622 files changed, 12507 insertions, 7123 deletions
diff --git a/Documentation/ABI/testing/configfs-usb-gadget-mass-storage b/Documentation/ABI/testing/configfs-usb-gadget-mass-storage
new file mode 100644
index 000000000000..ad72a37ee9ff
--- /dev/null
+++ b/Documentation/ABI/testing/configfs-usb-gadget-mass-storage
@@ -0,0 +1,31 @@
+What:           /config/usb-gadget/gadget/functions/mass_storage.name
+Date:           Oct 2013
+KenelVersion:   3.13
+Description:
+                The attributes:
+                stall           - Set to permit function to halt bulk endpoints.
+                                Disabled on some USB devices known not to work
+                                correctly. You should set it to true.
+                num_buffers     - Number of pipeline buffers. Valid numbers
+                                are 2..4. Available only if
+                                CONFIG_USB_GADGET_DEBUG_FILES is set.
+What:           /config/usb-gadget/gadget/functions/mass_storage.name/lun.name
+Date:           Oct 2013
+KenelVersion:   3.13
+Description:
+                The attributes:
+                file            - The path to the backing file for the LUN.
+                                Required if LUN is not marked as removable.
+                ro              - Flag specifying access to the LUN shall be
+                                read-only. This is implied if CD-ROM emulation
+                                is enabled as well as when it was impossible
+                                to open "filename" in R/W mode.
+                removable       - Flag specifying that LUN shall be indicated as
+                                being removable.
+                cdrom           - Flag specifying that LUN shall be reported as
+                                being a CD-ROM.
+                nofua           - Flag specifying that FUA flag
+                                in SCSI WRITE(10,12)
diff --git a/Documentation/connector/ucon.c b/Documentation/connector/ucon.c
index 4848db8c71ff..8a4da64e02a8 100644
--- a/Documentation/connector/ucon.c
+++ b/Documentation/connector/ucon.c
@@ -71,7 +71,7 @@ static int netlink_send(int s, struct cn_msg *msg)
        nlh->nlmsg_seq = seq++;
        nlh->nlmsg_pid = getpid();
        nlh->nlmsg_type = NLMSG_DONE;
-        nlh->nlmsg_len = NLMSG_LENGTH(size - sizeof(*nlh));
+        nlh->nlmsg_len = size;
        nlh->nlmsg_flags = 0;
        m = NLMSG_DATA(nlh);
diff --git a/Documentation/devicetree/bindings/phy/phy-bindings.txt b/Documentation/devicetree/bindings/phy/phy-bindings.txt
new file mode 100644
index 000000000000..8ae844fc0c60
--- /dev/null
+++ b/Documentation/devicetree/bindings/phy/phy-bindings.txt
@@ -0,0 +1,66 @@
+This document explains only the device tree data binding. For general
+information about PHY subsystem refer to Documentation/phy.txt
+PHY device node
+===============
+Required Properties:
+#phy-cells:     Number of cells in a PHY specifier;  The meaning of all those
+                cells is defined by the binding for the phy node. The PHY
+                provider can use the values in cells to find the appropriate
+                PHY.
+For example:
+phys: phy {
+    compatible = "xxx";
+    reg = <...>;
+    .
+    .
+    #phy-cells = <1>;
+    .
+    .
+};
+That node describes an IP block (PHY provider) that implements 2 different PHYs.
+In order to differentiate between these 2 PHYs, an additonal specifier should be
+given while trying to get a reference to it.
+PHY user node
+=============
+Required Properties:
+phys : the phandle for the PHY device (used by the PHY subsystem)
+phy-names : the names of the PHY corresponding to the PHYs present in the
+            *phys* phandle
+Example 1:
+usb1: usb_otg_ss@xxx {
+    compatible = "xxx";
+    reg = <xxx>;
+    .
+    .
+    phys = <&usb2_phy>, <&usb3_phy>;
+    phy-names = "usb2phy", "usb3phy";
+    .
+    .
+};
+This node represents a controller that uses two PHYs, one for usb2 and one for
+usb3.
+Example 2:
+usb2: usb_otg_ss@xxx {
+    compatible = "xxx";
+    reg = <xxx>;
+    .
+    .
+    phys = <&phys 1>;
+    phy-names = "usbphy";
+    .
+    .
+};
+This node represents a controller that uses one of the PHYs of the PHY provider
+device defined previously. Note that the phy handle has an additional specifier
+"1" to differentiate between the two PHYs.
diff --git a/Documentation/devicetree/bindings/phy/samsung-phy.txt b/Documentation/devicetree/bindings/phy/samsung-phy.txt
new file mode 100644
index 000000000000..c0fccaa1671e
--- /dev/null
+++ b/Documentation/devicetree/bindings/phy/samsung-phy.txt
@@ -0,0 +1,22 @@
+Samsung S5P/EXYNOS SoC series MIPI CSIS/DSIM DPHY
+-------------------------------------------------
+Required properties:
+- compatible : should be "samsung,s5pv210-mipi-video-phy";
+- reg : offset and length of the MIPI DPHY register set;
+- #phy-cells : from the generic phy bindings, must be 1;
+For "samsung,s5pv210-mipi-video-phy" compatible PHYs the second cell in
+the PHY specifier identifies the PHY and its meaning is as follows:
+  0 - MIPI CSIS 0,
+  1 - MIPI DSIM 0,
+  2 - MIPI CSIS 1,
+  3 - MIPI DSIM 1.
+Samsung EXYNOS SoC series Display Port PHY
+-------------------------------------------------
+Required properties:
+- compatible : should be "samsung,exynos5250-dp-video-phy";
+- reg : offset and length of the Display Port PHY register set;
+- #phy-cells : from the generic PHY bindings, must be 0;
diff --git a/Documentation/devicetree/bindings/usb/msm-hsusb.txt b/Documentation/devicetree/bindings/usb/msm-hsusb.txt
new file mode 100644
index 000000000000..5ea26c631e3a
--- /dev/null
+++ b/Documentation/devicetree/bindings/usb/msm-hsusb.txt
@@ -0,0 +1,17 @@
+MSM SoC HSUSB controllers
+EHCI
+Required properties:
+- compatible:   Should contain "qcom,ehci-host"
+- regs:                 offset and length of the register set in the memory map
+- usb-phy:              phandle for the PHY device
+Example EHCI controller device node:
+        ehci: ehci@f9a55000 {
+                compatible = "qcom,ehci-host";
+                reg = <0xf9a55000 0x400>;
+                usb-phy = <&usb_otg>;
+        };
diff --git a/Documentation/devicetree/bindings/usb/omap-usb.txt b/Documentation/devicetree/bindings/usb/omap-usb.txt
index 9088ab09e200..090e5e22bd2b 100644
--- a/Documentation/devicetree/bindings/usb/omap-usb.txt
+++ b/Documentation/devicetree/bindings/usb/omap-usb.txt
@@ -3,9 +3,6 @@ OMAP GLUE AND OTHER OMAP SPECIFIC COMPONENTS
 OMAP MUSB GLUE
 - compatible : Should be "ti,omap4-musb" or "ti,omap3-musb"
 - ti,hwmods : must be "usb_otg_hs"
- - ti,has-mailbox : to specify that omap uses an external mailbox
-   (in control module) to communicate with the musb core during device connect
-   and disconnect.
 - multipoint : Should be "1" indicating the musb controller supports
   multipoint. This is a MUSB configuration-specific setting.
 - num-eps : Specifies the number of endpoints. This is also a
@@ -19,6 +16,9 @@ OMAP MUSB GLUE
 - power : Should be "50". This signifies the controller can supply up to
   100mA when operating in host mode.
 - usb-phy : the phandle for the PHY device
+ - phys : the phandle for the PHY device (used by generic PHY framework)
+ - phy-names : the names of the PHY corresponding to the PHYs present in the
+   *phy* phandle.
 Optional properties:
 - ctrl-module : phandle of the control module this glue uses to write to
@@ -28,11 +28,12 @@ SOC specific device node entry
 usb_otg_hs: usb_otg_hs@4a0ab000 {
        compatible = "ti,omap4-musb";
        ti,hwmods = "usb_otg_hs";
-        ti,has-mailbox;
        multipoint = <1>;
        num-eps = <16>;
        ram-bits = <12>;
        ctrl-module = <&omap_control_usb>;
+        phys = <&usb2_phy>;
+        phy-names = "usb2-phy";
 };
 Board specific device node entry
@@ -78,22 +79,22 @@ omap_dwc3 {
 OMAP CONTROL USB
 Required properties:
- - compatible: Should be "ti,omap-control-usb"
+ - compatible: Should be one of
+ "ti,control-phy-otghs" - if it has otghs_control mailbox register as on OMAP4.
+ "ti,control-phy-usb2" - if it has Power down bit in control_dev_conf register
+                        e.g. USB2_PHY on OMAP5.
+ "ti,control-phy-pipe3" - if it has DPLL and individual Rx & Tx power control
+                        e.g. USB3 PHY and SATA PHY on OMAP5.
+ "ti,control-phy-dra7usb2" - if it has power down register like USB2 PHY on
+                        DRA7 platform.
 - reg : Address and length of the register set for the device. It contains
-   the address of "control_dev_conf" and "otghs_control" or "phy_power_usb"
+   the address of "otghs_control" for control-phy-otghs or "power" register
-   depending upon omap4 or omap5.
+   for other types.
- - reg-names: The names of the register addresses corresponding to the registers
+ - reg-names: should be "otghs_control" control-phy-otghs and "power" for
-   filled in "reg".
+   other types.
- - ti,type: This is used to differentiate whether the control module has
-   usb mailbox or usb3 phy power. omap4 has usb mailbox in control module to
-   notify events to the musb core and omap5 has usb3 phy power register to
-   power on usb3 phy. Should be "1" if it has mailbox and "2" if it has usb3
-   phy power.
 omap_control_usb: omap-control-usb@4a002300 {
-        compatible = "ti,omap-control-usb";
+        compatible = "ti,control-phy-otghs";
-        reg = <0x4a002300 0x4>,
+        reg = <0x4a00233c 0x4>;
-              <0x4a00233c 0x4>;
+        reg-names = "otghs_control";
-        reg-names = "control_dev_conf", "otghs_control";
-        ti,type = <1>;
 };
diff --git a/Documentation/devicetree/bindings/usb/usb-nop-xceiv.txt b/Documentation/devicetree/bindings/usb/usb-nop-xceiv.txt
index d7e272671c7e..1bd37faba05b 100644
--- a/Documentation/devicetree/bindings/usb/usb-nop-xceiv.txt
+++ b/Documentation/devicetree/bindings/usb/usb-nop-xceiv.txt
@@ -15,7 +15,7 @@ Optional properties:
 - vcc-supply: phandle to the regulator that provides RESET to the PHY.
- reset-supply: phandle to the regulator that provides power to the PHY.
+- reset-gpios: Should specify the GPIO for reset.
 Example:
@@ -25,10 +25,9 @@ Example:
                clocks = <&osc 0>;
                clock-names = "main_clk";
                vcc-supply = <&hsusb1_vcc_regulator>;
-                reset-supply = <&hsusb1_reset_regulator>;
+                reset-gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
        };
 hsusb1_phy is a NOP USB PHY device that gets its clock from an oscillator
 and expects that clock to be configured to 19.2MHz by the NOP PHY driver.
-hsusb1_vcc_regulator provides power to the PHY and hsusb1_reset_regulator
+hsusb1_vcc_regulator provides power to the PHY and GPIO 7 controls RESET.
-controls RESET.
diff --git a/Documentation/devicetree/bindings/usb/usb-phy.txt b/Documentation/devicetree/bindings/usb/usb-phy.txt
index 61496f5cb095..c0245c888982 100644
--- a/Documentation/devicetree/bindings/usb/usb-phy.txt
+++ b/Documentation/devicetree/bindings/usb/usb-phy.txt
@@ -5,6 +5,8 @@ OMAP USB2 PHY
 Required properties:
 - compatible: Should be "ti,omap-usb2"
 - reg : Address and length of the register set for the device.
+ - #phy-cells: determine the number of cells that should be given in the
+   phandle while referencing this phy.
 Optional properties:
 - ctrl-module : phandle of the control module used by PHY driver to power on
@@ -16,6 +18,7 @@ usb2phy@4a0ad080 {
        compatible = "ti,omap-usb2";
        reg = <0x4a0ad080 0x58>;
        ctrl-module = <&omap_control_usb>;
+        #phy-cells = <0>;
 };
 OMAP USB3 PHY
@@ -25,6 +28,8 @@ Required properties:
 - reg : Address and length of the register set for the device.
 - reg-names: The names of the register addresses corresponding to the registers
   filled in "reg".
+ - #phy-cells: determine the number of cells that should be given in the
+   phandle while referencing this phy.
 Optional properties:
 - ctrl-module : phandle of the control module used by PHY driver to power on
@@ -39,4 +44,5 @@ usb3phy@4a084400 {
              <0x4a084c00 0x40>;
        reg-names = "phy_rx", "phy_tx", "pll_ctrl";
        ctrl-module = <&omap_control_usb>;
+        #phy-cells = <0>;
 };
diff --git a/Documentation/devicetree/bindings/video/exynos_dp.txt b/Documentation/devicetree/bindings/video/exynos_dp.txt
index 84f10c16cb38..3289d76a21d0 100644
--- a/Documentation/devicetree/bindings/video/exynos_dp.txt
+++ b/Documentation/devicetree/bindings/video/exynos_dp.txt
@@ -6,10 +6,10 @@ We use two nodes:
        -dptx-phy node(defined inside dp-controller node)
 For the DP-PHY initialization, we use the dptx-phy node.
-Required properties for dptx-phy:
+Required properties for dptx-phy: deprecated, use phys and phy-names
-        -reg:
+        -reg: deprecated
                Base address of DP PHY register.
-        -samsung,enable-mask:
+        -samsung,enable-mask: deprecated
                The bit-mask used to enable/disable DP PHY.
 For the Panel initialization, we read data from dp-controller node.
@@ -27,6 +27,10 @@ Required properties for dp-controller:
                from common clock binding: Shall be "dp".
        -interrupt-parent:
                phandle to Interrupt combiner node.
+        -phys:
+                from general PHY binding: the phandle for the PHY device.
+        -phy-names:
+                from general PHY binding: Should be "dp".
        -samsung,color-space:
                input video data format.
                        COLOR_RGB = 0, COLOR_YCBCR422 = 1, COLOR_YCBCR444 = 2
@@ -68,11 +72,8 @@ SOC specific portion:
                clocks = <&clock 342>;
                clock-names = "dp";
-                dptx-phy {
+                phys = <&dp_phy>;
-                        reg = <0x10040720>;
+                phy-names = "dp";
-                        samsung,enable-mask = <1>;
-                };
        };
 Board Specific portion:
diff --git a/Documentation/networking/dccp.txt b/Documentation/networking/dccp.txt
index d718bc2ff1cf..bf5dbe3ab8c5 100644
--- a/Documentation/networking/dccp.txt
+++ b/Documentation/networking/dccp.txt
@@ -18,8 +18,8 @@ Introduction
 Datagram Congestion Control Protocol (DCCP) is an unreliable, connection
 oriented protocol designed to solve issues present in UDP and TCP, particularly
 for real-time and multimedia (streaming) traffic.
-It divides into a base protocol (RFC 4340) and plugable congestion control
+It divides into a base protocol (RFC 4340) and pluggable congestion control
-modules called CCIDs. Like plugable TCP congestion control, at least one CCID
+modules called CCIDs. Like pluggable TCP congestion control, at least one CCID
 needs to be enabled in order for the protocol to function properly. In the Linux
 implementation, this is the TCP-like CCID2 (RFC 4341). Additional CCIDs, such as
 the TCP-friendly CCID3 (RFC 4342), are optional.
diff --git a/Documentation/networking/e100.txt b/Documentation/networking/e100.txt
index 13a32124bca0..f862cf3aff34 100644
--- a/Documentation/networking/e100.txt
+++ b/Documentation/networking/e100.txt
@@ -103,7 +103,7 @@ Additional Configurations
  PRO/100 Family of Adapters is e100.
  As an example, if you install the e100 driver for two PRO/100 adapters
-  (eth0 and eth1), add the following to a configuraton file in /etc/modprobe.d/
+  (eth0 and eth1), add the following to a configuration file in /etc/modprobe.d/
       alias eth0 e100
       alias eth1 e100
diff --git a/Documentation/networking/ieee802154.txt b/Documentation/networking/ieee802154.txt
index 09eb57329f11..22bbc7225f8e 100644
--- a/Documentation/networking/ieee802154.txt
+++ b/Documentation/networking/ieee802154.txt
@@ -4,7 +4,7 @@
 Introduction
 ============
-The IEEE 802.15.4 working group focuses on standartization of bottom
+The IEEE 802.15.4 working group focuses on standardization of bottom
 two layers: Medium Access Control (MAC) and Physical (PHY). And there
 are mainly two options available for upper layers:
 - ZigBee - proprietary protocol from ZigBee Alliance
@@ -66,7 +66,7 @@ net_device, with .type = ARPHRD_IEEE802154. Data is exchanged with socket family
 code via plain sk_buffs. On skb reception skb->cb must contain additional
 info as described in the struct ieee802154_mac_cb. During packet transmission
 the skb->cb is used to provide additional data to device's header_ops->create
-function. Be aware, that this data can be overriden later (when socket code
+function. Be aware that this data can be overridden later (when socket code
 submits skb to qdisc), so if you need something from that cb later, you should
 store info in the skb->data on your own.
diff --git a/Documentation/networking/l2tp.txt b/Documentation/networking/l2tp.txt
index e63fc1f7bf87..c74434de2fa5 100644
--- a/Documentation/networking/l2tp.txt
+++ b/Documentation/networking/l2tp.txt
@@ -197,7 +197,7 @@ state information because the file format is subject to change. It is
 implemented to provide extra debug information to help diagnose
 problems.) Users should use the netlink API.
-/proc/net/pppol2tp is also provided for backwards compaibility with
+/proc/net/pppol2tp is also provided for backwards compatibility with
 the original pppol2tp driver. It lists information about L2TPv2
 tunnels and sessions only. Its use is discouraged.
diff --git a/Documentation/networking/netdev-FAQ.txt b/Documentation/networking/netdev-FAQ.txt
index d9112f01c44a..0fe1c6e0dbcd 100644
--- a/Documentation/networking/netdev-FAQ.txt
+++ b/Documentation/networking/netdev-FAQ.txt
@@ -4,23 +4,23 @@ Information you need to know about netdev
 Q: What is netdev?
-A: It is a mailing list for all network related linux stuff.  This includes
+A: It is a mailing list for all network-related Linux stuff.  This includes
   anything found under net/  (i.e. core code like IPv6) and drivers/net
-   (i.e. hardware specific drivers) in the linux source tree.
+   (i.e. hardware specific drivers) in the Linux source tree.
   Note that some subsystems (e.g. wireless drivers) which have a high volume
   of traffic have their own specific mailing lists.
-   The netdev list is managed (like many other linux mailing lists) through
+   The netdev list is managed (like many other Linux mailing lists) through
   VGER ( http://vger.kernel.org/ ) and archives can be found below:
        http://marc.info/?l=linux-netdev
        http://www.spinics.net/lists/netdev/
-   Aside from subsystems like that mentioned above, all network related linux
+   Aside from subsystems like that mentioned above, all network-related Linux
-   development (i.e. RFC, review, comments, etc) takes place on netdev.
+   development (i.e. RFC, review, comments, etc.) takes place on netdev.
-Q: How do the changes posted to netdev make their way into linux?
+Q: How do the changes posted to netdev make their way into Linux?
 A: There are always two trees (git repositories) in play.  Both are driven
   by David Miller, the main network maintainer.  There is the "net" tree,
@@ -35,7 +35,7 @@ A: There are always two trees (git repositories) in play.  Both are driven
 Q: How often do changes from these trees make it to the mainline Linus tree?
 A: To understand this, you need to know a bit of background information
-   on the cadence of linux development.  Each new release starts off with
+   on the cadence of Linux development.  Each new release starts off with
   a two week "merge window" where the main maintainers feed their new
   stuff to Linus for merging into the mainline tree.  After the two weeks,
   the merge window is closed, and it is called/tagged "-rc1".  No new
@@ -46,7 +46,7 @@ A: To understand this, you need to know a bit of background information
   things are in a state of churn), and a week after the last vX.Y-rcN
   was done, the official "vX.Y" is released.
-   Relating that to netdev:  At the beginning of the 2 week merge window,
+   Relating that to netdev:  At the beginning of the 2-week merge window,
   the net-next tree will be closed - no new changes/features.  The
   accumulated new content of the past ~10 weeks will be passed onto
   mainline/Linus via a pull request for vX.Y -- at the same time,
@@ -59,16 +59,16 @@ A: To understand this, you need to know a bit of background information
   IMPORTANT:  Do not send new net-next content to netdev during the
   period during which net-next tree is closed.
-   Shortly after the two weeks have passed, (and vX.Y-rc1 is released) the
+   Shortly after the two weeks have passed (and vX.Y-rc1 is released), the
   tree for net-next reopens to collect content for the next (vX.Y+1) release.
   If you aren't subscribed to netdev and/or are simply unsure if net-next
   has re-opened yet, simply check the net-next git repository link above for
-   any new networking related commits.
+   any new networking-related commits.
   The "net" tree continues to collect fixes for the vX.Y content, and
   is fed back to Linus at regular (~weekly) intervals.  Meaning that the
-   focus for "net" is on stablilization and bugfixes.
+   focus for "net" is on stabilization and bugfixes.
   Finally, the vX.Y gets released, and the whole cycle starts over.
@@ -217,7 +217,7 @@ A: Attention to detail.  Re-read your own work as if you were the
   to why it happens, and then if necessary, explain why the fix proposed
   is the best way to get things done.   Don't mangle whitespace, and as
   is common, don't mis-indent function arguments that span multiple lines.
-   If it is your 1st patch, mail it to yourself so you can test apply
+   If it is your first patch, mail it to yourself so you can test apply
   it to an unpatched tree to confirm infrastructure didn't mangle it.
   Finally, go back and read Documentation/SubmittingPatches to be
diff --git a/Documentation/networking/netlink_mmap.txt b/Documentation/networking/netlink_mmap.txt
index 533378839546..b26122973525 100644
--- a/Documentation/networking/netlink_mmap.txt
+++ b/Documentation/networking/netlink_mmap.txt
@@ -45,7 +45,7 @@ processing.
 Conversion of the reception path involves calling poll() on the file
 descriptor, once the socket is readable the frames from the ring are
-processsed in order until no more messages are available, as indicated by
+processed in order until no more messages are available, as indicated by
 a status word in the frame header.
 On kernel side, in order to make use of memory mapped I/O on receive, the
@@ -56,7 +56,7 @@ Dumps of kernel databases automatically support memory mapped I/O.
 Conversion of the transmit path involves changing message construction to
 use memory from the TX ring instead of (usually) a buffer declared on the
-stack and setting up the frame header approriately. Optionally poll() can
+stack and setting up the frame header appropriately. Optionally poll() can
 be used to wait for free frames in the TX ring.
 Structured and definitions for using memory mapped I/O are contained in
@@ -231,7 +231,7 @@ Ring setup:
        if (setsockopt(fd, NETLINK_TX_RING, &req, sizeof(req)) < 0)
                exit(1)
-        /* Calculate size of each invididual ring */
+        /* Calculate size of each individual ring */
        ring_size = req.nm_block_nr * req.nm_block_size;
        /* Map RX/TX rings. The TX ring is located after the RX ring */
diff --git a/Documentation/networking/operstates.txt b/Documentation/networking/operstates.txt
index 97694572338b..355c6d8ef8ad 100644
--- a/Documentation/networking/operstates.txt
+++ b/Documentation/networking/operstates.txt
@@ -89,8 +89,8 @@ packets. The name 'carrier' and the inversion are historical, think of
 it as lower layer.
 Note that for certain kind of soft-devices, which are not managing any
-real hardware, there is possible to set this bit from userpsace.
+real hardware, it is possible to set this bit from userspace.  One
-One should use TVL IFLA_CARRIER to do so.
+should use TVL IFLA_CARRIER to do so.
 netif_carrier_ok() can be used to query that bit.
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index 60d05eb77c64..b89bc82eed46 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -144,7 +144,7 @@ An overview of the RxRPC protocol:
 (*) Calls use ACK packets to handle reliability.  Data packets are also
     explicitly sequenced per call.
- (*) There are two types of positive acknowledgement: hard-ACKs and soft-ACKs.
+ (*) There are two types of positive acknowledgment: hard-ACKs and soft-ACKs.
     A hard-ACK indicates to the far side that all the data received to a point
     has been received and processed; a soft-ACK indicates that the data has
     been received but may yet be discarded and re-requested.  The sender may
diff --git a/Documentation/networking/stmmac.txt b/Documentation/networking/stmmac.txt
index 457b8bbafb08..cdd916da838d 100644
--- a/Documentation/networking/stmmac.txt
+++ b/Documentation/networking/stmmac.txt
@@ -160,7 +160,7 @@ Where:
 o pmt: core has the embedded power module (optional).
 o force_sf_dma_mode: force DMA to use the Store and Forward mode
                     instead of the Threshold.
- o force_thresh_dma_mode: force DMA to use the Shreshold mode other than
+ o force_thresh_dma_mode: force DMA to use the Threshold mode other than
                     the Store and Forward mode.
 o riwt_off: force to disable the RX watchdog feature and switch to NAPI mode.
 o fix_mac_speed: this callback is used for modifying some syscfg registers
@@ -175,7 +175,7 @@ Where:
             registers.
 o custom_cfg/custom_data: this is a custom configuration that can be passed
                           while initializing the resources.
- o bsp_priv: another private poiter.
+ o bsp_priv: another private pointer.
 For MDIO bus The we have:
@@ -271,7 +271,7 @@ reset procedure etc).
 o dwmac1000_dma.c:  dma functions for the GMAC chip;
 o dwmac1000.h: specific header file for the GMAC;
 o dwmac100_core: MAC 100 core and dma code;
- o dwmac100_dma.c: dma funtions for the MAC chip;
+ o dwmac100_dma.c: dma functions for the MAC chip;
 o dwmac1000.h: specific header file for the MAC;
 o dwmac_lib.c: generic DMA functions shared among chips;
 o enh_desc.c: functions for handling enhanced descriptors;
@@ -364,4 +364,4 @@ Auto-negotiated Link Parter Ability.
 10) TODO:
 o XGMAC is not supported.
 o Complete the TBI & RTBI support.
- o extened VLAN support for 3.70a SYNP GMAC.
+ o extend VLAN support for 3.70a SYNP GMAC.
diff --git a/Documentation/networking/vortex.txt b/Documentation/networking/vortex.txt
index 9a8041dcbb53..97282da82b75 100644
--- a/Documentation/networking/vortex.txt
+++ b/Documentation/networking/vortex.txt
@@ -68,7 +68,7 @@ Module parameters
 There are several parameters which may be provided to the driver when
 its module is loaded.  These are usually placed in /etc/modprobe.d/*.conf
-configuretion files.  Example:
+configuration files.  Example:
 options 3c59x debug=3 rx_copybreak=300
@@ -178,7 +178,7 @@ max_interrupt_work=N
  The driver's interrupt service routine can handle many receive and
  transmit packets in a single invocation.  It does this in a loop. 
-  The value of max_interrupt_work governs how mnay times the interrupt
+  The value of max_interrupt_work governs how many times the interrupt
  service routine will loop.  The default value is 32 loops.  If this
  is exceeded the interrupt service routine gives up and generates a
  warning message "eth0: Too much work in interrupt".
diff --git a/Documentation/networking/x25-iface.txt b/Documentation/networking/x25-iface.txt
index 78f662ee0622..7f213b556e85 100644
--- a/Documentation/networking/x25-iface.txt
+++ b/Documentation/networking/x25-iface.txt
@@ -105,7 +105,7 @@ reduced by the following measures or a combination thereof:
    later.
    The lapb module interface was modified to support this. Its
    data_indication() method should now transparently pass the
-    netif_rx() return value to the (lapb mopdule) caller.
+    netif_rx() return value to the (lapb module) caller.
 (2) Drivers for kernel versions 2.2.x should always check the global
    variable netdev_dropping when a new frame is received. The driver
    should only call netif_rx() if netdev_dropping is zero. Otherwise
diff --git a/Documentation/phy.txt b/Documentation/phy.txt
new file mode 100644
index 000000000000..0103e4b15b0e
--- /dev/null
+++ b/Documentation/phy.txt
@@ -0,0 +1,166 @@
+                            PHY SUBSYSTEM
+                  Kishon Vijay Abraham I <kishon@ti.com>
+This document explains the Generic PHY Framework along with the APIs provided,
+and how-to-use.
+1. Introduction
+*PHY* is the abbreviation for physical layer. It is used to connect a device
+to the physical medium e.g., the USB controller has a PHY to provide functions
+such as serialization, de-serialization, encoding, decoding and is responsible
+for obtaining the required data transmission rate. Note that some USB
+controllers have PHY functionality embedded into it and others use an external
+PHY. Other peripherals that use PHY include Wireless LAN, Ethernet,
+SATA etc.
+The intention of creating this framework is to bring the PHY drivers spread
+all over the Linux kernel to drivers/phy to increase code re-use and for
+better code maintainability.
+This framework will be of use only to devices that use external PHY (PHY
+functionality is not embedded within the controller).
+2. Registering/Unregistering the PHY provider
+PHY provider refers to an entity that implements one or more PHY instances.
+For the simple case where the PHY provider implements only a single instance of
+the PHY, the framework provides its own implementation of of_xlate in
+of_phy_simple_xlate. If the PHY provider implements multiple instances, it
+should provide its own implementation of of_xlate. of_xlate is used only for
+dt boot case.
+#define of_phy_provider_register(dev, xlate)    \
+        __of_phy_provider_register((dev), THIS_MODULE, (xlate))
+#define devm_of_phy_provider_register(dev, xlate)       \
+        __devm_of_phy_provider_register((dev), THIS_MODULE, (xlate))
+of_phy_provider_register and devm_of_phy_provider_register macros can be used to
+register the phy_provider and it takes device and of_xlate as
+arguments. For the dt boot case, all PHY providers should use one of the above
+2 macros to register the PHY provider.
+void devm_of_phy_provider_unregister(struct device *dev,
+        struct phy_provider *phy_provider);
+void of_phy_provider_unregister(struct phy_provider *phy_provider);
+devm_of_phy_provider_unregister and of_phy_provider_unregister can be used to
+unregister the PHY.
+3. Creating the PHY
+The PHY driver should create the PHY in order for other peripheral controllers
+to make use of it. The PHY framework provides 2 APIs to create the PHY.
+struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
+        struct phy_init_data *init_data);
+struct phy *devm_phy_create(struct device *dev, const struct phy_ops *ops,
+        struct phy_init_data *init_data);
+The PHY drivers can use one of the above 2 APIs to create the PHY by passing
+the device pointer, phy ops and init_data.
+phy_ops is a set of function pointers for performing PHY operations such as
+init, exit, power_on and power_off. *init_data* is mandatory to get a reference
+to the PHY in the case of non-dt boot. See section *Board File Initialization*
+on how init_data should be used.
+Inorder to dereference the private data (in phy_ops), the phy provider driver
+can use phy_set_drvdata() after creating the PHY and use phy_get_drvdata() in
+phy_ops to get back the private data.
+4. Getting a reference to the PHY
+Before the controller can make use of the PHY, it has to get a reference to
+it. This framework provides the following APIs to get a reference to the PHY.
+struct phy *phy_get(struct device *dev, const char *string);
+struct phy *devm_phy_get(struct device *dev, const char *string);
+phy_get and devm_phy_get can be used to get the PHY. In the case of dt boot,
+the string arguments should contain the phy name as given in the dt data and
+in the case of non-dt boot, it should contain the label of the PHY.
+The only difference between the two APIs is that devm_phy_get associates the
+device with the PHY using devres on successful PHY get. On driver detach,
+release function is invoked on the the devres data and devres data is freed.
+5. Releasing a reference to the PHY
+When the controller no longer needs the PHY, it has to release the reference
+to the PHY it has obtained using the APIs mentioned in the above section. The
+PHY framework provides 2 APIs to release a reference to the PHY.
+void phy_put(struct phy *phy);
+void devm_phy_put(struct device *dev, struct phy *phy);
+Both these APIs are used to release a reference to the PHY and devm_phy_put
+destroys the devres associated with this PHY.
+6. Destroying the PHY
+When the driver that created the PHY is unloaded, it should destroy the PHY it
+created using one of the following 2 APIs.
+void phy_destroy(struct phy *phy);
+void devm_phy_destroy(struct device *dev, struct phy *phy);
+Both these APIs destroy the PHY and devm_phy_destroy destroys the devres
+associated with this PHY.
+7. PM Runtime
+This subsystem is pm runtime enabled. So while creating the PHY,
+pm_runtime_enable of the phy device created by this subsystem is called and
+while destroying the PHY, pm_runtime_disable is called. Note that the phy
+device created by this subsystem will be a child of the device that calls
+phy_create (PHY provider device).
+So pm_runtime_get_sync of the phy_device created by this subsystem will invoke
+pm_runtime_get_sync of PHY provider device because of parent-child relationship.
+It should also be noted that phy_power_on and phy_power_off performs
+phy_pm_runtime_get_sync and phy_pm_runtime_put respectively.
+There are exported APIs like phy_pm_runtime_get, phy_pm_runtime_get_sync,
+phy_pm_runtime_put, phy_pm_runtime_put_sync, phy_pm_runtime_allow and
+phy_pm_runtime_forbid for performing PM operations.
+8. Board File Initialization
+Certain board file initialization is necessary in order to get a reference
+to the PHY in the case of non-dt boot.
+Say we have a single device that implements 3 PHYs that of USB, SATA and PCIe,
+then in the board file the following initialization should be done.
+struct phy_consumer consumers[] = {
+        PHY_CONSUMER("dwc3.0", "usb"),
+        PHY_CONSUMER("pcie.0", "pcie"),
+        PHY_CONSUMER("sata.0", "sata"),
+};
+PHY_CONSUMER takes 2 parameters, first is the device name of the controller
+(PHY consumer) and second is the port name.
+struct phy_init_data init_data = {
+        .consumers = consumers,
+        .num_consumers = ARRAY_SIZE(consumers),
+};
+static const struct platform_device pipe3_phy_dev = {
+        .name = "pipe3-phy",
+        .id = -1,
+        .dev = {
+                .platform_data = {
+                        .init_data = &init_data,
+                },
+        },
+};
+then, while doing phy_create, the PHY driver should pass this init_data
+        phy_create(dev, ops, pdata->init_data);
+and the controller driver (phy consumer) should pass the port name along with
+the device to get a reference to the PHY
+        phy_get(dev, "pcie");
+9. DeviceTree Binding
+The documentation for PHY dt binding can be found @
+Documentation/devicetree/bindings/phy/phy-bindings.txt
diff --git a/Documentation/pps/pps.txt b/Documentation/pps/pps.txt
index d35dcdd82ff6..c03b1be5eb15 100644
--- a/Documentation/pps/pps.txt
+++ b/Documentation/pps/pps.txt
@@ -66,6 +66,21 @@ In LinuxPPS the PPS sources are simply char devices usually mapped
 into files /dev/pps0, /dev/pps1, etc..
+PPS with USB to serial devices
+------------------------------
+It is possible to grab the PPS from an USB to serial device. However,
+you should take into account the latencies and jitter introduced by
+the USB stack. Users has reported clock instability around +-1ms when
+synchronized with PPS through USB. This isn't suited for time server
+synchronization.
+If your device doesn't report PPS, you can check that the feature is
+supported by its driver. Most of the time, you only need to add a call
+to usb_serial_handle_dcd_change after checking the DCD status (see
+ch341 and pl2303 examples).
 Coding example
 --------------
diff --git a/MAINTAINERS b/MAINTAINERS
index a7c34ef3509d..64a4ab154af8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1009,6 +1009,7 @@ ARM/Marvell Armada 370 and Armada XP SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Gregory Clement <gregory.clement@free-electrons.com>
+M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-mvebu/
@@ -1016,6 +1017,7 @@ F:	arch/arm/mach-mvebu/
 ARM/Marvell Dove/Kirkwood/MV78xx0/Orion SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
+M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-dove/
@@ -1148,6 +1150,13 @@ F:	drivers/net/ethernet/i825xx/ether1*
 F:      drivers/net/ethernet/seeq/ether3*
 F:      drivers/scsi/arm/
+ARM/Rockchip SoC support
+M:      Heiko Stuebner <heiko@sntech.de>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-rockchip/
+F:      drivers/*/*rockchip*
 ARM/SHARK MACHINE SUPPORT
 M:      Alexander Schulz <alex@shark-linux.de>
 W:      http://www.shark-linux.de/shark.html
@@ -1791,6 +1800,7 @@ F:	include/net/bluetooth/
 BONDING DRIVER
 M:      Jay Vosburgh <fubar@us.ibm.com>
+M:      Veaceslav Falico <vfalico@redhat.com>
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
@@ -2718,6 +2728,8 @@ T:	git git://git.linaro.org/people/sumitsemwal/linux-dma-buf.git
 DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
 M:      Vinod Koul <vinod.koul@intel.com>
 M:      Dan Williams <dan.j.williams@intel.com>
+L:      dmaengine@vger.kernel.org
+Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
 S:      Supported
 F:      drivers/dma/
 F:      include/linux/dma*
@@ -2821,7 +2833,7 @@ M:	Terje Bergström <tbergstrom@nvidia.com>
 L:      dri-devel@lists.freedesktop.org
 L:      linux-tegra@vger.kernel.org
 T:      git git://anongit.freedesktop.org/tegra/linux.git
-S:      Maintained
+S:      Supported
 F:      drivers/gpu/host1x/
 F:      include/uapi/drm/tegra_drm.h
 F:      Documentation/devicetree/bindings/gpu/nvidia,tegra20-host1x.txt
@@ -3679,6 +3691,14 @@ S:	Maintained
 F:      include/asm-generic/
 F:      include/uapi/asm-generic/
+GENERIC PHY FRAMEWORK
+M:      Kishon Vijay Abraham I <kishon@ti.com>
+L:      linux-kernel@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy.git
+S:      Supported
+F:      drivers/phy/
+F:      include/linux/phy/
 GENERIC UIO DRIVER FOR PCI DEVICES
 M:      "Michael S. Tsirkin" <mst@redhat.com>
 L:      kvm@vger.kernel.org
@@ -4357,7 +4377,10 @@ F:	arch/x86/kernel/microcode_intel.c
 INTEL I/OAT DMA DRIVER
 M:      Dan Williams <dan.j.williams@intel.com>
-S:      Maintained
+M:      Dave Jiang <dave.jiang@intel.com>
+L:      dmaengine@vger.kernel.org
+Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
+S:      Supported
 F:      drivers/dma/ioat*
 INTEL IOMMU (VT-d)
@@ -7822,6 +7845,13 @@ F:	Documentation/sound/alsa/soc/
 F:      sound/soc/
 F:      include/sound/soc*
+SOUND - DMAENGINE HELPERS
+M:      Lars-Peter Clausen <lars@metafoo.de>
+S:      Supported
+F:      include/sound/dmaengine_pcm.h
+F:      sound/core/pcm_dmaengine.c
+F:      sound/soc/soc-generic-dmaengine-pcm.c
 SPARC + UltraSPARC (sparc/sparc64)
 M:      "David S. Miller" <davem@davemloft.net>
 L:      sparclinux@vger.kernel.org
@@ -8294,14 +8324,72 @@ L:	linux-media@vger.kernel.org
 S:      Maintained
 F:      drivers/media/rc/ttusbir.c
-TEGRA SUPPORT
+TEGRA ARCHITECTURE SUPPORT
 M:      Stephen Warren <swarren@wwwdotorg.org>
+M:      Thierry Reding <thierry.reding@gmail.com>
 L:      linux-tegra@vger.kernel.org
 Q:      http://patchwork.ozlabs.org/project/linux-tegra/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-tegra.git
 S:      Supported
 N:      [^a-z]tegra
+TEGRA ASOC DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      sound/soc/tegra/
+TEGRA CLOCK DRIVER
+M:      Peter De Schrijver <pdeschrijver@nvidia.com>
+M:      Prashant Gaikwad <pgaikwad@nvidia.com>
+S:      Supported
+F:      drivers/clk/tegra/
+TEGRA DMA DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/dma/tegra20-apb-dma.c
+TEGRA GPIO DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      drivers/gpio/gpio-tegra.c
+TEGRA I2C DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/i2c/busses/i2c-tegra.c
+TEGRA IOMMU DRIVERS
+M:      Hiroshi Doyu <hdoyu@nvidia.com>
+S:      Supported
+F:      drivers/iommu/tegra*
+TEGRA KBC DRIVER
+M:      Rakesh Iyer <riyer@nvidia.com>
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/input/keyboard/tegra-kbc.c
+TEGRA PINCTRL DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      drivers/pinctrl/pinctrl-tegra*
+TEGRA PWM DRIVER
+M:      Thierry Reding <thierry.reding@gmail.com>
+S:      Supported
+F:      drivers/pwm/pwm-tegra.c
+TEGRA SERIAL DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/tty/serial/serial-tegra.c
+TEGRA SPI DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/spi/spi-tegra*
 TEHUTI ETHERNET DRIVER
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
@@ -8837,61 +8925,14 @@ W:	http://pegasus2.sourceforge.net/
 S:      Maintained
 F:      drivers/net/usb/rtl8150.c
-USB SERIAL BELKIN F5U103 DRIVER
+USB SERIAL SUBSYSTEM
-M:      William Greathouse <wgreathouse@smva.com>
+M:      Johan Hovold <jhovold@gmail.com>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/belkin_sa.*
-USB SERIAL CYPRESS M8 DRIVER
-M:      Lonnie Mendez <dignome@gmail.com>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
-W:      http://geocities.com/i0xox0i
-W:      http://firstlight.net/cvs
-F:      drivers/usb/serial/cypress_m8.*
-USB SERIAL CYBERJACK DRIVER
-M:      Matthias Bruestle and Harald Welte <support@reiner-sct.com>
-W:      http://www.reiner-sct.de/support/treiber_cyberjack.php
-S:      Maintained
-F:      drivers/usb/serial/cyberjack.c
-USB SERIAL DIGI ACCELEPORT DRIVER
-M:      Peter Berger <pberger@brimson.com>
-M:      Al Borchers <alborchers@steinerpoint.com>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/digi_acceleport.c
-USB SERIAL DRIVER
-M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-L:      linux-usb@vger.kernel.org
-S:      Supported
 F:      Documentation/usb/usb-serial.txt
-F:      drivers/usb/serial/generic.c
+F:      drivers/usb/serial/
-F:      drivers/usb/serial/usb-serial.c
 F:      include/linux/usb/serial.h
-USB SERIAL EMPEG EMPEG-CAR MARK I/II DRIVER
-M:      Gary Brubaker <xavyer@ix.netcom.com>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/empeg.c
-USB SERIAL KEYSPAN DRIVER
-M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/*keyspan*
-USB SERIAL WHITEHEAT DRIVER
-M:      Support Department <support@connecttech.com>
-L:      linux-usb@vger.kernel.org
-W:      http://www.connecttech.com
-S:      Supported
-F:      drivers/usb/serial/whiteheat*
 USB SMSC75XX ETHERNET DRIVER
 M:      Steve Glendinning <steve.glendinning@shawell.net>
 L:      netdev@vger.kernel.org
diff --git a/Makefile b/Makefile
index 126321d2e6ad..67077ad6edbb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION =
 NAME = One Giant Leap for Frogkind
 # *DOCUMENTATION*
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index d63f3de0cd5b..0c14d8a52683 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -17,7 +17,7 @@
 #include <asm/pgalloc.h>
 #include <asm/mmu.h>
-static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address)
+static int handle_vmalloc_fault(unsigned long address)
 {
        /*
         * Synchronize this task's top level page-table
@@ -27,7 +27,7 @@ static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address)
        pud_t *pud, *pud_k;
        pmd_t *pmd, *pmd_k;
-        pgd = pgd_offset_fast(mm, address);
+        pgd = pgd_offset_fast(current->active_mm, address);
        pgd_k = pgd_offset_k(address);
        if (!pgd_present(*pgd_k))
@@ -72,7 +72,7 @@ void do_page_fault(struct pt_regs *regs, unsigned long address)
         * nothing more.
         */
        if (address >= VMALLOC_START && address <= VMALLOC_END) {
-                ret = handle_vmalloc_fault(mm, address);
+                ret = handle_vmalloc_fault(address);
                if (unlikely(ret))
                        goto bad_area_nosemaphore;
                else
diff --git a/arch/arm/boot/dts/integratorcp.dts b/arch/arm/boot/dts/integratorcp.dts
index ff1aea0ee043..72693a69f830 100644
--- a/arch/arm/boot/dts/integratorcp.dts
+++ b/arch/arm/boot/dts/integratorcp.dts
@@ -9,11 +9,6 @@
        model = "ARM Integrator/CP";
        compatible = "arm,integrator-cp";
-        aliases {
-                arm,timer-primary = &timer2;
-                arm,timer-secondary = &timer1;
-        };
        chosen {
                bootargs = "root=/dev/ram0 console=ttyAMA0,38400n8 earlyprintk";
        };
@@ -24,14 +19,18 @@
        };
        timer0: timer@13000000 {
+                /* TIMER0 runs @ 25MHz */
                compatible = "arm,integrator-cp-timer";
+                status = "disabled";
        };
        timer1: timer@13000100 {
+                /* TIMER1 runs @ 1MHz */
                compatible = "arm,integrator-cp-timer";
        };
        timer2: timer@13000200 {
+                /* TIMER2 runs @ 1MHz */
                compatible = "arm,integrator-cp-timer";
        };
diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
index 2816bf612672..ba4dcfc6b721 100644
--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
@@ -144,6 +144,8 @@
 &usb_otg_hs {
        interface-type = <0>;
        usb-phy = <&usb2_phy>;
+        phys = <&usb2_phy>;
+        phy-names = "usb2-phy";
        mode = <3>;
        power = <50>;
 };
diff --git a/arch/arm/boot/dts/omap3-evm.dts b/arch/arm/boot/dts/omap3-evm.dts
index 7d4329d179c4..4134dd05c3a4 100644
--- a/arch/arm/boot/dts/omap3-evm.dts
+++ b/arch/arm/boot/dts/omap3-evm.dts
@@ -70,6 +70,8 @@
 &usb_otg_hs {
        interface-type = <0>;
        usb-phy = <&usb2_phy>;
+        phys = <&usb2_phy>;
+        phy-names = "usb2-phy";
        mode = <3>;
        power = <50>;
 };
diff --git a/arch/arm/boot/dts/omap3-overo.dtsi b/arch/arm/boot/dts/omap3-overo.dtsi
index 8f1abec78275..a461d2fd1fb0 100644
--- a/arch/arm/boot/dts/omap3-overo.dtsi
+++ b/arch/arm/boot/dts/omap3-overo.dtsi
@@ -76,6 +76,8 @@
 &usb_otg_hs {
        interface-type = <0>;
        usb-phy = <&usb2_phy>;
+        phys = <&usb2_phy>;
+        phy-names = "usb2-phy";
        mode = <3>;
        power = <50>;
 };
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 22d9f2b593d4..ea4054bfdfd4 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -519,7 +519,8 @@
                        usb2_phy: usb2phy@4a0ad080 {
                                compatible = "ti,omap-usb2";
                                reg = <0x4a0ad080 0x58>;
-                                ctrl-module = <&omap_control_usb>;
+                                ctrl-module = <&omap_control_usb2phy>;
+                                #phy-cells = <0>;
                        };
                };
@@ -643,12 +644,16 @@
                        };
                };
-                omap_control_usb: omap-control-usb@4a002300 {
+                omap_control_usb2phy: control-phy@4a002300 {
-                        compatible = "ti,omap-control-usb";
+                        compatible = "ti,control-phy-usb2";
-                        reg = <0x4a002300 0x4>,
+                        reg = <0x4a002300 0x4>;
-                              <0x4a00233c 0x4>;
+                        reg-names = "power";
-                        reg-names = "control_dev_conf", "otghs_control";
+                };
-                        ti,type = <1>;
+                omap_control_usbotg: control-phy@4a00233c {
+                        compatible = "ti,control-phy-otghs";
+                        reg = <0x4a00233c 0x4>;
+                        reg-names = "otghs_control";
                };
                usb_otg_hs: usb_otg_hs@4a0ab000 {
@@ -658,10 +663,12 @@
                        interrupt-names = "mc", "dma";
                        ti,hwmods = "usb_otg_hs";
                        usb-phy = <&usb2_phy>;
+                        phys = <&usb2_phy>;
+                        phy-names = "usb2-phy";
                        multipoint = <1>;
                        num-eps = <16>;
                        ram-bits = <12>;
-                        ti,has-mailbox;
+                        ctrl-module = <&omap_control_usbotg>;
                };
        };
 };
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 7cdea1bfea09..c0ec6dce30fe 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -626,12 +626,16 @@
                        hw-caps-temp-alert;
                };
-                omap_control_usb: omap-control-usb@4a002300 {
+                omap_control_usb2phy: control-phy@4a002300 {
-                        compatible = "ti,omap-control-usb";
+                        compatible = "ti,control-phy-usb2";
-                        reg = <0x4a002300 0x4>,
+                        reg = <0x4a002300 0x4>;
-                              <0x4a002370 0x4>;
+                        reg-names = "power";
-                        reg-names = "control_dev_conf", "phy_power_usb";
+                };
-                        ti,type = <2>;
+                omap_control_usb3phy: control-phy@4a002370 {
+                        compatible = "ti,control-phy-pipe3";
+                        reg = <0x4a002370 0x4>;
+                        reg-names = "power";
                };
                omap_dwc3@4a020000 {
@@ -662,7 +666,7 @@
                        usb2_phy: usb2phy@4a084000 {
                                compatible = "ti,omap-usb2";
                                reg = <0x4a084000 0x7c>;
-                                ctrl-module = <&omap_control_usb>;
+                                ctrl-module = <&omap_control_usb2phy>;
                        };
                        usb3_phy: usb3phy@4a084400 {
@@ -671,7 +675,7 @@
                                      <0x4a084800 0x64>,
                                      <0x4a084c00 0x40>;
                                reg-names = "phy_rx", "phy_tx", "pll_ctrl";
-                                ctrl-module = <&omap_control_usb>;
+                                ctrl-module = <&omap_control_usb3phy>;
                        };
                };
diff --git a/arch/arm/boot/dts/twl4030.dtsi b/arch/arm/boot/dts/twl4030.dtsi
index ae6a17aed9ee..5aba238d1f1e 100644
--- a/arch/arm/boot/dts/twl4030.dtsi
+++ b/arch/arm/boot/dts/twl4030.dtsi
@@ -86,6 +86,7 @@
                usb1v8-supply = <&vusb1v8>;
                usb3v1-supply = <&vusb3v1>;
                usb_mode = <1>;
+                #phy-cells = <0>;
        };
        twl_pwm: pwm {
diff --git a/arch/arm/configs/ep93xx_defconfig b/arch/arm/configs/ep93xx_defconfig
index 806005a4c4c1..6ac5ea73bd0a 100644
--- a/arch/arm/configs/ep93xx_defconfig
+++ b/arch/arm/configs/ep93xx_defconfig
@@ -1,15 +1,14 @@
-CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
+CONFIG_PARTITION_ADVANCED=y
 # CONFIG_IOSCHED_CFQ is not set
 CONFIG_ARCH_EP93XX=y
 CONFIG_CRUNCH=y
@@ -47,11 +46,8 @@ CONFIG_IPV6=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CONCAT=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_REDBOOT_PARTS=y
 CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
 CONFIG_MTD_CFI_ADV_OPTIONS=y
@@ -67,15 +63,14 @@ CONFIG_SCSI=y
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_BLK_DEV_SD=y
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_EP93XX_ETH=y
 CONFIG_USB_RTL8150=y
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_LEGACY_PTYS is not set
 CONFIG_SERIAL_AMBA_PL010=y
 CONFIG_SERIAL_AMBA_PL010_CONSOLE=y
-# CONFIG_LEGACY_PTYS is not set
 # CONFIG_HW_RANDOM is not set
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
@@ -86,9 +81,9 @@ CONFIG_WATCHDOG=y
 CONFIG_EP93XX_WATCHDOG=y
 CONFIG_USB=y
 CONFIG_USB_DEBUG=y
-CONFIG_USB_DEVICEFS=y
 CONFIG_USB_DYNAMIC_MINORS=y
 CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_SERIAL=y
 CONFIG_USB_SERIAL_CONSOLE=y
@@ -100,24 +95,18 @@ CONFIG_RTC_DRV_EP93XX=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
-CONFIG_INOTIFY=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
 CONFIG_JFFS2_FS=y
 CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
 CONFIG_ROOT_NFS=y
-CONFIG_PARTITION_ADVANCED=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_SLAB=y
 CONFIG_DEBUG_SPINLOCK=y
 CONFIG_DEBUG_MUTEXES=y
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 CONFIG_DEBUG_USER=y
-CONFIG_DEBUG_ERRORS=y
 CONFIG_DEBUG_LL=y
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_LIBCRC32C=y
diff --git a/arch/arm/mach-ep93xx/clock.c b/arch/arm/mach-ep93xx/clock.c
index c95dbce2468e..39ef3b613912 100644
--- a/arch/arm/mach-ep93xx/clock.c
+++ b/arch/arm/mach-ep93xx/clock.c
@@ -212,7 +212,7 @@ static struct clk_lookup clocks[] = {
        INIT_CK(NULL,                   "hclk",         &clk_h),
        INIT_CK(NULL,                   "apb_pclk",     &clk_p),
        INIT_CK(NULL,                   "pll2",         &clk_pll2),
-        INIT_CK("ep93xx-ohci",          NULL,           &clk_usb_host),
+        INIT_CK("ohci-platform",        NULL,           &clk_usb_host),
        INIT_CK("ep93xx-keypad",        NULL,           &clk_keypad),
        INIT_CK("ep93xx-fb",            NULL,           &clk_video),
        INIT_CK("ep93xx-spi.0",         NULL,           &clk_spi),
diff --git a/arch/arm/mach-ep93xx/core.c b/arch/arm/mach-ep93xx/core.c
index 3f12b885c083..d95ee28a616a 100644
--- a/arch/arm/mach-ep93xx/core.c
+++ b/arch/arm/mach-ep93xx/core.c
@@ -36,6 +36,7 @@
 #include <linux/export.h>
 #include <linux/irqchip/arm-vic.h>
 #include <linux/reboot.h>
+#include <linux/usb/ohci_pdriver.h>
 #include <mach/hardware.h>
 #include <linux/platform_data/video-ep93xx.h>
@@ -297,25 +298,53 @@ static struct platform_device ep93xx_rtc_device = {
        .resource       = ep93xx_rtc_resource,
 };
+/*************************************************************************
+ * EP93xx OHCI USB Host
+ *************************************************************************/
+static struct clk *ep93xx_ohci_host_clock;
+static int ep93xx_ohci_power_on(struct platform_device *pdev)
+{
+        if (!ep93xx_ohci_host_clock) {
+                ep93xx_ohci_host_clock = devm_clk_get(&pdev->dev, NULL);
+                if (IS_ERR(ep93xx_ohci_host_clock))
+                        return PTR_ERR(ep93xx_ohci_host_clock);
+        }
+        return clk_enable(ep93xx_ohci_host_clock);
+}
+static void ep93xx_ohci_power_off(struct platform_device *pdev)
+{
+        clk_disable(ep93xx_ohci_host_clock);
+}
+static struct usb_ohci_pdata ep93xx_ohci_pdata = {
+        .power_on       = ep93xx_ohci_power_on,
+        .power_off      = ep93xx_ohci_power_off,
+        .power_suspend  = ep93xx_ohci_power_off,
+};
 static struct resource ep93xx_ohci_resources[] = {
        DEFINE_RES_MEM(EP93XX_USB_PHYS_BASE, 0x1000),
        DEFINE_RES_IRQ(IRQ_EP93XX_USB),
 };
+static u64 ep93xx_ohci_dma_mask = DMA_BIT_MASK(32);
 static struct platform_device ep93xx_ohci_device = {
-        .name           = "ep93xx-ohci",
+        .name           = "ohci-platform",
        .id             = -1,
+        .num_resources  = ARRAY_SIZE(ep93xx_ohci_resources),
+        .resource       = ep93xx_ohci_resources,
        .dev            = {
-                .dma_mask               = &ep93xx_ohci_device.dev.coherent_dma_mask,
+                .dma_mask               = &ep93xx_ohci_dma_mask,
                .coherent_dma_mask      = DMA_BIT_MASK(32),
+                .platform_data          = &ep93xx_ohci_pdata,
        },
-        .num_resources  = ARRAY_SIZE(ep93xx_ohci_resources),
-        .resource       = ep93xx_ohci_resources,
 };
 /*************************************************************************
 * EP93xx physmap'ed flash
 *************************************************************************/
diff --git a/arch/arm/mach-exynos/include/mach/regs-pmu.h b/arch/arm/mach-exynos/include/mach/regs-pmu.h
index 57344b7e98ce..2cdb63e8ce5c 100644
--- a/arch/arm/mach-exynos/include/mach/regs-pmu.h
+++ b/arch/arm/mach-exynos/include/mach/regs-pmu.h
@@ -44,11 +44,6 @@
 #define S5P_DAC_PHY_CONTROL                     S5P_PMUREG(0x070C)
 #define S5P_DAC_PHY_ENABLE                      (1 << 0)
-#define S5P_MIPI_DPHY_CONTROL(n)                S5P_PMUREG(0x0710 + (n) * 4)
-#define S5P_MIPI_DPHY_ENABLE                    (1 << 0)
-#define S5P_MIPI_DPHY_SRESETN                   (1 << 1)
-#define S5P_MIPI_DPHY_MRESETN                   (1 << 2)
 #define S5P_INFORM0                             S5P_PMUREG(0x0800)
 #define S5P_INFORM1                             S5P_PMUREG(0x0804)
 #define S5P_INFORM2                             S5P_PMUREG(0x0808)
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index f26918467efc..8b9cd0690ce7 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -289,18 +289,12 @@ static struct regulator_consumer_supply beagle_vsim_supply[] = {
 static struct gpio_led gpio_leds[];
-/* PHY's VCC regulator might be added later, so flag that we need it */
-static struct usb_phy_gen_xceiv_platform_data hsusb2_phy_data = {
-        .needs_vcc = true,
-};
 static struct usbhs_phy_data phy_data[] = {
        {
                .port = 2,
                .reset_gpio = 147,
                .vcc_gpio = -1,         /* updated in beagle_twl_gpio_setup */
                .vcc_polarity = 1,      /* updated in beagle_twl_gpio_setup */
-                .platform_data = &hsusb2_phy_data,
        },
 };
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index c05898fbd634..b0d54dae1bcb 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -24,6 +24,7 @@
 #include <linux/i2c/twl.h>
 #include <linux/gpio.h>
 #include <linux/string.h>
+#include <linux/phy/phy.h>
 #include <linux/regulator/machine.h>
 #include <linux/regulator/fixed.h>
@@ -90,8 +91,18 @@ void __init omap_pmic_late_init(void)
 }
 #if defined(CONFIG_ARCH_OMAP3)
+struct phy_consumer consumers[] = {
+        PHY_CONSUMER("musb-hdrc.0", "usb"),
+};
+struct phy_init_data init_data = {
+        .consumers = consumers,
+        .num_consumers = ARRAY_SIZE(consumers),
+};
 static struct twl4030_usb_data omap3_usb_pdata = {
        .usb_mode       = T2_USB_MODE_ULPI,
+        .init_data      = &init_data,
 };
 static int omap3_batt_table[] = {
diff --git a/arch/arm/mach-omap2/usb-host.c b/arch/arm/mach-omap2/usb-host.c
index e83a6a4b184a..10855eb4ccc1 100644
--- a/arch/arm/mach-omap2/usb-host.c
+++ b/arch/arm/mach-omap2/usb-host.c
@@ -435,6 +435,7 @@ int usbhs_init_phys(struct usbhs_phy_data *phy, int num_phys)
        struct platform_device *pdev;
        char *phy_id;
        struct platform_device_info pdevinfo;
+        struct usb_phy_gen_xceiv_platform_data nop_pdata;
        for (i = 0; i < num_phys; i++) {
@@ -455,11 +456,18 @@ int usbhs_init_phys(struct usbhs_phy_data *phy, int num_phys)
                        return -ENOMEM;
                }
+                /* set platform data */
+                memset(&nop_pdata, 0, sizeof(nop_pdata));
+                if (gpio_is_valid(phy->vcc_gpio))
+                        nop_pdata.needs_vcc = true;
+                nop_pdata.gpio_reset = phy->reset_gpio;
+                nop_pdata.type = USB_PHY_TYPE_USB2;
                /* create a NOP PHY device */
                memset(&pdevinfo, 0, sizeof(pdevinfo));
                pdevinfo.name = nop_name;
                pdevinfo.id = phy->port;
-                pdevinfo.data = phy->platform_data;
+                pdevinfo.data = &nop_pdata;
                pdevinfo.size_data =
                        sizeof(struct usb_phy_gen_xceiv_platform_data);
                scnprintf(phy_id, MAX_STR, "usb_phy_gen_xceiv.%d",
@@ -474,14 +482,6 @@ int usbhs_init_phys(struct usbhs_phy_data *phy, int num_phys)
                usb_bind_phy("ehci-omap.0", phy->port - 1, phy_id);
-                /* Do we need RESET regulator ? */
-                if (gpio_is_valid(phy->reset_gpio)) {
-                        scnprintf(rail_name, MAX_STR,
-                                        "hsusb%d_reset", phy->port);
-                        usbhs_add_regulator(rail_name, phy_id, "reset",
-                                                phy->reset_gpio, 1);
-                }
                /* Do we need VCC regulator ? */
                if (gpio_is_valid(phy->vcc_gpio)) {
                        scnprintf(rail_name, MAX_STR, "hsusb%d_vcc", phy->port);
diff --git a/arch/arm/mach-omap2/usb.h b/arch/arm/mach-omap2/usb.h
index e7261ebcf7b0..4ba2ae759895 100644
--- a/arch/arm/mach-omap2/usb.h
+++ b/arch/arm/mach-omap2/usb.h
@@ -58,7 +58,6 @@ struct usbhs_phy_data {
        int reset_gpio;
        int vcc_gpio;
        bool vcc_polarity;      /* 1 active high, 0 active low */
-        void *platform_data;
 };
 extern void usb_musb_init(struct omap_musb_board_data *board_data);
diff --git a/arch/arm/mach-s5pv210/include/mach/regs-clock.h b/arch/arm/mach-s5pv210/include/mach/regs-clock.h
index 032de66fb8be..e345584d4c34 100644
--- a/arch/arm/mach-s5pv210/include/mach/regs-clock.h
+++ b/arch/arm/mach-s5pv210/include/mach/regs-clock.h
@@ -147,10 +147,6 @@
 #define S5P_HDMI_PHY_CONTROL    S5P_CLKREG(0xE804)
 #define S5P_USB_PHY_CONTROL     S5P_CLKREG(0xE80C)
 #define S5P_DAC_PHY_CONTROL     S5P_CLKREG(0xE810)
-#define S5P_MIPI_DPHY_CONTROL(x) S5P_CLKREG(0xE814)
-#define S5P_MIPI_DPHY_ENABLE    (1 << 0)
-#define S5P_MIPI_DPHY_SRESETN   (1 << 1)
-#define S5P_MIPI_DPHY_MRESETN   (1 << 2)
 #define S5P_INFORM0             S5P_CLKREG(0xF000)
 #define S5P_INFORM1             S5P_CLKREG(0xF004)
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index f50d223a0bd3..99b44e0e8d86 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -930,4 +930,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
        if (fp->bpf_func != sk_run_filter)
                module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig
index 7dfba937d8fc..6d95d60276d6 100644
--- a/arch/arm/plat-samsung/Kconfig
+++ b/arch/arm/plat-samsung/Kconfig
@@ -382,11 +382,6 @@ config S5P_DEV_TV
        help
          Compile in platform device definition for TV interface
-config S5P_DEV_USB_EHCI
-        bool
-        help
-          Compile in platform device definition for USB EHCI
 config S3C24XX_PWM
        bool "PWM device support"
        select PWM
@@ -395,11 +390,6 @@ config S3C24XX_PWM
          Support for exporting the PWM timer blocks via the pwm device
          system
-config S5P_SETUP_MIPIPHY
-        bool
-        help
-          Compile in common setup code for MIPI-CSIS and MIPI-DSIM devices
 config S3C_SETUP_CAMIF
        bool
        help
diff --git a/arch/arm/plat-samsung/Makefile b/arch/arm/plat-samsung/Makefile
index 498c7c23e9f4..9267d29549b4 100644
--- a/arch/arm/plat-samsung/Makefile
+++ b/arch/arm/plat-samsung/Makefile
@@ -38,7 +38,6 @@ obj-$(CONFIG_S5P_DEV_UART)	+= s5p-dev-uart.o
 obj-$(CONFIG_SAMSUNG_DEV_BACKLIGHT)     += dev-backlight.o
 obj-$(CONFIG_S3C_SETUP_CAMIF)   += setup-camif.o
-obj-$(CONFIG_S5P_SETUP_MIPIPHY) += setup-mipiphy.o
 # DMA support
diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
index 8ce0ac007eb9..25f40c9b7f62 100644
--- a/arch/arm/plat-samsung/devs.c
+++ b/arch/arm/plat-samsung/devs.c
@@ -49,7 +49,6 @@
 #include <plat/devs.h>
 #include <plat/adc.h>
 #include <linux/platform_data/ata-samsung_cf.h>
-#include <linux/platform_data/usb-ehci-s5p.h>
 #include <plat/fb.h>
 #include <plat/fb-s3c2410.h>
 #include <plat/hdmi.h>
@@ -1359,39 +1358,6 @@ void __init s3c24xx_udc_set_platdata(struct s3c2410_udc_mach_info *pd)
 }
 #endif /* CONFIG_PLAT_S3C24XX */
-/* USB EHCI Host Controller */
-#ifdef CONFIG_S5P_DEV_USB_EHCI
-static struct resource s5p_ehci_resource[] = {
-        [0] = DEFINE_RES_MEM(S5P_PA_EHCI, SZ_256),
-        [1] = DEFINE_RES_IRQ(IRQ_USB_HOST),
-};
-struct platform_device s5p_device_ehci = {
-        .name           = "s5p-ehci",
-        .id             = -1,
-        .num_resources  = ARRAY_SIZE(s5p_ehci_resource),
-        .resource       = s5p_ehci_resource,
-        .dev            = {
-                .dma_mask               = &samsung_device_dma_mask,
-                .coherent_dma_mask      = DMA_BIT_MASK(32),
-        }
-};
-void __init s5p_ehci_set_platdata(struct s5p_ehci_platdata *pd)
-{
-        struct s5p_ehci_platdata *npd;
-        npd = s3c_set_platdata(pd, sizeof(struct s5p_ehci_platdata),
-                        &s5p_device_ehci);
-        if (!npd->phy_init)
-                npd->phy_init = s5p_usb_phy_init;
-        if (!npd->phy_exit)
-                npd->phy_exit = s5p_usb_phy_exit;
-}
-#endif /* CONFIG_S5P_DEV_USB_EHCI */
 /* USB HSOTG */
 #ifdef CONFIG_S3C_DEV_USB_HSOTG
diff --git a/arch/arm/plat-samsung/include/plat/devs.h b/arch/arm/plat-samsung/include/plat/devs.h
index 0dc4ac4909b0..eece188ed188 100644
--- a/arch/arm/plat-samsung/include/plat/devs.h
+++ b/arch/arm/plat-samsung/include/plat/devs.h
@@ -75,7 +75,6 @@ extern struct platform_device s3c_device_usb_hsotg;
 extern struct platform_device s3c_device_usb_hsudc;
 extern struct platform_device s3c_device_wdt;
-extern struct platform_device s5p_device_ehci;
 extern struct platform_device s5p_device_fimc0;
 extern struct platform_device s5p_device_fimc1;
 extern struct platform_device s5p_device_fimc2;
diff --git a/arch/arm/plat-samsung/setup-mipiphy.c b/arch/arm/plat-samsung/setup-mipiphy.c
deleted file mode 100644
index 66df315990a7..000000000000
--- a/arch/arm/plat-samsung/setup-mipiphy.c
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright (C) 2011 Samsung Electronics Co., Ltd.
