYRO_DEV_NAME,
-                        [2] = LSM330D_GYRO_DEV_NAME,
-                        [3] = LSM330DLC_GYRO_DEV_NAME,
-                        [4] = L3G4IS_GYRO_DEV_NAME,
-                        [5] = LSM330_GYRO_DEV_NAME,
+                        [1] = LSM330D_GYRO_DEV_NAME,
+                        [2] = LSM330DLC_GYRO_DEV_NAME,
+                        [3] = L3G4IS_GYRO_DEV_NAME,
+                        [4] = LSM330_GYRO_DEV_NAME,
                 },
                 .ch = (struct iio_chan_spec *)st_gyro_16bit_channels,
                 .odr = {
diff --git a/drivers/iio/gyro/st_gyro_i2c.c b/drivers/iio/gyro/st_gyro_i2c.c
index 16b8b8d70bf1..23c12f361b05 100644
--- a/drivers/iio/gyro/st_gyro_i2c.c
+++ b/drivers/iio/gyro/st_gyro_i2c.c
@@ -55,7 +55,6 @@ static const struct i2c_device_id st_gyro_id_table[] = {
         { LSM330DL_GYRO_DEV_NAME },
         { LSM330DLC_GYRO_DEV_NAME },
         { L3GD20_GYRO_DEV_NAME },
-        { L3GD20H_GYRO_DEV_NAME },
         { L3G4IS_GYRO_DEV_NAME },
         { LSM330_GYRO_DEV_NAME },
         {},
diff --git a/drivers/iio/gyro/st_gyro_spi.c b/drivers/iio/gyro/st_gyro_spi.c
index 94763e25caf9..b4ad3be26687 100644
--- a/drivers/iio/gyro/st_gyro_spi.c
+++ b/drivers/iio/gyro/st_gyro_spi.c
@@ -54,7 +54,6 @@ static const struct spi_device_id st_gyro_id_table[] = {
         { LSM330DL_GYRO_DEV_NAME },
         { LSM330DLC_GYRO_DEV_NAME },
         { L3GD20_GYRO_DEV_NAME },
-        { L3GD20H_GYRO_DEV_NAME },
         { L3G4IS_GYRO_DEV_NAME },
         { LSM330_GYRO_DEV_NAME },
         {},
diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
index f17b4e6183c6..47a6dbac2d0c 100644
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -103,13 +103,13 @@ static int cm32181_reg_init(struct cm32181_chip *cm32181)
 /**
  *  cm32181_read_als_it() - Get sensor integration time (ms)
  *  @cm32181:   pointer of struct cm32181
- *  @val:       pointer of int to load the als_it value.
+ *  @val2:      pointer of int to load the als_it value.
  *
  *  Report the current integartion time by millisecond.
  *
- *  Return: IIO_VAL_INT for success, otherwise -EINVAL.
+ *  Return: IIO_VAL_INT_PLUS_MICRO for success, otherwise -EINVAL.
  */
-static int cm32181_read_als_it(struct cm32181_chip *cm32181, int *val)
+static int cm32181_read_als_it(struct cm32181_chip *cm32181, int *val2)
 {
         u16 als_it;
         int i;
@@ -119,8 +119,8 @@ static int cm32181_read_als_it(struct cm32181_chip *cm32181, int *val)
         als_it >>= CM32181_CMD_ALS_IT_SHIFT;
         for (i = 0; i < ARRAY_SIZE(als_it_bits); i++) {
                 if (als_it == als_it_bits[i]) {
-                        *val = als_it_value[i];
-                        return IIO_VAL_INT;
+                        *val2 = als_it_value[i];
+                        return IIO_VAL_INT_PLUS_MICRO;
                 }
         }
 
@@ -221,7 +221,7 @@ static int cm32181_read_raw(struct iio_dev *indio_dev,
                 *val = cm32181->calibscale;
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_INT_TIME:
-                ret = cm32181_read_als_it(cm32181, val);
+                ret = cm32181_read_als_it(cm32181, val2);
                 return ret;
         }
 
@@ -240,7 +240,7 @@ static int cm32181_write_raw(struct iio_dev *indio_dev,
                 cm32181->calibscale = val;
                 return val;
         case IIO_CHAN_INFO_INT_TIME:
-                ret = cm32181_write_als_it(cm32181, val);
+                ret = cm32181_write_als_it(cm32181, val2);
                 return ret;
         }
 
@@ -264,7 +264,7 @@ static ssize_t cm32181_get_it_available(struct device *dev,
 
         n = ARRAY_SIZE(als_it_value);
         for (i = 0, len = 0; i < n; i++)
-                len += sprintf(buf + len, "%d ", als_it_value[i]);
+                len += sprintf(buf + len, "0.%06u ", als_it_value[i]);
         return len + sprintf(buf + len, "\n");
 }
 
diff --git a/drivers/iio/light/cm36651.c b/drivers/iio/light/cm36651.c
index 0a142af83e25..a45e07492db3 100644
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -50,10 +50,10 @@
 #define CM36651_CS_CONF2_DEFAULT_BIT    0x08
 
 /* CS_CONF3 channel integration time */
-#define CM36651_CS_IT1                  0x00 /* Integration time 80000 usec */
-#define CM36651_CS_IT2                  0x40 /* Integration time 160000 usec */
-#define CM36651_CS_IT3                  0x80 /* Integration time 320000 usec */
-#define CM36651_CS_IT4                  0xC0 /* Integration time 640000 usec */
+#define CM36651_CS_IT1                  0x00 /* Integration time 80 msec */
+#define CM36651_CS_IT2                  0x40 /* Integration time 160 msec */
+#define CM36651_CS_IT3                  0x80 /* Integration time 320 msec */
+#define CM36651_CS_IT4                  0xC0 /* Integration time 640 msec */
 
 /* PS_CONF1 command code */
 #define CM36651_PS_ENABLE               0x00
@@ -64,10 +64,10 @@
 #define CM36651_PS_PERS4                0x0C
 
 /* PS_CONF1 command code: integration time */
-#define CM36651_PS_IT1                  0x00 /* Integration time 320 usec */
-#define CM36651_PS_IT2                  0x10 /* Integration time 420 usec */
-#define CM36651_PS_IT3                  0x20 /* Integration time 520 usec */
-#define CM36651_PS_IT4                  0x30 /* Integration time 640 usec */
+#define CM36651_PS_IT1                  0x00 /* Integration time 0.32 msec */
+#define CM36651_PS_IT2                  0x10 /* Integration time 0.42 msec */
+#define CM36651_PS_IT3                  0x20 /* Integration time 0.52 msec */
+#define CM36651_PS_IT4                  0x30 /* Integration time 0.64 msec */
 
 /* PS_CONF1 command code: duty ratio */
 #define CM36651_PS_DR1                  0x00 /* Duty ratio 1/80 */
@@ -93,8 +93,8 @@
 #define CM36651_CLOSE_PROXIMITY         0x32
 #define CM36651_FAR_PROXIMITY                   0x33
 
-#define CM36651_CS_INT_TIME_AVAIL       "80000 160000 320000 640000"
-#define CM36651_PS_INT_TIME_AVAIL       "320 420 520 640"
+#define CM36651_CS_INT_TIME_AVAIL       "0.08 0.16 0.32 0.64"
+#define CM36651_PS_INT_TIME_AVAIL       "0.000320 0.000420 0.000520 0.000640"
 
 enum cm36651_operation_mode {
         CM36651_LIGHT_EN,
@@ -356,30 +356,30 @@ static int cm36651_read_channel(struct cm36651_data *cm36651,
 }
 
 static int cm36651_read_int_time(struct cm36651_data *cm36651,
-                                struct iio_chan_spec const *chan, int *val)
+                                struct iio_chan_spec const *chan, int *val2)
 {
         switch (chan->type) {
         case IIO_LIGHT:
                 if (cm36651->cs_int_time[chan->address] == CM36651_CS_IT1)
-                        *val = 80000;
+                        *val2 = 80000;
                 else if (cm36651->cs_int_time[chan->address] == CM36651_CS_IT2)
-                        *val = 160000;
+                        *val2 = 160000;
                 else if (cm36651->cs_int_time[chan->address] == CM36651_CS_IT3)
-                        *val = 320000;
+                        *val2 = 320000;
                 else if (cm36651->cs_int_time[chan->address] == CM36651_CS_IT4)
-                        *val = 640000;
+                        *val2 = 640000;
                 else
                         return -EINVAL;
                 break;
         case IIO_PROXIMITY:
                 if (cm36651->ps_int_time == CM36651_PS_IT1)
-                        *val = 320;
+                        *val2 = 320;
                 else if (cm36651->ps_int_time == CM36651_PS_IT2)
-                        *val = 420;
+                        *val2 = 420;
                 else if (cm36651->ps_int_time == CM36651_PS_IT3)
-                        *val = 520;
+                        *val2 = 520;
                 else if (cm36651->ps_int_time == CM36651_PS_IT4)
-                        *val = 640;
+                        *val2 = 640;
                 else
                         return -EINVAL;
                 break;
@@ -387,7 +387,7 @@ static int cm36651_read_int_time(struct cm36651_data *cm36651,
                 return -EINVAL;
         }
 
-        return IIO_VAL_INT;
+        return IIO_VAL_INT_PLUS_MICRO;
 }
 
 static int cm36651_write_int_time(struct cm36651_data *cm36651,
@@ -459,7 +459,8 @@ static int cm36651_read_raw(struct iio_dev *indio_dev,
                 ret = cm36651_read_channel(cm36651, chan, val);
                 break;
         case IIO_CHAN_INFO_INT_TIME:
-                ret = cm36651_read_int_time(cm36651, chan, val);
+                *val = 0;
+                ret = cm36651_read_int_time(cm36651, chan, val2);
                 break;
         default:
                 ret = -EINVAL;
@@ -479,7 +480,7 @@ static int cm36651_write_raw(struct iio_dev *indio_dev,
         int ret = -EINVAL;
 
         if (mask == IIO_CHAN_INFO_INT_TIME) {
-                ret = cm36651_write_int_time(cm36651, chan, val);
+                ret = cm36651_write_int_time(cm36651, chan, val2);
                 if (ret < 0)
                         dev_err(&client->dev, "Integration time write failed\n");
         }
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index e81c5547e647..f9c12e92fdd6 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -53,8 +53,8 @@
 #include "user.h"
 
 #define DRV_NAME        MLX4_IB_DRV_NAME
-#define DRV_VERSION     "1.0"
-#define DRV_RELDATE     "April 4, 2008"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb 2014"
 
 #define MLX4_IB_FLOW_MAX_PRIO 0xFFF
 #define MLX4_IB_FLOW_QPN_MASK 0xFFFFFF
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index aa03e732b6a8..bf900579ac08 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -46,8 +46,8 @@
 #include "mlx5_ib.h"
 
 #define DRIVER_NAME "mlx5_ib"
-#define DRIVER_VERSION "1.0"
-#define DRIVER_RELDATE  "June 2013"
+#define DRIVER_VERSION "2.2-1"
+#define DRIVER_RELDATE  "Feb 2014"
 
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox Connect-IB HCA IB driver");
diff --git a/drivers/input/misc/arizona-haptics.c b/drivers/input/misc/arizona-haptics.c
index 7a04f54ef961..ef2e281b0a43 100644
--- a/drivers/input/misc/arizona-haptics.c
+++ b/drivers/input/misc/arizona-haptics.c
@@ -37,7 +37,6 @@ static void arizona_haptics_work(struct work_struct *work)
                                                        struct arizona_haptics,
                                                        work);
         struct arizona *arizona = haptics->arizona;
-        struct mutex *dapm_mutex = &arizona->dapm->card->dapm_mutex;
         int ret;
 
         if (!haptics->arizona->dapm) {
@@ -67,13 +66,10 @@ static void arizona_haptics_work(struct work_struct *work)
                         return;
                 }
 
-                mutex_lock_nested(dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
-
                 ret = snd_soc_dapm_enable_pin(arizona->dapm, "HAPTICS");
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to start HAPTICS: %d\n",
                                 ret);
-                        mutex_unlock(dapm_mutex);
                         return;
                 }
 
@@ -81,21 +77,14 @@ static void arizona_haptics_work(struct work_struct *work)
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to sync DAPM: %d\n",
                                 ret);
-                        mutex_unlock(dapm_mutex);
                         return;
                 }
-
-                mutex_unlock(dapm_mutex);
-
         } else {
                 /* This disable sequence will be a noop if already enabled */
-                mutex_lock_nested(dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
-
                 ret = snd_soc_dapm_disable_pin(arizona->dapm, "HAPTICS");
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to disable HAPTICS: %d\n",
                                 ret);
-                        mutex_unlock(dapm_mutex);
                         return;
                 }
 
@@ -103,12 +92,9 @@ static void arizona_haptics_work(struct work_struct *work)
                 if (ret != 0) {
                         dev_err(arizona->dev, "Failed to sync DAPM: %d\n",
                                 ret);
-                        mutex_unlock(dapm_mutex);
                         return;
                 }
 
-                mutex_unlock(dapm_mutex);
-
                 ret = regmap_update_bits(arizona->regmap,
                                          ARIZONA_HAPTICS_CONTROL_1,
                                          ARIZONA_HAP_CTRL_MASK,
@@ -155,16 +141,11 @@ static int arizona_haptics_play(struct input_dev *input, void *data,
 static void arizona_haptics_close(struct input_dev *input)
 {
         struct arizona_haptics *haptics = input_get_drvdata(input);
-        struct mutex *dapm_mutex = &haptics->arizona->dapm->card->dapm_mutex;
 
         cancel_work_sync(&haptics->work);
 
-        mutex_lock_nested(dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
-
         if (haptics->arizona->dapm)
                 snd_soc_dapm_disable_pin(haptics->arizona->dapm, "HAPTICS");
-
-        mutex_unlock(dapm_mutex);
 }
 
 static int arizona_haptics_probe(struct platform_device *pdev)
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index d97fbe4fb9b1..80fffba7f12d 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -354,8 +354,8 @@ DEBUG_FOPS(mem);
                         return -ENOMEM;                                 \
         }
 
-#define DEBUG_ADD_FILE(name) __DEBUG_ADD_FILE(name, 600)
-#define DEBUG_ADD_FILE_RO(name) __DEBUG_ADD_FILE(name, 400)
+#define DEBUG_ADD_FILE(name) __DEBUG_ADD_FILE(name, 0600)
+#define DEBUG_ADD_FILE_RO(name) __DEBUG_ADD_FILE(name, 0400)
 
 static int iommu_debug_register(struct device *dev, void *data)
 {
diff --git a/drivers/irqchip/irq-metag-ext.c b/drivers/irqchip/irq-metag-ext.c
index 92c41ab4dbfd..2cb474ad8809 100644
--- a/drivers/irqchip/irq-metag-ext.c
+++ b/drivers/irqchip/irq-metag-ext.c
@@ -515,7 +515,7 @@ static int meta_intc_set_affinity(struct irq_data *data,
          * one cpu (the interrupt code doesn't support it), so we just
          * pick the first cpu we find in 'cpumask'.
          */
-        cpu = cpumask_any(cpumask);
+        cpu = cpumask_any_and(cpumask, cpu_online_mask);
         thread = cpu_2_hwthread_id[cpu];
 
         metag_out32(TBI_TRIG_VEC(TBID_SIGNUM_TR2(thread)), vec_addr);
diff --git a/drivers/irqchip/irq-metag.c b/drivers/irqchip/irq-metag.c
index 8e94d7a3b20d..c16c186d97d3 100644
--- a/drivers/irqchip/irq-metag.c
+++ b/drivers/irqchip/irq-metag.c
@@ -201,7 +201,7 @@ static int metag_internal_irq_set_affinity(struct irq_data *data,
          * one cpu (the interrupt code doesn't support it), so we just
          * pick the first cpu we find in 'cpumask'.
          */
-        cpu = cpumask_any(cpumask);
+        cpu = cpumask_any_and(cpumask, cpu_online_mask);
         thread = cpu_2_hwthread_id[cpu];
 
         metag_out32(TBI_TRIG_VEC(TBID_SIGNUM_TR1(thread)),
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 9a06fe883766..95ad936e6048 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -254,16 +254,6 @@ config DM_THIN_PROVISIONING
        ---help---
          Provides thin provisioning and snapshots that share a data store.
 
-config DM_DEBUG_BLOCK_STACK_TRACING
-        boolean "Keep stack trace of persistent data block lock holders"
-        depends on STACKTRACE_SUPPORT && DM_PERSISTENT_DATA
-        select STACKTRACE
-        ---help---
-          Enable this for messages that may help debug problems with the
-          block manager locking used by thin provisioning and caching.
-
-          If unsure, say N.
-
 config DM_CACHE
        tristate "Cache target (EXPERIMENTAL)"
        depends on BLK_DEV_DM
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 1e018e986610..0e385e40909e 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -872,7 +872,7 @@ static void mq_destroy(struct dm_cache_policy *p)
 {
         struct mq_policy *mq = to_mq_policy(p);
 
-        kfree(mq->table);
+        vfree(mq->table);
         epool_exit(&mq->cache_pool);
         epool_exit(&mq->pre_cache_pool);
         kfree(mq);
@@ -1245,7 +1245,7 @@ static struct dm_cache_policy *mq_create(dm_cblock_t cache_size,
 
         mq->nr_buckets = next_power(from_cblock(cache_size) / 2, 16);
         mq->hash_bits = ffs(mq->nr_buckets) - 1;
-        mq->table = kzalloc(sizeof(*mq->table) * mq->nr_buckets, GFP_KERNEL);
+        mq->table = vzalloc(sizeof(*mq->table) * mq->nr_buckets);
         if (!mq->table)
                 goto bad_alloc_table;
 
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index ffd472e015ca..1af70145fab9 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -289,6 +289,7 @@ struct per_bio_data {
         bool tick:1;
         unsigned req_nr:2;
         struct dm_deferred_entry *all_io_entry;
+        struct dm_hook_info hook_info;
 
         /*
          * writethrough fields.  These MUST remain at the end of this
@@ -297,7 +298,6 @@ struct per_bio_data {
          */
         struct cache *cache;
         dm_cblock_t cblock;
-        struct dm_hook_info hook_info;
         struct dm_bio_details bio_details;
 };
 
@@ -671,15 +671,16 @@ static void remap_to_cache(struct cache *cache, struct bio *bio,
                            dm_cblock_t cblock)
 {
         sector_t bi_sector = bio->bi_iter.bi_sector;
+        sector_t block = from_cblock(cblock);
 
         bio->bi_bdev = cache->cache_dev->bdev;
         if (!block_size_is_power_of_two(cache))
                 bio->bi_iter.bi_sector =
-                        (from_cblock(cblock) * cache->sectors_per_block) +
+                        (block * cache->sectors_per_block) +
                         sector_div(bi_sector, cache->sectors_per_block);
         else
                 bio->bi_iter.bi_sector =
-                        (from_cblock(cblock) << cache->sectors_per_block_shift) |
+                        (block << cache->sectors_per_block_shift) |
                         (bi_sector & (cache->sectors_per_block - 1));
 }
 
@@ -1010,13 +1011,15 @@ static void overwrite_endio(struct bio *bio, int err)
         struct per_bio_data *pb = get_per_bio_data(bio, pb_data_size);
         unsigned long flags;
 
+        dm_unhook_bio(&pb->hook_info, bio);
+
         if (err)
                 mg->err = true;
 
+        mg->requeue_holder = false;
+
         spin_lock_irqsave(&cache->lock, flags);
         list_add_tail(&mg->list, &cache->completed_migrations);
-        dm_unhook_bio(&pb->hook_info, bio);
-        mg->requeue_holder = false;
         spin_unlock_irqrestore(&cache->lock, flags);
 
         wake_worker(cache);
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index b2b8a10e8427..3842ac738f98 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -201,29 +201,28 @@ static void list_dp_init(struct dpages *dp, struct page_list *pl, unsigned offse
 /*
  * Functions for getting the pages from a bvec.
  */
-static void bio_get_page(struct dpages *dp,
-                  struct page **p, unsigned long *len, unsigned *offset)
+static void bio_get_page(struct dpages *dp, struct page **p,
+                         unsigned long *len, unsigned *offset)
 {
-        struct bio *bio = dp->context_ptr;
-        struct bio_vec bvec = bio_iovec(bio);
-        *p = bvec.bv_page;
-        *len = bvec.bv_len;
-        *offset = bvec.bv_offset;
+        struct bio_vec *bvec = dp->context_ptr;
+        *p = bvec->bv_page;
+        *len = bvec->bv_len - dp->context_u;
+        *offset = bvec->bv_offset + dp->context_u;
 }
 
 static void bio_next_page(struct dpages *dp)
 {
-        struct bio *bio = dp->context_ptr;
-        struct bio_vec bvec = bio_iovec(bio);
-
-        bio_advance(bio, bvec.bv_len);
+        struct bio_vec *bvec = dp->context_ptr;
+        dp->context_ptr = bvec + 1;
+        dp->context_u = 0;
 }
 
 static void bio_dp_init(struct dpages *dp, struct bio *bio)
 {
         dp->get_page = bio_get_page;
         dp->next_page = bio_next_page;
-        dp->context_ptr = bio;
+        dp->context_ptr = __bvec_iter_bvec(bio->bi_io_vec, bio->bi_iter);
+        dp->context_u = bio->bi_iter.bi_bvec_done;
 }
 
 /*
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 6eb9dc9ef8f3..422a9fdeb53e 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1626,8 +1626,11 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
         /*
          * Only pass ioctls through if the device sizes match exactly.
          */
-        if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
-                r = scsi_verify_blk_ioctl(NULL, cmd);
+        if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) {
+                int err = scsi_verify_blk_ioctl(NULL, cmd);
+                if (err)
+                        r = err;
+        }
 
         if (r == -ENOTCONN && !fatal_signal_pending(current))
                 queue_work(kmultipathd, &m->process_queued_ios);
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index f284e0bfb25f..7dfdb5c746d6 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -1244,6 +1244,9 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
 