- *
- * S5P - Helper functions for MIPI-CSIS and MIPI-DSIM D-PHY control
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/export.h>
-#include <linux/kernel.h>
-#include <linux/platform_device.h>
-#include <linux/io.h>
-#include <linux/spinlock.h>
-#include <mach/regs-clock.h>
-static int __s5p_mipi_phy_control(int id, bool on, u32 reset)
-{
-        static DEFINE_SPINLOCK(lock);
-        void __iomem *addr;
-        unsigned long flags;
-        u32 cfg;
-        id = max(0, id);
-        if (id > 1)
-                return -EINVAL;
-        addr = S5P_MIPI_DPHY_CONTROL(id);
-        spin_lock_irqsave(&lock, flags);
-        cfg = __raw_readl(addr);
-        cfg = on ? (cfg | reset) : (cfg & ~reset);
-        __raw_writel(cfg, addr);
-        if (on) {
-                cfg |= S5P_MIPI_DPHY_ENABLE;
-        } else if (!(cfg & (S5P_MIPI_DPHY_SRESETN |
-                            S5P_MIPI_DPHY_MRESETN) & ~reset)) {
-                cfg &= ~S5P_MIPI_DPHY_ENABLE;
-        }
-        __raw_writel(cfg, addr);
-        spin_unlock_irqrestore(&lock, flags);
-        return 0;
-}
-int s5p_csis_phy_enable(int id, bool on)
-{
-        return __s5p_mipi_phy_control(id, on, S5P_MIPI_DPHY_SRESETN);
-}
-EXPORT_SYMBOL(s5p_csis_phy_enable);
-int s5p_dsim_phy_enable(struct platform_device *pdev, bool on)
-{
-        return __s5p_mipi_phy_control(pdev->id, on, S5P_MIPI_DPHY_MRESETN);
-}
-EXPORT_SYMBOL(s5p_dsim_phy_enable);
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index 45f1ffcf1a4b..24cdf64789c3 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -971,11 +971,11 @@ static const struct mips_perf_event mipsxx74Kcore_cache_map
 [C(LL)] = {
        [C(OP_READ)] = {
                [C(RESULT_ACCESS)]      = { 0x1c, CNTR_ODD, P },
-                [C(RESULT_MISS)]        = { 0x1d, CNTR_EVEN | CNTR_ODD, P },
+                [C(RESULT_MISS)]        = { 0x1d, CNTR_EVEN, P },
        },
        [C(OP_WRITE)] = {
                [C(RESULT_ACCESS)]      = { 0x1c, CNTR_ODD, P },
-                [C(RESULT_MISS)]        = { 0x1d, CNTR_EVEN | CNTR_ODD, P },
+                [C(RESULT_MISS)]        = { 0x1d, CNTR_EVEN, P },
        },
 },
 [C(ITLB)] = {
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index c69da3734699..5b28e81d94a0 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -473,7 +473,7 @@ static void __init fill_ipi_map(void)
 {
        int cpu;
-        for (cpu = 0; cpu < NR_CPUS; cpu++) {
+        for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
                fill_ipi_map1(gic_resched_int_base, cpu, GIC_CPU_INT1);
                fill_ipi_map1(gic_call_int_base, cpu, GIC_CPU_INT2);
        }
@@ -574,8 +574,9 @@ void __init arch_init_irq(void)
                /* FIXME */
                int i;
 #if defined(CONFIG_MIPS_MT_SMP)
-                gic_call_int_base = GIC_NUM_INTRS - NR_CPUS;
+                gic_call_int_base = GIC_NUM_INTRS -
-                gic_resched_int_base = gic_call_int_base - NR_CPUS;
+                        (NR_CPUS - nr_cpu_ids) * 2 - nr_cpu_ids;
+                gic_resched_int_base = gic_call_int_base - nr_cpu_ids;
                fill_ipi_map();
 #endif
                gic_init(GIC_BASE_ADDR, GIC_ADDRSPACE_SZ, gic_intr_map,
@@ -599,7 +600,7 @@ void __init arch_init_irq(void)
                printk("CPU%d: status register now %08x\n", smp_processor_id(), read_c0_status());
                write_c0_status(0x1100dc00);
                printk("CPU%d: status register frc %08x\n", smp_processor_id(), read_c0_status());
-                for (i = 0; i < NR_CPUS; i++) {
+                for (i = 0; i < nr_cpu_ids; i++) {
                        arch_init_ipiirq(MIPS_GIC_IRQ_BASE +
                                         GIC_RESCHED_INT(i), &irq_resched);
                        arch_init_ipiirq(MIPS_GIC_IRQ_BASE +
diff --git a/arch/mips/ralink/timer.c b/arch/mips/ralink/timer.c
index e49241a2c39a..202785709441 100644
--- a/arch/mips/ralink/timer.c
+++ b/arch/mips/ralink/timer.c
@@ -126,7 +126,7 @@ static int rt_timer_probe(struct platform_device *pdev)
                return -ENOENT;
        }
-        rt->membase = devm_request_and_ioremap(&pdev->dev, res);
+        rt->membase = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(rt->membase))
                return PTR_ERR(rt->membase);
diff --git a/arch/parisc/configs/712_defconfig b/arch/parisc/configs/712_defconfig
index 0f90569b9d85..9387cc2693f6 100644
--- a/arch/parisc/configs/712_defconfig
+++ b/arch/parisc/configs/712_defconfig
@@ -40,6 +40,8 @@ CONFIG_IP_NF_QUEUE=m
 CONFIG_LLC2=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
diff --git a/arch/parisc/configs/a500_defconfig b/arch/parisc/configs/a500_defconfig
index b647b182dacc..90025322b75e 100644
--- a/arch/parisc/configs/a500_defconfig
+++ b/arch/parisc/configs/a500_defconfig
@@ -79,6 +79,8 @@ CONFIG_IP_DCCP=m
 CONFIG_LLC2=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_BLK_DEV_UMEM=m
diff --git a/arch/parisc/configs/b180_defconfig b/arch/parisc/configs/b180_defconfig
index e289f5bf3148..f1a0c25bef8d 100644
--- a/arch/parisc/configs/b180_defconfig
+++ b/arch/parisc/configs/b180_defconfig
@@ -4,6 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODVERSIONS=y
@@ -27,6 +28,8 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_LRO is not set
 CONFIG_IPV6=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
diff --git a/arch/parisc/configs/c3000_defconfig b/arch/parisc/configs/c3000_defconfig
index 311ca367b622..ec1b014952b6 100644
--- a/arch/parisc/configs/c3000_defconfig
+++ b/arch/parisc/configs/c3000_defconfig
@@ -5,6 +5,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
@@ -39,6 +40,8 @@ CONFIG_NETFILTER_DEBUG=y
 CONFIG_IP_NF_QUEUE=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_BLK_DEV_UMEM=m
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index f11006361297..e1c8d2015c89 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -62,6 +62,8 @@ CONFIG_TIPC=m
 CONFIG_LLC2=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
diff --git a/arch/parisc/configs/default_defconfig b/arch/parisc/configs/default_defconfig
index dfe88f6c95c4..ba61495e1fa4 100644
--- a/arch/parisc/configs/default_defconfig
+++ b/arch/parisc/configs/default_defconfig
@@ -49,6 +49,8 @@ CONFIG_INET6_ESP=y
 CONFIG_INET6_IPCOMP=y
 CONFIG_LLC2=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index b521c0adf4ec..c035673209f7 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -602,7 +602,6 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
        }
 }
-EXPORT_SYMBOL_GPL(flush_cache_page);
 #ifdef CONFIG_PARISC_TMPALIAS
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index 37aabd772fbb..d2d58258aea6 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -195,6 +195,8 @@ common_stext:
        ldw             MEM_PDC_HI(%r0),%r6
        depd            %r6, 31, 32, %r3        /* move to upper word */
+        mfctl           %cr30,%r6               /* PCX-W2 firmware bug */
        ldo             PDC_PSW(%r0),%arg0              /* 21 */
        ldo             PDC_PSW_SET_DEFAULTS(%r0),%arg1 /* 2 */
        ldo             PDC_PSW_WIDE_BIT(%r0),%arg2     /* 2 */
@@ -203,6 +205,8 @@ common_stext:
        copy            %r0,%arg3
 stext_pdc_ret:
+        mtctl           %r6,%cr30               /* restore task thread info */
        /* restore rfi target address*/
        ldd             TI_TASK-THREAD_SZ_ALGN(%sp), %r10
        tophys_r1       %r10
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index bf56e33f8257..2345bdb4d917 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -691,4 +691,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
        if (fp->bpf_func != sk_run_filter)
                module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 9b60a36c348d..2204400d0bd5 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -748,7 +748,9 @@ static inline void pgste_set_key(pte_t *ptep, pgste_t pgste, pte_t entry)
 static inline void pgste_set_pte(pte_t *ptep, pte_t entry)
 {
-        if (!MACHINE_HAS_ESOP && (pte_val(entry) & _PAGE_WRITE)) {
+        if (!MACHINE_HAS_ESOP &&
+            (pte_val(entry) & _PAGE_PRESENT) &&
+            (pte_val(entry) & _PAGE_WRITE)) {
                /*
                 * Without enhanced suppression-on-protection force
                 * the dirty bit on for all writable ptes.
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index 8ad8af915032..819b94d22720 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -71,30 +71,30 @@ static inline void local_tick_enable(unsigned long long comp)
 typedef unsigned long long cycles_t;
-static inline unsigned long long get_tod_clock(void)
-{
-        unsigned long long clk;
-#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
-        asm volatile(".insn s,0xb27c0000,%0" : "=Q" (clk) : : "cc");
-#else
-        asm volatile("stck %0" : "=Q" (clk) : : "cc");
-#endif
-        return clk;
-}
 static inline void get_tod_clock_ext(char *clk)
 {
        asm volatile("stcke %0" : "=Q" (*clk) : : "cc");
 }
-static inline unsigned long long get_tod_clock_xt(void)
+static inline unsigned long long get_tod_clock(void)
 {
        unsigned char clk[16];
        get_tod_clock_ext(clk);
        return *((unsigned long long *)&clk[1]);
 }
+static inline unsigned long long get_tod_clock_fast(void)
+{
+#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
+        unsigned long long clk;
+        asm volatile("stckf %0" : "=Q" (clk) : : "cc");
+        return clk;
+#else
+        return get_tod_clock();
+#endif
+}
 static inline cycles_t get_cycles(void)
 {
        return (cycles_t) get_tod_clock() >> 2;
@@ -125,7 +125,7 @@ extern u64 sched_clock_base_cc;
 */
 static inline unsigned long long get_tod_clock_monotonic(void)
 {
-        return get_tod_clock_xt() - sched_clock_base_cc;
+        return get_tod_clock() - sched_clock_base_cc;
 }
 /**
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 1389b637dae5..adaa9e9478d8 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -99,7 +99,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
                        break;
                }
        }
-        return err;
+        return err ? -EFAULT : 0;
 }
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
@@ -148,7 +148,7 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
                        break;
                }
        }
-        return err;
+        return err ? -EFAULT : 0;
 }
 static int save_sigregs32(struct pt_regs *regs, _sigregs32 __user *sregs)
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index f1279dc2e1bc..17d62fe5d7b7 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -867,7 +867,7 @@ static inline void
 debug_finish_entry(debug_info_t * id, debug_entry_t* active, int level,
                        int exception)
 {
-        active->id.stck = get_tod_clock();
+        active->id.stck = get_tod_clock_fast();
        active->id.fields.cpuid = smp_processor_id();
        active->caller = __builtin_return_address(0);
        active->id.fields.exception = exception;
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 7f35cb33e510..7f1f7ac5cf7f 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -385,7 +385,7 @@ static int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu)
        }
        if ((!rc) && (vcpu->arch.sie_block->ckc <
-                get_tod_clock() + vcpu->arch.sie_block->epoch)) {
+                get_tod_clock_fast() + vcpu->arch.sie_block->epoch)) {
                if ((!psw_extint_disabled(vcpu)) &&
                        (vcpu->arch.sie_block->gcr[0] & 0x800ul))
                        rc = 1;
@@ -425,7 +425,7 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
                goto no_timer;
        }
-        now = get_tod_clock() + vcpu->arch.sie_block->epoch;
+        now = get_tod_clock_fast() + vcpu->arch.sie_block->epoch;
        if (vcpu->arch.sie_block->ckc < now) {
                __unset_cpu_idle(vcpu);
                return 0;
@@ -515,7 +515,7 @@ void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
        }
        if ((vcpu->arch.sie_block->ckc <
-                get_tod_clock() + vcpu->arch.sie_block->epoch))
+                get_tod_clock_fast() + vcpu->arch.sie_block->epoch))
                __try_deliver_ckc_interrupt(vcpu);
        if (atomic_read(&fi->active)) {
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index 57c87d7d7ede..a9f3d0042d58 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -44,7 +44,7 @@ static void __udelay_disabled(unsigned long long usecs)
        do {
                set_clock_comparator(end);
                vtime_stop_cpu();
-        } while (get_tod_clock() < end);
+        } while (get_tod_clock_fast() < end);
        lockdep_on();
        __ctl_load(cr0, 0, 0);
        __ctl_load(cr6, 6, 6);
@@ -55,7 +55,7 @@ static void __udelay_enabled(unsigned long long usecs)
 {
        u64 clock_saved, end;
-        end = get_tod_clock() + (usecs << 12);
+        end = get_tod_clock_fast() + (usecs << 12);
        do {
                clock_saved = 0;
                if (end < S390_lowcore.clock_comparator) {
@@ -65,7 +65,7 @@ static void __udelay_enabled(unsigned long long usecs)
                vtime_stop_cpu();
                if (clock_saved)
                        local_tick_enable(clock_saved);
-        } while (get_tod_clock() < end);
+        } while (get_tod_clock_fast() < end);
 }
 /*
@@ -109,8 +109,8 @@ void udelay_simple(unsigned long long usecs)
 {
        u64 end;
-        end = get_tod_clock() + (usecs << 12);
+        end = get_tod_clock_fast() + (usecs << 12);
-        while (get_tod_clock() < end)
+        while (get_tod_clock_fast() < end)
                cpu_relax();
 }
@@ -120,10 +120,10 @@ void __ndelay(unsigned long long nsecs)
        nsecs <<= 9;
        do_div(nsecs, 125);
-        end = get_tod_clock() + nsecs;
+        end = get_tod_clock_fast() + nsecs;
        if (nsecs & ~0xfffUL)
                __udelay(nsecs >> 12);
-        while (get_tod_clock() < end)
+        while (get_tod_clock_fast() < end)
                barrier();
 }
 EXPORT_SYMBOL(__ndelay);
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 709239285869..a5df511e27a2 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -881,7 +881,9 @@ void bpf_jit_free(struct sk_filter *fp)
        struct bpf_binary_header *header = (void *)addr;
        if (fp->bpf_func == sk_run_filter)
-                return;
+                goto free_filter;
        set_memory_rw(addr, header->pages);
        module_free(NULL, header);
+free_filter:
+        kfree(fp);
 }
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 9c7be59e6f5a..218b6b23c378 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -808,4 +808,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
        if (fp->bpf_func != sk_run_filter)
                module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/um/kernel/exitcode.c b/arch/um/kernel/exitcode.c
index 829df49dee99..41ebbfebb333 100644
--- a/arch/um/kernel/exitcode.c
+++ b/arch/um/kernel/exitcode.c
@@ -40,9 +40,11 @@ static ssize_t exitcode_proc_write(struct file *file,
                const char __user *buffer, size_t count, loff_t *pos)
 {
        char *end, buf[sizeof("nnnnn\0")];
+        size_t size;
        int tmp;
-        if (copy_from_user(buf, buffer, count))
+        size = min(count, sizeof(buf));
+        if (copy_from_user(buf, buffer, size))
                return -EFAULT;
        tmp = simple_strtol(buf, &end, 0);
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 0da5200ee79d..b3e18f800302 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -128,7 +128,8 @@ do {							\
 do {                                                                    \
        typedef typeof(var) pao_T__;                                    \
        const int pao_ID__ = (__builtin_constant_p(val) &&              \
-                              ((val) == 1 || (val) == -1)) ? (val) : 0; \
+                              ((val) == 1 || (val) == -1)) ?            \
+                                (int)(val) : 0;                         \
        if (0) {                                                        \
                pao_T__ pao_tmp__;                                      \
                pao_tmp__ = (val);                                      \
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 9d8449158cf9..8a87a3224121 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1276,16 +1276,16 @@ void perf_events_lapic_init(void)
 static int __kprobes
 perf_event_nmi_handler(unsigned int cmd, struct pt_regs *regs)
 {
-        int ret;
        u64 start_clock;
        u64 finish_clock;
+        int ret;
        if (!atomic_read(&active_events))
                return NMI_DONE;
-        start_clock = local_clock();
+        start_clock = sched_clock();
        ret = x86_pmu.handle_irq(regs);
-        finish_clock = local_clock();
+        finish_clock = sched_clock();
        perf_sample_event_took(finish_clock - start_clock);
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index a0e2a8a80c94..b2046e4d0b59 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -609,7 +609,7 @@ static struct dentry *d_kvm_debug;
 struct dentry *kvm_init_debugfs(void)
 {
-        d_kvm_debug = debugfs_create_dir("kvm", NULL);
+        d_kvm_debug = debugfs_create_dir("kvm-guest", NULL);
        if (!d_kvm_debug)
                printk(KERN_WARNING "Could not create 'kvm' debugfs directory\n");
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index ba77ebc2c353..6fcb49ce50a1 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -113,10 +113,10 @@ static int __kprobes nmi_handle(unsigned int type, struct pt_regs *regs, bool b2
                u64 before, delta, whole_msecs;
                int remainder_ns, decimal_msecs, thishandled;
-                before = local_clock();
+                before = sched_clock();
                thishandled = a->handler(type, regs);
                handled += thishandled;
-                delta = local_clock() - before;
+                delta = sched_clock() - before;
                trace_nmi_handler(a->handler, (int)delta, thishandled);
                if (delta < nmi_longest_ns)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 79c216aa0e2b..516593e1ce33 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -772,13 +772,21 @@ out:
        return;
 }
+static void bpf_jit_free_deferred(struct work_struct *work)
+{
+        struct sk_filter *fp = container_of(work, struct sk_filter, work);
+        unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
+        struct bpf_binary_header *header = (void *)addr;
+        set_memory_rw(addr, header->pages);
+        module_free(NULL, header);
+        kfree(fp);
+}
 void bpf_jit_free(struct sk_filter *fp)
 {
        if (fp->bpf_func != sk_run_filter) {
-                unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
+                INIT_WORK(&fp->work, bpf_jit_free_deferred);
-                struct bpf_binary_header *header = (void *)addr;
+                schedule_work(&fp->work);
-                set_memory_rw(addr, header->pages);
-                module_free(NULL, header);
        }
 }
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index de1dfa18d0a1..21dbe6bdb8ed 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1122,7 +1122,7 @@ ENDPROC(fast_syscall_spill_registers)
 * a3: exctable, original value in excsave1
 */
-fast_syscall_spill_registers_fixup:
+ENTRY(fast_syscall_spill_registers_fixup)
        rsr     a2, windowbase  # get current windowbase (a2 is saved)
        xsr     a0, depc        # restore depc and a0
@@ -1134,22 +1134,26 @@ fast_syscall_spill_registers_fixup:
         */
        xsr     a3, excsave1    # get spill-mask
-        slli    a2, a3, 1       # shift left by one
+        slli    a3, a3, 1       # shift left by one
-        slli    a3, a2, 32-WSBITS
+        slli    a2, a3, 32-WSBITS
-        src     a2, a2, a3      # a1 = xxwww1yyxxxwww1yy......
+        src     a2, a3, a2      # a2 = xxwww1yyxxxwww1yy......
        wsr     a2, windowstart # set corrected windowstart
-        rsr     a3, excsave1
+        srli    a3, a3, 1
-        l32i    a2, a3, EXC_TABLE_DOUBLE_SAVE   # restore a2
+        rsr     a2, excsave1
-        l32i    a3, a3, EXC_TABLE_PARAM # original WB (in user task)
+        l32i    a2, a2, EXC_TABLE_DOUBLE_SAVE   # restore a2
+        xsr     a2, excsave1
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE   # save a3
+        l32i    a3, a2, EXC_TABLE_PARAM # original WB (in user task)
+        xsr     a2, excsave1
        /* Return to the original (user task) WINDOWBASE.
         * We leave the following frame behind:
         * a0, a1, a2   same
-         * a3:          trashed (saved in excsave_1)
+         * a3:          trashed (saved in EXC_TABLE_DOUBLE_SAVE)
         * depc:        depc (we have to return to that address)
-         * excsave_1:   a3
+         * excsave_1:   exctable
         */
        wsr     a3, windowbase
@@ -1159,9 +1163,9 @@ fast_syscall_spill_registers_fixup:
         *  a0: return address
         *  a1: used, stack pointer
         *  a2: kernel stack pointer
-         *  a3: available, saved in EXCSAVE_1
+         *  a3: available
         *  depc: exception address
-         *  excsave: a3
+         *  excsave: exctable
         * Note: This frame might be the same as above.
         */
@@ -1181,9 +1185,12 @@ fast_syscall_spill_registers_fixup:
        rsr     a0, exccause
        addx4   a0, a0, a3                      # find entry in table
        l32i    a0, a0, EXC_TABLE_FAST_USER     # load handler
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
        jx      a0
-fast_syscall_spill_registers_fixup_return:
+ENDPROC(fast_syscall_spill_registers_fixup)
+ENTRY(fast_syscall_spill_registers_fixup_return)
        /* When we return here, all registers have been restored (a2: DEPC) */
@@ -1191,13 +1198,13 @@ fast_syscall_spill_registers_fixup_return:
        /* Restore fixup handler. */
-        xsr     a3, excsave1
+        rsr     a2, excsave1
-        movi    a2, fast_syscall_spill_registers_fixup
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE
-        s32i    a2, a3, EXC_TABLE_FIXUP
+        movi    a3, fast_syscall_spill_registers_fixup
-        s32i    a0, a3, EXC_TABLE_DOUBLE_SAVE
+        s32i    a3, a2, EXC_TABLE_FIXUP
-        rsr     a2, windowbase
+        rsr     a3, windowbase
-        s32i    a2, a3, EXC_TABLE_PARAM
+        s32i    a3, a2, EXC_TABLE_PARAM
-        l32i    a2, a3, EXC_TABLE_KSTK
+        l32i    a2, a2, EXC_TABLE_KSTK
        /* Load WB at the time the exception occurred. */
@@ -1206,8 +1213,12 @@ fast_syscall_spill_registers_fixup_return:
        wsr     a3, windowbase
        rsync
+        rsr     a3, excsave1
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
        rfde
+ENDPROC(fast_syscall_spill_registers_fixup_return)
 /*
 * spill all registers.
diff --git a/arch/xtensa/kernel/signal.c b/arch/xtensa/kernel/signal.c
index 718eca1850bd..98b67d5f1514 100644
--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -341,7 +341,7 @@ static int setup_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        sp = regs->areg[1];
-        if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && ! on_sig_stack(sp)) {
+        if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && sas_ss_flags(sp) == 0) {
                sp = current->sas_ss_sp + current->sas_ss_size;
        }
diff --git a/arch/xtensa/platforms/iss/network.c b/arch/xtensa/platforms/iss/network.c
index 56f88b7afe2f..e9e1aad8c271 100644
--- a/arch/xtensa/platforms/iss/network.c
+++ b/arch/xtensa/platforms/iss/network.c
@@ -737,7 +737,8 @@ static int __init iss_net_setup(char *str)
                return 1;
        }
-        if ((new = alloc_bootmem(sizeof new)) == NULL) {
+        new = alloc_bootmem(sizeof(*new));
+        if (new == NULL) {
                printk("Alloc_bootmem failed\n");
                return 1;
        }
diff --git a/drivers/Kconfig b/drivers/Kconfig
index aa43b911ccef..8f451449abd3 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -166,4 +166,6 @@ source "drivers/reset/Kconfig"
 source "drivers/fmc/Kconfig"
+source "drivers/phy/Kconfig"
 endmenu
diff --git a/drivers/Makefile b/drivers/Makefile
index ab93de8297f1..687da899cadb 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -8,6 +8,8 @@
 obj-y                           += irqchip/
 obj-y                           += bus/
+obj-$(CONFIG_GENERIC_PHY)       += phy/
 # GPIO must come after pinctrl as gpios may need to mux pins etc
 obj-y                           += pinctrl/
 obj-y                           += gpio/
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 9d715ae5ff6b..8e28f923cf7f 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1343,7 +1343,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                host->flags |= ATA_HOST_PARALLEL_SCAN;
        else
-                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
+                dev_info(&pdev->dev, "SSS flag set, parallel bus scan disabled\n");
        if (pi.flags & ATA_FLAG_EM)
                ahci_reset_em(host);
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 2daaee05cab1..7d3b85385bfc 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -184,7 +184,7 @@ static int ahci_probe(struct platform_device *pdev)
        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                host->flags |= ATA_HOST_PARALLEL_SCAN;
        else
-                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
+                dev_info(dev, "SSS flag set, parallel bus scan disabled\n");
        if (pi.flags & ATA_FLAG_EM)
                ahci_reset_em(host);
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index acfd0f711069..aaac4fb0d564 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -778,8 +778,16 @@ static void ahci_start_port(struct ata_port *ap)
                                rc = ap->ops->transmit_led_message(ap,
                                                               emp->led_state,
                                                               4);
+                                /*
+                                 * If busy, give a breather but do not
+                                 * release EH ownership by using msleep()
+                                 * instead of ata_msleep().  EM Transmit
+                                 * bit is busy for the whole host and
+                                 * releasing ownership will cause other
+                                 * ports to fail the same way.
+                                 */
                                if (rc == -EBUSY)
-                                        ata_msleep(ap, 1);
+                                        msleep(1);
                                else
                                        break;
                        }
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index c69fcce505c0..370462fa8e01 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1322,14 +1322,14 @@ void ata_eh_qc_complete(struct ata_queued_cmd *qc)
 *      should be retried.  To be used from EH.
 *
 *      SCSI midlayer limits the number of retries to scmd->allowed.
- *      scmd->retries is decremented for commands which get retried
+ *      scmd->allowed is incremented for commands which get retried
 *      due to unrelated failures (qc->err_mask is zero).
 */
 void ata_eh_qc_retry(struct ata_queued_cmd *qc)
 {
        struct scsi_cmnd *scmd = qc->scsicmd;
-        if (!qc->err_mask && scmd->retries)
+        if (!qc->err_mask)
-                scmd->retries--;
+                scmd->allowed++;
        __ata_eh_qc_complete(qc);
 }
diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
index 4bceb8803a10..b33d1f99b3a4 100644
--- a/drivers/ata/pata_isapnp.c
+++ b/drivers/ata/pata_isapnp.c
@@ -78,7 +78,7 @@ static int isapnp_init_one(struct pnp_dev *idev, const struct pnp_device_id *dev
        ap->ioaddr.cmd_addr = cmd_addr;
-        if (pnp_port_valid(idev, 1) == 0) {
+        if (pnp_port_valid(idev, 1)) {
                ctl_addr = devm_ioport_map(&idev->dev,
                                           pnp_port_start(idev, 1), 1);
                ap->ioaddr.altstatus_addr = ctl_addr;
diff --git a/drivers/clk/clk-nomadik.c b/drivers/clk/clk-nomadik.c
index 51410c2ac2cb..4d978a3c88f7 100644
--- a/drivers/clk/clk-nomadik.c
+++ b/drivers/clk/clk-nomadik.c
@@ -27,6 +27,14 @@
 */
 #define SRC_CR                  0x00U
+#define SRC_CR_T0_ENSEL         BIT(15)
+#define SRC_CR_T1_ENSEL         BIT(17)
+#define SRC_CR_T2_ENSEL         BIT(19)
+#define SRC_CR_T3_ENSEL         BIT(21)
+#define SRC_CR_T4_ENSEL         BIT(23)
+#define SRC_CR_T5_ENSEL         BIT(25)
+#define SRC_CR_T6_ENSEL         BIT(27)
+#define SRC_CR_T7_ENSEL         BIT(29)
 #define SRC_XTALCR              0x0CU
 #define SRC_XTALCR_XTALTIMEN    BIT(20)
 #define SRC_XTALCR_SXTALDIS     BIT(19)
@@ -543,6 +551,19 @@ void __init nomadik_clk_init(void)
                       __func__, np->name);
                return;
        }
+        /* Set all timers to use the 2.4 MHz TIMCLK */
+        val = readl(src_base + SRC_CR);
+        val |= SRC_CR_T0_ENSEL;
+        val |= SRC_CR_T1_ENSEL;
+        val |= SRC_CR_T2_ENSEL;
+        val |= SRC_CR_T3_ENSEL;
+        val |= SRC_CR_T4_ENSEL;
+        val |= SRC_CR_T5_ENSEL;
+        val |= SRC_CR_T6_ENSEL;
+        val |= SRC_CR_T7_ENSEL;
+        writel(val, src_base + SRC_CR);
        val = readl(src_base + SRC_XTALCR);
        pr_info("SXTALO is %s\n",
                (val & SRC_XTALCR_SXTALDIS) ? "disabled" : "enabled");
diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
index fc777bdc1886..81a202d12a7a 100644
--- a/drivers/clk/mvebu/armada-370.c
+++ b/drivers/clk/mvebu/armada-370.c
@@ -39,8 +39,8 @@ static const struct coreclk_ratio a370_coreclk_ratios[] __initconst = {
 };
 static const u32 a370_tclk_freqs[] __initconst = {
-        16600000,
+        166000000,
-        20000000,
+        200000000,
 };
 static u32 __init a370_get_tclk_freq(void __iomem *sar)
diff --git a/drivers/clk/socfpga/clk.c b/drivers/clk/socfpga/clk.c
index 5bb848cac6ec..81dd31a686df 100644
--- a/drivers/clk/socfpga/clk.c
+++ b/drivers/clk/socfpga/clk.c
@@ -49,7 +49,7 @@
 #define SOCFPGA_L4_SP_CLK               "l4_sp_clk"
 #define SOCFPGA_NAND_CLK                "nand_clk"
 #define SOCFPGA_NAND_X_CLK              "nand_x_clk"
-#define SOCFPGA_MMC_CLK                 "mmc_clk"
+#define SOCFPGA_MMC_CLK                 "sdmmc_clk"
 #define SOCFPGA_DB_CLK                  "gpio_db_clk"
 #define div_mask(width) ((1 << (width)) - 1)
diff --git a/drivers/clk/versatile/clk-icst.c b/drivers/clk/versatile/clk-icst.c
index 67ccf4aa7277..f5e4c21b301f 100644
--- a/drivers/clk/versatile/clk-icst.c
+++ b/drivers/clk/versatile/clk-icst.c
@@ -107,7 +107,7 @@ static int icst_set_rate(struct clk_hw *hw, unsigned long rate,
        vco = icst_hz_to_vco(icst->params, rate);
        icst->rate = icst_hz(icst->params, vco);
-        vco_set(icst->vcoreg, icst->lockreg, vco);
+        vco_set(icst->lockreg, icst->vcoreg, vco);
        return 0;
 }
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 08ae128cce9b..c73fc2b74de2 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -65,6 +65,7 @@ void proc_fork_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -80,6 +81,7 @@ void proc_fork_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        /*  If cn_netlink_send() failed, the data is not sent */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -96,6 +98,7 @@ void proc_exec_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -106,6 +109,7 @@ void proc_exec_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -122,6 +126,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        ev->what = which_id;
        ev->event_data.id.process_pid = task->pid;
        ev->event_data.id.process_tgid = task->tgid;
@@ -145,6 +150,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -160,6 +166,7 @@ void proc_sid_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -170,6 +177,7 @@ void proc_sid_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -185,6 +193,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -203,6 +212,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -218,6 +228,7 @@ void proc_comm_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -229,6 +240,7 @@ void proc_comm_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -244,6 +256,7 @@ void proc_coredump_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -254,6 +267,7 @@ void proc_coredump_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -269,6 +283,7 @@ void proc_exit_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -281,6 +296,7 @@ void proc_exit_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -304,6 +320,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        msg->seq = rcvd_seq;
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -313,6 +330,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = rcvd_ack + 1;
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index 6ecfa758942c..a36749f1e44a 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -109,7 +109,7 @@ int cn_netlink_send(struct cn_msg *msg, u32 __group, gfp_t gfp_mask)
        data = nlmsg_data(nlh);
-        memcpy(data, msg, sizeof(*data) + msg->len);
+        memcpy(data, msg, size);
        NETLINK_CB(skb).dst_group = group;
@@ -157,17 +157,18 @@ static int cn_call_callback(struct sk_buff *skb)
 static void cn_rx_skb(struct sk_buff *__skb)
 {
        struct nlmsghdr *nlh;
-        int err;
        struct sk_buff *skb;
+        int len, err;
        skb = skb_get(__skb);
        if (skb->len >= NLMSG_HDRLEN) {
                nlh = nlmsg_hdr(skb);
+                len = nlmsg_len(nlh);
-                if (nlh->nlmsg_len < sizeof(struct cn_msg) ||
+                if (len < (int)sizeof(struct cn_msg) ||
                    skb->len < nlh->nlmsg_len ||
-                    nlh->nlmsg_len > CONNECTOR_MAX_MSG_SIZE) {
+                    len > CONNECTOR_MAX_MSG_SIZE) {
                        kfree_skb(skb);
                        return;
                }
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index d2c3253e015e..506fd23c7550 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -986,12 +986,12 @@ static int __init acpi_cpufreq_init(void)
 {
        int ret;
+        if (acpi_disabled)
+                return -ENODEV;
        /* don't keep reloading if cpufreq_driver exists */
        if (cpufreq_get_current_driver())
-                return 0;
+                return -EEXIST;
-        if (acpi_disabled)
-                return 0;
        pr_debug("acpi_cpufreq_init\n");
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index badf6206b2b2..eb3fdc755000 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -48,7 +48,7 @@ static inline int32_t div_fp(int32_t x, int32_t y)
 }
 struct sample {
-        int core_pct_busy;
+        int32_t core_pct_busy;
        u64 aperf;
        u64 mperf;
        int freq;
@@ -68,7 +68,7 @@ struct _pid {
        int32_t i_gain;
        int32_t d_gain;
        int deadband;
-        int last_err;
+        int32_t last_err;
 };
 struct cpudata {
@@ -153,16 +153,15 @@ static inline void pid_d_gain_set(struct _pid *pid, int percent)
        pid->d_gain = div_fp(int_tofp(percent), int_tofp(100));
 }
-static signed int pid_calc(struct _pid *pid, int busy)
+static signed int pid_calc(struct _pid *pid, int32_t busy)
 {
-        signed int err, result;
+        signed int result;
        int32_t pterm, dterm, fp_error;
        int32_t integral_limit;
-        err = pid->setpoint - busy;
+        fp_error = int_tofp(pid->setpoint) - busy;
-        fp_error = int_tofp(err);
-        if (abs(err) <= pid->deadband)
+        if (abs(fp_error) <= int_tofp(pid->deadband))
                return 0;
        pterm = mul_fp(pid->p_gain, fp_error);
@@ -176,8 +175,8 @@ static signed int pid_calc(struct _pid *pid, int busy)
        if (pid->integral < -integral_limit)
                pid->integral = -integral_limit;
-        dterm = mul_fp(pid->d_gain, (err - pid->last_err));
+        dterm = mul_fp(pid->d_gain, fp_error - pid->last_err);
-        pid->last_err = err;
+        pid->last_err = fp_error;
        result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
@@ -367,12 +366,13 @@ static int intel_pstate_turbo_pstate(void)
 static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
 {
        int max_perf = cpu->pstate.turbo_pstate;
+        int max_perf_adj;
        int min_perf;
        if (limits.no_turbo)
                max_perf = cpu->pstate.max_pstate;
-        max_perf = fp_toint(mul_fp(int_tofp(max_perf), limits.max_perf));
+        max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf), limits.max_perf));
-        *max = clamp_t(int, max_perf,
+        *max = clamp_t(int, max_perf_adj,
                        cpu->pstate.min_pstate, cpu->pstate.turbo_pstate);
        min_perf = fp_toint(mul_fp(int_tofp(max_perf), limits.min_perf));
@@ -436,8 +436,9 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu,
                                        struct sample *sample)
 {
        u64 core_pct;
-        core_pct = div64_u64(sample->aperf * 100, sample->mperf);
+        core_pct = div64_u64(int_tofp(sample->aperf * 100),
-        sample->freq = cpu->pstate.max_pstate * core_pct * 1000;
+                             sample->mperf);
+        sample->freq = fp_toint(cpu->pstate.max_pstate * core_pct * 1000);
        sample->core_pct_busy = core_pct;
 }
@@ -469,22 +470,19 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
        mod_timer_pinned(&cpu->timer, jiffies + delay);
 }
-static inline int intel_pstate_get_scaled_busy(struct cpudata *cpu)
+static inline int32_t intel_pstate_get_scaled_busy(struct cpudata *cpu)
 {
-        int32_t busy_scaled;
        int32_t core_busy, max_pstate, current_pstate;
-        core_busy = int_tofp(cpu->samples[cpu->sample_ptr].core_pct_busy);
+        core_busy = cpu->samples[cpu->sample_ptr].core_pct_busy;
        max_pstate = int_tofp(cpu->pstate.max_pstate);
        current_pstate = int_tofp(cpu->pstate.current_pstate);
-        busy_scaled = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
+        return mul_fp(core_busy, div_fp(max_pstate, current_pstate));
-        return fp_toint(busy_scaled);
 }
 static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
 {
-        int busy_scaled;
+        int32_t busy_scaled;
        struct _pid *pid;
        signed int ctl = 0;
        int steps;
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 3519111c566b..10b577fcf48d 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -305,6 +305,7 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                                edma_alloc_slot(EDMA_CTLR(echan->ch_num),
                                                EDMA_SLOT_ANY);
                        if (echan->slot[i] < 0) {
+                                kfree(edesc);
                                dev_err(dev, "Failed to allocate slot\n");
                                kfree(edesc);
                                return NULL;
@@ -346,6 +347,7 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                        ccnt = sg_dma_len(sg) / (acnt * bcnt);
                        if (ccnt > (SZ_64K - 1)) {
                                dev_err(dev, "Exceeded max SG segment size\n");
+                                kfree(edesc);
                                return NULL;
                        }
                        cidx = acnt * bcnt;
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index e572dd20bdee..fe58d0833a11 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -61,7 +61,7 @@ static int drm_version(struct drm_device *dev, void *data,
 /** Ioctl table */
 static const struct drm_ioctl_desc drm_ioctls[] = {
-        DRM_IOCTL_DEF(DRM_IOCTL_VERSION, drm_version, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_IOCTL_VERSION, drm_version, DRM_UNLOCKED|DRM_RENDER_ALLOW),
        DRM_IOCTL_DEF(DRM_IOCTL_GET_UNIQUE, drm_getunique, 0),
        DRM_IOCTL_DEF(DRM_IOCTL_GET_MAGIC, drm_getmagic, 0),
        DRM_IOCTL_DEF(DRM_IOCTL_IRQ_BUSID, drm_irq_by_busid, DRM_MASTER|DRM_ROOT_ONLY),
@@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp,
                cmd = ioctl->cmd_drv;
        }
        else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
+                u32 drv_size;
                ioctl = &drm_ioctls[nr];
-                cmd = ioctl->cmd;
+                drv_size = _IOC_SIZE(ioctl->cmd);
                usize = asize = _IOC_SIZE(cmd);
+                if (drv_size > asize)
+                        asize = drv_size;
+                cmd = ioctl->cmd;
        } else
                goto err_i1;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 69d8ed5416c3..2ad27880cd04 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -505,6 +505,8 @@ static int i915_drm_freeze(struct drm_device *dev)
                intel_modeset_suspend_hw(dev);
        }
+        i915_gem_suspend_gtt_mappings(dev);
        i915_save_state(dev);
        intel_opregion_fini(dev);
@@ -648,7 +650,8 @@ static int i915_drm_thaw(struct drm_device *dev)
                mutex_lock(&dev->struct_mutex);
                i915_gem_restore_gtt_mappings(dev);
                mutex_unlock(&dev->struct_mutex);
-        }
+        } else if (drm_core_check_feature(dev, DRIVER_MODESET))
+                i915_check_and_clear_faults(dev);
        __i915_drm_thaw(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 35874b3a86dc..ab0f2c0a440c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -497,10 +497,12 @@ struct i915_address_space {
        /* FIXME: Need a more generic return type */
        gen6_gtt_pte_t (*pte_encode)(dma_addr_t addr,
-                                     enum i915_cache_level level);
+                                     enum i915_cache_level level,
+                                     bool valid); /* Create a valid PTE */
        void (*clear_range)(struct i915_address_space *vm,
                            unsigned int first_entry,
-                            unsigned int num_entries);
+                            unsigned int num_entries,
+                            bool use_scratch);
        void (*insert_entries)(struct i915_address_space *vm,
                               struct sg_table *st,
                               unsigned int first_entry,
@@ -2065,6 +2067,8 @@ void i915_ppgtt_bind_object(struct i915_hw_ppgtt *ppgtt,
 void i915_ppgtt_unbind_object(struct i915_hw_ppgtt *ppgtt,
                              struct drm_i915_gem_object *obj);
+void i915_check_and_clear_faults(struct drm_device *dev);
+void i915_gem_suspend_gtt_mappings(struct drm_device *dev);
 void i915_gem_restore_gtt_mappings(struct drm_device *dev);
 int __must_check i915_gem_gtt_prepare_object(struct drm_i915_gem_object *obj);
 void i915_gem_gtt_bind_object(struct drm_i915_gem_object *obj,
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 212f6d8c35ec..1f7b4caefb6e 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -58,9 +58,10 @@
 #define HSW_WT_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0x6)
 static gen6_gtt_pte_t snb_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -79,9 +80,10 @@ static gen6_gtt_pte_t snb_pte_encode(dma_addr_t addr,
 }
 static gen6_gtt_pte_t ivb_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -105,9 +107,10 @@ static gen6_gtt_pte_t ivb_pte_encode(dma_addr_t addr,
 #define BYT_PTE_SNOOPED_BY_CPU_CACHES   (1 << 2)
 static gen6_gtt_pte_t byt_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        /* Mark the page as writeable.  Other platforms don't have a
@@ -122,9 +125,10 @@ static gen6_gtt_pte_t byt_pte_encode(dma_addr_t addr,
 }
 static gen6_gtt_pte_t hsw_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= HSW_PTE_ADDR_ENCODE(addr);
        if (level != I915_CACHE_NONE)
@@ -134,9 +138,10 @@ static gen6_gtt_pte_t hsw_pte_encode(dma_addr_t addr,
 }
 static gen6_gtt_pte_t iris_pte_encode(dma_addr_t addr,
-                                      enum i915_cache_level level)
+                                      enum i915_cache_level level,
+                                      bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= HSW_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -236,7 +241,8 @@ static int gen6_ppgtt_enable(struct drm_device *dev)
 /* PPGTT support for Sandybdrige/Gen6 and later */
 static void gen6_ppgtt_clear_range(struct i915_address_space *vm,
                                   unsigned first_entry,
-                                   unsigned num_entries)
+                                   unsigned num_entries,
+                                   bool use_scratch)
 {
        struct i915_hw_ppgtt *ppgtt =
                container_of(vm, struct i915_hw_ppgtt, base);
@@ -245,7 +251,7 @@ static void gen6_ppgtt_clear_range(struct i915_address_space *vm,
        unsigned first_pte = first_entry % I915_PPGTT_PT_ENTRIES;
        unsigned last_pte, i;
-        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC);
+        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC, true);
        while (num_entries) {
                last_pte = first_pte + num_entries;
@@ -282,7 +288,7 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
                dma_addr_t page_addr;
                page_addr = sg_page_iter_dma_address(&sg_iter);
-                pt_vaddr[act_pte] = vm->pte_encode(page_addr, cache_level);
+                pt_vaddr[act_pte] = vm->pte_encode(page_addr, cache_level, true);
                if (++act_pte == I915_PPGTT_PT_ENTRIES) {
                        kunmap_atomic(pt_vaddr);
                        act_pt++;
@@ -367,7 +373,7 @@ static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt)
        }
        ppgtt->base.clear_range(&ppgtt->base, 0,
-                                ppgtt->num_pd_entries * I915_PPGTT_PT_ENTRIES);
+                                ppgtt->num_pd_entries * I915_PPGTT_PT_ENTRIES, true);
        ppgtt->pd_offset = first_pd_entry_in_global_pt * sizeof(gen6_gtt_pte_t);
@@ -444,7 +450,8 @@ void i915_ppgtt_unbind_object(struct i915_hw_ppgtt *ppgtt,
 {
        ppgtt->base.clear_range(&ppgtt->base,
                                i915_gem_obj_ggtt_offset(obj) >> PAGE_SHIFT,
-                                obj->base.size >> PAGE_SHIFT);
+                                obj->base.size >> PAGE_SHIFT,
+                                true);
 }
 extern int intel_iommu_gfx_mapped;
@@ -485,15 +492,65 @@ static void undo_idling(struct drm_i915_private *dev_priv, bool interruptible)
                dev_priv->mm.interruptible = interruptible;
 }
+void i915_check_and_clear_faults(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring;
+        int i;
+        if (INTEL_INFO(dev)->gen < 6)
+                return;
+        for_each_ring(ring, dev_priv, i) {
+                u32 fault_reg;
+                fault_reg = I915_READ(RING_FAULT_REG(ring));
+                if (fault_reg & RING_FAULT_VALID) {
+                        DRM_DEBUG_DRIVER("Unexpected fault\n"
+                                         "\tAddr: 0x%08lx\\n"
+                                         "\tAddress space: %s\n"
+                                         "\tSource ID: %d\n"
+                                         "\tType: %d\n",
+                                         fault_reg & PAGE_MASK,
+                                         fault_reg & RING_FAULT_GTTSEL_MASK ? "GGTT" : "PPGTT",
+                                         RING_FAULT_SRCID(fault_reg),
+                                         RING_FAULT_FAULT_TYPE(fault_reg));
+                        I915_WRITE(RING_FAULT_REG(ring),
+                                   fault_reg & ~RING_FAULT_VALID);
+                }
+        }
+        POSTING_READ(RING_FAULT_REG(&dev_priv->ring[RCS]));
+}
+void i915_gem_suspend_gtt_mappings(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        /* Don't bother messing with faults pre GEN6 as we have little
+         * documentation supporting that it's a good idea.
+         */
+        if (INTEL_INFO(dev)->gen < 6)
+                return;
+        i915_check_and_clear_faults(dev);
+        dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
+                                       dev_priv->gtt.base.start / PAGE_SIZE,
+                                       dev_priv->gtt.base.total / PAGE_SIZE,
+                                       false);
+}
 void i915_gem_restore_gtt_mappings(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj;
+        i915_check_and_clear_faults(dev);
        /* First fill our portion of the GTT with scratch pages */
        dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
                                       dev_priv->gtt.base.start / PAGE_SIZE,
-                                       dev_priv->gtt.base.total / PAGE_SIZE);
+                                       dev_priv->gtt.base.total / PAGE_SIZE,
+                                       true);
        list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list) {
                i915_gem_clflush_object(obj, obj->pin_display);
@@ -536,7 +593,7 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
        for_each_sg_page(st->sgl, &sg_iter, st->nents, 0) {
                addr = sg_page_iter_dma_address(&sg_iter);
-                iowrite32(vm->pte_encode(addr, level), &gtt_entries[i]);
+                iowrite32(vm->pte_encode(addr, level, true), &gtt_entries[i]);
                i++;
        }
@@ -548,7 +605,7 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
         */
        if (i != 0)
                WARN_ON(readl(&gtt_entries[i-1]) !=
-                        vm->pte_encode(addr, level));
+                        vm->pte_encode(addr, level, true));
        /* This next bit makes the above posting read even more important. We
         * want to flush the TLBs only after we're certain all the PTE updates
@@ -560,7 +617,8 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
 static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                                  unsigned int first_entry,
-                                  unsigned int num_entries)
+                                  unsigned int num_entries,
+                                  bool use_scratch)
 {
        struct drm_i915_private *dev_priv = vm->dev->dev_private;
        gen6_gtt_pte_t scratch_pte, __iomem *gtt_base =
@@ -573,7 +631,8 @@ static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                 first_entry, num_entries, max_entries))
                num_entries = max_entries;
-        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC);
+        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC, use_scratch);
        for (i = 0; i < num_entries; i++)
                iowrite32(scratch_pte, &gtt_base[i]);
        readl(gtt_base);
@@ -594,7 +653,8 @@ static void i915_ggtt_insert_entries(struct i915_address_space *vm,
 static void i915_ggtt_clear_range(struct i915_address_space *vm,
                                  unsigned int first_entry,
-                                  unsigned int num_entries)
+                                  unsigned int num_entries,
+                                  bool unused)
 {
        intel_gtt_clear_range(first_entry, num_entries);
 }
@@ -622,7 +682,8 @@ void i915_gem_gtt_unbind_object(struct drm_i915_gem_object *obj)
        dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
                                       entry,
-                                       obj->base.size >> PAGE_SHIFT);
+                                       obj->base.size >> PAGE_SHIFT,
+                                       true);
        obj->has_global_gtt_mapping = 0;
 }
@@ -709,11 +770,11 @@ void i915_gem_setup_global_gtt(struct drm_device *dev,
                const unsigned long count = (hole_end - hole_start) / PAGE_SIZE;
                DRM_DEBUG_KMS("clearing unused GTT space: [%lx, %lx]\n",
                              hole_start, hole_end);
-                ggtt_vm->clear_range(ggtt_vm, hole_start / PAGE_SIZE, count);
+                ggtt_vm->clear_range(ggtt_vm, hole_start / PAGE_SIZE, count, true);
        }
        /* And finally clear the reserved guard page */
-        ggtt_vm->clear_range(ggtt_vm, end / PAGE_SIZE - 1, 1);
+        ggtt_vm->clear_range(ggtt_vm, end / PAGE_SIZE - 1, 1, true);
 }
 static bool
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 38f96f65d87a..ef9b35479f01 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -604,6 +604,10 @@
 #define   ARB_MODE_SWIZZLE_IVB  (1<<5)
 #define RENDER_HWS_PGA_GEN7     (0x04080)
 #define RING_FAULT_REG(ring)    (0x4094 + 0x100*(ring)->id)
+#define   RING_FAULT_GTTSEL_MASK (1<<11)
+#define   RING_FAULT_SRCID(x)   ((x >> 3) & 0xff)
+#define   RING_FAULT_FAULT_TYPE(x) ((x >> 1) & 0x3)
+#define   RING_FAULT_VALID      (1<<0)
 #define DONE_REG                0x40b0
 #define BSD_HWS_PGA_GEN7        (0x04180)
 #define BLT_HWS_PGA_GEN7        (0x04280)
@@ -4279,7 +4283,9 @@
 #define FDI_RX_CHICKEN(pipe) _PIPE(pipe, _FDI_RXA_CHICKEN, _FDI_RXB_CHICKEN)
 #define SOUTH_DSPCLK_GATE_D     0xc2020
+#define  PCH_DPLUNIT_CLOCK_GATE_DISABLE (1<<30)
 #define  PCH_DPLSUNIT_CLOCK_GATE_DISABLE (1<<29)
+#define  PCH_CPUNIT_CLOCK_GATE_DISABLE (1<<14)
 #define  PCH_LP_PARTITION_LEVEL_DISABLE  (1<<12)
 /* CPU: FDI_TX */
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index ea9022ef15d5..10d1de5bce6f 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -83,8 +83,7 @@ static bool intel_crt_get_hw_state(struct intel_encoder *encoder,
        return true;
 }
-static void intel_crt_get_config(struct intel_encoder *encoder,
+static unsigned int intel_crt_get_flags(struct intel_encoder *encoder)
-                                 struct intel_crtc_config *pipe_config)
 {
        struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
        struct intel_crt *crt = intel_encoder_to_crt(encoder);
@@ -102,7 +101,25 @@ static void intel_crt_get_config(struct intel_encoder *encoder,
        else
                flags |= DRM_MODE_FLAG_NVSYNC;
-        pipe_config->adjusted_mode.flags |= flags;
+        return flags;
+}
+static void intel_crt_get_config(struct intel_encoder *encoder,
+                                 struct intel_crtc_config *pipe_config)
+{
+        pipe_config->adjusted_mode.flags |= intel_crt_get_flags(encoder);
+}
+static void hsw_crt_get_config(struct intel_encoder *encoder,
+                               struct intel_crtc_config *pipe_config)
+{
+        intel_ddi_get_config(encoder, pipe_config);
+        pipe_config->adjusted_mode.flags &= ~(DRM_MODE_FLAG_PHSYNC |
+                                              DRM_MODE_FLAG_NHSYNC |
+                                              DRM_MODE_FLAG_PVSYNC |
+                                              DRM_MODE_FLAG_NVSYNC);
+        pipe_config->adjusted_mode.flags |= intel_crt_get_flags(encoder);
 }
 /* Note: The caller is required to filter out dpms modes not supported by the
@@ -799,7 +816,10 @@ void intel_crt_init(struct drm_device *dev)
        crt->base.mode_set = intel_crt_mode_set;
        crt->base.disable = intel_disable_crt;
        crt->base.enable = intel_enable_crt;
-        crt->base.get_config = intel_crt_get_config;
+        if (IS_HASWELL(dev))
+                crt->base.get_config = hsw_crt_get_config;
+        else
+                crt->base.get_config = intel_crt_get_config;
        if (I915_HAS_HOTPLUG(dev))
                crt->base.hpd_pin = HPD_CRT;
        if (HAS_DDI(dev))
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 63de2701b974..b53fff84a7d5 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1249,8 +1249,8 @@ static void intel_ddi_hot_plug(struct intel_encoder *intel_encoder)
                intel_dp_check_link_status(intel_dp);
 }
-static void intel_ddi_get_config(struct intel_encoder *encoder,
+void intel_ddi_get_config(struct intel_encoder *encoder,
-                                 struct intel_crtc_config *pipe_config)
+                          struct intel_crtc_config *pipe_config)
 {
        struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(encoder->base.crtc);
@@ -1268,6 +1268,23 @@ static void intel_ddi_get_config(struct intel_encoder *encoder,
                flags |= DRM_MODE_FLAG_NVSYNC;
        pipe_config->adjusted_mode.flags |= flags;
+        switch (temp & TRANS_DDI_BPC_MASK) {
+        case TRANS_DDI_BPC_6:
+                pipe_config->pipe_bpp = 18;
+                break;
+        case TRANS_DDI_BPC_8:
+                pipe_config->pipe_bpp = 24;
+                break;
+        case TRANS_DDI_BPC_10:
+                pipe_config->pipe_bpp = 30;
+                break;
+        case TRANS_DDI_BPC_12:
+                pipe_config->pipe_bpp = 36;
+                break;
+        default:
+                break;
+        }
 }
 static void intel_ddi_destroy(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 581fb4b2f766..d78d33f9337d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2327,9 +2327,10 @@ static void intel_fdi_normal_train(struct drm_crtc *crtc)
                           FDI_FE_ERRC_ENABLE);
 }
-static bool pipe_has_enabled_pch(struct intel_crtc *intel_crtc)
+static bool pipe_has_enabled_pch(struct intel_crtc *crtc)
 {
-        return intel_crtc->base.enabled && intel_crtc->config.has_pch_encoder;
+        return crtc->base.enabled && crtc->active &&
+                crtc->config.has_pch_encoder;
 }
 static void ivb_modeset_global_resources(struct drm_device *dev)
@@ -2979,6 +2980,48 @@ static void ironlake_pch_transcoder_set_timings(struct intel_crtc *crtc,
                   I915_READ(VSYNCSHIFT(cpu_transcoder)));
 }
+static void cpt_enable_fdi_bc_bifurcation(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        uint32_t temp;
+        temp = I915_READ(SOUTH_CHICKEN1);
+        if (temp & FDI_BC_BIFURCATION_SELECT)
+                return;
+        WARN_ON(I915_READ(FDI_RX_CTL(PIPE_B)) & FDI_RX_ENABLE);
+        WARN_ON(I915_READ(FDI_RX_CTL(PIPE_C)) & FDI_RX_ENABLE);
+        temp |= FDI_BC_BIFURCATION_SELECT;
+        DRM_DEBUG_KMS("enabling fdi C rx\n");
+        I915_WRITE(SOUTH_CHICKEN1, temp);
+        POSTING_READ(SOUTH_CHICKEN1);
+}
+static void ivybridge_update_fdi_bc_bifurcation(struct intel_crtc *intel_crtc)
+{
+        struct drm_device *dev = intel_crtc->base.dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        switch (intel_crtc->pipe) {
+        case PIPE_A:
+                break;
+        case PIPE_B:
+                if (intel_crtc->config.fdi_lanes > 2)
+                        WARN_ON(I915_READ(SOUTH_CHICKEN1) & FDI_BC_BIFURCATION_SELECT);
+                else
+                        cpt_enable_fdi_bc_bifurcation(dev);
+                break;
+        case PIPE_C:
+                cpt_enable_fdi_bc_bifurcation(dev);
+                break;
+        default:
+                BUG();
+        }
+}
 /*
 * Enable PCH resources required for PCH ports:
 *   - PCH PLLs
@@ -2997,6 +3040,9 @@ static void ironlake_pch_enable(struct drm_crtc *crtc)
        assert_pch_transcoder_disabled(dev_priv, pipe);
+        if (IS_IVYBRIDGE(dev))
+                ivybridge_update_fdi_bc_bifurcation(intel_crtc);
        /* Write the TU size bits before fdi link training, so that error
         * detection works. */
        I915_WRITE(FDI_RX_TUSIZE1(pipe),
@@ -4983,6 +5029,22 @@ static bool i9xx_get_pipe_config(struct intel_crtc *crtc,
        if (!(tmp & PIPECONF_ENABLE))
                return false;
+        if (IS_G4X(dev) || IS_VALLEYVIEW(dev)) {
+                switch (tmp & PIPECONF_BPC_MASK) {
+                case PIPECONF_6BPC:
+                        pipe_config->pipe_bpp = 18;
+                        break;
+                case PIPECONF_8BPC:
+                        pipe_config->pipe_bpp = 24;
+                        break;
+                case PIPECONF_10BPC:
+                        pipe_config->pipe_bpp = 30;
+                        break;
+                default:
+                        break;
+                }
+        }
        intel_get_pipe_timings(crtc, pipe_config);
        i9xx_get_pfit_config(crtc, pipe_config);
@@ -5576,48 +5638,6 @@ static bool ironlake_compute_clocks(struct drm_crtc *crtc,
        return true;
 }
-static void cpt_enable_fdi_bc_bifurcation(struct drm_device *dev)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t temp;
-        temp = I915_READ(SOUTH_CHICKEN1);
-        if (temp & FDI_BC_BIFURCATION_SELECT)
-                return;
-        WARN_ON(I915_READ(FDI_RX_CTL(PIPE_B)) & FDI_RX_ENABLE);
-        WARN_ON(I915_READ(FDI_RX_CTL(PIPE_C)) & FDI_RX_ENABLE);
-        temp |= FDI_BC_BIFURCATION_SELECT;
-        DRM_DEBUG_KMS("enabling fdi C rx\n");
-        I915_WRITE(SOUTH_CHICKEN1, temp);
-        POSTING_READ(SOUTH_CHICKEN1);
-}
-static void ivybridge_update_fdi_bc_bifurcation(struct intel_crtc *intel_crtc)
-{
-        struct drm_device *dev = intel_crtc->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        switch (intel_crtc->pipe) {
-        case PIPE_A:
-                break;
-        case PIPE_B:
-                if (intel_crtc->config.fdi_lanes > 2)
-                        WARN_ON(I915_READ(SOUTH_CHICKEN1) & FDI_BC_BIFURCATION_SELECT);
-                else
-                        cpt_enable_fdi_bc_bifurcation(dev);
-                break;
-        case PIPE_C:
-                cpt_enable_fdi_bc_bifurcation(dev);
-                break;
-        default:
-                BUG();
-        }
-}
 int ironlake_get_lanes_required(int target_clock, int link_bw, int bpp)
 {
        /*
@@ -5811,9 +5831,6 @@ static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
                                             &intel_crtc->config.fdi_m_n);
        }
-        if (IS_IVYBRIDGE(dev))
-                ivybridge_update_fdi_bc_bifurcation(intel_crtc);
        ironlake_set_pipeconf(crtc);
        /* Set up the display plane register */
@@ -5881,6 +5898,23 @@ static bool ironlake_get_pipe_config(struct intel_crtc *crtc,
        if (!(tmp & PIPECONF_ENABLE))
                return false;
+        switch (tmp & PIPECONF_BPC_MASK) {
+        case PIPECONF_6BPC:
+                pipe_config->pipe_bpp = 18;
+                break;
+        case PIPECONF_8BPC:
+                pipe_config->pipe_bpp = 24;
+                break;
+        case PIPECONF_10BPC:
+                pipe_config->pipe_bpp = 30;
+                break;
+        case PIPECONF_12BPC:
+                pipe_config->pipe_bpp = 36;
+                break;
+        default:
+                break;
+        }
        if (I915_READ(PCH_TRANSCONF(crtc->pipe)) & TRANS_ENABLE) {
                struct intel_shared_dpll *pll;
@@ -8612,6 +8646,9 @@ intel_pipe_config_compare(struct drm_device *dev,
        PIPE_CONF_CHECK_X(dpll_hw_state.fp0);
        PIPE_CONF_CHECK_X(dpll_hw_state.fp1);
+        if (IS_G4X(dev) || INTEL_INFO(dev)->gen >= 5)
+                PIPE_CONF_CHECK_I(pipe_bpp);
 #undef PIPE_CONF_CHECK_X
 #undef PIPE_CONF_CHECK_I
 #undef PIPE_CONF_CHECK_FLAGS
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 2c555f91bfae..1a431377d83b 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1401,6 +1401,26 @@ static void intel_dp_get_config(struct intel_encoder *encoder,
                else
                        pipe_config->port_clock = 270000;
        }
+        if (is_edp(intel_dp) && dev_priv->vbt.edp_bpp &&
+            pipe_config->pipe_bpp > dev_priv->vbt.edp_bpp) {
+                /*
+                 * This is a big fat ugly hack.
+                 *
+                 * Some machines in UEFI boot mode provide us a VBT that has 18
+                 * bpp and 1.62 GHz link bandwidth for eDP, which for reasons
+                 * unknown we fail to light up. Yet the same BIOS boots up with
+                 * 24 bpp and 2.7 GHz link. Use the same bpp as the BIOS uses as
+                 * max, not what it tells us to use.
+                 *
+                 * Note: This will still be broken if the eDP panel is not lit
+                 * up by the BIOS, and thus we can't get the mode at module
+                 * load.
+                 */
+                DRM_DEBUG_KMS("pipe has %d bpp for eDP panel, overriding BIOS-provided max %d bpp\n",
+                              pipe_config->pipe_bpp, dev_priv->vbt.edp_bpp);
+                dev_priv->vbt.edp_bpp = pipe_config->pipe_bpp;
+        }
 }
 static bool is_edp_psr(struct intel_dp *intel_dp)
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 9b7b68fd5d47..7f2b384ac939 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -765,6 +765,8 @@ extern void intel_ddi_prepare_link_retrain(struct drm_encoder *encoder);
 extern bool
 intel_ddi_connector_get_hw_state(struct intel_connector *intel_connector);
 extern void intel_ddi_fdi_disable(struct drm_crtc *crtc);
+extern void intel_ddi_get_config(struct intel_encoder *encoder,
+                                 struct intel_crtc_config *pipe_config);
 extern void intel_display_handle_reset(struct drm_device *dev);
 extern bool intel_set_cpu_fifo_underrun_reporting(struct drm_device *dev,
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 831a5c021c4b..b8af94a5be39 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -700,6 +700,22 @@ static const struct dmi_system_id intel_no_lvds[] = {
        },
        {
                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Intel D410PT",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
+                        DMI_MATCH(DMI_BOARD_NAME, "D410PT"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Intel D425KT",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
+                        DMI_EXACT_MATCH(DMI_BOARD_NAME, "D425KT"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
                .ident = "Intel D510MO",
                .matches = {
                        DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index f4c5e95b2d6f..26c2ea3e985c 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4759,7 +4759,9 @@ static void cpt_init_clock_gating(struct drm_device *dev)
         * gating for the panel power sequencer or it will fail to
         * start up when no ports are active.
         */
-        I915_WRITE(SOUTH_DSPCLK_GATE_D, PCH_DPLSUNIT_CLOCK_GATE_DISABLE);
+        I915_WRITE(SOUTH_DSPCLK_GATE_D, PCH_DPLSUNIT_CLOCK_GATE_DISABLE |
+                   PCH_DPLUNIT_CLOCK_GATE_DISABLE |
+                   PCH_CPUNIT_CLOCK_GATE_DISABLE);
        I915_WRITE(SOUTH_CHICKEN2, I915_READ(SOUTH_CHICKEN2) |
                   DPLS_EDP_PPS_FIX_DIS);
        /* The below fixes the weird display corruption, a few pixels shifted
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 32923d2f6002..5e891b226acf 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -707,24 +707,37 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
        switch (connector->connector_type) {
        case DRM_MODE_CONNECTOR_DVII:
        case DRM_MODE_CONNECTOR_HDMIB: /* HDMI-B is basically DL-DVI; analog works fine */
-                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                if (radeon_audio != 0) {
-                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                        if (radeon_connector->use_digital &&
-                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
+                            (radeon_connector->audio == RADEON_AUDIO_ENABLE))
-                        return ATOM_ENCODER_MODE_HDMI;
+                                return ATOM_ENCODER_MODE_HDMI;
-                else if (radeon_connector->use_digital)
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else if (radeon_connector->use_digital)
+                                return ATOM_ENCODER_MODE_DVI;
+                        else
+                                return ATOM_ENCODER_MODE_CRT;
+                } else if (radeon_connector->use_digital) {
                        return ATOM_ENCODER_MODE_DVI;
-                else
+                } else {
                        return ATOM_ENCODER_MODE_CRT;
+                }
                break;
        case DRM_MODE_CONNECTOR_DVID:
        case DRM_MODE_CONNECTOR_HDMIA:
        default:
-                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                if (radeon_audio != 0) {
-                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                        if (radeon_connector->audio == RADEON_AUDIO_ENABLE)
-                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
+                                return ATOM_ENCODER_MODE_HDMI;
-                        return ATOM_ENCODER_MODE_HDMI;
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                else
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else
+                                return ATOM_ENCODER_MODE_DVI;
+                } else {
                        return ATOM_ENCODER_MODE_DVI;
+                }
                break;
        case DRM_MODE_CONNECTOR_LVDS:
                return ATOM_ENCODER_MODE_LVDS;
@@ -732,14 +745,19 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
        case DRM_MODE_CONNECTOR_DisplayPort:
                dig_connector = radeon_connector->con_priv;
                if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
-                    (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
+                    (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP)) {
                        return ATOM_ENCODER_MODE_DP;
-                else if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                } else if (radeon_audio != 0) {
-                         (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                        if (radeon_connector->audio == RADEON_AUDIO_ENABLE)
-                          (radeon_connector->audio == RADEON_AUDIO_AUTO)))
+                                return ATOM_ENCODER_MODE_HDMI;
-                        return ATOM_ENCODER_MODE_HDMI;
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                else
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else
+                                return ATOM_ENCODER_MODE_DVI;
+                } else {
                        return ATOM_ENCODER_MODE_DVI;
+                }
                break;
        case DRM_MODE_CONNECTOR_eDP:
                return ATOM_ENCODER_MODE_DP;
@@ -1655,7 +1673,7 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
                         * does the same thing and more.
                         */
                        if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) &&
-                            (rdev->family != CHIP_RS880))
+                            (rdev->family != CHIP_RS780) && (rdev->family != CHIP_RS880))
                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                }
                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index b874ccdf52f7..9cd2bc989ac7 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -1694,6 +1694,7 @@ static int cik_init_microcode(struct radeon_device *rdev)
                               fw_name);
                        release_firmware(rdev->smc_fw);
                        rdev->smc_fw = NULL;
+                        err = 0;
                } else if (rdev->smc_fw->size != smc_req_size) {
                        printk(KERN_ERR
                               "cik_smc: Bogus length %zu in firmware \"%s\"\n",
@@ -3182,6 +3183,7 @@ int cik_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
        r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
        if (r) {
                DRM_ERROR("radeon: failed to get ib (%d).\n", r);
+                radeon_scratch_free(rdev, scratch);
                return r;
        }
        ib.ptr[0] = PACKET3(PACKET3_SET_UCONFIG_REG, 1);
@@ -3198,6 +3200,8 @@ int cik_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
        r = radeon_fence_wait(ib.fence, false);
        if (r) {
                DRM_ERROR("radeon: fence wait failed (%d).\n", r);
+                radeon_scratch_free(rdev, scratch);
+                radeon_ib_free(rdev, &ib);
                return r;
        }
        for (i = 0; i < rdev->usec_timeout; i++) {
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 85a69d2ea3d2..9fcd338c0fcf 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -113,6 +113,9 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        u8 *sadb;
        int sad_count;
+        /* XXX: setting this register causes hangs on some asics */
+        return;
        if (!dig->afmt->pin)
                return;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index f815c20640bd..57fcc4b16a52 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -67,6 +67,9 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        u8 *sadb;
        int sad_count;
+        /* XXX: setting this register causes hangs on some asics */
+        return;
        list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
                if (connector->encoder == encoder)
                        radeon_connector = to_radeon_connector(connector);
@@ -288,6 +291,7 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
        /* fglrx clears sth in AFMT_AUDIO_PACKET_CONTROL2 here */
        WREG32(HDMI_ACR_PACKET_CONTROL + offset,
+               HDMI_ACR_SOURCE | /* select SW CTS value */
               HDMI_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
        evergreen_hdmi_update_ACR(encoder, mode->clock);
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 71399065db04..b41905573cd2 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2635,7 +2635,7 @@ int kv_dpm_init(struct radeon_device *rdev)
        pi->caps_sclk_ds = true;
        pi->enable_auto_thermal_throttling = true;
        pi->disable_nb_ps3_in_battery = false;
-        pi->bapm_enable = true;
+        pi->bapm_enable = false;
        pi->voltage_drop_t = 0;
        pi->caps_sclk_throttle_low_notification = false;
        pi->caps_fps = false; /* true? */
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 93c1f9ef5da9..cac2866d79da 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -804,6 +804,7 @@ int ni_init_microcode(struct radeon_device *rdev)
                               fw_name);
                        release_firmware(rdev->smc_fw);
                        rdev->smc_fw = NULL;
+                        err = 0;
                } else if (rdev->smc_fw->size != smc_req_size) {
                        printk(KERN_ERR
                               "ni_mc: Bogus length %zu in firmware \"%s\"\n",
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 2a1b1876b431..f9be22062df1 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2302,6 +2302,7 @@ int r600_init_microcode(struct radeon_device *rdev)
                               fw_name);
                        release_firmware(rdev->smc_fw);
                        rdev->smc_fw = NULL;
+                        err = 0;
                } else if (rdev->smc_fw->size != smc_req_size) {
                        printk(KERN_ERR
                               "smc: Bogus length %zu in firmware \"%s\"\n",
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 5b729319f27b..06022e3b9c3b 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -309,6 +309,9 @@ static void dce3_2_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        u8 *sadb;
        int sad_count;
+        /* XXX: setting this register causes hangs on some asics */
+        return;
        list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
                if (connector->encoder == encoder)
                        radeon_connector = to_radeon_connector(connector);
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index a400ac1c4147..24f4960f59ee 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1272,8 +1272,8 @@ struct radeon_blacklist_clocks
 struct radeon_clock_and_voltage_limits {
        u32 sclk;
        u32 mclk;
-        u32 vddc;
+        u16 vddc;
-        u32 vddci;
+        u16 vddci;
 };
 struct radeon_clock_array {
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 79159b5da05b..64565732cb98 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1658,9 +1658,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                        drm_object_attach_property(&radeon_connector->base.base,
                                                      rdev->mode_info.underscan_vborder_property,
                                                      0);
-                        drm_object_attach_property(&radeon_connector->base.base,
+                        if (radeon_audio != 0)
-                                                   rdev->mode_info.audio_property,
+                                drm_object_attach_property(&radeon_connector->base.base,
-                                                   RADEON_AUDIO_DISABLE);
+                                                           rdev->mode_info.audio_property,
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                        subpixel_order = SubPixelHorizontalRGB;
                        connector->interlace_allowed = true;
                        if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
@@ -1754,10 +1757,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
+                                                           rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                        }
                        if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                                radeon_connector->dac_load_detect = true;
@@ -1799,10 +1804,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
+                                                           rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                        }
                        subpixel_order = SubPixelHorizontalRGB;
                        connector->interlace_allowed = true;
@@ -1843,10 +1850,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
+                                                           rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                        }
                        connector->interlace_allowed = true;
                        /* in theory with a DP to VGA converter... */
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 66c222836631..80285e35bc65 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -85,9 +85,8 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                   VRAM, also but everything into VRAM on AGP cards to avoid
                   image corruptions */
                if (p->ring == R600_RING_TYPE_UVD_INDEX &&
-                    p->rdev->family < CHIP_PALM &&
                    (i == 0 || drm_pci_device_is_agp(p->rdev->ddev))) {
+                        /* TODO: is this still needed for NI+ ? */
                        p->relocs[i].lobj.domain =
                                RADEON_GEM_DOMAIN_VRAM;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index cdd12dcd988b..9c14a1ba1de4 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -153,7 +153,7 @@ int radeon_benchmarking = 0;
 int radeon_testing = 0;
 int radeon_connector_table = 0;
 int radeon_tv = 1;
-int radeon_audio = 1;
+int radeon_audio = -1;
 int radeon_disp_priority = 0;
 int radeon_hw_i2c = 0;
 int radeon_pcie_gen2 = -1;
@@ -196,7 +196,7 @@ module_param_named(connector_table, radeon_connector_table, int, 0444);
 MODULE_PARM_DESC(tv, "TV enable (0 = disable)");
 module_param_named(tv, radeon_tv, int, 0444);
-MODULE_PARM_DESC(audio, "Audio enable (1 = enable)");
+MODULE_PARM_DESC(audio, "Audio enable (-1 = auto, 0 = disable, 1 = enable)");
 module_param_named(audio, radeon_audio, int, 0444);
 MODULE_PARM_DESC(disp_priority, "Display Priority (0 = auto, 1 = normal, 2 = high)");
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 4f2e73f79638..308eff5be1b4 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -476,7 +476,8 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                return -EINVAL;
        }
-        if (p->rdev->family < CHIP_PALM && (cmd == 0 || cmd == 0x3) &&
+        /* TODO: is this still necessary on NI+ ? */
+        if ((cmd == 0 || cmd == 0x3) &&
            (start >> 28) != (p->rdev->uvd.gpu_addr >> 28)) {
                DRM_ERROR("msg/fb buffer %LX-%LX out of 256MB segment!\n",
                          start, end);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index d4652af425b8..d96f7cbca0a1 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -1681,6 +1681,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                       fw_name);
                release_firmware(rdev->smc_fw);
                rdev->smc_fw = NULL;
+                err = 0;
        } else if (rdev->smc_fw->size != smc_req_size) {
                printk(KERN_ERR
                       "si_smc: Bogus length %zu in firmware \"%s\"\n",
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index 3100fa9cb52f..7266805d9786 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -212,8 +212,8 @@ int uvd_v1_0_start(struct radeon_device *rdev)
        /* enable VCPU clock */
        WREG32(UVD_VCPU_CNTL,  1 << 9);
-        /* enable UMC and NC0 */
+        /* enable UMC */
-        WREG32_P(UVD_LMI_CTRL2, 1 << 13, ~((1 << 8) | (1 << 13)));
+        WREG32_P(UVD_LMI_CTRL2, 0, ~(1 << 8));
        /* boot up the VCPU */
        WREG32(UVD_SOFT_RESET, 0);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 1a90f0a2f7e5..0508f93b9795 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -740,9 +740,17 @@ static void vmw_postclose(struct drm_device *dev,
        struct vmw_fpriv *vmw_fp;
        vmw_fp = vmw_fpriv(file_priv);
-        ttm_object_file_release(&vmw_fp->tfile);
-        if (vmw_fp->locked_master)
+        if (vmw_fp->locked_master) {
+                struct vmw_master *vmaster =
+                        vmw_master(vmw_fp->locked_master);
+                ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+                ttm_vt_unlock(&vmaster->lock);
                drm_master_put(&vmw_fp->locked_master);
+        }
+        ttm_object_file_release(&vmw_fp->tfile);
        kfree(vmw_fp);
 }
@@ -925,14 +933,13 @@ static void vmw_master_drop(struct drm_device *dev,
        vmw_fp->locked_master = drm_master_get(file_priv->master);
        ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile);
-        vmw_execbuf_release_pinned_bo(dev_priv);
        if (unlikely((ret != 0))) {
                DRM_ERROR("Unable to lock TTM at VT switch.\n");
                drm_master_put(&vmw_fp->locked_master);
        }
-        ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+        ttm_lock_set_kill(&vmaster->lock, false, SIGTERM);
+        vmw_execbuf_release_pinned_bo(dev_priv);
        if (!dev_priv->enable_fb) {
                ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 0e67cf41065d..37fb4befec82 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -970,7 +970,7 @@ void vmw_resource_unreserve(struct vmw_resource *res,
        if (new_backup)
                res->backup_offset = new_backup_offset;
-        if (!res->func->may_evict)
+        if (!res->func->may_evict || res->id == -1)
                return;
        write_lock(&dev_priv->resource_lock);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5a8c01112a23..e80da62363bc 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -319,7 +319,7 @@ static s32 item_sdata(struct hid_item *item)
 static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
 {
-        __u32 raw_value;
+        __s32 raw_value;
        switch (item->tag) {
        case HID_GLOBAL_ITEM_TAG_PUSH:
@@ -370,10 +370,11 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
                return 0;
        case HID_GLOBAL_ITEM_TAG_UNIT_EXPONENT:
-                /* Units exponent negative numbers are given through a
+                /* Many devices provide unit exponent as a two's complement
-                 * two's complement.
+                 * nibble due to the common misunderstanding of HID
-                 * See "6.2.2.7 Global Items" for more information. */
+                 * specification 1.11, 6.2.2.7 Global Items. Attempt to handle
-                raw_value = item_udata(item);
+                 * both this and the standard encoding. */
+                raw_value = item_sdata(item);
                if (!(raw_value & 0xfffffff0))
                        parser->global.unit_exponent = hid_snto32(raw_value, 4);
                else
@@ -1870,6 +1871,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
        { }
 };
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 9cbc7ab07dfa..f0296a50be5f 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -633,6 +633,7 @@
 #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN    0x0003
 #define USB_VENDOR_ID_NINTENDO          0x057e
+#define USB_VENDOR_ID_NINTENDO2         0x054c
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE  0x0306
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE2 0x0330
@@ -792,6 +793,8 @@
 #define USB_DEVICE_ID_SYNAPTICS_COMP_TP 0x0009
 #define USB_DEVICE_ID_SYNAPTICS_WTP     0x0010
 #define USB_DEVICE_ID_SYNAPTICS_DPAD    0x0013
+#define USB_DEVICE_ID_SYNAPTICS_LTS1    0x0af8
+#define USB_DEVICE_ID_SYNAPTICS_LTS2    0x1d10
 #define USB_VENDOR_ID_THINGM            0x27b8
 #define USB_DEVICE_ID_BLINK1            0x01ed
@@ -919,4 +922,7 @@
 #define USB_VENDOR_ID_PRIMAX    0x0461
 #define USB_DEVICE_ID_PRIMAX_KEYBOARD   0x4e05
+#define USB_VENDOR_ID_SIS       0x0457
+#define USB_DEVICE_ID_SIS_TS    0x1013
 #endif
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 8741d953dcc8..d97f2323af57 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -192,6 +192,7 @@ static int hidinput_setkeycode(struct input_dev *dev,
        return -EINVAL;
 }
 /**
 * hidinput_calc_abs_res - calculate an absolute axis resolution
 * @field: the HID report field to calculate resolution for
@@ -234,23 +235,17 @@ __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code)
        case ABS_MT_TOOL_Y:
        case ABS_MT_TOUCH_MAJOR:
        case ABS_MT_TOUCH_MINOR:
-                if (field->unit & 0xffffff00)           /* Not a length */
+                if (field->unit == 0x11) {              /* If centimeters */
-                        return 0;
-                unit_exponent += hid_snto32(field->unit >> 4, 4) - 1;
-                switch (field->unit & 0xf) {
-                case 0x1:                               /* If centimeters */
                        /* Convert to millimeters */
                        unit_exponent += 1;
-                        break;
+                } else if (field->unit == 0x13) {       /* If inches */
-                case 0x3:                               /* If inches */
                        /* Convert to millimeters */
                        prev = physical_extents;
                        physical_extents *= 254;
                        if (physical_extents < prev)
                                return 0;
                        unit_exponent -= 1;
-                        break;
+                } else {
-                default:
                        return 0;
                }
                break;
diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
index abb20db2b443..1446f526ee8b 100644
--- a/drivers/hid/hid-wiimote-core.c
+++ b/drivers/hid/hid-wiimote-core.c
@@ -834,7 +834,8 @@ static void wiimote_init_set_type(struct wiimote_data *wdata,
                goto done;
        }
-        if (vendor == USB_VENDOR_ID_NINTENDO) {
+        if (vendor == USB_VENDOR_ID_NINTENDO ||
+            vendor == USB_VENDOR_ID_NINTENDO2) {
                if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE) {
                        devtype = WIIMOTE_DEV_GEN10;
                        goto done;
@@ -1855,6 +1856,8 @@ static void wiimote_hid_remove(struct hid_device *hdev)
 static const struct hid_device_id wiimote_hid_devices[] = {
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2,
+                                USB_DEVICE_ID_NINTENDO_WIIMOTE) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
        { }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 07345521f421..3fca3be08337 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -110,6 +110,9 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SIS, USB_DEVICE_ID_SIS_TS, HID_QUIRK_NO_INIT_REPORTS },
        { 0, 0 }
 };
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 5ceda710f516..b84791f03a27 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -31,6 +31,17 @@ config INFINIBAND_USER_ACCESS
          libibverbs, libibcm and a hardware driver library from
          <http://www.openfabrics.org/git/>.
+config INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
+       bool "Experimental and unstable ABI for userspace access to flow steering verbs"
+       depends on INFINIBAND_USER_ACCESS
+       depends on STAGING
+        ---help---
+          The final ABI for userspace access to flow steering verbs
+          has not been defined.  To use the current ABI, *WHICH WILL
+          CHANGE IN THE FUTURE*, say Y here.
+          If unsure, say N.
 config INFINIBAND_USER_MEM
        bool
        depends on INFINIBAND_USER_ACCESS != n
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index d040b877475f..d8f9c6c272d7 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -217,7 +217,9 @@ IB_UVERBS_DECLARE_CMD(destroy_srq);
 IB_UVERBS_DECLARE_CMD(create_xsrq);
 IB_UVERBS_DECLARE_CMD(open_xrcd);
 IB_UVERBS_DECLARE_CMD(close_xrcd);
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 IB_UVERBS_DECLARE_CMD(create_flow);
 IB_UVERBS_DECLARE_CMD(destroy_flow);
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 #endif /* UVERBS_H */
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index f2b81b9ee0d6..2f0f01b70e3b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -54,7 +54,9 @@ static struct uverbs_lock_class qp_lock_class	= { .name = "QP-uobj" };
 static struct uverbs_lock_class ah_lock_class   = { .name = "AH-uobj" };
 static struct uverbs_lock_class srq_lock_class  = { .name = "SRQ-uobj" };
 static struct uverbs_lock_class xrcd_lock_class = { .name = "XRCD-uobj" };
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 static struct uverbs_lock_class rule_lock_class = { .name = "RULE-uobj" };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
        do {                                                            \
@@ -2599,6 +2601,7 @@ out_put:
        return ret ? ret : in_len;
 }
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 static int kern_spec_to_ib_spec(struct ib_kern_spec *kern_spec,
                                union ib_flow_spec *ib_spec)
 {
@@ -2824,6 +2827,7 @@ ssize_t ib_uverbs_destroy_flow(struct ib_uverbs_file *file,
        return ret ? ret : in_len;
 }
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 static int __uverbs_create_xsrq(struct ib_uverbs_file *file,
                                struct ib_uverbs_create_xsrq *cmd,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 75ad86c4abf8..2df31f68ea09 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -115,8 +115,10 @@ static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
        [IB_USER_VERBS_CMD_CLOSE_XRCD]          = ib_uverbs_close_xrcd,
        [IB_USER_VERBS_CMD_CREATE_XSRQ]         = ib_uverbs_create_xsrq,
        [IB_USER_VERBS_CMD_OPEN_QP]             = ib_uverbs_open_qp,
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
        [IB_USER_VERBS_CMD_CREATE_FLOW]         = ib_uverbs_create_flow,
        [IB_USER_VERBS_CMD_DESTROY_FLOW]        = ib_uverbs_destroy_flow
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 };
 static void ib_uverbs_add_one(struct ib_device *device);
@@ -605,6 +607,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
        if (!(file->device->ib_dev->uverbs_cmd_mask & (1ull << hdr.command)))
                return -ENOSYS;
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
        if (hdr.command >= IB_USER_VERBS_CMD_THRESHOLD) {
                struct ib_uverbs_cmd_hdr_ex hdr_ex;
@@ -621,6 +624,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                                                     (hdr_ex.out_words +
                                                      hdr_ex.provider_out_words) * 4);
        } else {
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
                if (hdr.in_words * 4 != count)
                        return -EINVAL;
@@ -628,7 +632,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                                                     buf + sizeof(hdr),
                                                     hdr.in_words * 4,
                                                     hdr.out_words * 4);
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
        }
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 }
 static int ib_uverbs_mmap(struct file *filp, struct vm_area_struct *vma)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index d6c5a73becf4..f0612645de99 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1691,9 +1691,11 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                ibdev->ib_dev.create_flow       = mlx4_ib_create_flow;
                ibdev->ib_dev.destroy_flow      = mlx4_ib_destroy_flow;
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
                ibdev->ib_dev.uverbs_cmd_mask   |=
                        (1ull << IB_USER_VERBS_CMD_CREATE_FLOW) |
                        (1ull << IB_USER_VERBS_CMD_DESTROY_FLOW);
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
        }
        mlx4_ib_alloc_eqs(dev, ibdev);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 3591855cc5b5..6df23502059a 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -594,7 +594,7 @@ isert_connect_release(struct isert_conn *isert_conn)
        pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-        if (device->use_frwr)
+        if (device && device->use_frwr)
                isert_conn_free_frwr_pool(isert_conn);
        if (isert_conn->conn_qp) {
diff --git a/drivers/input/input.c b/drivers/input/input.c
index c04469928925..e75d015024a1 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1734,6 +1734,7 @@ EXPORT_SYMBOL_GPL(input_class);
 */
 struct input_dev *input_allocate_device(void)
 {
+        static atomic_t input_no = ATOMIC_INIT(0);
        struct input_dev *dev;
        dev = kzalloc(sizeof(struct input_dev), GFP_KERNEL);
@@ -1743,9 +1744,13 @@ struct input_dev *input_allocate_device(void)
                device_initialize(&dev->dev);
                mutex_init(&dev->mutex);
                spin_lock_init(&dev->event_lock);
+                init_timer(&dev->timer);
                INIT_LIST_HEAD(&dev->h_list);
                INIT_LIST_HEAD(&dev->node);
+                dev_set_name(&dev->dev, "input%ld",
+                             (unsigned long) atomic_inc_return(&input_no) - 1);
                __module_get(THIS_MODULE);
        }
@@ -2019,7 +2024,6 @@ static void devm_input_device_unregister(struct device *dev, void *res)
 */
 int input_register_device(struct input_dev *dev)
 {
-        static atomic_t input_no = ATOMIC_INIT(0);
        struct input_devres *devres = NULL;
        struct input_handler *handler;
        unsigned int packet_size;
@@ -2059,7 +2063,6 @@ int input_register_device(struct input_dev *dev)
         * If delay and period are pre-set by the driver, then autorepeating
         * is handled by the driver itself and we don't do it in input.c.
         */
-        init_timer(&dev->timer);
        if (!dev->rep[REP_DELAY] && !dev->rep[REP_PERIOD]) {
                dev->timer.data = (long) dev;
                dev->timer.function = input_repeat_key;
@@ -2073,9 +2076,6 @@ int input_register_device(struct input_dev *dev)
        if (!dev->setkeycode)
                dev->setkeycode = input_default_setkeycode;
-        dev_set_name(&dev->dev, "input%ld",
-                     (unsigned long) atomic_inc_return(&input_no) - 1);
        error = device_add(&dev->dev);
        if (error)
                goto err_free_vals;
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index 134c3b404a54..a2e758d27584 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -786,10 +786,17 @@ static int pxa27x_keypad_probe(struct platform_device *pdev)
        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
        input_set_capability(input_dev, EV_MSC, MSC_SCAN);
-        if (pdata)
+        if (pdata) {
                error = pxa27x_keypad_build_keycode(keypad);
-        else
+        } else {
                error = pxa27x_keypad_build_keycode_from_dt(keypad);
+                /*
+                 * Data that we get from DT resides in dynamically
+                 * allocated memory so we need to update our pdata
+                 * pointer.
+                 */
+                pdata = keypad->pdata;
+        }
        if (error) {
                dev_err(&pdev->dev, "failed to build keycode\n");
                goto failed_put_clk;
diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 082684e7f390..9365535ba7f1 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -351,7 +351,9 @@ static void cm109_urb_irq_callback(struct urb *urb)
        if (status) {
                if (status == -ESHUTDOWN)
                        return;
-                dev_err(&dev->intf->dev, "%s: urb status %d\n", __func__, status);
+                dev_err_ratelimited(&dev->intf->dev, "%s: urb status %d\n",
+                                    __func__, status);
+                goto out;
        }
        /* Special keys */
@@ -418,8 +420,12 @@ static void cm109_urb_ctl_callback(struct urb *urb)
             dev->ctl_data->byte[2],
             dev->ctl_data->byte[3]);
-        if (status)
+        if (status) {
-                dev_err(&dev->intf->dev, "%s: urb status %d\n", __func__, status);
+                if (status == -ESHUTDOWN)
+                        return;
+                dev_err_ratelimited(&dev->intf->dev, "%s: urb status %d\n",
+                                    __func__, status);
+        }
        spin_lock(&dev->ctl_submit_lock);
@@ -427,7 +433,7 @@ static void cm109_urb_ctl_callback(struct urb *urb)
        if (likely(!dev->shutdown)) {
-                if (dev->buzzer_pending) {
+                if (dev->buzzer_pending || status) {
                        dev->buzzer_pending = 0;
                        dev->ctl_urb_pending = 1;
                        cm109_submit_buzz_toggle(dev);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 7c5d72a6a26a..83658472ad25 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -103,6 +103,7 @@ static const struct alps_model_info alps_model_data[] = {
        /* Dell Latitude E5500, E6400, E6500, Precision M4400 */
        { { 0x62, 0x02, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf,
                ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
+        { { 0x73, 0x00, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_DUALPOINT },              /* Dell XT2 */
        { { 0x73, 0x02, 0x50 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },           /* Dell Vostro 1400 */
        { { 0x52, 0x01, 0x14 }, 0x00, ALPS_PROTO_V2, 0xff, 0xff,
                ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },                            /* Toshiba Tecra A11-11L */
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 78e4de42efaa..52c9ebf94729 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -223,21 +223,26 @@ static int i8042_flush(void)
 {
        unsigned long flags;
        unsigned char data, str;
-        int i = 0;
+        int count = 0;
+        int retval = 0;
        spin_lock_irqsave(&i8042_lock, flags);
-        while (((str = i8042_read_status()) & I8042_STR_OBF) && (i < I8042_BUFFER_SIZE)) {
+        while ((str = i8042_read_status()) & I8042_STR_OBF) {
-                udelay(50);
+                if (count++ < I8042_BUFFER_SIZE) {
-                data = i8042_read_data();
+                        udelay(50);
-                i++;
+                        data = i8042_read_data();
-                dbg("%02x <- i8042 (flush, %s)\n",
+                        dbg("%02x <- i8042 (flush, %s)\n",
-                    data, str & I8042_STR_AUXDATA ? "aux" : "kbd");
+                            data, str & I8042_STR_AUXDATA ? "aux" : "kbd");
+                } else {
+                        retval = -EIO;
+                        break;
+                }
        }
        spin_unlock_irqrestore(&i8042_lock, flags);
-        return i;
+        return retval;
 }
 /*
@@ -849,7 +854,7 @@ static int __init i8042_check_aux(void)
 static int i8042_controller_check(void)
 {
-        if (i8042_flush() == I8042_BUFFER_SIZE) {
+        if (i8042_flush()) {
                pr_err("No controller found\n");
                return -ENODEV;
        }
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 79b69ea47f74..e53416a4d7f3 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -1031,6 +1031,7 @@ static void wacom_destroy_leds(struct wacom *wacom)
 }
 static enum power_supply_property wacom_battery_props[] = {
+        POWER_SUPPLY_PROP_SCOPE,
        POWER_SUPPLY_PROP_CAPACITY
 };
@@ -1042,6 +1043,9 @@ static int wacom_battery_get_property(struct power_supply *psy,
        int ret = 0;
        switch (psp) {
+                case POWER_SUPPLY_PROP_SCOPE:
+                        val->intval = POWER_SUPPLY_SCOPE_DEVICE;
+                        break;
                case POWER_SUPPLY_PROP_CAPACITY:
                        val->intval =
                                wacom->wacom_wac.battery_capacity * 100 / 31;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index b2aa503c16b1..c59b797eeafa 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -2054,6 +2054,12 @@ static const struct wacom_features wacom_features_0x101 =
 static const struct wacom_features wacom_features_0x10D =
        { "Wacom ISDv4 10D",      WACOM_PKGLEN_MTTPC,     26202, 16325,  255,
          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0x10E =
+        { "Wacom ISDv4 10E",      WACOM_PKGLEN_MTTPC,     27760, 15694,  255,
+          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0x10F =
+        { "Wacom ISDv4 10F",      WACOM_PKGLEN_MTTPC,     27760, 15694,  255,
+          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0x4001 =
        { "Wacom ISDv4 4001",      WACOM_PKGLEN_MTTPC,     26202, 16325,  255,
          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -2248,6 +2254,8 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0x100) },
        { USB_DEVICE_WACOM(0x101) },
        { USB_DEVICE_WACOM(0x10D) },
+        { USB_DEVICE_WACOM(0x10E) },
+        { USB_DEVICE_WACOM(0x10F) },
        { USB_DEVICE_WACOM(0x300) },
        { USB_DEVICE_WACOM(0x301) },
        { USB_DEVICE_WACOM(0x304) },
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index b6a74bcbb08f..2a7f0dd6abab 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -1000,7 +1000,7 @@ static void request_write(struct cached_dev *dc, struct search *s)
                if (bio->bi_rw & REQ_FLUSH) {
                        /* Also need to send a flush to the backing device */
-                        struct bio *flush = bio_alloc_bioset(0, GFP_NOIO,
+                        struct bio *flush = bio_alloc_bioset(GFP_NOIO, 0,
                                                             dc->disk.bio_split);
                        flush->bi_rw    = WRITE_FLUSH;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index adf4d7e1d5e1..561a65f82e26 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8111,6 +8111,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
        u64 *p;
        int lo, hi;
        int rv = 1;
+        unsigned long flags;
        if (bb->shift < 0)
                /* badblocks are disabled */
@@ -8125,7 +8126,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
                sectors = next - s;
        }
-        write_seqlock_irq(&bb->lock);
+        write_seqlock_irqsave(&bb->lock, flags);
        p = bb->page;
        lo = 0;
@@ -8241,7 +8242,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
        bb->changed = 1;
        if (!acknowledged)
                bb->unacked_exist = 1;
-        write_sequnlock_irq(&bb->lock);
+        write_sequnlock_irqrestore(&bb->lock, flags);
        return rv;
 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d60412c7f995..aacf6bf352d8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1479,6 +1479,7 @@ static int raid1_spare_active(struct mddev *mddev)
                        }
                }
                if (rdev
+                    && rdev->recovery_offset == MaxSector
                    && !test_bit(Faulty, &rdev->flags)
                    && !test_and_set_bit(In_sync, &rdev->flags)) {
                        count++;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index df7b0a06b0ea..73dc8a377522 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1782,6 +1782,7 @@ static int raid10_spare_active(struct mddev *mddev)
                        }
                        sysfs_notify_dirent_safe(tmp->replacement->sysfs_state);
                } else if (tmp->rdev
+                           && tmp->rdev->recovery_offset == MaxSector
                           && !test_bit(Faulty, &tmp->rdev->flags)
                           && !test_and_set_bit(In_sync, &tmp->rdev->flags)) {
                        count++;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 7ff4f252ca1a..f8b906843926 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -778,6 +778,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        bi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                        bi->bi_io_vec[0].bv_offset = 0;
                        bi->bi_size = STRIPE_SIZE;
+                        /*
+                         * If this is discard request, set bi_vcnt 0. We don't
+                         * want to confuse SCSI because SCSI will replace payload
+                         */
+                        if (rw & REQ_DISCARD)
+                                bi->bi_vcnt = 0;
                        if (rrdev)
                                set_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags);
@@ -816,6 +822,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        rbi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                        rbi->bi_io_vec[0].bv_offset = 0;
                        rbi->bi_size = STRIPE_SIZE;
+                        /*
+                         * If this is discard request, set bi_vcnt 0. We don't
+                         * want to confuse SCSI because SCSI will replace payload
+                         */
+                        if (rw & REQ_DISCARD)
+                                rbi->bi_vcnt = 0;
                        if (conf->mddev->gendisk)
                                trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
                                                      rbi, disk_devt(conf->mddev->gendisk),
@@ -2910,6 +2922,14 @@ static void handle_stripe_clean_event(struct r5conf *conf,
                }
                /* now that discard is done we can proceed with any sync */
                clear_bit(STRIPE_DISCARD, &sh->state);
+                /*
+                 * SCSI discard will change some bio fields and the stripe has
+                 * no updated data, so remove it from hash list and the stripe
+                 * will be reinitialized
+                 */
+                spin_lock_irq(&conf->device_lock);
+                remove_hash(sh);
+                spin_unlock_irq(&conf->device_lock);
                if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
                        set_bit(STRIPE_HANDLE, &sh->state);
diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
index 2521f7e23018..e79749cfec81 100644
--- a/drivers/media/dvb-frontends/tda10071.c
+++ b/drivers/media/dvb-frontends/tda10071.c
@@ -912,14 +912,8 @@ static int tda10071_init(struct dvb_frontend *fe)
                { 0xd5, 0x03, 0x03 },
        };
-        /* firmware status */
+        if (priv->warm) {
-        ret = tda10071_rd_reg(priv, 0x51, &tmp);
-        if (ret)
-                goto error;
-        if (!tmp) {
                /* warm state - wake up device from sleep */
-                priv->warm = 1;
                for (i = 0; i < ARRAY_SIZE(tab); i++) {
                        ret = tda10071_wr_reg_mask(priv, tab[i].reg,
@@ -937,7 +931,6 @@ static int tda10071_init(struct dvb_frontend *fe)
                        goto error;
        } else {
                /* cold state - try to download firmware */
-                priv->warm = 0;
                /* request the firmware, this will block and timeout */
                ret = request_firmware(&fw, fw_file, priv->i2c->dev.parent);
diff --git a/drivers/media/i2c/ad9389b.c b/drivers/media/i2c/ad9389b.c
index bb0c99d7a4f1..b06a7e54ee0d 100644
--- a/drivers/media/i2c/ad9389b.c
+++ b/drivers/media/i2c/ad9389b.c
@@ -628,16 +628,13 @@ static int ad9389b_s_stream(struct v4l2_subdev *sd, int enable)
 static const struct v4l2_dv_timings_cap ad9389b_timings_cap = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = 1920,
+        .reserved = { 0 },
-                .max_height = 1200,
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
-                .min_pixelclock = 25000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
-                .max_pixelclock = 170000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                        V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
+                V4L2_DV_BT_CAP_CUSTOM)
-        },
 };
 static int ad9389b_s_dv_timings(struct v4l2_subdev *sd,
diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
index 7a576097471f..7c8d971f1f61 100644
--- a/drivers/media/i2c/adv7511.c
+++ b/drivers/media/i2c/adv7511.c
@@ -119,16 +119,14 @@ static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq);
 static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = ADV7511_MAX_WIDTH,
+        .reserved = { 0 },
-                .max_height = ADV7511_MAX_HEIGHT,
+        V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT,
-                .min_pixelclock = ADV7511_MIN_PIXELCLOCK,
+                ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
-                .max_pixelclock = ADV7511_MAX_PIXELCLOCK,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                        V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
+                        V4L2_DV_BT_CAP_CUSTOM)
-        },
 };
 static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd)
@@ -1126,6 +1124,7 @@ static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *
        state->i2c_edid = i2c_new_dummy(client->adapter, state->i2c_edid_addr >> 1);
        if (state->i2c_edid == NULL) {
                v4l2_err(sd, "failed to register edid i2c client\n");
+                err = -ENOMEM;
                goto err_entity;
        }
@@ -1133,6 +1132,7 @@ static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *
        state->work_queue = create_singlethread_workqueue(sd->name);
        if (state->work_queue == NULL) {
                v4l2_err(sd, "could not create workqueue\n");
+                err = -ENOMEM;
                goto err_unreg_cec;
        }
diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index d1748901337c..22f729d66a96 100644
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -546,30 +546,24 @@ static inline bool is_digital_input(struct v4l2_subdev *sd)
 static const struct v4l2_dv_timings_cap adv7842_timings_cap_analog = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = 1920,
+        .reserved = { 0 },
-                .max_height = 1200,
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
-                .min_pixelclock = 25000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
-                .max_pixelclock = 170000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                        V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
+                        V4L2_DV_BT_CAP_CUSTOM)
-        },
 };
 static const struct v4l2_dv_timings_cap adv7842_timings_cap_digital = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = 1920,
+        .reserved = { 0 },
-                .max_height = 1200,
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
-                .min_pixelclock = 25000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
-                .max_pixelclock = 225000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                        V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
+                        V4L2_DV_BT_CAP_CUSTOM)
-        },
 };
 static inline const struct v4l2_dv_timings_cap *
diff --git a/drivers/media/i2c/ths8200.c b/drivers/media/i2c/ths8200.c
index a58a8f663ffb..d9f65d7e3e58 100644
--- a/drivers/media/i2c/ths8200.c
+++ b/drivers/media/i2c/ths8200.c
@@ -46,14 +46,10 @@ struct ths8200_state {
 static const struct v4l2_dv_timings_cap ths8200_timings_cap = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = 1920,
+        .reserved = { 0 },
-                .max_height = 1080,
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1080, 25000000, 148500000,
-                .min_pixelclock = 25000000,
+                V4L2_DV_BT_STD_CEA861, V4L2_DV_BT_CAP_PROGRESSIVE)
-                .max_pixelclock = 148500000,
-                .standards = V4L2_DV_BT_STD_CEA861,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE,
-        },
 };
 static inline struct ths8200_state *to_state(struct v4l2_subdev *sd)
diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
index e12bbd8c3f0b..fb60da85bc2c 100644
--- a/drivers/media/pci/saa7134/saa7134-video.c
+++ b/drivers/media/pci/saa7134/saa7134-video.c
@@ -1455,6 +1455,7 @@ static int video_release(struct file *file)
        /* stop video capture */
        if (res_check(fh, RESOURCE_VIDEO)) {
+                pm_qos_remove_request(&dev->qos_request);
                videobuf_streamoff(&fh->cap);
                res_free(dev,fh,RESOURCE_VIDEO);
        }
diff --git a/drivers/media/platform/exynos4-is/Kconfig b/drivers/media/platform/exynos4-is/Kconfig
index 53ad0f080179..d2d3b4b61435 100644
--- a/drivers/media/platform/exynos4-is/Kconfig
+++ b/drivers/media/platform/exynos4-is/Kconfig
@@ -29,7 +29,7 @@ config VIDEO_S5P_FIMC
 config VIDEO_S5P_MIPI_CSIS
        tristate "S5P/EXYNOS MIPI-CSI2 receiver (MIPI-CSIS) driver"
        depends on REGULATOR
-        select S5P_SETUP_MIPIPHY
+        select GENERIC_PHY
        help
          This is a V4L2 driver for Samsung S5P and EXYNOS4 SoC MIPI-CSI2
          receiver (MIPI-CSIS) devices.
diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
index 0914230b42de..9fc2af6a0446 100644
--- a/drivers/media/platform/exynos4-is/mipi-csis.c
+++ b/drivers/media/platform/exynos4-is/mipi-csis.c
@@ -20,6 +20,7 @@
 #include <linux/memory.h>
 #include <linux/module.h>
 #include <linux/of.h>
+#include <linux/phy/phy.h>
 #include <linux/platform_data/mipi-csis.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
@@ -180,6 +181,7 @@ struct csis_drvdata {
 * @sd: v4l2_subdev associated with CSIS device instance
 * @index: the hardware instance index
 * @pdev: CSIS platform device
+ * @phy: pointer to the CSIS generic PHY
 * @regs: mmaped I/O registers memory
 * @supplies: CSIS regulator supplies
 * @clock: CSIS clocks
@@ -203,6 +205,7 @@ struct csis_state {
        struct v4l2_subdev sd;
        u8 index;
        struct platform_device *pdev;
+        struct phy *phy;
        void __iomem *regs;
        struct regulator_bulk_data supplies[CSIS_NUM_SUPPLIES];
        struct clk *clock[NUM_CSIS_CLOCKS];
@@ -779,8 +782,8 @@ static int s5pcsis_parse_dt(struct platform_device *pdev,
                                        "samsung,csis-wclk");
        state->num_lanes = endpoint.bus.mipi_csi2.num_data_lanes;
        of_node_put(node);
        return 0;
 }
 #else
@@ -829,6 +832,10 @@ static int s5pcsis_probe(struct platform_device *pdev)
                return -EINVAL;
        }
+        state->phy = devm_phy_get(dev, "csis");
+        if (IS_ERR(state->phy))
+                return PTR_ERR(state->phy);
        mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        state->regs = devm_ioremap_resource(dev, mem_res);
        if (IS_ERR(state->regs))
@@ -922,7 +929,7 @@ static int s5pcsis_pm_suspend(struct device *dev, bool runtime)
        mutex_lock(&state->lock);
        if (state->flags & ST_POWERED) {
                s5pcsis_stop_stream(state);
-                ret = s5p_csis_phy_enable(state->index, false);
+                ret = phy_power_off(state->phy);
                if (ret)
                        goto unlock;
                ret = regulator_bulk_disable(CSIS_NUM_SUPPLIES,
@@ -958,7 +965,7 @@ static int s5pcsis_pm_resume(struct device *dev, bool runtime)
                                            state->supplies);
                if (ret)
                        goto unlock;
-                ret = s5p_csis_phy_enable(state->index, true);
+                ret = phy_power_on(state->phy);
                if (!ret) {
                        state->flags |= ST_POWERED;
                } else {
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 15d23968d1de..9b88a4601007 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1423,6 +1423,7 @@ static int s5p_jpeg_probe(struct platform_device *pdev)
        jpeg->vfd_decoder->release      = video_device_release;
        jpeg->vfd_decoder->lock         = &jpeg->lock;
        jpeg->vfd_decoder->v4l2_dev     = &jpeg->v4l2_dev;
+        jpeg->vfd_decoder->vfl_dir      = VFL_DIR_M2M;
        ret = video_register_device(jpeg->vfd_decoder, VFL_TYPE_GRABBER, -1);
        if (ret) {
diff --git a/drivers/media/platform/sh_vou.c b/drivers/media/platform/sh_vou.c
index 7a9c5e9329f2..4f30341dc2ab 100644
--- a/drivers/media/platform/sh_vou.c
+++ b/drivers/media/platform/sh_vou.c
@@ -776,7 +776,7 @@ static int sh_vou_try_fmt_vid_out(struct file *file, void *priv,
        v4l_bound_align_image(&pix->width, 0, VOU_MAX_IMAGE_WIDTH, 1,
                              &pix->height, 0, VOU_MAX_IMAGE_HEIGHT, 1, 0);
-        for (i = 0; ARRAY_SIZE(vou_fmt); i++)
+        for (i = 0; i < ARRAY_SIZE(vou_fmt); i++)
                if (vou_fmt[i].pfmt == pix->pixelformat)
                        return 0;
diff --git a/drivers/media/platform/soc_camera/mx3_camera.c b/drivers/media/platform/soc_camera/mx3_camera.c
index 8f9f6211c52e..f975b7008692 100644
--- a/drivers/media/platform/soc_camera/mx3_camera.c
+++ b/drivers/media/platform/soc_camera/mx3_camera.c
@@ -266,7 +266,6 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
        struct idmac_channel *ichan = mx3_cam->idmac_channel[0];
        struct idmac_video_param *video = &ichan->params.video;
        const struct soc_mbus_pixelfmt *host_fmt = icd->current_fmt->host_fmt;
-        unsigned long flags;
        dma_cookie_t cookie;
        size_t new_size;
@@ -328,7 +327,7 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
                memset(vb2_plane_vaddr(vb, 0), 0xaa, vb2_get_plane_payload(vb, 0));
 #endif
-        spin_lock_irqsave(&mx3_cam->lock, flags);
+        spin_lock_irq(&mx3_cam->lock);
        list_add_tail(&buf->queue, &mx3_cam->capture);
        if (!mx3_cam->active)
@@ -351,7 +350,7 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
        if (mx3_cam->active == buf)
                mx3_cam->active = NULL;
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
+        spin_unlock_irq(&mx3_cam->lock);
 error:
        vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
 }
diff --git a/drivers/media/tuners/e4000.c b/drivers/media/tuners/e4000.c
index ad9309da4a91..6c96e4898777 100644
--- a/drivers/media/tuners/e4000.c
+++ b/drivers/media/tuners/e4000.c
@@ -19,6 +19,7 @@
 */
 #include "e4000_priv.h"
+#include <linux/math64.h>
 /* write multiple registers */
 static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
@@ -233,7 +234,7 @@ static int e4000_set_params(struct dvb_frontend *fe)
         * or more.
         */
        f_vco = c->frequency * e4000_pll_lut[i].mul;
-        sigma_delta = 0x10000UL * (f_vco % priv->cfg->clock) / priv->cfg->clock;
+        sigma_delta = div_u64(0x10000ULL * (f_vco % priv->cfg->clock), priv->cfg->clock);
        buf[0] = f_vco / priv->cfg->clock;
        buf[1] = (sigma_delta >> 0) & 0xff;
        buf[2] = (sigma_delta >> 8) & 0xff;
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
index c43c8d32be40..be77482c3070 100644
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -111,6 +111,13 @@ static const struct dmi_system_id stk_upside_down_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "F3JC")
                }
        },
+        {
+                .ident = "T12Rg-H",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "HCL Infosystems Limited"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "T12Rg-H")
+                }
+        },
        {}
 };
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 81695d48c13e..c3bb2502225b 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -2090,6 +2090,15 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_PROBE_MINMAX },
+        /* Microsoft Lifecam NX-3000 */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x045e,
+          .idProduct            = 0x0721,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_PROBE_DEF },
        /* Microsoft Lifecam VX-7000 */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2174,6 +2183,15 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_PROBE_DEF },
+        /* Dell SP2008WFP Monitor */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x05a9,
+          .idProduct            = 0x2641,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_PROBE_DEF },
        /* Dell Alienware X51 */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 594c75eab5a5..de0e87f0b2c3 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -353,7 +353,9 @@ static int __verify_length(struct vb2_buffer *vb, const struct v4l2_buffer *b)
                        if (b->m.planes[plane].bytesused > length)
                                return -EINVAL;
-                        if (b->m.planes[plane].data_offset >=
+                        if (b->m.planes[plane].data_offset > 0 &&
+                            b->m.planes[plane].data_offset >=
                            b->m.planes[plane].bytesused)
                                return -EINVAL;
                }
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index fd56f2563201..646f08f4f504 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -423,6 +423,39 @@ static inline int vma_is_io(struct vm_area_struct *vma)
        return !!(vma->vm_flags & (VM_IO | VM_PFNMAP));
 }
+static int vb2_dc_get_user_pfn(unsigned long start, int n_pages,
+        struct vm_area_struct *vma, unsigned long *res)
+{
+        unsigned long pfn, start_pfn, prev_pfn;
+        unsigned int i;
+        int ret;
+        if (!vma_is_io(vma))
+                return -EFAULT;
+        ret = follow_pfn(vma, start, &pfn);
+        if (ret)
+                return ret;
+        start_pfn = pfn;
+        start += PAGE_SIZE;
+        for (i = 1; i < n_pages; ++i, start += PAGE_SIZE) {
+                prev_pfn = pfn;
+                ret = follow_pfn(vma, start, &pfn);
+                if (ret) {
+                        pr_err("no page for address %lu\n", start);
+                        return ret;
+                }
+                if (pfn != prev_pfn + 1)
+                        return -EINVAL;
+        }
+        *res = start_pfn;
+        return 0;
+}
 static int vb2_dc_get_user_pages(unsigned long start, struct page **pages,
        int n_pages, struct vm_area_struct *vma, int write)
 {
@@ -433,6 +466,9 @@ static int vb2_dc_get_user_pages(unsigned long start, struct page **pages,
                        unsigned long pfn;
                        int ret = follow_pfn(vma, start, &pfn);
+                        if (!pfn_valid(pfn))
+                                return -EINVAL;
                        if (ret) {
                                pr_err("no page for address %lu\n", start);
                                return ret;
@@ -468,16 +504,49 @@ static void vb2_dc_put_userptr(void *buf_priv)
        struct vb2_dc_buf *buf = buf_priv;
        struct sg_table *sgt = buf->dma_sgt;
-        dma_unmap_sg(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
+        if (sgt) {
-        if (!vma_is_io(buf->vma))
+                dma_unmap_sg(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
-                vb2_dc_sgt_foreach_page(sgt, vb2_dc_put_dirty_page);
+                if (!vma_is_io(buf->vma))
+                        vb2_dc_sgt_foreach_page(sgt, vb2_dc_put_dirty_page);
-        sg_free_table(sgt);
+                sg_free_table(sgt);
-        kfree(sgt);
+                kfree(sgt);
+        }
        vb2_put_vma(buf->vma);
        kfree(buf);
 }
+/*
+ * For some kind of reserved memory there might be no struct page available,
+ * so all that can be done to support such 'pages' is to try to convert
+ * pfn to dma address or at the last resort just assume that
+ * dma address == physical address (like it has been assumed in earlier version
+ * of videobuf2-dma-contig
+ */
+#ifdef __arch_pfn_to_dma
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__arch_pfn_to_dma(dev, pfn);
+}
+#elif defined(__pfn_to_bus)
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__pfn_to_bus(pfn);
+}
+#elif defined(__pfn_to_phys)
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__pfn_to_phys(pfn);
+}
+#else
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        /* really, we cannot do anything better at this point */
+        return (dma_addr_t)(pfn) << PAGE_SHIFT;
+}
+#endif
 static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
        unsigned long size, int write)
 {
@@ -548,6 +617,14 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
        /* extract page list from userspace mapping */
        ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, write);
        if (ret) {
+                unsigned long pfn;
+                if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
+                        buf->dma_addr = vb2_dc_pfn_to_dma(buf->dev, pfn);
+                        buf->size = size;
+                        kfree(pages);
+                        return buf;
+                }
                pr_err("failed to get user pages\n");
                goto fail_vma;
        }
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 59ab0692f0b9..a9830ff8e3f3 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -349,7 +349,7 @@ static int legacy_set_geometry(struct gpmi_nand_data *this)
 int common_nfc_set_geometry(struct gpmi_nand_data *this)
 {
-        return set_geometry_by_ecc_info(this) ? 0 : legacy_set_geometry(this);
+        return legacy_set_geometry(this);
 }
 struct dma_chan *get_dma_chan(struct gpmi_nand_data *this)
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index dd03dfdfb0d6..c28d4e29af1a 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1320,7 +1320,12 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
        for (cs = 0; cs < pdata->num_cs; cs++) {
                struct mtd_info *mtd = info->host[cs]->mtd;
-                mtd->name = pdev->name;
+                /*
+                 * The mtd name matches the one used in 'mtdparts' kernel
+                 * parameter. This name cannot be changed or otherwise
+                 * user's mtd partitions configuration would get broken.
+                 */
+                mtd->name = "pxa3xx_nand-0";
                info->cs = cs;
                ret = pxa3xx_nand_scan(mtd);
                if (ret) {
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 3b1ff6148702..693d8ffe4653 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -1405,10 +1405,10 @@ static int at91_can_remove(struct platform_device *pdev)
 static const struct platform_device_id at91_can_id_table[] = {
        {
-                .name = "at91_can",
+                .name = "at91sam9x5_can",
                .driver_data = (kernel_ulong_t)&at91_at91sam9x5_data,
        }, {
-                .name = "at91sam9x5_can",
+                .name = "at91_can",
                .driver_data = (kernel_ulong_t)&at91_at91sam9263_data,
        }, {
                /* sentinel */
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index a668cd491cb3..e3fc07cf2f62 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -814,9 +814,6 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
                        msg_ctrl_save = priv->read_reg(priv,
                                        C_CAN_IFACE(MSGCTRL_REG, 0));
-                        if (msg_ctrl_save & IF_MCONT_EOB)
-                                return num_rx_pkts;
                        if (msg_ctrl_save & IF_MCONT_MSGLST) {
                                c_can_handle_lost_msg_obj(dev, 0, msg_obj);
                                num_rx_pkts++;
@@ -824,6 +821,9 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
                                continue;
                        }
+                        if (msg_ctrl_save & IF_MCONT_EOB)
+                                return num_rx_pkts;
                        if (!(msg_ctrl_save & IF_MCONT_NEWDAT))
                                continue;
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index f9cba4123c66..1870c4731a57 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -705,14 +705,14 @@ static size_t can_get_size(const struct net_device *dev)
        size_t size;
        size = nla_total_size(sizeof(u32));   /* IFLA_CAN_STATE */
-        size += sizeof(struct can_ctrlmode);  /* IFLA_CAN_CTRLMODE */
+        size += nla_total_size(sizeof(struct can_ctrlmode));  /* IFLA_CAN_CTRLMODE */
        size += nla_total_size(sizeof(u32));  /* IFLA_CAN_RESTART_MS */
-        size += sizeof(struct can_bittiming); /* IFLA_CAN_BITTIMING */
+        size += nla_total_size(sizeof(struct can_bittiming)); /* IFLA_CAN_BITTIMING */
-        size += sizeof(struct can_clock);     /* IFLA_CAN_CLOCK */
+        size += nla_total_size(sizeof(struct can_clock));     /* IFLA_CAN_CLOCK */
        if (priv->do_get_berr_counter)        /* IFLA_CAN_BERR_COUNTER */
-                size += sizeof(struct can_berr_counter);
+                size += nla_total_size(sizeof(struct can_berr_counter));
        if (priv->bittiming_const)            /* IFLA_CAN_BITTIMING_CONST */
-                size += sizeof(struct can_bittiming_const);
+                size += nla_total_size(sizeof(struct can_bittiming_const));
        return size;
 }
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 3f21142138b7..8f5ce747feb5 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -62,7 +62,7 @@
 #define FLEXCAN_MCR_BCC                 BIT(16)
 #define FLEXCAN_MCR_LPRIO_EN            BIT(13)
 #define FLEXCAN_MCR_AEN                 BIT(12)
-#define FLEXCAN_MCR_MAXMB(x)            ((x) & 0xf)
+#define FLEXCAN_MCR_MAXMB(x)            ((x) & 0x1f)
 #define FLEXCAN_MCR_IDAM_A              (0 << 8)
 #define FLEXCAN_MCR_IDAM_B              (1 << 8)
 #define FLEXCAN_MCR_IDAM_C              (2 << 8)
@@ -735,9 +735,11 @@ static int flexcan_chip_start(struct net_device *dev)
         *
         */
        reg_mcr = flexcan_read(&regs->mcr);
+        reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
        reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_FEN | FLEXCAN_MCR_HALT |
                FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN |
-                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS;
+                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS |
+                FLEXCAN_MCR_MAXMB(FLEXCAN_TX_BUF_ID);
        netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
        flexcan_write(reg_mcr, &regs->mcr);
@@ -771,6 +773,10 @@ static int flexcan_chip_start(struct net_device *dev)
        netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
        flexcan_write(reg_ctrl, &regs->ctrl);
+        /* Abort any pending TX, mark Mailbox as INACTIVE */
+        flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
+                      &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
        /* acceptance mask/acceptance code (accept everything) */
        flexcan_write(0x0, &regs->rxgmask);
        flexcan_write(0x0, &regs->rx14mask);
@@ -979,9 +985,9 @@ static void unregister_flexcandev(struct net_device *dev)
 }
 static const struct of_device_id flexcan_of_match[] = {
-        { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
-        { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
        { .compatible = "fsl,imx6q-flexcan", .data = &fsl_imx6q_devtype_data, },
+        { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
+        { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
        { /* sentinel */ },
 };
 MODULE_DEVICE_TABLE(of, flexcan_of_match);
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 3b9546588240..4b2d5ed62b11 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -1544,9 +1544,9 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
        return 0;
 }
-static void kvaser_usb_get_endpoints(const struct usb_interface *intf,
+static int kvaser_usb_get_endpoints(const struct usb_interface *intf,
-                                     struct usb_endpoint_descriptor **in,
+                                    struct usb_endpoint_descriptor **in,
-                                     struct usb_endpoint_descriptor **out)
+                                    struct usb_endpoint_descriptor **out)
 {
        const struct usb_host_interface *iface_desc;
        struct usb_endpoint_descriptor *endpoint;
@@ -1557,12 +1557,18 @@ static void kvaser_usb_get_endpoints(const struct usb_interface *intf,
        for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                endpoint = &iface_desc->endpoint[i].desc;
-                if (usb_endpoint_is_bulk_in(endpoint))
+                if (!*in && usb_endpoint_is_bulk_in(endpoint))
                        *in = endpoint;
-                if (usb_endpoint_is_bulk_out(endpoint))
+                if (!*out && usb_endpoint_is_bulk_out(endpoint))
                        *out = endpoint;
+                /* use first bulk endpoint for in and out */
+                if (*in && *out)
+                        return 0;
        }
+        return -ENODEV;
 }
 static int kvaser_usb_probe(struct usb_interface *intf,
@@ -1576,8 +1582,8 @@ static int kvaser_usb_probe(struct usb_interface *intf,
        if (!dev)
                return -ENOMEM;
-        kvaser_usb_get_endpoints(intf, &dev->bulk_in, &dev->bulk_out);
+        err = kvaser_usb_get_endpoints(intf, &dev->bulk_in, &dev->bulk_out);
-        if (!dev->bulk_in || !dev->bulk_out) {
+        if (err) {
                dev_err(&intf->dev, "Cannot get usb endpoint(s)");
                return err;
        }
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 249468f95365..9e8a3e024e01 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -244,25 +244,33 @@ static int bgmac_dma_rx_skb_for_slot(struct bgmac *bgmac,
                                     struct bgmac_slot_info *slot)
 {
        struct device *dma_dev = bgmac->core->dma_dev;
+        struct sk_buff *skb;
+        dma_addr_t dma_addr;
        struct bgmac_rx_header *rx;
        /* Alloc skb */
-        slot->skb = netdev_alloc_skb(bgmac->net_dev, BGMAC_RX_BUF_SIZE);
+        skb = netdev_alloc_skb(bgmac->net_dev, BGMAC_RX_BUF_SIZE);
-        if (!slot->skb)
+        if (!skb)
                return -ENOMEM;
        /* Poison - if everything goes fine, hardware will overwrite it */
-        rx = (struct bgmac_rx_header *)slot->skb->data;
+        rx = (struct bgmac_rx_header *)skb->data;
        rx->len = cpu_to_le16(0xdead);
        rx->flags = cpu_to_le16(0xbeef);
        /* Map skb for the DMA */
-        slot->dma_addr = dma_map_single(dma_dev, slot->skb->data,
+        dma_addr = dma_map_single(dma_dev, skb->data,
-                                        BGMAC_RX_BUF_SIZE, DMA_FROM_DEVICE);
+                                  BGMAC_RX_BUF_SIZE, DMA_FROM_DEVICE);
-        if (dma_mapping_error(dma_dev, slot->dma_addr)) {
+        if (dma_mapping_error(dma_dev, dma_addr)) {
                bgmac_err(bgmac, "DMA mapping error\n");
+                dev_kfree_skb(skb);
                return -ENOMEM;
        }
+        /* Update the slot */
+        slot->skb = skb;
+        slot->dma_addr = dma_addr;
        if (slot->dma_addr & 0xC0000000)
                bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 97b3d32a98bd..c5e375ddd6c0 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1197,8 +1197,9 @@ union cdu_context {
 /* TM (timers) host DB constants */
 #define TM_ILT_PAGE_SZ_HW       0
 #define TM_ILT_PAGE_SZ          (4096 << TM_ILT_PAGE_SZ_HW) /* 4K */
-/* #define TM_CONN_NUM          (CNIC_STARTING_CID+CNIC_ISCSI_CXT_MAX) */
+#define TM_CONN_NUM             (BNX2X_FIRST_VF_CID + \
-#define TM_CONN_NUM             1024
+                                 BNX2X_VF_CIDS + \
+                                 CNIC_ISCSI_CID_MAX)
 #define TM_ILT_SZ               (8 * TM_CONN_NUM)
 #define TM_ILT_LINES            DIV_ROUND_UP(TM_ILT_SZ, TM_ILT_PAGE_SZ)
@@ -1527,7 +1528,6 @@ struct bnx2x {
 #define PCI_32BIT_FLAG                  (1 << 1)
 #define ONE_PORT_FLAG                   (1 << 2)
 #define NO_WOL_FLAG                     (1 << 3)
-#define USING_DAC_FLAG                  (1 << 4)
 #define USING_MSIX_FLAG                 (1 << 5)
 #define USING_MSI_FLAG                  (1 << 6)
 #define DISABLE_MSI_FLAG                (1 << 7)
@@ -1621,7 +1621,7 @@ struct bnx2x {
        u16                     rx_ticks_int;
        u16                     rx_ticks;
 /* Maximal coalescing timeout in us */
-#define BNX2X_MAX_COALESCE_TOUT         (0xf0*12)
+#define BNX2X_MAX_COALESCE_TOUT         (0xff*BNX2X_BTR)
        u32                     lin_cnt;
@@ -2072,7 +2072,8 @@ u32 bnx2x_dmae_opcode(struct bnx2x *bp, u8 src_type, u8 dst_type,
 void bnx2x_prep_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
                               u8 src_type, u8 dst_type);
-int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae);
+int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
+                               u32 *comp);
 /* FLR related routines */
 u32 bnx2x_flr_clnup_poll_count(struct bnx2x *bp);
@@ -2498,4 +2499,8 @@ enum bnx2x_pci_bus_speed {
 };
 void bnx2x_set_local_cmng(struct bnx2x *bp);
+#define MCPR_SCRATCH_BASE(bp) \
+        (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index e66beff2704d..74d6486fccfd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -681,6 +681,7 @@ static void bnx2x_gro_receive(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                }
        }
 #endif
+        skb_record_rx_queue(skb, fp->rx_queue);
        napi_gro_receive(&fp->napi, skb);
 }
@@ -2544,10 +2545,6 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                }
        }
-        /* Allocated memory for FW statistics  */
-        if (bnx2x_alloc_fw_stats_mem(bp))
-                LOAD_ERROR_EXIT(bp, load_error0);
        /* need to be done after alloc mem, since it's self adjusting to amount
         * of memory available for RSS queues
         */
@@ -2557,6 +2554,10 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                LOAD_ERROR_EXIT(bp, load_error0);
        }
+        /* Allocated memory for FW statistics  */
+        if (bnx2x_alloc_fw_stats_mem(bp))
+                LOAD_ERROR_EXIT(bp, load_error0);
        /* request pf to initialize status blocks */
        if (IS_VF(bp)) {
                rc = bnx2x_vfpf_init(bp);
@@ -2811,8 +2812,8 @@ load_error1:
        if (IS_PF(bp))
                bnx2x_clear_pf_load(bp);
 load_error0:
-        bnx2x_free_fp_mem(bp);
        bnx2x_free_fw_stats_mem(bp);
+        bnx2x_free_fp_mem(bp);
        bnx2x_free_mem(bp);
        return rc;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 324de5f05332..e8efa1c93ffe 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -891,17 +891,8 @@ static void bnx2x_get_regs(struct net_device *dev,
         * will re-enable parity attentions right after the dump.
         */
-        /* Disable parity on path 0 */
-        bnx2x_pretend_func(bp, 0);
        bnx2x_disable_blocks_parity(bp);
-        /* Disable parity on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_disable_blocks_parity(bp);
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
        dump_hdr.header_size = (sizeof(struct dump_header) / 4) - 1;
        dump_hdr.preset = DUMP_ALL_PRESETS;
        dump_hdr.version = BNX2X_DUMP_VERSION;
@@ -928,18 +919,9 @@ static void bnx2x_get_regs(struct net_device *dev,
        /* Actually read the registers */
        __bnx2x_get_regs(bp, p);
-        /* Re-enable parity attentions on path 0 */
+        /* Re-enable parity attentions */
-        bnx2x_pretend_func(bp, 0);
        bnx2x_clear_blocks_parity(bp);
        bnx2x_enable_blocks_parity(bp);
-        /* Re-enable parity attentions on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_clear_blocks_parity(bp);
-        bnx2x_enable_blocks_parity(bp);
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
 }
 static int bnx2x_get_preset_regs_len(struct net_device *dev, u32 preset)
@@ -993,17 +975,8 @@ static int bnx2x_get_dump_data(struct net_device *dev,
         * will re-enable parity attentions right after the dump.
         */
-        /* Disable parity on path 0 */
-        bnx2x_pretend_func(bp, 0);
        bnx2x_disable_blocks_parity(bp);
-        /* Disable parity on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_disable_blocks_parity(bp);
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
        dump_hdr.header_size = (sizeof(struct dump_header) / 4) - 1;
        dump_hdr.preset = bp->dump_preset_idx;
        dump_hdr.version = BNX2X_DUMP_VERSION;
@@ -1032,19 +1005,10 @@ static int bnx2x_get_dump_data(struct net_device *dev,
        /* Actually read the registers */
        __bnx2x_get_preset_regs(bp, p, dump_hdr.preset);
-        /* Re-enable parity attentions on path 0 */
+        /* Re-enable parity attentions */
-        bnx2x_pretend_func(bp, 0);
        bnx2x_clear_blocks_parity(bp);
        bnx2x_enable_blocks_parity(bp);
-        /* Re-enable parity attentions on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_clear_blocks_parity(bp);
-        bnx2x_enable_blocks_parity(bp);
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
        return 0;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
index 76df015f486a..c2dfea7968f4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
@@ -640,23 +640,35 @@ static const struct {
 * [30] MCP Latched ump_tx_parity
 * [31] MCP Latched scpad_parity
 */
-#define MISC_AEU_ENABLE_MCP_PRTY_BITS   \
+#define MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS       \
        (AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY | \
         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY | \
-         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY | \
+         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY)
+#define MISC_AEU_ENABLE_MCP_PRTY_BITS   \
+        (MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS | \
         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY)
 /* Below registers control the MCP parity attention output. When
 * MISC_AEU_ENABLE_MCP_PRTY_BITS are set - attentions are
 * enabled, when cleared - disabled.