                         dm_bio_restore(bd, bio);
                         bio_record->details.bi_bdev = NULL;
+
+                        atomic_inc(&bio->bi_remaining);
+
                         queue_bio(ms, bio, rw);
                         return DM_ENDIO_INCOMPLETE;
                 }
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index afc3d017de4c..d6e88178d22c 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -546,6 +546,9 @@ static int read_exceptions(struct pstore *ps,
                 r = insert_exceptions(ps, area, callback, callback_context,
                                       &full);
 
+                if (!full)
+                        memcpy(ps->area, area, ps->store->chunk_size << SECTOR_SHIFT);
+
                 dm_bufio_release(bp);
 
                 dm_bufio_forget(client, chunk);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 7da347665552..fb9efc829182 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -76,7 +76,7 @@
 
 #define THIN_SUPERBLOCK_MAGIC 27022010
 #define THIN_SUPERBLOCK_LOCATION 0
-#define THIN_VERSION 1
+#define THIN_VERSION 2
 #define THIN_METADATA_CACHE_SIZE 64
 #define SECTOR_TO_BLOCK_SHIFT 3
 
@@ -483,7 +483,7 @@ static int __write_initial_superblock(struct dm_pool_metadata *pmd)
 
         disk_super->data_mapping_root = cpu_to_le64(pmd->root);
         disk_super->device_details_root = cpu_to_le64(pmd->details_root);
-        disk_super->metadata_block_size = cpu_to_le32(THIN_METADATA_BLOCK_SIZE >> SECTOR_SHIFT);
+        disk_super->metadata_block_size = cpu_to_le32(THIN_METADATA_BLOCK_SIZE);
         disk_super->metadata_nr_blocks = cpu_to_le64(bdev_size >> SECTOR_TO_BLOCK_SHIFT);
         disk_super->data_block_size = cpu_to_le32(pmd->data_block_size);
 
@@ -651,7 +651,7 @@ static int __create_persistent_data_objects(struct dm_pool_metadata *pmd, bool f
 {
         int r;
 
-        pmd->bm = dm_block_manager_create(pmd->bdev, THIN_METADATA_BLOCK_SIZE,
+        pmd->bm = dm_block_manager_create(pmd->bdev, THIN_METADATA_BLOCK_SIZE << SECTOR_SHIFT,
                                           THIN_METADATA_CACHE_SIZE,
                                           THIN_MAX_CONCURRENT_LOCKS);
         if (IS_ERR(pmd->bm)) {
@@ -1489,6 +1489,23 @@ bool dm_thin_changed_this_transaction(struct dm_thin_device *td)
         return r;
 }
 
+bool dm_pool_changed_this_transaction(struct dm_pool_metadata *pmd)
+{
+        bool r = false;
+        struct dm_thin_device *td, *tmp;
+
+        down_read(&pmd->root_lock);
+        list_for_each_entry_safe(td, tmp, &pmd->thin_devices, list) {
+                if (td->changed) {
+                        r = td->changed;
+                        break;
+                }
+        }
+        up_read(&pmd->root_lock);
+
+        return r;
+}
+
 bool dm_thin_aborted_changes(struct dm_thin_device *td)
 {
         bool r;
@@ -1738,3 +1755,38 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
 
         return r;
 }
+
+int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd)
+{
+        int r;
+        struct dm_block *sblock;
+        struct thin_disk_superblock *disk_super;
+
+        down_write(&pmd->root_lock);
+        pmd->flags |= THIN_METADATA_NEEDS_CHECK_FLAG;
+
+        r = superblock_lock(pmd, &sblock);
+        if (r) {
+                DMERR("couldn't read superblock");
+                goto out;
+        }
+
+        disk_super = dm_block_data(sblock);
+        disk_super->flags = cpu_to_le32(pmd->flags);
+
+        dm_bm_unlock(sblock);
+out:
+        up_write(&pmd->root_lock);
+        return r;
+}
+
+bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd)
+{
+        bool needs_check;
+
+        down_read(&pmd->root_lock);
+        needs_check = pmd->flags & THIN_METADATA_NEEDS_CHECK_FLAG;
+        up_read(&pmd->root_lock);
+
+        return needs_check;
+}
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 9a368567632f..e3c857db195a 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -9,16 +9,14 @@
 
 #include "persistent-data/dm-block-manager.h"
 #include "persistent-data/dm-space-map.h"
+#include "persistent-data/dm-space-map-metadata.h"
 
-#define THIN_METADATA_BLOCK_SIZE 4096
+#define THIN_METADATA_BLOCK_SIZE DM_SM_METADATA_BLOCK_SIZE
 
 /*
  * The metadata device is currently limited in size.
- *
- * We have one block of index, which can hold 255 index entries.  Each
- * index entry contains allocation info about 16k metadata blocks.
  */
-#define THIN_METADATA_MAX_SECTORS (255 * (1 << 14) * (THIN_METADATA_BLOCK_SIZE / (1 << SECTOR_SHIFT)))
+#define THIN_METADATA_MAX_SECTORS DM_SM_METADATA_MAX_SECTORS
 
 /*
  * A metadata device larger than 16GB triggers a warning.
@@ -27,6 +25,11 @@
 
 /*----------------------------------------------------------------*/
 
+/*
+ * Thin metadata superblock flags.
+ */
+#define THIN_METADATA_NEEDS_CHECK_FLAG (1 << 0)
+
 struct dm_pool_metadata;
 struct dm_thin_device;
 
@@ -161,6 +164,8 @@ int dm_thin_remove_block(struct dm_thin_device *td, dm_block_t block);
  */
 bool dm_thin_changed_this_transaction(struct dm_thin_device *td);
 
+bool dm_pool_changed_this_transaction(struct dm_pool_metadata *pmd);
+
 bool dm_thin_aborted_changes(struct dm_thin_device *td);
 
 int dm_thin_get_highest_mapped_block(struct dm_thin_device *td,
@@ -202,6 +207,12 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                         dm_sm_threshold_fn fn,
                                         void *context);
 
+/*
+ * Updates the superblock immediately.
+ */
+int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd);
+bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd);
+
 /*----------------------------------------------------------------*/
 
 #endif
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index faaf944597ab..be70d38745f7 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -130,10 +130,11 @@ static void build_virtual_key(struct dm_thin_device *td, dm_block_t b,
 struct dm_thin_new_mapping;
 
 /*
- * The pool runs in 3 modes.  Ordered in degraded order for comparisons.
+ * The pool runs in 4 modes.  Ordered in degraded order for comparisons.
  */
 enum pool_mode {
         PM_WRITE,               /* metadata may be changed */
+        PM_OUT_OF_DATA_SPACE,   /* metadata may be changed, though data may not be allocated */
         PM_READ_ONLY,           /* metadata may not be changed */
         PM_FAIL,                /* all I/O fails */
 };
@@ -198,7 +199,6 @@ struct pool {
 };
 
 static enum pool_mode get_pool_mode(struct pool *pool);
-static void out_of_data_space(struct pool *pool);
 static void metadata_operation_failed(struct pool *pool, const char *op, int r);
 
 /*
@@ -226,6 +226,7 @@ struct thin_c {
 
         struct pool *pool;
         struct dm_thin_device *td;
+        bool requeue_mode:1;
 };
 
 /*----------------------------------------------------------------*/
@@ -369,14 +370,18 @@ struct dm_thin_endio_hook {
         struct dm_thin_new_mapping *overwrite_mapping;
 };
 
-static void __requeue_bio_list(struct thin_c *tc, struct bio_list *master)
+static void requeue_bio_list(struct thin_c *tc, struct bio_list *master)
 {
         struct bio *bio;
         struct bio_list bios;
+        unsigned long flags;
 
         bio_list_init(&bios);
+
+        spin_lock_irqsave(&tc->pool->lock, flags);
         bio_list_merge(&bios, master);
         bio_list_init(master);
+        spin_unlock_irqrestore(&tc->pool->lock, flags);
 
         while ((bio = bio_list_pop(&bios))) {
                 struct dm_thin_endio_hook *h = dm_per_bio_data(bio, sizeof(struct dm_thin_endio_hook));
@@ -391,12 +396,26 @@ static void __requeue_bio_list(struct thin_c *tc, struct bio_list *master)
 static void requeue_io(struct thin_c *tc)
 {
         struct pool *pool = tc->pool;
+
+        requeue_bio_list(tc, &pool->deferred_bios);
+        requeue_bio_list(tc, &pool->retry_on_resume_list);
+}
+
+static void error_retry_list(struct pool *pool)
+{
+        struct bio *bio;
         unsigned long flags;
+        struct bio_list bios;
+
+        bio_list_init(&bios);
 
         spin_lock_irqsave(&pool->lock, flags);
-        __requeue_bio_list(tc, &pool->deferred_bios);
-        __requeue_bio_list(tc, &pool->retry_on_resume_list);
+        bio_list_merge(&bios, &pool->retry_on_resume_list);
+        bio_list_init(&pool->retry_on_resume_list);
         spin_unlock_irqrestore(&pool->lock, flags);
+
+        while ((bio = bio_list_pop(&bios)))
+                bio_io_error(bio);
 }
 
 /*
@@ -925,13 +944,15 @@ static void check_low_water_mark(struct pool *pool, dm_block_t free_blocks)
         }
 }
 
+static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+
 static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
 {
         int r;
         dm_block_t free_blocks;
         struct pool *pool = tc->pool;
 
-        if (get_pool_mode(pool) != PM_WRITE)
+        if (WARN_ON(get_pool_mode(pool) != PM_WRITE))
                 return -EINVAL;
 
         r = dm_pool_get_free_block_count(pool->pmd, &free_blocks);
@@ -958,7 +979,7 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                 }
 
                 if (!free_blocks) {
-                        out_of_data_space(pool);
+                        set_pool_mode(pool, PM_OUT_OF_DATA_SPACE);
                         return -ENOSPC;
                 }
         }
@@ -988,15 +1009,32 @@ static void retry_on_resume(struct bio *bio)
         spin_unlock_irqrestore(&pool->lock, flags);
 }
 
-static void handle_unserviceable_bio(struct pool *pool, struct bio *bio)
+static bool should_error_unserviceable_bio(struct pool *pool)
 {
-        /*
-         * When pool is read-only, no cell locking is needed because
-         * nothing is changing.
-         */
-        WARN_ON_ONCE(get_pool_mode(pool) != PM_READ_ONLY);
+        enum pool_mode m = get_pool_mode(pool);
 
-        if (pool->pf.error_if_no_space)
+        switch (m) {
+        case PM_WRITE:
+                /* Shouldn't get here */
+                DMERR_LIMIT("bio unserviceable, yet pool is in PM_WRITE mode");
+                return true;
+
+        case PM_OUT_OF_DATA_SPACE:
+                return pool->pf.error_if_no_space;
+
+        case PM_READ_ONLY:
+        case PM_FAIL:
+                return true;
+        default:
+                /* Shouldn't get here */
+                DMERR_LIMIT("bio unserviceable, yet pool has an unknown mode");
+                return true;
+        }
+}
+
+static void handle_unserviceable_bio(struct pool *pool, struct bio *bio)
+{
+        if (should_error_unserviceable_bio(pool))
                 bio_io_error(bio);
         else
                 retry_on_resume(bio);
@@ -1007,11 +1045,20 @@ static void retry_bios_on_resume(struct pool *pool, struct dm_bio_prison_cell *c
         struct bio *bio;
         struct bio_list bios;
 
+        if (should_error_unserviceable_bio(pool)) {
+                cell_error(pool, cell);
+                return;
+        }
+
         bio_list_init(&bios);
         cell_release(pool, cell, &bios);
 
-        while ((bio = bio_list_pop(&bios)))
-                handle_unserviceable_bio(pool, bio);
+        if (should_error_unserviceable_bio(pool))
+                while ((bio = bio_list_pop(&bios)))
+                        bio_io_error(bio);
+        else
+                while ((bio = bio_list_pop(&bios)))
+                        retry_on_resume(bio);
 }
 
 static void process_discard(struct thin_c *tc, struct bio *bio)
@@ -1296,6 +1343,11 @@ static void process_bio_read_only(struct thin_c *tc, struct bio *bio)
         }
 }
 
+static void process_bio_success(struct thin_c *tc, struct bio *bio)
+{
+        bio_endio(bio, 0);
+}
+
 static void process_bio_fail(struct thin_c *tc, struct bio *bio)
 {
         bio_io_error(bio);
@@ -1328,6 +1380,11 @@ static void process_deferred_bios(struct pool *pool)
                 struct dm_thin_endio_hook *h = dm_per_bio_data(bio, sizeof(struct dm_thin_endio_hook));
                 struct thin_c *tc = h->tc;
 
+                if (tc->requeue_mode) {
+                        bio_endio(bio, DM_ENDIO_REQUEUE);
+                        continue;
+                }
+
                 /*
                  * If we've got no free new_mapping structs, and processing
                  * this bio might require one, we pause until there are some
@@ -1357,7 +1414,8 @@ static void process_deferred_bios(struct pool *pool)
         bio_list_init(&pool->deferred_flush_bios);
         spin_unlock_irqrestore(&pool->lock, flags);
 
-        if (bio_list_empty(&bios) && !need_commit_due_to_time(pool))
+        if (bio_list_empty(&bios) &&
+            !(dm_pool_changed_this_transaction(pool->pmd) && need_commit_due_to_time(pool)))
                 return;
 
         if (commit(pool)) {
@@ -1393,51 +1451,134 @@ static void do_waker(struct work_struct *ws)
 
 /*----------------------------------------------------------------*/
 
+struct noflush_work {
+        struct work_struct worker;
+        struct thin_c *tc;
+
+        atomic_t complete;
+        wait_queue_head_t wait;
+};
+
+static void complete_noflush_work(struct noflush_work *w)
+{
+        atomic_set(&w->complete, 1);
+        wake_up(&w->wait);
+}
+
+static void do_noflush_start(struct work_struct *ws)
+{
+        struct noflush_work *w = container_of(ws, struct noflush_work, worker);
+        w->tc->requeue_mode = true;
+        requeue_io(w->tc);
+        complete_noflush_work(w);
+}
+
+static void do_noflush_stop(struct work_struct *ws)
+{
+        struct noflush_work *w = container_of(ws, struct noflush_work, worker);
+        w->tc->requeue_mode = false;
+        complete_noflush_work(w);
+}
+
+static void noflush_work(struct thin_c *tc, void (*fn)(struct work_struct *))
+{
+        struct noflush_work w;
+
+        INIT_WORK(&w.worker, fn);
+        w.tc = tc;
+        atomic_set(&w.complete, 0);
+        init_waitqueue_head(&w.wait);
+
+        queue_work(tc->pool->wq, &w.worker);
+
+        wait_event(w.wait, atomic_read(&w.complete));
+}
+
+/*----------------------------------------------------------------*/
+
 static enum pool_mode get_pool_mode(struct pool *pool)
 {
         return pool->pf.mode;
 }
 
+static void notify_of_pool_mode_change(struct pool *pool, const char *new_mode)
+{
+        dm_table_event(pool->ti->table);
+        DMINFO("%s: switching pool to %s mode",
+               dm_device_name(pool->pool_md), new_mode);
+}
+
 static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
 {
-        int r;
-        enum pool_mode old_mode = pool->pf.mode;
+        struct pool_c *pt = pool->ti->private;
+        bool needs_check = dm_pool_metadata_needs_check(pool->pmd);
+        enum pool_mode old_mode = get_pool_mode(pool);
+
+        /*
+         * Never allow the pool to transition to PM_WRITE mode if user
+         * intervention is required to verify metadata and data consistency.
+         */
+        if (new_mode == PM_WRITE && needs_check) {
+                DMERR("%s: unable to switch pool to write mode until repaired.",
+                      dm_device_name(pool->pool_md));
+                if (old_mode != new_mode)
+                        new_mode = old_mode;
+                else
+                        new_mode = PM_READ_ONLY;
+        }
+        /*
+         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
+         * not going to recover without a thin_repair.  So we never let the
+         * pool move out of the old mode.
+         */
+        if (old_mode == PM_FAIL)
+                new_mode = old_mode;
 
         switch (new_mode) {
         case PM_FAIL:
                 if (old_mode != new_mode)
-                        DMERR("%s: switching pool to failure mode",
-                              dm_device_name(pool->pool_md));
+                        notify_of_pool_mode_change(pool, "failure");
                 dm_pool_metadata_read_only(pool->pmd);
                 pool->process_bio = process_bio_fail;
                 pool->process_discard = process_bio_fail;
                 pool->process_prepared_mapping = process_prepared_mapping_fail;
                 pool->process_prepared_discard = process_prepared_discard_fail;
+
+                error_retry_list(pool);
                 break;
 
         case PM_READ_ONLY:
                 if (old_mode != new_mode)
-                        DMERR("%s: switching pool to read-only mode",
-                              dm_device_name(pool->pool_md));
-                r = dm_pool_abort_metadata(pool->pmd);
-                if (r) {
-                        DMERR("%s: aborting transaction failed",
-                              dm_device_name(pool->pool_md));
-                        new_mode = PM_FAIL;
-                        set_pool_mode(pool, new_mode);
-                } else {
-                        dm_pool_metadata_read_only(pool->pmd);
-                        pool->process_bio = process_bio_read_only;
-                        pool->process_discard = process_discard;
-                        pool->process_prepared_mapping = process_prepared_mapping_fail;
-                        pool->process_prepared_discard = process_prepared_discard_passdown;
-                }
+                        notify_of_pool_mode_change(pool, "read-only");
+                dm_pool_metadata_read_only(pool->pmd);
+                pool->process_bio = process_bio_read_only;
+                pool->process_discard = process_bio_success;
+                pool->process_prepared_mapping = process_prepared_mapping_fail;
+                pool->process_prepared_discard = process_prepared_discard_passdown;
+
+                error_retry_list(pool);
+                break;
+
+        case PM_OUT_OF_DATA_SPACE:
+                /*
+                 * Ideally we'd never hit this state; the low water mark
+                 * would trigger userland to extend the pool before we
+                 * completely run out of data space.  However, many small
+                 * IOs to unprovisioned space can consume data space at an
+                 * alarming rate.  Adjust your low water mark if you're
+                 * frequently seeing this mode.
+                 */
+                if (old_mode != new_mode)
+                        notify_of_pool_mode_change(pool, "out-of-data-space");
+                pool->process_bio = process_bio_read_only;
+                pool->process_discard = process_discard;
+                pool->process_prepared_mapping = process_prepared_mapping;
+                pool->process_prepared_discard = process_prepared_discard_passdown;
                 break;
 
         case PM_WRITE:
                 if (old_mode != new_mode)
-                        DMINFO("%s: switching pool to write mode",
-                               dm_device_name(pool->pool_md));
+                        notify_of_pool_mode_change(pool, "write");
                 dm_pool_metadata_read_write(pool->pmd);
                 pool->process_bio = process_bio;
                 pool->process_discard = process_discard;
@@ -1447,32 +1588,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
         }
 
         pool->pf.mode = new_mode;
+        /*
+         * The pool mode may have changed, sync it so bind_control_target()
+         * doesn't cause an unexpected mode transition on resume.
+         */
+        pt->adjusted_pf.mode = new_mode;
 }
 
-/*
- * Rather than calling set_pool_mode directly, use these which describe the
- * reason for mode degradation.
- */
-static void out_of_data_space(struct pool *pool)
+static void abort_transaction(struct pool *pool)
 {
-        DMERR_LIMIT("%s: no free data space available.",
-                    dm_device_name(pool->pool_md));
-        set_pool_mode(pool, PM_READ_ONLY);
+        const char *dev_name = dm_device_name(pool->pool_md);
+
+        DMERR_LIMIT("%s: aborting current metadata transaction", dev_name);
+        if (dm_pool_abort_metadata(pool->pmd)) {
+                DMERR("%s: failed to abort metadata transaction", dev_name);
+                set_pool_mode(pool, PM_FAIL);
+        }
+
+        if (dm_pool_metadata_set_needs_check(pool->pmd)) {
+                DMERR("%s: failed to set 'needs_check' flag in metadata", dev_name);
+                set_pool_mode(pool, PM_FAIL);
+        }
 }
 
 static void metadata_operation_failed(struct pool *pool, const char *op, int r)
 {
-        dm_block_t free_blocks;
-
         DMERR_LIMIT("%s: metadata operation '%s' failed: error = %d",
                     dm_device_name(pool->pool_md), op, r);
 
-        if (r == -ENOSPC &&
-            !dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks) &&
-            !free_blocks)
-                DMERR_LIMIT("%s: no free metadata space available.",
-                            dm_device_name(pool->pool_md));
-
+        abort_transaction(pool);
         set_pool_mode(pool, PM_READ_ONLY);
 }
 
@@ -1523,6 +1667,11 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
 
         thin_hook_bio(tc, bio);
 
+        if (tc->requeue_mode) {
+                bio_endio(bio, DM_ENDIO_REQUEUE);
+                return DM_MAPIO_SUBMITTED;
+        }
+
         if (get_pool_mode(tc->pool) == PM_FAIL) {
                 bio_io_error(bio);
                 return DM_MAPIO_SUBMITTED;
@@ -1686,7 +1835,7 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         /*
          * We want to make sure that a pool in PM_FAIL mode is never upgraded.
          */
-        enum pool_mode old_mode = pool->pf.mode;
+        enum pool_mode old_mode = get_pool_mode(pool);
         enum pool_mode new_mode = pt->adjusted_pf.mode;
 
         /*
@@ -1700,16 +1849,6 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         pool->pf = pt->adjusted_pf;
         pool->low_water_blocks = pt->low_water_blocks;
 
-        /*
-         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
-         * not going to recover without a thin_repair.  So we never let the
-         * pool move out of the old mode.  On the other hand a PM_READ_ONLY
-         * may have been due to a lack of metadata or data space, and may
-         * now work (ie. if the underlying devices have been resized).
-         */
-        if (old_mode == PM_FAIL)
-                new_mode = old_mode;
-
         set_pool_mode(pool, new_mode);
 
         return 0;
@@ -1999,16 +2138,27 @@ static void metadata_low_callback(void *context)
         dm_table_event(pool->ti->table);
 }
 
-static sector_t get_metadata_dev_size(struct block_device *bdev)
+static sector_t get_dev_size(struct block_device *bdev)
+{
+        return i_size_read(bdev->bd_inode) >> SECTOR_SHIFT;
+}
+
+static void warn_if_metadata_device_too_big(struct block_device *bdev)
 {
-        sector_t metadata_dev_size = i_size_read(bdev->bd_inode) >> SECTOR_SHIFT;
+        sector_t metadata_dev_size = get_dev_size(bdev);
         char buffer[BDEVNAME_SIZE];
 
-        if (metadata_dev_size > THIN_METADATA_MAX_SECTORS_WARNING) {
+        if (metadata_dev_size > THIN_METADATA_MAX_SECTORS_WARNING)
                 DMWARN("Metadata device %s is larger than %u sectors: excess space will not be used.",
                        bdevname(bdev, buffer), THIN_METADATA_MAX_SECTORS);
-                metadata_dev_size = THIN_METADATA_MAX_SECTORS_WARNING;
-        }
+}
+
+static sector_t get_metadata_dev_size(struct block_device *bdev)
+{
+        sector_t metadata_dev_size = get_dev_size(bdev);
+
+        if (metadata_dev_size > THIN_METADATA_MAX_SECTORS)
+                metadata_dev_size = THIN_METADATA_MAX_SECTORS;
 
         return metadata_dev_size;
 }
@@ -2017,7 +2167,7 @@ static dm_block_t get_metadata_dev_size_in_blocks(struct block_device *bdev)
 {
         sector_t metadata_dev_size = get_metadata_dev_size(bdev);
 
-        sector_div(metadata_dev_size, THIN_METADATA_BLOCK_SIZE >> SECTOR_SHIFT);
+        sector_div(metadata_dev_size, THIN_METADATA_BLOCK_SIZE);
 
         return metadata_dev_size;
 }
@@ -2095,12 +2245,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
                 ti->error = "Error opening metadata block device";
                 goto out_unlock;
         }
-
-        /*
-         * Run for the side-effect of possibly issuing a warning if the
-         * device is too big.
-         */
-        (void) get_metadata_dev_size(metadata_dev->bdev);
+        warn_if_metadata_device_too_big(metadata_dev->bdev);
 
         r = dm_get_device(ti, argv[1], FMODE_READ | FMODE_WRITE, &data_dev);
         if (r) {
@@ -2246,6 +2391,12 @@ static int maybe_resize_data_dev(struct dm_target *ti, bool *need_commit)
                 return -EINVAL;
 
         } else if (data_size > sb_data_size) {
+                if (dm_pool_metadata_needs_check(pool->pmd)) {
+                        DMERR("%s: unable to grow the data device until repaired.",
+                              dm_device_name(pool->pool_md));
+                        return 0;
+                }
+
                 if (sb_data_size)
                         DMINFO("%s: growing the data device from %llu to %llu blocks",
                                dm_device_name(pool->pool_md),
@@ -2287,6 +2438,13 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit)
                 return -EINVAL;
 
         } else if (metadata_dev_size > sb_metadata_dev_size) {
+                if (dm_pool_metadata_needs_check(pool->pmd)) {
+                        DMERR("%s: unable to grow the metadata device until repaired.",
+                              dm_device_name(pool->pool_md));
+                        return 0;
+                }
+
+                warn_if_metadata_device_too_big(pool->md_dev);
                 DMINFO("%s: growing the metadata device from %llu to %llu blocks",
                        dm_device_name(pool->pool_md),
                        sb_metadata_dev_size, metadata_dev_size);
@@ -2673,7 +2831,9 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                 else
                         DMEMIT("- ");
 
-                if (pool->pf.mode == PM_READ_ONLY)
+                if (pool->pf.mode == PM_OUT_OF_DATA_SPACE)
+                        DMEMIT("out_of_data_space ");
+                else if (pool->pf.mode == PM_READ_ONLY)
                         DMEMIT("ro ");
                 else
                         DMEMIT("rw ");
@@ -2787,7 +2947,7 @@ static struct target_type pool_target = {
         .name = "thin-pool",
         .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                     DM_TARGET_IMMUTABLE,
-        .version = {1, 10, 0},
+        .version = {1, 11, 0},
         .module = THIS_MODULE,
         .ctr = pool_ctr,
         .dtr = pool_dtr,
@@ -2894,6 +3054,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         if (get_pool_mode(tc->pool) == PM_FAIL) {
                 ti->error = "Couldn't open thin device, Pool is in fail mode";
+                r = -EINVAL;
                 goto bad_thin_open;
         }
 
@@ -2905,7 +3066,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         r = dm_set_target_max_io_len(ti, tc->pool->sectors_per_block);
         if (r)
-                goto bad_thin_open;
+                goto bad_target_max_io_len;
 
         ti->num_flush_bios = 1;
         ti->flush_supported = true;
@@ -2926,6 +3087,8 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         return 0;
 
+bad_target_max_io_len:
+        dm_pool_close_thin_device(tc->td);
 bad_thin_open:
         __pool_dec(tc->pool);
 bad_pool_lookup:
@@ -2986,10 +3149,23 @@ static int thin_endio(struct dm_target *ti, struct bio *bio, int err)
         return 0;
 }
 
-static void thin_postsuspend(struct dm_target *ti)
+static void thin_presuspend(struct dm_target *ti)
 {
+        struct thin_c *tc = ti->private;
+
         if (dm_noflush_suspending(ti))
-                requeue_io((struct thin_c *)ti->private);
+                noflush_work(tc, do_noflush_start);
+}
+
+static void thin_postsuspend(struct dm_target *ti)
+{
+        struct thin_c *tc = ti->private;
+
+        /*
+         * The dm_noflush_suspending flag has been cleared by now, so
+         * unfortunately we must always run this.
+         */
+        noflush_work(tc, do_noflush_stop);
 }
 
 /*
@@ -3074,12 +3250,13 @@ static int thin_iterate_devices(struct dm_target *ti,
 
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 10, 0},
+        .version = {1, 11, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
         .map = thin_map,
         .end_io = thin_endio,
+        .presuspend = thin_presuspend,
         .postsuspend = thin_postsuspend,
         .status = thin_status,
         .iterate_devices = thin_iterate_devices,
diff --git a/drivers/md/persistent-data/Kconfig b/drivers/md/persistent-data/Kconfig
index 19b268795415..0c2dec7aec20 100644
--- a/drivers/md/persistent-data/Kconfig
+++ b/drivers/md/persistent-data/Kconfig
@@ -6,3 +6,13 @@ config DM_PERSISTENT_DATA
        ---help---
          Library providing immutable on-disk data structure support for
          device-mapper targets such as the thin provisioning target.
+
+config DM_DEBUG_BLOCK_STACK_TRACING
+       boolean "Keep stack trace of persistent data block lock holders"
+       depends on STACKTRACE_SUPPORT && DM_PERSISTENT_DATA
+       select STACKTRACE
+       ---help---
+         Enable this for messages that may help debug problems with the
+         block manager locking used by thin provisioning and caching.
+
+         If unsure, say N.
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 536782e3bcb7..786b689bdfc7 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -91,6 +91,69 @@ struct block_op {
         dm_block_t block;
 };
 
+struct bop_ring_buffer {
+        unsigned begin;
+        unsigned end;
+        struct block_op bops[MAX_RECURSIVE_ALLOCATIONS + 1];
+};
+
+static void brb_init(struct bop_ring_buffer *brb)
+{
+        brb->begin = 0;
+        brb->end = 0;
+}
+
+static bool brb_empty(struct bop_ring_buffer *brb)
+{
+        return brb->begin == brb->end;
+}
+
+static unsigned brb_next(struct bop_ring_buffer *brb, unsigned old)
+{
+        unsigned r = old + 1;
+        return (r >= (sizeof(brb->bops) / sizeof(*brb->bops))) ? 0 : r;
+}
+
+static int brb_push(struct bop_ring_buffer *brb,
+                    enum block_op_type type, dm_block_t b)
+{
+        struct block_op *bop;
+        unsigned next = brb_next(brb, brb->end);
+
+        /*
+         * We don't allow the last bop to be filled, this way we can
+         * differentiate between full and empty.
+         */
+        if (next == brb->begin)
+                return -ENOMEM;
+
+        bop = brb->bops + brb->end;
+        bop->type = type;
+        bop->block = b;
+
+        brb->end = next;
+
+        return 0;
+}
+
+static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
+{
+        struct block_op *bop;
+
+        if (brb_empty(brb))
+                return -ENODATA;
+
+        bop = brb->bops + brb->begin;
+        result->type = bop->type;
+        result->block = bop->block;
+
+        brb->begin = brb_next(brb, brb->begin);
+
+        return 0;
+}
+
+/*----------------------------------------------------------------*/
+
 struct sm_metadata {
         struct dm_space_map sm;
 
@@ -101,25 +164,20 @@ struct sm_metadata {
 
         unsigned recursion_count;
         unsigned allocated_this_transaction;
-        unsigned nr_uncommitted;
-        struct block_op uncommitted[MAX_RECURSIVE_ALLOCATIONS];
+        struct bop_ring_buffer uncommitted;
 
         struct threshold threshold;
 };
 
 static int add_bop(struct sm_metadata *smm, enum block_op_type type, dm_block_t b)
 {
-        struct block_op *op;
+        int r = brb_push(&smm->uncommitted, type, b);
 
-        if (smm->nr_uncommitted == MAX_RECURSIVE_ALLOCATIONS) {
+        if (r) {
                 DMERR("too many recursive allocations");
                 return -ENOMEM;
         }
 
-        op = smm->uncommitted + smm->nr_uncommitted++;
-        op->type = type;
-        op->block = b;
-
         return 0;
 }
 
@@ -158,11 +216,17 @@ static int out(struct sm_metadata *smm)
                 return -ENOMEM;
         }
 
-        if (smm->recursion_count == 1 && smm->nr_uncommitted) {
-                while (smm->nr_uncommitted && !r) {
-                        smm->nr_uncommitted--;
-                        r = commit_bop(smm, smm->uncommitted +
-                                       smm->nr_uncommitted);
+        if (smm->recursion_count == 1) {
+                while (!brb_empty(&smm->uncommitted)) {
+                        struct block_op bop;
+
+                        r = brb_pop(&smm->uncommitted, &bop);
+                        if (r) {
+                                DMERR("bug in bop ring buffer");
+                                break;
+                        }
+
+                        r = commit_bop(smm, &bop);
                         if (r)
                                 break;
                 }
@@ -217,7 +281,8 @@ static int sm_metadata_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
 static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
                                  uint32_t *result)
 {
-        int r, i;
+        int r;
+        unsigned i;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
         unsigned adjustment = 0;
 
@@ -225,8 +290,10 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
          * We may have some uncommitted adjustments to add.  This list
          * should always be really short.
          */
-        for (i = 0; i < smm->nr_uncommitted; i++) {
-                struct block_op *op = smm->uncommitted + i;
+        for (i = smm->uncommitted.begin;
+             i != smm->uncommitted.end;
+             i = brb_next(&smm->uncommitted, i)) {
+                struct block_op *op = smm->uncommitted.bops + i;
 
                 if (op->block != b)
                         continue;
@@ -254,7 +321,8 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
 static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
                                               dm_block_t b, int *result)
 {
-        int r, i, adjustment = 0;
+        int r, adjustment = 0;
+        unsigned i;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
         uint32_t rc;
 
@@ -262,8 +330,11 @@ static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
          * We may have some uncommitted adjustments to add.  This list
          * should always be really short.
          */
-        for (i = 0; i < smm->nr_uncommitted; i++) {
-                struct block_op *op = smm->uncommitted + i;
+        for (i = smm->uncommitted.begin;
+             i != smm->uncommitted.end;
+             i = brb_next(&smm->uncommitted, i)) {
+
+                struct block_op *op = smm->uncommitted.bops + i;
 
                 if (op->block != b)
                         continue;
@@ -671,7 +742,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
         smm->begin = superblock + 1;
         smm->recursion_count = 0;
         smm->allocated_this_transaction = 0;
-        smm->nr_uncommitted = 0;
+        brb_init(&smm->uncommitted);
         threshold_init(&smm->threshold);
 
         memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm));
@@ -680,6 +751,8 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
         if (r)
                 return r;
 
+        if (nr_blocks > DM_SM_METADATA_MAX_BLOCKS)
+                nr_blocks = DM_SM_METADATA_MAX_BLOCKS;
         r = sm_ll_extend(&smm->ll, nr_blocks);
         if (r)
                 return r;
@@ -713,7 +786,7 @@ int dm_sm_metadata_open(struct dm_space_map *sm,
         smm->begin = 0;
         smm->recursion_count = 0;
         smm->allocated_this_transaction = 0;
-        smm->nr_uncommitted = 0;
+        brb_init(&smm->uncommitted);
         threshold_init(&smm->threshold);
 
         memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll));
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.h b/drivers/md/persistent-data/dm-space-map-metadata.h
index 39bba0801cf2..64df923974d8 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.h
+++ b/drivers/md/persistent-data/dm-space-map-metadata.h
@@ -9,6 +9,17 @@
 
 #include "dm-transaction-manager.h"
 
+#define DM_SM_METADATA_BLOCK_SIZE (4096 >> SECTOR_SHIFT)
+
+/*
+ * The metadata device is currently limited in size.
+ *
+ * We have one block of index, which can hold 255 index entries.  Each
+ * index entry contains allocation info about ~16k metadata blocks.
+ */
+#define DM_SM_METADATA_MAX_BLOCKS (255 * ((1 << 14) - 64))
+#define DM_SM_METADATA_MAX_SECTORS (DM_SM_METADATA_MAX_BLOCKS * DM_SM_METADATA_BLOCK_SIZE)
+
 /*
  * Unfortunately we have to use two-phase construction due to the cycle
  * between the tm and sm.
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 59eba5d2c685..9715a7ba164a 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1584,7 +1584,7 @@ read_retry:
                         }
 
                         if (mtd->ecc_stats.failed - ecc_failures) {
-                                if (retry_mode + 1 <= chip->read_retries) {
+                                if (retry_mode + 1 < chip->read_retries) {
                                         retry_mode++;
                                         ret = nand_setup_read_retry(mtd,
                                                         retry_mode);
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index ef4190a02b7b..bf642ceef681 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -1633,6 +1633,7 @@ static int omap_nand_probe(struct platform_device *pdev)
         int                             i;
         dma_cap_mask_t                  mask;
         unsigned                        sig;
+        unsigned                        oob_index;
         struct resource                 *res;
         struct mtd_part_parser_data     ppdata = {};
 
@@ -1826,11 +1827,14 @@ static int omap_nand_probe(struct platform_device *pdev)
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
                 if (nand_chip->options & NAND_BUSWIDTH_16)
-                        ecclayout->eccpos[0]    = BADBLOCK_MARKER_LENGTH;
+                        oob_index               = BADBLOCK_MARKER_LENGTH;
                 else
-                        ecclayout->eccpos[0]    = 1;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                        oob_index               = 1;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* no reserved-marker in ecclayout for this ecc-scheme */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 break;
 
         case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
@@ -1847,9 +1851,15 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++) {
+                        ecclayout->eccpos[i] = oob_index;
+                        if (((i + 1) % nand_chip->ecc.bytes) == 0)
+                                oob_index++;
+                }
+                /* include reserved-marker in ecclayout->oobfree calculation */
+                ecclayout->oobfree->offset      = 1 +
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* software bch library is used for locating errors */
                 nand_chip->ecc.priv             = nand_bch_init(mtd,
                                                         nand_chip->ecc.size,
@@ -1883,9 +1893,12 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* reserved marker already included in ecclayout->eccbytes */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* This ECC scheme requires ELM H/W block */
                 if (is_elm_present(info, pdata->elm_of_node, BCH4_ECC) < 0) {
                         pr_err("nand: error: could not initialize ELM\n");
@@ -1913,9 +1926,15 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++) {
+                        ecclayout->eccpos[i] = oob_index;
+                        if (((i + 1) % nand_chip->ecc.bytes) == 0)
+                                oob_index++;
+                }
+                /* include reserved-marker in ecclayout->oobfree calculation */
+                ecclayout->oobfree->offset      = 1 +
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 /* software bch library is used for locating errors */
                 nand_chip->ecc.priv             = nand_bch_init(mtd,
                                                         nand_chip->ecc.size,
@@ -1956,9 +1975,12 @@ static int omap_nand_probe(struct platform_device *pdev)
                 ecclayout->eccbytes             = nand_chip->ecc.bytes *
                                                         (mtd->writesize /
                                                         nand_chip->ecc.size);
-                ecclayout->eccpos[0]            = BADBLOCK_MARKER_LENGTH;
-                ecclayout->oobfree->offset      = ecclayout->eccpos[0] +
-                                                        ecclayout->eccbytes;
+                oob_index                       = BADBLOCK_MARKER_LENGTH;
+                for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+                        ecclayout->eccpos[i]    = oob_index;
+                /* reserved marker already included in ecclayout->eccbytes */
+                ecclayout->oobfree->offset      =
+                                ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
                 break;
 #else
                 pr_err("nand: error: CONFIG_MTD_NAND_OMAP_BCH not enabled\n");
@@ -1972,11 +1994,8 @@ static int omap_nand_probe(struct platform_device *pdev)
                 goto return_error;
         }
 
-        /* populate remaining ECC layout data */
-        ecclayout->oobfree->length = mtd->oobsize - (BADBLOCK_MARKER_LENGTH +
-                                                        ecclayout->eccbytes);
-        for (i = 1; i < ecclayout->eccbytes; i++)
-                ecclayout->eccpos[i] = ecclayout->eccpos[0] + i;
+        /* all OOB bytes from oobfree->offset till end off OOB are free */
+        ecclayout->oobfree->length = mtd->oobsize - ecclayout->oobfree->offset;
         /* check if NAND device's OOB is enough to store ECC signatures */
         if (mtd->oobsize < (ecclayout->eccbytes + BADBLOCK_MARKER_LENGTH)) {
                 pr_err("not enough OOB bytes required = %d, available=%d\n",
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index ead861307b3c..c5dad652614d 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -463,8 +463,8 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
                                 }
                         }
                         if (found_orphan) {
-                                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                                 list_del(&tmp_aeb->u.list);
+                                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                         }
 
                         new_aeb = kmem_cache_alloc(ai->aeb_slab_cache,
@@ -846,16 +846,16 @@ fail_bad:
         ret = UBI_BAD_FASTMAP;
 fail:
         list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &used, u.list) {
-                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                 list_del(&tmp_aeb->u.list);
+                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
         }
         list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &eba_orphans, u.list) {
-                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                 list_del(&tmp_aeb->u.list);
+                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
         }
         list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &free, u.list) {
-                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
                 list_del(&tmp_aeb->u.list);
+                kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);
         }
 
         return ret;
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 6d20fbde8d43..dcde56057fe1 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -181,7 +181,7 @@ static inline int __agg_has_partner(struct aggregator *agg)
  */
 static inline void __disable_port(struct port *port)
 {
-        bond_set_slave_inactive_flags(port->slave);
+        bond_set_slave_inactive_flags(port->slave, BOND_SLAVE_NOTIFY_LATER);
 }
 
 /**
@@ -193,7 +193,7 @@ static inline void __enable_port(struct port *port)
         struct slave *slave = port->slave;
 
         if ((slave->link == BOND_LINK_UP) && IS_UP(slave->dev))
-                bond_set_slave_active_flags(slave);
+                bond_set_slave_active_flags(slave, BOND_SLAVE_NOTIFY_LATER);
 }
 
 /**
@@ -2062,6 +2062,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
         struct list_head *iter;
         struct slave *slave;
         struct port *port;
+        bool should_notify_rtnl = BOND_SLAVE_NOTIFY_LATER;
 
         read_lock(&bond->lock);
         rcu_read_lock();
@@ -2119,8 +2120,19 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
         }
 
 re_arm:
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (slave->should_notify) {
+                        should_notify_rtnl = BOND_SLAVE_NOTIFY_NOW;
+                        break;
+                }
+        }
         rcu_read_unlock();
         read_unlock(&bond->lock);
+
+        if (should_notify_rtnl && rtnl_trylock()) {
+                bond_slave_state_notify(bond);
+                rtnl_unlock();
+        }
         queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
 }
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 1c6104d3501d..e5628fc725c3 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -829,21 +829,25 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
         if (bond_is_lb(bond)) {
                 bond_alb_handle_active_change(bond, new_active);
                 if (old_active)
-                        bond_set_slave_inactive_flags(old_active);
+                        bond_set_slave_inactive_flags(old_active,
+                                                      BOND_SLAVE_NOTIFY_NOW);
                 if (new_active)
-                        bond_set_slave_active_flags(new_active);
+                        bond_set_slave_active_flags(new_active,
+                                                    BOND_SLAVE_NOTIFY_NOW);
         } else {
                 rcu_assign_pointer(bond->curr_active_slave, new_active);
         }
 
         if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) {
                 if (old_active)
-                        bond_set_slave_inactive_flags(old_active);
+                        bond_set_slave_inactive_flags(old_active,
+                                                      BOND_SLAVE_NOTIFY_NOW);
 
                 if (new_active) {
                         bool should_notify_peers = false;
 
-                        bond_set_slave_active_flags(new_active);
+                        bond_set_slave_active_flags(new_active,
+                                                    BOND_SLAVE_NOTIFY_NOW);
 
                         if (bond->params.fail_over_mac)
                                 bond_do_fail_over_mac(bond, new_active,
@@ -1193,6 +1197,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 return -EBUSY;
         }
 