 */
-static const u32 mcp_attn_ctl_regs[] = {
+static const struct {
-        MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0,
+        u32 addr;
-        MISC_REG_AEU_ENABLE4_NIG_0,
+        u32 bits;
-        MISC_REG_AEU_ENABLE4_PXP_0,
+} mcp_attn_ctl_regs[] = {
-        MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0,
+        { MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0,
-        MISC_REG_AEU_ENABLE4_NIG_1,
+                MISC_AEU_ENABLE_MCP_PRTY_BITS },
-        MISC_REG_AEU_ENABLE4_PXP_1
+        { MISC_REG_AEU_ENABLE4_NIG_0,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_PXP_0,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0,
+                MISC_AEU_ENABLE_MCP_PRTY_BITS },
+        { MISC_REG_AEU_ENABLE4_NIG_1,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_PXP_1,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS }
 };
 static inline void bnx2x_set_mcp_parity(struct bnx2x *bp, u8 enable)
@@ -665,14 +677,14 @@ static inline void bnx2x_set_mcp_parity(struct bnx2x *bp, u8 enable)
        u32 reg_val;
        for (i = 0; i < ARRAY_SIZE(mcp_attn_ctl_regs); i++) {
-                reg_val = REG_RD(bp, mcp_attn_ctl_regs[i]);
+                reg_val = REG_RD(bp, mcp_attn_ctl_regs[i].addr);
                if (enable)
-                        reg_val |= MISC_AEU_ENABLE_MCP_PRTY_BITS;
+                        reg_val |= mcp_attn_ctl_regs[i].bits;
                else
-                        reg_val &= ~MISC_AEU_ENABLE_MCP_PRTY_BITS;
+                        reg_val &= ~mcp_attn_ctl_regs[i].bits;
-                REG_WR(bp, mcp_attn_ctl_regs[i], reg_val);
+                REG_WR(bp, mcp_attn_ctl_regs[i].addr, reg_val);
        }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 82b658d8c04c..b42f89ce02ef 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -503,9 +503,9 @@ void bnx2x_prep_dmae_with_comp(struct bnx2x *bp,
 }
 /* issue a dmae command over the init-channel and wait for completion */
-int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
+int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
+                               u32 *comp)
 {
-        u32 *wb_comp = bnx2x_sp(bp, wb_comp);
        int cnt = CHIP_REV_IS_SLOW(bp) ? (400000) : 4000;
        int rc = 0;
@@ -518,14 +518,14 @@ int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
        spin_lock_bh(&bp->dmae_lock);
        /* reset completion */
-        *wb_comp = 0;
+        *comp = 0;
        /* post the command on the channel used for initializations */
        bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
        /* wait for completion */
        udelay(5);
-        while ((*wb_comp & ~DMAE_PCI_ERR_FLAG) != DMAE_COMP_VAL) {
+        while ((*comp & ~DMAE_PCI_ERR_FLAG) != DMAE_COMP_VAL) {
                if (!cnt ||
                    (bp->recovery_state != BNX2X_RECOVERY_DONE &&
@@ -537,7 +537,7 @@ int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
                cnt--;
                udelay(50);
        }
-        if (*wb_comp & DMAE_PCI_ERR_FLAG) {
+        if (*comp & DMAE_PCI_ERR_FLAG) {
                BNX2X_ERR("DMAE PCI error!\n");
                rc = DMAE_PCI_ERROR;
        }
@@ -574,7 +574,7 @@ void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
        dmae.len = len32;
        /* issue the command and wait for completion */
-        rc = bnx2x_issue_dmae_with_comp(bp, &dmae);
+        rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
        if (rc) {
                BNX2X_ERR("DMAE returned failure %d\n", rc);
                bnx2x_panic();
@@ -611,7 +611,7 @@ void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32)
        dmae.len = len32;
        /* issue the command and wait for completion */
-        rc = bnx2x_issue_dmae_with_comp(bp, &dmae);
+        rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
        if (rc) {
                BNX2X_ERR("DMAE returned failure %d\n", rc);
                bnx2x_panic();
@@ -751,6 +751,10 @@ static int bnx2x_mc_assert(struct bnx2x *bp)
        return rc;
 }
+#define MCPR_TRACE_BUFFER_SIZE  (0x800)
+#define SCRATCH_BUFFER_SIZE(bp) \
+        (CHIP_IS_E1(bp) ? 0x10000 : (CHIP_IS_E1H(bp) ? 0x20000 : 0x28000))
 void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
 {
        u32 addr, val;
@@ -775,7 +779,17 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
                trace_shmem_base = bp->common.shmem_base;
        else
                trace_shmem_base = SHMEM2_RD(bp, other_shmem_base_addr);
-        addr = trace_shmem_base - 0x800;
+        /* sanity */
+        if (trace_shmem_base < MCPR_SCRATCH_BASE(bp) + MCPR_TRACE_BUFFER_SIZE ||
+            trace_shmem_base >= MCPR_SCRATCH_BASE(bp) +
+                                SCRATCH_BUFFER_SIZE(bp)) {
+                BNX2X_ERR("Unable to dump trace buffer (mark %x)\n",
+                          trace_shmem_base);
+                return;
+        }
+        addr = trace_shmem_base - MCPR_TRACE_BUFFER_SIZE;
        /* validate TRCB signature */
        mark = REG_RD(bp, addr);
@@ -787,14 +801,17 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
        /* read cyclic buffer pointer */
        addr += 4;
        mark = REG_RD(bp, addr);
-        mark = (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
+        mark = MCPR_SCRATCH_BASE(bp) + ((mark + 0x3) & ~0x3) - 0x08000000;
-                        + ((mark + 0x3) & ~0x3) - 0x08000000;
+        if (mark >= trace_shmem_base || mark < addr + 4) {
+                BNX2X_ERR("Mark doesn't fall inside Trace Buffer\n");
+                return;
+        }
        printk("%s" "begin fw dump (mark 0x%x)\n", lvl, mark);
        printk("%s", lvl);
        /* dump buffer after the mark */
-        for (offset = mark; offset <= trace_shmem_base; offset += 0x8*4) {
+        for (offset = mark; offset < trace_shmem_base; offset += 0x8*4) {
                for (word = 0; word < 8; word++)
                        data[word] = htonl(REG_RD(bp, offset + 4*word));
                data[8] = 0x0;
@@ -4280,65 +4297,60 @@ static void _print_next_block(int idx, const char *blk)
        pr_cont("%s%s", idx ? ", " : "", blk);
 }
-static int bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
+static bool bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+                                            int *par_num, bool print)
 {
-        int i = 0;
+        u32 cur_bit;
-        u32 cur_bit = 0;
+        bool res;
+        int i;
+        res = false;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
-                        switch (cur_bit) {
+                        res |= true; /* Each bit is real error! */
-                        case AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR:
-                                if (print) {
+                        if (print) {
-                                        _print_next_block(par_num++, "BRB");
+                                switch (cur_bit) {
+                                case AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "BRB");
                                        _print_parity(bp,
                                                      BRB1_REG_BRB1_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_PARSER_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_PARSER_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
-                                if (print) {
+                                                          "PARSER");
-                                        _print_next_block(par_num++, "PARSER");
                                        _print_parity(bp, PRS_REG_PRS_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_TSDM_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_TSDM_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "TSDM");
-                                if (print) {
-                                        _print_next_block(par_num++, "TSDM");
                                        _print_parity(bp,
                                                      TSDM_REG_TSDM_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_SEARCHER_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_SEARCHER_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
-                                if (print) {
-                                        _print_next_block(par_num++,
                                                          "SEARCHER");
                                        _print_parity(bp, SRC_REG_SRC_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_TCM_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_TCM_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "TCM");
-                                if (print) {
+                                        _print_parity(bp, TCM_REG_TCM_PRTY_STS);
-                                        _print_next_block(par_num++, "TCM");
+                                        break;
-                                        _print_parity(bp,
+                                case AEU_INPUTS_ATTN_BITS_TSEMI_PARITY_ERROR:
-                                                      TCM_REG_TCM_PRTY_STS);
+                                        _print_next_block((*par_num)++,
-                                }
+                                                          "TSEMI");
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_TSEMI_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "TSEMI");
                                        _print_parity(bp,
                                                      TSEM_REG_TSEM_PRTY_STS_0);
                                        _print_parity(bp,
                                                      TSEM_REG_TSEM_PRTY_STS_1);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "XPB");
-                                if (print) {
-                                        _print_next_block(par_num++, "XPB");
                                        _print_parity(bp, GRCBASE_XPB +
                                                          PB_REG_PB_PRTY_STS);
+                                        break;
                                }
-                                break;
                        }
                        /* Clear the bit */
@@ -4346,53 +4358,59 @@ static int bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
                }
        }
-        return par_num;
+        return res;
 }
-static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
+static bool bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool *global,
+                                            int *par_num, bool *global,
                                            bool print)
 {
-        int i = 0;
+        u32 cur_bit;
-        u32 cur_bit = 0;
+        bool res;
+        int i;
+        res = false;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
+                        res |= true; /* Each bit is real error! */
                        switch (cur_bit) {
                        case AEU_INPUTS_ATTN_BITS_PBF_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "PBF");
+                                        _print_next_block((*par_num)++, "PBF");
                                        _print_parity(bp, PBF_REG_PBF_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_QM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "QM");
+                                        _print_next_block((*par_num)++, "QM");
                                        _print_parity(bp, QM_REG_QM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_TIMERS_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "TM");
+                                        _print_next_block((*par_num)++, "TM");
                                        _print_parity(bp, TM_REG_TM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_XSDM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "XSDM");
+                                        _print_next_block((*par_num)++, "XSDM");
                                        _print_parity(bp,
                                                      XSDM_REG_XSDM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_XCM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "XCM");
+                                        _print_next_block((*par_num)++, "XCM");
                                        _print_parity(bp, XCM_REG_XCM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_XSEMI_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "XSEMI");
+                                        _print_next_block((*par_num)++,
+                                                          "XSEMI");
                                        _print_parity(bp,
                                                      XSEM_REG_XSEM_PRTY_STS_0);
                                        _print_parity(bp,
@@ -4401,7 +4419,7 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                break;
                        case AEU_INPUTS_ATTN_BITS_DOORBELLQ_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "DOORBELLQ");
                                        _print_parity(bp,
                                                      DORQ_REG_DORQ_PRTY_STS);
@@ -4409,7 +4427,7 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                break;
                        case AEU_INPUTS_ATTN_BITS_NIG_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "NIG");
+                                        _print_next_block((*par_num)++, "NIG");
                                        if (CHIP_IS_E1x(bp)) {
                                                _print_parity(bp,
                                                        NIG_REG_NIG_PRTY_STS);
@@ -4423,32 +4441,34 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                break;
                        case AEU_INPUTS_ATTN_BITS_VAUX_PCI_CORE_PARITY_ERROR:
                                if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "VAUX PCI CORE");
                                *global = true;
                                break;
                        case AEU_INPUTS_ATTN_BITS_DEBUG_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "DEBUG");
+                                        _print_next_block((*par_num)++,
+                                                          "DEBUG");
                                        _print_parity(bp, DBG_REG_DBG_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_USDM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "USDM");
+                                        _print_next_block((*par_num)++, "USDM");
                                        _print_parity(bp,
                                                      USDM_REG_USDM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_UCM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "UCM");
+                                        _print_next_block((*par_num)++, "UCM");
                                        _print_parity(bp, UCM_REG_UCM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_USEMI_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "USEMI");
+                                        _print_next_block((*par_num)++,
+                                                          "USEMI");
                                        _print_parity(bp,
                                                      USEM_REG_USEM_PRTY_STS_0);
                                        _print_parity(bp,
@@ -4457,21 +4477,21 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                break;
                        case AEU_INPUTS_ATTN_BITS_UPB_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "UPB");
+                                        _print_next_block((*par_num)++, "UPB");
                                        _print_parity(bp, GRCBASE_UPB +
                                                          PB_REG_PB_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_CSDM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "CSDM");
+                                        _print_next_block((*par_num)++, "CSDM");
                                        _print_parity(bp,
                                                      CSDM_REG_CSDM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_CCM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "CCM");
+                                        _print_next_block((*par_num)++, "CCM");
                                        _print_parity(bp, CCM_REG_CCM_PRTY_STS);
                                }
                                break;
@@ -4482,80 +4502,73 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                }
        }
-        return par_num;
+        return res;
 }
-static int bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
+static bool bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+                                            int *par_num, bool print)
 {
-        int i = 0;
+        u32 cur_bit;
-        u32 cur_bit = 0;
+        bool res;
+        int i;
+        res = false;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
-                        switch (cur_bit) {
+                        res |= true; /* Each bit is real error! */
-                        case AEU_INPUTS_ATTN_BITS_CSEMI_PARITY_ERROR:
+                        if (print) {
-                                if (print) {
+                                switch (cur_bit) {
-                                        _print_next_block(par_num++, "CSEMI");
+                                case AEU_INPUTS_ATTN_BITS_CSEMI_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "CSEMI");
                                        _print_parity(bp,
                                                      CSEM_REG_CSEM_PRTY_STS_0);
                                        _print_parity(bp,
                                                      CSEM_REG_CSEM_PRTY_STS_1);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_PXP_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_PXP_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "PXP");
-                                if (print) {
-                                        _print_next_block(par_num++, "PXP");
                                        _print_parity(bp, PXP_REG_PXP_PRTY_STS);
                                        _print_parity(bp,
                                                      PXP2_REG_PXP2_PRTY_STS_0);
                                        _print_parity(bp,
                                                      PXP2_REG_PXP2_PRTY_STS_1);
-                                }
+                                        break;
-                                break;
+                                case AEU_IN_ATTN_BITS_PXPPCICLOCKCLIENT_PARITY_ERROR:
-                        case AEU_IN_ATTN_BITS_PXPPCICLOCKCLIENT_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
-                                if (print)
+                                                          "PXPPCICLOCKCLIENT");
-                                        _print_next_block(par_num++,
+                                        break;
-                                        "PXPPCICLOCKCLIENT");
+                                case AEU_INPUTS_ATTN_BITS_CFC_PARITY_ERROR:
-                                break;
+                                        _print_next_block((*par_num)++, "CFC");
-                        case AEU_INPUTS_ATTN_BITS_CFC_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "CFC");
                                        _print_parity(bp,
                                                      CFC_REG_CFC_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_CDU_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_CDU_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "CDU");
-                                if (print) {
-                                        _print_next_block(par_num++, "CDU");
                                        _print_parity(bp, CDU_REG_CDU_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_DMAE_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_DMAE_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "DMAE");
-                                if (print) {
-                                        _print_next_block(par_num++, "DMAE");
                                        _print_parity(bp,
                                                      DMAE_REG_DMAE_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_IGU_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_IGU_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "IGU");
-                                if (print) {
-                                        _print_next_block(par_num++, "IGU");
                                        if (CHIP_IS_E1x(bp))
                                                _print_parity(bp,
                                                        HC_REG_HC_PRTY_STS);
                                        else
                                                _print_parity(bp,
                                                        IGU_REG_IGU_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_MISC_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_MISC_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "MISC");
-                                if (print) {
-                                        _print_next_block(par_num++, "MISC");
                                        _print_parity(bp,
                                                      MISC_REG_MISC_PRTY_STS);
+                                        break;
                                }
-                                break;
                        }
                        /* Clear the bit */
@@ -4563,40 +4576,49 @@ static int bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
                }
        }
-        return par_num;
+        return res;
 }
-static int bnx2x_check_blocks_with_parity3(u32 sig, int par_num,
+static bool bnx2x_check_blocks_with_parity3(struct bnx2x *bp, u32 sig,
-                                           bool *global, bool print)
+                                            int *par_num, bool *global,
+                                            bool print)
 {
-        int i = 0;
+        bool res = false;
-        u32 cur_bit = 0;
+        u32 cur_bit;
+        int i;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
                        switch (cur_bit) {
                        case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY:
                                if (print)
-                                        _print_next_block(par_num++, "MCP ROM");
+                                        _print_next_block((*par_num)++,
+                                                          "MCP ROM");
                                *global = true;
+                                res |= true;
                                break;
                        case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY:
                                if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "MCP UMP RX");
                                *global = true;
+                                res |= true;
                                break;
                        case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY:
                                if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "MCP UMP TX");
                                *global = true;
+                                res |= true;
                                break;
                        case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY:
                                if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "MCP SCPAD");
-                                *global = true;
+                                /* clear latched SCPAD PATIRY from MCP */
+                                REG_WR(bp, MISC_REG_AEU_CLR_LATCH_SIGNAL,
+                                       1UL << 10);
                                break;
                        }
@@ -4605,45 +4627,50 @@ static int bnx2x_check_blocks_with_parity3(u32 sig, int par_num,
                }
        }
-        return par_num;
+        return res;
 }
-static int bnx2x_check_blocks_with_parity4(struct bnx2x *bp, u32 sig,
+static bool bnx2x_check_blocks_with_parity4(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+                                            int *par_num, bool print)
 {
-        int i = 0;
+        u32 cur_bit;
-        u32 cur_bit = 0;
+        bool res;
+        int i;
+        res = false;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
-                        switch (cur_bit) {
+                        res |= true; /* Each bit is real error! */
-                        case AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR:
+                        if (print) {
-                                if (print) {
+                                switch (cur_bit) {
-                                        _print_next_block(par_num++, "PGLUE_B");
+                                case AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "PGLUE_B");
                                        _print_parity(bp,
-                                                PGLUE_B_REG_PGLUE_B_PRTY_STS);
+                                                      PGLUE_B_REG_PGLUE_B_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "ATC");
-                                if (print) {
-                                        _print_next_block(par_num++, "ATC");
                                        _print_parity(bp,
                                                      ATC_REG_ATC_PRTY_STS);
+                                        break;
                                }
-                                break;
                        }
                        /* Clear the bit */
                        sig &= ~cur_bit;
                }
        }
-        return par_num;
+        return res;
 }
 static bool bnx2x_parity_attn(struct bnx2x *bp, bool *global, bool print,
                              u32 *sig)
 {
+        bool res = false;
        if ((sig[0] & HW_PRTY_ASSERT_SET_0) ||
            (sig[1] & HW_PRTY_ASSERT_SET_1) ||
            (sig[2] & HW_PRTY_ASSERT_SET_2) ||
@@ -4660,23 +4687,22 @@ static bool bnx2x_parity_attn(struct bnx2x *bp, bool *global, bool print,
                if (print)
                        netdev_err(bp->dev,
                                   "Parity errors detected in blocks: ");
-                par_num = bnx2x_check_blocks_with_parity0(bp,
+                res |= bnx2x_check_blocks_with_parity0(bp,
-                        sig[0] & HW_PRTY_ASSERT_SET_0, par_num, print);
+                        sig[0] & HW_PRTY_ASSERT_SET_0, &par_num, print);
-                par_num = bnx2x_check_blocks_with_parity1(bp,
+                res |= bnx2x_check_blocks_with_parity1(bp,
-                        sig[1] & HW_PRTY_ASSERT_SET_1, par_num, global, print);
+                        sig[1] & HW_PRTY_ASSERT_SET_1, &par_num, global, print);
-                par_num = bnx2x_check_blocks_with_parity2(bp,
+                res |= bnx2x_check_blocks_with_parity2(bp,
-                        sig[2] & HW_PRTY_ASSERT_SET_2, par_num, print);
+                        sig[2] & HW_PRTY_ASSERT_SET_2, &par_num, print);
-                par_num = bnx2x_check_blocks_with_parity3(
+                res |= bnx2x_check_blocks_with_parity3(bp,
-                        sig[3] & HW_PRTY_ASSERT_SET_3, par_num, global, print);
+                        sig[3] & HW_PRTY_ASSERT_SET_3, &par_num, global, print);
-                par_num = bnx2x_check_blocks_with_parity4(bp,
+                res |= bnx2x_check_blocks_with_parity4(bp,
-                        sig[4] & HW_PRTY_ASSERT_SET_4, par_num, print);
+                        sig[4] & HW_PRTY_ASSERT_SET_4, &par_num, print);
                if (print)
                        pr_cont("\n");
+        }
-                return true;
+        return res;
-        } else
-                return false;
 }
 /**
@@ -7126,7 +7152,7 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
        int port = BP_PORT(bp);
        int init_phase = port ? PHASE_PORT1 : PHASE_PORT0;
        u32 low, high;
-        u32 val;
+        u32 val, reg;
        DP(NETIF_MSG_HW, "starting port init  port %d\n", port);
@@ -7271,6 +7297,17 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
        val |= CHIP_IS_E1(bp) ? 0 : 0x10;
        REG_WR(bp, MISC_REG_AEU_MASK_ATTN_FUNC_0 + port*4, val);
+        /* SCPAD_PARITY should NOT trigger close the gates */
+        reg = port ? MISC_REG_AEU_ENABLE4_NIG_1 : MISC_REG_AEU_ENABLE4_NIG_0;
+        REG_WR(bp, reg,
+               REG_RD(bp, reg) &
+               ~AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY);
+        reg = port ? MISC_REG_AEU_ENABLE4_PXP_1 : MISC_REG_AEU_ENABLE4_PXP_0;
+        REG_WR(bp, reg,
+               REG_RD(bp, reg) &
+               ~AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY);
        bnx2x_init_block(bp, BLOCK_NIG, init_phase);
        if (!CHIP_IS_E1x(bp)) {
@@ -11685,9 +11722,6 @@ static int bnx2x_init_bp(struct bnx2x *bp)
 static int bnx2x_open(struct net_device *dev)
 {
        struct bnx2x *bp = netdev_priv(dev);
-        bool global = false;
-        int other_engine = BP_PATH(bp) ? 0 : 1;
-        bool other_load_status, load_status;
        int rc;
        bp->stats_init = true;
@@ -11703,6 +11737,10 @@ static int bnx2x_open(struct net_device *dev)
         * Parity recovery is only relevant for PF driver.
         */
        if (IS_PF(bp)) {
+                int other_engine = BP_PATH(bp) ? 0 : 1;
+                bool other_load_status, load_status;
+                bool global = false;
                other_load_status = bnx2x_get_load_status(bp, other_engine);
                load_status = bnx2x_get_load_status(bp, BP_PATH(bp));
                if (!bnx2x_reset_is_done(bp, BP_PATH(bp)) ||
@@ -12080,7 +12118,6 @@ static int bnx2x_set_coherency_mask(struct bnx2x *bp)
        struct device *dev = &bp->pdev->dev;
        if (dma_set_mask(dev, DMA_BIT_MASK(64)) == 0) {
-                bp->flags |= USING_DAC_FLAG;
                if (dma_set_coherent_mask(dev, DMA_BIT_MASK(64)) != 0) {
                        dev_err(dev, "dma_set_coherent_mask failed, aborting\n");
                        return -EIO;
@@ -12248,8 +12285,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_HIGHDMA;
        dev->features |= dev->hw_features | NETIF_F_HW_VLAN_CTAG_RX;
-        if (bp->flags & USING_DAC_FLAG)
+        dev->features |= NETIF_F_HIGHDMA;
-                dev->features |= NETIF_F_HIGHDMA;
        /* Add Loopback capability to the device */
        dev->hw_features |= NETIF_F_LOOPBACK;
@@ -12612,24 +12648,24 @@ static int set_max_cos_est(int chip_id)
                return BNX2X_MULTI_TX_COS_E1X;
        case BCM57712:
        case BCM57712_MF:
-        case BCM57712_VF:
                return BNX2X_MULTI_TX_COS_E2_E3A0;
        case BCM57800:
        case BCM57800_MF:
-        case BCM57800_VF:
        case BCM57810:
        case BCM57810_MF:
        case BCM57840_4_10:
        case BCM57840_2_20:
        case BCM57840_O:
        case BCM57840_MFO:
-        case BCM57810_VF:
        case BCM57840_MF:
-        case BCM57840_VF:
        case BCM57811:
        case BCM57811_MF:
-        case BCM57811_VF:
                return BNX2X_MULTI_TX_COS_E3B0;
+        case BCM57712_VF:
+        case BCM57800_VF:
+        case BCM57810_VF:
+        case BCM57840_VF:
+        case BCM57811_VF:
                return 1;
        default:
                pr_err("Unknown board_type (%d), aborting\n", chip_id);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 9ad012bdd915..5e07efb6ec13 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -470,10 +470,10 @@ static int bnx2x_vfop_qdtor_cmd(struct bnx2x *bp,
                                 bnx2x_vfop_qdtor, cmd->done);
                return bnx2x_vfop_transition(bp, vf, bnx2x_vfop_qdtor,
                                             cmd->block);
+        } else {
+                BNX2X_ERR("VF[%d] failed to add a vfop\n", vf->abs_vfid);
+                return -ENOMEM;
        }
-        DP(BNX2X_MSG_IOV, "VF[%d] failed to add a vfop. rc %d\n",
-           vf->abs_vfid, vfop->rc);
-        return -ENOMEM;
 }
 static void
@@ -2018,6 +2018,8 @@ failed:
 void bnx2x_iov_remove_one(struct bnx2x *bp)
 {
+        int vf_idx;
        /* if SRIOV is not enabled there's nothing to do */
        if (!IS_SRIOV(bp))
                return;
@@ -2026,6 +2028,18 @@ void bnx2x_iov_remove_one(struct bnx2x *bp)
        pci_disable_sriov(bp->pdev);
        DP(BNX2X_MSG_IOV, "sriov disabled\n");
+        /* disable access to all VFs */
+        for (vf_idx = 0; vf_idx < bp->vfdb->sriov.total; vf_idx++) {
+                bnx2x_pretend_func(bp,
+                                   HW_VF_HANDLE(bp,
+                                                bp->vfdb->sriov.first_vf_in_pf +
+                                                vf_idx));
+                DP(BNX2X_MSG_IOV, "disabling internal access for vf %d\n",
+                   bp->vfdb->sriov.first_vf_in_pf + vf_idx);
+                bnx2x_vf_enable_internal(bp, 0);
+                bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
+        }
        /* free vf database */
        __bnx2x_iov_free_vfdb(bp);
 }
@@ -3197,7 +3211,7 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
         * the "acquire" messages to appear on the VF PF channel.
         */
        DP(BNX2X_MSG_IOV, "about to call enable sriov\n");
-        pci_disable_sriov(bp->pdev);
+        bnx2x_disable_sriov(bp);
        rc = pci_enable_sriov(bp->pdev, req_vfs);
        if (rc) {
                BNX2X_ERR("pci_enable_sriov failed with %d\n", rc);
@@ -3390,14 +3404,16 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
                rc = bnx2x_del_all_macs(bp, mac_obj, BNX2X_ETH_MAC, true);
                if (rc) {
                        BNX2X_ERR("failed to delete eth macs\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                }
                /* remove existing uc list macs */
                rc = bnx2x_del_all_macs(bp, mac_obj, BNX2X_UC_LIST_MAC, true);
                if (rc) {
                        BNX2X_ERR("failed to delete uc_list macs\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                }
                /* configure the new mac to device */
@@ -3405,6 +3421,7 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
                bnx2x_set_mac_one(bp, (u8 *)&bulletin->mac, mac_obj, true,
                                  BNX2X_ETH_MAC, &ramrod_flags);
+out:
                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_MAC);
        }
@@ -3467,7 +3484,8 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                                          &ramrod_flags);
                if (rc) {
                        BNX2X_ERR("failed to delete vlans\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                }
                /* send queue update ramrod to configure default vlan and silent
@@ -3501,7 +3519,8 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
                        if (rc) {
                                BNX2X_ERR("failed to configure vlan\n");
-                                return -EINVAL;
+                                rc =  -EINVAL;
+                                goto out;
                        }
                        /* configure default vlan to vf queue and set silent
@@ -3519,18 +3538,18 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                rc = bnx2x_queue_state_change(bp, &q_params);
                if (rc) {
                        BNX2X_ERR("Failed to configure default VLAN\n");
-                        return rc;
+                        goto out;
                }
                /* clear the flag indicating that this VF needs its vlan
-                 * (will only be set if the HV configured th Vlan before vf was
+                 * (will only be set if the HV configured the Vlan before vf was
-                 * and we were called because the VF came up later
+                 * up and we were called because the VF came up later
                 */
+out:
                vf->cfg_flags &= ~VF_CFG_VLAN;
                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
        }
-        return 0;
+        return rc;
 }
 /* crc is the first field in the bulletin board. Compute the crc over the
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 86436c77af03..3b75070411aa 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -196,7 +196,7 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
        } else if (bp->func_stx) {
                *stats_comp = 0;
-                bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
+                bnx2x_issue_dmae_with_comp(bp, dmae, stats_comp);
        }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index da16953eb2ec..28757dfacf0d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -980,7 +980,7 @@ static int bnx2x_copy32_vf_dmae(struct bnx2x *bp, u8 from_vf,
        dmae.len = len32;
        /* issue the command and wait for completion */
-        return bnx2x_issue_dmae_with_comp(bp, &dmae);
+        return bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
 }
 static void bnx2x_vf_mbx_resp(struct bnx2x *bp, struct bnx2x_virtf *vf)
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index 78d6d6b970e1..48f52882a22b 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -106,7 +106,6 @@
 #define XGMAC_DMA_HW_FEATURE    0x00000f58      /* Enabled Hardware Features */
 #define XGMAC_ADDR_AE           0x80000000
-#define XGMAC_MAX_FILTER_ADDR   31
 /* PMT Control and Status */
 #define XGMAC_PMT_POINTER_RESET 0x80000000
@@ -384,6 +383,7 @@ struct xgmac_priv {
        struct device *device;
        struct napi_struct napi;
+        int max_macs;
        struct xgmac_extra_stats xstats;
        spinlock_t stats_lock;
@@ -1291,14 +1291,12 @@ static void xgmac_set_rx_mode(struct net_device *dev)
        netdev_dbg(priv->dev, "# mcasts %d, # unicast %d\n",
                 netdev_mc_count(dev), netdev_uc_count(dev));
-        if (dev->flags & IFF_PROMISC) {
+        if (dev->flags & IFF_PROMISC)
-                writel(XGMAC_FRAME_FILTER_PR, ioaddr + XGMAC_FRAME_FILTER);
+                value |= XGMAC_FRAME_FILTER_PR;
-                return;
-        }
        memset(hash_filter, 0, sizeof(hash_filter));
-        if (netdev_uc_count(dev) > XGMAC_MAX_FILTER_ADDR) {
+        if (netdev_uc_count(dev) > priv->max_macs) {
                use_hash = true;
                value |= XGMAC_FRAME_FILTER_HUC | XGMAC_FRAME_FILTER_HPF;
        }
@@ -1321,7 +1319,7 @@ static void xgmac_set_rx_mode(struct net_device *dev)
                goto out;
        }
-        if ((netdev_mc_count(dev) + reg - 1) > XGMAC_MAX_FILTER_ADDR) {
+        if ((netdev_mc_count(dev) + reg - 1) > priv->max_macs) {
                use_hash = true;
                value |= XGMAC_FRAME_FILTER_HMC | XGMAC_FRAME_FILTER_HPF;
        } else {
@@ -1342,8 +1340,8 @@ static void xgmac_set_rx_mode(struct net_device *dev)
        }
 out:
-        for (i = reg; i < XGMAC_MAX_FILTER_ADDR; i++)
+        for (i = reg; i <= priv->max_macs; i++)
-                xgmac_set_mac_addr(ioaddr, NULL, reg);
+                xgmac_set_mac_addr(ioaddr, NULL, i);
        for (i = 0; i < XGMAC_NUM_HASH; i++)
                writel(hash_filter[i], ioaddr + XGMAC_HASH(i));
@@ -1761,6 +1759,13 @@ static int xgmac_probe(struct platform_device *pdev)
        uid = readl(priv->base + XGMAC_VERSION);
        netdev_info(ndev, "h/w version is 0x%x\n", uid);
+        /* Figure out how many valid mac address filter registers we have */
+        writel(1, priv->base + XGMAC_ADDR_HIGH(31));
+        if (readl(priv->base + XGMAC_ADDR_HIGH(31)) == 1)
+                priv->max_macs = 31;
+        else
+                priv->max_macs = 7;
        writel(0, priv->base + XGMAC_DMA_INTR_ENA);
        ndev->irq = platform_get_irq(pdev, 0);
        if (ndev->irq == -ENXIO) {
diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
index 9c89dc8fe105..632b318eb38a 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
@@ -1599,7 +1599,8 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
        flits = skb_transport_offset(skb) / 8;
        sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
        sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
-                             skb->tail - skb->transport_header,
+                             skb_tail_pointer(skb) -
+                             skb_transport_header(skb),
                             adap->pdev);
        if (need_skb_unmap()) {
                setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 5f5896e522d2..a7a941b1a655 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -158,18 +158,6 @@ static inline board_info_t *to_dm9000_board(struct net_device *dev)
 /* DM9000 network board routine ---------------------------- */
-static void
-dm9000_reset(board_info_t * db)
-{
-        dev_dbg(db->dev, "resetting device\n");
-        /* RESET device */
-        writeb(DM9000_NCR, db->io_addr);
-        udelay(200);
-        writeb(NCR_RST, db->io_data);
-        udelay(200);
-}
 /*
 *   Read a byte from I/O port
 */
@@ -191,6 +179,27 @@ iow(board_info_t * db, int reg, int value)
        writeb(value, db->io_data);
 }
+static void
+dm9000_reset(board_info_t *db)
+{
+        dev_dbg(db->dev, "resetting device\n");
+        /* Reset DM9000, see DM9000 Application Notes V1.22 Jun 11, 2004 page 29
+         * The essential point is that we have to do a double reset, and the
+         * instruction is to set LBK into MAC internal loopback mode.
+         */
+        iow(db, DM9000_NCR, 0x03);
+        udelay(100); /* Application note says at least 20 us */
+        if (ior(db, DM9000_NCR) & 1)
+                dev_err(db->dev, "dm9000 did not respond to first reset\n");
+        iow(db, DM9000_NCR, 0);
+        iow(db, DM9000_NCR, 0x03);
+        udelay(100);
+        if (ior(db, DM9000_NCR) & 1)
+                dev_err(db->dev, "dm9000 did not respond to second reset\n");
+}
 /* routines for sending block to chip */
 static void dm9000_outblk_8bit(void __iomem *reg, void *data, int count)
@@ -744,15 +753,20 @@ static const struct ethtool_ops dm9000_ethtool_ops = {
 static void dm9000_show_carrier(board_info_t *db,
                                unsigned carrier, unsigned nsr)
 {
+        int lpa;
        struct net_device *ndev = db->ndev;
+        struct mii_if_info *mii = &db->mii;
        unsigned ncr = dm9000_read_locked(db, DM9000_NCR);
-        if (carrier)
+        if (carrier) {
-                dev_info(db->dev, "%s: link up, %dMbps, %s-duplex, no LPA\n",
+                lpa = mii->mdio_read(mii->dev, mii->phy_id, MII_LPA);
+                dev_info(db->dev,
+                         "%s: link up, %dMbps, %s-duplex, lpa 0x%04X\n",
                         ndev->name, (nsr & NSR_SPEED) ? 10 : 100,
-                         (ncr & NCR_FDX) ? "full" : "half");
+                         (ncr & NCR_FDX) ? "full" : "half", lpa);
-        else
+        } else {
                dev_info(db->dev, "%s: link down\n", ndev->name);
+        }
 }
 static void
@@ -890,9 +904,15 @@ dm9000_init_dm9000(struct net_device *dev)
                        (dev->features & NETIF_F_RXCSUM) ? RCSR_CSUM : 0);
        iow(db, DM9000_GPCR, GPCR_GEP_CNTL);    /* Let GPIO0 output */
+        iow(db, DM9000_GPR, 0);
-        dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */
+        /* If we are dealing with DM9000B, some extra steps are required: a
-        dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */
+         * manual phy reset, and setting init params.
+         */
+        if (db->type == TYPE_DM9000B) {
+                dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET);
+                dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM);
+        }
        ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index db020230bd0b..c99dac6a9ddf 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -696,6 +696,15 @@ static inline int qnq_async_evt_rcvd(struct be_adapter *adapter)
        return adapter->flags & BE_FLAGS_QNQ_ASYNC_EVT_RCVD;
 }
+static inline int fw_major_num(const char *fw_ver)
+{
+        int fw_major = 0;
+        sscanf(fw_ver, "%d.", &fw_major);
+        return fw_major;
+}
 extern void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm,
                u16 num_popped);
 extern void be_link_status_update(struct be_adapter *adapter, u8 link_status);
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index bd0e0c0bbcd8..c08fd32bb8e5 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1198,7 +1198,6 @@ int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo)
        if (lancer_chip(adapter)) {
                req->hdr.version = 1;
-                req->if_id = cpu_to_le16(adapter->if_handle);
        } else if (BEx_chip(adapter)) {
                if (adapter->function_caps & BE_FUNCTION_CAPS_SUPER_NIC)
                        req->hdr.version = 2;
@@ -1206,6 +1205,8 @@ int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo)
                req->hdr.version = 2;
        }
+        if (req->hdr.version > 0)
+                req->if_id = cpu_to_le16(adapter->if_handle);
        req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
        req->ulp_num = BE_ULP1_NUM;
        req->type = BE_ETH_TX_RING_TYPE_STANDARD;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 2c38cc402119..53ed58b492c8 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3247,6 +3247,12 @@ static int be_setup(struct be_adapter *adapter)
        be_cmd_get_fw_ver(adapter, adapter->fw_ver, adapter->fw_on_flash);
+        if (BE2_chip(adapter) && fw_major_num(adapter->fw_ver) < 4) {
+                dev_err(dev, "Firmware on card is old(%s), IRQs may not work.",
+                        adapter->fw_ver);
+                dev_err(dev, "Please upgrade firmware to version >= 4.0\n");
+        }
        if (adapter->vlans_added)
                be_vid_config(adapter);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index c4eaadeb572f..9fbe4dda7a0e 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -88,6 +88,7 @@
 #include <asm/io.h>
 #include <asm/reg.h>
+#include <asm/mpc85xx.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 #include <linux/module.h>
@@ -939,9 +940,8 @@ static void gfar_init_filer_table(struct gfar_private *priv)
        }
 }
-static void gfar_detect_errata(struct gfar_private *priv)
+static void __gfar_detect_errata_83xx(struct gfar_private *priv)
 {
-        struct device *dev = &priv->ofdev->dev;
        unsigned int pvr = mfspr(SPRN_PVR);
        unsigned int svr = mfspr(SPRN_SVR);
        unsigned int mod = (svr >> 16) & 0xfff6; /* w/o E suffix */
@@ -957,15 +957,33 @@ static void gfar_detect_errata(struct gfar_private *priv)
            (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
                priv->errata |= GFAR_ERRATA_76;
-        /* MPC8313 and MPC837x all rev */
+        /* MPC8313 Rev < 2.0 */
-        if ((pvr == 0x80850010 && mod == 0x80b0) ||
+        if (pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020)
-            (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
+                priv->errata |= GFAR_ERRATA_12;
-                priv->errata |= GFAR_ERRATA_A002;
+}
-        /* MPC8313 Rev < 2.0, MPC8548 rev 2.0 */
+static void __gfar_detect_errata_85xx(struct gfar_private *priv)
-        if ((pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020) ||
+{
-            (pvr == 0x80210020 && mod == 0x8030 && rev == 0x0020))
+        unsigned int svr = mfspr(SPRN_SVR);
+        if ((SVR_SOC_VER(svr) == SVR_8548) && (SVR_REV(svr) == 0x20))
                priv->errata |= GFAR_ERRATA_12;
+        if (((SVR_SOC_VER(svr) == SVR_P2020) && (SVR_REV(svr) < 0x20)) ||
+            ((SVR_SOC_VER(svr) == SVR_P2010) && (SVR_REV(svr) < 0x20)))
+                priv->errata |= GFAR_ERRATA_76; /* aka eTSEC 20 */
+}
+static void gfar_detect_errata(struct gfar_private *priv)
+{
+        struct device *dev = &priv->ofdev->dev;
+        /* no plans to fix */
+        priv->errata |= GFAR_ERRATA_A002;
+        if (pvr_version_is(PVR_VER_E500V1) || pvr_version_is(PVR_VER_E500V2))
+                __gfar_detect_errata_85xx(priv);
+        else /* non-mpc85xx parts, i.e. e300 core based */
+                __gfar_detect_errata_83xx(priv);
        if (priv->errata)
                dev_info(dev, "enabled errata workarounds, flags: 0x%x\n",
@@ -1599,7 +1617,7 @@ static int __gfar_is_rx_idle(struct gfar_private *priv)
        /* Normaly TSEC should not hang on GRS commands, so we should
         * actually wait for IEVENT_GRSC flag.
         */
-        if (likely(!gfar_has_errata(priv, GFAR_ERRATA_A002)))
+        if (!gfar_has_errata(priv, GFAR_ERRATA_A002))
                return 0;
        /* Read the eTSEC register at offset 0xD1C. If bits 7-14 are
diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c
index dac564c25440..e7847510eda2 100644
--- a/drivers/net/ethernet/ibm/emac/mal.c
+++ b/drivers/net/ethernet/ibm/emac/mal.c
@@ -263,7 +263,9 @@ static inline void mal_schedule_poll(struct mal_instance *mal)
 {
        if (likely(napi_schedule_prep(&mal->napi))) {
                MAL_DBG2(mal, "schedule_poll" NL);
+                spin_lock(&mal->lock);
                mal_disable_eob_irq(mal);
+                spin_unlock(&mal->lock);
                __napi_schedule(&mal->napi);
        } else
                MAL_DBG2(mal, "already in poll" NL);
@@ -442,15 +444,13 @@ static int mal_poll(struct napi_struct *napi, int budget)
                if (unlikely(mc->ops->peek_rx(mc->dev) ||
                             test_bit(MAL_COMMAC_RX_STOPPED, &mc->flags))) {
                        MAL_DBG2(mal, "rotting packet" NL);
-                        if (napi_reschedule(napi))
+                        if (!napi_reschedule(napi))
-                                mal_disable_eob_irq(mal);
-                        else
-                                MAL_DBG2(mal, "already in poll list" NL);
-                        if (budget > 0)
-                                goto again;
-                        else
                                goto more_work;
+                        spin_lock_irqsave(&mal->lock, flags);
+                        mal_disable_eob_irq(mal);
+                        spin_unlock_irqrestore(&mal->lock, flags);
+                        goto again;
                }
                mc->ops->poll_tx(mc->dev);
        }
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 86d51429a189..151e00cad113 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2655,6 +2655,8 @@ static int igb_set_eee(struct net_device *netdev,
            (hw->phy.media_type != e1000_media_type_copper))
                return -EOPNOTSUPP;
+        memset(&eee_curr, 0, sizeof(struct ethtool_eee));
        ret_val = igb_get_eee(netdev, &eee_curr);
        if (ret_val)
                return ret_val;
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 7fb5677451f9..2c210ec35d59 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1131,15 +1131,13 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
        p->rx_discard += rdlp(mp, RX_DISCARD_FRAME_CNT);
        p->rx_overrun += rdlp(mp, RX_OVERRUN_FRAME_CNT);
        spin_unlock_bh(&mp->mib_counters_lock);
-        mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
 }
 static void mib_counters_timer_wrapper(unsigned long _mp)
 {
        struct mv643xx_eth_private *mp = (void *)_mp;
        mib_counters_update(mp);
+        mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
 }
@@ -2237,6 +2235,7 @@ static int mv643xx_eth_open(struct net_device *dev)
                mp->int_mask |= INT_TX_END_0 << i;
        }
+        add_timer(&mp->mib_counters_timer);
        port_start(mp);
        wrlp(mp, INT_MASK_EXT, INT_EXT_LINK_PHY | INT_EXT_TX);
@@ -2534,6 +2533,7 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
        if (!ppdev)
                return -ENOMEM;
        ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
+        ppdev->dev.of_node = pnp;
        ret = platform_device_add_resources(ppdev, &res, 1);
        if (ret)
@@ -2916,7 +2916,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
        mp->mib_counters_timer.data = (unsigned long)mp;
        mp->mib_counters_timer.function = mib_counters_timer_wrapper;
        mp->mib_counters_timer.expires = jiffies + 30 * HZ;
-        add_timer(&mp->mib_counters_timer);
        spin_lock_init(&mp->mib_counters_lock);
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index ea20182c6969..bb11624a1f39 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -1691,7 +1691,7 @@ static void mlx4_master_deactivate_admin_state(struct mlx4_priv *priv, int slave
                        vp_oper->vlan_idx = NO_INDX;
                }
                if (NO_INDX != vp_oper->mac_idx) {
-                        __mlx4_unregister_mac(&priv->dev, port, vp_oper->mac_idx);
+                        __mlx4_unregister_mac(&priv->dev, port, vp_oper->state.mac);
                        vp_oper->mac_idx = NO_INDX;
                }
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index dec455c8f627..afe2efa69c86 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -70,14 +70,15 @@ static int mlx4_alloc_pages(struct mlx4_en_priv *priv,
                put_page(page);
                return -ENOMEM;
        }
-        page_alloc->size = PAGE_SIZE << order;
+        page_alloc->page_size = PAGE_SIZE << order;
        page_alloc->page = page;
        page_alloc->dma = dma;
-        page_alloc->offset = frag_info->frag_align;
+        page_alloc->page_offset = frag_info->frag_align;
        /* Not doing get_page() for each frag is a big win
         * on asymetric workloads.
         */
-        atomic_set(&page->_count, page_alloc->size / frag_info->frag_stride);
+        atomic_set(&page->_count,
+                   page_alloc->page_size / frag_info->frag_stride);
        return 0;
 }
@@ -96,16 +97,19 @@ static int mlx4_en_alloc_frags(struct mlx4_en_priv *priv,
        for (i = 0; i < priv->num_frags; i++) {
                frag_info = &priv->frag_info[i];
                page_alloc[i] = ring_alloc[i];
-                page_alloc[i].offset += frag_info->frag_stride;
+                page_alloc[i].page_offset += frag_info->frag_stride;
-                if (page_alloc[i].offset + frag_info->frag_stride <= ring_alloc[i].size)
+                if (page_alloc[i].page_offset + frag_info->frag_stride <=
+                    ring_alloc[i].page_size)
                        continue;
                if (mlx4_alloc_pages(priv, &page_alloc[i], frag_info, gfp))
                        goto out;
        }
        for (i = 0; i < priv->num_frags; i++) {
                frags[i] = ring_alloc[i];
-                dma = ring_alloc[i].dma + ring_alloc[i].offset;
+                dma = ring_alloc[i].dma + ring_alloc[i].page_offset;
                ring_alloc[i] = page_alloc[i];
                rx_desc->data[i].addr = cpu_to_be64(dma);
        }
@@ -117,7 +121,7 @@ out:
                frag_info = &priv->frag_info[i];
                if (page_alloc[i].page != ring_alloc[i].page) {
                        dma_unmap_page(priv->ddev, page_alloc[i].dma,
-                                page_alloc[i].size, PCI_DMA_FROMDEVICE);
+                                page_alloc[i].page_size, PCI_DMA_FROMDEVICE);
                        page = page_alloc[i].page;
                        atomic_set(&page->_count, 1);
                        put_page(page);
@@ -131,10 +135,12 @@ static void mlx4_en_free_frag(struct mlx4_en_priv *priv,
                              int i)
 {
        const struct mlx4_en_frag_info *frag_info = &priv->frag_info[i];
+        u32 next_frag_end = frags[i].page_offset + 2 * frag_info->frag_stride;
-        if (frags[i].offset + frag_info->frag_stride > frags[i].size)
+        if (next_frag_end > frags[i].page_size)
-                dma_unmap_page(priv->ddev, frags[i].dma, frags[i].size,
+                dma_unmap_page(priv->ddev, frags[i].dma, frags[i].page_size,
-                                         PCI_DMA_FROMDEVICE);
+                               PCI_DMA_FROMDEVICE);
        if (frags[i].page)
                put_page(frags[i].page);
@@ -161,7 +167,7 @@ out:
                page_alloc = &ring->page_alloc[i];
                dma_unmap_page(priv->ddev, page_alloc->dma,
-                               page_alloc->size, PCI_DMA_FROMDEVICE);
+                               page_alloc->page_size, PCI_DMA_FROMDEVICE);
                page = page_alloc->page;
                atomic_set(&page->_count, 1);
                put_page(page);
@@ -184,10 +190,11 @@ static void mlx4_en_destroy_allocator(struct mlx4_en_priv *priv,
                       i, page_count(page_alloc->page));
                dma_unmap_page(priv->ddev, page_alloc->dma,
-                                page_alloc->size, PCI_DMA_FROMDEVICE);
+                                page_alloc->page_size, PCI_DMA_FROMDEVICE);
-                while (page_alloc->offset + frag_info->frag_stride < page_alloc->size) {
+                while (page_alloc->page_offset + frag_info->frag_stride <
+                       page_alloc->page_size) {
                        put_page(page_alloc->page);
-                        page_alloc->offset += frag_info->frag_stride;
+                        page_alloc->page_offset += frag_info->frag_stride;
                }
                page_alloc->page = NULL;
        }
@@ -478,7 +485,7 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                /* Save page reference in skb */
                __skb_frag_set_page(&skb_frags_rx[nr], frags[nr].page);
                skb_frag_size_set(&skb_frags_rx[nr], frag_info->frag_size);
-                skb_frags_rx[nr].page_offset = frags[nr].offset;
+                skb_frags_rx[nr].page_offset = frags[nr].page_offset;
                skb->truesize += frag_info->frag_stride;
                frags[nr].page = NULL;
        }
@@ -517,7 +524,7 @@ static struct sk_buff *mlx4_en_rx_skb(struct mlx4_en_priv *priv,
        /* Get pointer to first fragment so we could copy the headers into the
         * (linear part of the) skb */
-        va = page_address(frags[0].page) + frags[0].offset;
+        va = page_address(frags[0].page) + frags[0].page_offset;
        if (length <= SMALL_PACKET_SIZE) {
                /* We are copying all relevant data to the skb - temporarily
@@ -645,7 +652,7 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                        dma_sync_single_for_cpu(priv->ddev, dma, sizeof(*ethh),
                                                DMA_FROM_DEVICE);
                        ethh = (struct ethhdr *)(page_address(frags[0].page) +
-                                                 frags[0].offset);
+                                                 frags[0].page_offset);
                        if (is_multicast_ether_addr(ethh->h_dest)) {
                                struct mlx4_mac_entry *entry;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 5e0aa569306a..bf06e3610d27 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -237,8 +237,8 @@ struct mlx4_en_tx_desc {
 struct mlx4_en_rx_alloc {
        struct page     *page;
        dma_addr_t      dma;
-        u32             offset;
+        u32             page_offset;
-        u32             size;
+        u32             page_size;
 };
 struct mlx4_en_tx_ring {
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index bd1a2d2bc2ae..ea54d95e5b9f 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -448,7 +448,8 @@ static int moxart_mac_probe(struct platform_device *pdev)
        irq = irq_of_parse_and_map(node, 0);
        if (irq <= 0) {
                netdev_err(ndev, "irq_of_parse_and_map failed\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto irq_map_fail;
        }
        priv = netdev_priv(ndev);
@@ -472,24 +473,32 @@ static int moxart_mac_probe(struct platform_device *pdev)
        priv->tx_desc_base = dma_alloc_coherent(NULL, TX_REG_DESC_SIZE *
                                                TX_DESC_NUM, &priv->tx_base,
                                                GFP_DMA | GFP_KERNEL);
-        if (priv->tx_desc_base == NULL)
+        if (priv->tx_desc_base == NULL) {
+                ret = -ENOMEM;
                goto init_fail;
+        }
        priv->rx_desc_base = dma_alloc_coherent(NULL, RX_REG_DESC_SIZE *
                                                RX_DESC_NUM, &priv->rx_base,
                                                GFP_DMA | GFP_KERNEL);
-        if (priv->rx_desc_base == NULL)
+        if (priv->rx_desc_base == NULL) {
+                ret = -ENOMEM;
                goto init_fail;
+        }
        priv->tx_buf_base = kmalloc(priv->tx_buf_size * TX_DESC_NUM,
                                    GFP_ATOMIC);
-        if (!priv->tx_buf_base)
+        if (!priv->tx_buf_base) {
+                ret = -ENOMEM;
                goto init_fail;
+        }
        priv->rx_buf_base = kmalloc(priv->rx_buf_size * RX_DESC_NUM,
                                    GFP_ATOMIC);
-        if (!priv->rx_buf_base)
+        if (!priv->rx_buf_base) {
+                ret = -ENOMEM;
                goto init_fail;
+        }
        platform_set_drvdata(pdev, ndev);
@@ -522,7 +531,8 @@ static int moxart_mac_probe(struct platform_device *pdev)
 init_fail:
        netdev_err(ndev, "init failed\n");
        moxart_mac_free_memory(ndev);
+irq_map_fail:
+        free_netdev(ndev);
        return ret;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 3ca00e05f23d..ace217c447dd 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -2276,9 +2276,9 @@ int qlcnic_83xx_get_nic_info(struct qlcnic_adapter *adapter,
                temp = (cmd.rsp.arg[8] & 0x7FFE0000) >> 17;
                npar_info->max_linkspeed_reg_offset = temp;
        }
-        if (npar_info->capabilities & QLCNIC_FW_CAPABILITY_MORE_CAPS)
-                memcpy(ahw->extra_capability, &cmd.rsp.arg[16],
+        memcpy(ahw->extra_capability, &cmd.rsp.arg[16],
-                       sizeof(ahw->extra_capability));
+               sizeof(ahw->extra_capability));
 out:
        qlcnic_free_mbx_args(&cmd);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index ebe4c86e5230..ff83a9fcd4c5 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -665,7 +665,7 @@ static int qlcnic_set_channels(struct net_device *dev,
                        return err;
        }
-        if (channel->tx_count) {
+        if (qlcnic_82xx_check(adapter) && channel->tx_count) {
                err = qlcnic_validate_max_tx_rings(adapter, channel->tx_count);
                if (err)
                        return err;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index f8adc7b01f1f..b64e2bef9428 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -785,8 +785,6 @@ void qlcnic_82xx_config_intr_coalesce(struct qlcnic_adapter *adapter)
 #define QLCNIC_ENABLE_IPV4_LRO          1
 #define QLCNIC_ENABLE_IPV6_LRO          2
-#define QLCNIC_NO_DEST_IPV4_CHECK       (1 << 8)
-#define QLCNIC_NO_DEST_IPV6_CHECK       (2 << 8)
 int qlcnic_82xx_config_hw_lro(struct qlcnic_adapter *adapter, int enable)
 {
@@ -806,11 +804,10 @@ int qlcnic_82xx_config_hw_lro(struct qlcnic_adapter *adapter, int enable)
        word = 0;
        if (enable) {
-                word = QLCNIC_ENABLE_IPV4_LRO | QLCNIC_NO_DEST_IPV4_CHECK;
+                word = QLCNIC_ENABLE_IPV4_LRO;
                if (adapter->ahw->extra_capability[0] &
                    QLCNIC_FW_CAP2_HW_LRO_IPV6)
-                        word |= QLCNIC_ENABLE_IPV6_LRO |
+                        word |= QLCNIC_ENABLE_IPV6_LRO;
-                                QLCNIC_NO_DEST_IPV6_CHECK;
        }
        req.words[0] = cpu_to_le64(word);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 21d00a0449a1..d8f4897e9e82 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1131,7 +1131,10 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
                if (err == -EIO)
                        return err;
                adapter->ahw->extra_capability[0] = temp;
+        } else {
+                adapter->ahw->extra_capability[0] = 0;
        }
        adapter->ahw->max_mac_filters = nic_info.max_mac_filters;
        adapter->ahw->max_mtu = nic_info.max_mtu;
@@ -2159,8 +2162,7 @@ void qlcnic_set_drv_version(struct qlcnic_adapter *adapter)
        else if (qlcnic_83xx_check(adapter))
                fw_cmd = QLCNIC_CMD_83XX_SET_DRV_VER;
-        if ((ahw->capabilities & QLCNIC_FW_CAPABILITY_MORE_CAPS) &&
+        if (ahw->extra_capability[0] & QLCNIC_FW_CAPABILITY_SET_DRV_VER)
-            (ahw->extra_capability[0] & QLCNIC_FW_CAPABILITY_SET_DRV_VER))
                qlcnic_fw_cmd_set_drv_version(adapter, fw_cmd);
 }
@@ -2257,7 +2259,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        err = qlcnic_alloc_adapter_resources(adapter);
        if (err)
-                goto err_out_free_netdev;
+                goto err_out_free_wq;
        adapter->dev_rst_time = jiffies;
        adapter->ahw->revision_id = pdev->revision;
@@ -2396,6 +2398,9 @@ err_out_disable_msi:
 err_out_free_hw:
        qlcnic_free_adapter_resources(adapter);
+err_out_free_wq:
+        destroy_workqueue(adapter->qlcnic_wq);
 err_out_free_netdev:
        free_netdev(netdev);
@@ -3648,11 +3653,6 @@ int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *adapter, u32 txq)
        u8 max_hw = QLCNIC_MAX_TX_RINGS;
        u32 max_allowed;
-        if (!qlcnic_82xx_check(adapter)) {
-                netdev_err(netdev, "No Multi TX-Q support\n");
-                return -EINVAL;
-        }
        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
                netdev_err(netdev, "No Multi TX-Q support in INT-x mode\n");
                return -EINVAL;
@@ -3692,8 +3692,7 @@ int qlcnic_validate_max_rss(struct qlcnic_adapter *adapter,
        u8 max_hw = adapter->ahw->max_rx_ques;
        u32 max_allowed;
-        if (qlcnic_82xx_check(adapter) && !qlcnic_use_msi_x &&
+        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
-            !qlcnic_use_msi) {
                netdev_err(netdev, "No RSS support in INT-x mode\n");
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 5cd831ebfa83..b57c278d3b46 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -688,12 +688,16 @@ static struct sh_eth_cpu_data r8a7740_data = {
        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
                          EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                          EESR_TDE | EESR_ECI,
+        .fdr_value      = 0x0000070f,
+        .rmcr_value     = 0x00000001,
        .apr            = 1,
        .mpr            = 1,
        .tpauser        = 1,
        .bculr          = 1,
        .hw_swap        = 1,
+        .rpadir         = 1,
+        .rpadir_value   = 2 << 16,
        .no_trimd       = 1,
        .no_ade         = 1,
        .tsu            = 1,
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 9f18ae984f9e..21f9ad6392e9 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -444,6 +444,18 @@ static const struct efx_hw_stat_desc efx_ef10_stat_desc[EF10_STAT_COUNT] = {
        EF10_DMA_STAT(rx_align_error, RX_ALIGN_ERROR_PKTS),
        EF10_DMA_STAT(rx_length_error, RX_LENGTH_ERROR_PKTS),
        EF10_DMA_STAT(rx_nodesc_drops, RX_NODESC_DROPS),
+        EF10_DMA_STAT(rx_pm_trunc_bb_overflow, PM_TRUNC_BB_OVERFLOW),
+        EF10_DMA_STAT(rx_pm_discard_bb_overflow, PM_DISCARD_BB_OVERFLOW),
+        EF10_DMA_STAT(rx_pm_trunc_vfifo_full, PM_TRUNC_VFIFO_FULL),
+        EF10_DMA_STAT(rx_pm_discard_vfifo_full, PM_DISCARD_VFIFO_FULL),
+        EF10_DMA_STAT(rx_pm_trunc_qbb, PM_TRUNC_QBB),
+        EF10_DMA_STAT(rx_pm_discard_qbb, PM_DISCARD_QBB),
+        EF10_DMA_STAT(rx_pm_discard_mapping, PM_DISCARD_MAPPING),
+        EF10_DMA_STAT(rx_dp_q_disabled_packets, RXDP_Q_DISABLED_PKTS),
+        EF10_DMA_STAT(rx_dp_di_dropped_packets, RXDP_DI_DROPPED_PKTS),
+        EF10_DMA_STAT(rx_dp_streaming_packets, RXDP_STREAMING_PKTS),
+        EF10_DMA_STAT(rx_dp_emerg_fetch, RXDP_EMERGENCY_FETCH_CONDITIONS),
+        EF10_DMA_STAT(rx_dp_emerg_wait, RXDP_EMERGENCY_WAIT_CONDITIONS),
 };
 #define HUNT_COMMON_STAT_MASK ((1ULL << EF10_STAT_tx_bytes) |           \
@@ -498,44 +510,72 @@ static const struct efx_hw_stat_desc efx_ef10_stat_desc[EF10_STAT_COUNT] = {
 #define HUNT_40G_EXTRA_STAT_MASK ((1ULL << EF10_STAT_rx_align_error) |  \
                                  (1ULL << EF10_STAT_rx_length_error))
-#if BITS_PER_LONG == 64
+/* These statistics are only provided if the firmware supports the
-#define STAT_MASK_BITMAP(bits) (bits)
+ * capability PM_AND_RXDP_COUNTERS.
-#else
+ */
-#define STAT_MASK_BITMAP(bits) (bits) & 0xffffffff, (bits) >> 32
+#define HUNT_PM_AND_RXDP_STAT_MASK (                                    \
-#endif
+        (1ULL << EF10_STAT_rx_pm_trunc_bb_overflow) |                   \
+        (1ULL << EF10_STAT_rx_pm_discard_bb_overflow) |                 \
-static const unsigned long *efx_ef10_stat_mask(struct efx_nic *efx)
+        (1ULL << EF10_STAT_rx_pm_trunc_vfifo_full) |                    \
-{
+        (1ULL << EF10_STAT_rx_pm_discard_vfifo_full) |                  \
-        static const unsigned long hunt_40g_stat_mask[] = {
+        (1ULL << EF10_STAT_rx_pm_trunc_qbb) |                           \
-                STAT_MASK_BITMAP(HUNT_COMMON_STAT_MASK |
+        (1ULL << EF10_STAT_rx_pm_discard_qbb) |                         \
-                                 HUNT_40G_EXTRA_STAT_MASK)
+        (1ULL << EF10_STAT_rx_pm_discard_mapping) |                     \
-        };
+        (1ULL << EF10_STAT_rx_dp_q_disabled_packets) |                  \
-        static const unsigned long hunt_10g_only_stat_mask[] = {
+        (1ULL << EF10_STAT_rx_dp_di_dropped_packets) |                  \
-                STAT_MASK_BITMAP(HUNT_COMMON_STAT_MASK |
+        (1ULL << EF10_STAT_rx_dp_streaming_packets) |                   \
-                                 HUNT_10G_ONLY_STAT_MASK)
+        (1ULL << EF10_STAT_rx_dp_emerg_fetch) |                         \
-        };
+        (1ULL << EF10_STAT_rx_dp_emerg_wait))
+static u64 efx_ef10_raw_stat_mask(struct efx_nic *efx)
+{
+        u64 raw_mask = HUNT_COMMON_STAT_MASK;
        u32 port_caps = efx_mcdi_phy_get_caps(efx);
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
        if (port_caps & (1 << MC_CMD_PHY_CAP_40000FDX_LBN))
-                return hunt_40g_stat_mask;
+                raw_mask |= HUNT_40G_EXTRA_STAT_MASK;
        else
-                return hunt_10g_only_stat_mask;
+                raw_mask |= HUNT_10G_ONLY_STAT_MASK;
+        if (nic_data->datapath_caps &
+            (1 << MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_LBN))
+                raw_mask |= HUNT_PM_AND_RXDP_STAT_MASK;
+        return raw_mask;
+}
+static void efx_ef10_get_stat_mask(struct efx_nic *efx, unsigned long *mask)
+{
+        u64 raw_mask = efx_ef10_raw_stat_mask(efx);
+#if BITS_PER_LONG == 64
+        mask[0] = raw_mask;
+#else
+        mask[0] = raw_mask & 0xffffffff;
+        mask[1] = raw_mask >> 32;
+#endif
 }
 static size_t efx_ef10_describe_stats(struct efx_nic *efx, u8 *names)
 {
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
+        efx_ef10_get_stat_mask(efx, mask);
        return efx_nic_describe_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
-                                      efx_ef10_stat_mask(efx), names);
+                                      mask, names);
 }
 static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
 {
        struct efx_ef10_nic_data *nic_data = efx->nic_data;
-        const unsigned long *stats_mask = efx_ef10_stat_mask(efx);
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
        __le64 generation_start, generation_end;
        u64 *stats = nic_data->stats;
        __le64 *dma_stats;
+        efx_ef10_get_stat_mask(efx, mask);
        dma_stats = efx->stats_buffer.addr;
        nic_data = efx->nic_data;
@@ -543,8 +583,9 @@ static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
        if (generation_end == EFX_MC_STATS_GENERATION_INVALID)
                return 0;
        rmb();
-        efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, stats_mask,
+        efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, mask,
                             stats, efx->stats_buffer.addr, false);
+        rmb();
        generation_start = dma_stats[MC_CMD_MAC_GENERATION_START];
        if (generation_end != generation_start)
                return -EAGAIN;
@@ -563,12 +604,14 @@ static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
 static size_t efx_ef10_update_stats(struct efx_nic *efx, u64 *full_stats,
                                    struct rtnl_link_stats64 *core_stats)
 {
-        const unsigned long *mask = efx_ef10_stat_mask(efx);
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
        struct efx_ef10_nic_data *nic_data = efx->nic_data;
        u64 *stats = nic_data->stats;
        size_t stats_count = 0, index;
        int retry;
+        efx_ef10_get_stat_mask(efx, mask);
        /* If we're unlucky enough to read statistics during the DMA, wait
         * up to 10ms for it to finish (typically takes <500us)
         */
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index c082562dbf4e..366c8e3e3784 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -963,7 +963,7 @@ static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                               bool *was_attached)
 {
        MCDI_DECLARE_BUF(inbuf, MC_CMD_DRV_ATTACH_IN_LEN);
-        MCDI_DECLARE_BUF(outbuf, MC_CMD_DRV_ATTACH_OUT_LEN);
+        MCDI_DECLARE_BUF(outbuf, MC_CMD_DRV_ATTACH_EXT_OUT_LEN);
        size_t outlen;
        int rc;
@@ -981,6 +981,22 @@ static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                goto fail;
        }
+        /* We currently assume we have control of the external link
+         * and are completely trusted by firmware.  Abort probing
+         * if that's not true for this function.
+         */
+        if (driver_operating &&
+            outlen >= MC_CMD_DRV_ATTACH_EXT_OUT_LEN &&
+            (MCDI_DWORD(outbuf, DRV_ATTACH_EXT_OUT_FUNC_FLAGS) &
+             (1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_LINKCTRL |
+              1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_TRUSTED)) !=
+            (1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_LINKCTRL |
+             1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_TRUSTED)) {
+                netif_err(efx, probe, efx->net_dev,
+                          "This driver version only supports one function per port\n");
+                return -ENODEV;
+        }
        if (was_attached != NULL)
                *was_attached = MCDI_DWORD(outbuf, DRV_ATTACH_OUT_OLD_STATE);
        return 0;
diff --git a/drivers/net/ethernet/sfc/mcdi_pcol.h b/drivers/net/ethernet/sfc/mcdi_pcol.h
index b5cf62492f8e..e0a63ddb7a6c 100644
--- a/drivers/net/ethernet/sfc/mcdi_pcol.h
+++ b/drivers/net/ethernet/sfc/mcdi_pcol.h
@@ -2574,8 +2574,58 @@
 #define          MC_CMD_MAC_RX_LANES01_DISP_ERR  0x39 /* enum */
 #define          MC_CMD_MAC_RX_LANES23_DISP_ERR  0x3a /* enum */
 #define          MC_CMD_MAC_RX_MATCH_FAULT  0x3b /* enum */
-#define          MC_CMD_GMAC_DMABUF_START  0x40 /* enum */
+/* enum: PM trunc_bb_overflow counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
-#define          MC_CMD_GMAC_DMABUF_END    0x5f /* enum */
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_BB_OVERFLOW  0x3c
+/* enum: PM discard_bb_overflow counter. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_BB_OVERFLOW  0x3d
+/* enum: PM trunc_vfifo_full counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_VFIFO_FULL  0x3e
+/* enum: PM discard_vfifo_full counter. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_VFIFO_FULL  0x3f
+/* enum: PM trunc_qbb counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_QBB  0x40
+/* enum: PM discard_qbb counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_QBB  0x41
+/* enum: PM discard_mapping counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_MAPPING  0x42
+/* enum: RXDP counter: Number of packets dropped due to the queue being
+ * disabled. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_Q_DISABLED_PKTS  0x43
+/* enum: RXDP counter: Number of packets dropped by the DICPU. Valid for EF10
+ * with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_DI_DROPPED_PKTS  0x45
+/* enum: RXDP counter: Number of non-host packets. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_STREAMING_PKTS  0x46
+/* enum: RXDP counter: Number of times an emergency descriptor fetch was
+ * performed. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_EMERGENCY_FETCH_CONDITIONS  0x47
+/* enum: RXDP counter: Number of times the DPCPU waited for an existing
+ * descriptor fetch. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_EMERGENCY_WAIT_CONDITIONS  0x48
+/* enum: Start of GMAC stats buffer space, for Siena only. */
+#define          MC_CMD_GMAC_DMABUF_START  0x40
+/* enum: End of GMAC stats buffer space, for Siena only. */
+#define          MC_CMD_GMAC_DMABUF_END    0x5f
 #define          MC_CMD_MAC_GENERATION_END 0x60 /* enum */
 #define          MC_CMD_MAC_NSTATS  0x61 /* enum */
@@ -5065,6 +5115,8 @@
 #define        MC_CMD_GET_CAPABILITIES_OUT_RX_BATCHING_WIDTH 1
 #define        MC_CMD_GET_CAPABILITIES_OUT_MCAST_FILTER_CHAINING_LBN 26
 #define        MC_CMD_GET_CAPABILITIES_OUT_MCAST_FILTER_CHAINING_WIDTH 1
+#define        MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_LBN 27
+#define        MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_WIDTH 1
 /* RxDPCPU firmware id. */
 #define       MC_CMD_GET_CAPABILITIES_OUT_RX_DPCPU_FW_ID_OFST 4
 #define       MC_CMD_GET_CAPABILITIES_OUT_RX_DPCPU_FW_ID_LEN 2
diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
index e7dbd2dd202e..9826594c8a48 100644
--- a/drivers/net/ethernet/sfc/nic.c
+++ b/drivers/net/ethernet/sfc/nic.c
@@ -469,8 +469,7 @@ size_t efx_nic_describe_stats(const struct efx_hw_stat_desc *desc, size_t count,
 * @count: Length of the @desc array
 * @mask: Bitmask of which elements of @desc are enabled
 * @stats: Buffer to update with the converted statistics.  The length
- *      of this array must be at least the number of set bits in the
+ *      of this array must be at least @count.
- *      first @count bits of @mask.
 * @dma_buf: DMA buffer containing hardware statistics
 * @accumulate: If set, the converted values will be added rather than
 *      directly stored to the corresponding elements of @stats
@@ -503,11 +502,9 @@ void efx_nic_update_stats(const struct efx_hw_stat_desc *desc, size_t count,
                        }
                        if (accumulate)
-                                *stats += val;
+                                stats[index] += val;
                        else
-                                *stats = val;
+                                stats[index] = val;
                }
-                ++stats;
        }
 }
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index fda29d39032f..890bbbe8320e 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -386,6 +386,18 @@ enum {
        EF10_STAT_rx_align_error,
        EF10_STAT_rx_length_error,
        EF10_STAT_rx_nodesc_drops,
+        EF10_STAT_rx_pm_trunc_bb_overflow,
+        EF10_STAT_rx_pm_discard_bb_overflow,
+        EF10_STAT_rx_pm_trunc_vfifo_full,
+        EF10_STAT_rx_pm_discard_vfifo_full,
+        EF10_STAT_rx_pm_trunc_qbb,
+        EF10_STAT_rx_pm_discard_qbb,
+        EF10_STAT_rx_pm_discard_mapping,
+        EF10_STAT_rx_dp_q_disabled_packets,
+        EF10_STAT_rx_dp_di_dropped_packets,
+        EF10_STAT_rx_dp_streaming_packets,
+        EF10_STAT_rx_dp_emerg_fetch,
+        EF10_STAT_rx_dp_emerg_wait,
        EF10_STAT_COUNT
 };
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 5730fe2445a6..98eedb90cdc3 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -1124,8 +1124,7 @@ static const char * chip_ids[ 16 ] =  {
                        void __iomem *__ioaddr = ioaddr;                \
                        if (__len >= 2 && (unsigned long)__ptr & 2) {   \
                                __len -= 2;                             \
-                                SMC_outw(*(u16 *)__ptr, ioaddr,         \
+                                SMC_outsw(ioaddr, DATA_REG(lp), __ptr, 1); \
-                                        DATA_REG(lp));          \
                                __ptr += 2;                             \
                        }                                               \
                        if (SMC_CAN_USE_DATACS && lp->datacs)           \
@@ -1133,8 +1132,7 @@ static const char * chip_ids[ 16 ] =  {
                        SMC_outsl(__ioaddr, DATA_REG(lp), __ptr, __len>>2); \
                        if (__len & 2) {                                \
                                __ptr += (__len & ~3);                  \
-                                SMC_outw(*((u16 *)__ptr), ioaddr,       \
+                                SMC_outsw(ioaddr, DATA_REG(lp), __ptr, 1); \
-                                         DATA_REG(lp));         \
                        }                                               \
                } else if (SMC_16BIT(lp))                               \
                        SMC_outsw(ioaddr, DATA_REG(lp), p, (l) >> 1);   \
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 79974e31187a..cc3ce557e4aa 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -639,13 +639,6 @@ void cpsw_rx_handler(void *token, int len, int status)
 static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
 {
        struct cpsw_priv *priv = dev_id;
-        u32 rx, tx, rx_thresh;
-        rx_thresh = __raw_readl(&priv->wr_regs->rx_thresh_stat);
-        rx = __raw_readl(&priv->wr_regs->rx_stat);
-        tx = __raw_readl(&priv->wr_regs->tx_stat);
-        if (!rx_thresh && !rx && !tx)
-                return IRQ_NONE;
        cpsw_intr_disable(priv);
        if (priv->irq_enabled == true) {
@@ -1169,9 +1162,9 @@ static int cpsw_ndo_open(struct net_device *ndev)
                }
        }
+        napi_enable(&priv->napi);
        cpdma_ctlr_start(priv->dma);
        cpsw_intr_enable(priv);
-        napi_enable(&priv->napi);
        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
@@ -1771,8 +1764,8 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
        }
        data->mac_control = prop;
-        if (!of_property_read_u32(node, "dual_emac", &prop))
+        if (of_property_read_bool(node, "dual_emac"))
-                data->dual_emac = prop;
+                data->dual_emac = 1;
        /*
         * Populate all the child nodes here...