+        if (bond_dev == slave_dev) {
+                pr_err("%s: cannot enslave bond to itself.\n", bond_dev->name);
+                return -EPERM;
+        }
+
         /* vlan challenged mutual exclusion */
         /* no need to lock since we're protected by rtnl_lock */
         if (slave_dev->features & NETIF_F_VLAN_CHALLENGED) {
@@ -1463,14 +1472,15 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         switch (bond->params.mode) {
         case BOND_MODE_ACTIVEBACKUP:
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave,
+                                              BOND_SLAVE_NOTIFY_NOW);
                 break;
         case BOND_MODE_8023AD:
                 /* in 802.3ad mode, the internal mechanism
                  * will activate the slaves in the selected
                  * aggregator
                  */
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave, BOND_SLAVE_NOTIFY_NOW);
                 /* if this is the first slave */
                 if (!prev_slave) {
                         SLAVE_AD_INFO(new_slave).id = 1;
@@ -1488,7 +1498,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         case BOND_MODE_TLB:
         case BOND_MODE_ALB:
                 bond_set_active_slave(new_slave);
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave, BOND_SLAVE_NOTIFY_NOW);
                 break;
         default:
                 pr_debug("This slave is always active in trunk mode\n");
@@ -1654,9 +1664,6 @@ static int __bond_release_one(struct net_device *bond_dev,
                 return -EINVAL;
         }
 
-        /* release the slave from its bond */
-        bond->slave_cnt--;
-
         bond_sysfs_slave_del(slave);
 
         bond_upper_dev_unlink(bond_dev, slave_dev);
@@ -1738,6 +1745,7 @@ static int __bond_release_one(struct net_device *bond_dev,
 
         unblock_netpoll_tx();
         synchronize_rcu();
+        bond->slave_cnt--;
 
         if (!bond_has_slaves(bond)) {
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, bond->dev);
@@ -2015,7 +2023,8 @@ static void bond_miimon_commit(struct bonding *bond)
 
                         if (bond->params.mode == BOND_MODE_ACTIVEBACKUP ||
                             bond->params.mode == BOND_MODE_8023AD)
-                                bond_set_slave_inactive_flags(slave);
+                                bond_set_slave_inactive_flags(slave,
+                                                              BOND_SLAVE_NOTIFY_NOW);
 
                         pr_info("%s: link status definitely down for interface %s, disabling it\n",
                                 bond->dev->name, slave->dev->name);
@@ -2562,7 +2571,8 @@ static void bond_ab_arp_commit(struct bonding *bond)
                                 slave->link = BOND_LINK_UP;
                                 if (bond->current_arp_slave) {
                                         bond_set_slave_inactive_flags(
-                                                bond->current_arp_slave);
+                                                bond->current_arp_slave,
+                                                BOND_SLAVE_NOTIFY_NOW);
                                         bond->current_arp_slave = NULL;
                                 }
 
@@ -2582,7 +2592,8 @@ static void bond_ab_arp_commit(struct bonding *bond)
                                 slave->link_failure_count++;
 
                         slave->link = BOND_LINK_DOWN;
-                        bond_set_slave_inactive_flags(slave);
+                        bond_set_slave_inactive_flags(slave,
+                                                      BOND_SLAVE_NOTIFY_NOW);
 
                         pr_info("%s: link status definitely down for interface %s, disabling it\n",
                                 bond->dev->name, slave->dev->name);
@@ -2615,17 +2626,17 @@ do_failover:
 
 /*
  * Send ARP probes for active-backup mode ARP monitor.
+ *
+ * Called with rcu_read_lock hold.
  */
 static bool bond_ab_arp_probe(struct bonding *bond)
 {
         struct slave *slave, *before = NULL, *new_slave = NULL,
-                     *curr_arp_slave, *curr_active_slave;
+                     *curr_arp_slave = rcu_dereference(bond->current_arp_slave),
+                     *curr_active_slave = rcu_dereference(bond->curr_active_slave);
         struct list_head *iter;
         bool found = false;
-
-        rcu_read_lock();
-        curr_arp_slave = rcu_dereference(bond->current_arp_slave);
-        curr_active_slave = rcu_dereference(bond->curr_active_slave);
+        bool should_notify_rtnl = BOND_SLAVE_NOTIFY_LATER;
 
         if (curr_arp_slave && curr_active_slave)
                 pr_info("PROBE: c_arp %s && cas %s BAD\n",
@@ -2634,32 +2645,23 @@ static bool bond_ab_arp_probe(struct bonding *bond)
 
         if (curr_active_slave) {
                 bond_arp_send_all(bond, curr_active_slave);
-                rcu_read_unlock();
-                return true;
+                return should_notify_rtnl;
         }
-        rcu_read_unlock();
 
         /* if we don't have a curr_active_slave, search for the next available
          * backup slave from the current_arp_slave and make it the candidate
          * for becoming the curr_active_slave
          */
 
-        if (!rtnl_trylock())
-                return false;
-        /* curr_arp_slave might have gone away */
-        curr_arp_slave = ACCESS_ONCE(bond->current_arp_slave);
-
         if (!curr_arp_slave) {
-                curr_arp_slave = bond_first_slave(bond);
-                if (!curr_arp_slave) {
-                        rtnl_unlock();
-                        return true;
-                }
+                curr_arp_slave = bond_first_slave_rcu(bond);
+                if (!curr_arp_slave)
+                        return should_notify_rtnl;
         }
 
-        bond_set_slave_inactive_flags(curr_arp_slave);
+        bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER);
 
-        bond_for_each_slave(bond, slave, iter) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
                 if (!found && !before && IS_UP(slave->dev))
                         before = slave;
 
@@ -2677,7 +2679,8 @@ static bool bond_ab_arp_probe(struct bonding *bond)
                         if (slave->link_failure_count < UINT_MAX)
                                 slave->link_failure_count++;
 
-                        bond_set_slave_inactive_flags(slave);
+                        bond_set_slave_inactive_flags(slave,
+                                                      BOND_SLAVE_NOTIFY_LATER);
 
                         pr_info("%s: backup interface %s is now down.\n",
                                 bond->dev->name, slave->dev->name);
@@ -2689,26 +2692,31 @@ static bool bond_ab_arp_probe(struct bonding *bond)
         if (!new_slave && before)
                 new_slave = before;
 
-        if (!new_slave) {
-                rtnl_unlock();
-                return true;
-        }
+        if (!new_slave)
+                goto check_state;
 
         new_slave->link = BOND_LINK_BACK;
-        bond_set_slave_active_flags(new_slave);
+        bond_set_slave_active_flags(new_slave, BOND_SLAVE_NOTIFY_LATER);
         bond_arp_send_all(bond, new_slave);
         new_slave->jiffies = jiffies;
         rcu_assign_pointer(bond->current_arp_slave, new_slave);
-        rtnl_unlock();
 
-        return true;
+check_state:
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (slave->should_notify) {
+                        should_notify_rtnl = BOND_SLAVE_NOTIFY_NOW;
+                        break;
+                }
+        }
+        return should_notify_rtnl;
 }
 
 static void bond_activebackup_arp_mon(struct work_struct *work)
 {
         struct bonding *bond = container_of(work, struct bonding,
                                             arp_work.work);
-        bool should_notify_peers = false, should_commit = false;
+        bool should_notify_peers = false;
+        bool should_notify_rtnl = false;
         int delta_in_ticks;
 
         delta_in_ticks = msecs_to_jiffies(bond->params.arp_interval);
@@ -2717,11 +2725,12 @@ static void bond_activebackup_arp_mon(struct work_struct *work)
                 goto re_arm;
 
         rcu_read_lock();
+
         should_notify_peers = bond_should_notify_peers(bond);
-        should_commit = bond_ab_arp_inspect(bond);
-        rcu_read_unlock();
 
-        if (should_commit) {
+        if (bond_ab_arp_inspect(bond)) {
+                rcu_read_unlock();
+
                 /* Race avoidance with bond_close flush of workqueue */
                 if (!rtnl_trylock()) {
                         delta_in_ticks = 1;
@@ -2730,23 +2739,28 @@ static void bond_activebackup_arp_mon(struct work_struct *work)
                 }
 
                 bond_ab_arp_commit(bond);
+
                 rtnl_unlock();
+                rcu_read_lock();
         }
 
-        if (!bond_ab_arp_probe(bond)) {
-                /* rtnl locking failed, re-arm */
-                delta_in_ticks = 1;
-                should_notify_peers = false;
-        }
+        should_notify_rtnl = bond_ab_arp_probe(bond);
+        rcu_read_unlock();
 
 re_arm:
         if (bond->params.arp_interval)
                 queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 
-        if (should_notify_peers) {
+        if (should_notify_peers || should_notify_rtnl) {
                 if (!rtnl_trylock())
                         return;
-                call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev);
+
+                if (should_notify_peers)
+                        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
+                                                 bond->dev);
+                if (should_notify_rtnl)
+                        bond_slave_state_notify(bond);
+
                 rtnl_unlock();
         }
 }
@@ -3046,9 +3060,11 @@ static int bond_open(struct net_device *bond_dev)
                 bond_for_each_slave(bond, slave, iter) {
                         if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
                                 && (slave != bond->curr_active_slave)) {
-                                bond_set_slave_inactive_flags(slave);
+                                bond_set_slave_inactive_flags(slave,
+                                                              BOND_SLAVE_NOTIFY_NOW);
                         } else {
-                                bond_set_slave_active_flags(slave);
+                                bond_set_slave_active_flags(slave,
+                                                            BOND_SLAVE_NOTIFY_NOW);
                         }
                 }
                 read_unlock(&bond->curr_slave_lock);
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 86ccfb9f71cc..2b0fdec695f7 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -195,7 +195,8 @@ struct slave {
         s8     new_link;
         u8     backup:1,   /* indicates backup slave. Value corresponds with
                               BOND_STATE_ACTIVE and BOND_STATE_BACKUP */
-               inactive:1; /* indicates inactive slave */
+               inactive:1, /* indicates inactive slave */
+               should_notify:1; /* indicateds whether the state changed */
         u8     duplex;
         u32    original_mtu;
         u32    link_failure_count;
@@ -303,6 +304,24 @@ static inline void bond_set_backup_slave(struct slave *slave)
         }
 }
 
+static inline void bond_set_slave_state(struct slave *slave,
+                                        int slave_state, bool notify)
+{
+        if (slave->backup == slave_state)
+                return;
+
+        slave->backup = slave_state;
+        if (notify) {
+                rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_KERNEL);
+                slave->should_notify = 0;
+        } else {
+                if (slave->should_notify)
+                        slave->should_notify = 0;
+                else
+                        slave->should_notify = 1;
+        }
+}
+
 static inline void bond_slave_state_change(struct bonding *bond)
 {
         struct list_head *iter;
@@ -316,6 +335,19 @@ static inline void bond_slave_state_change(struct bonding *bond)
         }
 }
 
+static inline void bond_slave_state_notify(struct bonding *bond)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+
+        bond_for_each_slave(bond, tmp, iter) {
+                if (tmp->should_notify) {
+                        rtmsg_ifinfo(RTM_NEWLINK, tmp->dev, 0, GFP_KERNEL);
+                        tmp->should_notify = 0;
+                }
+        }
+}
+
 static inline int bond_slave_state(struct slave *slave)
 {
         return slave->backup;
@@ -343,6 +375,9 @@ static inline bool bond_is_active_slave(struct slave *slave)
 #define BOND_ARP_VALIDATE_ALL           (BOND_ARP_VALIDATE_ACTIVE | \
                                          BOND_ARP_VALIDATE_BACKUP)
 
+#define BOND_SLAVE_NOTIFY_NOW           true
+#define BOND_SLAVE_NOTIFY_LATER         false
+
 static inline int slave_do_arp_validate(struct bonding *bond,
                                         struct slave *slave)
 {
@@ -394,17 +429,19 @@ static inline void bond_netpoll_send_skb(const struct slave *slave,
 }
 #endif
 
-static inline void bond_set_slave_inactive_flags(struct slave *slave)
+static inline void bond_set_slave_inactive_flags(struct slave *slave,
+                                                 bool notify)
 {
         if (!bond_is_lb(slave->bond))
-                bond_set_backup_slave(slave);
+                bond_set_slave_state(slave, BOND_STATE_BACKUP, notify);
         if (!slave->bond->params.all_slaves_active)
                 slave->inactive = 1;
 }
 
-static inline void bond_set_slave_active_flags(struct slave *slave)
+static inline void bond_set_slave_active_flags(struct slave *slave,
+                                               bool notify)
 {
-        bond_set_active_slave(slave);
+        bond_set_slave_state(slave, BOND_STATE_ACTIVE, notify);
         slave->inactive = 0;
 }
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 320bef2dba42..61376abdab39 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -144,6 +144,8 @@
 
 #define FLEXCAN_MB_CODE_MASK            (0xf0ffffff)
 
+#define FLEXCAN_TIMEOUT_US             (50)
+
 /*
  * FLEXCAN hardware feature flags
  *
@@ -262,6 +264,22 @@ static inline void flexcan_write(u32 val, void __iomem *addr)
 }
 #endif
 
+static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv)
+{
+        if (!priv->reg_xceiver)
+                return 0;
+
+        return regulator_enable(priv->reg_xceiver);
+}
+
+static inline int flexcan_transceiver_disable(const struct flexcan_priv *priv)
+{
+        if (!priv->reg_xceiver)
+                return 0;
+
+        return regulator_disable(priv->reg_xceiver);
+}
+
 static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
                                               u32 reg_esr)
 {
@@ -269,26 +287,95 @@ static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
                 (reg_esr & FLEXCAN_ESR_ERR_BUS);
 }
 
-static inline void flexcan_chip_enable(struct flexcan_priv *priv)
+static int flexcan_chip_enable(struct flexcan_priv *priv)
 {
         struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
         u32 reg;
 
         reg = flexcan_read(&regs->mcr);
         reg &= ~FLEXCAN_MCR_MDIS;
         flexcan_write(reg, &regs->mcr);
 
-        udelay(10);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK)
+                return -ETIMEDOUT;
+
+        return 0;
 }
 
-static inline void flexcan_chip_disable(struct flexcan_priv *priv)
+static int flexcan_chip_disable(struct flexcan_priv *priv)
 {
         struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
         u32 reg;
 
         reg = flexcan_read(&regs->mcr);
         reg |= FLEXCAN_MCR_MDIS;
         flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                usleep_range(10, 20);
+
+        if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_freeze(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate;
+        u32 reg;
+
+        reg = flexcan_read(&regs->mcr);
+        reg |= FLEXCAN_MCR_HALT;
+        flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                usleep_range(100, 200);
+
+        if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_unfreeze(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+        u32 reg;
+
+        reg = flexcan_read(&regs->mcr);
+        reg &= ~FLEXCAN_MCR_HALT;
+        flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK)
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_softreset(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+
+        flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_SOFTRST))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_SOFTRST)
+                return -ETIMEDOUT;
+
+        return 0;
 }
 
 static int flexcan_get_berr_counter(const struct net_device *dev,
@@ -709,19 +796,14 @@ static int flexcan_chip_start(struct net_device *dev)
         u32 reg_mcr, reg_ctrl;
 
         /* enable module */
-        flexcan_chip_enable(priv);
+        err = flexcan_chip_enable(priv);
+        if (err)
+                return err;
 
         /* soft reset */
-        flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
-        udelay(10);
-
-        reg_mcr = flexcan_read(&regs->mcr);
-        if (reg_mcr & FLEXCAN_MCR_SOFTRST) {
-                netdev_err(dev, "Failed to softreset can module (mcr=0x%08x)\n",
-                           reg_mcr);
-                err = -ENODEV;
-                goto out;
-        }
+        err = flexcan_chip_softreset(priv);
+        if (err)
+                goto out_chip_disable;
 
         flexcan_set_bittiming(dev);
 
@@ -788,16 +870,14 @@ static int flexcan_chip_start(struct net_device *dev)
         if (priv->devtype_data->features & FLEXCAN_HAS_V10_FEATURES)
                 flexcan_write(0x0, &regs->rxfgmask);
 
-        if (priv->reg_xceiver)  {
-                err = regulator_enable(priv->reg_xceiver);
-                if (err)
-                        goto out;
-        }
+        err = flexcan_transceiver_enable(priv);
+        if (err)
+                goto out_chip_disable;
 
         /* synchronize with the can bus */
-        reg_mcr = flexcan_read(&regs->mcr);
-        reg_mcr &= ~FLEXCAN_MCR_HALT;
-        flexcan_write(reg_mcr, &regs->mcr);
+        err = flexcan_chip_unfreeze(priv);
+        if (err)
+                goto out_transceiver_disable;
 
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
@@ -810,7 +890,9 @@ static int flexcan_chip_start(struct net_device *dev)
 
         return 0;
 
- out:
+ out_transceiver_disable:
+        flexcan_transceiver_disable(priv);
+ out_chip_disable:
         flexcan_chip_disable(priv);
         return err;
 }
@@ -825,18 +907,17 @@ static void flexcan_chip_stop(struct net_device *dev)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
         struct flexcan_regs __iomem *regs = priv->base;
-        u32 reg;
+
+        /* freeze + disable module */
+        flexcan_chip_freeze(priv);
+        flexcan_chip_disable(priv);
 
         /* Disable all interrupts */
         flexcan_write(0, &regs->imask1);
+        flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
+                      &regs->ctrl);
 
-        /* Disable + halt module */
-        reg = flexcan_read(&regs->mcr);
-        reg |= FLEXCAN_MCR_MDIS | FLEXCAN_MCR_HALT;
-        flexcan_write(reg, &regs->mcr);
-
-        if (priv->reg_xceiver)
-                regulator_disable(priv->reg_xceiver);
+        flexcan_transceiver_disable(priv);
         priv->can.state = CAN_STATE_STOPPED;
 
         return;
@@ -866,7 +947,7 @@ static int flexcan_open(struct net_device *dev)
         /* start chip and queuing */
         err = flexcan_chip_start(dev);
         if (err)
-                goto out_close;
+                goto out_free_irq;
 
         can_led_event(dev, CAN_LED_EVENT_OPEN);
 
@@ -875,6 +956,8 @@ static int flexcan_open(struct net_device *dev)
 
         return 0;
 
+ out_free_irq:
+        free_irq(dev->irq, dev);
  out_close:
         close_candev(dev);
  out_disable_per:
@@ -945,12 +1028,16 @@ static int register_flexcandev(struct net_device *dev)
                 goto out_disable_ipg;
 
         /* select "bus clock", chip must be disabled */
-        flexcan_chip_disable(priv);
+        err = flexcan_chip_disable(priv);
+        if (err)
+                goto out_disable_per;
         reg = flexcan_read(&regs->ctrl);
         reg |= FLEXCAN_CTRL_CLK_SRC;
         flexcan_write(reg, &regs->ctrl);
 
-        flexcan_chip_enable(priv);
+        err = flexcan_chip_enable(priv);
+        if (err)
+                goto out_chip_disable;
 
         /* set freeze, halt and activate FIFO, restrict register access */
         reg = flexcan_read(&regs->mcr);
@@ -967,14 +1054,15 @@ static int register_flexcandev(struct net_device *dev)
         if (!(reg & FLEXCAN_MCR_FEN)) {
                 netdev_err(dev, "Could not enable RX FIFO, unsupported core\n");
                 err = -ENODEV;
-                goto out_disable_per;
+                goto out_chip_disable;
         }
 
         err = register_candev(dev);
 
- out_disable_per:
         /* disable core and turn off clocks */
+ out_chip_disable:
         flexcan_chip_disable(priv);
+ out_disable_per:
         clk_disable_unprepare(priv->clk_per);
  out_disable_ipg:
         clk_disable_unprepare(priv->clk_ipg);
@@ -1104,9 +1192,10 @@ static int flexcan_probe(struct platform_device *pdev)
 static int flexcan_remove(struct platform_device *pdev)
 {
         struct net_device *dev = platform_get_drvdata(pdev);
+        struct flexcan_priv *priv = netdev_priv(dev);
 
         unregister_flexcandev(dev);
-
+        netif_napi_del(&priv->napi);
         free_candev(dev);
 
         return 0;
@@ -1117,8 +1206,11 @@ static int flexcan_suspend(struct device *device)
 {
         struct net_device *dev = dev_get_drvdata(device);
         struct flexcan_priv *priv = netdev_priv(dev);
+        int err;
 
-        flexcan_chip_disable(priv);
+        err = flexcan_chip_disable(priv);
+        if (err)
+                return err;
 
         if (netif_running(dev)) {
                 netif_stop_queue(dev);
@@ -1139,9 +1231,7 @@ static int flexcan_resume(struct device *device)
                 netif_device_attach(dev);
                 netif_start_queue(dev);
         }
-        flexcan_chip_enable(priv);
-
-        return 0;
+        return flexcan_chip_enable(priv);
 }
 #endif /* CONFIG_PM_SLEEP */
 
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 1f7b5aa114fa..8a7bf7dad898 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -1484,6 +1484,10 @@ static int b44_open(struct net_device *dev)
         add_timer(&bp->timer);
 
         b44_enable_ints(bp);
+
+        if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+                phy_start(bp->phydev);
+
         netif_start_queue(dev);
 out:
         return err;
@@ -1646,6 +1650,9 @@ static int b44_close(struct net_device *dev)
 
         netif_stop_queue(dev);
 
+        if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+                phy_stop(bp->phydev);
+
         napi_disable(&bp->napi);
 
         del_timer_sync(&bp->timer);
@@ -2222,7 +2229,12 @@ static void b44_adjust_link(struct net_device *dev)
         }
 
         if (status_changed) {
-                b44_check_phy(bp);
+                u32 val = br32(bp, B44_TX_CTRL);
+                if (bp->flags & B44_FLAG_FULL_DUPLEX)
+                        val |= TX_CTRL_DUPLEX;
+                else
+                        val &= ~TX_CTRL_DUPLEX;
+                bw32(bp, B44_TX_CTRL, val);
                 phy_print_status(phydev);
         }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 66c0df78c3ff..dbcff509dc3f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3875,7 +3875,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                                      xmit_type);
                 }
 
-                /* Add the macs to the parsing BD this is a vf */
+                /* Add the macs to the parsing BD if this is a vf or if
+                 * Tx Switching is enabled.
+                 */
                 if (IS_VF(bp)) {
                         /* override GRE parameters in BD */
                         bnx2x_set_fw_mac_addr(&pbd_e2->data.mac_addr.src_hi,
@@ -3887,6 +3889,11 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                               &pbd_e2->data.mac_addr.dst_mid,
                                               &pbd_e2->data.mac_addr.dst_lo,
                                               eth->h_dest);
+                } else if (bp->flags & TX_SWITCHING) {
+                        bnx2x_set_fw_mac_addr(&pbd_e2->data.mac_addr.dst_hi,
+                                              &pbd_e2->data.mac_addr.dst_mid,
+                                              &pbd_e2->data.mac_addr.dst_lo,
+                                              eth->h_dest);
                 }
 
                 SET_FLAG(pbd_e2_parsing_data,
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 3167ed6593b0..3b6d0ba86c71 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6843,8 +6843,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
 
                 work_mask |= opaque_key;
 
-                if ((desc->err_vlan & RXD_ERR_MASK) != 0 &&
-                    (desc->err_vlan != RXD_ERR_ODD_NIBBLE_RCVD_MII)) {
+                if (desc->err_vlan & RXD_ERR_MASK) {
                 drop_it:
                         tg3_recycle_rx(tnapi, tpr, opaque_key,
                                        desc_idx, *post_ptr);
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index ef472385bce4..04321e5a356e 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2608,7 +2608,11 @@ struct tg3_rx_buffer_desc {
 #define RXD_ERR_TOO_SMALL               0x00400000
 #define RXD_ERR_NO_RESOURCES            0x00800000
 #define RXD_ERR_HUGE_FRAME              0x01000000
-#define RXD_ERR_MASK                    0xffff0000
+
+#define RXD_ERR_MASK    (RXD_ERR_BAD_CRC | RXD_ERR_COLLISION |          \
+                         RXD_ERR_LINK_LOST | RXD_ERR_PHY_DECODE |       \
+                         RXD_ERR_MAC_ABRT | RXD_ERR_TOO_SMALL |         \
+                         RXD_ERR_NO_RESOURCES | RXD_ERR_HUGE_FRAME)
 
         u32                             reserved;
         u32                             opaque;
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index cf64f3d0b60d..4ad1187e82fb 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -707,7 +707,8 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
                 else
                         skb_checksum_none_assert(skb);
 
-                if (flags & BNA_CQ_EF_VLAN)
+                if ((flags & BNA_CQ_EF_VLAN) &&
+                    (bnad->netdev->features & NETIF_F_HW_VLAN_CTAG_RX))
                         __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), ntohs(cmpl->vlan_tag));
 
                 if (BNAD_RXBUF_IS_SK_BUFF(unmap_q->type))
@@ -2094,7 +2095,9 @@ bnad_init_rx_config(struct bnad *bnad, struct bna_rx_config *rx_config)
                 rx_config->q1_buf_size = BFI_SMALL_RXBUF_SIZE;
         }
 
-        rx_config->vlan_strip_status = BNA_STATUS_T_ENABLED;
+        rx_config->vlan_strip_status =
+                (bnad->netdev->features & NETIF_F_HW_VLAN_CTAG_RX) ?
+                BNA_STATUS_T_ENABLED : BNA_STATUS_T_DISABLED;
 }
 
 static void
@@ -3245,11 +3248,6 @@ bnad_set_rx_mode(struct net_device *netdev)
                         BNA_RXMODE_ALLMULTI;
         bna_rx_mode_set(bnad->rx_info[0].rx, new_mode, mode_mask, NULL);
 
-        if (bnad->cfg_flags & BNAD_CF_PROMISC)
-                bna_rx_vlan_strip_disable(bnad->rx_info[0].rx);
-        else
-                bna_rx_vlan_strip_enable(bnad->rx_info[0].rx);
-
         spin_unlock_irqrestore(&bnad->bna_lock, flags);
 }
 
@@ -3374,6 +3372,27 @@ bnad_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto, u16 vid)
         return 0;
 }
 
+static int bnad_set_features(struct net_device *dev, netdev_features_t features)
+{
+        struct bnad *bnad = netdev_priv(dev);
+        netdev_features_t changed = features ^ dev->features;
+
+        if ((changed & NETIF_F_HW_VLAN_CTAG_RX) && netif_running(dev)) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&bnad->bna_lock, flags);
+
+                if (features & NETIF_F_HW_VLAN_CTAG_RX)
+                        bna_rx_vlan_strip_enable(bnad->rx_info[0].rx);
+                else
+                        bna_rx_vlan_strip_disable(bnad->rx_info[0].rx);
+
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void
 bnad_netpoll(struct net_device *netdev)
@@ -3421,6 +3440,7 @@ static const struct net_device_ops bnad_netdev_ops = {
         .ndo_change_mtu         = bnad_change_mtu,
         .ndo_vlan_rx_add_vid    = bnad_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bnad_vlan_rx_kill_vid,
+        .ndo_set_features       = bnad_set_features,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = bnad_netpoll
 #endif
@@ -3433,14 +3453,14 @@ bnad_netdev_init(struct bnad *bnad, bool using_dac)
 
         netdev->hw_features = NETIF_F_SG | NETIF_F_RXCSUM |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_HW_VLAN_CTAG_TX;
+                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_HW_VLAN_CTAG_TX |
+                NETIF_F_HW_VLAN_CTAG_RX;
 
         netdev->vlan_features = NETIF_F_SG | NETIF_F_HIGHDMA |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                 NETIF_F_TSO | NETIF_F_TSO6;
 
-        netdev->features |= netdev->hw_features |
-                NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_CTAG_FILTER;
+        netdev->features |= netdev->hw_features | NETIF_F_HW_VLAN_CTAG_FILTER;
 
         if (using_dac)
                 netdev->features |= NETIF_F_HIGHDMA;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 43ab35fea48d..34e2488767d9 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -6179,6 +6179,7 @@ static struct pci_driver cxgb4_driver = {
         .id_table = cxgb4_pci_tbl,
         .probe    = init_one,
         .remove   = remove_one,
+        .shutdown = remove_one,
         .err_handler = &cxgb4_eeh,
 };
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 8d09615da585..05529e273050 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -350,11 +350,13 @@ struct be_drv_stats {
         u32 roce_drops_crc;
 };
 
+/* A vlan-id of 0xFFFF must be used to clear transparent vlan-tagging */
+#define BE_RESET_VLAN_TAG_ID    0xFFFF
+
 struct be_vf_cfg {
         unsigned char mac_addr[ETH_ALEN];
         int if_handle;
         int pmac_id;
-        u16 def_vid;
         u16 vlan_tag;
         u32 tx_rate;
 };
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 04ac9c6a0d39..36c80612e21a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -913,24 +913,14 @@ static int be_ipv6_tx_stall_chk(struct be_adapter *adapter,
         return BE3_chip(adapter) && be_ipv6_exthdr_check(skb);
 }
 
-static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
-                                           struct sk_buff *skb,
-                                           bool *skip_hw_vlan)
+static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter,
+                                                  struct sk_buff *skb,
+                                                  bool *skip_hw_vlan)
 {
         struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
         unsigned int eth_hdr_len;
         struct iphdr *ip;
 
-        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or less
-         * may cause a transmit stall on that port. So the work-around is to
-         * pad short packets (<= 32 bytes) to a 36-byte length.
-         */
-        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
-                if (skb_padto(skb, 36))
-                        goto tx_drop;
-                skb->len = 36;
-        }
-
         /* For padded packets, BE HW modifies tot_len field in IP header
          * incorrecly when VLAN tag is inserted by HW.
          * For padded packets, Lancer computes incorrect checksum.
@@ -959,7 +949,7 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
             vlan_tx_tag_present(skb)) {
                 skb = be_insert_vlan_in_pkt(adapter, skb, skip_hw_vlan);
                 if (unlikely(!skb))
-                        goto tx_drop;
+                        goto err;
         }
 
         /* HW may lockup when VLAN HW tagging is requested on
@@ -981,15 +971,39 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
             be_vlan_tag_tx_chk(adapter, skb)) {
                 skb = be_insert_vlan_in_pkt(adapter, skb, skip_hw_vlan);
                 if (unlikely(!skb))
-                        goto tx_drop;
+                        goto err;
         }
 
         return skb;
 tx_drop:
         dev_kfree_skb_any(skb);
+err:
         return NULL;
 }
 
+static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
+                                           struct sk_buff *skb,
+                                           bool *skip_hw_vlan)
+{
+        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or
+         * less may cause a transmit stall on that port. So the work-around is
+         * to pad short packets (<= 32 bytes) to a 36-byte length.
+         */
+        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
+                if (skb_padto(skb, 36))
+                        return NULL;
+                skb->len = 36;
+        }
+
+        if (BEx_chip(adapter) || lancer_chip(adapter)) {
+                skb = be_lancer_xmit_workarounds(adapter, skb, skip_hw_vlan);
+                if (!skb)
+                        return NULL;
+        }
+
+        return skb;
+}
+
 static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
@@ -1157,6 +1171,14 @@ ret:
         return status;
 }
 
+static void be_clear_promisc(struct be_adapter *adapter)
+{
+        adapter->promiscuous = false;
+        adapter->flags &= ~BE_FLAGS_VLAN_PROMISC;
+
+        be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
+}
+
 static void be_set_rx_mode(struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
@@ -1170,9 +1192,7 @@ static void be_set_rx_mode(struct net_device *netdev)
 
         /* BE was previously in promiscuous mode; disable it */
         if (adapter->promiscuous) {
-                adapter->promiscuous = false;
-                be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
-
+                be_clear_promisc(adapter);
                 if (adapter->vlans_added)
                         be_vid_config(adapter);
         }
@@ -1287,24 +1307,20 @@ static int be_set_vf_vlan(struct net_device *netdev,
 
         if (vlan || qos) {
                 vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan) {
-                        /* If this is new value, program it. Else skip. */
-                        vf_cfg->vlan_tag = vlan;
+                if (vf_cfg->vlan_tag != vlan)
                         status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
                                                        vf_cfg->if_handle, 0);
-                }
         } else {
                 /* Reset Transparent Vlan Tagging. */
-                vf_cfg->vlan_tag = 0;
-                vlan = vf_cfg->def_vid;
-                status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                               vf_cfg->if_handle, 0);
+                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
+                                               vf + 1, vf_cfg->if_handle, 0);
         }
 
-
-        if (status)
+        if (!status)
+                vf_cfg->vlan_tag = vlan;
+        else
                 dev_info(&adapter->pdev->dev,
-                                "VLAN %d config on VF %d failed\n", vlan, vf);
+                         "VLAN %d config on VF %d failed\n", vlan, vf);
         return status;
 }
 
@@ -3013,11 +3029,11 @@ static int be_vf_setup_init(struct be_adapter *adapter)
 
 static int be_vf_setup(struct be_adapter *adapter)
 {
+        struct device *dev = &adapter->pdev->dev;
         struct be_vf_cfg *vf_cfg;
-        u16 def_vlan, lnk_speed;
         int status, old_vfs, vf;
-        struct device *dev = &adapter->pdev->dev;
         u32 privileges;
+        u16 lnk_speed;
 
         old_vfs = pci_num_vf(adapter->pdev);
         if (old_vfs) {
@@ -3084,12 +3100,6 @@ static int be_vf_setup(struct be_adapter *adapter)
                 if (!status)
                         vf_cfg->tx_rate = lnk_speed;
 
-                status = be_cmd_get_hsw_config(adapter, &def_vlan,
-                                               vf + 1, vf_cfg->if_handle, NULL);
-                if (status)
-                        goto err;
-                vf_cfg->def_vid = def_vlan;
-
                 if (!old_vfs)
                         be_cmd_enable_vf(adapter, vf + 1);
         }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 903362a7b584..479a7cba45c0 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -389,12 +389,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                         netdev_err(ndev, "Tx DMA memory map failed\n");
                 return NETDEV_TX_OK;
         }
-        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
-         * it's the last BD of the frame, and to put the CRC on the end.
-         */
-        status |= (BD_ENET_TX_READY | BD_ENET_TX_INTR
-                        | BD_ENET_TX_LAST | BD_ENET_TX_TC);
-        bdp->cbd_sc = status;
 
         if (fep->bufdesc_ex) {
 
@@ -416,6 +410,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 }
         }
 
+        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
+         * it's the last BD of the frame, and to put the CRC on the end.
+         */
+        status |= (BD_ENET_TX_READY | BD_ENET_TX_INTR
+                        | BD_ENET_TX_LAST | BD_ENET_TX_TC);
+        bdp->cbd_sc = status;
+
         bdp_pre = fec_enet_get_prevdesc(bdp, fep);
         if ((id_entry->driver_data & FEC_QUIRK_ERR006358) &&
             !(bdp_pre->cbd_sc & BD_ENET_TX_READY)) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 6b65f7795215..7aec6c833973 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -51,8 +51,8 @@
 
 #define DRV_NAME        "mlx4_core"
 #define PFX             DRV_NAME ": "
-#define DRV_VERSION     "1.1"
-#define DRV_RELDATE     "Dec, 2011"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb, 2014"
 
 #define MLX4_FS_UDP_UC_EN               (1 << 1)
 #define MLX4_FS_TCP_UC_EN               (1 << 2)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 9ca223bc90fc..b57e8c87a34e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -57,8 +57,8 @@
 #include "en_port.h"
 
 #define DRV_NAME        "mlx4_en"
-#define DRV_VERSION     "2.0"
-#define DRV_RELDATE     "Dec 2011"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb 2014"
 
 #define MLX4_EN_MSG_LEVEL       (NETIF_MSG_LINK | NETIF_MSG_IFDOWN)
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index a064f06e0cb8..23b7e2d35a93 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -46,8 +46,8 @@
 #include "mlx5_core.h"
 
 #define DRIVER_NAME "mlx5_core"
-#define DRIVER_VERSION "1.0"
-#define DRIVER_RELDATE  "June 2013"
+#define DRIVER_VERSION "2.2-1"
+#define DRIVER_RELDATE  "Feb 2014"
 
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox ConnectX-IB HCA core library");
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4146664d4d6a..27c4f131863b 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -340,6 +340,7 @@ int qlcnic_83xx_setup_intr(struct qlcnic_adapter *adapter)
                         if (qlcnic_sriov_vf_check(adapter))
                                 return -EINVAL;
                         num_msix = 1;
+                        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
                         adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
                 }
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index 77f1bce432d2..7d4f54912bad 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -807,7 +807,7 @@ qlcnic_dcb_get_pg_tc_cfg_tx(struct net_device *netdev, int tc, u8 *prio,
             !type->tc_param_valid)
                 return;
 
-        if (tc < 0 || (tc > QLC_DCB_MAX_TC))
+        if (tc < 0 || (tc >= QLC_DCB_MAX_TC))
                 return;
 
         tc_cfg = &type->tc_cfg[tc];
@@ -843,7 +843,7 @@ static void qlcnic_dcb_get_pg_bwg_cfg_tx(struct net_device *netdev, int pgid,
             !type->tc_param_valid)
                 return;
 
-        if (pgid < 0 || pgid > QLC_DCB_MAX_PG)
+        if (pgid < 0 || pgid >= QLC_DCB_MAX_PG)
                 return;
 
         pgcfg = &type->pg_cfg[pgid];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index ba78c7481fa3..1222865cfb73 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -816,9 +816,10 @@ static int qlcnic_82xx_setup_intr(struct qlcnic_adapter *adapter)
 
                 if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
                         qlcnic_disable_multi_tx(adapter);
+                        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
 
                         err = qlcnic_enable_msi_legacy(adapter);
-                        if (!err)
+                        if (err)
                                 return err;
                 }
         }
@@ -3863,7 +3864,7 @@ int qlcnic_validate_rings(struct qlcnic_adapter *adapter, __u32 ring_cnt,
                 strcpy(buf, "Tx");
         }
 
-        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
+        if (!QLCNIC_IS_MSI_FAMILY(adapter)) {
                 netdev_err(netdev, "No RSS/TSS support in INT-x mode\n");
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 09acf15c3a56..e5277a632671 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -13,8 +13,6 @@
 #define QLC_VF_MIN_TX_RATE      100
 #define QLC_VF_MAX_TX_RATE      9999
 #define QLC_MAC_OPCODE_MASK     0x7
-#define QLC_MAC_STAR_ADD        6
-#define QLC_MAC_STAR_DEL        7
 #define QLC_VF_FLOOD_BIT        BIT_16
 #define QLC_FLOOD_MODE          0x5
 
@@ -1206,13 +1204,6 @@ static int qlcnic_sriov_validate_cfg_macvlan(struct qlcnic_adapter *adapter,
         struct qlcnic_vport *vp = vf->vp;
         u8 op, new_op;
 
-        if (((cmd->req.arg[1] & QLC_MAC_OPCODE_MASK) == QLC_MAC_STAR_ADD) ||
-            ((cmd->req.arg[1] & QLC_MAC_OPCODE_MASK) == QLC_MAC_STAR_DEL)) {
-                netdev_err(adapter->netdev, "MAC + any VLAN filter not allowed from VF %d\n",
-                           vf->pci_func);
-                return -EINVAL;
-        }
-
         if (!(cmd->req.arg[1] & BIT_8))
                 return -EINVAL;
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 91a67ae8f17b..e9779653cd4c 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7118,6 +7118,8 @@ rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         mutex_init(&tp->wk.mutex);
+        u64_stats_init(&tp->rx_stats.syncp);
+        u64_stats_init(&tp->tx_stats.syncp);
 
         /* Get MAC address */
         for (i = 0; i < ETH_ALEN; i++)
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index eb75fbd11a01..d7a36829649a 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -1668,6 +1668,13 @@ void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev)
         struct efx_ptp_data *ptp = efx->ptp_data;
         int code = EFX_QWORD_FIELD(*ev, MCDI_EVENT_CODE);
 
+        if (!ptp) {
+                if (net_ratelimit())
+                        netif_warn(efx, drv, efx->net_dev,
+                                   "Received PTP event but PTP not set up\n");
+                return;
+        }
+
         if (!ptp->enabled)
                 return;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a2e7d2c96e36..078ad0ec8593 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1705,7 +1705,7 @@ static int stmmac_open(struct net_device *dev)
         priv->dma_rx_size = STMMAC_ALIGN(dma_rxsize);
         priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
 
-        alloc_dma_desc_resources(priv);
+        ret = alloc_dma_desc_resources(priv);
         if (ret < 0) {
                 pr_err("%s: DMA descriptors allocation failed\n", __func__);
                 goto dma_desc_error;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 651087b5c8da..ffd4d12acf6d 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1164,11 +1164,17 @@ static void cpsw_init_host_port(struct cpsw_priv *priv)
 
 static void cpsw_slave_stop(struct cpsw_slave *slave, struct cpsw_priv *priv)
 {
+        u32 slave_port;
+
+        slave_port = cpsw_get_slave_port(priv, slave->slave_num);
+
         if (!slave->phy)
                 return;
         phy_stop(slave->phy);
         phy_disconnect(slave->phy);
         slave->phy = NULL;
+        cpsw_ale_control_set(priv->ale, slave_port,
+                             ALE_PORT_STATE, ALE_PORT_STATE_DISABLE);
 }
 
 static int cpsw_ndo_open(struct net_device *ndev)
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index a5d21893670d..1831fb7cd017 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -506,6 +506,9 @@ static int macvlan_change_mtu(struct net_device *dev, int new_mtu)
 static struct lock_class_key macvlan_netdev_xmit_lock_key;
 static struct lock_class_key macvlan_netdev_addr_lock_key;
 
+#define ALWAYS_ON_FEATURES \
+        (NETIF_F_SG | NETIF_F_GEN_CSUM | NETIF_F_GSO_SOFTWARE | NETIF_F_LLTX)
+
 #define MACVLAN_FEATURES \
         (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
          NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_GSO_ROBUST | \
@@ -539,7 +542,7 @@ static int macvlan_init(struct net_device *dev)
         dev->state              = (dev->state & ~MACVLAN_STATE_MASK) |
                                   (lowerdev->state & MACVLAN_STATE_MASK);
         dev->features           = lowerdev->features & MACVLAN_FEATURES;
-        dev->features           |= NETIF_F_LLTX;
+        dev->features           |= ALWAYS_ON_FEATURES;
         dev->gso_max_size       = lowerdev->gso_max_size;
         dev->iflink             = lowerdev->ifindex;
         dev->hard_header_len    = lowerdev->hard_header_len;
@@ -699,7 +702,7 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
         features = netdev_increment_features(vlan->lowerdev->features,
                                              features,
                                              mask);
-        features |= NETIF_F_LLTX;
+        features |= ALWAYS_ON_FEATURES;
 
         return features;
 }
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 82514e72b3d8..4b970f7624c0 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -916,6 +916,8 @@ int genphy_read_status(struct phy_device *phydev)
         int err;
         int lpa;
         int lpagb = 0;
+        int common_adv;
+        int common_adv_gb = 0;
 
         /* Update the link, but return if there was an error */
         err = genphy_update_link(phydev);
@@ -937,7 +939,7 @@ int genphy_read_status(struct phy_device *phydev)
 
                         phydev->lp_advertising =
                                 mii_stat1000_to_ethtool_lpa_t(lpagb);
-                        lpagb &= adv << 2;
+                        common_adv_gb = lpagb & adv << 2;
                 }
 
                 lpa = phy_read(phydev, MII_LPA);
@@ -950,25 +952,25 @@ int genphy_read_status(struct phy_device *phydev)
                 if (adv < 0)
                         return adv;
 
-                lpa &= adv;
+                common_adv = lpa & adv;
 
                 phydev->speed = SPEED_10;
                 phydev->duplex = DUPLEX_HALF;
                 phydev->pause = 0;
                 phydev->asym_pause = 0;
 