@@ -1782,7 +1775,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
        if (ret)
                pr_warn("Doesn't have any child node\n");
-        for_each_node_by_name(slave_node, "slave") {
+        for_each_child_of_node(node, slave_node) {
                struct cpsw_slave_data *slave_data = data->slave_data + i;
                const void *mac_addr = NULL;
                u32 phyid;
@@ -1791,6 +1784,10 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                struct device_node *mdio_node;
                struct platform_device *mdio;
+                /* This is no slave child node, continue */
+                if (strcmp(slave_node->name, "slave"))
+                        continue;
                parp = of_get_property(slave_node, "phy_id", &lenp);
                if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                        pr_err("Missing slave[%d] phy_id property\n", i);
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 67df09ea9d04..6a32ef9d63ae 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -876,8 +876,7 @@ static void emac_dev_mcast_set(struct net_device *ndev)
                    netdev_mc_count(ndev) > EMAC_DEF_MAX_MULTICAST_ADDRESSES) {
                        mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
                        emac_add_mcast(priv, EMAC_ALL_MULTI_SET, NULL);
-                }
+                } else if (!netdev_mc_empty(ndev)) {
-                if (!netdev_mc_empty(ndev)) {
                        struct netdev_hw_addr *ha;
                        mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 0721e72f9299..5af1c3e5032a 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -975,7 +975,6 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                        return -EINVAL;         /* Cannot change this parameter when up */
                if ((ym = kmalloc(sizeof(struct yamdrv_ioctl_mcs), GFP_KERNEL)) == NULL)
                        return -ENOBUFS;
-                ym->bitrate = 9600;
                if (copy_from_user(ym, ifr->ifr_data, sizeof(struct yamdrv_ioctl_mcs))) {
                        kfree(ym);
                        return -EFAULT;
diff --git a/drivers/net/ieee802154/mrf24j40.c b/drivers/net/ieee802154/mrf24j40.c
index 42e6deee6db5..0632d34905c7 100644
--- a/drivers/net/ieee802154/mrf24j40.c
+++ b/drivers/net/ieee802154/mrf24j40.c
@@ -82,7 +82,6 @@ struct mrf24j40 {
        struct mutex buffer_mutex; /* only used to protect buf */
        struct completion tx_complete;
-        struct work_struct irqwork;
        u8 *buf; /* 3 bytes. Used for SPI single-register transfers. */
 };
@@ -344,6 +343,8 @@ static int mrf24j40_tx(struct ieee802154_dev *dev, struct sk_buff *skb)
        if (ret)
                goto err;
+        INIT_COMPLETION(devrec->tx_complete);
        /* Set TXNTRIG bit of TXNCON to send packet */
        ret = read_short_reg(devrec, REG_TXNCON, &val);
        if (ret)
@@ -354,8 +355,6 @@ static int mrf24j40_tx(struct ieee802154_dev *dev, struct sk_buff *skb)
                val |= 0x4;
        write_short_reg(devrec, REG_TXNCON, val);
-        INIT_COMPLETION(devrec->tx_complete);
        /* Wait for the device to send the TX complete interrupt. */
        ret = wait_for_completion_interruptible_timeout(
                                                &devrec->tx_complete,
@@ -590,17 +589,6 @@ static struct ieee802154_ops mrf24j40_ops = {
 static irqreturn_t mrf24j40_isr(int irq, void *data)
 {
        struct mrf24j40 *devrec = data;
-        disable_irq_nosync(irq);
-        schedule_work(&devrec->irqwork);
-        return IRQ_HANDLED;
-}
-static void mrf24j40_isrwork(struct work_struct *work)
-{
-        struct mrf24j40 *devrec = container_of(work, struct mrf24j40, irqwork);
        u8 intstat;
        int ret;
@@ -618,7 +606,7 @@ static void mrf24j40_isrwork(struct work_struct *work)
                mrf24j40_handle_rx(devrec);
 out:
-        enable_irq(devrec->spi->irq);
+        return IRQ_HANDLED;
 }
 static int mrf24j40_probe(struct spi_device *spi)
@@ -642,7 +630,6 @@ static int mrf24j40_probe(struct spi_device *spi)
        mutex_init(&devrec->buffer_mutex);
        init_completion(&devrec->tx_complete);
-        INIT_WORK(&devrec->irqwork, mrf24j40_isrwork);
        devrec->spi = spi;
        spi_set_drvdata(spi, devrec);
@@ -688,11 +675,12 @@ static int mrf24j40_probe(struct spi_device *spi)
        val &= ~0x3; /* Clear RX mode (normal) */
        write_short_reg(devrec, REG_RXMCR, val);
-        ret = request_irq(spi->irq,
+        ret = request_threaded_irq(spi->irq,
-                          mrf24j40_isr,
+                                   NULL,
-                          IRQF_TRIGGER_FALLING,
+                                   mrf24j40_isr,
-                          dev_name(&spi->dev),
+                                   IRQF_TRIGGER_LOW|IRQF_ONESHOT,
-                          devrec);
+                                   dev_name(&spi->dev),
+                                   devrec);
        if (ret) {
                dev_err(printdev(devrec), "Unable to get IRQ");
@@ -721,7 +709,6 @@ static int mrf24j40_remove(struct spi_device *spi)
        dev_dbg(printdev(devrec), "remove\n");
        free_irq(spi->irq, devrec);
-        flush_work(&devrec->irqwork); /* TODO: Is this the right call? */
        ieee802154_unregister_device(devrec->dev);
        ieee802154_free_device(devrec->dev);
        /* TODO: Will ieee802154_free_device() wait until ->xmit() is
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index adeee615dd19..c9a15925a1f7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -310,6 +310,7 @@ static ssize_t store_enabled(struct netconsole_target *nt,
                             const char *buf,
                             size_t count)
 {
+        unsigned long flags;
        int enabled;
        int err;
@@ -324,9 +325,7 @@ static ssize_t store_enabled(struct netconsole_target *nt,
                return -EINVAL;
        }
-        mutex_lock(&nt->mutex);
        if (enabled) {  /* 1 */
                /*
                 * Skip netpoll_parse_options() -- all the attributes are
                 * already configured via configfs. Just print them out.
@@ -334,19 +333,22 @@ static ssize_t store_enabled(struct netconsole_target *nt,
                netpoll_print_options(&nt->np);
                err = netpoll_setup(&nt->np);
-                if (err) {
+                if (err)
-                        mutex_unlock(&nt->mutex);
                        return err;
-                }
                printk(KERN_INFO "netconsole: network logging started\n");
        } else {        /* 0 */
+                /* We need to disable the netconsole before cleaning it up
+                 * otherwise we might end up in write_msg() with
+                 * nt->np.dev == NULL and nt->enabled == 1
+                 */
+                spin_lock_irqsave(&target_list_lock, flags);
+                nt->enabled = 0;
+                spin_unlock_irqrestore(&target_list_lock, flags);
                netpoll_cleanup(&nt->np);
        }
        nt->enabled = enabled;
-        mutex_unlock(&nt->mutex);
        return strnlen(buf, count);
 }
@@ -563,8 +565,10 @@ static ssize_t netconsole_target_attr_store(struct config_item *item,
        struct netconsole_target_attr *na =
                container_of(attr, struct netconsole_target_attr, attr);
+        mutex_lock(&nt->mutex);
        if (na->store)
                ret = na->store(nt, buf, count);
+        mutex_unlock(&nt->mutex);
        return ret;
 }
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 807815fc9968..7cb105c103fe 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1293,7 +1293,8 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
        if (unlikely(!noblock))
                add_wait_queue(&tfile->wq.wait, &wait);
        while (len) {
-                current->state = TASK_INTERRUPTIBLE;
+                if (unlikely(!noblock))
+                        current->state = TASK_INTERRUPTIBLE;
                /* Read frames from the queue */
                if (!(skb = skb_dequeue(&tfile->socket.sk->sk_receive_queue))) {
@@ -1320,9 +1321,10 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
                break;
        }
-        current->state = TASK_RUNNING;
+        if (unlikely(!noblock)) {
-        if (unlikely(!noblock))
+                current->state = TASK_RUNNING;
                remove_wait_queue(&tfile->wq.wait, &wait);
+        }
        return ret;
 }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 3569293df872..8e8d0fcd4979 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -36,8 +36,8 @@
 #define AX_RXHDR_L4_TYPE_TCP                    16
 #define AX_RXHDR_L3CSUM_ERR                     2
 #define AX_RXHDR_L4CSUM_ERR                     1
-#define AX_RXHDR_CRC_ERR                        ((u32)BIT(31))
+#define AX_RXHDR_CRC_ERR                        ((u32)BIT(29))
-#define AX_RXHDR_DROP_ERR                       ((u32)BIT(30))
+#define AX_RXHDR_DROP_ERR                       ((u32)BIT(31))
 #define AX_ACCESS_MAC                           0x01
 #define AX_ACCESS_PHY                           0x02
 #define AX_ACCESS_EEPROM                        0x04
@@ -78,7 +78,6 @@
 #define AX_MEDIUM_STATUS_MODE                   0x22
        #define AX_MEDIUM_GIGAMODE      0x01
        #define AX_MEDIUM_FULL_DUPLEX   0x02
-        #define AX_MEDIUM_ALWAYS_ONE    0x04
        #define AX_MEDIUM_EN_125MHZ     0x08
        #define AX_MEDIUM_RXFLOW_CTRLEN 0x10
        #define AX_MEDIUM_TXFLOW_CTRLEN 0x20
@@ -1065,8 +1064,8 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
        /* Configure default medium type => giga */
        *tmp16 = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
-                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE |
+                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_FULL_DUPLEX |
-                 AX_MEDIUM_FULL_DUPLEX | AX_MEDIUM_GIGAMODE;
+                 AX_MEDIUM_GIGAMODE;
        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
                          2, 2, tmp16);
@@ -1225,7 +1224,7 @@ static int ax88179_link_reset(struct usbnet *dev)
        }
        mode = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
-               AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE;
+               AX_MEDIUM_RXFLOW_CTRLEN;
        ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS,
                         1, 1, &link_sts);
@@ -1339,8 +1338,8 @@ static int ax88179_reset(struct usbnet *dev)
        /* Configure default medium type => giga */
        *tmp16 = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
-                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE |
+                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_FULL_DUPLEX |
-                 AX_MEDIUM_FULL_DUPLEX | AX_MEDIUM_GIGAMODE;
+                 AX_MEDIUM_GIGAMODE;
        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
                          2, 2, tmp16);
@@ -1406,6 +1405,19 @@ static const struct driver_info sitecom_info = {
        .tx_fixup = ax88179_tx_fixup,
 };
+static const struct driver_info samsung_info = {
+        .description = "Samsung USB Ethernet Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
 static const struct usb_device_id products[] = {
 {
        /* ASIX AX88179 10/100/1000 */
@@ -1418,7 +1430,11 @@ static const struct usb_device_id products[] = {
 }, {
        /* Sitecom USB 3.0 to Gigabit Adapter */
        USB_DEVICE(0x0df6, 0x0072),
-        .driver_info = (unsigned long) &sitecom_info,
+        .driver_info = (unsigned long)&sitecom_info,
+}, {
+        /* Samsung USB Ethernet Adapter */
+        USB_DEVICE(0x04e8, 0xa100),
+        .driver_info = (unsigned long)&samsung_info,
 },
        { },
 };
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3d6aaf79d8b2..818ce90185b5 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -714,6 +714,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
+        {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
        {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
        /* 4. Gobi 1000 devices */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index bf94e10a37c8..90a429b7ebad 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1688,8 +1688,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
        if (dev->can_dma_sg && !(info->flags & FLAG_SEND_ZLP) &&
                !(info->flags & FLAG_MULTI_PACKET)) {
                dev->padding_pkt = kzalloc(1, GFP_KERNEL);
-                if (!dev->padding_pkt)
+                if (!dev->padding_pkt) {
+                        status = -ENOMEM;
                        goto out4;
+                }
        }
        status = register_netdev (net);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index defec2b3c5a4..bbc9cb84ec1f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -938,7 +938,9 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
                return -EINVAL;
        } else {
                vi->curr_queue_pairs = queue_pairs;
-                schedule_delayed_work(&vi->refill, 0);
+                /* virtnet_open() will refill when device is going to up. */
+                if (dev->flags & IFF_UP)
+                        schedule_delayed_work(&vi->refill, 0);
        }
        return 0;
@@ -1128,6 +1130,7 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
        default:
                break;
        }
        return NOTIFY_OK;
 }
@@ -1689,6 +1692,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
        struct virtnet_info *vi = vdev->priv;
        int i;
+        unregister_hotcpu_notifier(&vi->nb);
        /* Prevent config work handler from accessing the device */
        mutex_lock(&vi->config_lock);
        vi->config_enable = false;
@@ -1733,7 +1738,13 @@ static int virtnet_restore(struct virtio_device *vdev)
        vi->config_enable = true;
        mutex_unlock(&vi->config_lock);
+        rtnl_lock();
        virtnet_set_queues(vi, vi->curr_queue_pairs);
+        rtnl_unlock();
+        err = register_hotcpu_notifier(&vi->nb);
+        if (err)
+                return err;
        return 0;
 }
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index 3f0c4f268751..bcfff0d62de4 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -1972,6 +1972,7 @@ fst_get_iface(struct fst_card_info *card, struct fst_port_info *port,
        }
        i = port->index;
+        memset(&sync, 0, sizeof(sync));
        sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed);
        /* Lucky card and linux use same encoding here */
        sync.clock_type = FST_RDB(card, portConfig[i].internalClock) ==
diff --git a/drivers/net/wan/sbni.c b/drivers/net/wan/sbni.c
index 5bbcb5e3ee0c..388ddf60a66d 100644
--- a/drivers/net/wan/sbni.c
+++ b/drivers/net/wan/sbni.c
@@ -148,10 +148,6 @@ static int  enslave( struct net_device *, struct net_device * );
 static int  emancipate( struct net_device * );
 #endif
-#ifdef __i386__
-#define ASM_CRC 1
-#endif
 static const char  version[] =
        "Granch SBNI12 driver ver 5.0.1  Jun 22 2001  Denis I.Timofeev.\n";
@@ -1551,88 +1547,6 @@ __setup( "sbni=", sbni_setup );
 /* -------------------------------------------------------------------------- */
-#ifdef ASM_CRC
-static u32
-calc_crc32( u32  crc,  u8  *p,  u32  len )
-{
-        register u32  _crc;
-        _crc = crc;
-        
-        __asm__ __volatile__ (
-                "xorl   %%ebx, %%ebx\n"
-                "movl   %2, %%esi\n" 
-                "movl   %3, %%ecx\n" 
-                "movl   $crc32tab, %%edi\n"
-                "shrl   $2, %%ecx\n"
-                "jz     1f\n"
-                ".align 4\n"
-        "0:\n"
-                "movb   %%al, %%bl\n"
-                "movl   (%%esi), %%edx\n"
-                "shrl   $8, %%eax\n"
-                "xorb   %%dl, %%bl\n"
-                "shrl   $8, %%edx\n"
-                "xorl   (%%edi,%%ebx,4), %%eax\n"
-                "movb   %%al, %%bl\n"
-                "shrl   $8, %%eax\n"
-                "xorb   %%dl, %%bl\n"
-                "shrl   $8, %%edx\n"
-                "xorl   (%%edi,%%ebx,4), %%eax\n"
-                "movb   %%al, %%bl\n"
-                "shrl   $8, %%eax\n"
-                "xorb   %%dl, %%bl\n"
-                "movb   %%dh, %%dl\n" 
-                "xorl   (%%edi,%%ebx,4), %%eax\n"
-                "movb   %%al, %%bl\n"
-                "shrl   $8, %%eax\n"
-                "xorb   %%dl, %%bl\n"
-                "addl   $4, %%esi\n"
-                "xorl   (%%edi,%%ebx,4), %%eax\n"
-                "decl   %%ecx\n"
-                "jnz    0b\n"
-        "1:\n"
-                "movl   %3, %%ecx\n"
-                "andl   $3, %%ecx\n"
-                "jz     2f\n"
-                "movb   %%al, %%bl\n"
-                "shrl   $8, %%eax\n"
-                "xorb   (%%esi), %%bl\n"
-                "xorl   (%%edi,%%ebx,4), %%eax\n"
-                "decl   %%ecx\n"
-                "jz     2f\n"
-                "movb   %%al, %%bl\n"
-                "shrl   $8, %%eax\n"
-                "xorb   1(%%esi), %%bl\n"
-                "xorl   (%%edi,%%ebx,4), %%eax\n"
-                "decl   %%ecx\n"
-                "jz     2f\n"
-                "movb   %%al, %%bl\n"
-                "shrl   $8, %%eax\n"
-                "xorb   2(%%esi), %%bl\n"
-                "xorl   (%%edi,%%ebx,4), %%eax\n"
-        "2:\n"
-                : "=a" (_crc)
-                : "0" (_crc), "g" (p), "g" (len)
-                : "bx", "cx", "dx", "si", "di"
-        );
-        return  _crc;
-}
-#else   /* ASM_CRC */
 static u32
 calc_crc32( u32  crc,  u8  *p,  u32  len )
 {
@@ -1642,9 +1556,6 @@ calc_crc32( u32  crc,  u8  *p,  u32  len )
        return  crc;
 }
-#endif  /* ASM_CRC */
 static u32  crc32tab[] __attribute__ ((aligned(8))) = {
        0xD202EF8D,  0xA505DF1B,  0x3C0C8EA1,  0x4B0BBE37,
        0xD56F2B94,  0xA2681B02,  0x3B614AB8,  0x4C667A2E,
diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c
index 6a24a5a70cc7..4c0a69779b89 100644
--- a/drivers/net/wan/wanxl.c
+++ b/drivers/net/wan/wanxl.c
@@ -355,6 +355,7 @@ static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                        ifr->ifr_settings.size = size; /* data size wanted */
                        return -ENOBUFS;
                }
+                memset(&line, 0, sizeof(line));
                line.clock_type = get_status(port)->clocking;
                line.clock_rate = 0;
                line.loopback = 0;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index e4f65900132d..709301f88dcd 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -208,6 +208,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
        struct ath_hw *ah = sc->sc_ah;
        struct ath_common *common = ath9k_hw_common(ah);
        unsigned long flags;
+        int i;
        if (ath_startrecv(sc) != 0) {
                ath_err(common, "Unable to restart recv logic\n");
@@ -235,6 +236,15 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
                }
        work:
                ath_restart_work(sc);
+                for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+                        if (!ATH_TXQ_SETUP(sc, i))
+                                continue;
+                        spin_lock_bh(&sc->tx.txq[i].axq_lock);
+                        ath_txq_schedule(sc, &sc->tx.txq[i]);
+                        spin_unlock_bh(&sc->tx.txq[i].axq_lock);
+                }
        }
        ieee80211_wake_queues(sc->hw);
@@ -539,21 +549,10 @@ chip_reset:
 static int ath_reset(struct ath_softc *sc)
 {
-        int i, r;
+        int r;
        ath9k_ps_wakeup(sc);
        r = ath_reset_internal(sc, NULL);
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
-                if (!ATH_TXQ_SETUP(sc, i))
-                        continue;
-                spin_lock_bh(&sc->tx.txq[i].axq_lock);
-                ath_txq_schedule(sc, &sc->tx.txq[i]);
-                spin_unlock_bh(&sc->tx.txq[i].axq_lock);
-        }
        ath9k_ps_restore(sc);
        return r;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 5ac713d2ff5d..dd30452df966 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1969,15 +1969,18 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
 static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
                               struct ath_atx_tid *tid, struct sk_buff *skb)
 {
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
        struct ath_frame_info *fi = get_frame_info(skb);
        struct list_head bf_head;
-        struct ath_buf *bf;
+        struct ath_buf *bf = fi->bf;
-        bf = fi->bf;
        INIT_LIST_HEAD(&bf_head);
        list_add_tail(&bf->list, &bf_head);
        bf->bf_state.bf_type = 0;
+        if (tid && (tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
+                bf->bf_state.bf_type = BUF_AMPDU;
+                ath_tx_addto_baw(sc, tid, bf);
+        }
        bf->bf_next = NULL;
        bf->bf_lastbf = bf;
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
index 899cad34ccd3..755a0c8edfe1 100644
--- a/drivers/net/wireless/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -237,7 +237,9 @@ static irqreturn_t cw1200_spi_irq_handler(int irq, void *dev_id)
        struct hwbus_priv *self = dev_id;
        if (self->core) {
+                cw1200_spi_lock(self);
                cw1200_irq_handler(self->core);
+                cw1200_spi_unlock(self);
                return IRQ_HANDLED;
        } else {
                return IRQ_NONE;
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 30d45e2fc193..8ac305be68f4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -240,6 +240,12 @@ const struct iwl_cfg iwl6035_2agn_cfg = {
        .ht_params = &iwl6000_ht_params,
 };
+const struct iwl_cfg iwl6035_2agn_sff_cfg = {
+        .name = "Intel(R) Centrino(R) Ultimate-N 6235 AGN",
+        IWL_DEVICE_6035,
+        .ht_params = &iwl6000_ht_params,
+};
 const struct iwl_cfg iwl1030_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 1030 BGN",
        IWL_DEVICE_6030,
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index e4d370bff306..b03c25e14903 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -280,6 +280,7 @@ extern const struct iwl_cfg iwl2000_2bgn_cfg;
 extern const struct iwl_cfg iwl2000_2bgn_d_cfg;
 extern const struct iwl_cfg iwl2030_2bgn_cfg;
 extern const struct iwl_cfg iwl6035_2agn_cfg;
+extern const struct iwl_cfg iwl6035_2agn_sff_cfg;
 extern const struct iwl_cfg iwl105_bgn_cfg;
 extern const struct iwl_cfg iwl105_bgn_d_cfg;
 extern const struct iwl_cfg iwl135_bgn_cfg;
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index dd57a36ecb10..80b47508647c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -601,8 +601,10 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
 {
        int ret;
-        WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
+        if (trans->state != IWL_TRANS_FW_ALIVE) {
-                  "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                return -EIO;
+        }
        if (!(cmd->flags & CMD_ASYNC))
                lock_map_acquire_read(&trans->sync_cmd_lockdep_map);
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 21407a353a3b..d58e393324ef 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -273,7 +273,10 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                if (!mvmvif->queue_params[ac].uapsd)
                        continue;
-                cmd->flags |= cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
+                if (mvm->cur_ucode != IWL_UCODE_WOWLAN)
+                        cmd->flags |=
+                                cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
                cmd->uapsd_ac_flags |= BIT(ac);
                /* QNDP TID - the highest TID with no admission control */
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 9a7ab8495300..621fb71f282a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -394,6 +394,11 @@ static bool iwl_mvm_scan_abort_notif(struct iwl_notif_wait_data *notif_wait,
                        return false;
                }
+                /*
+                 * If scan cannot be aborted, it means that we had a
+                 * SCAN_COMPLETE_NOTIFICATION in the pipe and it called
+                 * ieee80211_scan_completed already.
+                 */
                IWL_DEBUG_SCAN(mvm, "Scan cannot be aborted, exit now: %d\n",
                               *resp);
                return true;
@@ -417,14 +422,19 @@ void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
                                               SCAN_COMPLETE_NOTIFICATION };
        int ret;
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return;
        iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                   scan_abort_notif,
                                   ARRAY_SIZE(scan_abort_notif),
                                   iwl_mvm_scan_abort_notif, NULL);
-        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD,
+                                   CMD_SYNC | CMD_SEND_IN_RFKILL, 0, NULL);
        if (ret) {
                IWL_ERR(mvm, "Couldn't send SCAN_ABORT_CMD: %d\n", ret);
+                /* mac80211's state will be cleaned in the fw_restart flow */
                goto out_remove_notif;
        }
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index dc02cb9792af..26108a1a29fa 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -139,13 +139,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 6x00 Series */
        {IWL_PCI_DEVICE(0x422B, 0x1101, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422B, 0x1108, iwl6000_3agn_cfg)},
        {IWL_PCI_DEVICE(0x422B, 0x1121, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422B, 0x1128, iwl6000_3agn_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1301, iwl6000i_2agn_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1306, iwl6000i_2abg_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1307, iwl6000i_2bg_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1321, iwl6000i_2agn_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1326, iwl6000i_2abg_cfg)},
        {IWL_PCI_DEVICE(0x4238, 0x1111, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4238, 0x1118, iwl6000_3agn_cfg)},
        {IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
        {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
@@ -153,12 +156,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x0082, 0x1301, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1306, iwl6005_2abg_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1307, iwl6005_2bg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1308, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1321, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1326, iwl6005_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1328, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0085, 0x1311, iwl6005_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0x1318, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0085, 0x1316, iwl6005_2abg_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0xC020, iwl6005_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x0085, 0xC220, iwl6005_2agn_sff_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0xC228, iwl6005_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x4820, iwl6005_2agn_d_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1304, iwl6005_2agn_mow1_cfg)},/* low 5GHz active */
        {IWL_PCI_DEVICE(0x0082, 0x1305, iwl6005_2agn_mow2_cfg)},/* high 5GHz active */
@@ -240,8 +247,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 6x35 Series */
        {IWL_PCI_DEVICE(0x088E, 0x4060, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088E, 0x406A, iwl6035_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x088F, 0x4260, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088F, 0x426A, iwl6035_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x088E, 0x4460, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088E, 0x446A, iwl6035_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x088E, 0x4860, iwl6035_2agn_cfg)},
        {IWL_PCI_DEVICE(0x088F, 0x5260, iwl6035_2agn_cfg)},
@@ -260,54 +270,86 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 #if IS_ENABLED(CONFIG_IWLMVM)
 /* 7000 Series */
        {IWL_PCI_DEVICE(0x08B1, 0x4070, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4072, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4170, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4060, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x406A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4160, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4062, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4162, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0x4270, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4272, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0x4260, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x426A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0x4262, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4470, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4472, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4460, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x446A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4462, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4870, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x486E, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4A70, iwl7260_2ac_cfg_high_temp)},
        {IWL_PCI_DEVICE(0x08B1, 0x4A6E, iwl7260_2ac_cfg_high_temp)},
        {IWL_PCI_DEVICE(0x08B1, 0x4A6C, iwl7260_2ac_cfg_high_temp)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4570, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4560, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4370, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4360, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x5070, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4020, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x402A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0x4220, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4420, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC070, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC072, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC170, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC060, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC06A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC160, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC062, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC162, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC770, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC760, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0xC270, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC272, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0xC260, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC26A, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0xC262, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC470, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC472, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC460, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC462, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC570, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC560, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC370, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC360, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC020, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC02A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0xC220, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC420, iwl7260_2n_cfg)},
 /* 3160 Series */
        {IWL_PCI_DEVICE(0x08B3, 0x0070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0072, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x0170, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0172, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x0060, iwl3160_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x0062, iwl3160_n_cfg)},
        {IWL_PCI_DEVICE(0x08B4, 0x0270, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B4, 0x0272, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x0470, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0472, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B4, 0x0370, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8072, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8170, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8172, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8060, iwl3160_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8062, iwl3160_n_cfg)},
        {IWL_PCI_DEVICE(0x08B4, 0x8270, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8470, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8570, iwl3160_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
        {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index bad95d28d50d..c3f904d422b0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1401,6 +1401,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        spin_lock_init(&trans_pcie->reg_lock);
        init_waitqueue_head(&trans_pcie->ucode_write_waitq);
+        err = pci_enable_device(pdev);
+        if (err)
+                goto out_no_pci;
        if (!cfg->base_params->pcie_l1_allowed) {
                /*
                 * W/A - seems to solve weird behavior. We need to remove this
@@ -1412,10 +1416,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                                       PCIE_LINK_STATE_CLKPM);
        }
-        err = pci_enable_device(pdev);
-        if (err)
-                goto out_no_pci;
        pci_set_master(pdev);
        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index f45eb29c2ede..1424335163b9 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1102,6 +1102,8 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
                 * non-AGG queue.
                 */
                iwl_clear_bits_prph(trans, SCD_AGGR_SEL, BIT(txq_id));
+                ssn = trans_pcie->txq[txq_id].q.read_ptr;
        }
        /* Place first TFD at index corresponding to start sequence number.
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 9d7c0e6c4fc7..37f873bb342f 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1422,13 +1422,19 @@ static int mwifiex_deauthenticate_infra(struct mwifiex_private *priv, u8 *mac)
 */
 int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac)
 {
+        int ret = 0;
        if (!priv->media_connected)
                return 0;
        switch (priv->bss_mode) {
        case NL80211_IFTYPE_STATION:
        case NL80211_IFTYPE_P2P_CLIENT:
-                return mwifiex_deauthenticate_infra(priv, mac);
+                ret = mwifiex_deauthenticate_infra(priv, mac);
+                if (ret)
+                        cfg80211_disconnected(priv->netdev, 0, NULL, 0,
+                                              GFP_KERNEL);
+                break;
        case NL80211_IFTYPE_ADHOC:
                return mwifiex_send_cmd_sync(priv,
                                             HostCmd_CMD_802_11_AD_HOC_STOP,
@@ -1440,7 +1446,7 @@ int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac)
                break;
        }
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(mwifiex_deauthenticate);
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index fd778337deee..c2b91f566e05 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -358,10 +358,12 @@ process_start:
                }
        } while (true);
-        if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter))
+        spin_lock_irqsave(&adapter->main_proc_lock, flags);
+        if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter)) {
+                spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
                goto process_start;
+        }
-        spin_lock_irqsave(&adapter->main_proc_lock, flags);
        adapter->mwifiex_processing = false;
        spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 8b057524b252..8c351f71f72f 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -118,7 +118,8 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
        dev_dbg(adapter->dev,
                "info: successfully disconnected from %pM: reason code %d\n",
                priv->cfg_bssid, reason_code);
-        if (priv->bss_mode == NL80211_IFTYPE_STATION) {
+        if (priv->bss_mode == NL80211_IFTYPE_STATION ||
+            priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
                cfg80211_disconnected(priv->netdev, reason_code, NULL, 0,
                                      GFP_KERNEL);
        }
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 76d95deb274b..dc49e525ae5e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -105,13 +105,11 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops)
                goto exit_release_regions;
        }
-        pci_enable_msi(pci_dev);
        hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
        if (!hw) {
                rt2x00_probe_err("Failed to allocate hardware\n");
                retval = -ENOMEM;
-                goto exit_disable_msi;
+                goto exit_release_regions;
        }
        pci_set_drvdata(pci_dev, hw);
@@ -152,9 +150,6 @@ exit_free_reg:
 exit_free_device:
        ieee80211_free_hw(hw);
-exit_disable_msi:
-        pci_disable_msi(pci_dev);
 exit_release_regions:
        pci_release_regions(pci_dev);
@@ -179,8 +174,6 @@ void rt2x00pci_remove(struct pci_dev *pci_dev)
        rt2x00pci_free_reg(rt2x00dev);
        ieee80211_free_hw(hw);
-        pci_disable_msi(pci_dev);
        /*
         * Free the PCI device data.
         */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 763cf1defab5..5a060e537fbe 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -343,7 +343,8 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                                        (bool)GET_RX_DESC_PAGGR(pdesc));
        rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
        if (phystatus) {
-                p_drvinfo = (struct rx_fwinfo_92c *)(pdesc + RTL_RX_DESC_SIZE);
+                p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
+                                                     stats->rx_bufshift);
                rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
                                                 p_drvinfo);
        }
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 5715318d6bab..400fea1de080 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -163,6 +163,7 @@ struct xenvif {
        unsigned long   credit_usec;
        unsigned long   remaining_credit;
        struct timer_list credit_timeout;
+        u64 credit_window_start;
        /* Statistics */
        unsigned long rx_gso_checksum_fixup;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 01bb854c7f62..459935a6bfae 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -312,8 +312,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
        vif->credit_bytes = vif->remaining_credit = ~0UL;
        vif->credit_usec  = 0UL;
        init_timer(&vif->credit_timeout);
-        /* Initialize 'expires' now: it's used to track the credit window. */
+        vif->credit_window_start = get_jiffies_64();
-        vif->credit_timeout.expires = jiffies;
        dev->netdev_ops = &xenvif_netdev_ops;
        dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f3e591c611de..900da4b243ad 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1185,9 +1185,8 @@ out:
 static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
 {
-        unsigned long now = jiffies;
+        u64 now = get_jiffies_64();
-        unsigned long next_credit =
+        u64 next_credit = vif->credit_window_start +
-                vif->credit_timeout.expires +
                msecs_to_jiffies(vif->credit_usec / 1000);
        /* Timer could already be pending in rare cases. */
@@ -1195,8 +1194,8 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
                return true;
        /* Passed the point where we can replenish credit? */
-        if (time_after_eq(now, next_credit)) {
+        if (time_after_eq64(now, next_credit)) {
-                vif->credit_timeout.expires = now;
+                vif->credit_window_start = now;
                tx_add_credit(vif);
        }
@@ -1208,6 +1207,7 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
                        tx_credit_callback;
                mod_timer(&vif->credit_timeout,
                          next_credit);
+                vif->credit_window_start = next_credit;
                return true;
        }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index b45bce20ad76..1b08d8798372 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -39,11 +39,15 @@ static int connect_rings(struct backend_info *);
 static void connect(struct backend_info *);
 static void backend_create_xenvif(struct backend_info *be);
 static void unregister_hotplug_status_watch(struct backend_info *be);
+static void set_backend_state(struct backend_info *be,
+                              enum xenbus_state state);
 static int netback_remove(struct xenbus_device *dev)
 {
        struct backend_info *be = dev_get_drvdata(&dev->dev);
+        set_backend_state(be, XenbusStateClosed);
        unregister_hotplug_status_watch(be);
        if (be->vif) {
                kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index be12fbfcae10..1ea75236a15f 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -552,9 +552,8 @@ static void __ref enable_slot(struct acpiphp_slot *slot)
        struct acpiphp_func *func;
        int max, pass;
        LIST_HEAD(add_list);
-        int nr_found;
-        nr_found = acpiphp_rescan_slot(slot);
+        acpiphp_rescan_slot(slot);
        max = acpiphp_max_busnr(bus);
        for (pass = 0; pass < 2; pass++) {
                list_for_each_entry(dev, &bus->devices, bus_list) {
@@ -574,9 +573,6 @@ static void __ref enable_slot(struct acpiphp_slot *slot)
                }
        }
        __pci_bus_assign_resources(bus, &add_list, NULL);
-        /* Nothing more to do here if there are no new devices on this bus. */
-        if (!nr_found && (slot->flags & SLOT_ENABLED))
-                return;
        acpiphp_sanitize_bus(bus);
        acpiphp_set_hpp_values(bus);
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
new file mode 100644
index 000000000000..a344f3d52361
--- /dev/null
+++ b/drivers/phy/Kconfig
@@ -0,0 +1,54 @@
+#
+# PHY
+#
+menu "PHY Subsystem"
+config GENERIC_PHY
+        tristate "PHY Core"
+        help
+          Generic PHY support.
+          This framework is designed to provide a generic interface for PHY
+          devices present in the kernel. This layer will have the generic
+          API by which phy drivers can create PHY using the phy framework and
+          phy users can obtain reference to the PHY. All the users of this
+          framework should select this config.
+config PHY_EXYNOS_MIPI_VIDEO
+        tristate "S5P/EXYNOS SoC series MIPI CSI-2/DSI PHY driver"
+        help
+          Support for MIPI CSI-2 and MIPI DSI DPHY found on Samsung S5P
+          and EXYNOS SoCs.
+config OMAP_USB2
+        tristate "OMAP USB2 PHY Driver"
+        depends on ARCH_OMAP2PLUS
+        select GENERIC_PHY
+        select USB_PHY
+        select OMAP_CONTROL_USB
+        help
+          Enable this to support the transceiver that is part of SOC. This
+          driver takes care of all the PHY functionality apart from comparator.
+          The USB OTG controller communicates with the comparator using this
+          driver.
+config TWL4030_USB
+        tristate "TWL4030 USB Transceiver Driver"
+        depends on TWL4030_CORE && REGULATOR_TWL4030 && USB_MUSB_OMAP2PLUS
+        select GENERIC_PHY
+        select USB_PHY
+        help
+          Enable this to support the USB OTG transceiver on TWL4030
+          family chips (including the TWL5030 and TPS659x0 devices).
+          This transceiver supports high and full speed devices plus,
+          in host mode, low speed.
+config PHY_EXYNOS_DP_VIDEO
+        tristate "EXYNOS SoC series Display Port PHY driver"
+        depends on OF
+        select GENERIC_PHY
+        help
+          Support for Display Port PHY found on Samsung EXYNOS SoCs.
+endmenu
diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
new file mode 100644
index 000000000000..d0caae9cfb83
--- /dev/null
+++ b/drivers/phy/Makefile
@@ -0,0 +1,9 @@
+#
+# Makefile for the phy drivers.
+#
+obj-$(CONFIG_GENERIC_PHY)               += phy-core.o
+obj-$(CONFIG_PHY_EXYNOS_DP_VIDEO)       += phy-exynos-dp-video.o
+obj-$(CONFIG_PHY_EXYNOS_MIPI_VIDEO)     += phy-exynos-mipi-video.o
+obj-$(CONFIG_OMAP_USB2)                 += phy-omap-usb2.o
+obj-$(CONFIG_TWL4030_USB)               += phy-twl4030-usb.o
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
new file mode 100644
index 000000000000..03cf8fb81554
--- /dev/null
+++ b/drivers/phy/phy-core.c
@@ -0,0 +1,698 @@
+/*
+ * phy-core.c  --  Generic Phy framework.
+ *
+ * Copyright (C) 2013 Texas Instruments Incorporated - http://www.ti.com
+ *
+ * Author: Kishon Vijay Abraham I <kishon@ti.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/export.h>
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/phy/phy.h>
+#include <linux/idr.h>
+#include <linux/pm_runtime.h>
+static struct class *phy_class;
+static DEFINE_MUTEX(phy_provider_mutex);
+static LIST_HEAD(phy_provider_list);
+static DEFINE_IDA(phy_ida);
+static void devm_phy_release(struct device *dev, void *res)
+{
+        struct phy *phy = *(struct phy **)res;
+        phy_put(phy);
+}
+static void devm_phy_provider_release(struct device *dev, void *res)
+{
+        struct phy_provider *phy_provider = *(struct phy_provider **)res;
+        of_phy_provider_unregister(phy_provider);
+}
+static void devm_phy_consume(struct device *dev, void *res)
+{
+        struct phy *phy = *(struct phy **)res;
+        phy_destroy(phy);
+}
+static int devm_phy_match(struct device *dev, void *res, void *match_data)
+{
+        return res == match_data;
+}
+static struct phy *phy_lookup(struct device *device, const char *port)
+{
+        unsigned int count;
+        struct phy *phy;
+        struct device *dev;
+        struct phy_consumer *consumers;
+        struct class_dev_iter iter;
+        class_dev_iter_init(&iter, phy_class, NULL, NULL);
+        while ((dev = class_dev_iter_next(&iter))) {
+                phy = to_phy(dev);
+                count = phy->init_data->num_consumers;
+                consumers = phy->init_data->consumers;
+                while (count--) {
+                        if (!strcmp(consumers->dev_name, dev_name(device)) &&
+                                        !strcmp(consumers->port, port)) {
+                                class_dev_iter_exit(&iter);
+                                return phy;
+                        }
+                        consumers++;
+                }
+        }
+        class_dev_iter_exit(&iter);
+        return ERR_PTR(-ENODEV);
+}
+static struct phy_provider *of_phy_provider_lookup(struct device_node *node)
+{
+        struct phy_provider *phy_provider;
+        list_for_each_entry(phy_provider, &phy_provider_list, list) {
+                if (phy_provider->dev->of_node == node)
+                        return phy_provider;
+        }
+        return ERR_PTR(-EPROBE_DEFER);
+}
+int phy_pm_runtime_get(struct phy *phy)
+{
+        if (!pm_runtime_enabled(&phy->dev))
+                return -ENOTSUPP;
+        return pm_runtime_get(&phy->dev);
+}
+EXPORT_SYMBOL_GPL(phy_pm_runtime_get);
+int phy_pm_runtime_get_sync(struct phy *phy)
+{
+        if (!pm_runtime_enabled(&phy->dev))
+                return -ENOTSUPP;
+        return pm_runtime_get_sync(&phy->dev);
+}
+EXPORT_SYMBOL_GPL(phy_pm_runtime_get_sync);
+int phy_pm_runtime_put(struct phy *phy)
+{
+        if (!pm_runtime_enabled(&phy->dev))
+                return -ENOTSUPP;
+        return pm_runtime_put(&phy->dev);
+}
+EXPORT_SYMBOL_GPL(phy_pm_runtime_put);
+int phy_pm_runtime_put_sync(struct phy *phy)
+{
+        if (!pm_runtime_enabled(&phy->dev))
+                return -ENOTSUPP;
+        return pm_runtime_put_sync(&phy->dev);
+}
+EXPORT_SYMBOL_GPL(phy_pm_runtime_put_sync);
+void phy_pm_runtime_allow(struct phy *phy)
+{
+        if (!pm_runtime_enabled(&phy->dev))
+                return;
+        pm_runtime_allow(&phy->dev);
+}
+EXPORT_SYMBOL_GPL(phy_pm_runtime_allow);
+void phy_pm_runtime_forbid(struct phy *phy)
+{
+        if (!pm_runtime_enabled(&phy->dev))
+                return;
+        pm_runtime_forbid(&phy->dev);
+}
+EXPORT_SYMBOL_GPL(phy_pm_runtime_forbid);
+int phy_init(struct phy *phy)
+{
+        int ret;
+        ret = phy_pm_runtime_get_sync(phy);
+        if (ret < 0 && ret != -ENOTSUPP)
+                return ret;
+        mutex_lock(&phy->mutex);
+        if (phy->init_count++ == 0 && phy->ops->init) {
+                ret = phy->ops->init(phy);
+                if (ret < 0) {
+                        dev_err(&phy->dev, "phy init failed --> %d\n", ret);
+                        goto out;
+                }
+        }
+out:
+        mutex_unlock(&phy->mutex);
+        phy_pm_runtime_put(phy);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(phy_init);
+int phy_exit(struct phy *phy)
+{
+        int ret;
+        ret = phy_pm_runtime_get_sync(phy);
+        if (ret < 0 && ret != -ENOTSUPP)
+                return ret;
+        mutex_lock(&phy->mutex);
+        if (--phy->init_count == 0 && phy->ops->exit) {
+                ret = phy->ops->exit(phy);
+                if (ret < 0) {
+                        dev_err(&phy->dev, "phy exit failed --> %d\n", ret);
+                        goto out;
+                }
+        }
+out:
+        mutex_unlock(&phy->mutex);
+        phy_pm_runtime_put(phy);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(phy_exit);
+int phy_power_on(struct phy *phy)
+{
+        int ret = -ENOTSUPP;
+        ret = phy_pm_runtime_get_sync(phy);
+        if (ret < 0 && ret != -ENOTSUPP)
+                return ret;
+        mutex_lock(&phy->mutex);
+        if (phy->power_count++ == 0 && phy->ops->power_on) {
+                ret = phy->ops->power_on(phy);
+                if (ret < 0) {
+                        dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
+                        goto out;
+                }
+        }
+out:
+        mutex_unlock(&phy->mutex);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(phy_power_on);
+int phy_power_off(struct phy *phy)
+{
+        int ret = -ENOTSUPP;
+        mutex_lock(&phy->mutex);
+        if (--phy->power_count == 0 && phy->ops->power_off) {
+                ret =  phy->ops->power_off(phy);
+                if (ret < 0) {
+                        dev_err(&phy->dev, "phy poweroff failed --> %d\n", ret);
+                        goto out;
+                }
+        }
+out:
+        mutex_unlock(&phy->mutex);
+        phy_pm_runtime_put(phy);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(phy_power_off);
+/**
+ * of_phy_get() - lookup and obtain a reference to a phy by phandle
+ * @dev: device that requests this phy
+ * @index: the index of the phy
+ *
+ * Returns the phy associated with the given phandle value,
+ * after getting a refcount to it or -ENODEV if there is no such phy or
+ * -EPROBE_DEFER if there is a phandle to the phy, but the device is
+ * not yet loaded. This function uses of_xlate call back function provided
+ * while registering the phy_provider to find the phy instance.
+ */
+static struct phy *of_phy_get(struct device *dev, int index)
+{
+        int ret;
+        struct phy_provider *phy_provider;
+        struct phy *phy = NULL;
+        struct of_phandle_args args;
+        ret = of_parse_phandle_with_args(dev->of_node, "phys", "#phy-cells",
+                index, &args);
+        if (ret) {
+                dev_dbg(dev, "failed to get phy in %s node\n",
+                        dev->of_node->full_name);
+                return ERR_PTR(-ENODEV);
+        }
+        mutex_lock(&phy_provider_mutex);
+        phy_provider = of_phy_provider_lookup(args.np);
+        if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) {
+                phy = ERR_PTR(-EPROBE_DEFER);
+                goto err0;
+        }
+        phy = phy_provider->of_xlate(phy_provider->dev, &args);
+        module_put(phy_provider->owner);
+err0:
+        mutex_unlock(&phy_provider_mutex);
+        of_node_put(args.np);
+        return phy;
+}
+/**
+ * phy_put() - release the PHY
+ * @phy: the phy returned by phy_get()
+ *
+ * Releases a refcount the caller received from phy_get().
+ */
+void phy_put(struct phy *phy)
+{
+        if (IS_ERR(phy))
+                return;
+        module_put(phy->ops->owner);
+        put_device(&phy->dev);
+}
+EXPORT_SYMBOL_GPL(phy_put);
+/**
+ * devm_phy_put() - release the PHY
+ * @dev: device that wants to release this phy
+ * @phy: the phy returned by devm_phy_get()
+ *
+ * destroys the devres associated with this phy and invokes phy_put
+ * to release the phy.
+ */
+void devm_phy_put(struct device *dev, struct phy *phy)
+{
+        int r;
+        r = devres_destroy(dev, devm_phy_release, devm_phy_match, phy);
+        dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n");
+}
+EXPORT_SYMBOL_GPL(devm_phy_put);
+/**
+ * of_phy_simple_xlate() - returns the phy instance from phy provider
+ * @dev: the PHY provider device
+ * @args: of_phandle_args (not used here)
+ *
+ * Intended to be used by phy provider for the common case where #phy-cells is
+ * 0. For other cases where #phy-cells is greater than '0', the phy provider
+ * should provide a custom of_xlate function that reads the *args* and returns
+ * the appropriate phy.
+ */
+struct phy *of_phy_simple_xlate(struct device *dev, struct of_phandle_args
+        *args)
+{
+        struct phy *phy;
+        struct class_dev_iter iter;
+        struct device_node *node = dev->of_node;
+        class_dev_iter_init(&iter, phy_class, NULL, NULL);
+        while ((dev = class_dev_iter_next(&iter))) {
+                phy = to_phy(dev);
+                if (node != phy->dev.of_node)
+                        continue;
+                class_dev_iter_exit(&iter);
+                return phy;
+        }
+        class_dev_iter_exit(&iter);
+        return ERR_PTR(-ENODEV);
+}
+EXPORT_SYMBOL_GPL(of_phy_simple_xlate);
+/**
+ * phy_get() - lookup and obtain a reference to a phy.
+ * @dev: device that requests this phy
+ * @string: the phy name as given in the dt data or the name of the controller
+ * port for non-dt case
+ *
+ * Returns the phy driver, after getting a refcount to it; or
+ * -ENODEV if there is no such phy.  The caller is responsible for
+ * calling phy_put() to release that count.
+ */
+struct phy *phy_get(struct device *dev, const char *string)
+{
+        int index = 0;
+        struct phy *phy = NULL;
+        if (string == NULL) {
+                dev_WARN(dev, "missing string\n");
+                return ERR_PTR(-EINVAL);
+        }
+        if (dev->of_node) {
+                index = of_property_match_string(dev->of_node, "phy-names",
+                        string);
+                phy = of_phy_get(dev, index);
+                if (IS_ERR(phy)) {
+                        dev_err(dev, "unable to find phy\n");
+                        return phy;
+                }
+        } else {
+                phy = phy_lookup(dev, string);
+                if (IS_ERR(phy)) {
+                        dev_err(dev, "unable to find phy\n");
+                        return phy;
+                }
+        }
+        if (!try_module_get(phy->ops->owner))
+                return ERR_PTR(-EPROBE_DEFER);
+        get_device(&phy->dev);
+        return phy;
+}
+EXPORT_SYMBOL_GPL(phy_get);
+/**
+ * devm_phy_get() - lookup and obtain a reference to a phy.
+ * @dev: device that requests this phy
+ * @string: the phy name as given in the dt data or phy device name
+ * for non-dt case
+ *
+ * Gets the phy using phy_get(), and associates a device with it using
+ * devres. On driver detach, release function is invoked on the devres data,
+ * then, devres data is freed.
+ */
+struct phy *devm_phy_get(struct device *dev, const char *string)
+{
+        struct phy **ptr, *phy;
+        ptr = devres_alloc(devm_phy_release, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return ERR_PTR(-ENOMEM);
+        phy = phy_get(dev, string);
+        if (!IS_ERR(phy)) {
+                *ptr = phy;
+                devres_add(dev, ptr);
+        } else {
+                devres_free(ptr);
+        }
+        return phy;
+}
+EXPORT_SYMBOL_GPL(devm_phy_get);
+/**
+ * phy_create() - create a new phy
+ * @dev: device that is creating the new phy
+ * @ops: function pointers for performing phy operations
+ * @init_data: contains the list of PHY consumers or NULL
+ *
+ * Called to create a phy using phy framework.
+ */
+struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
+        struct phy_init_data *init_data)
+{
+        int ret;
+        int id;
+        struct phy *phy;
+        if (!dev) {
+                dev_WARN(dev, "no device provided for PHY\n");
+                ret = -EINVAL;
+                goto err0;
+        }
+        phy = kzalloc(sizeof(*phy), GFP_KERNEL);
+        if (!phy) {
+                ret = -ENOMEM;
+                goto err0;
+        }
+        id = ida_simple_get(&phy_ida, 0, 0, GFP_KERNEL);
+        if (id < 0) {
+                dev_err(dev, "unable to get id\n");
+                ret = id;
+                goto err0;
+        }
+        device_initialize(&phy->dev);
+        mutex_init(&phy->mutex);
+        phy->dev.class = phy_class;
+        phy->dev.parent = dev;
+        phy->dev.of_node = dev->of_node;
+        phy->id = id;
+        phy->ops = ops;
+        phy->init_data = init_data;
+        ret = dev_set_name(&phy->dev, "phy-%s.%d", dev_name(dev), id);
+        if (ret)
+                goto err1;
+        ret = device_add(&phy->dev);
+        if (ret)
+                goto err1;
+        if (pm_runtime_enabled(dev)) {
+                pm_runtime_enable(&phy->dev);
+                pm_runtime_no_callbacks(&phy->dev);
+        }
+        return phy;
+err1:
+        ida_remove(&phy_ida, phy->id);
+        put_device(&phy->dev);
+        kfree(phy);
+err0:
+        return ERR_PTR(ret);
+}
+EXPORT_SYMBOL_GPL(phy_create);
+/**
+ * devm_phy_create() - create a new phy
+ * @dev: device that is creating the new phy
+ * @ops: function pointers for performing phy operations
+ * @init_data: contains the list of PHY consumers or NULL
+ *
+ * Creates a new PHY device adding it to the PHY class.
+ * While at that, it also associates the device with the phy using devres.
+ * On driver detach, release function is invoked on the devres data,
+ * then, devres data is freed.
+ */
+struct phy *devm_phy_create(struct device *dev, const struct phy_ops *ops,
+        struct phy_init_data *init_data)
+{
+        struct phy **ptr, *phy;
+        ptr = devres_alloc(devm_phy_consume, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return ERR_PTR(-ENOMEM);
+        phy = phy_create(dev, ops, init_data);
+        if (!IS_ERR(phy)) {
+                *ptr = phy;
+                devres_add(dev, ptr);
+        } else {
+                devres_free(ptr);
+        }
+        return phy;
+}
+EXPORT_SYMBOL_GPL(devm_phy_create);
+/**
+ * phy_destroy() - destroy the phy
+ * @phy: the phy to be destroyed
+ *
+ * Called to destroy the phy.
+ */
+void phy_destroy(struct phy *phy)
+{
+        pm_runtime_disable(&phy->dev);
+        device_unregister(&phy->dev);
+}
+EXPORT_SYMBOL_GPL(phy_destroy);
+/**
+ * devm_phy_destroy() - destroy the PHY
+ * @dev: device that wants to release this phy
+ * @phy: the phy returned by devm_phy_get()
+ *
+ * destroys the devres associated with this phy and invokes phy_destroy
+ * to destroy the phy.
+ */
+void devm_phy_destroy(struct device *dev, struct phy *phy)
+{
+        int r;
+        r = devres_destroy(dev, devm_phy_consume, devm_phy_match, phy);
+        dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n");
+}
+EXPORT_SYMBOL_GPL(devm_phy_destroy);
+/**
+ * __of_phy_provider_register() - create/register phy provider with the framework
+ * @dev: struct device of the phy provider
+ * @owner: the module owner containing of_xlate
+ * @of_xlate: function pointer to obtain phy instance from phy provider
+ *
+ * Creates struct phy_provider from dev and of_xlate function pointer.
+ * This is used in the case of dt boot for finding the phy instance from
+ * phy provider.
+ */
+struct phy_provider *__of_phy_provider_register(struct device *dev,
+        struct module *owner, struct phy * (*of_xlate)(struct device *dev,
+        struct of_phandle_args *args))
+{
+        struct phy_provider *phy_provider;
+        phy_provider = kzalloc(sizeof(*phy_provider), GFP_KERNEL);
+        if (!phy_provider)
+                return ERR_PTR(-ENOMEM);
+        phy_provider->dev = dev;
+        phy_provider->owner = owner;
+        phy_provider->of_xlate = of_xlate;
+        mutex_lock(&phy_provider_mutex);
+        list_add_tail(&phy_provider->list, &phy_provider_list);
+        mutex_unlock(&phy_provider_mutex);
+        return phy_provider;
+}
+EXPORT_SYMBOL_GPL(__of_phy_provider_register);
+/**
+ * __devm_of_phy_provider_register() - create/register phy provider with the
+ * framework
+ * @dev: struct device of the phy provider
+ * @owner: the module owner containing of_xlate
+ * @of_xlate: function pointer to obtain phy instance from phy provider
+ *
+ * Creates struct phy_provider from dev and of_xlate function pointer.
+ * This is used in the case of dt boot for finding the phy instance from
+ * phy provider. While at that, it also associates the device with the
+ * phy provider using devres. On driver detach, release function is invoked
+ * on the devres data, then, devres data is freed.
+ */
+struct phy_provider *__devm_of_phy_provider_register(struct device *dev,
+        struct module *owner, struct phy * (*of_xlate)(struct device *dev,
+        struct of_phandle_args *args))
+{
+        struct phy_provider **ptr, *phy_provider;
+        ptr = devres_alloc(devm_phy_provider_release, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return ERR_PTR(-ENOMEM);
+        phy_provider = __of_phy_provider_register(dev, owner, of_xlate);
+        if (!IS_ERR(phy_provider)) {
+                *ptr = phy_provider;
+                devres_add(dev, ptr);
+        } else {
+                devres_free(ptr);
+        }
+        return phy_provider;
+}
+EXPORT_SYMBOL_GPL(__devm_of_phy_provider_register);
+/**
+ * of_phy_provider_unregister() - unregister phy provider from the framework
+ * @phy_provider: phy provider returned by of_phy_provider_register()
+ *
+ * Removes the phy_provider created using of_phy_provider_register().
+ */
+void of_phy_provider_unregister(struct phy_provider *phy_provider)
+{
+        if (IS_ERR(phy_provider))
+                return;
+        mutex_lock(&phy_provider_mutex);
+        list_del(&phy_provider->list);
+        kfree(phy_provider);
+        mutex_unlock(&phy_provider_mutex);
+}
+EXPORT_SYMBOL_GPL(of_phy_provider_unregister);
+/**
+ * devm_of_phy_provider_unregister() - remove phy provider from the framework
+ * @dev: struct device of the phy provider
+ *
+ * destroys the devres associated with this phy provider and invokes
+ * of_phy_provider_unregister to unregister the phy provider.
+ */
+void devm_of_phy_provider_unregister(struct device *dev,
+        struct phy_provider *phy_provider) {
+        int r;
+        r = devres_destroy(dev, devm_phy_provider_release, devm_phy_match,
+                phy_provider);
+        dev_WARN_ONCE(dev, r, "couldn't find PHY provider device resource\n");
+}
+EXPORT_SYMBOL_GPL(devm_of_phy_provider_unregister);
+/**
+ * phy_release() - release the phy
+ * @dev: the dev member within phy
+ *
+ * When the last reference to the device is removed, it is called
+ * from the embedded kobject as release method.
+ */
+static void phy_release(struct device *dev)
+{
+        struct phy *phy;
+        phy = to_phy(dev);
+        dev_vdbg(dev, "releasing '%s'\n", dev_name(dev));
+        ida_remove(&phy_ida, phy->id);
+        kfree(phy);
+}
+static int __init phy_core_init(void)
+{
+        phy_class = class_create(THIS_MODULE, "phy");
+        if (IS_ERR(phy_class)) {
+                pr_err("failed to create phy class --> %ld\n",
+                        PTR_ERR(phy_class));
+                return PTR_ERR(phy_class);
+        }
+        phy_class->dev_release = phy_release;
+        return 0;
+}
+module_init(phy_core_init);
+static void __exit phy_core_exit(void)
+{
+        class_destroy(phy_class);
+}
+module_exit(phy_core_exit);
+MODULE_DESCRIPTION("Generic PHY Framework");
+MODULE_AUTHOR("Kishon Vijay Abraham I <kishon@ti.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-exynos-dp-video.c b/drivers/phy/phy-exynos-dp-video.c
new file mode 100644
index 000000000000..1dbe6ce7b2ce
--- /dev/null
+++ b/drivers/phy/phy-exynos-dp-video.c
@@ -0,0 +1,111 @@
+/*
+ * Samsung EXYNOS SoC series Display Port PHY driver
+ *
+ * Copyright (C) 2013 Samsung Electronics Co., Ltd.
+ * Author: Jingoo Han <jg1.han@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/phy/phy.h>
+#include <linux/platform_device.h>
+/* DPTX_PHY_CONTROL register */
+#define EXYNOS_DPTX_PHY_ENABLE          (1 << 0)
+struct exynos_dp_video_phy {
+        void __iomem *regs;
+};
+static int __set_phy_state(struct exynos_dp_video_phy *state, unsigned int on)
+{
+        u32 reg;
+        reg = readl(state->regs);
+        if (on)
+                reg |= EXYNOS_DPTX_PHY_ENABLE;
+        else
+                reg &= ~EXYNOS_DPTX_PHY_ENABLE;
+        writel(reg, state->regs);
+        return 0;
+}
+static int exynos_dp_video_phy_power_on(struct phy *phy)
+{
+        struct exynos_dp_video_phy *state = phy_get_drvdata(phy);
+        return __set_phy_state(state, 1);
+}
+static int exynos_dp_video_phy_power_off(struct phy *phy)
+{
+        struct exynos_dp_video_phy *state = phy_get_drvdata(phy);
+        return __set_phy_state(state, 0);
+}
+static struct phy_ops exynos_dp_video_phy_ops = {
+        .power_on       = exynos_dp_video_phy_power_on,
+        .power_off      = exynos_dp_video_phy_power_off,
+        .owner          = THIS_MODULE,
+};
+static int exynos_dp_video_phy_probe(struct platform_device *pdev)
+{
+        struct exynos_dp_video_phy *state;
+        struct device *dev = &pdev->dev;
+        struct resource *res;
+        struct phy_provider *phy_provider;
+        struct phy *phy;
+        state = devm_kzalloc(dev, sizeof(*state), GFP_KERNEL);
+        if (!state)
+                return -ENOMEM;
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        state->regs = devm_ioremap_resource(dev, res);
+        if (IS_ERR(state->regs))
+                return PTR_ERR(state->regs);
+        phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+        phy = devm_phy_create(dev, &exynos_dp_video_phy_ops, NULL);
+        if (IS_ERR(phy)) {
+                dev_err(dev, "failed to create Display Port PHY\n");
+                return PTR_ERR(phy);
+        }
+        phy_set_drvdata(phy, state);
+        return 0;
+}
+static const struct of_device_id exynos_dp_video_phy_of_match[] = {
+        { .compatible = "samsung,exynos5250-dp-video-phy" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, exynos_dp_video_phy_of_match);
+static struct platform_driver exynos_dp_video_phy_driver = {
+        .probe  = exynos_dp_video_phy_probe,
+        .driver = {
+                .name   = "exynos-dp-video-phy",
+                .owner  = THIS_MODULE,
+                .of_match_table = exynos_dp_video_phy_of_match,
+        }
+};
+module_platform_driver(exynos_dp_video_phy_driver);
+MODULE_AUTHOR("Jingoo Han <jg1.han@samsung.com>");
+MODULE_DESCRIPTION("Samsung EXYNOS SoC DP PHY driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-exynos-mipi-video.c b/drivers/phy/phy-exynos-mipi-video.c
new file mode 100644
index 000000000000..0c5efab11af1
--- /dev/null
+++ b/drivers/phy/phy-exynos-mipi-video.c
@@ -0,0 +1,176 @@
+/*
+ * Samsung S5P/EXYNOS SoC series MIPI CSIS/DSIM DPHY driver
+ *
+ * Copyright (C) 2013 Samsung Electronics Co., Ltd.