-                if (lpagb & (LPA_1000FULL | LPA_1000HALF)) {
+                if (common_adv_gb & (LPA_1000FULL | LPA_1000HALF)) {
                         phydev->speed = SPEED_1000;
 
-                        if (lpagb & LPA_1000FULL)
+                        if (common_adv_gb & LPA_1000FULL)
                                 phydev->duplex = DUPLEX_FULL;
-                } else if (lpa & (LPA_100FULL | LPA_100HALF)) {
+                } else if (common_adv & (LPA_100FULL | LPA_100HALF)) {
                         phydev->speed = SPEED_100;
 
-                        if (lpa & LPA_100FULL)
+                        if (common_adv & LPA_100FULL)
                                 phydev->duplex = DUPLEX_FULL;
                 } else
-                        if (lpa & LPA_10FULL)
+                        if (common_adv & LPA_10FULL)
                                 phydev->duplex = DUPLEX_FULL;
 
                 if (phydev->duplex == DUPLEX_FULL) {
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 8fe9cb7d0f72..26f8635b027d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1686,7 +1686,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                                    TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
                                    NETIF_F_HW_VLAN_STAG_TX;
                 dev->features = dev->hw_features;
-                dev->vlan_features = dev->features;
+                dev->vlan_features = dev->features &
+                                     ~(NETIF_F_HW_VLAN_CTAG_TX |
+                                       NETIF_F_HW_VLAN_STAG_TX);
 
                 INIT_LIST_HEAD(&tun->disabled);
                 err = tun_attach(tun, file, false);
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 955df81a4358..d2e6fdb25e28 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1395,6 +1395,19 @@ static const struct driver_info ax88178a_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info dlink_dub1312_info = {
+        .description = "D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct driver_info sitecom_info = {
         .description = "Sitecom USB 3.0 to Gigabit Adapter",
         .bind = ax88179_bind,
@@ -1421,6 +1434,19 @@ static const struct driver_info samsung_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info lenovo_info = {
+        .description = "Lenovo OneLinkDock Gigabit LAN",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct usb_device_id products[] = {
 {
         /* ASIX AX88179 10/100/1000 */
@@ -1431,6 +1457,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0b95, 0x178a),
         .driver_info = (unsigned long)&ax88178a_info,
 }, {
+        /* D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter */
+        USB_DEVICE(0x2001, 0x4a00),
+        .driver_info = (unsigned long)&dlink_dub1312_info,
+}, {
         /* Sitecom USB 3.0 to Gigabit Adapter */
         USB_DEVICE(0x0df6, 0x0072),
         .driver_info = (unsigned long)&sitecom_info,
@@ -1438,6 +1468,10 @@ static const struct usb_device_id products[] = {
         /* Samsung USB Ethernet Adapter */
         USB_DEVICE(0x04e8, 0xa100),
         .driver_info = (unsigned long)&samsung_info,
+}, {
+        /* Lenovo OneLinkDock Gigabit LAN */
+        USB_DEVICE(0x17ef, 0x304b),
+        .driver_info = (unsigned long)&lenovo_info,
 },
         { },
 };
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 2ec2041b62d4..5b374370f71c 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -285,7 +285,8 @@ static void veth_setup(struct net_device *dev)
         dev->ethtool_ops = &veth_ethtool_ops;
         dev->features |= NETIF_F_LLTX;
         dev->features |= VETH_FEATURES;
-        dev->vlan_features = dev->features;
+        dev->vlan_features = dev->features &
+                             ~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX);
         dev->destructor = veth_dev_free;
 
         dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d75f8edf4fb3..5632a99cbbd2 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1711,7 +1711,8 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* If we can receive ANY GSO packets, we must allocate large ones. */
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
             virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
                 vi->big_packets = true;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index 1cc13569b17b..1b6b4d0cfa97 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -57,7 +57,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
         {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
@@ -96,7 +96,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
         {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 11eab9f01fd8..303ce27964c1 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1534,7 +1534,7 @@ EXPORT_SYMBOL(ath9k_hw_check_nav);
 bool ath9k_hw_check_alive(struct ath_hw *ah)
 {
         int count = 50;
-        u32 reg;
+        u32 reg, last_val;
 
         if (AR_SREV_9300(ah))
                 return !ath9k_hw_detect_mac_hang(ah);
@@ -1542,9 +1542,13 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
         if (AR_SREV_9285_12_OR_LATER(ah))
                 return true;
 
+        last_val = REG_READ(ah, AR_OBS_BUS_1);
         do {
                 reg = REG_READ(ah, AR_OBS_BUS_1);
+                if (reg != last_val)
+                        return true;
 
+                last_val = reg;
                 if ((reg & 0x7E7FFFEF) == 0x00702400)
                         continue;
 
@@ -1556,6 +1560,8 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
                 default:
                         return true;
                 }
+
+                udelay(1);
         } while (count-- > 0);
 
         return false;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a0ebdd000fc2..82e340d3ec60 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -732,11 +732,18 @@ static struct ath_rxbuf *ath_get_next_rx_buf(struct ath_softc *sc,
                         return NULL;
 
                 /*
-                 * mark descriptor as zero-length and set the 'more'
-                 * flag to ensure that both buffers get discarded
+                 * Re-check previous descriptor, in case it has been filled
+                 * in the mean time.
                  */
-                rs->rs_datalen = 0;
-                rs->rs_more = true;
+                ret = ath9k_hw_rxprocdesc(ah, ds, rs);
+                if (ret == -EINPROGRESS) {
+                        /*
+                         * mark descriptor as zero-length and set the 'more'
+                         * flag to ensure that both buffers get discarded
+                         */
+                        rs->rs_datalen = 0;
+                        rs->rs_more = true;
+                }
         }
 
         list_del(&bf->list);
@@ -985,32 +992,32 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_hdr *hdr;
         bool discard_current = sc->rx.discard_next;
-        int ret = 0;
 
         /*
          * Discard corrupt descriptors which are marked in
          * ath_get_next_rx_buf().
          */
-        sc->rx.discard_next = rx_stats->rs_more;
         if (discard_current)
-                return -EINVAL;
+                goto corrupt;
+
+        sc->rx.discard_next = false;
 
         /*
          * Discard zero-length packets.
          */
         if (!rx_stats->rs_datalen) {
                 RX_STAT_INC(rx_len_err);
-                return -EINVAL;
+                goto corrupt;
         }
 
-        /*
-         * rs_status follows rs_datalen so if rs_datalen is too large
-         * we can take a hint that hardware corrupted it, so ignore
-         * those frames.
-         */
+        /*
+         * rs_status follows rs_datalen so if rs_datalen is too large
+         * we can take a hint that hardware corrupted it, so ignore
+         * those frames.
+         */
         if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {
                 RX_STAT_INC(rx_len_err);
-                return -EINVAL;
+                goto corrupt;
         }
 
         /* Only use status info from the last fragment */
@@ -1024,10 +1031,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
          * This is different from the other corrupt descriptor
          * condition handled above.
          */
-        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC)
+                goto corrupt;
 
         hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
 
@@ -1043,18 +1048,15 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
                         RX_STAT_INC(rx_spectral);
 
-                ret = -EINVAL;
-                goto exit;
+                return -EINVAL;
         }
 
         /*
          * everything but the rate is checked here, the rate check is done
          * separately to avoid doing two lookups for a rate for each frame.
          */
-        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
+                return -EINVAL;
 
         if (ath_is_mybeacon(common, hdr)) {
                 RX_STAT_INC(rx_beacons);
@@ -1064,15 +1066,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         /*
          * This shouldn't happen, but have a safety check anyway.
          */
-        if (WARN_ON(!ah->curchan)) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (WARN_ON(!ah->curchan))
+                return -EINVAL;
 
-        if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
-                ret =-EINVAL;
-                goto exit;
-        }
+        if (ath9k_process_rate(common, hw, rx_stats, rx_status))
+                return -EINVAL;
 
         ath9k_process_rssi(common, hw, rx_stats, rx_status);
 
@@ -1087,9 +1085,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 sc->rx.num_pkts++;
 #endif
 
-exit:
-        sc->rx.discard_next = false;
-        return ret;
+        return 0;
+
+corrupt:
+        sc->rx.discard_next = rx_stats->rs_more;
+        return -EINVAL;
 }
 
 static void ath9k_rx_skb_postprocess(struct ath_common *common,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 0a75e2f68c9d..f042a18c8495 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1444,14 +1444,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
         for (tidno = 0, tid = &an->tid[tidno];
              tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
 
-                if (!tid->sched)
-                        continue;
-
                 ac = tid->ac;
                 txq = ac->txq;
 
                 ath_txq_lock(sc, txq);
 
+                if (!tid->sched) {
+                        ath_txq_unlock(sc, txq);
+                        continue;
+                }
+
                 buffered = ath_tid_has_buffered(tid);
 
                 tid->sched = false;
@@ -2184,14 +2186,15 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 txq->stopped = true;
         }
 
+        if (txctl->an)
+                tid = ath_get_skb_tid(sc, txctl->an, skb);
+
         if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
                 ath_txq_unlock(sc, txq);
                 txq = sc->tx.uapsdq;
                 ath_txq_lock(sc, txq);
         } else if (txctl->an &&
                    ieee80211_is_data_present(hdr->frame_control)) {
-                tid = ath_get_skb_tid(sc, txctl->an, skb);
-
                 WARN_ON(tid->ac->txq != txctl->txq);
 
                 if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 3e991897d7ca..119ee6eaf1c3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -457,7 +457,6 @@ struct brcmf_sdio {
 
         u8 tx_hdrlen;           /* sdio bus header length for tx packet */
         bool txglom;            /* host tx glomming enable flag */
-        struct sk_buff *txglom_sgpad;   /* scatter-gather padding buffer */
         u16 head_align;         /* buffer pointer alignment */
         u16 sgentry_align;      /* scatter-gather buffer alignment */
 };
@@ -1944,9 +1943,8 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
         if (lastfrm && chain_pad)
                 tail_pad += blksize - chain_pad;
         if (skb_tailroom(pkt) < tail_pad && pkt->len > blksize) {
-                pkt_pad = bus->txglom_sgpad;
-                if (pkt_pad == NULL)
-                          brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
+                pkt_pad = brcmu_pkt_buf_get_skb(tail_pad + tail_chop +
+                                                bus->head_align);
                 if (pkt_pad == NULL)
                         return -ENOMEM;
                 ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
@@ -1957,6 +1955,7 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
                        tail_chop);
                 *(u32 *)(pkt_pad->cb) = ALIGN_SKB_FLAG + tail_chop;
                 skb_trim(pkt, pkt->len - tail_chop);
+                skb_trim(pkt_pad, tail_pad + tail_chop);
                 __skb_queue_after(pktq, pkt, pkt_pad);
         } else {
                 ntail = pkt->data_len + tail_pad -
@@ -2011,7 +2010,7 @@ brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
                         return ret;
                 head_pad = (u16)ret;
                 if (head_pad)
-                        memset(pkt_next->data, 0, head_pad + bus->tx_hdrlen);
+                        memset(pkt_next->data + bus->tx_hdrlen, 0, head_pad);
 
                 total_len += pkt_next->len;
 
@@ -3486,10 +3485,6 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                 bus->txglom = false;
                 value = 1;
                 pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
-                bus->txglom_sgpad = brcmu_pkt_buf_get_skb(pad_size);
-                if (!bus->txglom_sgpad)
-                        brcmf_err("allocating txglom padding skb failed, reduced performance\n");
-
                 err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
                                            &value, sizeof(u32));
                 if (err < 0) {
@@ -4053,7 +4048,6 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                         brcmf_sdio_chip_detach(&bus->ci);
                 }
 
-                brcmu_pkt_buf_free_skb(bus->txglom_sgpad);
                 kfree(bus->rxbuf);
                 kfree(bus->hdrbuf);
                 kfree(bus);
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index d36e252d2ccb..596525528f50 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -147,7 +147,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
 
         if (!sta->ap && sta->u.sta.challenge)
                 kfree(sta->u.sta.challenge);
-        del_timer(&sta->timer);
+        del_timer_sync(&sta->timer);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
 
         kfree(sta);
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index c0d070c5df5e..9cdd91cdf661 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -590,6 +590,7 @@ void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
                         sizeof(priv->tid_data[sta_id][tid]));
 
         priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
+        priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
 
         priv->num_stations--;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index a6839dfcb82d..398dd096674c 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1291,8 +1291,6 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         struct iwl_compressed_ba_resp *ba_resp = (void *)pkt->data;
         struct iwl_ht_agg *agg;
         struct sk_buff_head reclaimed_skbs;
-        struct ieee80211_tx_info *info;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb;
         int sta_id;
         int tid;
@@ -1379,22 +1377,28 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         freed = 0;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (ieee80211_is_data_qos(hdr->frame_control))
                         freed++;
                 else
                         WARN_ON_ONCE(1);
 
-                info = IEEE80211_SKB_CB(skb);
                 iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
 
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
                 if (freed == 1) {
                         /* this is the first skb we deliver in this batch */
                         /* put the rate scaling data there */
                         info = IEEE80211_SKB_CB(skb);
                         memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                         info->flags |= IEEE80211_TX_STAT_AMPDU;
                         info->status.ampdu_ack_len = ba_resp->txed_2_done;
                         info->status.ampdu_len = ba_resp->txed;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index e4ead86f06d6..2b0ba1fc3c82 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -152,7 +152,7 @@ enum iwl_power_scheme {
         IWL_POWER_SCHEME_LP
 };
 
-#define IWL_CONN_MAX_LISTEN_INTERVAL    70
+#define IWL_CONN_MAX_LISTEN_INTERVAL    10
 #define IWL_UAPSD_AC_INFO               (IEEE80211_WMM_IE_STA_QOSINFO_AC_VO |\
                                          IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |\
                                          IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |\
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 4df12fa9d336..76ee486039d7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -822,16 +822,12 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         struct iwl_mvm_ba_notif *ba_notif = (void *)pkt->data;
         struct sk_buff_head reclaimed_skbs;
         struct iwl_mvm_tid_data *tid_data;
-        struct ieee80211_tx_info *info;
         struct ieee80211_sta *sta;
         struct iwl_mvm_sta *mvmsta;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb;
         int sta_id, tid, freed;
-
         /* "flow" corresponds to Tx queue */
         u16 scd_flow = le16_to_cpu(ba_notif->scd_flow);
-
         /* "ssn" is start of block-ack Tx window, corresponds to index
          * (in Tx queue's circular buffer) of first TFD/frame in window */
         u16 ba_resp_scd_ssn = le16_to_cpu(ba_notif->scd_ssn);
@@ -888,22 +884,26 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         freed = 0;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (ieee80211_is_data_qos(hdr->frame_control))
                         freed++;
                 else
                         WARN_ON_ONCE(1);
 
-                info = IEEE80211_SKB_CB(skb);
                 iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
 
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
                 if (freed == 1) {
                         /* this is the first skb we deliver in this batch */
                         /* put the rate scaling data there */
-                        info = IEEE80211_SKB_CB(skb);
-                        memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                         info->flags |= IEEE80211_TX_STAT_AMPDU;
                         info->status.ampdu_ack_len = ba_notif->txed_2_done;
                         info->status.ampdu_len = ba_notif->txed;
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 32f75007a825..cb6d189bc3e6 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -621,7 +621,7 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                         id = *pos++;
                         elen = *pos++;
                         left -= 2;
-                        if (elen > left || elen == 0) {
+                        if (elen > left) {
                                 lbs_deb_scan("scan response: invalid IE fmt\n");
                                 goto done;
                         }
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 03688aa14e8a..7fe7b53fb17a 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1211,6 +1211,12 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
                 rd_index = card->rxbd_rdptr & reg->rx_mask;
                 skb_data = card->rx_buf_list[rd_index];
 
+                /* If skb allocation was failed earlier for Rx packet,
+                 * rx_buf_list[rd_index] would have been left with a NULL.
+                 */
+                if (!skb_data)
+                        return -ENOMEM;
+
                 MWIFIEX_SKB_PACB(skb_data, &buf_pa);
                 pci_unmap_single(card->dev, buf_pa, MWIFIEX_RX_DATA_BUF_SIZE,
                                  PCI_DMA_FROMDEVICE);
@@ -1525,6 +1531,14 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                         mwifiex_process_sleep_confirm_resp(adapter, skb->data,
                                                            skb->len);
+                        mwifiex_pcie_enable_host_int(adapter);
+                        if (mwifiex_write_reg(adapter,
+                                              PCIE_CPU_INT_EVENT,
+                                              CPU_INTR_SLEEP_CFM_DONE)) {
+                                dev_warn(adapter->dev,
+                                         "Write register failed\n");
+                                return -1;
+                        }
                         while (reg->sleep_cookie && (count++ < 10) &&
                                mwifiex_pcie_ok_to_access_hw(adapter))
                                 usleep_range(50, 60);
@@ -1993,23 +2007,9 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                 adapter->int_status |= pcie_ireg;
                 spin_unlock_irqrestore(&adapter->int_lock, flags);
 
-                if (pcie_ireg & HOST_INTR_CMD_DONE) {
-                        if ((adapter->ps_state == PS_STATE_SLEEP_CFM) ||
-                            (adapter->ps_state == PS_STATE_SLEEP)) {
-                                mwifiex_pcie_enable_host_int(adapter);
-                                if (mwifiex_write_reg(adapter,
-                                                      PCIE_CPU_INT_EVENT,
-                                                      CPU_INTR_SLEEP_CFM_DONE)
-                                                      ) {
-                                        dev_warn(adapter->dev,
-                                                 "Write register failed\n");
-                                        return;
-
-                                }
-                        }
-                } else if (!adapter->pps_uapsd_mode &&
-                           adapter->ps_state == PS_STATE_SLEEP &&
-                           mwifiex_pcie_ok_to_access_hw(adapter)) {
+                if (!adapter->pps_uapsd_mode &&
+                    adapter->ps_state == PS_STATE_SLEEP &&
+                    mwifiex_pcie_ok_to_access_hw(adapter)) {
                                 /* Potentially for PCIe we could get other
                                  * interrupts like shared. Don't change power
                                  * state until cookie is set */
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index e8ebbd4bc3cd..208748804a55 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -22,8 +22,6 @@
 
 #define USB_VERSION     "1.0"
 
-static const char usbdriver_name[] = "usb8xxx";
-
 static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
 static struct usb_card_rec *usb_card;
@@ -527,13 +525,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
                                                    MWIFIEX_BSS_ROLE_ANY),
                                   MWIFIEX_ASYNC_CMD);
 
-#ifdef CONFIG_PM
-        /* Resume handler may be called due to remote wakeup,
-         * force to exit suspend anyway
-         */
-        usb_disable_autosuspend(card->udev);
-#endif /* CONFIG_PM */
-
         return 0;
 }
 
@@ -567,13 +558,12 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
 }
 
 static struct usb_driver mwifiex_usb_driver = {
-        .name = usbdriver_name,
+        .name = "mwifiex_usb",
         .probe = mwifiex_usb_probe,
         .disconnect = mwifiex_usb_disconnect,
         .id_table = mwifiex_usb_table,
         .suspend = mwifiex_usb_suspend,
         .resume = mwifiex_usb_resume,
-        .supports_autosuspend = 1,
 };
 
 static int mwifiex_usb_tx_init(struct mwifiex_adapter *adapter)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 13eaeed03898..981cf6e7c73b 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -559,7 +559,8 @@ mwifiex_clean_txrx(struct mwifiex_private *priv)
         mwifiex_wmm_delete_all_ralist(priv);
         memcpy(tos_to_tid, ac_to_tid, sizeof(tos_to_tid));
 
-        if (priv->adapter->if_ops.clean_pcie_ring)
+        if (priv->adapter->if_ops.clean_pcie_ring &&
+            !priv->adapter->surprise_removed)
                 priv->adapter->if_ops.clean_pcie_ring(priv->adapter);
         spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags);
 }
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index f9daa9e183f2..e30d80033cbc 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -907,6 +907,7 @@ static int handle_incoming_queue(struct net_device *dev,
 
                 /* Ethernet work: Delayed to here as it peeks the header. */
                 skb->protocol = eth_type_trans(skb, dev);
+                skb_reset_network_header(skb);
 
                 if (checksum_setup(dev, skb)) {
                         kfree_skb(skb);
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index be361b7cd30f..1e4e69384baa 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -217,7 +217,7 @@ config PINCTRL_IMX28
         select PINCTRL_MXS
 
 config PINCTRL_MSM
-        tristate
+        bool
         select PINMUX
         select PINCONF
         select GENERIC_PINCONF
diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
index 9ccf681dad2f..f9fabe9bf47d 100644
--- a/drivers/pinctrl/pinctrl-sunxi.c
+++ b/drivers/pinctrl/pinctrl-sunxi.c
@@ -14,6 +14,7 @@
 #include <linux/clk.h>
 #include <linux/gpio.h>
 #include <linux/irqdomain.h>
+#include <linux/irqchip/chained_irq.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
@@ -584,7 +585,7 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
         spin_lock_irqsave(&pctl->lock, flags);
 
         regval = readl(pctl->membase + reg);
-        regval &= ~IRQ_CFG_IRQ_MASK;
+        regval &= ~(IRQ_CFG_IRQ_MASK << index);
         writel(regval | (mode << index), pctl->membase + reg);
 
         spin_unlock_irqrestore(&pctl->lock, flags);
@@ -665,6 +666,7 @@ static struct irq_chip sunxi_pinctrl_irq_chip = {
 
 static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
 {
+        struct irq_chip *chip = irq_get_chip(irq);
         struct sunxi_pinctrl *pctl = irq_get_handler_data(irq);
         const unsigned long reg = readl(pctl->membase + IRQ_STATUS_REG);
 
@@ -674,10 +676,12 @@ static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
         if (reg) {
                 int irqoffset;
 
+                chained_irq_enter(chip, desc);
                 for_each_set_bit(irqoffset, &reg, SUNXI_IRQ_NUMBER) {
                         int pin_irq = irq_find_mapping(pctl->domain, irqoffset);
                         generic_handle_irq(pin_irq);
                 }
+                chained_irq_exit(chip, desc);
         }
 }
 
diff --git a/drivers/pinctrl/pinctrl-sunxi.h b/drivers/pinctrl/pinctrl-sunxi.h
index 01c494f8a14f..552b0e97077a 100644
--- a/drivers/pinctrl/pinctrl-sunxi.h
+++ b/drivers/pinctrl/pinctrl-sunxi.h
@@ -511,7 +511,7 @@ static inline u32 sunxi_pull_offset(u16 pin)
 
 static inline u32 sunxi_irq_cfg_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_CFG_IRQ_PER_REG;
+        u8 reg = irq / IRQ_CFG_IRQ_PER_REG * 0x04;
         return reg + IRQ_CFG_REG;
 }
 
@@ -523,7 +523,7 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq)
 
 static inline u32 sunxi_irq_ctrl_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_CTRL_IRQ_PER_REG;
+        u8 reg = irq / IRQ_CTRL_IRQ_PER_REG * 0x04;
         return reg + IRQ_CTRL_REG;
 }
 
@@ -535,7 +535,7 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq)
 
 static inline u32 sunxi_irq_status_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_STATUS_IRQ_PER_REG;
+        u8 reg = irq / IRQ_STATUS_IRQ_PER_REG * 0x04;
         return reg + IRQ_STATUS_REG;
 }
 
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 77d103fe39d9..567d6918d50b 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -89,7 +89,8 @@ enum {
 
         /* GPSR6 */
         FN_IP13_10, FN_IP13_11, FN_IP13_12, FN_IP13_13, FN_IP13_14,
-        FN_IP13_15, FN_IP13_18_16, FN_IP13_21_19, FN_IP13_22, FN_IP13_24_23,
+        FN_IP13_15, FN_IP13_18_16, FN_IP13_21_19,
+        FN_IP13_22, FN_IP13_24_23, FN_SD1_CLK,
         FN_IP13_25, FN_IP13_26, FN_IP13_27, FN_IP13_30_28, FN_IP14_1_0,
         FN_IP14_2, FN_IP14_3, FN_IP14_4, FN_IP14_5, FN_IP14_6, FN_IP14_7,
         FN_IP14_10_8, FN_IP14_13_11, FN_IP14_16_14, FN_IP14_19_17,
@@ -788,6 +789,7 @@ static const u16 pinmux_data[] = {
         PINMUX_DATA(USB1_PWEN_MARK, FN_USB1_PWEN),
         PINMUX_DATA(USB1_OVC_MARK, FN_USB1_OVC),
         PINMUX_DATA(DU0_DOTCLKIN_MARK, FN_DU0_DOTCLKIN),
+        PINMUX_DATA(SD1_CLK_MARK, FN_SD1_CLK),
 
         /* IPSR0 */
         PINMUX_IPSR_DATA(IP0_0, D0),
@@ -3825,7 +3827,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
                 GP_6_11_FN, FN_IP13_25,
                 GP_6_10_FN, FN_IP13_24_23,
                 GP_6_9_FN, FN_IP13_22,
-                0, 0,
+                GP_6_8_FN, FN_SD1_CLK,
                 GP_6_7_FN, FN_IP13_21_19,
                 GP_6_6_FN, FN_IP13_18_16,
                 GP_6_5_FN, FN_IP13_15,
diff --git a/drivers/pinctrl/sirf/pinctrl-sirf.c b/drivers/pinctrl/sirf/pinctrl-sirf.c
index a0d6152701cd..617a4916b50f 100644
--- a/drivers/pinctrl/sirf/pinctrl-sirf.c
+++ b/drivers/pinctrl/sirf/pinctrl-sirf.c
@@ -598,7 +598,7 @@ static unsigned int sirfsoc_gpio_irq_startup(struct irq_data *d)
 {
         struct sirfsoc_gpio_bank *bank = irq_data_get_irq_chip_data(d);
 
-        if (gpio_lock_as_irq(&bank->chip.gc, d->hwirq))
+        if (gpio_lock_as_irq(&bank->chip.gc, d->hwirq % SIRFSOC_GPIO_BANK_SIZE))
                 dev_err(bank->chip.gc.dev,
                         "unable to lock HW IRQ %lu for IRQ\n",
                         d->hwirq);
@@ -611,7 +611,7 @@ static void sirfsoc_gpio_irq_shutdown(struct irq_data *d)
         struct sirfsoc_gpio_bank *bank = irq_data_get_irq_chip_data(d);
 
         sirfsoc_gpio_irq_mask(d);
-        gpio_unlock_as_irq(&bank->chip.gc, d->hwirq);
+        gpio_unlock_as_irq(&bank->chip.gc, d->hwirq % SIRFSOC_GPIO_BANK_SIZE);
 }
 
 static struct irq_chip sirfsoc_irq_chip = {
diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
index 8a843a04c224..a40b9c34e9ff 100644
--- a/drivers/pwm/pwm-lp3943.c
+++ b/drivers/pwm/pwm-lp3943.c
@@ -52,8 +52,10 @@ lp3943_pwm_request_map(struct lp3943_pwm *lp3943_pwm, int hwpwm)
                 offset = pwm_map->output[i];
 
                 /* Return an error if the pin is already assigned */
-                if (test_and_set_bit(offset, &lp3943->pin_used))
+                if (test_and_set_bit(offset, &lp3943->pin_used)) {
+                        kfree(pwm_map);
                         return ERR_PTR(-EBUSY);
+                }
         }
 
         return pwm_map;
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index b4b0d83f9ef6..7061ac0ad428 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -678,6 +678,7 @@ struct tsi721_bdma_chan {
         struct list_head        free_list;
         dma_cookie_t            completed_cookie;
         struct tasklet_struct   tasklet;
+        bool                    active;
 };
 
 #endif /* CONFIG_RAPIDIO_DMA_ENGINE */
diff --git a/drivers/rapidio/devices/tsi721_dma.c b/drivers/rapidio/devices/tsi721_dma.c
index 502663f5f7c6..91245f5dbe81 100644
--- a/drivers/rapidio/devices/tsi721_dma.c
+++ b/drivers/rapidio/devices/tsi721_dma.c
@@ -206,8 +206,8 @@ void tsi721_bdma_handler(struct tsi721_bdma_chan *bdma_chan)
 {
         /* Disable BDMA channel interrupts */
         iowrite32(0, bdma_chan->regs + TSI721_DMAC_INTE);
-
-        tasklet_schedule(&bdma_chan->tasklet);
+        if (bdma_chan->active)
+                tasklet_schedule(&bdma_chan->tasklet);
 }
 
 #ifdef CONFIG_PCI_MSI
@@ -562,7 +562,7 @@ static int tsi721_alloc_chan_resources(struct dma_chan *dchan)
         }
 #endif /* CONFIG_PCI_MSI */
 
-        tasklet_enable(&bdma_chan->tasklet);
+        bdma_chan->active = true;
         tsi721_bdma_interrupt_enable(bdma_chan, 1);
 
         return bdma_chan->bd_num - 1;
@@ -576,9 +576,7 @@ err_out:
 static void tsi721_free_chan_resources(struct dma_chan *dchan)
 {
         struct tsi721_bdma_chan *bdma_chan = to_tsi721_chan(dchan);
-#ifdef CONFIG_PCI_MSI
         struct tsi721_device *priv = to_tsi721(dchan->device);
-#endif
         LIST_HEAD(list);
 
         dev_dbg(dchan->device->dev, "%s: Entry\n", __func__);
@@ -589,14 +587,25 @@ static void tsi721_free_chan_resources(struct dma_chan *dchan)
         BUG_ON(!list_empty(&bdma_chan->active_list));
         BUG_ON(!list_empty(&bdma_chan->queue));
 
-        tasklet_disable(&bdma_chan->tasklet);
+        tsi721_bdma_interrupt_enable(bdma_chan, 0);
+        bdma_chan->active = false;
+
+#ifdef CONFIG_PCI_MSI
+        if (priv->flags & TSI721_USING_MSIX) {
+                synchronize_irq(priv->msix[TSI721_VECT_DMA0_DONE +
+                                           bdma_chan->id].vector);
+                synchronize_irq(priv->msix[TSI721_VECT_DMA0_INT +
+                                           bdma_chan->id].vector);
+        } else
+#endif
+        synchronize_irq(priv->pdev->irq);
+
+        tasklet_kill(&bdma_chan->tasklet);
 
         spin_lock_bh(&bdma_chan->lock);
         list_splice_init(&bdma_chan->free_list, &list);
         spin_unlock_bh(&bdma_chan->lock);
 
-        tsi721_bdma_interrupt_enable(bdma_chan, 0);
-
 #ifdef CONFIG_PCI_MSI
         if (priv->flags & TSI721_USING_MSIX) {
                 free_irq(priv->msix[TSI721_VECT_DMA0_DONE +
@@ -790,6 +799,7 @@ int tsi721_register_dma(struct tsi721_device *priv)
                 bdma_chan->dchan.cookie = 1;
                 bdma_chan->dchan.chan_id = i;
                 bdma_chan->id = i;
+                bdma_chan->active = false;
 
                 spin_lock_init(&bdma_chan->lock);
 
@@ -799,7 +809,6 @@ int tsi721_register_dma(struct tsi721_device *priv)
 
                 tasklet_init(&bdma_chan->tasklet, tsi721_dma_tasklet,
                              (unsigned long)bdma_chan);
-                tasklet_disable(&bdma_chan->tasklet);
                 list_add_tail(&bdma_chan->dchan.device_node,
                               &mport->dma.channels);
         }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index d1ac4caaf1b0..afca1bc24f26 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -953,6 +953,8 @@ static int machine_constraints_current(struct regulator_dev *rdev,
         return 0;
 }
 
+static int _regulator_do_enable(struct regulator_dev *rdev);
+
 /**
  * set_machine_constraints - sets regulator constraints
  * @rdev: regulator source
@@ -1013,10 +1015,9 @@ static int set_machine_constraints(struct regulator_dev *rdev,
         /* If the constraints say the regulator should be on at this point
          * and we have control then make sure it is enabled.
          */
-        if ((rdev->constraints->always_on || rdev->constraints->boot_on) &&
-            ops->enable) {
-                ret = ops->enable(rdev);
-                if (ret < 0) {
+        if (rdev->constraints->always_on || rdev->constraints->boot_on) {
+                ret = _regulator_do_enable(rdev);
+                if (ret < 0 && ret != -EINVAL) {
                         rdev_err(rdev, "failed to enable\n");
                         goto out;
                 }
@@ -1907,8 +1908,6 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
 
         trace_regulator_disable_complete(rdev_get_name(rdev));
 
-        _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
-                             NULL);
         return 0;
 }
 
@@ -1932,6 +1931,8 @@ static int _regulator_disable(struct regulator_dev *rdev)
                                 rdev_err(rdev, "failed to disable\n");
                                 return ret;
                         }
+                        _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
+                                        NULL);
                 }
 
                 rdev->use_count = 0;
@@ -1984,20 +1985,16 @@ static int _regulator_force_disable(struct regulator_dev *rdev)
 {
         int ret = 0;
 
-        /* force disable */
-        if (rdev->desc->ops->disable) {
-                /* ah well, who wants to live forever... */
-                ret = rdev->desc->ops->disable(rdev);
-                if (ret < 0) {
-                        rdev_err(rdev, "failed to force disable\n");
-                        return ret;
-                }
-                /* notify other consumers that power has been forced off */
-                _notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE |
-                        REGULATOR_EVENT_DISABLE, NULL);
+        ret = _regulator_do_disable(rdev);
+        if (ret < 0) {
+                rdev_err(rdev, "failed to force disable\n");
+                return ret;
         }
 
-        return ret;
+        _notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE |
+                        REGULATOR_EVENT_DISABLE, NULL);
+
+        return 0;
 }
 
 /**
@@ -3630,23 +3627,18 @@ int regulator_suspend_finish(void)
 
         mutex_lock(&regulator_list_mutex);
         list_for_each_entry(rdev, &regulator_list, list) {
-                struct regulator_ops *ops = rdev->desc->ops;
-
                 mutex_lock(&rdev->mutex);
-                if ((rdev->use_count > 0  || rdev->constraints->always_on) &&
-                                ops->enable) {
-                        error = ops->enable(rdev);
+                if (rdev->use_count > 0  || rdev->constraints->always_on) {
+                        error = _regulator_do_enable(rdev);
                         if (error)
                                 ret = error;
                 } else {
                         if (!have_full_constraints())
                                 goto unlock;
-                        if (!ops->disable)
-                                goto unlock;
                         if (!_regulator_is_enabled(rdev))
                                 goto unlock;
 
-                        error = ops->disable(rdev);
+                        error = _regulator_do_disable(rdev);
                         if (error)
                                 ret = error;
                 }
@@ -3820,7 +3812,7 @@ static int __init regulator_init_complete(void)
                 ops = rdev->desc->ops;
                 c = rdev->constraints;
 
-                if (!ops->disable || (c && c->always_on))
+                if (c && c->always_on)
                         continue;
 
                 mutex_lock(&rdev->mutex);
@@ -3841,7 +3833,7 @@ static int __init regulator_init_complete(void)
                         /* We log since this may kill the system if it
                          * goes wrong. */
                         rdev_info(rdev, "disabling\n");
-                        ret = ops->disable(rdev);
+                        ret = _regulator_do_disable(rdev);
                         if (ret != 0)
                                 rdev_err(rdev, "couldn't disable: %d\n", ret);
                 } else {
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 7afd373b9595..c4cde9c08f1f 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -580,10 +580,12 @@ static int s3c_rtc_suspend(struct device *dev)
 
         clk_enable(rtc_clk);
         /* save TICNT for anyone using periodic interrupts */
-        ticnt_save = readb(s3c_rtc_base + S3C2410_TICNT);
         if (s3c_rtc_cpu_type == TYPE_S3C64XX) {
                 ticnt_en_save = readw(s3c_rtc_base + S3C2410_RTCCON);
                 ticnt_en_save &= S3C64XX_RTCCON_TICEN;
+                ticnt_save = readl(s3c_rtc_base + S3C2410_TICNT);
+        } else {
+                ticnt_save = readb(s3c_rtc_base + S3C2410_TICNT);
         }
         s3c_rtc_enable(pdev, 0);
 
@@ -605,10 +607,15 @@ static int s3c_rtc_resume(struct device *dev)
 
         clk_enable(rtc_clk);
         s3c_rtc_enable(pdev, 1);
-        writeb(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
-        if (s3c_rtc_cpu_type == TYPE_S3C64XX && ticnt_en_save) {
-                tmp = readw(s3c_rtc_base + S3C2410_RTCCON);
-                writew(tmp | ticnt_en_save, s3c_rtc_base + S3C2410_RTCCON);
+        if (s3c_rtc_cpu_type == TYPE_S3C64XX) {
+                writel(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
+                if (ticnt_en_save) {
+                        tmp = readw(s3c_rtc_base + S3C2410_RTCCON);
+                        writew(tmp | ticnt_en_save,
+                                        s3c_rtc_base + S3C2410_RTCCON);
+                }
+        } else {
+                writeb(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
         }
 
         if (device_may_wakeup(dev) && wake_en) {
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index f6b9188c5af5..9f0ea6cb6922 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -610,6 +610,7 @@ void chsc_chp_online(struct chp_id chpid)
                 css_wait_for_slow_path();
                 for_each_subchannel_staged(__s390_process_res_acc, NULL,
                                            &link);
+                css_schedule_reprobe();
         }
 }
 
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index dc542e0a3055..0bc91e46395a 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -311,7 +311,7 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
         } __packed * msg = ap_msg->message;
 
         int rcblen = CEIL4(xcRB->request_control_blk_length);
-        int replylen;
+        int replylen, req_sumlen, resp_sumlen;
         char *req_data = ap_msg->message + sizeof(struct type6_hdr) + rcblen;
         char *function_code;
 
@@ -321,12 +321,34 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
                 xcRB->request_data_length;
         if (ap_msg->length > MSGTYPE06_MAX_MSG_SIZE)
                 return -EINVAL;
+
+        /* Overflow check
+           sum must be greater (or equal) than the largest operand */
+        req_sumlen = CEIL4(xcRB->request_control_blk_length) +
+                        xcRB->request_data_length;
+        if ((CEIL4(xcRB->request_control_blk_length) <=
+                                                xcRB->request_data_length) ?
+                (req_sumlen < xcRB->request_data_length) :
+                (req_sumlen < CEIL4(xcRB->request_control_blk_length))) {
+                return -EINVAL;
+        }
+
         replylen = sizeof(struct type86_fmt2_msg) +
                 CEIL4(xcRB->reply_control_blk_length) +
                 xcRB->reply_data_length;
         if (replylen > MSGTYPE06_MAX_MSG_SIZE)
                 return -EINVAL;
 
+        /* Overflow check
+           sum must be greater (or equal) than the largest operand */
+        resp_sumlen = CEIL4(xcRB->reply_control_blk_length) +
+                        xcRB->reply_data_length;
+        if ((CEIL4(xcRB->reply_control_blk_length) <= xcRB->reply_data_length) ?
+                (resp_sumlen < xcRB->reply_data_length) :
+                (resp_sumlen < CEIL4(xcRB->reply_control_blk_length))) {
+                return -EINVAL;
+        }
+
         /* prepare type6 header */
         msg->hdr = static_type6_hdrX;
         memcpy(msg->hdr.agent_id , &(xcRB->agent_ID), sizeof(xcRB->agent_ID));
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index c3a83df07894..795ed61a5496 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1660,7 +1660,6 @@ int qeth_qdio_clear_card(struct qeth_card *card, int use_halt)
                                 QDIO_FLAG_CLEANUP_USING_CLEAR);
                 if (rc)
                         QETH_CARD_TEXT_(card, 3, "1err%d", rc);
-                qdio_free(CARD_DDEV(card));
                 atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
                 break;
         case QETH_QDIO_CLEANING:
@@ -2605,6 +2604,7 @@ static int qeth_mpc_initialize(struct qeth_card *card)
         return 0;
 out_qdio:
         qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
+        qdio_free(CARD_DDEV(card));
         return rc;
 }
 
@@ -4906,9 +4906,11 @@ retry:
         if (retries < 3)
                 QETH_DBF_MESSAGE(2, "%s Retrying to do IDX activates.\n",
                         dev_name(&card->gdev->dev));
+        rc = qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         rc = ccw_device_set_online(CARD_RDEV(card));
         if (rc)
                 goto retriable;
@@ -4918,7 +4920,6 @@ retry:
         rc = ccw_device_set_online(CARD_DDEV(card));
         if (rc)
                 goto retriable;
-        rc = qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
 retriable:
         if (rc == -ERESTARTSYS) {
                 QETH_DBF_TEXT(SETUP, 2, "break1");
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 0710550093ce..908d82529ee9 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1091,6 +1091,7 @@ out_remove:
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_RECOVER)
                 card->state = CARD_STATE_RECOVER;
         else
@@ -1132,6 +1133,7 @@ static int __qeth_l2_set_offline(struct ccwgroup_device *cgdev,
                 rc = (rc2) ? rc2 : rc3;
         if (rc)
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_UP)
                 card->state = CARD_STATE_RECOVER;
         /* let user_space know that device is offline */
@@ -1194,6 +1196,7 @@ static void qeth_l2_shutdown(struct ccwgroup_device *gdev)
                 qeth_hw_trap(card, QETH_DIAGS_TRAP_DISARM);
         qeth_qdio_clear_card(card, 0);
         qeth_clear_qdio_buffers(card);
+        qdio_free(CARD_DDEV(card));
 }
 
 static int qeth_l2_pm_suspend(struct ccwgroup_device *gdev)
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 0f430424c3b8..3524d34ff694 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3447,6 +3447,7 @@ out_remove:
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_RECOVER)
                 card->state = CARD_STATE_RECOVER;
         else
@@ -3493,6 +3494,7 @@ static int __qeth_l3_set_offline(struct ccwgroup_device *cgdev,
                 rc = (rc2) ? rc2 : rc3;
         if (rc)
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_UP)
                 card->state = CARD_STATE_RECOVER;
         /* let user_space know that device is offline */
@@ -3545,6 +3547,7 @@ static void qeth_l3_shutdown(struct ccwgroup_device *gdev)
                 qeth_hw_trap(card, QETH_DIAGS_TRAP_DISARM);
         qeth_qdio_clear_card(card, 0);
         qeth_clear_qdio_buffers(card);
+        qdio_free(CARD_DDEV(card));
 }
 
 static int qeth_l3_pm_suspend(struct ccwgroup_device *gdev)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 2eb97d7e8d12..0cb73074c199 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -790,17 +790,32 @@ static inline int test_tgt_sess_count(struct qla_tgt *tgt)
 }
 
 /* Called by tcm_qla2xxx configfs code */
-void qlt_stop_phase1(struct qla_tgt *tgt)
+int qlt_stop_phase1(struct qla_tgt *tgt)
 {
         struct scsi_qla_host *vha = tgt->vha;
         struct qla_hw_data *ha = tgt->ha;
         unsigned long flags;
 
+        mutex_lock(&qla_tgt_mutex);
+        if (!vha->fc_vport) {
+                struct Scsi_Host *sh = vha->host;
+                struct fc_host_attrs *fc_host = shost_to_fc_host(sh);
+                bool npiv_vports;
+
+                spin_lock_irqsave(sh->host_lock, flags);
+                npiv_vports = (fc_host->npiv_vports_inuse);
+                spin_unlock_irqrestore(sh->host_lock, flags);
+
+                if (npiv_vports) {
+                        mutex_unlock(&qla_tgt_mutex);
+                        return -EPERM;
+                }
+        }
         if (tgt->tgt_stop || tgt->tgt_stopped) {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf04e,
                     "Already in tgt->tgt_stop or tgt_stopped state\n");
-                dump_stack();
-                return;
+                mutex_unlock(&qla_tgt_mutex);
+                return -EPERM;
         }
 
         ql_dbg(ql_dbg_tgt, vha, 0xe003, "Stopping target for host %ld(%p)\n",
@@ -815,6 +830,7 @@ void qlt_stop_phase1(struct qla_tgt *tgt)
         qlt_clear_tgt_db(tgt, true);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         mutex_unlock(&vha->vha_tgt.tgt_mutex);
+        mutex_unlock(&qla_tgt_mutex);
 
         flush_delayed_work(&tgt->sess_del_work);
 