+ * Author: Sylwester Nawrocki <s.nawrocki@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/phy/phy.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+/* MIPI_PHYn_CONTROL register offset: n = 0..1 */
+#define EXYNOS_MIPI_PHY_CONTROL(n)      ((n) * 4)
+#define EXYNOS_MIPI_PHY_ENABLE          (1 << 0)
+#define EXYNOS_MIPI_PHY_SRESETN         (1 << 1)
+#define EXYNOS_MIPI_PHY_MRESETN         (1 << 2)
+#define EXYNOS_MIPI_PHY_RESET_MASK      (3 << 1)
+enum exynos_mipi_phy_id {
+        EXYNOS_MIPI_PHY_ID_CSIS0,
+        EXYNOS_MIPI_PHY_ID_DSIM0,
+        EXYNOS_MIPI_PHY_ID_CSIS1,
+        EXYNOS_MIPI_PHY_ID_DSIM1,
+        EXYNOS_MIPI_PHYS_NUM
+};
+#define is_mipi_dsim_phy_id(id) \
+        ((id) == EXYNOS_MIPI_PHY_ID_DSIM0 || (id) == EXYNOS_MIPI_PHY_ID_DSIM1)
+struct exynos_mipi_video_phy {
+        spinlock_t slock;
+        struct video_phy_desc {
+                struct phy *phy;
+                unsigned int index;
+        } phys[EXYNOS_MIPI_PHYS_NUM];
+        void __iomem *regs;
+};
+static int __set_phy_state(struct exynos_mipi_video_phy *state,
+                        enum exynos_mipi_phy_id id, unsigned int on)
+{
+        void __iomem *addr;
+        u32 reg, reset;
+        addr = state->regs + EXYNOS_MIPI_PHY_CONTROL(id / 2);
+        if (is_mipi_dsim_phy_id(id))
+                reset = EXYNOS_MIPI_PHY_MRESETN;
+        else
+                reset = EXYNOS_MIPI_PHY_SRESETN;
+        spin_lock(&state->slock);
+        reg = readl(addr);
+        if (on)
+                reg |= reset;
+        else
+                reg &= ~reset;
+        writel(reg, addr);
+        /* Clear ENABLE bit only if MRESETN, SRESETN bits are not set. */
+        if (on)
+                reg |= EXYNOS_MIPI_PHY_ENABLE;
+        else if (!(reg & EXYNOS_MIPI_PHY_RESET_MASK))
+                reg &= ~EXYNOS_MIPI_PHY_ENABLE;
+        writel(reg, addr);
+        spin_unlock(&state->slock);
+        return 0;
+}
+#define to_mipi_video_phy(desc) \
+        container_of((desc), struct exynos_mipi_video_phy, phys[(desc)->index]);
+static int exynos_mipi_video_phy_power_on(struct phy *phy)
+{
+        struct video_phy_desc *phy_desc = phy_get_drvdata(phy);
+        struct exynos_mipi_video_phy *state = to_mipi_video_phy(phy_desc);
+        return __set_phy_state(state, phy_desc->index, 1);
+}
+static int exynos_mipi_video_phy_power_off(struct phy *phy)
+{
+        struct video_phy_desc *phy_desc = phy_get_drvdata(phy);
+        struct exynos_mipi_video_phy *state = to_mipi_video_phy(phy_desc);
+        return __set_phy_state(state, phy_desc->index, 0);
+}
+static struct phy *exynos_mipi_video_phy_xlate(struct device *dev,
+                                        struct of_phandle_args *args)
+{
+        struct exynos_mipi_video_phy *state = dev_get_drvdata(dev);
+        if (WARN_ON(args->args[0] > EXYNOS_MIPI_PHYS_NUM))
+                return ERR_PTR(-ENODEV);
+        return state->phys[args->args[0]].phy;
+}
+static struct phy_ops exynos_mipi_video_phy_ops = {
+        .power_on       = exynos_mipi_video_phy_power_on,
+        .power_off      = exynos_mipi_video_phy_power_off,
+        .owner          = THIS_MODULE,
+};
+static int exynos_mipi_video_phy_probe(struct platform_device *pdev)
+{
+        struct exynos_mipi_video_phy *state;
+        struct device *dev = &pdev->dev;
+        struct resource *res;
+        struct phy_provider *phy_provider;
+        unsigned int i;
+        state = devm_kzalloc(dev, sizeof(*state), GFP_KERNEL);
+        if (!state)
+                return -ENOMEM;
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        state->regs = devm_ioremap_resource(dev, res);
+        if (IS_ERR(state->regs))
+                return PTR_ERR(state->regs);
+        dev_set_drvdata(dev, state);
+        spin_lock_init(&state->slock);
+        phy_provider = devm_of_phy_provider_register(dev,
+                                        exynos_mipi_video_phy_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+        for (i = 0; i < EXYNOS_MIPI_PHYS_NUM; i++) {
+                struct phy *phy = devm_phy_create(dev,
+                                        &exynos_mipi_video_phy_ops, NULL);
+                if (IS_ERR(phy)) {
+                        dev_err(dev, "failed to create PHY %d\n", i);
+                        return PTR_ERR(phy);
+                }
+                state->phys[i].phy = phy;
+                state->phys[i].index = i;
+                phy_set_drvdata(phy, &state->phys[i]);
+        }
+        return 0;
+}
+static const struct of_device_id exynos_mipi_video_phy_of_match[] = {
+        { .compatible = "samsung,s5pv210-mipi-video-phy" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, exynos_mipi_video_phy_of_match);
+static struct platform_driver exynos_mipi_video_phy_driver = {
+        .probe  = exynos_mipi_video_phy_probe,
+        .driver = {
+                .of_match_table = exynos_mipi_video_phy_of_match,
+                .name  = "exynos-mipi-video-phy",
+                .owner = THIS_MODULE,
+        }
+};
+module_platform_driver(exynos_mipi_video_phy_driver);
+MODULE_DESCRIPTION("Samsung S5P/EXYNOS SoC MIPI CSI-2/DSI PHY driver");
+MODULE_AUTHOR("Sylwester Nawrocki <s.nawrocki@samsung.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index d266861d24f7..bfc5c337f99a 100644
--- a/drivers/usb/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -28,6 +28,8 @@
 #include <linux/pm_runtime.h>
 #include <linux/delay.h>
 #include <linux/usb/omap_control_usb.h>
+#include <linux/phy/phy.h>
+#include <linux/of_platform.h>
 /**
 * omap_usb2_set_comparator - links the comparator present in the sytem with
@@ -118,10 +120,42 @@ static int omap_usb2_suspend(struct usb_phy *x, int suspend)
        return 0;
 }
+static int omap_usb_power_off(struct phy *x)
+{
+        struct omap_usb *phy = phy_get_drvdata(x);
+        omap_control_usb_phy_power(phy->control_dev, 0);
+        return 0;
+}
+static int omap_usb_power_on(struct phy *x)
+{
+        struct omap_usb *phy = phy_get_drvdata(x);
+        omap_control_usb_phy_power(phy->control_dev, 1);
+        return 0;
+}
+static struct phy_ops ops = {
+        .power_on       = omap_usb_power_on,
+        .power_off      = omap_usb_power_off,
+        .owner          = THIS_MODULE,
+};
 static int omap_usb2_probe(struct platform_device *pdev)
 {
-        struct omap_usb                 *phy;
+        struct omap_usb *phy;
-        struct usb_otg                  *otg;
+        struct phy *generic_phy;
+        struct phy_provider *phy_provider;
+        struct usb_otg *otg;
+        struct device_node *node = pdev->dev.of_node;
+        struct device_node *control_node;
+        struct platform_device *control_pdev;
+        if (!node)
+                return -EINVAL;
        phy = devm_kzalloc(&pdev->dev, sizeof(*phy), GFP_KERNEL);
        if (!phy) {
@@ -143,12 +177,25 @@ static int omap_usb2_probe(struct platform_device *pdev)
        phy->phy.otg            = otg;
        phy->phy.type           = USB_PHY_TYPE_USB2;
-        phy->control_dev = omap_get_control_dev();
+        phy_provider = devm_of_phy_provider_register(phy->dev,
-        if (IS_ERR(phy->control_dev)) {
+                        of_phy_simple_xlate);
-                dev_dbg(&pdev->dev, "Failed to get control device\n");
+        if (IS_ERR(phy_provider))
-                return -ENODEV;
+                return PTR_ERR(phy_provider);
+        control_node = of_parse_phandle(node, "ctrl-module", 0);
+        if (!control_node) {
+                dev_err(&pdev->dev, "Failed to get control device phandle\n");
+                return -EINVAL;
+        }
+        control_pdev = of_find_device_by_node(control_node);
+        if (!control_pdev) {
+                dev_err(&pdev->dev, "Failed to get control device\n");
+                return -EINVAL;
        }
+        phy->control_dev = &control_pdev->dev;
        phy->is_suspended       = 1;
        omap_control_usb_phy_power(phy->control_dev, 0);
@@ -158,6 +205,15 @@ static int omap_usb2_probe(struct platform_device *pdev)
        otg->start_srp          = omap_usb_start_srp;
        otg->phy                = &phy->phy;
+        platform_set_drvdata(pdev, phy);
+        pm_runtime_enable(phy->dev);
+        generic_phy = devm_phy_create(phy->dev, &ops, NULL);
+        if (IS_ERR(generic_phy))
+                return PTR_ERR(generic_phy);
+        phy_set_drvdata(generic_phy, phy);
        phy->wkupclk = devm_clk_get(phy->dev, "usb_phy_cm_clk32k");
        if (IS_ERR(phy->wkupclk)) {
                dev_err(&pdev->dev, "unable to get usb_phy_cm_clk32k\n");
@@ -173,10 +229,6 @@ static int omap_usb2_probe(struct platform_device *pdev)
        usb_add_phy_dev(&phy->phy);
-        platform_set_drvdata(pdev, phy);
-        pm_runtime_enable(phy->dev);
        return 0;
 }
diff --git a/drivers/usb/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 90730c8762b8..daf65e68aaab 100644
--- a/drivers/usb/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -33,6 +33,7 @@
 #include <linux/io.h>
 #include <linux/delay.h>
 #include <linux/usb/otg.h>
+#include <linux/phy/phy.h>
 #include <linux/usb/musb-omap.h>
 #include <linux/usb/ulpi.h>
 #include <linux/i2c/twl.h>
@@ -421,17 +422,20 @@ static void twl4030_phy_power(struct twl4030_usb *twl, int on)
        }
 }
-static void twl4030_phy_suspend(struct twl4030_usb *twl, int controller_off)
+static int twl4030_phy_power_off(struct phy *phy)
 {
+        struct twl4030_usb *twl = phy_get_drvdata(phy);
        if (twl->asleep)
-                return;
+                return 0;
        twl4030_phy_power(twl, 0);
        twl->asleep = 1;
        dev_dbg(twl->dev, "%s\n", __func__);
+        return 0;
 }
-static void __twl4030_phy_resume(struct twl4030_usb *twl)
+static void __twl4030_phy_power_on(struct twl4030_usb *twl)
 {
        twl4030_phy_power(twl, 1);
        twl4030_i2c_access(twl, 1);
@@ -440,11 +444,13 @@ static void __twl4030_phy_resume(struct twl4030_usb *twl)
                twl4030_i2c_access(twl, 0);
 }
-static void twl4030_phy_resume(struct twl4030_usb *twl)
+static int twl4030_phy_power_on(struct phy *phy)
 {
+        struct twl4030_usb *twl = phy_get_drvdata(phy);
        if (!twl->asleep)
-                return;
+                return 0;
-        __twl4030_phy_resume(twl);
+        __twl4030_phy_power_on(twl);
        twl->asleep = 0;
        dev_dbg(twl->dev, "%s\n", __func__);
@@ -457,6 +463,7 @@ static void twl4030_phy_resume(struct twl4030_usb *twl)
                cancel_delayed_work(&twl->id_workaround_work);
                schedule_delayed_work(&twl->id_workaround_work, HZ);
        }
+        return 0;
 }
 static int twl4030_usb_ldo_init(struct twl4030_usb *twl)
@@ -587,9 +594,9 @@ static void twl4030_id_workaround_work(struct work_struct *work)
        }
 }
-static int twl4030_usb_phy_init(struct usb_phy *phy)
+static int twl4030_phy_init(struct phy *phy)
 {
-        struct twl4030_usb *twl = phy_to_twl(phy);
+        struct twl4030_usb *twl = phy_get_drvdata(phy);
        enum omap_musb_vbus_id_status status;
        /*
@@ -602,25 +609,15 @@ static int twl4030_usb_phy_init(struct usb_phy *phy)
        status = twl4030_usb_linkstat(twl);
        twl->linkstat = status;
-        if (status == OMAP_MUSB_ID_GROUND || status == OMAP_MUSB_VBUS_VALID)
+        if (status == OMAP_MUSB_ID_GROUND || status == OMAP_MUSB_VBUS_VALID) {
                omap_musb_mailbox(twl->linkstat);
+                twl4030_phy_power_on(phy);
+        }
        sysfs_notify(&twl->dev->kobj, NULL, "vbus");
        return 0;
 }
-static int twl4030_set_suspend(struct usb_phy *x, int suspend)
-{
-        struct twl4030_usb *twl = phy_to_twl(x);
-        if (suspend)
-                twl4030_phy_suspend(twl, 1);
-        else
-                twl4030_phy_resume(twl);
-        return 0;
-}
 static int twl4030_set_peripheral(struct usb_otg *otg,
                                        struct usb_gadget *gadget)
 {
@@ -646,13 +643,23 @@ static int twl4030_set_host(struct usb_otg *otg, struct usb_bus *host)
        return 0;
 }
+static const struct phy_ops ops = {
+        .init           = twl4030_phy_init,
+        .power_on       = twl4030_phy_power_on,
+        .power_off      = twl4030_phy_power_off,
+        .owner          = THIS_MODULE,
+};
 static int twl4030_usb_probe(struct platform_device *pdev)
 {
        struct twl4030_usb_data *pdata = dev_get_platdata(&pdev->dev);
        struct twl4030_usb      *twl;
+        struct phy              *phy;
        int                     status, err;
        struct usb_otg          *otg;
        struct device_node      *np = pdev->dev.of_node;
+        struct phy_provider     *phy_provider;
+        struct phy_init_data    *init_data = NULL;
        twl = devm_kzalloc(&pdev->dev, sizeof *twl, GFP_KERNEL);
        if (!twl)
@@ -661,9 +668,10 @@ static int twl4030_usb_probe(struct platform_device *pdev)
        if (np)
                of_property_read_u32(np, "usb_mode",
                                (enum twl4030_usb_mode *)&twl->usb_mode);
-        else if (pdata)
+        else if (pdata) {
                twl->usb_mode = pdata->usb_mode;
-        else {
+                init_data = pdata->init_data;
+        } else {
                dev_err(&pdev->dev, "twl4030 initialized without pdata\n");
                return -EINVAL;
        }
@@ -682,13 +690,24 @@ static int twl4030_usb_probe(struct platform_device *pdev)
        twl->phy.label          = "twl4030";
        twl->phy.otg            = otg;
        twl->phy.type           = USB_PHY_TYPE_USB2;
-        twl->phy.set_suspend    = twl4030_set_suspend;
-        twl->phy.init           = twl4030_usb_phy_init;
        otg->phy                = &twl->phy;
        otg->set_host           = twl4030_set_host;
        otg->set_peripheral     = twl4030_set_peripheral;
+        phy_provider = devm_of_phy_provider_register(twl->dev,
+                of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+        phy = devm_phy_create(twl->dev, &ops, init_data);
+        if (IS_ERR(phy)) {
+                dev_dbg(&pdev->dev, "Failed to create PHY\n");
+                return PTR_ERR(phy);
+        }
+        phy_set_drvdata(phy, twl);
        /* init spinlock for workqueue */
        spin_lock_init(&twl->lock);
@@ -705,6 +724,8 @@ static int twl4030_usb_probe(struct platform_device *pdev)
        if (device_create_file(&pdev->dev, &dev_attr_vbus))
                dev_warn(&pdev->dev, "could not create sysfs file\n");
+        ATOMIC_INIT_NOTIFIER_HEAD(&twl->phy.notifier);
        /* Our job is to use irqs and status from the power module
         * to keep the transceiver disabled when nothing's connected.
         *
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 96d6b2eef4f2..b51a7460cc49 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -504,6 +504,7 @@ config ASUS_WMI
        depends on BACKLIGHT_CLASS_DEVICE
        depends on RFKILL || RFKILL = n
        depends on HOTPLUG_PCI
+        depends on ACPI_VIDEO || ACPI_VIDEO = n
        select INPUT_SPARSEKMAP
        select LEDS_CLASS
        select NEW_LEDS
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index d3fd52036fd6..13ec195f0ca6 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -127,18 +127,17 @@ MODULE_PARM_DESC(minor,
                 "default is -1 (automatic)");
 #endif
-static int kbd_backlight = 1;
+static int kbd_backlight = -1;
 module_param(kbd_backlight, int, 0444);
 MODULE_PARM_DESC(kbd_backlight,
                 "set this to 0 to disable keyboard backlight, "
-                 "1 to enable it (default: 0)");
+                 "1 to enable it (default: no change from current value)");
-static int kbd_backlight_timeout;       /* = 0 */
+static int kbd_backlight_timeout = -1;
 module_param(kbd_backlight_timeout, int, 0444);
 MODULE_PARM_DESC(kbd_backlight_timeout,
-                 "set this to 0 to set the default 10 seconds timeout, "
+                 "meaningful values vary from 0 to 3 and their meaning depends "
-                 "1 for 30 seconds, 2 for 60 seconds and 3 to disable timeout "
+                 "on the model (default: no change from current value)");
-                 "(default: 0)");
 #ifdef CONFIG_PM_SLEEP
 static void sony_nc_kbd_backlight_resume(void);
@@ -1844,6 +1843,8 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
        if (!kbdbl_ctl)
                return -ENOMEM;
+        kbdbl_ctl->mode = kbd_backlight;
+        kbdbl_ctl->timeout = kbd_backlight_timeout;
        kbdbl_ctl->handle = handle;
        if (handle == 0x0137)
                kbdbl_ctl->base = 0x0C00;
@@ -1870,8 +1871,8 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
        if (ret)
                goto outmode;
-        __sony_nc_kbd_backlight_mode_set(kbd_backlight);
+        __sony_nc_kbd_backlight_mode_set(kbdbl_ctl->mode);
-        __sony_nc_kbd_backlight_timeout_set(kbd_backlight_timeout);
+        __sony_nc_kbd_backlight_timeout_set(kbdbl_ctl->timeout);
        return 0;
@@ -1886,17 +1887,8 @@ outkzalloc:
 static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
 {
        if (kbdbl_ctl) {
-                int result;
                device_remove_file(&pd->dev, &kbdbl_ctl->mode_attr);
                device_remove_file(&pd->dev, &kbdbl_ctl->timeout_attr);
-                /* restore the default hw behaviour */
-                sony_call_snc_handle(kbdbl_ctl->handle,
-                                kbdbl_ctl->base | 0x10000, &result);
-                sony_call_snc_handle(kbdbl_ctl->handle,
-                                kbdbl_ctl->base + 0x200, &result);
                kfree(kbdbl_ctl);
                kbdbl_ctl = NULL;
        }
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 5adb2042e824..cee7e2708a1f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2077,6 +2077,7 @@ dasd_eckd_build_format(struct dasd_device *base,
        int intensity = 0;
        int r0_perm;
        int nr_tracks;
+        int use_prefix;
        startdev = dasd_alias_get_start_dev(base);
        if (!startdev)
@@ -2106,28 +2107,46 @@ dasd_eckd_build_format(struct dasd_device *base,
                intensity = fdata->intensity;
        }
+        use_prefix = base_priv->features.feature[8] & 0x01;
        switch (intensity) {
        case 0x00:      /* Normal format */
        case 0x08:      /* Normal format, use cdl. */
                cplength = 2 + (rpt*nr_tracks);
-                datasize = sizeof(struct PFX_eckd_data) +
+                if (use_prefix)
-                        sizeof(struct LO_eckd_data) +
+                        datasize = sizeof(struct PFX_eckd_data) +
-                        rpt * nr_tracks * sizeof(struct eckd_count);
+                                sizeof(struct LO_eckd_data) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
                break;
        case 0x01:      /* Write record zero and format track. */
        case 0x09:      /* Write record zero and format track, use cdl. */
                cplength = 2 + rpt * nr_tracks;
-                datasize = sizeof(struct PFX_eckd_data) +
+                if (use_prefix)
-                        sizeof(struct LO_eckd_data) +
+                        datasize = sizeof(struct PFX_eckd_data) +
-                        sizeof(struct eckd_count) +
+                                sizeof(struct LO_eckd_data) +
-                        rpt * nr_tracks * sizeof(struct eckd_count);
+                                sizeof(struct eckd_count) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
                break;
        case 0x04:      /* Invalidate track. */
        case 0x0c:      /* Invalidate track, use cdl. */
                cplength = 3;
-                datasize = sizeof(struct PFX_eckd_data) +
+                if (use_prefix)
-                        sizeof(struct LO_eckd_data) +
+                        datasize = sizeof(struct PFX_eckd_data) +
-                        sizeof(struct eckd_count);
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count);
                break;
        default:
                dev_warn(&startdev->cdev->dev,
@@ -2147,14 +2166,25 @@ dasd_eckd_build_format(struct dasd_device *base,
        switch (intensity & ~0x08) {
        case 0x00: /* Normal format. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
+                if (use_prefix) {
-                       fdata->start_unit, fdata->stop_unit,
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
-                       DASD_ECKD_CCW_WRITE_CKD, base, startdev);
+                               fdata->start_unit, fdata->stop_unit,
-                /* grant subsystem permission to format R0 */
+                               DASD_ECKD_CCW_WRITE_CKD, base, startdev);
-                if (r0_perm)
+                        /* grant subsystem permission to format R0 */
-                        ((struct PFX_eckd_data *)data)
+                        if (r0_perm)
-                                ->define_extent.ga_extended |= 0x04;
+                                ((struct PFX_eckd_data *)data)
-                data += sizeof(struct PFX_eckd_data);
+                                        ->define_extent.ga_extended |= 0x04;
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                                      fdata->start_unit, fdata->stop_unit,
+                                      DASD_ECKD_CCW_WRITE_CKD, startdev);
+                        /* grant subsystem permission to format R0 */
+                        if (r0_perm)
+                                ((struct DE_eckd_data *) data)
+                                        ->ga_extended |= 0x04;
+                        data += sizeof(struct DE_eckd_data);
+                }
                ccw[-1].flags |= CCW_FLAG_CC;
                locate_record(ccw++, (struct LO_eckd_data *) data,
                              fdata->start_unit, 0, rpt*nr_tracks,
@@ -2163,11 +2193,18 @@ dasd_eckd_build_format(struct dasd_device *base,
                data += sizeof(struct LO_eckd_data);
                break;
        case 0x01: /* Write record zero + format track. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
+                if (use_prefix) {
-                       fdata->start_unit, fdata->stop_unit,
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
-                       DASD_ECKD_CCW_WRITE_RECORD_ZERO,
+                               fdata->start_unit, fdata->stop_unit,
-                       base, startdev);
+                               DASD_ECKD_CCW_WRITE_RECORD_ZERO,
-                data += sizeof(struct PFX_eckd_data);
+                               base, startdev);
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_RECORD_ZERO, startdev);
+                        data += sizeof(struct DE_eckd_data);
+                }
                ccw[-1].flags |= CCW_FLAG_CC;
                locate_record(ccw++, (struct LO_eckd_data *) data,
                              fdata->start_unit, 0, rpt * nr_tracks + 1,
@@ -2176,10 +2213,17 @@ dasd_eckd_build_format(struct dasd_device *base,
                data += sizeof(struct LO_eckd_data);
                break;
        case 0x04: /* Invalidate track. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
+                if (use_prefix) {
-                       fdata->start_unit, fdata->stop_unit,
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
-                       DASD_ECKD_CCW_WRITE_CKD, base, startdev);
+                               fdata->start_unit, fdata->stop_unit,
-                data += sizeof(struct PFX_eckd_data);
+                               DASD_ECKD_CCW_WRITE_CKD, base, startdev);
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_CKD, startdev);
+                        data += sizeof(struct DE_eckd_data);
+                }
                ccw[-1].flags |= CCW_FLAG_CC;
                locate_record(ccw++, (struct LO_eckd_data *) data,
                              fdata->start_unit, 0, 1,
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index a3aa374799dc..1fe264379e0d 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -486,7 +486,7 @@ sclp_sync_wait(void)
        timeout = 0;
        if (timer_pending(&sclp_request_timer)) {
                /* Get timeout TOD value */
-                timeout = get_tod_clock() +
+                timeout = get_tod_clock_fast() +
                          sclp_tod_from_jiffies(sclp_request_timer.expires -
                                                jiffies);
        }
@@ -508,7 +508,7 @@ sclp_sync_wait(void)
        while (sclp_running_state != sclp_running_state_idle) {
                /* Check for expired request timer */
                if (timer_pending(&sclp_request_timer) &&
-                    get_tod_clock() > timeout &&
+                    get_tod_clock_fast() > timeout &&
                    del_timer(&sclp_request_timer))
                        sclp_request_timer.function(sclp_request_timer.data);
                cpu_relax();
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index 9b3a24e8d3a0..cf31d3321dab 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -313,7 +313,7 @@ static int vmlogrdr_open (struct inode *inode, struct file *filp)
        int ret;
        dev_num = iminor(inode);
-        if (dev_num > MAXMINOR)
+        if (dev_num >= MAXMINOR)
                return -ENODEV;
        logptr = &sys_ser[dev_num];
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index d7da67a31c77..88e35d85d205 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -878,9 +878,9 @@ static void css_reset(void)
                        atomic_inc(&chpid_reset_count);
        }
        /* Wait for machine check for all channel paths. */
-        timeout = get_tod_clock() + (RCHP_TIMEOUT << 12);
+        timeout = get_tod_clock_fast() + (RCHP_TIMEOUT << 12);
        while (atomic_read(&chpid_reset_count) != 0) {
-                if (get_tod_clock() > timeout)
+                if (get_tod_clock_fast() > timeout)
                        break;
                cpu_relax();
        }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 8ed52aa49122..bbd3e511c771 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -338,10 +338,10 @@ again:
                retries++;
                if (!start_time) {
-                        start_time = get_tod_clock();
+                        start_time = get_tod_clock_fast();
                        goto again;
                }
-                if ((get_tod_clock() - start_time) < QDIO_BUSY_BIT_PATIENCE)
+                if (get_tod_clock_fast() - start_time < QDIO_BUSY_BIT_PATIENCE)
                        goto again;
        }
        if (retries) {
@@ -504,7 +504,7 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
        int count, stop;
        unsigned char state = 0;
-        q->timestamp = get_tod_clock();
+        q->timestamp = get_tod_clock_fast();
        /*
         * Don't check 128 buffers, as otherwise qdio_inbound_q_moved
@@ -595,7 +595,7 @@ static inline int qdio_inbound_q_done(struct qdio_q *q)
         * At this point we know, that inbound first_to_check
         * has (probably) not moved (see qdio_inbound_processing).
         */
-        if (get_tod_clock() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
+        if (get_tod_clock_fast() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
                DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "in done:%02x",
                              q->first_to_check);
                return 1;
@@ -728,7 +728,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
        int count, stop;
        unsigned char state = 0;
-        q->timestamp = get_tod_clock();
+        q->timestamp = get_tod_clock_fast();
        if (need_siga_sync(q))
                if (((queue_type(q) != QDIO_IQDIO_QFMT) &&
diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index feab3a5e50b5..757eb0716d45 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -696,7 +696,7 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
        while ((pci_device = pci_get_device(PCI_VENDOR_ID_BUSLOGIC,
                                        PCI_DEVICE_ID_BUSLOGIC_MULTIMASTER,
                                        pci_device)) != NULL) {
-                struct blogic_adapter *adapter = adapter;
+                struct blogic_adapter *host_adapter = adapter;
                struct blogic_adapter_info adapter_info;
                enum blogic_isa_ioport mod_ioaddr_req;
                unsigned char bus;
@@ -744,9 +744,9 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
                   known and enabled, note that the particular Standard ISA I/O
                   Address should not be probed.
                 */
-                adapter->io_addr = io_addr;
+                host_adapter->io_addr = io_addr;
-                blogic_intreset(adapter);
+                blogic_intreset(host_adapter);
-                if (blogic_cmd(adapter, BLOGIC_INQ_PCI_INFO, NULL, 0,
+                if (blogic_cmd(host_adapter, BLOGIC_INQ_PCI_INFO, NULL, 0,
                                &adapter_info, sizeof(adapter_info)) ==
                                sizeof(adapter_info)) {
                        if (adapter_info.isa_port < 6)
@@ -762,7 +762,7 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
                   I/O Address assigned at system initialization.
                 */
                mod_ioaddr_req = BLOGIC_IO_DISABLE;
-                blogic_cmd(adapter, BLOGIC_MOD_IOADDR, &mod_ioaddr_req,
+                blogic_cmd(host_adapter, BLOGIC_MOD_IOADDR, &mod_ioaddr_req,
                                sizeof(mod_ioaddr_req), NULL, 0);
                /*
                   For the first MultiMaster Host Adapter enumerated,
@@ -779,12 +779,12 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
                        fetch_localram.offset = BLOGIC_AUTOSCSI_BASE + 45;
                        fetch_localram.count = sizeof(autoscsi_byte45);
-                        blogic_cmd(adapter, BLOGIC_FETCH_LOCALRAM,
+                        blogic_cmd(host_adapter, BLOGIC_FETCH_LOCALRAM,
                                        &fetch_localram, sizeof(fetch_localram),
                                        &autoscsi_byte45,
                                        sizeof(autoscsi_byte45));
-                        blogic_cmd(adapter, BLOGIC_GET_BOARD_ID, NULL, 0, &id,
+                        blogic_cmd(host_adapter, BLOGIC_GET_BOARD_ID, NULL, 0,
-                                        sizeof(id));
+                                        &id, sizeof(id));
                        if (id.fw_ver_digit1 == '5')
                                force_scan_order =
                                        autoscsi_byte45.force_scan_order;
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 408a42ef787a..f0d432c139d0 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -771,6 +771,8 @@ static long aac_compat_do_ioctl(struct aac_dev *dev, unsigned cmd, unsigned long
 static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
 {
        struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
+        if (!capable(CAP_SYS_RAWIO))
+                return -EPERM;
        return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg);
 }
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 2ef497ebadc0..ee5c1833eb73 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -20,7 +20,7 @@
 * | Device Discovery             |       0x2095       | 0x2020-0x2022, |
 * |                              |                    | 0x2011-0x2012, |
 * |                              |                    | 0x2016         |
- * | Queue Command and IO tracing |       0x3058       | 0x3006-0x300b  |
+ * | Queue Command and IO tracing |       0x3059       | 0x3006-0x300b  |
 * |                              |                    | 0x3027-0x3028  |
 * |                              |                    | 0x303d-0x3041  |
 * |                              |                    | 0x302d,0x3033  |
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index df1b30ba938c..ff9c86b1a0d8 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1957,6 +1957,15 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
        que = MSW(sts->handle);
        req = ha->req_q_map[que];
+        /* Check for invalid queue pointer */
+        if (req == NULL ||
+            que >= find_first_zero_bit(ha->req_qid_map, ha->max_req_queues)) {
+                ql_dbg(ql_dbg_io, vha, 0x3059,
+                    "Invalid status handle (0x%x): Bad req pointer. req=%p, "
+                    "que=%u.\n", sts->handle, req, que);
+                return;
+        }
        /* Validate handle. */
        if (handle < req->num_outstanding_cmds)
                sp = req->outstanding_cmds[handle];
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e62d17d41d4e..5693f6d7eddb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2854,6 +2854,7 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
                gd->events |= DISK_EVENT_MEDIA_CHANGE;
        }
+        blk_pm_runtime_init(sdp->request_queue, dev);
        add_disk(gd);
        if (sdkp->capacity)
                sd_dif_config_host(sdkp);
@@ -2862,7 +2863,6 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
        sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
                  sdp->removable ? "removable " : "");
-        blk_pm_runtime_init(sdp->request_queue, dev);
        scsi_autopm_put_device(sdp);
        put_device(&sdkp->dev);
 }
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 5cbc4bb1b395..df5e961484e1 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -105,8 +105,11 @@ static int scatter_elem_sz_prev = SG_SCATTER_SZ;
 static int sg_add(struct device *, struct class_interface *);
 static void sg_remove(struct device *, struct class_interface *);
+static DEFINE_SPINLOCK(sg_open_exclusive_lock);
 static DEFINE_IDR(sg_index_idr);
-static DEFINE_RWLOCK(sg_index_lock);
+static DEFINE_RWLOCK(sg_index_lock);    /* Also used to lock
+                                                           file descriptor list for device */
 static struct class_interface sg_interface = {
        .add_dev        = sg_add,
@@ -143,7 +146,8 @@ typedef struct sg_request {	/* SG_MAX_QUEUE requests outstanding per file */
 } Sg_request;
 typedef struct sg_fd {          /* holds the state of a file descriptor */
-        struct list_head sfd_siblings; /* protected by sfd_lock of device */
+        /* sfd_siblings is protected by sg_index_lock */
+        struct list_head sfd_siblings;
        struct sg_device *parentdp;     /* owning device */
        wait_queue_head_t read_wait;    /* queue read until command done */
        rwlock_t rq_list_lock;  /* protect access to list in req_arr */
@@ -166,12 +170,13 @@ typedef struct sg_fd {		/* holds the state of a file descriptor */
 typedef struct sg_device { /* holds the state of each scsi generic device */
        struct scsi_device *device;
+        wait_queue_head_t o_excl_wait;  /* queue open() when O_EXCL in use */
        int sg_tablesize;       /* adapter's max scatter-gather table size */
        u32 index;              /* device index number */
-        spinlock_t sfd_lock;    /* protect file descriptor list for device */
+        /* sfds is protected by sg_index_lock */
        struct list_head sfds;
-        struct rw_semaphore o_sem;      /* exclude open should hold this rwsem */
        volatile char detached; /* 0->attached, 1->detached pending removal */
+        /* exclude protected by sg_open_exclusive_lock */
        char exclude;           /* opened for exclusive access */
        char sgdebug;           /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
        struct gendisk *disk;
@@ -220,14 +225,35 @@ static int sg_allow_access(struct file *filp, unsigned char *cmd)
        return blk_verify_command(cmd, filp->f_mode & FMODE_WRITE);
 }
+static int get_exclude(Sg_device *sdp)
+{
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&sg_open_exclusive_lock, flags);
+        ret = sdp->exclude;
+        spin_unlock_irqrestore(&sg_open_exclusive_lock, flags);
+        return ret;
+}
+static int set_exclude(Sg_device *sdp, char val)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&sg_open_exclusive_lock, flags);
+        sdp->exclude = val;
+        spin_unlock_irqrestore(&sg_open_exclusive_lock, flags);
+        return val;
+}
 static int sfds_list_empty(Sg_device *sdp)
 {
        unsigned long flags;
        int ret;
-        spin_lock_irqsave(&sdp->sfd_lock, flags);
+        read_lock_irqsave(&sg_index_lock, flags);
        ret = list_empty(&sdp->sfds);
-        spin_unlock_irqrestore(&sdp->sfd_lock, flags);
+        read_unlock_irqrestore(&sg_index_lock, flags);
        return ret;
 }
@@ -239,6 +265,7 @@ sg_open(struct inode *inode, struct file *filp)
        struct request_queue *q;
        Sg_device *sdp;
        Sg_fd *sfp;
+        int res;
        int retval;
        nonseekable_open(inode, filp);
@@ -267,52 +294,54 @@ sg_open(struct inode *inode, struct file *filp)
                goto error_out;
        }
-        if ((flags & O_EXCL) && (O_RDONLY == (flags & O_ACCMODE))) {
+        if (flags & O_EXCL) {
-                retval = -EPERM; /* Can't lock it with read only access */
+                if (O_RDONLY == (flags & O_ACCMODE)) {
-                goto error_out;
+                        retval = -EPERM; /* Can't lock it with read only access */
-        }
+                        goto error_out;
-        if (flags & O_NONBLOCK) {
+                }
-                if (flags & O_EXCL) {
+                if (!sfds_list_empty(sdp) && (flags & O_NONBLOCK)) {
-                        if (!down_write_trylock(&sdp->o_sem)) {
+                        retval = -EBUSY;
-                                retval = -EBUSY;
+                        goto error_out;
-                                goto error_out;
+                }
-                        }
+                res = wait_event_interruptible(sdp->o_excl_wait,
-                } else {
+                                           ((!sfds_list_empty(sdp) || get_exclude(sdp)) ? 0 : set_exclude(sdp, 1)));
-                        if (!down_read_trylock(&sdp->o_sem)) {
+                if (res) {
-                                retval = -EBUSY;
+                        retval = res;   /* -ERESTARTSYS because signal hit process */
-                                goto error_out;
+                        goto error_out;
-                        }
+                }
+        } else if (get_exclude(sdp)) {  /* some other fd has an exclusive lock on dev */
+                if (flags & O_NONBLOCK) {
+                        retval = -EBUSY;
+                        goto error_out;
+                }
+                res = wait_event_interruptible(sdp->o_excl_wait, !get_exclude(sdp));
+                if (res) {
+                        retval = res;   /* -ERESTARTSYS because signal hit process */
+                        goto error_out;
                }
-        } else {
-                if (flags & O_EXCL)
-                        down_write(&sdp->o_sem);
-                else
-                        down_read(&sdp->o_sem);
        }
-        /* Since write lock is held, no need to check sfd_list */
+        if (sdp->detached) {
-        if (flags & O_EXCL)
+                retval = -ENODEV;
-                sdp->exclude = 1;       /* used by release lock */
+                goto error_out;
+        }
        if (sfds_list_empty(sdp)) {     /* no existing opens on this device */
                sdp->sgdebug = 0;
                q = sdp->device->request_queue;
                sdp->sg_tablesize = queue_max_segments(q);
        }
-        sfp = sg_add_sfp(sdp, dev);
+        if ((sfp = sg_add_sfp(sdp, dev)))
-        if (!IS_ERR(sfp))
                filp->private_data = sfp;
-                /* retval is already provably zero at this point because of the
-                 * check after retval = scsi_autopm_get_device(sdp->device))
-                 */
        else {
-                retval = PTR_ERR(sfp);
                if (flags & O_EXCL) {
-                        sdp->exclude = 0;       /* undo if error */
+                        set_exclude(sdp, 0);    /* undo if error */
-                        up_write(&sdp->o_sem);
+                        wake_up_interruptible(&sdp->o_excl_wait);
-                } else
+                }
-                        up_read(&sdp->o_sem);
+                retval = -ENOMEM;
+                goto error_out;
+        }
+        retval = 0;
 error_out:
+        if (retval) {
                scsi_autopm_put_device(sdp->device);
 sdp_put:
                scsi_device_put(sdp->device);
@@ -329,18 +358,13 @@ sg_release(struct inode *inode, struct file *filp)
 {
        Sg_device *sdp;
        Sg_fd *sfp;
-        int excl;
        if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
                return -ENXIO;
        SCSI_LOG_TIMEOUT(3, printk("sg_release: %s\n", sdp->disk->disk_name));
-        excl = sdp->exclude;
+        set_exclude(sdp, 0);
-        sdp->exclude = 0;
+        wake_up_interruptible(&sdp->o_excl_wait);
-        if (excl)
-                up_write(&sdp->o_sem);
-        else
-                up_read(&sdp->o_sem);
        scsi_autopm_put_device(sdp->device);
        kref_put(&sfp->f_ref, sg_remove_sfp);
@@ -1391,9 +1415,8 @@ static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
        disk->first_minor = k;
        sdp->disk = disk;
        sdp->device = scsidp;
-        spin_lock_init(&sdp->sfd_lock);
        INIT_LIST_HEAD(&sdp->sfds);
-        init_rwsem(&sdp->o_sem);
+        init_waitqueue_head(&sdp->o_excl_wait);
        sdp->sg_tablesize = queue_max_segments(q);
        sdp->index = k;
        kref_init(&sdp->d_ref);
@@ -1526,13 +1549,11 @@ static void sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
        /* Need a write lock to set sdp->detached. */
        write_lock_irqsave(&sg_index_lock, iflags);
-        spin_lock(&sdp->sfd_lock);
        sdp->detached = 1;
        list_for_each_entry(sfp, &sdp->sfds, sfd_siblings) {
                wake_up_interruptible(&sfp->read_wait);
                kill_fasync(&sfp->async_qp, SIGPOLL, POLL_HUP);
        }
-        spin_unlock(&sdp->sfd_lock);
        write_unlock_irqrestore(&sg_index_lock, iflags);
        sysfs_remove_link(&scsidp->sdev_gendev.kobj, "generic");
@@ -2043,7 +2064,7 @@ sg_add_sfp(Sg_device * sdp, int dev)
        sfp = kzalloc(sizeof(*sfp), GFP_ATOMIC | __GFP_NOWARN);
        if (!sfp)
-                return ERR_PTR(-ENOMEM);
+                return NULL;
        init_waitqueue_head(&sfp->read_wait);
        rwlock_init(&sfp->rq_list_lock);
@@ -2057,13 +2078,9 @@ sg_add_sfp(Sg_device * sdp, int dev)
        sfp->cmd_q = SG_DEF_COMMAND_Q;
        sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
        sfp->parentdp = sdp;
-        spin_lock_irqsave(&sdp->sfd_lock, iflags);
+        write_lock_irqsave(&sg_index_lock, iflags);
-        if (sdp->detached) {
-                spin_unlock_irqrestore(&sdp->sfd_lock, iflags);
-                return ERR_PTR(-ENODEV);
-        }
        list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
-        spin_unlock_irqrestore(&sdp->sfd_lock, iflags);
+        write_unlock_irqrestore(&sg_index_lock, iflags);
        SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p\n", sfp));
        if (unlikely(sg_big_buff != def_reserved_size))
                sg_big_buff = def_reserved_size;
@@ -2113,9 +2130,10 @@ static void sg_remove_sfp(struct kref *kref)
        struct sg_device *sdp = sfp->parentdp;
        unsigned long iflags;
-        spin_lock_irqsave(&sdp->sfd_lock, iflags);
+        write_lock_irqsave(&sg_index_lock, iflags);
        list_del(&sfp->sfd_siblings);
-        spin_unlock_irqrestore(&sdp->sfd_lock, iflags);
+        write_unlock_irqrestore(&sg_index_lock, iflags);
+        wake_up_interruptible(&sdp->o_excl_wait);
        INIT_WORK(&sfp->ew.work, sg_remove_sfp_usercontext);
        schedule_work(&sfp->ew.work);
@@ -2502,7 +2520,7 @@ static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v)
        return 0;
 }
-/* must be called while holding sg_index_lock and sfd_lock */
+/* must be called while holding sg_index_lock */
 static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
 {
        int k, m, new_interface, blen, usg;
@@ -2587,26 +2605,22 @@ static int sg_proc_seq_show_debug(struct seq_file *s, void *v)
        read_lock_irqsave(&sg_index_lock, iflags);
        sdp = it ? sg_lookup_dev(it->index) : NULL;
-        if (sdp) {
+        if (sdp && !list_empty(&sdp->sfds)) {
-                spin_lock(&sdp->sfd_lock);
+                struct scsi_device *scsidp = sdp->device;
-                if (!list_empty(&sdp->sfds)) {
-                        struct scsi_device *scsidp = sdp->device;
-                        seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
+                seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
-                        if (sdp->detached)
+                if (sdp->detached)
-                                seq_printf(s, "detached pending close ");
+                        seq_printf(s, "detached pending close ");
-                        else
+                else
-                                seq_printf
+                        seq_printf
-                                    (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
+                            (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
-                                     scsidp->host->host_no,
+                             scsidp->host->host_no,
-                                     scsidp->channel, scsidp->id,
+                             scsidp->channel, scsidp->id,
-                                     scsidp->lun,
+                             scsidp->lun,
-                                     scsidp->host->hostt->emulated);
+                             scsidp->host->hostt->emulated);
-                        seq_printf(s, " sg_tablesize=%d excl=%d\n",
+                seq_printf(s, " sg_tablesize=%d excl=%d\n",
-                                   sdp->sg_tablesize, sdp->exclude);
+                           sdp->sg_tablesize, get_exclude(sdp));
-                        sg_proc_debug_helper(s, sdp);
+                sg_proc_debug_helper(s, sdp);
-                }
-                spin_unlock(&sdp->sfd_lock);
        }
        read_unlock_irqrestore(&sg_index_lock, iflags);
        return 0;
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c
index f91bc1fdd895..639ba96adb36 100644
--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -1960,6 +1960,7 @@ cntrlEnd:
                BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, OSAL_DBG, DBG_LVL_ALL, "Called IOCTL_BCM_GET_DEVICE_DRIVER_INFO\n");
+                memset(&DevInfo, 0, sizeof(DevInfo));
                DevInfo.MaxRDMBufferSize = BUFFER_4K;
                DevInfo.u32DSDStartOffset = EEPROM_CALPARAM_START;
                DevInfo.u32RxAlignmentCorrection = 0;
diff --git a/drivers/staging/media/msi3101/Kconfig b/drivers/staging/media/msi3101/Kconfig
index b94a95a597d6..76d5bbd4d93c 100644
--- a/drivers/staging/media/msi3101/Kconfig
+++ b/drivers/staging/media/msi3101/Kconfig
@@ -1,3 +1,4 @@
 config USB_MSI3101
        tristate "Mirics MSi3101 SDR Dongle"
        depends on USB && VIDEO_DEV && VIDEO_V4L2
+        select VIDEOBUF2_VMALLOC
diff --git a/drivers/staging/media/msi3101/sdr-msi3101.c b/drivers/staging/media/msi3101/sdr-msi3101.c
index 24c7b70a6cbf..4c3bf776bb20 100644
--- a/drivers/staging/media/msi3101/sdr-msi3101.c
+++ b/drivers/staging/media/msi3101/sdr-msi3101.c
@@ -1131,7 +1131,13 @@ static int msi3101_queue_setup(struct vb2_queue *vq,
        /* Absolute min and max number of buffers available for mmap() */
        *nbuffers = 32;
        *nplanes = 1;
-        sizes[0] = PAGE_ALIGN(3 * 3072); /* 3 * 768 * 4 */
+        /*
+         *   3, wMaxPacketSize 3x 1024 bytes
+         * 504, max IQ sample pairs per 1024 frame
+         *   2, two samples, I and Q
+         *   4, 32-bit float
+         */
+        sizes[0] = PAGE_ALIGN(3 * 504 * 2 * 4); /* = 12096 */
        dev_dbg(&s->udev->dev, "%s: nbuffers=%d sizes[0]=%d\n",
                        __func__, *nbuffers, sizes[0]);
        return 0;
@@ -1657,7 +1663,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
                        f->frequency * 625UL / 10UL);
 }
-const struct v4l2_ioctl_ops msi3101_ioctl_ops = {
+static const struct v4l2_ioctl_ops msi3101_ioctl_ops = {
        .vidioc_querycap          = msi3101_querycap,
        .vidioc_enum_input        = msi3101_enum_input,
diff --git a/drivers/staging/ozwpan/ozcdev.c b/drivers/staging/ozwpan/ozcdev.c
index 6ccb64fb0786..6ce0af9977d8 100644
--- a/drivers/staging/ozwpan/ozcdev.c
+++ b/drivers/staging/ozwpan/ozcdev.c
@@ -155,6 +155,9 @@ static ssize_t oz_cdev_write(struct file *filp, const char __user *buf,
        struct oz_app_hdr *app_hdr;
        struct oz_serial_ctx *ctx;
+        if (count > sizeof(ei->data) - sizeof(*elt) - sizeof(*app_hdr))
+                return -EINVAL;
        spin_lock_bh(&g_cdev.lock);
        pd = g_cdev.active_pd;
        if (pd)
diff --git a/drivers/staging/sb105x/sb_pci_mp.c b/drivers/staging/sb105x/sb_pci_mp.c
index 23db32f07fd5..a10cdb17038b 100644
--- a/drivers/staging/sb105x/sb_pci_mp.c
+++ b/drivers/staging/sb105x/sb_pci_mp.c
@@ -1063,7 +1063,7 @@ static int mp_wait_modem_status(struct sb_uart_state *state, unsigned long arg)
 static int mp_get_count(struct sb_uart_state *state, struct serial_icounter_struct *icnt)
 {
-        struct serial_icounter_struct icount;
+        struct serial_icounter_struct icount = {};
        struct sb_uart_icount cnow;
        struct sb_uart_port *port = state->port;
diff --git a/drivers/staging/wlags49_h2/wl_priv.c b/drivers/staging/wlags49_h2/wl_priv.c
index c97e0e154d28..7e10dcdc3090 100644
--- a/drivers/staging/wlags49_h2/wl_priv.c
+++ b/drivers/staging/wlags49_h2/wl_priv.c
@@ -570,6 +570,7 @@ int wvlan_uil_put_info(struct uilreq *urq, struct wl_private *lp)
        ltv_t                   *pLtv;
        bool_t                  ltvAllocated = FALSE;
        ENCSTRCT                sEncryption;
+        size_t                  len;
 #ifdef USE_WDS
        hcf_16                  hcfPort  = HCF_PORT_0;
@@ -686,7 +687,8 @@ int wvlan_uil_put_info(struct uilreq *urq, struct wl_private *lp)
                                        break;
                                case CFG_CNF_OWN_NAME:
                                        memset(lp->StationName, 0, sizeof(lp->StationName));
-                                        memcpy((void *)lp->StationName, (void *)&pLtv->u.u8[2], (size_t)pLtv->u.u16[0]);
+                                        len = min_t(size_t, pLtv->u.u16[0], sizeof(lp->StationName));
+                                        strlcpy(lp->StationName, &pLtv->u.u8[2], len);
                                        pLtv->u.u16[0] = CNV_INT_TO_LITTLE(pLtv->u.u16[0]);
                                        break;
                                case CFG_CNF_LOAD_BALANCING:
@@ -1783,6 +1785,7 @@ int wvlan_set_station_nickname(struct net_device *dev,
 {
        struct wl_private *lp = wl_priv(dev);
        unsigned long flags;
+        size_t len;
        int         ret = 0;
        /*------------------------------------------------------------------------*/
@@ -1793,8 +1796,8 @@ int wvlan_set_station_nickname(struct net_device *dev,
        wl_lock(lp, &flags);
        memset(lp->StationName, 0, sizeof(lp->StationName));
+        len = min_t(size_t, wrqu->data.length, sizeof(lp->StationName));
-        memcpy(lp->StationName, extra, wrqu->data.length);
+        strlcpy(lp->StationName, extra, len);
        /* Commit the adapter parameters */
        wl_apply(lp);
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 551c96ca60ac..0f199f6a0738 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -134,10 +134,10 @@ static int pscsi_pmode_enable_hba(struct se_hba *hba, unsigned long mode_flag)
         * pSCSI Host ID and enable for phba mode
         */
        sh = scsi_host_lookup(phv->phv_host_id);
-        if (IS_ERR(sh)) {
+        if (!sh) {
                pr_err("pSCSI: Unable to locate SCSI Host for"
                        " phv_host_id: %d\n", phv->phv_host_id);
-                return PTR_ERR(sh);
+                return -EINVAL;
        }
        phv->phv_lld_host = sh;
@@ -515,10 +515,10 @@ static int pscsi_configure_device(struct se_device *dev)
                        sh = phv->phv_lld_host;
                } else {
                        sh = scsi_host_lookup(pdv->pdv_host_id);
-                        if (IS_ERR(sh)) {
+                        if (!sh) {
                                pr_err("pSCSI: Unable to locate"
                                        " pdv_host_id: %d\n", pdv->pdv_host_id);
-                                return PTR_ERR(sh);
+                                return -EINVAL;
                        }
                }
        } else {
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 4714c6f8da4b..d9b92b2c524d 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -263,6 +263,11 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
                        sectors, cmd->se_dev->dev_attrib.max_write_same_len);
                return TCM_INVALID_CDB_FIELD;
        }
+        /* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
+        if (flags[0] & 0x10) {
+                pr_warn("WRITE SAME with ANCHOR not supported\n");
+                return TCM_INVALID_CDB_FIELD;
+        }
        /*
         * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
         * translated into block discard requests within backend code.
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 3da4fd10b9f8..474cd44fac14 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -82,6 +82,9 @@ static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op
        mutex_lock(&g_device_mutex);
        list_for_each_entry(se_dev, &g_device_list, g_dev_node) {
+                if (!se_dev->dev_attrib.emulate_3pc)
+                        continue;
                memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
                target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
@@ -357,6 +360,7 @@ struct xcopy_pt_cmd {
        struct se_cmd se_cmd;
        struct xcopy_op *xcopy_op;
        struct completion xpt_passthrough_sem;
+        unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
 };
 static struct se_port xcopy_pt_port;
@@ -675,7 +679,8 @@ static int target_xcopy_issue_pt_cmd(struct xcopy_pt_cmd *xpt_cmd)
        pr_debug("target_xcopy_issue_pt_cmd(): SCSI status: 0x%02x\n",
                        se_cmd->scsi_status);
-        return 0;
+        return (se_cmd->scsi_status) ? -EINVAL : 0;
 }
 static int target_xcopy_read_source(
@@ -708,7 +713,7 @@ static int target_xcopy_read_source(
                (unsigned long long)src_lba, src_sectors, length);
        transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
-                                DMA_FROM_DEVICE, 0, NULL);
+                              DMA_FROM_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
        xop->src_pt_cmd = xpt_cmd;
        rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0],
@@ -768,7 +773,7 @@ static int target_xcopy_write_destination(
                (unsigned long long)dst_lba, dst_sectors, length);
        transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
-                                DMA_TO_DEVICE, 0, NULL);
+                              DMA_TO_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
        xop->dst_pt_cmd = xpt_cmd;
        rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, dst_dev, &cdb[0],
@@ -884,30 +889,42 @@ out:
 sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
 {
+        struct se_device *dev = se_cmd->se_dev;
        struct xcopy_op *xop = NULL;
        unsigned char *p = NULL, *seg_desc;
        unsigned int list_id, list_id_usage, sdll, inline_dl, sa;
+        sense_reason_t ret = TCM_INVALID_PARAMETER_LIST;
        int rc;
        unsigned short tdll;
+        if (!dev->dev_attrib.emulate_3pc) {
+                pr_err("EXTENDED_COPY operation explicitly disabled\n");
+                return TCM_UNSUPPORTED_SCSI_OPCODE;
+        }
        sa = se_cmd->t_task_cdb[1] & 0x1f;
        if (sa != 0x00) {
                pr_err("EXTENDED_COPY(LID4) not supported\n");
                return TCM_UNSUPPORTED_SCSI_OPCODE;
        }
+        xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
+        if (!xop) {
+                pr_err("Unable to allocate xcopy_op\n");
+                return TCM_OUT_OF_RESOURCES;
+        }
+        xop->xop_se_cmd = se_cmd;
        p = transport_kmap_data_sg(se_cmd);
        if (!p) {
                pr_err("transport_kmap_data_sg() failed in target_do_xcopy\n");
+                kfree(xop);
                return TCM_OUT_OF_RESOURCES;
        }
        list_id = p[0];
-        if (list_id != 0x00) {
+        list_id_usage = (p[1] & 0x18) >> 3;
-                pr_err("XCOPY with non zero list_id: 0x%02x\n", list_id);
-                goto out;
-        }
-        list_id_usage = (p[1] & 0x18);
        /*
         * Determine TARGET DESCRIPTOR LIST LENGTH + SEGMENT DESCRIPTOR LIST LENGTH
         */
@@ -920,13 +937,6 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
                goto out;
        }
-        xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
-        if (!xop) {
-                pr_err("Unable to allocate xcopy_op\n");
-                goto out;
-        }
-        xop->xop_se_cmd = se_cmd;
        pr_debug("Processing XCOPY with list_id: 0x%02x list_id_usage: 0x%02x"
                " tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
                tdll, sdll, inline_dl);
@@ -935,6 +945,17 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
        if (rc <= 0)
                goto out;
+        if (xop->src_dev->dev_attrib.block_size !=
+            xop->dst_dev->dev_attrib.block_size) {
+                pr_err("XCOPY: Non matching src_dev block_size: %u + dst_dev"
+                       " block_size: %u currently unsupported\n",
+                        xop->src_dev->dev_attrib.block_size,
+                        xop->dst_dev->dev_attrib.block_size);
+                xcopy_pt_undepend_remotedev(xop);
+                ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                goto out;
+        }
        pr_debug("XCOPY: Processed %d target descriptors, length: %u\n", rc,
                                rc * XCOPY_TARGET_DESC_LEN);
        seg_desc = &p[16];
@@ -957,7 +978,7 @@ out:
        if (p)
                transport_kunmap_data_sg(se_cmd);
        kfree(xop);
-        return TCM_INVALID_CDB_FIELD;
+        return ret;
 }
 static sense_reason_t target_rcr_operating_parameters(struct se_cmd *se_cmd)
diff --git a/drivers/thermal/samsung/exynos_thermal_common.c b/drivers/thermal/samsung/exynos_thermal_common.c
index f10a6ad37c06..c2301da08ac7 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.c
+++ b/drivers/thermal/samsung/exynos_thermal_common.c
@@ -310,8 +310,6 @@ void exynos_report_trigger(struct thermal_sensor_conf *conf)
        }
        th_zone = conf->pzone_data;
-        if (th_zone->therm_dev)
-                return;
        if (th_zone->bind == false) {
                for (i = 0; i < th_zone->cool_dev_size; i++) {
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index b43afda8acd1..32f38b90c4f6 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -317,6 +317,9 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
        con = readl(data->base + reg->tmu_ctrl);
+        if (pdata->test_mux)
+                con |= (pdata->test_mux << reg->test_mux_addr_shift);
        if (pdata->reference_voltage) {
                con &= ~(reg->buf_vref_sel_mask << reg->buf_vref_sel_shift);
                con |= pdata->reference_voltage << reg->buf_vref_sel_shift;
@@ -488,7 +491,7 @@ static const struct of_device_id exynos_tmu_match[] = {
        },
        {
                .compatible = "samsung,exynos4412-tmu",
-                .data = (void *)EXYNOS5250_TMU_DRV_DATA,
+                .data = (void *)EXYNOS4412_TMU_DRV_DATA,
        },
        {
                .compatible = "samsung,exynos5250-tmu",
@@ -629,9 +632,10 @@ static int exynos_tmu_probe(struct platform_device *pdev)
        if (ret)
                return ret;
-        if (pdata->type == SOC_ARCH_EXYNOS ||
+        if (pdata->type == SOC_ARCH_EXYNOS4210 ||
-                pdata->type == SOC_ARCH_EXYNOS4210 ||
+            pdata->type == SOC_ARCH_EXYNOS4412 ||
-                                pdata->type == SOC_ARCH_EXYNOS5440)
+            pdata->type == SOC_ARCH_EXYNOS5250 ||
+            pdata->type == SOC_ARCH_EXYNOS5440)
                data->soc = pdata->type;
        else {
                ret = -EINVAL;
diff --git a/drivers/thermal/samsung/exynos_tmu.h b/drivers/thermal/samsung/exynos_tmu.h
index b364c9eee701..3fb65547e64c 100644
--- a/drivers/thermal/samsung/exynos_tmu.h
+++ b/drivers/thermal/samsung/exynos_tmu.h
@@ -41,7 +41,8 @@ enum calibration_mode {
 enum soc_type {
        SOC_ARCH_EXYNOS4210 = 1,
-        SOC_ARCH_EXYNOS,
+        SOC_ARCH_EXYNOS4412,
+        SOC_ARCH_EXYNOS5250,
        SOC_ARCH_EXYNOS5440,
 };
@@ -84,6 +85,7 @@ enum soc_type {
 * @triminfo_reload_shift: shift of triminfo reload enable bit in triminfo_ctrl
        reg.
 * @tmu_ctrl: TMU main controller register.
+ * @test_mux_addr_shift: shift bits of test mux address.
 * @buf_vref_sel_shift: shift bits of reference voltage in tmu_ctrl register.
 * @buf_vref_sel_mask: mask bits of reference voltage in tmu_ctrl register.
 * @therm_trip_mode_shift: shift bits of tripping mode in tmu_ctrl register.
@@ -150,6 +152,7 @@ struct exynos_tmu_registers {
        u32     triminfo_reload_shift;
        u32     tmu_ctrl;
+        u32     test_mux_addr_shift;
        u32     buf_vref_sel_shift;
        u32     buf_vref_sel_mask;
        u32     therm_trip_mode_shift;
@@ -257,6 +260,7 @@ struct exynos_tmu_registers {
 * @first_point_trim: temp value of the first point trimming
 * @second_point_trim: temp value of the second point trimming
 * @default_temp_offset: default temperature offset in case of no trimming
+ * @test_mux; information if SoC supports test MUX
 * @cal_type: calibration type for temperature
 * @cal_mode: calibration mode for temperature
 * @freq_clip_table: Table representing frequency reduction percentage.
@@ -286,6 +290,7 @@ struct exynos_tmu_platform_data {
        u8 first_point_trim;
        u8 second_point_trim;
        u8 default_temp_offset;
+        u8 test_mux;
        enum calibration_type cal_type;
        enum calibration_mode cal_mode;
diff --git a/drivers/thermal/samsung/exynos_tmu_data.c b/drivers/thermal/samsung/exynos_tmu_data.c
index 9002499c1f69..073c292baa53 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.c
+++ b/drivers/thermal/samsung/exynos_tmu_data.c
@@ -90,14 +90,15 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
 };
 #endif
-#if defined(CONFIG_SOC_EXYNOS5250) || defined(CONFIG_SOC_EXYNOS4412)
+#if defined(CONFIG_SOC_EXYNOS4412) || defined(CONFIG_SOC_EXYNOS5250)
-static const struct exynos_tmu_registers exynos5250_tmu_registers = {
+static const struct exynos_tmu_registers exynos4412_tmu_registers = {
        .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
        .triminfo_ctrl = EXYNOS_TMU_TRIMINFO_CON,
        .triminfo_reload_shift = EXYNOS_TRIMINFO_RELOAD_SHIFT,
        .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
+        .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
        .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
@@ -128,7 +129,7 @@ static const struct exynos_tmu_registers exynos5250_tmu_registers = {
        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
-#define EXYNOS5250_TMU_DATA \
+#define EXYNOS4412_TMU_DATA \
        .threshold_falling = 10, \
        .trigger_levels[0] = 85, \
        .trigger_levels[1] = 103, \
@@ -162,15 +163,32 @@ static const struct exynos_tmu_registers exynos5250_tmu_registers = {
                .temp_level = 103, \
        }, \
        .freq_tab_count = 2, \
-        .type = SOC_ARCH_EXYNOS, \
+        .registers = &exynos4412_tmu_registers, \
-        .registers = &exynos5250_tmu_registers, \
        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
                        TMU_SUPPORT_EMUL_TIME)
+#endif
+#if defined(CONFIG_SOC_EXYNOS4412)
+struct exynos_tmu_init_data const exynos4412_default_tmu_data = {
+        .tmu_data = {
+                {
+                        EXYNOS4412_TMU_DATA,
+                        .type = SOC_ARCH_EXYNOS4412,
+                        .test_mux = EXYNOS4412_MUX_ADDR_VALUE,
+                },
+        },
+        .tmu_count = 1,
+};
+#endif
+#if defined(CONFIG_SOC_EXYNOS5250)
 struct exynos_tmu_init_data const exynos5250_default_tmu_data = {
        .tmu_data = {
-                { EXYNOS5250_TMU_DATA },
+                {
+                        EXYNOS4412_TMU_DATA,
+                        .type = SOC_ARCH_EXYNOS5250,
+                },
        },
        .tmu_count = 1,
 };
diff --git a/drivers/thermal/samsung/exynos_tmu_data.h b/drivers/thermal/samsung/exynos_tmu_data.h
index dc7feb51099b..a1ea19d9e0a6 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.h
+++ b/drivers/thermal/samsung/exynos_tmu_data.h
@@ -95,6 +95,10 @@
 #define EXYNOS_MAX_TRIGGER_PER_REG      4
+/* Exynos4412 specific */
+#define EXYNOS4412_MUX_ADDR_VALUE          6
+#define EXYNOS4412_MUX_ADDR_SHIFT          20
 /*exynos5440 specific registers*/
 #define EXYNOS5440_TMU_S0_7_TRIM                0x000
 #define EXYNOS5440_TMU_S0_7_CTRL                0x020
@@ -138,7 +142,14 @@ extern struct exynos_tmu_init_data const exynos4210_default_tmu_data;
 #define EXYNOS4210_TMU_DRV_DATA (NULL)
 #endif
-#if (defined(CONFIG_SOC_EXYNOS5250) || defined(CONFIG_SOC_EXYNOS4412))
+#if defined(CONFIG_SOC_EXYNOS4412)
+extern struct exynos_tmu_init_data const exynos4412_default_tmu_data;
+#define EXYNOS4412_TMU_DRV_DATA (&exynos4412_default_tmu_data)
+#else
+#define EXYNOS4412_TMU_DRV_DATA (NULL)
+#endif
+#if defined(CONFIG_SOC_EXYNOS5250)
 extern struct exynos_tmu_init_data const exynos5250_default_tmu_data;
 #define EXYNOS5250_TMU_DRV_DATA (&exynos5250_default_tmu_data)
 #else
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index eeef0e2498ca..fdb07199d9c2 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -159,7 +159,7 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
        INIT_LIST_HEAD(&hwmon->tz_list);
        strlcpy(hwmon->type, tz->type, THERMAL_NAME_LENGTH);
-        hwmon->device = hwmon_device_register(&tz->device);
+        hwmon->device = hwmon_device_register(NULL);
        if (IS_ERR(hwmon->device)) {
                result = PTR_ERR(hwmon->device);
                goto free_mem;
diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
index 4f8b9af54a5a..5a47cc8c8f85 100644
--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
@@ -110,6 +110,7 @@ static inline int ti_thermal_get_temp(struct thermal_zone_device *thermal,
                } else {
                        dev_err(bgp->dev,
                                "Failed to read PCB state. Using defaults\n");
+                        ret = 0;
                }
        }
        *temp = ti_thermal_hotspot_temperature(tmp, slope, constant);
diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
index f36950e4134f..7722cb9d5a80 100644
--- a/drivers/thermal/x86_pkg_temp_thermal.c
+++ b/drivers/thermal/x86_pkg_temp_thermal.c
@@ -316,18 +316,19 @@ static void pkg_temp_thermal_threshold_work_fn(struct work_struct *work)
        int phy_id = topology_physical_package_id(cpu);
        struct phy_dev_entry *phdev = pkg_temp_thermal_get_phy_entry(cpu);
        bool notify = false;
+        unsigned long flags;
        if (!phdev)
                return;
-        spin_lock(&pkg_work_lock);
+        spin_lock_irqsave(&pkg_work_lock, flags);
        ++pkg_work_cnt;
        if (unlikely(phy_id > max_phy_id)) {
-                spin_unlock(&pkg_work_lock);
+                spin_unlock_irqrestore(&pkg_work_lock, flags);
                return;
        }
        pkg_work_scheduled[phy_id] = 0;
-        spin_unlock(&pkg_work_lock);
+        spin_unlock_irqrestore(&pkg_work_lock, flags);
        enable_pkg_thres_interrupt();
        rdmsrl(MSR_IA32_PACKAGE_THERM_STATUS, msr_val);
@@ -397,6 +398,7 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
        int thres_count;
        u32 eax, ebx, ecx, edx;
        u8 *temp;
+        unsigned long flags;
        cpuid(6, &eax, &ebx, &ecx, &edx);
        thres_count = ebx & 0x07;
@@ -420,19 +422,19 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
                goto err_ret_unlock;
        }
-        spin_lock(&pkg_work_lock);
+        spin_lock_irqsave(&pkg_work_lock, flags);
        if (topology_physical_package_id(cpu) > max_phy_id)
                max_phy_id = topology_physical_package_id(cpu);
        temp = krealloc(pkg_work_scheduled,
                        (max_phy_id+1) * sizeof(u8), GFP_ATOMIC);
        if (!temp) {
-                spin_unlock(&pkg_work_lock);
+                spin_unlock_irqrestore(&pkg_work_lock, flags);
                err = -ENOMEM;
                goto err_ret_free;
        }
        pkg_work_scheduled = temp;
        pkg_work_scheduled[topology_physical_package_id(cpu)] = 0;
-        spin_unlock(&pkg_work_lock);
+        spin_unlock_irqrestore(&pkg_work_lock, flags);
        phy_dev_entry->phys_proc_id = topology_physical_package_id(cpu);
        phy_dev_entry->first_cpu = cpu;
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index d067285a2d20..6b0f75eac8a2 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1499,7 +1499,7 @@ static void atmel_set_ops(struct uart_port *port)
 /*
 * Get ip name usart or uart
 */
-static int atmel_get_ip_name(struct uart_port *port)
+static void atmel_get_ip_name(struct uart_port *port)
 {
        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
        int name = UART_GET_IP_NAME(port);
@@ -1518,10 +1518,7 @@ static int atmel_get_ip_name(struct uart_port *port)
                atmel_port->is_usart = false;
        } else {
                dev_err(port->dev, "Not supported ip name, set to uart\n");
-                return -EINVAL;
        }
-        return 0;
 }
 /*
@@ -2405,9 +2402,7 @@ static int atmel_serial_probe(struct platform_device *pdev)
        /*
         * Get port name of usart or uart
         */
-        ret = atmel_get_ip_name(&port->uart);
+        atmel_get_ip_name(&port->uart);
-        if (ret < 0)
-                goto err_add_port;
        return 0;
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index e221f13fcb61..67beb8444930 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -648,16 +648,29 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
 {
        struct uio_device *idev = vma->vm_private_data;
        int mi = uio_find_mem_index(vma);
+        struct uio_mem *mem;
        if (mi < 0)
                return -EINVAL;
+        mem = idev->info->mem + mi;
-        vma->vm_ops = &uio_physical_vm_ops;
+        if (vma->vm_end - vma->vm_start > mem->size)
+                return -EINVAL;
+        vma->vm_ops = &uio_physical_vm_ops;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+        /*
+         * We cannot use the vm_iomap_memory() helper here,
+         * because vma->vm_pgoff is the map index we looked
+         * up above in uio_find_mem_index(), rather than an
+         * actual page offset into the mmap.
+         *
+         * So we just do the physical mmap without a page
+         * offset.
+         */
        return remap_pfn_range(vma,
                               vma->vm_start,
-                               idev->info->mem[mi].addr >> PAGE_SHIFT,
+                               mem->addr >> PAGE_SHIFT,
                               vma->vm_end - vma->vm_start,
                               vma->vm_page_prot);
 }
diff --git a/drivers/usb/atm/usbatm.h b/drivers/usb/atm/usbatm.h
index 5651231a7437..f3eecd967a8a 100644
--- a/drivers/usb/atm/usbatm.h
+++ b/drivers/usb/atm/usbatm.h
@@ -34,6 +34,7 @@
 #include <linux/stringify.h>
 #include <linux/usb.h>
 #include <linux/mutex.h>
+#include <linux/ratelimit.h>
 /*
 #define VERBOSE_DEBUG
@@ -59,13 +60,12 @@
        atm_printk(KERN_INFO, instance , format , ## arg)
 #define atm_warn(instance, format, arg...)      \
        atm_printk(KERN_WARNING, instance , format , ## arg)
-#define atm_dbg(instance, format, arg...)               \
+#define atm_dbg(instance, format, ...)                                  \
-        dynamic_pr_debug("ATM dev %d: " format ,        \
+        pr_debug("ATM dev %d: " format,                                 \
-        (instance)->atm_dev->number , ## arg)
+                 (instance)->atm_dev->number, ##__VA_ARGS__)
-#define atm_rldbg(instance, format, arg...)             \
+#define atm_rldbg(instance, format, ...)                                \
-        if (printk_ratelimit())                         \
+        pr_debug_ratelimited("ATM dev %d: " format,                     \
-                atm_dbg(instance , format , ## arg)
+                             (instance)->atm_dev->number, ##__VA_ARGS__)
 /* flags, set by mini-driver in bind() */
diff --git a/drivers/usb/chipidea/bits.h b/drivers/usb/chipidea/bits.h
index 464584c6ccae..a85713165688 100644
--- a/drivers/usb/chipidea/bits.h
+++ b/drivers/usb/chipidea/bits.h
@@ -48,6 +48,7 @@
 #define PORTSC_SUSP           BIT(7)
 #define PORTSC_HSP            BIT(9)
 #define PORTSC_PTC            (0x0FUL << 16)
+#define PORTSC_PHCD(d)        ((d) ? BIT(22) : BIT(23))
 /* PTS and PTW for non lpm version only */
 #define PORTSC_PTS(d)                                           \
        (u32)((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index be822a2c1776..023d3cb6aa0a 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -108,14 +108,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
        }
        data->phy = devm_usb_get_phy_by_phandle(&pdev->dev, "fsl,usbphy", 0);
-        if (!IS_ERR(data->phy)) {
+        if (IS_ERR(data->phy)) {
-                ret = usb_phy_init(data->phy);
+                ret = PTR_ERR(data->phy);
-                if (ret) {
-                        dev_err(&pdev->dev, "unable to init phy: %d\n", ret);
-                        goto err_clk;
-                }
-        } else if (PTR_ERR(data->phy) == -EPROBE_DEFER) {
-                ret = -EPROBE_DEFER;
                goto err_clk;
        }
@@ -131,7 +125,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                if (ret) {
                        dev_err(&pdev->dev, "usbmisc init failed, ret=%d\n",
                                        ret);
-                        goto err_phy;
+                        goto err_clk;
                }
        }
@@ -143,7 +137,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                dev_err(&pdev->dev,
                        "Can't register ci_hdrc platform device, err=%d\n",
                        ret);
-                goto err_phy;
+                goto err_clk;
        }
        if (data->usbmisc_data) {
@@ -164,9 +158,6 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
 disable_device:
        ci_hdrc_remove_device(data->ci_pdev);
-err_phy:
-        if (data->phy)
-                usb_phy_shutdown(data->phy);
 err_clk:
        clk_disable_unprepare(data->clk);
        return ret;
@@ -178,10 +169,6 @@ static int ci_hdrc_imx_remove(struct platform_device *pdev)
        pm_runtime_disable(&pdev->dev);
        ci_hdrc_remove_device(data->ci_pdev);
-        if (data->phy)
-                usb_phy_shutdown(data->phy);
        clk_disable_unprepare(data->clk);
        return 0;
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 23763dcec069..5d8981c5235e 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -172,6 +172,27 @@ u8 hw_port_test_get(struct ci_hdrc *ci)
        return hw_read(ci, OP_PORTSC, PORTSC_PTC) >> __ffs(PORTSC_PTC);
 }
+/* The PHY enters/leaves low power mode */
+static void ci_hdrc_enter_lpm(struct ci_hdrc *ci, bool enable)
+{
+        enum ci_hw_regs reg = ci->hw_bank.lpm ? OP_DEVLC : OP_PORTSC;
+        bool lpm = !!(hw_read(ci, reg, PORTSC_PHCD(ci->hw_bank.lpm)));
+        if (enable && !lpm) {
+                hw_write(ci, reg, PORTSC_PHCD(ci->hw_bank.lpm),
+                                PORTSC_PHCD(ci->hw_bank.lpm));
+        } else  if (!enable && lpm) {
+                hw_write(ci, reg, PORTSC_PHCD(ci->hw_bank.lpm),
+                                0);
+                /* 
+                 * The controller needs at least 1ms to reflect
+                 * PHY's status, the PHY also needs some time (less
+                 * than 1ms) to leave low power mode.