@@ -841,6 +857,7 @@ void qlt_stop_phase1(struct qla_tgt *tgt)
 
         /* Wait for sessions to clear out (just in case) */
         wait_event(tgt->waitQ, test_tgt_sess_count(tgt));
+        return 0;
 }
 EXPORT_SYMBOL(qlt_stop_phase1);
 
@@ -3185,7 +3202,8 @@ restart:
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf02c,
                     "SRR cmd %p (se_cmd %p, tag %d, op %x), "
                     "sg_cnt=%d, offset=%d", cmd, &cmd->se_cmd, cmd->tag,
-                    se_cmd->t_task_cdb[0], cmd->sg_cnt, cmd->offset);
+                    se_cmd->t_task_cdb ? se_cmd->t_task_cdb[0] : 0,
+                    cmd->sg_cnt, cmd->offset);
 
                 qlt_handle_srr(vha, sctio, imm);
 
@@ -4181,6 +4199,9 @@ int qlt_add_target(struct qla_hw_data *ha, struct scsi_qla_host *base_vha)
         tgt->datasegs_per_cmd = QLA_TGT_DATASEGS_PER_CMD_24XX;
         tgt->datasegs_per_cont = QLA_TGT_DATASEGS_PER_CONT_24XX;
 
+        if (base_vha->fc_vport)
+                return 0;
+
         mutex_lock(&qla_tgt_mutex);
         list_add_tail(&tgt->tgt_list_entry, &qla_tgt_glist);
         mutex_unlock(&qla_tgt_mutex);
@@ -4194,6 +4215,10 @@ int qlt_remove_target(struct qla_hw_data *ha, struct scsi_qla_host *vha)
         if (!vha->vha_tgt.qla_tgt)
                 return 0;
 
+        if (vha->fc_vport) {
+                qlt_release(vha->vha_tgt.qla_tgt);
+                return 0;
+        }
         mutex_lock(&qla_tgt_mutex);
         list_del(&vha->vha_tgt.qla_tgt->tgt_list_entry);
         mutex_unlock(&qla_tgt_mutex);
@@ -4265,6 +4290,12 @@ int qlt_lport_register(void *target_lport_ptr, u64 phys_wwpn,
                         spin_unlock_irqrestore(&ha->hardware_lock, flags);
                         continue;
                 }
+                if (tgt->tgt_stop) {
+                        pr_debug("MODE_TARGET in shutdown on qla2xxx(%d)\n",
+                                 host->host_no);
+                        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                        continue;
+                }
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
                 if (!scsi_host_get(host)) {
@@ -4279,12 +4310,11 @@ int qlt_lport_register(void *target_lport_ptr, u64 phys_wwpn,
                         scsi_host_put(host);
                         continue;
                 }
-                mutex_unlock(&qla_tgt_mutex);
-
                 rc = (*callback)(vha, target_lport_ptr, npiv_wwpn, npiv_wwnn);
                 if (rc != 0)
                         scsi_host_put(host);
 
+                mutex_unlock(&qla_tgt_mutex);
                 return rc;
         }
         mutex_unlock(&qla_tgt_mutex);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 66e755cdde57..ce33d8c26406 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -1001,7 +1001,7 @@ extern void qlt_modify_vp_config(struct scsi_qla_host *,
 extern void qlt_probe_one_stage1(struct scsi_qla_host *, struct qla_hw_data *);
 extern int qlt_mem_alloc(struct qla_hw_data *);
 extern void qlt_mem_free(struct qla_hw_data *);
-extern void qlt_stop_phase1(struct qla_tgt *);
+extern int qlt_stop_phase1(struct qla_tgt *);
 extern void qlt_stop_phase2(struct qla_tgt *);
 extern irqreturn_t qla83xx_msix_atio_q(int, void *);
 extern void qlt_83xx_iospace_config(struct qla_hw_data *);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 75a141bbe74d..788c4fe2b0c9 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -182,20 +182,6 @@ static int tcm_qla2xxx_npiv_parse_wwn(
         return 0;
 }
 
-static ssize_t tcm_qla2xxx_npiv_format_wwn(char *buf, size_t len,
-                                        u64 wwpn, u64 wwnn)
-{
-        u8 b[8], b2[8];
-
-        put_unaligned_be64(wwpn, b);
-        put_unaligned_be64(wwnn, b2);
-        return snprintf(buf, len,
-                "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x,"
-                "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x",
-                b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7],
-                b2[0], b2[1], b2[2], b2[3], b2[4], b2[5], b2[6], b2[7]);
-}
-
 static char *tcm_qla2xxx_npiv_get_fabric_name(void)
 {
         return "qla2xxx_npiv";
@@ -227,15 +213,6 @@ static char *tcm_qla2xxx_get_fabric_wwn(struct se_portal_group *se_tpg)
         return lport->lport_naa_name;
 }
 
-static char *tcm_qla2xxx_npiv_get_fabric_wwn(struct se_portal_group *se_tpg)
-{
-        struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
-                                struct tcm_qla2xxx_tpg, se_tpg);
-        struct tcm_qla2xxx_lport *lport = tpg->lport;
-
-        return &lport->lport_npiv_name[0];
-}
-
 static u16 tcm_qla2xxx_get_tag(struct se_portal_group *se_tpg)
 {
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
@@ -941,15 +918,41 @@ static ssize_t tcm_qla2xxx_tpg_show_enable(
                         atomic_read(&tpg->lport_tpg_enabled));
 }
 
+static void tcm_qla2xxx_depend_tpg(struct work_struct *work)
+{
+        struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+                                struct tcm_qla2xxx_tpg, tpg_base_work);
+        struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+        struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+
+        if (!configfs_depend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                  &se_tpg->tpg_group.cg_item)) {
+                atomic_set(&base_tpg->lport_tpg_enabled, 1);
+                qlt_enable_vha(base_vha);
+        }
+        complete(&base_tpg->tpg_base_comp);
+}
+
+static void tcm_qla2xxx_undepend_tpg(struct work_struct *work)
+{
+        struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+                                struct tcm_qla2xxx_tpg, tpg_base_work);
+        struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+        struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+
+        if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) {
+                atomic_set(&base_tpg->lport_tpg_enabled, 0);
+                configfs_undepend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                       &se_tpg->tpg_group.cg_item);
+        }
+        complete(&base_tpg->tpg_base_comp);
+}
+
 static ssize_t tcm_qla2xxx_tpg_store_enable(
         struct se_portal_group *se_tpg,
         const char *page,
         size_t count)
 {
-        struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
-        struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
-                        struct tcm_qla2xxx_lport, lport_wwn);
-        struct scsi_qla_host *vha = lport->qla_vha;
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
                         struct tcm_qla2xxx_tpg, se_tpg);
         unsigned long op;
@@ -964,19 +967,28 @@ static ssize_t tcm_qla2xxx_tpg_store_enable(
                 pr_err("Illegal value for tpg_enable: %lu\n", op);
                 return -EINVAL;
         }
-
         if (op) {
-                atomic_set(&tpg->lport_tpg_enabled, 1);
-                qlt_enable_vha(vha);
+                if (atomic_read(&tpg->lport_tpg_enabled))
+                        return -EEXIST;
+
+                INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg);
         } else {
-                if (!vha->vha_tgt.qla_tgt) {
-                        pr_err("struct qla_hw_data *vha->vha_tgt.qla_tgt is NULL\n");
-                        return -ENODEV;
-                }
-                atomic_set(&tpg->lport_tpg_enabled, 0);
-                qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+                if (!atomic_read(&tpg->lport_tpg_enabled))
+                        return count;
+
+                INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg);
         }
+        init_completion(&tpg->tpg_base_comp);
+        schedule_work(&tpg->tpg_base_work);
+        wait_for_completion(&tpg->tpg_base_comp);
 
+        if (op) {
+                if (!atomic_read(&tpg->lport_tpg_enabled))
+                        return -ENODEV;
+        } else {
+                if (atomic_read(&tpg->lport_tpg_enabled))
+                        return -EPERM;
+        }
         return count;
 }
 
@@ -1053,11 +1065,64 @@ static void tcm_qla2xxx_drop_tpg(struct se_portal_group *se_tpg)
         /*
          * Clear local TPG=1 pointer for non NPIV mode.
          */
-                lport->tpg_1 = NULL;
-
+        lport->tpg_1 = NULL;
         kfree(tpg);
 }
 
+static ssize_t tcm_qla2xxx_npiv_tpg_show_enable(
+        struct se_portal_group *se_tpg,
+        char *page)
+{
+        return tcm_qla2xxx_tpg_show_enable(se_tpg, page);
+}
+
+static ssize_t tcm_qla2xxx_npiv_tpg_store_enable(
+        struct se_portal_group *se_tpg,
+        const char *page,
+        size_t count)
+{
+        struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
+        struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
+                        struct tcm_qla2xxx_lport, lport_wwn);
+        struct scsi_qla_host *vha = lport->qla_vha;
+        struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
+                        struct tcm_qla2xxx_tpg, se_tpg);
+        unsigned long op;
+        int rc;
+
+        rc = kstrtoul(page, 0, &op);
+        if (rc < 0) {
+                pr_err("kstrtoul() returned %d\n", rc);
+                return -EINVAL;
+        }
+        if ((op != 1) && (op != 0)) {
+                pr_err("Illegal value for tpg_enable: %lu\n", op);
+                return -EINVAL;
+        }
+        if (op) {
+                if (atomic_read(&tpg->lport_tpg_enabled))
+                        return -EEXIST;
+
+                atomic_set(&tpg->lport_tpg_enabled, 1);
+                qlt_enable_vha(vha);
+        } else {
+                if (!atomic_read(&tpg->lport_tpg_enabled))
+                        return count;
+
+                atomic_set(&tpg->lport_tpg_enabled, 0);
+                qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+        }
+
+        return count;
+}
+
+TF_TPG_BASE_ATTR(tcm_qla2xxx_npiv, enable, S_IRUGO | S_IWUSR);
+
+static struct configfs_attribute *tcm_qla2xxx_npiv_tpg_attrs[] = {
+        &tcm_qla2xxx_npiv_tpg_enable.attr,
+        NULL,
+};
+
 static struct se_portal_group *tcm_qla2xxx_npiv_make_tpg(
         struct se_wwn *wwn,
         struct config_group *group,
@@ -1650,6 +1715,9 @@ static int tcm_qla2xxx_lport_register_npiv_cb(struct scsi_qla_host *base_vha,
         struct scsi_qla_host *npiv_vha;
         struct tcm_qla2xxx_lport *lport =
                         (struct tcm_qla2xxx_lport *)target_lport_ptr;
+        struct tcm_qla2xxx_lport *base_lport =
+                        (struct tcm_qla2xxx_lport *)base_vha->vha_tgt.target_lport_ptr;
+        struct tcm_qla2xxx_tpg *base_tpg;
         struct fc_vport_identifiers vport_id;
 
         if (!qla_tgt_mode_enabled(base_vha)) {
@@ -1657,6 +1725,13 @@ static int tcm_qla2xxx_lport_register_npiv_cb(struct scsi_qla_host *base_vha,
                 return -EPERM;
         }
 
+        if (!base_lport || !base_lport->tpg_1 ||
+            !atomic_read(&base_lport->tpg_1->lport_tpg_enabled)) {
+                pr_err("qla2xxx base_lport or tpg_1 not available\n");
+                return -EPERM;
+        }
+        base_tpg = base_lport->tpg_1;
+
         memset(&vport_id, 0, sizeof(vport_id));
         vport_id.port_name = npiv_wwpn;
         vport_id.node_name = npiv_wwnn;
@@ -1675,7 +1750,6 @@ static int tcm_qla2xxx_lport_register_npiv_cb(struct scsi_qla_host *base_vha,
         npiv_vha = (struct scsi_qla_host *)vport->dd_data;
         npiv_vha->vha_tgt.target_lport_ptr = target_lport_ptr;
         lport->qla_vha = npiv_vha;
-
         scsi_host_get(npiv_vha->host);
         return 0;
 }
@@ -1714,8 +1788,6 @@ static struct se_wwn *tcm_qla2xxx_npiv_make_lport(
         }
         lport->lport_npiv_wwpn = npiv_wwpn;
         lport->lport_npiv_wwnn = npiv_wwnn;
-        tcm_qla2xxx_npiv_format_wwn(&lport->lport_npiv_name[0],
-                        TCM_QLA2XXX_NAMELEN, npiv_wwpn, npiv_wwnn);
         sprintf(lport->lport_naa_name, "naa.%016llx", (unsigned long long) npiv_wwpn);
 
         ret = tcm_qla2xxx_init_lport(lport);
@@ -1824,7 +1896,7 @@ static struct target_core_fabric_ops tcm_qla2xxx_ops = {
 static struct target_core_fabric_ops tcm_qla2xxx_npiv_ops = {
         .get_fabric_name                = tcm_qla2xxx_npiv_get_fabric_name,
         .get_fabric_proto_ident         = tcm_qla2xxx_get_fabric_proto_ident,
-        .tpg_get_wwn                    = tcm_qla2xxx_npiv_get_fabric_wwn,
+        .tpg_get_wwn                    = tcm_qla2xxx_get_fabric_wwn,
         .tpg_get_tag                    = tcm_qla2xxx_get_tag,
         .tpg_get_default_depth          = tcm_qla2xxx_get_default_depth,
         .tpg_get_pr_transport_id        = tcm_qla2xxx_get_pr_transport_id,
@@ -1935,7 +2007,7 @@ static int tcm_qla2xxx_register_configfs(void)
          */
         npiv_fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = tcm_qla2xxx_wwn_attrs;
         npiv_fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs =
-            tcm_qla2xxx_tpg_attrs;
+            tcm_qla2xxx_npiv_tpg_attrs;
         npiv_fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = NULL;
         npiv_fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
         npiv_fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
index 275d8b9a7a34..33aaac8c7d59 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
@@ -4,8 +4,6 @@
 #define TCM_QLA2XXX_VERSION     "v0.1"
 /* length of ASCII WWPNs including pad */
 #define TCM_QLA2XXX_NAMELEN     32
-/* lenth of ASCII NPIV 'WWPN+WWNN' including pad */
-#define TCM_QLA2XXX_NPIV_NAMELEN 66
 
 #include "qla_target.h"
 
@@ -43,6 +41,9 @@ struct tcm_qla2xxx_tpg {
         struct tcm_qla2xxx_tpg_attrib tpg_attrib;
         /* Returned by tcm_qla2xxx_make_tpg() */
         struct se_portal_group se_tpg;
+        /* Items for dealing with configfs_depend_item */
+        struct completion tpg_base_comp;
+        struct work_struct tpg_base_work;
 };
 
 struct tcm_qla2xxx_fc_loopid {
@@ -62,8 +63,6 @@ struct tcm_qla2xxx_lport {
         char lport_name[TCM_QLA2XXX_NAMELEN];
         /* ASCII formatted naa WWPN for VPD page 83 etc */
         char lport_naa_name[TCM_QLA2XXX_NAMELEN];
-        /* ASCII formatted WWPN+WWNN for NPIV FC Target Lport */
-        char lport_npiv_name[TCM_QLA2XXX_NPIV_NAMELEN];
         /* map for fc_port pointers in 24-bit FC Port ID space */
         struct btree_head32 lport_fcport_map;
         /* vmalloc-ed memory for fc_port pointers for 16-bit FC loop ID */
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index 7fc66a6a6e36..514844efac75 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -757,6 +757,7 @@ static void mxs_lradc_finish_touch_event(struct mxs_lradc *lradc, bool valid)
         }
 
         /* if it is released, wait for the next touch via IRQ */
+        lradc->cur_plate = LRADC_TOUCH;
         mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ, LRADC_CTRL1);
         mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index a70dcef1419e..2f40ff5901d6 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -55,6 +55,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         /****** 8188EUS ********/
         {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
+        {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
         {}      /* Terminating entry */
 };
 
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index a4489444ffbc..42f18fc1067b 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1074,7 +1074,7 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
         struct scatterlist *psg;
         void *paddr, *addr;
         unsigned int i, len, left;
-        unsigned int offset = 0;
+        unsigned int offset = sg_off;
 
         left = sectors * dev->prot_length;
 
@@ -1084,11 +1084,10 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
                 if (offset >= sg->length) {
                         sg = sg_next(sg);
                         offset = 0;
-                        sg_off = sg->offset;
                 }
 
                 paddr = kmap_atomic(sg_page(psg)) + psg->offset;
-                addr = kmap_atomic(sg_page(sg)) + sg_off;
+                addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
 
                 if (read)
                         memcpy(paddr, addr, len);
@@ -1163,7 +1162,7 @@ sbc_dif_verify_read(struct se_cmd *cmd, sector_t start, unsigned int sectors,
 {
         struct se_device *dev = cmd->se_dev;
         struct se_dif_v1_tuple *sdt;
-        struct scatterlist *dsg;
+        struct scatterlist *dsg, *psg = sg;
         sector_t sector = start;
         void *daddr, *paddr;
         int i, j, offset = sg_off;
@@ -1171,14 +1170,14 @@ sbc_dif_verify_read(struct se_cmd *cmd, sector_t start, unsigned int sectors,
 
         for_each_sg(cmd->t_data_sg, dsg, cmd->t_data_nents, i) {
                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
-                paddr = kmap_atomic(sg_page(sg)) + sg->offset;
+                paddr = kmap_atomic(sg_page(psg)) + sg->offset;
 
                 for (j = 0; j < dsg->length; j += dev->dev_attrib.block_size) {
 
-                        if (offset >= sg->length) {
+                        if (offset >= psg->length) {
                                 kunmap_atomic(paddr);
-                                sg = sg_next(sg);
-                                paddr = kmap_atomic(sg_page(sg)) + sg->offset;
+                                psg = sg_next(psg);
+                                paddr = kmap_atomic(sg_page(psg)) + psg->offset;
                                 offset = 0;
                         }
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 24b4f65d8777..2956250b7225 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1601,6 +1601,9 @@ void transport_generic_request_failure(struct se_cmd *cmd,
         case TCM_CHECK_CONDITION_ABORT_CMD:
         case TCM_CHECK_CONDITION_UNIT_ATTENTION:
         case TCM_CHECK_CONDITION_NOT_READY:
+        case TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED:
+        case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
+        case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
                 break;
         case TCM_OUT_OF_RESOURCES:
                 sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 471142725ffe..81cda09b47e3 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -685,8 +685,15 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
         struct ehci_hcd         *ehci = hcd_to_ehci (hcd);
         u32                     status, masked_status, pcd_status = 0, cmd;
         int                     bh;
+        unsigned long           flags;
 
-        spin_lock (&ehci->lock);
+        /*
+         * For threadirqs option we use spin_lock_irqsave() variant to prevent
+         * deadlock with ehci hrtimer callback, because hrtimer callbacks run
+         * in interrupt context even when threadirqs is specified. We can go
+         * back to spin_lock() variant when hrtimer callbacks become threaded.
+         */
+        spin_lock_irqsave(&ehci->lock, flags);
 
         status = ehci_readl(ehci, &ehci->regs->status);
 
@@ -704,7 +711,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
 
         /* Shared IRQ? */
         if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
-                spin_unlock(&ehci->lock);
+                spin_unlock_irqrestore(&ehci->lock, flags);
                 return IRQ_NONE;
         }
 
@@ -815,7 +822,7 @@ dead:
 
         if (bh)
                 ehci_work (ehci);
-        spin_unlock (&ehci->lock);
+        spin_unlock_irqrestore(&ehci->lock, flags);
         if (pcd_status)
                 usb_hcd_poll_rh_status(hcd);
         return IRQ_HANDLED;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ee1f00f03c43..44ab12986805 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -907,6 +907,8 @@ static const struct usb_device_id id_table_combined[] = {
         /* Crucible Devices */
         { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
+        /* Cressi Devices */
+        { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 1e2d369df86e..e599fbfcde5f 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1320,3 +1320,9 @@
  * Manufacturer: Smart GSM Team
  */
 #define FTDI_Z3X_PID            0x0011
+
+/*
+ * Product: Cressi PC Interface
+ * Manufacturer: Cressi
+ */
+#define FTDI_CRESSI_PID         0x87d0
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 4fb7a8f83c8a..54af4e933695 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -186,12 +186,12 @@ static bool is_invalid_reserved_pfn(unsigned long pfn)
         if (pfn_valid(pfn)) {
                 bool reserved;
                 struct page *tail = pfn_to_page(pfn);
-                struct page *head = compound_trans_head(tail);
+                struct page *head = compound_head(tail);
                 reserved = !!(PageReserved(head));
                 if (head != tail) {
                         /*
                          * "head" is not a dangling pointer
-                         * (compound_trans_head takes care of that)
+                         * (compound_head takes care of that)
                          * but the hugepage may have been split
                          * from under us (and we may not hold a
                          * reference count on the head page so it can
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 0a025b8e2a12..e48d4a672580 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1001,6 +1001,12 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                         break;
                 }
 
+                /* virtio-scsi spec requires byte 0 of the lun to be 1 */
+                if (unlikely(v_req.lun[0] != 1)) {
+                        vhost_scsi_send_bad_target(vs, vq, head, out);
+                        continue;
+                }
+
                 /* Extract the tpgt */
                 target = v_req.lun[1];
                 tpg = ACCESS_ONCE(vs_tpg[target]);