+                 */
+                usleep_range(1500, 2000);
+        }
+}
 static int hw_device_init(struct ci_hdrc *ci, void __iomem *base)
 {
        u32 reg;
@@ -199,6 +220,8 @@ static int hw_device_init(struct ci_hdrc *ci, void __iomem *base)
        if (ci->hw_ep_max > ENDPT_MAX)
                return -ENODEV;
+        ci_hdrc_enter_lpm(ci, false);
        /* Disable all interrupts bits */
        hw_write(ci, OP_USBINTR, 0xffffffff, 0);
@@ -369,16 +392,28 @@ static irqreturn_t ci_irq(int irq, void *data)
 static int ci_get_platdata(struct device *dev,
                struct ci_hdrc_platform_data *platdata)
 {
-        /* Get the vbus regulator */
+        if (!platdata->phy_mode)
-        platdata->reg_vbus = devm_regulator_get(dev, "vbus");
+                platdata->phy_mode = of_usb_get_phy_mode(dev->of_node);
-        if (PTR_ERR(platdata->reg_vbus) == -EPROBE_DEFER) {
-                return -EPROBE_DEFER;
+        if (!platdata->dr_mode)
-        } else if (PTR_ERR(platdata->reg_vbus) == -ENODEV) {
+                platdata->dr_mode = of_usb_get_dr_mode(dev->of_node);
-                platdata->reg_vbus = NULL; /* no vbus regualator is needed */
-        } else if (IS_ERR(platdata->reg_vbus)) {
+        if (platdata->dr_mode == USB_DR_MODE_UNKNOWN)
-                dev_err(dev, "Getting regulator error: %ld\n",
+                platdata->dr_mode = USB_DR_MODE_OTG;
-                        PTR_ERR(platdata->reg_vbus));
-                return PTR_ERR(platdata->reg_vbus);
+        if (platdata->dr_mode != USB_DR_MODE_PERIPHERAL) {
+                /* Get the vbus regulator */
+                platdata->reg_vbus = devm_regulator_get(dev, "vbus");
+                if (PTR_ERR(platdata->reg_vbus) == -EPROBE_DEFER) {
+                        return -EPROBE_DEFER;
+                } else if (PTR_ERR(platdata->reg_vbus) == -ENODEV) {
+                        /* no vbus regualator is needed */
+                        platdata->reg_vbus = NULL;
+                } else if (IS_ERR(platdata->reg_vbus)) {
+                        dev_err(dev, "Getting regulator error: %ld\n",
+                                PTR_ERR(platdata->reg_vbus));
+                        return PTR_ERR(platdata->reg_vbus);
+                }
        }
        return 0;
@@ -465,6 +500,33 @@ static void ci_get_otg_capable(struct ci_hdrc *ci)
        }
 }
+static int ci_usb_phy_init(struct ci_hdrc *ci)
+{
+        if (ci->platdata->phy) {
+                ci->transceiver = ci->platdata->phy;
+                return usb_phy_init(ci->transceiver);
+        } else {
+                ci->global_phy = true;
+                ci->transceiver = usb_get_phy(USB_PHY_TYPE_USB2);
+                if (IS_ERR(ci->transceiver))
+                        ci->transceiver = NULL;
+                return 0;
+        }
+}
+static void ci_usb_phy_destroy(struct ci_hdrc *ci)
+{
+        if (!ci->transceiver)
+                return;
+        otg_set_peripheral(ci->transceiver->otg, NULL);
+        if (ci->global_phy)
+                usb_put_phy(ci->transceiver);
+        else
+                usb_phy_shutdown(ci->transceiver);
+}
 static int ci_hdrc_probe(struct platform_device *pdev)
 {
        struct device   *dev = &pdev->dev;
@@ -473,7 +535,6 @@ static int ci_hdrc_probe(struct platform_device *pdev)
        void __iomem    *base;
        int             ret;
        enum usb_dr_mode dr_mode;
-        struct device_node *of_node = dev->of_node ?: dev->parent->of_node;
        if (!dev->platform_data) {
                dev_err(dev, "platform data missing\n");
@@ -493,10 +554,6 @@ static int ci_hdrc_probe(struct platform_device *pdev)
        ci->dev = dev;
        ci->platdata = dev->platform_data;
-        if (ci->platdata->phy)
-                ci->transceiver = ci->platdata->phy;
-        else
-                ci->global_phy = true;
        ret = hw_device_init(ci, base);
        if (ret < 0) {
@@ -504,27 +561,25 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                return -ENODEV;
        }
+        ret = ci_usb_phy_init(ci);
+        if (ret) {
+                dev_err(dev, "unable to init phy: %d\n", ret);
+                return ret;
+        }
        ci->hw_bank.phys = res->start;
        ci->irq = platform_get_irq(pdev, 0);
        if (ci->irq < 0) {
                dev_err(dev, "missing IRQ\n");
-                return -ENODEV;
+                ret = -ENODEV;
+                goto destroy_phy;
        }
        ci_get_otg_capable(ci);
-        if (!ci->platdata->phy_mode)
-                ci->platdata->phy_mode = of_usb_get_phy_mode(of_node);
        hw_phymode_configure(ci);
-        if (!ci->platdata->dr_mode)
-                ci->platdata->dr_mode = of_usb_get_dr_mode(of_node);
-        if (ci->platdata->dr_mode == USB_DR_MODE_UNKNOWN)
-                ci->platdata->dr_mode = USB_DR_MODE_OTG;
        dr_mode = ci->platdata->dr_mode;
        /* initialize role(s) before the interrupt is requested */
        if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_HOST) {
@@ -537,11 +592,23 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                ret = ci_hdrc_gadget_init(ci);
                if (ret)
                        dev_info(dev, "doesn't support gadget\n");
+                if (!ret && ci->transceiver) {
+                        ret = otg_set_peripheral(ci->transceiver->otg,
+                                                        &ci->gadget);
+                        /*
+                         * If we implement all USB functions using chipidea drivers,
+                         * it doesn't need to call above API, meanwhile, if we only
+                         * use gadget function, calling above API is useless.
+                         */
+                        if (ret && ret != -ENOTSUPP)
+                                goto destroy_phy;
+                }
        }
        if (!ci->roles[CI_ROLE_HOST] && !ci->roles[CI_ROLE_GADGET]) {
                dev_err(dev, "no supported roles\n");
-                return -ENODEV;
+                ret = -ENODEV;
+                goto destroy_phy;
        }
        if (ci->is_otg) {
@@ -594,6 +661,8 @@ static int ci_hdrc_probe(struct platform_device *pdev)
        free_irq(ci->irq, ci);
 stop:
        ci_role_destroy(ci);
+destroy_phy:
+        ci_usb_phy_destroy(ci);
        return ret;
 }
@@ -605,6 +674,8 @@ static int ci_hdrc_remove(struct platform_device *pdev)
        dbg_remove_files(ci);
        free_irq(ci->irq, ci);
        ci_role_destroy(ci);
+        ci_hdrc_enter_lpm(ci, true);
+        ci_usb_phy_destroy(ci);
        kfree(ci->hw_bank.regmap);
        return 0;
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 64d7a6d9a1ad..59e6020ea753 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -103,15 +103,15 @@ static void host_stop(struct ci_hdrc *ci)
        if (hcd) {
                usb_remove_hcd(hcd);
                usb_put_hcd(hcd);
+                if (ci->platdata->reg_vbus)
+                        regulator_disable(ci->platdata->reg_vbus);
        }
-        if (ci->platdata->reg_vbus)
-                regulator_disable(ci->platdata->reg_vbus);
 }
 void ci_hdrc_host_destroy(struct ci_hdrc *ci)
 {
-        if (ci->role == CI_ROLE_HOST)
+        if (ci->role == CI_ROLE_HOST && ci->hcd)
                host_stop(ci);
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 9333083dd111..b34c81969cba 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -20,7 +20,6 @@
 #include <linux/pm_runtime.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
-#include <linux/usb/otg.h>
 #include <linux/usb/chipidea.h>
 #include "ci.h"
@@ -686,9 +685,6 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
        usb_ep_fifo_flush(&ci->ep0out->ep);
        usb_ep_fifo_flush(&ci->ep0in->ep);
-        if (ci->driver)
-                ci->driver->disconnect(gadget);
        /* make sure to disable all endpoints */
        gadget_for_each_ep(ep, gadget) {
                usb_ep_disable(ep);
@@ -718,6 +714,11 @@ __acquires(ci->lock)
        int retval;
        spin_unlock(&ci->lock);
+        if (ci->gadget.speed != USB_SPEED_UNKNOWN) {
+                if (ci->driver)
+                        ci->driver->disconnect(&ci->gadget);
+        }
        retval = _gadget_stop_activity(&ci->gadget);
        if (retval)
                goto done;
@@ -1461,6 +1462,8 @@ static int ci_udc_vbus_session(struct usb_gadget *_gadget, int is_active)
                        hw_device_state(ci, ci->ep0out->qh.dma);
                        dev_dbg(ci->dev, "Connected to host\n");
                } else {
+                        if (ci->driver)
+                                ci->driver->disconnect(&ci->gadget);
                        hw_device_state(ci, 0);
                        if (ci->platdata->notify_event)
                                ci->platdata->notify_event(ci,
@@ -1633,23 +1636,22 @@ static int ci_udc_start(struct usb_gadget *gadget,
        retval = usb_ep_enable(&ci->ep0in->ep);
        if (retval)
                return retval;
-        spin_lock_irqsave(&ci->lock, flags);
        ci->driver = driver;
        pm_runtime_get_sync(&ci->gadget.dev);
        if (ci->vbus_active) {
+                spin_lock_irqsave(&ci->lock, flags);
                hw_device_reset(ci, USBMODE_CM_DC);
        } else {
                pm_runtime_put_sync(&ci->gadget.dev);
-                goto done;
+                return retval;
        }
        retval = hw_device_state(ci, ci->ep0out->qh.dma);
+        spin_unlock_irqrestore(&ci->lock, flags);
        if (retval)
                pm_runtime_put_sync(&ci->gadget.dev);
- done:
-        spin_unlock_irqrestore(&ci->lock, flags);
        return retval;
 }
@@ -1786,34 +1788,9 @@ static int udc_start(struct ci_hdrc *ci)
        ci->gadget.ep0 = &ci->ep0in->ep;
-        if (ci->global_phy) {
-                ci->transceiver = usb_get_phy(USB_PHY_TYPE_USB2);
-                if (IS_ERR(ci->transceiver))
-                        ci->transceiver = NULL;
-        }
-        if (ci->platdata->flags & CI_HDRC_REQUIRE_TRANSCEIVER) {
-                if (ci->transceiver == NULL) {
-                        retval = -ENODEV;
-                        goto destroy_eps;
-                }
-        }
-        if (ci->transceiver) {
-                retval = otg_set_peripheral(ci->transceiver->otg,
-                                                &ci->gadget);
-                /*
-                 * If we implement all USB functions using chipidea drivers,
-                 * it doesn't need to call above API, meanwhile, if we only
-                 * use gadget function, calling above API is useless.
-                 */
-                if (retval && retval != -ENOTSUPP)
-                        goto put_transceiver;
-        }
        retval = usb_add_gadget_udc(dev, &ci->gadget);
        if (retval)
-                goto remove_trans;
+                goto destroy_eps;
        pm_runtime_no_callbacks(&ci->gadget.dev);
        pm_runtime_enable(&ci->gadget.dev);
@@ -1823,17 +1800,6 @@ static int udc_start(struct ci_hdrc *ci)
        return retval;
-remove_trans:
-        if (ci->transceiver) {
-                otg_set_peripheral(ci->transceiver->otg, NULL);
-                if (ci->global_phy)
-                        usb_put_phy(ci->transceiver);
-        }
-        dev_err(dev, "error = %i\n", retval);
-put_transceiver:
-        if (ci->transceiver && ci->global_phy)
-                usb_put_phy(ci->transceiver);
 destroy_eps:
        destroy_eps(ci);
 free_pools:
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index d3318a0df8ee..4d387596f3f0 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -101,6 +101,7 @@ struct wdm_device {
        struct work_struct      rxwork;
        int                     werr;
        int                     rerr;
+        int                     resp_count;
        struct list_head        device_list;
        int                     (*manage_power)(struct usb_interface *, int);
@@ -253,6 +254,10 @@ static void wdm_int_callback(struct urb *urb)
                        "NOTIFY_NETWORK_CONNECTION %s network",
                        dr->wValue ? "connected to" : "disconnected from");
                goto exit;
+        case USB_CDC_NOTIFY_SPEED_CHANGE:
+                dev_dbg(&desc->intf->dev, "SPEED_CHANGE received (len %u)",
+                        urb->actual_length);
+                goto exit;
        default:
                clear_bit(WDM_POLL_RUNNING, &desc->flags);
                dev_err(&desc->intf->dev,
@@ -262,9 +267,9 @@ static void wdm_int_callback(struct urb *urb)
        }
        spin_lock(&desc->iuspin);
-        clear_bit(WDM_READ, &desc->flags);
        responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
-        if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+        if (!desc->resp_count++ && !responding
+                && !test_bit(WDM_DISCONNECTING, &desc->flags)
                && !test_bit(WDM_SUSPENDING, &desc->flags)) {
                rv = usb_submit_urb(desc->response, GFP_ATOMIC);
                dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
@@ -521,10 +526,36 @@ retry:
        desc->length -= cntr;
        /* in case we had outstanding data */
-        if (!desc->length)
+        if (!desc->length) {
                clear_bit(WDM_READ, &desc->flags);
-        spin_unlock_irq(&desc->iuspin);
+                if (--desc->resp_count) {
+                        set_bit(WDM_RESPONDING, &desc->flags);
+                        spin_unlock_irq(&desc->iuspin);
+                        rv = usb_submit_urb(desc->response, GFP_KERNEL);
+                        if (rv) {
+                                dev_err(&desc->intf->dev,
+                                        "%s: usb_submit_urb failed with result %d\n",
+                                        __func__, rv);
+                                spin_lock_irq(&desc->iuspin);
+                                clear_bit(WDM_RESPONDING, &desc->flags);
+                                spin_unlock_irq(&desc->iuspin);
+                                if (rv == -ENOMEM) {
+                                        rv = schedule_work(&desc->rxwork);
+                                        if (rv)
+                                                dev_err(&desc->intf->dev, "Cannot schedule work\n");
+                                } else {
+                                        spin_lock_irq(&desc->iuspin);
+                                        desc->resp_count = 0;
+                                        spin_unlock_irq(&desc->iuspin);
+                                }
+                        }
+                } else
+                        spin_unlock_irq(&desc->iuspin);
+        } else
+                spin_unlock_irq(&desc->iuspin);
        rv = cntr;
@@ -635,6 +666,9 @@ static int wdm_release(struct inode *inode, struct file *file)
                if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
                        dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
                        kill_urbs(desc);
+                        spin_lock_irq(&desc->iuspin);
+                        desc->resp_count = 0;
+                        spin_unlock_irq(&desc->iuspin);
                        desc->manage_power(desc->intf, 0);
                } else {
                        /* must avoid dev_printk here as desc->intf is invalid */
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 71dc5d768fa5..967152a63bd3 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -914,10 +914,8 @@ static int proc_control(struct dev_state *ps, void __user *arg)
        snoop(&dev->dev, "control urb: bRequestType=%02x "
                "bRequest=%02x wValue=%04x "
                "wIndex=%04x wLength=%04x\n",
-                ctrl.bRequestType, ctrl.bRequest,
+                ctrl.bRequestType, ctrl.bRequest, ctrl.wValue,
-                __le16_to_cpup(&ctrl.wValue),
+                ctrl.wIndex, ctrl.wLength);
-                __le16_to_cpup(&ctrl.wIndex),
-                __le16_to_cpup(&ctrl.wLength));
        if (ctrl.bRequestType & 0x80) {
                if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data,
                                               ctrl.wLength)) {
@@ -1636,32 +1634,32 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
 static int proc_control_compat(struct dev_state *ps,
                                struct usbdevfs_ctrltransfer32 __user *p32)
 {
-        struct usbdevfs_ctrltransfer __user *p;
+        struct usbdevfs_ctrltransfer __user *p;
-        __u32 udata;
+        __u32 udata;
-        p = compat_alloc_user_space(sizeof(*p));
+        p = compat_alloc_user_space(sizeof(*p));
-        if (copy_in_user(p, p32, (sizeof(*p32) - sizeof(compat_caddr_t))) ||
+        if (copy_in_user(p, p32, (sizeof(*p32) - sizeof(compat_caddr_t))) ||
-            get_user(udata, &p32->data) ||
+            get_user(udata, &p32->data) ||
            put_user(compat_ptr(udata), &p->data))
                return -EFAULT;
-        return proc_control(ps, p);
+        return proc_control(ps, p);
 }
 static int proc_bulk_compat(struct dev_state *ps,
                        struct usbdevfs_bulktransfer32 __user *p32)
 {
-        struct usbdevfs_bulktransfer __user *p;
+        struct usbdevfs_bulktransfer __user *p;
-        compat_uint_t n;
+        compat_uint_t n;
-        compat_caddr_t addr;
+        compat_caddr_t addr;
-        p = compat_alloc_user_space(sizeof(*p));
+        p = compat_alloc_user_space(sizeof(*p));
-        if (get_user(n, &p32->ep) || put_user(n, &p->ep) ||
+        if (get_user(n, &p32->ep) || put_user(n, &p->ep) ||
-            get_user(n, &p32->len) || put_user(n, &p->len) ||
+            get_user(n, &p32->len) || put_user(n, &p->len) ||
-            get_user(n, &p32->timeout) || put_user(n, &p->timeout) ||
+            get_user(n, &p32->timeout) || put_user(n, &p->timeout) ||
-            get_user(addr, &p32->data) || put_user(compat_ptr(addr), &p->data))
+            get_user(addr, &p32->data) || put_user(compat_ptr(addr), &p->data))
-                return -EFAULT;
+                return -EFAULT;
-        return proc_bulk(ps, p);
+        return proc_bulk(ps, p);
 }
 static int proc_disconnectsignal_compat(struct dev_state *ps, void __user *arg)
 {
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f7841d44feda..47aade2a5e74 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1179,8 +1179,8 @@ static int usb_resume_interface(struct usb_device *udev,
                                                "reset_resume", status);
                } else {
                        intf->needs_binding = 1;
-                        dev_warn(&intf->dev, "no %s for driver %s?\n",
+                        dev_dbg(&intf->dev, "no reset_resume for driver %s?\n",
-                                        "reset_resume", driver->name);
+                                        driver->name);
                }
        } else {
                status = driver->resume(intf);
@@ -1790,6 +1790,9 @@ int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable)
        struct usb_hcd *hcd = bus_to_hcd(udev->bus);
        int ret = -EPERM;
+        if (enable && !udev->usb2_hw_lpm_allowed)
+                return 0;
        if (hcd->driver->set_usb2_hw_lpm) {
                ret = hcd->driver->set_usb2_hw_lpm(hcd, udev, enable);
                if (!ret)
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index 7421888087a3..3bdfbf88a0ae 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -8,7 +8,7 @@
 * (C) Copyright Deti Fliegl 1999 (new USB architecture)
 * (C) Copyright Randy Dunlap 2000
 * (C) Copyright David Brownell 2000-2001 (kernel hotplug, usb_device_id,
-        more docs, etc)
+ *      more docs, etc)
 * (C) Copyright Yggdrasil Computing, Inc. 2000
 *     (usb_device_id matching changes by Adam J. Richter)
 * (C) Copyright Greg Kroah-Hartman 2002-2003
@@ -27,7 +27,7 @@
 static const struct file_operations *usb_minors[MAX_USB_MINORS];
 static DECLARE_RWSEM(minor_rwsem);
-static int usb_open(struct inode * inode, struct file * file)
+static int usb_open(struct inode *inode, struct file *file)
 {
        int minor = iminor(inode);
        const struct file_operations *c;
@@ -44,7 +44,7 @@ static int usb_open(struct inode * inode, struct file * file)
        file->f_op = new_fops;
        /* Curiouser and curiouser... NULL ->open() as "no device" ? */
        if (file->f_op->open)
-                err = file->f_op->open(inode,file);
+                err = file->f_op->open(inode, file);
        if (err) {
                fops_put(file->f_op);
                file->f_op = fops_get(old_fops);
@@ -166,7 +166,7 @@ int usb_register_dev(struct usb_interface *intf,
        char *temp;
 #ifdef CONFIG_USB_DYNAMIC_MINORS
-        /* 
+        /*
         * We don't care what the device tries to start at, we want to start
         * at zero to pack the devices into the smallest available space with
         * no holes in the minor range.
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index b9d3c43e3859..dfe9d0f22978 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -215,6 +215,9 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                goto disable_pci;
        }
+        hcd->amd_resume_bug = (usb_hcd_amd_remote_wakeup_quirk(dev) &&
+                        driver->flags & (HCD_USB11 | HCD_USB3)) ? 1 : 0;
        if (driver->flags & HCD_MEMORY) {
                /* EHCI, OHCI */
                hcd->rsrc_start = pci_resource_start(dev, 0);
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index d6a8d23f047b..6bffb8c87bc9 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -6,7 +6,7 @@
 * (C) Copyright Deti Fliegl 1999
 * (C) Copyright Randy Dunlap 2000
 * (C) Copyright David Brownell 2000-2002
- * 
+ *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
@@ -40,6 +40,7 @@
 #include <linux/platform_device.h>
 #include <linux/workqueue.h>
 #include <linux/pm_runtime.h>
+#include <linux/types.h>
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
@@ -92,10 +93,7 @@ EXPORT_SYMBOL_GPL (usb_bus_list);
 /* used when allocating bus numbers */
 #define USB_MAXBUS              64
-struct usb_busmap {
+static DECLARE_BITMAP(busmap, USB_MAXBUS);
-        unsigned long busmap [USB_MAXBUS / (8*sizeof (unsigned long))];
-};
-static struct usb_busmap busmap;
 /* used when updating list of hcds */
 DEFINE_MUTEX(usb_bus_list_lock);        /* exported only for usbfs */
@@ -171,7 +169,7 @@ static const u8 usb25_rh_dev_descriptor[18] = {
 };
 /* usb 2.0 root hub device descriptor */
-static const u8 usb2_rh_dev_descriptor [18] = {
+static const u8 usb2_rh_dev_descriptor[18] = {
        0x12,       /*  __u8  bLength; */
        0x01,       /*  __u8  bDescriptorType; Device */
        0x00, 0x02, /*  __le16 bcdUSB; v2.0 */
@@ -194,7 +192,7 @@ static const u8 usb2_rh_dev_descriptor [18] = {
 /* no usb 2.0 root hub "device qualifier" descriptor: one speed only */
 /* usb 1.1 root hub device descriptor */
-static const u8 usb11_rh_dev_descriptor [18] = {
+static const u8 usb11_rh_dev_descriptor[18] = {
        0x12,       /*  __u8  bLength; */
        0x01,       /*  __u8  bDescriptorType; Device */
        0x10, 0x01, /*  __le16 bcdUSB; v1.1 */
@@ -219,7 +217,7 @@ static const u8 usb11_rh_dev_descriptor [18] = {
 /* Configuration descriptors for our root hubs */
-static const u8 fs_rh_config_descriptor [] = {
+static const u8 fs_rh_config_descriptor[] = {
        /* one configuration */
        0x09,       /*  __u8  bLength; */
@@ -228,13 +226,13 @@ static const u8 fs_rh_config_descriptor [] = {
        0x01,       /*  __u8  bNumInterfaces; (1) */
        0x01,       /*  __u8  bConfigurationValue; */
        0x00,       /*  __u8  iConfiguration; */
-        0xc0,       /*  __u8  bmAttributes; 
+        0xc0,       /*  __u8  bmAttributes;
                                 Bit 7: must be set,
                                     6: Self-powered,
                                     5: Remote wakeup,
                                     4..0: resvd */
        0x00,       /*  __u8  MaxPower; */
-      
        /* USB 1.1:
         * USB 2.0, single TT organization (mandatory):
         *      one interface, protocol 0
@@ -256,17 +254,17 @@ static const u8 fs_rh_config_descriptor [] = {
        0x00,       /*  __u8  if_bInterfaceSubClass; */
        0x00,       /*  __u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
        0x00,       /*  __u8  if_iInterface; */
-     
        /* one endpoint (status change endpoint) */
        0x07,       /*  __u8  ep_bLength; */
        0x05,       /*  __u8  ep_bDescriptorType; Endpoint */
        0x81,       /*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
-        0x03,       /*  __u8  ep_bmAttributes; Interrupt */
+        0x03,       /*  __u8  ep_bmAttributes; Interrupt */
-        0x02, 0x00, /*  __le16 ep_wMaxPacketSize; 1 + (MAX_ROOT_PORTS / 8) */
+        0x02, 0x00, /*  __le16 ep_wMaxPacketSize; 1 + (MAX_ROOT_PORTS / 8) */
        0xff        /*  __u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 };
-static const u8 hs_rh_config_descriptor [] = {
+static const u8 hs_rh_config_descriptor[] = {
        /* one configuration */
        0x09,       /*  __u8  bLength; */
@@ -275,13 +273,13 @@ static const u8 hs_rh_config_descriptor [] = {
        0x01,       /*  __u8  bNumInterfaces; (1) */
        0x01,       /*  __u8  bConfigurationValue; */
        0x00,       /*  __u8  iConfiguration; */
-        0xc0,       /*  __u8  bmAttributes; 
+        0xc0,       /*  __u8  bmAttributes;
                                 Bit 7: must be set,
                                     6: Self-powered,
                                     5: Remote wakeup,
                                     4..0: resvd */
        0x00,       /*  __u8  MaxPower; */
-      
        /* USB 1.1:
         * USB 2.0, single TT organization (mandatory):
         *      one interface, protocol 0
@@ -303,12 +301,12 @@ static const u8 hs_rh_config_descriptor [] = {
        0x00,       /*  __u8  if_bInterfaceSubClass; */
        0x00,       /*  __u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
        0x00,       /*  __u8  if_iInterface; */
-     
        /* one endpoint (status change endpoint) */
        0x07,       /*  __u8  ep_bLength; */
        0x05,       /*  __u8  ep_bDescriptorType; Endpoint */
        0x81,       /*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
-        0x03,       /*  __u8  ep_bmAttributes; Interrupt */
+        0x03,       /*  __u8  ep_bmAttributes; Interrupt */
                    /* __le16 ep_wMaxPacketSize; 1 + (MAX_ROOT_PORTS / 8)
                     * see hub.c:hub_configure() for details. */
        (USB_MAXCHILDREN + 1 + 7) / 8, 0x00,
@@ -428,7 +426,7 @@ rh_string(int id, struct usb_hcd const *hcd, u8 *data, unsigned len)
        char const *s;
        static char const langids[4] = {4, USB_DT_STRING, 0x09, 0x04};
-        // language ids
+        /* language ids */
        switch (id) {
        case 0:
                /* Array of LANGID codes (0x0409 is MSFT-speak for "en-us") */
@@ -464,7 +462,7 @@ rh_string(int id, struct usb_hcd const *hcd, u8 *data, unsigned len)
 static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
 {
        struct usb_ctrlrequest *cmd;
-        u16             typeReq, wValue, wIndex, wLength;
+        u16             typeReq, wValue, wIndex, wLength;
        u8              *ubuf = urb->transfer_buffer;
        unsigned        len = 0;
        int             status;
@@ -526,10 +524,10 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
         */
        case DeviceRequest | USB_REQ_GET_STATUS:
-                tbuf [0] = (device_may_wakeup(&hcd->self.root_hub->dev)
+                tbuf[0] = (device_may_wakeup(&hcd->self.root_hub->dev)
                                        << USB_DEVICE_REMOTE_WAKEUP)
                                | (1 << USB_DEVICE_SELF_POWERED);
-                tbuf [1] = 0;
+                tbuf[1] = 0;
                len = 2;
                break;
        case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
@@ -546,7 +544,7 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
                        goto error;
                break;
        case DeviceRequest | USB_REQ_GET_CONFIGURATION:
-                tbuf [0] = 1;
+                tbuf[0] = 1;
                len = 1;
                        /* FALLTHROUGH */
        case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
@@ -609,13 +607,13 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
                }
                break;
        case DeviceRequest | USB_REQ_GET_INTERFACE:
-                tbuf [0] = 0;
+                tbuf[0] = 0;
                len = 1;
                        /* FALLTHROUGH */
        case DeviceOutRequest | USB_REQ_SET_INTERFACE:
                break;
        case DeviceOutRequest | USB_REQ_SET_ADDRESS:
-                // wValue == urb->dev->devaddr
+                /* wValue == urb->dev->devaddr */
                dev_dbg (hcd->self.controller, "root hub device address %d\n",
                        wValue);
                break;
@@ -625,9 +623,9 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
        /* ENDPOINT REQUESTS */
        case EndpointRequest | USB_REQ_GET_STATUS:
-                // ENDPOINT_HALT flag
+                /* ENDPOINT_HALT flag */
-                tbuf [0] = 0;
+                tbuf[0] = 0;
-                tbuf [1] = 0;
+                tbuf[1] = 0;
                len = 2;
                        /* FALLTHROUGH */
        case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
@@ -683,7 +681,7 @@ error:
                if (urb->transfer_buffer_length < len)
                        len = urb->transfer_buffer_length;
                urb->actual_length = len;
-                // always USB_DIR_IN, toward host
+                /* always USB_DIR_IN, toward host */
                memcpy (ubuf, bufp, len);
                /* report whether RH hardware supports remote wakeup */
@@ -877,11 +875,11 @@ static ssize_t authorized_default_store(struct device *dev,
        usb_hcd = bus_to_hcd(usb_bus);
        result = sscanf(buf, "%u\n", &val);
        if (result == 1) {
-                usb_hcd->authorized_default = val? 1 : 0;
+                usb_hcd->authorized_default = val ? 1 : 0;
                result = size;
-        }
+        } else {
-        else
                result = -EINVAL;
+        }
        return result;
 }
 static DEVICE_ATTR_RW(authorized_default);
@@ -941,12 +939,12 @@ static int usb_register_bus(struct usb_bus *bus)
        int busnum;
        mutex_lock(&usb_bus_list_lock);
-        busnum = find_next_zero_bit (busmap.busmap, USB_MAXBUS, 1);
+        busnum = find_next_zero_bit(busmap, USB_MAXBUS, 1);
        if (busnum >= USB_MAXBUS) {
                printk (KERN_ERR "%s: too many buses\n", usbcore_name);
                goto error_find_busnum;
        }
-        set_bit (busnum, busmap.busmap);
+        set_bit(busnum, busmap);
        bus->busnum = busnum;
        /* Add it to the local list of buses */
@@ -987,7 +985,7 @@ static void usb_deregister_bus (struct usb_bus *bus)
        usb_notify_remove_bus(bus);
-        clear_bit (bus->busnum, busmap.busmap);
+        clear_bit(bus->busnum, busmap);
 }
 /**
@@ -1033,6 +1031,7 @@ static int register_root_hub(struct usb_hcd *hcd)
                                        dev_name(&usb_dev->dev), retval);
                        return retval;
                }
+                usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
        }
        retval = usb_new_device (usb_dev);
@@ -1120,21 +1119,21 @@ long usb_calc_bus_time (int speed, int is_input, int isoc, int bytecount)
        case USB_SPEED_LOW:     /* INTR only */
                if (is_input) {
                        tmp = (67667L * (31L + 10L * BitTime (bytecount))) / 1000L;
-                        return (64060L + (2 * BW_HUB_LS_SETUP) + BW_HOST_DELAY + tmp);
+                        return 64060L + (2 * BW_HUB_LS_SETUP) + BW_HOST_DELAY + tmp;
                } else {
                        tmp = (66700L * (31L + 10L * BitTime (bytecount))) / 1000L;
-                        return (64107L + (2 * BW_HUB_LS_SETUP) + BW_HOST_DELAY + tmp);
+                        return 64107L + (2 * BW_HUB_LS_SETUP) + BW_HOST_DELAY + tmp;
                }
        case USB_SPEED_FULL:    /* ISOC or INTR */
                if (isoc) {
                        tmp = (8354L * (31L + 10L * BitTime (bytecount))) / 1000L;
-                        return (((is_input) ? 7268L : 6265L) + BW_HOST_DELAY + tmp);
+                        return ((is_input) ? 7268L : 6265L) + BW_HOST_DELAY + tmp;
                } else {
                        tmp = (8354L * (31L + 10L * BitTime (bytecount))) / 1000L;
-                        return (9107L + BW_HOST_DELAY + tmp);
+                        return 9107L + BW_HOST_DELAY + tmp;
                }
        case USB_SPEED_HIGH:    /* ISOC or INTR */
-                // FIXME adjust for input vs output
+                /* FIXME adjust for input vs output */
                if (isoc)
                        tmp = HS_NSECS_ISO (bytecount);
                else
@@ -1651,6 +1650,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
 static void __usb_hcd_giveback_urb(struct urb *urb)
 {
        struct usb_hcd *hcd = bus_to_hcd(urb->dev->bus);
+        struct usb_anchor *anchor = urb->anchor;
        int status = urb->unlinked;
        unsigned long flags;
@@ -1662,6 +1662,7 @@ static void __usb_hcd_giveback_urb(struct urb *urb)
        unmap_urb_for_dma(hcd, urb);
        usbmon_urb_complete(&hcd->self, urb, status);
+        usb_anchor_suspend_wakeups(anchor);
        usb_unanchor_urb(urb);
        /* pass ownership to the completion handler */
@@ -1681,6 +1682,7 @@ static void __usb_hcd_giveback_urb(struct urb *urb)
        urb->complete(urb);
        local_irq_restore(flags);
+        usb_anchor_resume_wakeups(anchor);
        atomic_dec(&urb->use_count);
        if (unlikely(atomic_read(&urb->reject)))
                wake_up(&usb_kill_urb_queue);
@@ -1703,7 +1705,9 @@ static void usb_giveback_urb_bh(unsigned long param)
                urb = list_entry(local_list.next, struct urb, urb_list);
                list_del_init(&urb->urb_list);
+                bh->completing_ep = urb->ep;
                __usb_hcd_giveback_urb(urb);
+                bh->completing_ep = NULL;
        }
        /* check if there are new URBs to giveback */
@@ -1812,7 +1816,7 @@ rescan:
                                 case USB_ENDPOINT_XFER_INT:
                                        s = "-intr"; break;
                                 default:
-                                        s = "-iso"; break;
+                                        s = "-iso"; break;
                                };
                                s;
                        }));
@@ -2073,8 +2077,11 @@ EXPORT_SYMBOL_GPL(usb_alloc_streams);
 *
 * Reverts a group of bulk endpoints back to not using stream IDs.
 * Can fail if we are given bad arguments, or HCD is broken.
+ *
+ * Return: On success, the number of allocated streams. On failure, a negative
+ * error code.
 */
-void usb_free_streams(struct usb_interface *interface,
+int usb_free_streams(struct usb_interface *interface,
                struct usb_host_endpoint **eps, unsigned int num_eps,
                gfp_t mem_flags)
 {
@@ -2085,14 +2092,14 @@ void usb_free_streams(struct usb_interface *interface,
        dev = interface_to_usbdev(interface);
        hcd = bus_to_hcd(dev->bus);
        if (dev->speed != USB_SPEED_SUPER)
-                return;
+                return -EINVAL;
        /* Streams only apply to bulk endpoints. */
        for (i = 0; i < num_eps; i++)
                if (!eps[i] || !usb_endpoint_xfer_bulk(&eps[i]->desc))
-                        return;
+                        return -EINVAL;
-        hcd->driver->free_streams(hcd, dev, eps, num_eps, mem_flags);
+        return hcd->driver->free_streams(hcd, dev, eps, num_eps, mem_flags);
 }
 EXPORT_SYMBOL_GPL(usb_free_streams);
@@ -2245,7 +2252,7 @@ static void hcd_resume_work(struct work_struct *work)
 }
 /**
- * usb_hcd_resume_root_hub - called by HCD to resume its root hub 
+ * usb_hcd_resume_root_hub - called by HCD to resume its root hub
 * @hcd: host controller for this root hub
 *
 * The USB host controller calls this function when its root hub is
@@ -2324,15 +2331,8 @@ EXPORT_SYMBOL_GPL(usb_bus_start_enum);
 irqreturn_t usb_hcd_irq (int irq, void *__hcd)
 {
        struct usb_hcd          *hcd = __hcd;
-        unsigned long           flags;
        irqreturn_t             rc;
-        /* IRQF_DISABLED doesn't work correctly with shared IRQs
-         * when the first handler doesn't use it.  So let's just
-         * assume it's never used.
-         */
-        local_irq_save(flags);
        if (unlikely(HCD_DEAD(hcd) || !HCD_HW_ACCESSIBLE(hcd)))
                rc = IRQ_NONE;
        else if (hcd->driver->irq(hcd) == IRQ_NONE)
@@ -2340,7 +2340,6 @@ irqreturn_t usb_hcd_irq (int irq, void *__hcd)
        else
                rc = IRQ_HANDLED;
-        local_irq_restore(flags);
        return rc;
 }
 EXPORT_SYMBOL_GPL(usb_hcd_irq);
@@ -2547,13 +2546,6 @@ static int usb_hcd_request_irqs(struct usb_hcd *hcd,
        if (hcd->driver->irq) {
-                /* IRQF_DISABLED doesn't work as advertised when used together
-                 * with IRQF_SHARED. As usb_hcd_irq() will always disable
-                 * interrupts we can remove it here.
-                 */
-                if (irqflags & IRQF_SHARED)
-                        irqflags &= ~IRQF_DISABLED;
                snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
                                hcd->driver->description, hcd->self.busnum);
                retval = request_irq(irqnum, &usb_hcd_irq, irqflags,
@@ -2600,7 +2592,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
        /* Keep old behaviour if authorized_default is not in [0, 1]. */
        if (authorized_default < 0 || authorized_default > 1)
-                hcd->authorized_default = hcd->wireless? 0 : 1;
+                hcd->authorized_default = hcd->wireless ? 0 : 1;
        else
                hcd->authorized_default = authorized_default;
        set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
@@ -2743,7 +2735,7 @@ err_allocate_root_hub:
 err_register_bus:
        hcd_buffer_destroy(hcd);
        return retval;
-} 
+}
 EXPORT_SYMBOL_GPL(usb_add_hcd);
 /**
@@ -2818,7 +2810,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 EXPORT_SYMBOL_GPL(usb_remove_hcd);
 void
-usb_hcd_platform_shutdown(struct platform_device* dev)
+usb_hcd_platform_shutdown(struct platform_device *dev)
 {
        struct usb_hcd *hcd = platform_get_drvdata(dev);
@@ -2840,7 +2832,7 @@ struct usb_mon_operations *mon_ops;
 * Notice that the code is minimally error-proof. Because usbmon needs
 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
 */
- 
 int usb_mon_register (struct usb_mon_operations *ops)
 {
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index e6b682c6c236..06cec635e703 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -120,7 +120,7 @@ static inline char *portspeed(struct usb_hub *hub, int portstatus)
        if (hub_is_superspeed(hub->hdev))
                return "5.0 Gb/s";
        if (portstatus & USB_PORT_STAT_HIGH_SPEED)
-                return "480 Mb/s";
+                return "480 Mb/s";
        else if (portstatus & USB_PORT_STAT_LOW_SPEED)
                return "1.5 Mb/s";
        else
@@ -135,7 +135,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
        return usb_get_intfdata(hdev->actconfig->interface[0]);
 }
-static int usb_device_supports_lpm(struct usb_device *udev)
+int usb_device_supports_lpm(struct usb_device *udev)
 {
        /* USB 2.1 (and greater) devices indicate LPM support through
         * their USB 2.0 Extended Capabilities BOS descriptor.
@@ -156,6 +156,11 @@ static int usb_device_supports_lpm(struct usb_device *udev)
                                "Power management will be impacted.\n");
                return 0;
        }
+        /* udev is root hub */
+        if (!udev->parent)
+                return 1;
        if (udev->parent->lpm_capable)
                return 1;
@@ -310,9 +315,9 @@ static void usb_set_lpm_parameters(struct usb_device *udev)
                return;
        udev_u1_del = udev->bos->ss_cap->bU1devExitLat;
-        udev_u2_del = udev->bos->ss_cap->bU2DevExitLat;
+        udev_u2_del = le16_to_cpu(udev->bos->ss_cap->bU2DevExitLat);
        hub_u1_del = udev->parent->bos->ss_cap->bU1devExitLat;
-        hub_u2_del = udev->parent->bos->ss_cap->bU2DevExitLat;
+        hub_u2_del = le16_to_cpu(udev->parent->bos->ss_cap->bU2DevExitLat);
        usb_set_lpm_mel(udev, &udev->u1_params, udev_u1_del,
                        hub, &udev->parent->u1_params, hub_u1_del);
@@ -433,7 +438,7 @@ static void set_port_led(
                        case HUB_LED_OFF: s = "off"; break;
                        case HUB_LED_AUTO: s = "auto"; break;
                        default: s = "??"; break;
-                        }; s; }),
+                        } s; }),
                        status);
 }
@@ -857,7 +862,7 @@ static int hub_hub_status(struct usb_hub *hub,
                                "%s failed (err = %d)\n", __func__, ret);
        } else {
                *status = le16_to_cpu(hub->status->hub.wHubStatus);
-                *change = le16_to_cpu(hub->status->hub.wHubChange); 
+                *change = le16_to_cpu(hub->status->hub.wHubChange);
                ret = 0;
        }
        mutex_unlock(&hub->status_mutex);
@@ -956,7 +961,7 @@ static void hub_port_logical_disconnect(struct usb_hub *hub, int port1)
         */
        set_bit(port1, hub->change_bits);
-        kick_khubd(hub);
+        kick_khubd(hub);
 }
 /**
@@ -1107,16 +1112,13 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                        /*
                         * USB3 protocol ports will automatically transition
                         * to Enabled state when detect an USB3.0 device attach.
-                         * Do not disable USB3 protocol ports.
+                         * Do not disable USB3 protocol ports, just pretend
+                         * power was lost
                         */
-                        if (!hub_is_superspeed(hdev)) {
+                        portstatus &= ~USB_PORT_STAT_ENABLE;
+                        if (!hub_is_superspeed(hdev))
                                usb_clear_port_feature(hdev, port1,
                                                   USB_PORT_FEAT_ENABLE);
-                                portstatus &= ~USB_PORT_STAT_ENABLE;
-                        } else {
-                                /* Pretend that power was lost for USB3 devs */
-                                portstatus &= ~USB_PORT_STAT_ENABLE;
-                        }
                }
                /* Clear status-change flags; we'll debounce later */
@@ -1130,6 +1132,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                        usb_clear_port_feature(hub->hdev, port1,
                                        USB_PORT_FEAT_C_ENABLE);
                }
+                if (portchange & USB_PORT_STAT_C_RESET) {
+                        need_debounce_delay = true;
+                        usb_clear_port_feature(hub->hdev, port1,
+                                        USB_PORT_FEAT_C_RESET);
+                }
                if ((portchange & USB_PORT_STAT_C_BH_RESET) &&
                                hub_is_superspeed(hub->hdev)) {
                        need_debounce_delay = true;
@@ -1361,7 +1368,7 @@ static int hub_configure(struct usb_hub *hub,
        if ((wHubCharacteristics & HUB_CHAR_COMPOUND) &&
                        !(hub_is_superspeed(hdev))) {
                int     i;
-                char    portstr [USB_MAXCHILDREN + 1];
+                char    portstr[USB_MAXCHILDREN + 1];
                for (i = 0; i < hdev->maxchild; i++)
                        portstr[i] = hub->descriptor->u.hs.DeviceRemovable
@@ -1429,32 +1436,32 @@ static int hub_configure(struct usb_hub *hub,
        /* Note 8 FS bit times == (8 bits / 12000000 bps) ~= 666ns */
        switch (wHubCharacteristics & HUB_CHAR_TTTT) {
-                case HUB_TTTT_8_BITS:
+        case HUB_TTTT_8_BITS:
-                        if (hdev->descriptor.bDeviceProtocol != 0) {
+                if (hdev->descriptor.bDeviceProtocol != 0) {
-                                hub->tt.think_time = 666;
+                        hub->tt.think_time = 666;
-                                dev_dbg(hub_dev, "TT requires at most %d "
-                                                "FS bit times (%d ns)\n",
-                                        8, hub->tt.think_time);
-                        }
-                        break;
-                case HUB_TTTT_16_BITS:
-                        hub->tt.think_time = 666 * 2;
-                        dev_dbg(hub_dev, "TT requires at most %d "
-                                        "FS bit times (%d ns)\n",
-                                16, hub->tt.think_time);
-                        break;
-                case HUB_TTTT_24_BITS:
-                        hub->tt.think_time = 666 * 3;
                        dev_dbg(hub_dev, "TT requires at most %d "
                                        "FS bit times (%d ns)\n",
-                                24, hub->tt.think_time);
+                                8, hub->tt.think_time);
-                        break;
+                }
-                case HUB_TTTT_32_BITS:
+                break;
-                        hub->tt.think_time = 666 * 4;
+        case HUB_TTTT_16_BITS:
-                        dev_dbg(hub_dev, "TT requires at most %d "
+                hub->tt.think_time = 666 * 2;
-                                        "FS bit times (%d ns)\n",
+                dev_dbg(hub_dev, "TT requires at most %d "
-                                32, hub->tt.think_time);
+                                "FS bit times (%d ns)\n",
-                        break;
+                        16, hub->tt.think_time);
+                break;
+        case HUB_TTTT_24_BITS:
+                hub->tt.think_time = 666 * 3;
+                dev_dbg(hub_dev, "TT requires at most %d "
+                                "FS bit times (%d ns)\n",
+                        24, hub->tt.think_time);
+                break;
+        case HUB_TTTT_32_BITS:
+                hub->tt.think_time = 666 * 4;
+                dev_dbg(hub_dev, "TT requires at most %d "
+                                "FS bit times (%d ns)\n",
+                        32, hub->tt.think_time);
+                break;
        }
        /* probe() zeroes hub->indicator[] */
@@ -1560,7 +1567,7 @@ static int hub_configure(struct usb_hub *hub,
        /* maybe cycle the hub leds */
        if (hub->has_indicators && blinkenlights)
-                hub->indicator [0] = INDICATOR_CYCLE;
+                hub->indicator[0] = INDICATOR_CYCLE;
        for (i = 0; i < hdev->maxchild; i++) {
                ret = usb_hub_create_port_device(hub, i + 1);
@@ -1978,7 +1985,7 @@ static void choose_devnum(struct usb_device *udev)
                if (devnum >= 128)
                        devnum = find_next_zero_bit(bus->devmap.devicemap,
                                                    128, 1);
-                bus->devnum_next = ( devnum >= 127 ? 1 : devnum + 1);
+                bus->devnum_next = (devnum >= 127 ? 1 : devnum + 1);
        }
        if (devnum < 128) {
                set_bit(devnum, bus->devmap.devicemap);
@@ -2018,8 +2025,8 @@ static void hub_free_dev(struct usb_device *udev)
 * Something got disconnected. Get rid of it and all of its children.
 *
 * If *pdev is a normal device then the parent hub must already be locked.
- * If *pdev is a root hub then this routine will acquire the
+ * If *pdev is a root hub then the caller must hold the usb_bus_list_lock,
- * usb_bus_list_lock on behalf of the caller.
+ * which protects the set of root hubs as well as the list of buses.
 *
 * Only hub drivers (including virtual root hub drivers for host
 * controllers) should ever call this.
@@ -2232,8 +2239,7 @@ static int usb_enumerate_device(struct usb_device *udev)
                udev->product = kstrdup("n/a (unauthorized)", GFP_KERNEL);
                udev->manufacturer = kstrdup("n/a (unauthorized)", GFP_KERNEL);
                udev->serial = kstrdup("n/a (unauthorized)", GFP_KERNEL);
-        }
+        } else {
-        else {
                /* read the standard strings and cache them if present */
                udev->product = usb_cache_string(udev, udev->descriptor.iProduct);
                udev->manufacturer = usb_cache_string(udev,
@@ -2489,7 +2495,7 @@ error_device_descriptor:
        usb_autosuspend_device(usb_dev);
 error_autoresume:
 out_authorized:
-        usb_unlock_device(usb_dev);     // complements locktree
+        usb_unlock_device(usb_dev);     /* complements locktree */
        return result;
 }
@@ -3108,8 +3114,8 @@ static int finish_port_resume(struct usb_device *udev)
 retry_reset_resume:
                status = usb_reset_and_verify_device(udev);
-        /* 10.5.4.5 says be sure devices in the tree are still there.
+        /* 10.5.4.5 says be sure devices in the tree are still there.
-         * For now let's assume the device didn't go crazy on resume,
+         * For now let's assume the device didn't go crazy on resume,
         * and device drivers will know about any resume quirks.
         */
        if (status == 0) {
@@ -3211,7 +3217,7 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
        if (status == 0 && !port_is_suspended(hub, portstatus))
                goto SuspendCleared;
-        // dev_dbg(hub->intfdev, "resume port %d\n", port1);
+        /* dev_dbg(hub->intfdev, "resume port %d\n", port1); */
        set_bit(port1, hub->busy_bits);
@@ -3855,7 +3861,7 @@ EXPORT_SYMBOL_GPL(usb_enable_ltm);
 * Between connect detection and reset signaling there must be a delay
 * of 100ms at least for debounce and power-settling.  The corresponding
 * timer shall restart whenever the downstream port detects a disconnect.
- * 
+ *
 * Apparently there are some bluetooth and irda-dongles and a number of
 * low-speed devices for which this debounce period may last over a second.
 * Not covered by the spec - but easy to deal with.
@@ -3949,6 +3955,32 @@ static int hub_set_address(struct usb_device *udev, int devnum)
        return retval;
 }
+/*
+ * There are reports of USB 3.0 devices that say they support USB 2.0 Link PM
+ * when they're plugged into a USB 2.0 port, but they don't work when LPM is
+ * enabled.
+ *
+ * Only enable USB 2.0 Link PM if the port is internal (hardwired), or the
+ * device says it supports the new USB 2.0 Link PM errata by setting the BESL
+ * support bit in the BOS descriptor.
+ */
+static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev)
+{
+        int connect_type;
+        if (!udev->usb2_hw_lpm_capable)
+                return;
+        connect_type = usb_get_hub_port_connect_type(udev->parent,
+                        udev->portnum);
+        if ((udev->bos->ext_cap->bmAttributes & USB_BESL_SUPPORT) ||
+                        connect_type == USB_PORT_CONNECT_TYPE_HARD_WIRED) {
+                udev->usb2_hw_lpm_allowed = 1;
+                usb_set_usb2_hardware_lpm(udev, 1);
+        }
+}
 /* Reset device, (re)assign address, get device descriptor.
 * Device connection must be stable, no more debouncing needed.
 * Returns device in USB_STATE_ADDRESS, except on error.
@@ -4055,7 +4087,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
                udev->tt = &hub->tt;
                udev->ttport = port1;
        }
- 
        /* Why interleave GET_DESCRIPTOR and SET_ADDRESS this way?
         * Because device hardware and firmware is sometimes buggy in
         * this area, and this is how Linux has done it for ages.
@@ -4130,11 +4162,11 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
 #undef GET_DESCRIPTOR_BUFSIZE
                }
-                /*
+                /*
-                 * If device is WUSB, we already assigned an
+                 * If device is WUSB, we already assigned an
-                 * unauthorized address in the Connect Ack sequence;
+                 * unauthorized address in the Connect Ack sequence;
-                 * authorization will assign the final address.
+                 * authorization will assign the final address.
-                 */
+                 */
                if (udev->wusb == 0) {
                        for (j = 0; j < SET_ADDRESS_TRIES; ++j) {
                                retval = hub_set_address(udev, devnum);
@@ -4163,7 +4195,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
                        msleep(10);
                        if (USE_NEW_SCHEME(retry_counter) && !(hcd->driver->flags & HCD_USB3))
                                break;
-                }
+                }
                retval = usb_get_device_descriptor(udev, 8);
                if (retval < 8) {
@@ -4219,7 +4251,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
                udev->ep0.desc.wMaxPacketSize = cpu_to_le16(i);
                usb_ep0_reinit(udev);
        }
-  
        retval = usb_get_device_descriptor(udev, USB_DT_DEVICE_SIZE);
        if (retval < (signed)sizeof(udev->descriptor)) {
                if (retval != -ENODEV)
@@ -4242,6 +4274,7 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
        /* notify HCD that we have a device connected and addressed */
        if (hcd->driver->update_device)
                hcd->driver->update_device(hcd, udev);
+        hub_set_initial_usb2_lpm_policy(udev);
 fail:
        if (retval) {
                hub_port_disable(hub, port1, 0);
@@ -4316,7 +4349,7 @@ hub_power_remaining (struct usb_hub *hub)
        }
        if (remaining < 0) {
                dev_warn(hub->intfdev, "%dmA over power budget!\n",
-                        - remaining);
+                        -remaining);
                remaining = 0;
        }
        return remaining;
@@ -4427,7 +4460,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
                        set_port_feature(hdev, port1, USB_PORT_FEAT_POWER);
                if (portstatus & USB_PORT_STAT_ENABLE)
-                        goto done;
+                        goto done;
                return;
        }
        if (hub_is_superspeed(hub->hdev))
@@ -4450,7 +4483,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
                }
                usb_set_device_state(udev, USB_STATE_POWERED);
-                udev->bus_mA = hub->mA_per_port;
+                udev->bus_mA = hub->mA_per_port;
                udev->level = hdev->level + 1;
                udev->wusb = hub_is_wusb(hub);
@@ -4504,7 +4537,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
                                goto loop_disable;
                        }
                }
- 
                /* check for devices running slower than they could */
                if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0200
                                && udev->speed == USB_SPEED_FULL
@@ -4564,7 +4597,7 @@ loop:
                        dev_err(hub_dev, "unable to enumerate USB device on port %d\n",
                                        port1);
        }
- 
 done:
        hub_port_disable(hub, port1, 1);
        if (hcd->driver->relinquish_port && !hub->hdev->parent)
@@ -4729,7 +4762,7 @@ static void hub_events(void)
                                 * EM interference sometimes causes badly
                                 * shielded USB devices to be shutdown by
                                 * the hub, this hack enables them again.
-                                 * Works at least with mouse driver. 
+                                 * Works at least with mouse driver.
                                 */
                                if (!(portstatus & USB_PORT_STAT_ENABLE)
                                    && !connect_change
@@ -4841,7 +4874,7 @@ static void hub_events(void)
                                dev_dbg(hub_dev, "over-current change\n");
                                clear_hub_feature(hdev, C_HUB_OVER_CURRENT);
                                msleep(500);    /* Cool down */
-                                hub_power_on(hub, true);
+                                hub_power_on(hub, true);
                                hub_hub_status(hub, &status, &unused);
                                if (status & HUB_STATUS_OVERCURRENT)
                                        dev_err(hub_dev, "over-current "
@@ -4861,7 +4894,7 @@ static void hub_events(void)
                usb_unlock_device(hdev);
                kref_put(&hub->kref, hub_release);
-        } /* end while (1) */
+        } /* end while (1) */
 }
 static int hub_thread(void *__unused)
@@ -4886,7 +4919,7 @@ static int hub_thread(void *__unused)
 static const struct usb_device_id hub_id_table[] = {
    { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
-                   | USB_DEVICE_ID_MATCH_INT_CLASS,
+                        | USB_DEVICE_ID_MATCH_INT_CLASS,
      .idVendor = USB_VENDOR_GENESYS_LOGIC,
      .bInterfaceClass = USB_CLASS_HUB,
      .driver_info = HUB_QUIRK_CHECK_PORT_AUTOSUSPEND},
@@ -5086,6 +5119,12 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
        }
        parent_hub = usb_hub_to_struct_hub(parent_hdev);
+        /* Disable USB2 hardware LPM.
+         * It will be re-enabled by the enumeration process.
+         */
+        if (udev->usb2_hw_lpm_enabled == 1)
+                usb_set_usb2_hardware_lpm(udev, 0);
        bos = udev->bos;
        udev->bos = NULL;
@@ -5120,13 +5159,13 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
        if (ret < 0)
                goto re_enumerate;
- 
        /* Device might have changed firmware (DFU or similar) */
        if (descriptors_changed(udev, &descriptor, bos)) {
                dev_info(&udev->dev, "device firmware changed\n");
                udev->descriptor = descriptor;  /* for disconnect() calls */
                goto re_enumerate;
-        }
+        }
        /* Restore the device's previous configuration */
        if (!udev->actconfig)
@@ -5151,7 +5190,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
                        udev->actconfig->desc.bConfigurationValue, ret);
                mutex_unlock(hcd->bandwidth_mutex);
                goto re_enumerate;
-        }
+        }
        mutex_unlock(hcd->bandwidth_mutex);
        usb_set_device_state(udev, USB_STATE_CONFIGURED);
@@ -5193,12 +5232,13 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
 done:
        /* Now that the alt settings are re-installed, enable LTM and LPM. */
+        usb_set_usb2_hardware_lpm(udev, 1);
        usb_unlocked_enable_lpm(udev);
        usb_enable_ltm(udev);
        usb_release_bos_descriptor(udev);
        udev->bos = bos;
        return 0;
- 
 re_enumerate:
        /* LPM state doesn't matter when we're about to destroy the device. */
        hub_port_logical_disconnect(parent_hub, port1);
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 82927e1ed27d..bb315970e475 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1182,8 +1182,12 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
                        put_device(&dev->actconfig->interface[i]->dev);
                        dev->actconfig->interface[i] = NULL;
                }
+                if (dev->usb2_hw_lpm_enabled == 1)
+                        usb_set_usb2_hardware_lpm(dev, 0);
                usb_unlocked_disable_lpm(dev);
                usb_disable_ltm(dev);
                dev->actconfig = NULL;
                if (dev->state == USB_STATE_CONFIGURED)
                        usb_set_device_state(dev, USB_STATE_ADDRESS);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 01fe36273f3b..12924dbfdc2c 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -13,6 +13,7 @@
 #include <linux/usb.h>
 #include <linux/usb/quirks.h>
+#include <linux/usb/hcd.h>
 #include "usb.h"
 /* Lists of quirky USB devices, split in device quirks and interface quirks.
@@ -161,6 +162,21 @@ static const struct usb_device_id usb_interface_quirk_list[] = {
        { }  /* terminating entry must be last */
 };
+static const struct usb_device_id usb_amd_resume_quirk_list[] = {
+        /* Lenovo Mouse with Pixart controller */
+        { USB_DEVICE(0x17ef, 0x602e), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* Pixart Mouse */
+        { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME },
+        { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME },
+        { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* Logitech Optical Mouse M90/M100 */
+        { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME },
+        { }  /* terminating entry must be last */
+};
 static bool usb_match_any_interface(struct usb_device *udev,
                                    const struct usb_device_id *id)
 {
@@ -187,6 +203,18 @@ static bool usb_match_any_interface(struct usb_device *udev,
        return false;
 }
+static int usb_amd_resume_quirk(struct usb_device *udev)
+{
+        struct usb_hcd *hcd;
+        hcd = bus_to_hcd(udev->bus);
+        /* The device should be attached directly to root hub */
+        if (udev->level == 1 && hcd->amd_resume_bug == 1)
+                return 1;
+        return 0;
+}
 static u32 __usb_detect_quirks(struct usb_device *udev,
                               const struct usb_device_id *id)
 {
@@ -212,6 +240,15 @@ static u32 __usb_detect_quirks(struct usb_device *udev,
 void usb_detect_quirks(struct usb_device *udev)
 {
        udev->quirks = __usb_detect_quirks(udev, usb_quirk_list);
+        /*
+         * Pixart-based mice would trigger remote wakeup issue on AMD
+         * Yangtze chipset, so set them as RESET_RESUME flag.
+         */
+        if (usb_amd_resume_quirk(udev))
+                udev->quirks |= __usb_detect_quirks(udev,
+                                usb_amd_resume_quirk_list);
        if (udev->quirks)
                dev_dbg(&udev->dev, "USB quirks for this device: %x\n",
                        udev->quirks);
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index 6d2c8edb1ffe..52a97adf02a0 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -23,14 +23,16 @@ static ssize_t field##_show(struct device *dev,				\
 {                                                                       \
        struct usb_device *udev;                                        \
        struct usb_host_config *actconfig;                              \
+        ssize_t rc = 0;                                                 \
                                                                        \
        udev = to_usb_device(dev);                                      \
+        usb_lock_device(udev);                                          \
        actconfig = udev->actconfig;                                    \
        if (actconfig)                                                  \
-                return sprintf(buf, format_string,                      \
+                rc = sprintf(buf, format_string,                        \
                                actconfig->desc.field);                 \
-        else                                                            \
+        usb_unlock_device(udev);                                        \
-                return 0;                                               \
+        return rc;                                                      \
 }                                                                       \
 #define usb_actconfig_attr(field, format_string)                \
@@ -45,12 +47,15 @@ static ssize_t bMaxPower_show(struct device *dev,
 {
        struct usb_device *udev;
        struct usb_host_config *actconfig;
+        ssize_t rc = 0;
        udev = to_usb_device(dev);
+        usb_lock_device(udev);
        actconfig = udev->actconfig;
-        if (!actconfig)
+        if (actconfig)
-                return 0;
+                rc = sprintf(buf, "%dmA\n", usb_get_max_power(udev, actconfig));
-        return sprintf(buf, "%dmA\n", usb_get_max_power(udev, actconfig));
+        usb_unlock_device(udev);
+        return rc;
 }
 static DEVICE_ATTR_RO(bMaxPower);
@@ -59,12 +64,15 @@ static ssize_t configuration_show(struct device *dev,
 {
        struct usb_device *udev;
        struct usb_host_config *actconfig;
+        ssize_t rc = 0;
        udev = to_usb_device(dev);
+        usb_lock_device(udev);
        actconfig = udev->actconfig;
-        if ((!actconfig) || (!actconfig->string))
+        if (actconfig && actconfig->string)
-                return 0;
+                rc = sprintf(buf, "%s\n", actconfig->string);
-        return sprintf(buf, "%s\n", actconfig->string);
+        usb_unlock_device(udev);
+        return rc;
 }
 static DEVICE_ATTR_RO(configuration);
@@ -390,7 +398,8 @@ static DEVICE_ATTR_RW(autosuspend);
 static const char on_string[] = "on";
 static const char auto_string[] = "auto";
-static void warn_level(void) {
+static void warn_level(void)
+{
        static int level_warned;
        if (!level_warned) {
@@ -449,7 +458,7 @@ static ssize_t usb2_hardware_lpm_show(struct device *dev,
        struct usb_device *udev = to_usb_device(dev);
        const char *p;
-        if (udev->usb2_hw_lpm_enabled == 1)
+        if (udev->usb2_hw_lpm_allowed == 1)
                p = "enabled";
        else
                p = "disabled";
@@ -469,8 +478,10 @@ static ssize_t usb2_hardware_lpm_store(struct device *dev,
        ret = strtobool(buf, &value);
-        if (!ret)
+        if (!ret) {
+                udev->usb2_hw_lpm_allowed = value;
                ret = usb_set_usb2_hardware_lpm(udev, value);
+        }
        usb_unlock_device(udev);
@@ -644,7 +655,7 @@ static ssize_t authorized_store(struct device *dev,
                result = usb_deauthorize_device(usb_dev);
        else
                result = usb_authorize_device(usb_dev);
-        return result < 0? result : size;
+        return result < 0 ? result : size;
 }
 static DEVICE_ATTR_IGNORE_LOCKDEP(authorized, S_IRUGO | S_IWUSR,
                                  authorized_show, authorized_store);
@@ -764,6 +775,7 @@ read_descriptors(struct file *filp, struct kobject *kobj,
         * Following that are the raw descriptor entries for all the
         * configurations (config plus subsidiary descriptors).
         */
+        usb_lock_device(udev);
        for (cfgno = -1; cfgno < udev->descriptor.bNumConfigurations &&
                        nleft > 0; ++cfgno) {
                if (cfgno < 0) {
@@ -784,6 +796,7 @@ read_descriptors(struct file *filp, struct kobject *kobj,
                        off -= srclen;
                }
        }
+        usb_unlock_device(udev);
        return count - nleft;
 }
@@ -870,9 +883,7 @@ static ssize_t interface_show(struct device *dev, struct device_attribute *attr,
        char *string;
        intf = to_usb_interface(dev);
-        string = intf->cur_altsetting->string;
+        string = ACCESS_ONCE(intf->cur_altsetting->string);
-        barrier();              /* The altsetting might change! */
        if (!string)
                return 0;
        return sprintf(buf, "%s\n", string);
@@ -888,7 +899,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
        intf = to_usb_interface(dev);
        udev = interface_to_usbdev(intf);
-        alt = intf->cur_altsetting;
+        alt = ACCESS_ONCE(intf->cur_altsetting);
        return sprintf(buf, "usb:v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02X"
                        "ic%02Xisc%02Xip%02Xin%02X\n",
@@ -909,23 +920,14 @@ static ssize_t supports_autosuspend_show(struct device *dev,
                                         struct device_attribute *attr,
                                         char *buf)
 {
-        struct usb_interface *intf;
+        int s;
-        struct usb_device *udev;
-        int ret;
-        intf = to_usb_interface(dev);
+        device_lock(dev);
-        udev = interface_to_usbdev(intf);
-        usb_lock_device(udev);
        /* Devices will be autosuspended even when an interface isn't claimed */
-        if (!intf->dev.driver ||
+        s = (!dev->driver || to_usb_driver(dev->driver)->supports_autosuspend);
-                        to_usb_driver(intf->dev.driver)->supports_autosuspend)
+        device_unlock(dev);
-                ret = sprintf(buf, "%u\n", 1);
-        else
-                ret = sprintf(buf, "%u\n", 0);
-        usb_unlock_device(udev);
-        return ret;
+        return sprintf(buf, "%u\n", s);
 }
 static DEVICE_ATTR_RO(supports_autosuspend);
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index c12bc790a6a7..e62208356c89 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -138,13 +138,19 @@ void usb_anchor_urb(struct urb *urb, struct usb_anchor *anchor)
 }
 EXPORT_SYMBOL_GPL(usb_anchor_urb);
+static int usb_anchor_check_wakeup(struct usb_anchor *anchor)
+{
+        return atomic_read(&anchor->suspend_wakeups) == 0 &&
+                list_empty(&anchor->urb_list);
+}
 /* Callers must hold anchor->lock */
 static void __usb_unanchor_urb(struct urb *urb, struct usb_anchor *anchor)
 {
        urb->anchor = NULL;
        list_del(&urb->anchor_list);
        usb_put_urb(urb);
-        if (list_empty(&anchor->urb_list))
+        if (usb_anchor_check_wakeup(anchor))
                wake_up(&anchor->wait);
 }
@@ -846,6 +852,39 @@ void usb_unlink_anchored_urbs(struct usb_anchor *anchor)
 EXPORT_SYMBOL_GPL(usb_unlink_anchored_urbs);
 /**
+ * usb_anchor_suspend_wakeups
+ * @anchor: the anchor you want to suspend wakeups on
+ *
+ * Call this to stop the last urb being unanchored from waking up any
+ * usb_wait_anchor_empty_timeout waiters. This is used in the hcd urb give-
+ * back path to delay waking up until after the completion handler has run.
+ */
+void usb_anchor_suspend_wakeups(struct usb_anchor *anchor)
+{
+        if (anchor)
+                atomic_inc(&anchor->suspend_wakeups);
+}
+EXPORT_SYMBOL_GPL(usb_anchor_suspend_wakeups);
+/**
+ * usb_anchor_resume_wakeups
+ * @anchor: the anchor you want to resume wakeups on
+ *
+ * Allow usb_wait_anchor_empty_timeout waiters to be woken up again, and
+ * wake up any current waiters if the anchor is empty.
+ */
+void usb_anchor_resume_wakeups(struct usb_anchor *anchor)
+{
+        if (!anchor)
+                return;
+        atomic_dec(&anchor->suspend_wakeups);
+        if (usb_anchor_check_wakeup(anchor))
+                wake_up(&anchor->wait);
+}
+EXPORT_SYMBOL_GPL(usb_anchor_resume_wakeups);
+/**
 * usb_wait_anchor_empty_timeout - wait for an anchor to be unused
 * @anchor: the anchor you want to become unused
 * @timeout: how long you are willing to wait in milliseconds
@@ -858,7 +897,8 @@ EXPORT_SYMBOL_GPL(usb_unlink_anchored_urbs);
 int usb_wait_anchor_empty_timeout(struct usb_anchor *anchor,
                                  unsigned int timeout)
 {
-        return wait_event_timeout(anchor->wait, list_empty(&anchor->urb_list),
+        return wait_event_timeout(anchor->wait,
+                                  usb_anchor_check_wakeup(anchor),
                                  msecs_to_jiffies(timeout));
 }
 EXPORT_SYMBOL_GPL(usb_wait_anchor_empty_timeout);
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 0a6ee2e70b25..4d1144990d4c 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -497,7 +497,7 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
                dev->authorized = 1;
        else {
                dev->authorized = usb_hcd->authorized_default;
-                dev->wusb = usb_bus_is_wusb(bus)? 1 : 0;
+                dev->wusb = usb_bus_is_wusb(bus) ? 1 : 0;
        }
        return dev;
 }
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 823857767a16..c49383669cd8 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -35,6 +35,7 @@ extern int usb_get_device_descriptor(struct usb_device *dev,
                unsigned int size);
 extern int usb_get_bos_descriptor(struct usb_device *dev);
 extern void usb_release_bos_descriptor(struct usb_device *dev);
+extern int usb_device_supports_lpm(struct usb_device *udev);
 extern char *usb_cache_string(struct usb_device *udev, int index);
 extern int usb_set_configuration(struct usb_device *dev, int configuration);
 extern int usb_choose_configuration(struct usb_device *udev);
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 474162e9d01d..74f9cf02da07 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -584,7 +584,7 @@ static int dwc3_remove(struct platform_device *pdev)
        usb_phy_set_suspend(dwc->usb2_phy, 1);
        usb_phy_set_suspend(dwc->usb3_phy, 1);
-        pm_runtime_put(&pdev->dev);
+        pm_runtime_put_sync(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
        dwc3_debugfs_exit(dwc);
@@ -691,7 +691,6 @@ static int dwc3_resume(struct device *dev)
        usb_phy_init(dwc->usb3_phy);
        usb_phy_init(dwc->usb2_phy);
-        msleep(100);
        spin_lock_irqsave(&dwc->lock, flags);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 2e252aae51ca..31443aeedcdb 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -165,7 +165,6 @@ static int dwc3_pci_probe(struct pci_dev *pci,
        return 0;
 err3:
-        pci_set_drvdata(pci, NULL);
        platform_device_put(dwc3);
 err1:
        pci_disable_device(pci);
@@ -180,7 +179,6 @@ static void dwc3_pci_remove(struct pci_dev *pci)
        platform_device_unregister(glue->dwc3);
        platform_device_unregister(glue->usb2_phy);
        platform_device_unregister(glue->usb3_phy);
-        pci_set_drvdata(pci, NULL);
        pci_disable_device(pci);
 }
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 7fa93f4bc507..95f7649c71a7 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -352,7 +352,7 @@ static int dwc3_ep0_handle_status(struct dwc3 *dwc,
                break;
        default:
                return -EINVAL;
-        };
+        }
        response_pkt = (__le16 *) dwc->setup_buf;
        *response_pkt = cpu_to_le16(usb_status);
@@ -470,7 +470,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
        default:
                return -EINVAL;
-        };
+        }
        return 0;
 }
@@ -709,7 +709,7 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
                dev_vdbg(dwc->dev, "Forwarding to gadget driver\n");
                ret = dwc3_ep0_delegate_req(dwc, ctrl);
                break;
-        };
+        }
        return ret;
 }
diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
index 5e29ddeb4d33..8cfc3191be50 100644
--- a/drivers/usb/early/ehci-dbgp.c
+++ b/drivers/usb/early/ehci-dbgp.c
@@ -568,10 +568,6 @@ try_again:
                dbgp_printk("Could not find attached debug device\n");
                goto err;
        }
-        if (ret < 0) {
-                dbgp_printk("Attached device is not a debug device\n");
-                goto err;
-        }
        dbgp_endpoint_out = dbgp_desc.bDebugOutEndpoint;
        dbgp_endpoint_in = dbgp_desc.bDebugInEndpoint;
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 48cddf3cd6b8..a91e6422f930 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -58,6 +58,20 @@ config USB_GADGET_DEBUG
           trying to track down.  Never enable these messages for a
           production build.
+config USB_GADGET_VERBOSE
+        bool "Verbose debugging Messages (DEVELOPMENT)"
+        depends on USB_GADGET_DEBUG
+        help
+           Many controller and gadget drivers will print verbose debugging
+           messages if you use this option to ask for those messages.
+           Avoid enabling these messages, even if you're actively
+           debugging such a driver.  Many drivers will emit so many
+           messages that the driver timings are affected, which will
+           either create new failure modes or remove the one you're
+           trying to track down.  Never enable these messages for a
+           production build.
 config USB_GADGET_DEBUG_FILES
        boolean "Debugging information files (DEVELOPMENT)"
        depends on PROC_FS
@@ -525,6 +539,9 @@ config USB_F_SUBSET
 config USB_F_RNDIS
        tristate
+config USB_F_MASS_STORAGE
+        tristate
 choice
        tristate "USB Gadget Drivers"
        default USB_ETH
@@ -662,6 +679,16 @@ config USB_CONFIGFS_PHONET
        help
          The Phonet protocol implementation for USB device.
+config USB_CONFIGFS_MASS_STORAGE
+        boolean "Mass storage"
+        depends on USB_CONFIGFS
+        select USB_F_MASS_STORAGE
+        help
+          The Mass Storage Gadget acts as a USB Mass Storage disk drive.
+          As its storage repository it can use a regular file or a block
+          device (in much the same way as the "loop" device driver),
+          specified as a module parameter or sysfs option.
 config USB_ZERO
        tristate "Gadget Zero (DEVELOPMENT)"
        select USB_LIBCOMPOSITE
@@ -878,6 +905,7 @@ config USB_MASS_STORAGE
        tristate "Mass Storage Gadget"
        depends on BLOCK
        select USB_LIBCOMPOSITE
+        select USB_F_MASS_STORAGE
        help
          The Mass Storage Gadget acts as a USB Mass Storage disk drive.
          As its storage repository it can use a regular file or a block
@@ -1001,6 +1029,7 @@ config USB_G_ACM_MS
        select USB_LIBCOMPOSITE
        select USB_U_SERIAL
        select USB_F_ACM
+        select USB_F_MASS_STORAGE
        help
          This driver provides two functions in one configuration:
          a mass storage, and a CDC ACM (serial port) link.
@@ -1015,8 +1044,8 @@ config USB_G_MULTI
        select USB_LIBCOMPOSITE
        select USB_U_SERIAL
        select USB_U_ETHER
-        select USB_U_RNDIS
        select USB_F_ACM
+        select USB_F_MASS_STORAGE
        help
          The Multifunction Composite Gadget provides Ethernet (RNDIS
          and/or CDC Ethernet), mass storage and ACM serial link
@@ -1035,6 +1064,8 @@ config USB_G_MULTI
 config USB_G_MULTI_RNDIS
        bool "RNDIS + CDC Serial + Storage configuration"
        depends on USB_G_MULTI
+        select USB_U_RNDIS
+        select USB_F_RNDIS
        default y
        help
          This option enables a configuration with RNDIS, CDC Serial and
@@ -1048,6 +1079,7 @@ config USB_G_MULTI_CDC
        bool "CDC Ethernet + CDC Serial + Storage configuration"
        depends on USB_G_MULTI
        default n
+        select USB_F_ECM
        help
          This option enables a configuration with CDC Ethernet (ECM), CDC
          Serial and Mass Storage functions available in the Multifunction
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index 386db9daf1d9..f1af39603d4d 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -1,7 +1,8 @@
 #
 # USB peripheral controller drivers
 #
-ccflags-$(CONFIG_USB_GADGET_DEBUG) := -DDEBUG
+ccflags-$(CONFIG_USB_GADGET_DEBUG)      := -DDEBUG
+ccflags-$(CONFIG_USB_GADGET_VERBOSE)    += -DVERBOSE_DEBUG
 obj-$(CONFIG_USB_GADGET)        += udc-core.o
 obj-$(CONFIG_USB_LIBCOMPOSITE)  += libcomposite.o
@@ -60,6 +61,8 @@ usb_f_ecm_subset-y		:= f_subset.o
 obj-$(CONFIG_USB_F_SUBSET)      += usb_f_ecm_subset.o
 usb_f_rndis-y                   := f_rndis.o
 obj-$(CONFIG_USB_F_RNDIS)       += usb_f_rndis.o
+usb_f_mass_storage-y            := f_mass_storage.o storage_common.o
+obj-$(CONFIG_USB_F_MASS_STORAGE)+= usb_f_mass_storage.o
 #
 # USB gadget drivers
diff --git a/drivers/usb/gadget/acm_ms.c b/drivers/usb/gadget/acm_ms.c
index 4b947bb50f62..7bfa134fe0e3 100644
--- a/drivers/usb/gadget/acm_ms.c
+++ b/drivers/usb/gadget/acm_ms.c
@@ -31,16 +31,7 @@
 #define ACM_MS_VENDOR_NUM       0x1d6b  /* Linux Foundation */
 #define ACM_MS_PRODUCT_NUM      0x0106  /* Composite Gadget: ACM + MS*/
-/*-------------------------------------------------------------------------*/
+#include "f_mass_storage.h"
-/*
- * Kbuild is not very cooperative with respect to linking separately
- * compiled library objects into one module.  So for now we won't use
- * separate compilation ... ensuring init/exit sections work to shrink
- * the runtime footprint, and giving us at least some parts of what
- * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
- */
-#include "f_mass_storage.c"
 /*-------------------------------------------------------------------------*/
 USB_GADGET_COMPOSITE_OPTIONS();
@@ -104,18 +95,35 @@ static struct usb_gadget_strings *dev_strings[] = {
 /****************************** Configurations ******************************/
 static struct fsg_module_parameters fsg_mod_data = { .stall = 1 };
-FSG_MODULE_PARAMETERS(/* no prefix */, fsg_mod_data);
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
-static struct fsg_common fsg_common;
+static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
+#else
+/*
+ * Number of buffers we will use.
+ * 2 is usually enough for good buffering pipeline
+ */
+#define fsg_num_buffers CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS
+#endif /* CONFIG_USB_DEBUG */
+FSG_MODULE_PARAMETERS(/* no prefix */, fsg_mod_data);
 /*-------------------------------------------------------------------------*/
 static struct usb_function *f_acm;
 static struct usb_function_instance *f_acm_inst;
+static struct usb_function_instance *fi_msg;
+static struct usb_function *f_msg;
 /*
 * We _always_ have both ACM and mass storage functions.
 */
 static int __init acm_ms_do_config(struct usb_configuration *c)
 {
+        struct fsg_opts *opts;
        int     status;
        if (gadget_is_otg(c->cdev->gadget)) {
@@ -123,31 +131,37 @@ static int __init acm_ms_do_config(struct usb_configuration *c)
                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
        }
-        f_acm_inst = usb_get_function_instance("acm");
+        opts = fsg_opts_from_func_inst(fi_msg);
-        if (IS_ERR(f_acm_inst))
-                return PTR_ERR(f_acm_inst);
        f_acm = usb_get_function(f_acm_inst);
-        if (IS_ERR(f_acm)) {
+        if (IS_ERR(f_acm))
-                status = PTR_ERR(f_acm);
+                return PTR_ERR(f_acm);
-                goto err_func;
+        f_msg = usb_get_function(fi_msg);
+        if (IS_ERR(f_msg)) {
+                status = PTR_ERR(f_msg);
+                goto put_acm;
        }
        status = usb_add_function(c, f_acm);
        if (status < 0)
-                goto err_conf;
+                goto put_msg;
-        status = fsg_bind_config(c->cdev, c, &fsg_common);
+        status = fsg_common_run_thread(opts->common);
-        if (status < 0)
+        if (status)
-                goto err_fsg;
+                goto remove_acm;
+        status = usb_add_function(c, f_msg);
+        if (status)
+                goto remove_acm;
        return 0;
-err_fsg:
+remove_acm:
        usb_remove_function(c, f_acm);
-err_conf:
+put_msg:
+        usb_put_function(f_msg);
+put_acm:
        usb_put_function(f_acm);
-err_func:
-        usb_put_function_instance(f_acm_inst);
        return status;
 }
@@ -163,45 +177,82 @@ static struct usb_configuration acm_ms_config_driver = {
 static int __init acm_ms_bind(struct usb_composite_dev *cdev)
 {
        struct usb_gadget       *gadget = cdev->gadget;
+        struct fsg_opts         *opts;
+        struct fsg_config       config;
        int                     status;
-        void                    *retp;
-        /* set up mass storage function */
+        f_acm_inst = usb_get_function_instance("acm");
-        retp = fsg_common_from_params(&fsg_common, cdev, &fsg_mod_data);
+        if (IS_ERR(f_acm_inst))
-        if (IS_ERR(retp)) {
+                return PTR_ERR(f_acm_inst);
-                status = PTR_ERR(retp);
-                return PTR_ERR(retp);
+        fi_msg = usb_get_function_instance("mass_storage");
+        if (IS_ERR(fi_msg)) {
+                status = PTR_ERR(fi_msg);
+                goto fail_get_msg;
        }
+        /* set up mass storage function */
+        fsg_config_from_params(&config, &fsg_mod_data, fsg_num_buffers);
+        opts = fsg_opts_from_func_inst(fi_msg);
+        opts->no_configfs = true;
+        status = fsg_common_set_num_buffers(opts->common, fsg_num_buffers);
+        if (status)
+                goto fail;
+        status = fsg_common_set_nluns(opts->common, config.nluns);
+        if (status)
+                goto fail_set_nluns;
+        status = fsg_common_set_cdev(opts->common, cdev, config.can_stall);
+        if (status)
+                goto fail_set_cdev;
+        fsg_common_set_sysfs(opts->common, true);
+        status = fsg_common_create_luns(opts->common, &config);
+        if (status)
+                goto fail_set_cdev;
+        fsg_common_set_inquiry_string(opts->common, config.vendor_name,
+                                      config.product_name);
        /*
         * Allocate string descriptor numbers ... note that string
         * contents can be overridden by the composite_dev glue.
         */
        status = usb_string_ids_tab(cdev, strings_dev);
        if (status < 0)
-                goto fail1;
+                goto fail_string_ids;
        device_desc.iManufacturer = strings_dev[USB_GADGET_MANUFACTURER_IDX].id;
        device_desc.iProduct = strings_dev[USB_GADGET_PRODUCT_IDX].id;
        /* register our configuration */
        status = usb_add_config(cdev, &acm_ms_config_driver, acm_ms_do_config);
        if (status < 0)
-                goto fail1;
+                goto fail_string_ids;
        usb_composite_overwrite_options(cdev, &coverwrite);
        dev_info(&gadget->dev, "%s, version: " DRIVER_VERSION "\n",
                        DRIVER_DESC);
-        fsg_common_put(&fsg_common);
        return 0;
        /* error recovery */
-fail1:
+fail_string_ids:
-        fsg_common_put(&fsg_common);
+        fsg_common_remove_luns(opts->common);
+fail_set_cdev:
+        fsg_common_free_luns(opts->common);
+fail_set_nluns:
+        fsg_common_free_buffers(opts->common);
+fail:
+        usb_put_function_instance(fi_msg);
+fail_get_msg:
+        usb_put_function_instance(f_acm_inst);
        return status;
 }
 static int __exit acm_ms_unbind(struct usb_composite_dev *cdev)
 {
+        usb_put_function(f_msg);
+        usb_put_function_instance(fi_msg);
        usb_put_function(f_acm);
        usb_put_function_instance(f_acm_inst);
        return 0;
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index a9a4346c83aa..54a1e2954cea 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -3078,8 +3078,6 @@ static void udc_pci_remove(struct pci_dev *pdev)
        if (dev->active)
                pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
        udc_remove(dev);
 }
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index d4f0f3305759..3e7ae707f691 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -354,7 +354,7 @@ static u8 encode_bMaxPower(enum usb_device_speed speed,
                return DIV_ROUND_UP(val, 8);
        default:
                return DIV_ROUND_UP(val, 2);
-        };
+        }
 }
 static int config_buf(struct usb_configuration *config,
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 8f0d6141e5e6..25885112fa35 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -557,7 +557,7 @@ static struct config_group *function_make(
        fi = usb_get_function_instance(func_name);
        if (IS_ERR(fi))
-                return ERR_PTR(PTR_ERR(fi));
+                return ERR_CAST(fi);
        ret = config_item_set_name(&fi->group.cg_item, name);
        if (ret) {
@@ -991,6 +991,14 @@ static struct configfs_subsystem gadget_subsys = {
        .su_mutex = __MUTEX_INITIALIZER(gadget_subsys.su_mutex),
 };
+void unregister_gadget_item(struct config_item *item)
+{
+        struct gadget_info *gi = to_gadget_info(item);
+        unregister_gadget(gi);
+}
+EXPORT_SYMBOL(unregister_gadget_item);
 static int __init gadget_cfs_init(void)
 {
        int ret;
diff --git a/drivers/usb/gadget/configfs.h b/drivers/usb/gadget/configfs.h
new file mode 100644
index 000000000000..a7b564a913d1
--- /dev/null
+++ b/drivers/usb/gadget/configfs.h
@@ -0,0 +1,6 @@
+#ifndef USB__GADGET__CONFIGFS__H
+#define USB__GADGET__CONFIGFS__H
+void unregister_gadget_item(struct config_item *item);
+#endif /*  USB__GADGET__CONFIGFS__H */
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index b8a2376971a4..8f4dae310923 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -544,7 +544,7 @@ static int dummy_enable(struct usb_ep *_ep,
                 default:
                         val = "ctrl";
                         break;
-                 }; val; }),
+                 } val; }),
                max, ep->stream_en ? "enabled" : "disabled");
        /* at this point real hardware should be NAKing transfers
@@ -2271,7 +2271,7 @@ static inline ssize_t show_urb(char *buf, size_t size, struct urb *urb)
                default:
                        s = "?";
                        break;
-                 }; s; }),
+                 } s; }),
                ep, ep ? (usb_pipein(urb->pipe) ? "in" : "out") : "",
                ({ char *s; \
                switch (usb_pipetype(urb->pipe)) { \
@@ -2287,7 +2287,7 @@ static inline ssize_t show_urb(char *buf, size_t size, struct urb *urb)
                default: \
                        s = "-iso"; \
                        break; \
-                }; s; }),
+                } s; }),
                urb->actual_length, urb->transfer_buffer_length);
 }
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index a01d7d38c016..a03ba2c83589 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -213,12 +213,14 @@
 #include <linux/spinlock.h>
 #include <linux/string.h>
 #include <linux/freezer.h>
+#include <linux/module.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
 #include <linux/usb/composite.h>
 #include "gadget_chips.h"
+#include "configfs.h"
 /*------------------------------------------------------------------------*/
@@ -228,26 +230,30 @@
 static const char fsg_string_interface[] = "Mass Storage";
-#include "storage_common.c"
+#include "storage_common.h"
+#include "f_mass_storage.h"
+/* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
+static struct usb_string                fsg_strings[] = {
+        {FSG_STRING_INTERFACE,          fsg_string_interface},
+        {}
+};
+static struct usb_gadget_strings        fsg_stringtab = {
+        .language       = 0x0409,               /* en-us */
+        .strings        = fsg_strings,
+};
+static struct usb_gadget_strings *fsg_strings_array[] = {
+        &fsg_stringtab,
+        NULL,
+};
 /*-------------------------------------------------------------------------*/
 struct fsg_dev;
 struct fsg_common;
-/* FSF callback functions */
-struct fsg_operations {
-        /*
-         * Callback function to call when thread exits.  If no
-         * callback is set or it returns value lower then zero MSF
-         * will force eject all LUNs it operates on (including those
-         * marked as non-removable or with prevent_medium_removal flag
-         * set).
-         */
-        int (*thread_exits)(struct fsg_common *common);
-};
 /* Data shared by all the FSG instances. */
 struct fsg_common {
        struct usb_gadget       *gadget;
@@ -268,13 +274,14 @@ struct fsg_common {
        struct fsg_buffhd       *next_buffhd_to_fill;
        struct fsg_buffhd       *next_buffhd_to_drain;
        struct fsg_buffhd       *buffhds;
+        unsigned int            fsg_num_buffers;
        int                     cmnd_size;
        u8                      cmnd[MAX_COMMAND_SIZE];
        unsigned int            nluns;
        unsigned int            lun;
-        struct fsg_lun          *luns;
+        struct fsg_lun          **luns;
        struct fsg_lun          *curlun;
        unsigned int            bulk_out_maxpacket;
@@ -294,6 +301,7 @@ struct fsg_common {
        unsigned int            short_packet_received:1;
        unsigned int            bad_lun_okay:1;
        unsigned int            running:1;
+        unsigned int            sysfs:1;
        int                     thread_wakeup_needed;
        struct completion       thread_notifier;
@@ -313,27 +321,6 @@ struct fsg_common {
        struct kref             ref;
 };
-struct fsg_config {
-        unsigned nluns;
-        struct fsg_lun_config {
-                const char *filename;
-                char ro;
-                char removable;
-                char cdrom;
-                char nofua;
-        } luns[FSG_MAX_LUNS];
-        /* Callback functions. */
-        const struct fsg_operations     *ops;
-        /* Gadget's private data. */
-        void                    *private_data;
-        const char *vendor_name;                /*  8 characters or less */
-        const char *product_name;               /* 16 characters or less */
-        char                    can_stall;
-};
 struct fsg_dev {
        struct usb_function     function;
        struct usb_gadget       *gadget;        /* Copy of cdev->gadget */
@@ -2172,7 +2159,7 @@ static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
                common->data_dir = DATA_DIR_NONE;
        common->lun = cbw->Lun;
        if (common->lun < common->nluns)
-                common->curlun = &common->luns[common->lun];
+                common->curlun = common->luns[common->lun];
        else
                common->curlun = NULL;
        common->tag = cbw->Tag;
@@ -2244,7 +2231,7 @@ reset:
        if (common->fsg) {
                fsg = common->fsg;
-                for (i = 0; i < fsg_num_buffers; ++i) {
+                for (i = 0; i < common->fsg_num_buffers; ++i) {
                        struct fsg_buffhd *bh = &common->buffhds[i];
                        if (bh->inreq) {
@@ -2303,7 +2290,7 @@ reset:
        clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
        /* Allocate the requests */
-        for (i = 0; i < fsg_num_buffers; ++i) {
+        for (i = 0; i < common->fsg_num_buffers; ++i) {
                struct fsg_buffhd       *bh = &common->buffhds[i];
                rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
@@ -2320,7 +2307,9 @@ reset:
        common->running = 1;
        for (i = 0; i < common->nluns; ++i)
-                common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+                if (common->luns[i])
+                        common->luns[i]->unit_attention_data =
+                                SS_RESET_OCCURRED;
        return rc;
 }
@@ -2372,7 +2361,7 @@ static void handle_exception(struct fsg_common *common)
        /* Cancel all the pending transfers */
        if (likely(common->fsg)) {
-                for (i = 0; i < fsg_num_buffers; ++i) {
+                for (i = 0; i < common->fsg_num_buffers; ++i) {
                        bh = &common->buffhds[i];
                        if (bh->inreq_busy)
                                usb_ep_dequeue(common->fsg->bulk_in, bh->inreq);
@@ -2384,7 +2373,7 @@ static void handle_exception(struct fsg_common *common)
                /* Wait until everything is idle */
                for (;;) {
                        int num_active = 0;
-                        for (i = 0; i < fsg_num_buffers; ++i) {
+                        for (i = 0; i < common->fsg_num_buffers; ++i) {
                                bh = &common->buffhds[i];
                                num_active += bh->inreq_busy + bh->outreq_busy;
                        }
@@ -2407,7 +2396,7 @@ static void handle_exception(struct fsg_common *common)
         */
        spin_lock_irq(&common->lock);
-        for (i = 0; i < fsg_num_buffers; ++i) {
+        for (i = 0; i < common->fsg_num_buffers; ++i) {
                bh = &common->buffhds[i];
                bh->state = BUF_STATE_EMPTY;
        }
@@ -2420,7 +2409,9 @@ static void handle_exception(struct fsg_common *common)
                common->state = FSG_STATE_STATUS_PHASE;
        else {
                for (i = 0; i < common->nluns; ++i) {
-                        curlun = &common->luns[i];
+                        curlun = common->luns[i];
+                        if (!curlun)
+                                continue;
                        curlun->prevent_medium_removal = 0;
                        curlun->sense_data = SS_NO_SENSE;
                        curlun->unit_attention_data = SS_NO_SENSE;
@@ -2462,8 +2453,9 @@ static void handle_exception(struct fsg_common *common)
                 * CONFIG_CHANGE cases.
                 */
                /* for (i = 0; i < common->nluns; ++i) */
-                /*      common->luns[i].unit_attention_data = */
+                /*      if (common->luns[i]) */
-                /*              SS_RESET_OCCURRED;  */
+                /*              common->luns[i]->unit_attention_data = */
+                /*                      SS_RESET_OCCURRED;  */
                break;
        case FSG_STATE_CONFIG_CHANGE:
@@ -2559,12 +2551,13 @@ static int fsg_main_thread(void *common_)
        if (!common->ops || !common->ops->thread_exits
         || common->ops->thread_exits(common) < 0) {
-                struct fsg_lun *curlun = common->luns;
+                struct fsg_lun **curlun_it = common->luns;
                unsigned i = common->nluns;
                down_write(&common->filesem);
-                for (; i--; ++curlun) {
+                for (; i--; ++curlun_it) {
-                        if (!fsg_lun_is_open(curlun))
+                        struct fsg_lun *curlun = *curlun_it;
+                        if (!curlun || !fsg_lun_is_open(curlun))
                                continue;
                        fsg_lun_close(curlun);
@@ -2580,6 +2573,56 @@ static int fsg_main_thread(void *common_)
 /*************************** DEVICE ATTRIBUTES ***************************/
+static ssize_t ro_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct fsg_lun          *curlun = fsg_lun_from_dev(dev);
+        return fsg_show_ro(curlun, buf);
+}
+static ssize_t nofua_show(struct device *dev, struct device_attribute *attr,
+                          char *buf)
+{
+        struct fsg_lun          *curlun = fsg_lun_from_dev(dev);
+        return fsg_show_nofua(curlun, buf);
+}
+static ssize_t file_show(struct device *dev, struct device_attribute *attr,
+                         char *buf)
+{
+        struct fsg_lun          *curlun = fsg_lun_from_dev(dev);
+        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
+        return fsg_show_file(curlun, filesem, buf);
+}
+static ssize_t ro_store(struct device *dev, struct device_attribute *attr,
+                        const char *buf, size_t count)
+{
+        struct fsg_lun          *curlun = fsg_lun_from_dev(dev);
+        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
+        return fsg_store_ro(curlun, filesem, buf, count);
+}
+static ssize_t nofua_store(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        struct fsg_lun          *curlun = fsg_lun_from_dev(dev);
+        return fsg_store_nofua(curlun, buf, count);
+}
+static ssize_t file_store(struct device *dev, struct device_attribute *attr,
+                          const char *buf, size_t count)
+{
+        struct fsg_lun          *curlun = fsg_lun_from_dev(dev);
+        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
+        return fsg_store_file(curlun, filesem, buf, count);
+}
 static DEVICE_ATTR_RW(ro);
 static DEVICE_ATTR_RW(nofua);
 static DEVICE_ATTR_RW(file);
@@ -2597,221 +2640,422 @@ static void fsg_lun_release(struct device *dev)
        /* Nothing needs to be done */
 }
-static inline void fsg_common_get(struct fsg_common *common)
+void fsg_common_get(struct fsg_common *common)
 {
        kref_get(&common->ref);
 }
+EXPORT_SYMBOL_GPL(fsg_common_get);
-static inline void fsg_common_put(struct fsg_common *common)
+void fsg_common_put(struct fsg_common *common)
 {
        kref_put(&common->ref, fsg_common_release);
 }
+EXPORT_SYMBOL_GPL(fsg_common_put);
-static struct fsg_common *fsg_common_init(struct fsg_common *common,
+/* check if fsg_num_buffers is within a valid range */
-                                          struct usb_composite_dev *cdev,
+static inline int fsg_num_buffers_validate(unsigned int fsg_num_buffers)
-                                          struct fsg_config *cfg)
 {
-        struct usb_gadget *gadget = cdev->gadget;
+        if (fsg_num_buffers >= 2 && fsg_num_buffers <= 4)
-        struct fsg_buffhd *bh;
+                return 0;
-        struct fsg_lun *curlun;
+        pr_err("fsg_num_buffers %u is out of range (%d to %d)\n",
-        struct fsg_lun_config *lcfg;
+               fsg_num_buffers, 2, 4);
-        int nluns, i, rc;
+        return -EINVAL;
-        char *pathbuf;
+}
-        rc = fsg_num_buffers_validate();
-        if (rc != 0)
-                return ERR_PTR(rc);
-        /* Find out how many LUNs there should be */
-        nluns = cfg->nluns;
-        if (nluns < 1 || nluns > FSG_MAX_LUNS) {
-                dev_err(&gadget->dev, "invalid number of LUNs: %u\n", nluns);
-                return ERR_PTR(-EINVAL);
-        }
-        /* Allocate? */
+static struct fsg_common *fsg_common_setup(struct fsg_common *common)
+{
        if (!common) {
-                common = kzalloc(sizeof *common, GFP_KERNEL);
+                common = kzalloc(sizeof(*common), GFP_KERNEL);
                if (!common)
                        return ERR_PTR(-ENOMEM);
                common->free_storage_on_release = 1;
        } else {
-                memset(common, 0, sizeof *common);
                common->free_storage_on_release = 0;
        }
+        init_rwsem(&common->filesem);
+        spin_lock_init(&common->lock);
+        kref_init(&common->ref);
+        init_completion(&common->thread_notifier);
+        init_waitqueue_head(&common->fsg_wait);
+        common->state = FSG_STATE_TERMINATED;
-        common->buffhds = kcalloc(fsg_num_buffers,
+        return common;
-                                  sizeof *(common->buffhds), GFP_KERNEL);
+}
-        if (!common->buffhds) {
-                if (common->free_storage_on_release)
+void fsg_common_set_sysfs(struct fsg_common *common, bool sysfs)
-                        kfree(common);
+{
-                return ERR_PTR(-ENOMEM);
+        common->sysfs = sysfs;
+}
+EXPORT_SYMBOL_GPL(fsg_common_set_sysfs);
+static void _fsg_common_free_buffers(struct fsg_buffhd *buffhds, unsigned n)
+{
+        if (buffhds) {
+                struct fsg_buffhd *bh = buffhds;
+                while (n--) {
+                        kfree(bh->buf);
+                        ++bh;
+                }
+                kfree(buffhds);
        }
+}
-        common->ops = cfg->ops;
+int fsg_common_set_num_buffers(struct fsg_common *common, unsigned int n)
-        common->private_data = cfg->private_data;
+{
+        struct fsg_buffhd *bh, *buffhds;
+        int i, rc;
-        common->gadget = gadget;
+        rc = fsg_num_buffers_validate(n);
-        common->ep0 = gadget->ep0;
+        if (rc != 0)
-        common->ep0req = cdev->req;
+                return rc;
-        common->cdev = cdev;
+        buffhds = kcalloc(n, sizeof(*buffhds), GFP_KERNEL);
+        if (!buffhds)
+                return -ENOMEM;
-        /* Maybe allocate device-global string IDs, and patch descriptors */
+        /* Data buffers cyclic list */
-        if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
+        bh = buffhds;
-                rc = usb_string_id(cdev);
+        i = n;
-                if (unlikely(rc < 0))
+        goto buffhds_first_it;
+        do {
+                bh->next = bh + 1;
+                ++bh;
+buffhds_first_it:
+                bh->buf = kmalloc(FSG_BUFLEN, GFP_KERNEL);
+                if (unlikely(!bh->buf))
                        goto error_release;
-                fsg_strings[FSG_STRING_INTERFACE].id = rc;
+        } while (--i);
-                fsg_intf_desc.iInterface = rc;
+        bh->next = buffhds;
-        }
+        _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
+        common->fsg_num_buffers = n;
+        common->buffhds = buffhds;
+        return 0;
+error_release:
        /*
-         * Create the LUNs, open their backing files, and register the
+         * "buf"s pointed to by heads after n - i are NULL
-         * LUN devices in sysfs.
+         * so releasing them won't hurt
         */
-        curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
+        _fsg_common_free_buffers(buffhds, n);
-        if (unlikely(!curlun)) {
-                rc = -ENOMEM;
+        return -ENOMEM;
-                goto error_release;
+}
+EXPORT_SYMBOL_GPL(fsg_common_set_num_buffers);
+static inline void fsg_common_remove_sysfs(struct fsg_lun *lun)
+{
+        device_remove_file(&lun->dev, &dev_attr_nofua);
+        /*
+         * device_remove_file() =>
+         *
+         * here the attr (e.g. dev_attr_ro) is only used to be passed to:
+         *
+         *      sysfs_remove_file() =>
+         *
+         *      here e.g. both dev_attr_ro_cdrom and dev_attr_ro are in
+         *      the same namespace and
+         *      from here only attr->name is passed to:
+         *
+         *              sysfs_hash_and_remove()
+         *
+         *              attr->name is the same for dev_attr_ro_cdrom and
+         *              dev_attr_ro
+         *              attr->name is the same for dev_attr_file and
+         *              dev_attr_file_nonremovable
+         *
+         * so we don't differentiate between removing e.g. dev_attr_ro_cdrom
+         * and dev_attr_ro
+         */
+        device_remove_file(&lun->dev, &dev_attr_ro);
+        device_remove_file(&lun->dev, &dev_attr_file);
+}
+void fsg_common_remove_lun(struct fsg_lun *lun, bool sysfs)
+{
+        if (sysfs) {
+                fsg_common_remove_sysfs(lun);
+                device_unregister(&lun->dev);
        }
-        common->luns = curlun;
+        fsg_lun_close(lun);
+        kfree(lun);
+}
+EXPORT_SYMBOL_GPL(fsg_common_remove_lun);
-        init_rwsem(&common->filesem);
+static void _fsg_common_remove_luns(struct fsg_common *common, int n)
+{
+        int i;
-        for (i = 0, lcfg = cfg->luns; i < nluns; ++i, ++curlun, ++lcfg) {
+        for (i = 0; i < n; ++i)
-                curlun->cdrom = !!lcfg->cdrom;
+                if (common->luns[i]) {
-                curlun->ro = lcfg->cdrom || lcfg->ro;
+                        fsg_common_remove_lun(common->luns[i], common->sysfs);
-                curlun->initially_ro = curlun->ro;
+                        common->luns[i] = NULL;
-                curlun->removable = lcfg->removable;
-                curlun->dev.release = fsg_lun_release;
-                curlun->dev.parent = &gadget->dev;
-                /* curlun->dev.driver = &fsg_driver.driver; XXX */
-                dev_set_drvdata(&curlun->dev, &common->filesem);
-                dev_set_name(&curlun->dev, "lun%d", i);
-                rc = device_register(&curlun->dev);
-                if (rc) {
-                        INFO(common, "failed to register LUN%d: %d\n", i, rc);
-                        common->nluns = i;
-                        put_device(&curlun->dev);
-                        goto error_release;
                }
+}
+EXPORT_SYMBOL_GPL(fsg_common_remove_luns);
-                rc = device_create_file(&curlun->dev,
+void fsg_common_remove_luns(struct fsg_common *common)
-                                        curlun->cdrom
+{
-                                      ? &dev_attr_ro_cdrom
+        _fsg_common_remove_luns(common, common->nluns);
-                                      : &dev_attr_ro);
+}
-                if (rc)
-                        goto error_luns;
-                rc = device_create_file(&curlun->dev,
-                                        curlun->removable
-                                      ? &dev_attr_file
-                                      : &dev_attr_file_nonremovable);
-                if (rc)
-                        goto error_luns;
-                rc = device_create_file(&curlun->dev, &dev_attr_nofua);
-                if (rc)
-                        goto error_luns;
-                if (lcfg->filename) {
+void fsg_common_free_luns(struct fsg_common *common)
-                        rc = fsg_lun_open(curlun, lcfg->filename);
+{
-                        if (rc)
+        fsg_common_remove_luns(common);
-                                goto error_luns;
+        kfree(common->luns);
-                } else if (!curlun->removable) {
+        common->luns = NULL;
-                        ERROR(common, "no file given for LUN%d\n", i);
+}
-                        rc = -EINVAL;
+EXPORT_SYMBOL_GPL(fsg_common_free_luns);
-                        goto error_luns;
-                }
+int fsg_common_set_nluns(struct fsg_common *common, int nluns)
+{
+        struct fsg_lun **curlun;
+        /* Find out how many LUNs there should be */
+        if (nluns < 1 || nluns > FSG_MAX_LUNS) {
+                pr_err("invalid number of LUNs: %u\n", nluns);
+                return -EINVAL;
        }
+        curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
+        if (unlikely(!curlun))
+                return -ENOMEM;
+        if (common->luns)
+                fsg_common_free_luns(common);
+        common->luns = curlun;
        common->nluns = nluns;
-        /* Data buffers cyclic list */
+        pr_info("Number of LUNs=%d\n", common->nluns);
-        bh = common->buffhds;
-        i = fsg_num_buffers;
-        goto buffhds_first_it;
-        do {
-                bh->next = bh + 1;
-                ++bh;
-buffhds_first_it:
-                bh->buf = kmalloc(FSG_BUFLEN, GFP_KERNEL);
-                if (unlikely(!bh->buf)) {
-                        rc = -ENOMEM;
-                        goto error_release;
-                }
-        } while (--i);
-        bh->next = common->buffhds;
-        /* Prepare inquiryString */
+        return 0;
-        i = get_default_bcdDevice();
+}
-        snprintf(common->inquiry_string, sizeof common->inquiry_string,
+EXPORT_SYMBOL_GPL(fsg_common_set_nluns);
-                 "%-8s%-16s%04x", cfg->vendor_name ?: "Linux",
-                 /* Assume product name dependent on the first LUN */
+void fsg_common_set_ops(struct fsg_common *common,
-                 cfg->product_name ?: (common->luns->cdrom
+                        const struct fsg_operations *ops)
-                                     ? "File-CD Gadget"
+{
-                                     : "File-Stor Gadget"),
+        common->ops = ops;
-                 i);
+}
+EXPORT_SYMBOL_GPL(fsg_common_set_ops);
+void fsg_common_free_buffers(struct fsg_common *common)
+{
+        _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
+        common->buffhds = NULL;
+}
+EXPORT_SYMBOL_GPL(fsg_common_free_buffers);
+int fsg_common_set_cdev(struct fsg_common *common,
+                         struct usb_composite_dev *cdev, bool can_stall)
+{
+        struct usb_string *us;
+        common->gadget = cdev->gadget;
+        common->ep0 = cdev->gadget->ep0;
+        common->ep0req = cdev->req;
+        common->cdev = cdev;
+        us = usb_gstrings_attach(cdev, fsg_strings_array,
+                                 ARRAY_SIZE(fsg_strings));
+        if (IS_ERR(us))
+                return PTR_ERR(us);
+        fsg_intf_desc.iInterface = us[FSG_STRING_INTERFACE].id;
        /*
         * Some peripheral controllers are known not to be able to
         * halt bulk endpoints correctly.  If one of them is present,
         * disable stalls.
         */
-        common->can_stall = cfg->can_stall &&
+        common->can_stall = can_stall && !(gadget_is_at91(common->gadget));
-                !(gadget_is_at91(common->gadget));
-        spin_lock_init(&common->lock);
+        return 0;
-        kref_init(&common->ref);
+}
+EXPORT_SYMBOL_GPL(fsg_common_set_cdev);
-        /* Tell the thread to start working */
+static inline int fsg_common_add_sysfs(struct fsg_common *common,
-        common->thread_task =
+                                       struct fsg_lun *lun)
-                kthread_create(fsg_main_thread, common, "file-storage");
+{
-        if (IS_ERR(common->thread_task)) {
+        int rc;
-                rc = PTR_ERR(common->thread_task);
-                goto error_release;
+        rc = device_register(&lun->dev);
+        if (rc) {
+                put_device(&lun->dev);
+                return rc;
        }
-        init_completion(&common->thread_notifier);
-        init_waitqueue_head(&common->fsg_wait);
-        /* Information */
+        rc = device_create_file(&lun->dev,
-        INFO(common, FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
+                                lun->cdrom
-        INFO(common, "Number of LUNs=%d\n", common->nluns);
+                              ? &dev_attr_ro_cdrom
+                              : &dev_attr_ro);
+        if (rc)
+                goto error;
+        rc = device_create_file(&lun->dev,
+                                lun->removable
+                              ? &dev_attr_file
+                              : &dev_attr_file_nonremovable);
+        if (rc)
+                goto error;
+        rc = device_create_file(&lun->dev, &dev_attr_nofua);
+        if (rc)
+                goto error;
+        return 0;
+error:
+        /* removing nonexistent files is a no-op */
+        fsg_common_remove_sysfs(lun);
+        device_unregister(&lun->dev);
+        return rc;
+}
+int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
+                          unsigned int id, const char *name,
+                          const char **name_pfx)
+{
+        struct fsg_lun *lun;
+        char *pathbuf, *p;
+        int rc = -ENOMEM;
+        if (!common->nluns || !common->luns)
+                return -ENODEV;
+        if (common->luns[id])
+                return -EBUSY;
+        if (!cfg->filename && !cfg->removable) {
+                pr_err("no file given for LUN%d\n", id);
+                return -EINVAL;
+        }
+        lun = kzalloc(sizeof(*lun), GFP_KERNEL);
+        if (!lun)
+                return -ENOMEM;
+        lun->name_pfx = name_pfx;
+        lun->cdrom = !!cfg->cdrom;
+        lun->ro = cfg->cdrom || cfg->ro;
+        lun->initially_ro = lun->ro;
+        lun->removable = !!cfg->removable;
+        if (!common->sysfs) {
+                /* we DON'T own the name!*/
+                lun->name = name;
+        } else {
+                lun->dev.release = fsg_lun_release;
+                lun->dev.parent = &common->gadget->dev;
+                dev_set_drvdata(&lun->dev, &common->filesem);
+                dev_set_name(&lun->dev, "%s", name);
+                lun->name = dev_name(&lun->dev);
+                rc = fsg_common_add_sysfs(common, lun);
+                if (rc) {
+                        pr_info("failed to register LUN%d: %d\n", id, rc);
+                        goto error_sysfs;
+                }
+        }
+        common->luns[id] = lun;
+        if (cfg->filename) {
+                rc = fsg_lun_open(lun, cfg->filename);
+                if (rc)
+                        goto error_lun;
+        }
        pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
-        for (i = 0, nluns = common->nluns, curlun = common->luns;
+        p = "(no medium)";
-             i < nluns;
+        if (fsg_lun_is_open(lun)) {
-             ++curlun, ++i) {
+                p = "(error)";
-                char *p = "(no medium)";
+                if (pathbuf) {
-                if (fsg_lun_is_open(curlun)) {
+                        p = d_path(&lun->filp->f_path, pathbuf, PATH_MAX);
-                        p = "(error)";
+                        if (IS_ERR(p))
-                        if (pathbuf) {
+                                p = "(error)";
-                                p = d_path(&curlun->filp->f_path,
-                                           pathbuf, PATH_MAX);
-                                if (IS_ERR(p))
-                                        p = "(error)";
-                        }
                }
-                LINFO(curlun, "LUN: %s%s%sfile: %s\n",
-                      curlun->removable ? "removable " : "",
-                      curlun->ro ? "read only " : "",
-                      curlun->cdrom ? "CD-ROM " : "",
-                      p);
        }
+        pr_info("LUN: %s%s%sfile: %s\n",
+              lun->removable ? "removable " : "",
+              lun->ro ? "read only " : "",
+              lun->cdrom ? "CD-ROM " : "",
+              p);
        kfree(pathbuf);
+        return 0;
+error_lun:
+        if (common->sysfs) {
+                fsg_common_remove_sysfs(lun);
+                device_unregister(&lun->dev);
+        }
+        fsg_lun_close(lun);
+        common->luns[id] = NULL;
+error_sysfs:
+        kfree(lun);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(fsg_common_create_lun);
+int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg)
+{
+        char buf[8]; /* enough for 100000000 different numbers, decimal */
+        int i, rc;
+        for (i = 0; i < common->nluns; ++i) {
+                snprintf(buf, sizeof(buf), "lun%d", i);
+                rc = fsg_common_create_lun(common, &cfg->luns[i], i, buf, NULL);
+                if (rc)
+                        goto fail;
+        }
+        pr_info("Number of LUNs=%d\n", common->nluns);
+        return 0;
+fail:
+        _fsg_common_remove_luns(common, i);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(fsg_common_create_luns);
+void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn,
+                                   const char *pn)
+{
+        int i;
+        /* Prepare inquiryString */
+        i = get_default_bcdDevice();
+        snprintf(common->inquiry_string, sizeof(common->inquiry_string),
+                 "%-8s%-16s%04x", vn ?: "Linux",
+                 /* Assume product name dependent on the first LUN */
+                 pn ?: ((*common->luns)->cdrom
+                     ? "File-CD Gadget"
+                     : "File-Stor Gadget"),
+                 i);
+}
+EXPORT_SYMBOL_GPL(fsg_common_set_inquiry_string);
+int fsg_common_run_thread(struct fsg_common *common)
+{
+        common->state = FSG_STATE_IDLE;
+        /* Tell the thread to start working */
+        common->thread_task =
+                kthread_create(fsg_main_thread, common, "file-storage");
+        if (IS_ERR(common->thread_task)) {
+                common->state = FSG_STATE_TERMINATED;
+                return PTR_ERR(common->thread_task);
+        }
        DBG(common, "I/O thread pid: %d\n", task_pid_nr(common->thread_task));
        wake_up_process(common->thread_task);
-        return common;
+        return 0;
-error_luns:
-        common->nluns = i + 1;
-error_release:
-        common->state = FSG_STATE_TERMINATED;   /* The thread is dead */
-        /* Call fsg_common_release() directly, ref might be not initialised. */
-        fsg_common_release(&common->ref);
-        return ERR_PTR(rc);
 }
+EXPORT_SYMBOL_GPL(fsg_common_run_thread);
 static void fsg_common_release(struct kref *ref)
 {
@@ -2824,36 +3068,26 @@ static void fsg_common_release(struct kref *ref)
        }
        if (likely(common->luns)) {
-                struct fsg_lun *lun = common->luns;
+                struct fsg_lun **lun_it = common->luns;
                unsigned i = common->nluns;
                /* In error recovery common->nluns may be zero. */
-                for (; i; --i, ++lun) {
+                for (; i; --i, ++lun_it) {
-                        device_remove_file(&lun->dev, &dev_attr_nofua);
+                        struct fsg_lun *lun = *lun_it;
-                        device_remove_file(&lun->dev,
+                        if (!lun)
-                                           lun->cdrom
+                                continue;
-                                         ? &dev_attr_ro_cdrom
+                        if (common->sysfs)
-                                         : &dev_attr_ro);
+                                fsg_common_remove_sysfs(lun);
-                        device_remove_file(&lun->dev,
-                                           lun->removable
-                                         ? &dev_attr_file
-                                         : &dev_attr_file_nonremovable);
                        fsg_lun_close(lun);
-                        device_unregister(&lun->dev);
+                        if (common->sysfs)
+                                device_unregister(&lun->dev);
+                        kfree(lun);
                }
                kfree(common->luns);
        }
-        {
+        _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
-                struct fsg_buffhd *bh = common->buffhds;
-                unsigned i = fsg_num_buffers;
-                do {
-                        kfree(bh->buf);
-                } while (++bh, --i);
-        }
-        kfree(common->buffhds);
        if (common->free_storage_on_release)
                kfree(common);
 }
@@ -2861,24 +3095,6 @@ static void fsg_common_release(struct kref *ref)
 /*-------------------------------------------------------------------------*/
-static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
-{
-        struct fsg_dev          *fsg = fsg_from_func(f);
-        struct fsg_common       *common = fsg->common;
-        DBG(fsg, "unbind\n");
-        if (fsg->common->fsg == fsg) {
-                fsg->common->new_fsg = NULL;
-                raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
-                /* FIXME: make interruptible or killable somehow? */
-                wait_event(common->fsg_wait, common->fsg != fsg);
-        }
-        fsg_common_put(common);
-        usb_free_all_descriptors(&fsg->function);
-        kfree(fsg);
-}
 static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
 {
        struct fsg_dev          *fsg = fsg_from_func(f);
@@ -2887,6 +3103,19 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
        struct usb_ep           *ep;
        unsigned                max_burst;
        int                     ret;
+        struct fsg_opts         *opts;
+        opts = fsg_opts_from_func_inst(f->fi);
+        if (!opts->no_configfs) {
+                ret = fsg_common_set_cdev(fsg->common, c->cdev,
+                                          fsg->common->can_stall);
+                if (ret)
+                        return ret;
+                fsg_common_set_inquiry_string(fsg->common, 0, 0);
+                ret = fsg_common_run_thread(fsg->common);
+                if (ret)
+                        return ret;
+        }
        fsg->gadget = gadget;
@@ -2939,95 +3168,472 @@ autoconf_fail:
        return -ENOTSUPP;
 }
-/****************************** ADD FUNCTION ******************************/
+/****************************** ALLOCATE FUNCTION *************************/
-static struct usb_gadget_strings *fsg_strings_array[] = {
+static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
-        &fsg_stringtab,
+{
+        struct fsg_dev          *fsg = fsg_from_func(f);
+        struct fsg_common       *common = fsg->common;
+        DBG(fsg, "unbind\n");
+        if (fsg->common->fsg == fsg) {
+                fsg->common->new_fsg = NULL;
+                raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+                /* FIXME: make interruptible or killable somehow? */
+                wait_event(common->fsg_wait, common->fsg != fsg);
+        }
+        usb_free_all_descriptors(&fsg->function);
+}
+static inline struct fsg_lun_opts *to_fsg_lun_opts(struct config_item *item)
+{
+        return container_of(to_config_group(item), struct fsg_lun_opts, group);
+}
+static inline struct fsg_opts *to_fsg_opts(struct config_item *item)
+{
+        return container_of(to_config_group(item), struct fsg_opts,
+                            func_inst.group);
+}
+CONFIGFS_ATTR_STRUCT(fsg_lun_opts);
+CONFIGFS_ATTR_OPS(fsg_lun_opts);
+static void fsg_lun_attr_release(struct config_item *item)
+{
+        struct fsg_lun_opts *lun_opts;
+        lun_opts = to_fsg_lun_opts(item);
+        kfree(lun_opts);
+}
+static struct configfs_item_operations fsg_lun_item_ops = {
+        .release                = fsg_lun_attr_release,
+        .show_attribute         = fsg_lun_opts_attr_show,
+        .store_attribute        = fsg_lun_opts_attr_store,
+};
+static ssize_t fsg_lun_opts_file_show(struct fsg_lun_opts *opts, char *page)
+{
+        struct fsg_opts *fsg_opts;
+        fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
+        return fsg_show_file(opts->lun, &fsg_opts->common->filesem, page);
+}
+static ssize_t fsg_lun_opts_file_store(struct fsg_lun_opts *opts,
+                                       const char *page, size_t len)
+{
+        struct fsg_opts *fsg_opts;
+        fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
+        return fsg_store_file(opts->lun, &fsg_opts->common->filesem, page, len);
+}
+static struct fsg_lun_opts_attribute fsg_lun_opts_file =
+        __CONFIGFS_ATTR(file, S_IRUGO | S_IWUSR, fsg_lun_opts_file_show,
+                        fsg_lun_opts_file_store);
+static ssize_t fsg_lun_opts_ro_show(struct fsg_lun_opts *opts, char *page)
+{
+        return fsg_show_ro(opts->lun, page);
+}
+static ssize_t fsg_lun_opts_ro_store(struct fsg_lun_opts *opts,
+                                       const char *page, size_t len)
+{
+        struct fsg_opts *fsg_opts;
+        fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
+        return fsg_store_ro(opts->lun, &fsg_opts->common->filesem, page, len);
+}
+static struct fsg_lun_opts_attribute fsg_lun_opts_ro =
+        __CONFIGFS_ATTR(ro, S_IRUGO | S_IWUSR, fsg_lun_opts_ro_show,
+                        fsg_lun_opts_ro_store);
+static ssize_t fsg_lun_opts_removable_show(struct fsg_lun_opts *opts,
+                                           char *page)
+{
+        return fsg_show_removable(opts->lun, page);
+}
+static ssize_t fsg_lun_opts_removable_store(struct fsg_lun_opts *opts,
+                                       const char *page, size_t len)
+{
+        return fsg_store_removable(opts->lun, page, len);
+}
+static struct fsg_lun_opts_attribute fsg_lun_opts_removable =
+        __CONFIGFS_ATTR(removable, S_IRUGO | S_IWUSR,
+                        fsg_lun_opts_removable_show,
+                        fsg_lun_opts_removable_store);
+static ssize_t fsg_lun_opts_cdrom_show(struct fsg_lun_opts *opts, char *page)
+{
+        return fsg_show_cdrom(opts->lun, page);
+}
+static ssize_t fsg_lun_opts_cdrom_store(struct fsg_lun_opts *opts,
+                                       const char *page, size_t len)
+{
+        struct fsg_opts *fsg_opts;
+        fsg_opts = to_fsg_opts(opts->group.cg_item.ci_parent);
+        return fsg_store_cdrom(opts->lun, &fsg_opts->common->filesem, page,
+                               len);
+}
+static struct fsg_lun_opts_attribute fsg_lun_opts_cdrom =
+        __CONFIGFS_ATTR(cdrom, S_IRUGO | S_IWUSR, fsg_lun_opts_cdrom_show,
+                        fsg_lun_opts_cdrom_store);
+static ssize_t fsg_lun_opts_nofua_show(struct fsg_lun_opts *opts, char *page)
+{
+        return fsg_show_nofua(opts->lun, page);
+}
+static ssize_t fsg_lun_opts_nofua_store(struct fsg_lun_opts *opts,
+                                       const char *page, size_t len)
+{
+        return fsg_store_nofua(opts->lun, page, len);
+}
+static struct fsg_lun_opts_attribute fsg_lun_opts_nofua =
+        __CONFIGFS_ATTR(nofua, S_IRUGO | S_IWUSR, fsg_lun_opts_nofua_show,
+                        fsg_lun_opts_nofua_store);
+static struct configfs_attribute *fsg_lun_attrs[] = {
+        &fsg_lun_opts_file.attr,
+        &fsg_lun_opts_ro.attr,
+        &fsg_lun_opts_removable.attr,
+        &fsg_lun_opts_cdrom.attr,
+        &fsg_lun_opts_nofua.attr,
        NULL,
 };
-static int fsg_bind_config(struct usb_composite_dev *cdev,
+static struct config_item_type fsg_lun_type = {
-                           struct usb_configuration *c,
+        .ct_item_ops    = &fsg_lun_item_ops,
-                           struct fsg_common *common)
+        .ct_attrs       = fsg_lun_attrs,
+        .ct_owner       = THIS_MODULE,
+};
+static struct config_group *fsg_lun_make(struct config_group *group,
+                                         const char *name)
 {
-        struct fsg_dev *fsg;
+        struct fsg_lun_opts *opts;
+        struct fsg_opts *fsg_opts;
+        struct fsg_lun_config config;
+        char *num_str;
+        u8 num;
+        int ret;
+        num_str = strchr(name, '.');
+        if (!num_str) {
+                pr_err("Unable to locate . in LUN.NUMBER\n");
+                return ERR_PTR(-EINVAL);
+        }
+        num_str++;
+        ret = kstrtou8(num_str, 0, &num);
+        if (ret)
+                return ERR_PTR(ret);
+        fsg_opts = to_fsg_opts(&group->cg_item);
+        if (num >= FSG_MAX_LUNS)
+                return ERR_PTR(-ERANGE);
+        mutex_lock(&fsg_opts->lock);
+        if (fsg_opts->refcnt || fsg_opts->common->luns[num]) {
+                ret = -EBUSY;
+                goto out;
+        }
+        opts = kzalloc(sizeof(*opts), GFP_KERNEL);
+        if (!opts) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        memset(&config, 0, sizeof(config));
+        config.removable = true;
+        ret = fsg_common_create_lun(fsg_opts->common, &config, num, name,
+                                    (const char **)&group->cg_item.ci_name);
+        if (ret) {
+                kfree(opts);
+                goto out;
+        }
+        opts->lun = fsg_opts->common->luns[num];
+        opts->lun_id = num;
+        mutex_unlock(&fsg_opts->lock);
+        config_group_init_type_name(&opts->group, name, &fsg_lun_type);
+        return &opts->group;
+out:
+        mutex_unlock(&fsg_opts->lock);
+        return ERR_PTR(ret);
+}
+static void fsg_lun_drop(struct config_group *group, struct config_item *item)
+{
+        struct fsg_lun_opts *lun_opts;
+        struct fsg_opts *fsg_opts;
+        lun_opts = to_fsg_lun_opts(item);
+        fsg_opts = to_fsg_opts(&group->cg_item);
+        mutex_lock(&fsg_opts->lock);
+        if (fsg_opts->refcnt) {
+                struct config_item *gadget;
+                gadget = group->cg_item.ci_parent->ci_parent;
+                unregister_gadget_item(gadget);
+        }
+        fsg_common_remove_lun(lun_opts->lun, fsg_opts->common->sysfs);
+        fsg_opts->common->luns[lun_opts->lun_id] = NULL;
+        lun_opts->lun_id = 0;
+        mutex_unlock(&fsg_opts->lock);
+        config_item_put(item);
+}
+CONFIGFS_ATTR_STRUCT(fsg_opts);
+CONFIGFS_ATTR_OPS(fsg_opts);
+static void fsg_attr_release(struct config_item *item)
+{
+        struct fsg_opts *opts = to_fsg_opts(item);
+        usb_put_function_instance(&opts->func_inst);
+}
+static struct configfs_item_operations fsg_item_ops = {
+        .release                = fsg_attr_release,
+        .show_attribute         = fsg_opts_attr_show,
+        .store_attribute        = fsg_opts_attr_store,
+};
+static ssize_t fsg_opts_stall_show(struct fsg_opts *opts, char *page)
+{
+        int result;
+        mutex_lock(&opts->lock);
+        result = sprintf(page, "%d", opts->common->can_stall);
+        mutex_unlock(&opts->lock);
+        return result;
+}
+static ssize_t fsg_opts_stall_store(struct fsg_opts *opts, const char *page,
+                                    size_t len)
+{
+        int ret;
+        bool stall;
+        mutex_lock(&opts->lock);
+        if (opts->refcnt) {
+                mutex_unlock(&opts->lock);
+                return -EBUSY;
+        }
+        ret = strtobool(page, &stall);
+        if (!ret) {
+                opts->common->can_stall = stall;
+                ret = len;
+        }
+        mutex_unlock(&opts->lock);
+        return ret;
+}
+static struct fsg_opts_attribute fsg_opts_stall =
+        __CONFIGFS_ATTR(stall, S_IRUGO | S_IWUSR, fsg_opts_stall_show,
+                        fsg_opts_stall_store);
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+static ssize_t fsg_opts_num_buffers_show(struct fsg_opts *opts, char *page)
+{
+        int result;
+        mutex_lock(&opts->lock);
+        result = sprintf(page, "%d", opts->common->fsg_num_buffers);
+        mutex_unlock(&opts->lock);
+        return result;
+}
+static ssize_t fsg_opts_num_buffers_store(struct fsg_opts *opts,
+                                          const char *page, size_t len)
+{
+        int ret;
+        u8 num;
+        mutex_lock(&opts->lock);
+        if (opts->refcnt) {
+                ret = -EBUSY;
+                goto end;
+        }
+        ret = kstrtou8(page, 0, &num);
+        if (ret)
+                goto end;
+        ret = fsg_num_buffers_validate(num);
+        if (ret)
+                goto end;
+        fsg_common_set_num_buffers(opts->common, num);
+        ret = len;
+end:
+        mutex_unlock(&opts->lock);
+        return ret;
+}
+static struct fsg_opts_attribute fsg_opts_num_buffers =
+        __CONFIGFS_ATTR(num_buffers, S_IRUGO | S_IWUSR,
+                        fsg_opts_num_buffers_show,
+                        fsg_opts_num_buffers_store);
+#endif
+static struct configfs_attribute *fsg_attrs[] = {
+        &fsg_opts_stall.attr,
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+        &fsg_opts_num_buffers.attr,
+#endif
+        NULL,
+};
+static struct configfs_group_operations fsg_group_ops = {
+        .make_group     = fsg_lun_make,
+        .drop_item      = fsg_lun_drop,
+};
+static struct config_item_type fsg_func_type = {
+        .ct_item_ops    = &fsg_item_ops,
+        .ct_group_ops   = &fsg_group_ops,
+        .ct_attrs       = fsg_attrs,
+        .ct_owner       = THIS_MODULE,
+};
+static void fsg_free_inst(struct usb_function_instance *fi)
+{
+        struct fsg_opts *opts;
+        opts = fsg_opts_from_func_inst(fi);
+        fsg_common_put(opts->common);
+        kfree(opts);
+}
+static struct usb_function_instance *fsg_alloc_inst(void)
+{
+        struct fsg_opts *opts;
+        struct fsg_lun_config config;
        int rc;
-        fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
+        opts = kzalloc(sizeof(*opts), GFP_KERNEL);
+        if (!opts)
+                return ERR_PTR(-ENOMEM);
+        mutex_init(&opts->lock);
+        opts->func_inst.free_func_inst = fsg_free_inst;
+        opts->common = fsg_common_setup(opts->common);
+        if (IS_ERR(opts->common)) {
+                rc = PTR_ERR(opts->common);
+                goto release_opts;
+        }
+        rc = fsg_common_set_nluns(opts->common, FSG_MAX_LUNS);
+        if (rc)
+                goto release_opts;
+        rc = fsg_common_set_num_buffers(opts->common,
+                                        CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS);
+        if (rc)
+                goto release_luns;
+        pr_info(FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
+        memset(&config, 0, sizeof(config));
+        config.removable = true;
+        rc = fsg_common_create_lun(opts->common, &config, 0, "lun.0",
+                        (const char **)&opts->func_inst.group.cg_item.ci_name);
+        opts->lun0.lun = opts->common->luns[0];
+        opts->lun0.lun_id = 0;
+        config_group_init_type_name(&opts->lun0.group, "lun.0", &fsg_lun_type);
+        opts->default_groups[0] = &opts->lun0.group;
+        opts->func_inst.group.default_groups = opts->default_groups;
+        config_group_init_type_name(&opts->func_inst.group, "", &fsg_func_type);
+        return &opts->func_inst;
+release_luns:
+        kfree(opts->common->luns);
+release_opts:
+        kfree(opts);
+        return ERR_PTR(rc);
+}
+static void fsg_free(struct usb_function *f)
+{
+        struct fsg_dev *fsg;
+        struct fsg_opts *opts;
+        fsg = container_of(f, struct fsg_dev, function);
+        opts = container_of(f->fi, struct fsg_opts, func_inst);
+        mutex_lock(&opts->lock);
+        opts->refcnt--;
+        mutex_unlock(&opts->lock);
+        kfree(fsg);
+}
+static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
+{
+        struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
+        struct fsg_common *common = opts->common;
+        struct fsg_dev *fsg;
+        fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
        if (unlikely(!fsg))
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
-        fsg->function.name        = FSG_DRIVER_DESC;
+        mutex_lock(&opts->lock);
-        fsg->function.strings     = fsg_strings_array;
+        opts->refcnt++;
-        fsg->function.bind        = fsg_bind;
+        mutex_unlock(&opts->lock);
-        fsg->function.unbind      = fsg_unbind;
+        fsg->function.name      = FSG_DRIVER_DESC;
-        fsg->function.setup       = fsg_setup;
+        fsg->function.bind      = fsg_bind;
-        fsg->function.set_alt     = fsg_set_alt;
+        fsg->function.unbind    = fsg_unbind;
-        fsg->function.disable     = fsg_disable;
+        fsg->function.setup     = fsg_setup;
+        fsg->function.set_alt   = fsg_set_alt;
+        fsg->function.disable   = fsg_disable;
+        fsg->function.free_func = fsg_free;
        fsg->common               = common;
-        /*
-         * Our caller holds a reference to common structure so we
-         * don't have to be worry about it being freed until we return
-         * from this function.  So instead of incrementing counter now
-         * and decrement in error recovery we increment it only when
-         * call to usb_add_function() was successful.
-         */
-        rc = usb_add_function(c, &fsg->function);
+        return &fsg->function;
-        if (unlikely(rc))
-                kfree(fsg);
-        else
-                fsg_common_get(fsg->common);
-        return rc;
 }
+DECLARE_USB_FUNCTION_INIT(mass_storage, fsg_alloc_inst, fsg_alloc);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Michal Nazarewicz");
 /************************* Module parameters *************************/
-struct fsg_module_parameters {
-        char            *file[FSG_MAX_LUNS];
-        bool            ro[FSG_MAX_LUNS];
-        bool            removable[FSG_MAX_LUNS];
-        bool            cdrom[FSG_MAX_LUNS];
-        bool            nofua[FSG_MAX_LUNS];
-        unsigned int    file_count, ro_count, removable_count, cdrom_count;
-        unsigned int    nofua_count;
-        unsigned int    luns;   /* nluns */
-        bool            stall;  /* can_stall */
-};
-#define _FSG_MODULE_PARAM_ARRAY(prefix, params, name, type, desc)       \
+void fsg_config_from_params(struct fsg_config *cfg,
-        module_param_array_named(prefix ## name, params.name, type,     \
+                       const struct fsg_module_parameters *params,
-                                 &prefix ## params.name ## _count,      \
+                       unsigned int fsg_num_buffers)
-                                 S_IRUGO);                              \
-        MODULE_PARM_DESC(prefix ## name, desc)
-#define _FSG_MODULE_PARAM(prefix, params, name, type, desc)             \
-        module_param_named(prefix ## name, params.name, type,           \
-                           S_IRUGO);                                    \
-        MODULE_PARM_DESC(prefix ## name, desc)
-#define FSG_MODULE_PARAMETERS(prefix, params)                           \
-        _FSG_MODULE_PARAM_ARRAY(prefix, params, file, charp,            \
-                                "names of backing files or devices");   \
-        _FSG_MODULE_PARAM_ARRAY(prefix, params, ro, bool,               \
-                                "true to force read-only");             \
-        _FSG_MODULE_PARAM_ARRAY(prefix, params, removable, bool,        \
-                                "true to simulate removable media");    \
-        _FSG_MODULE_PARAM_ARRAY(prefix, params, cdrom, bool,            \
-                                "true to simulate CD-ROM instead of disk"); \
-        _FSG_MODULE_PARAM_ARRAY(prefix, params, nofua, bool,            \
-                                "true to ignore SCSI WRITE(10,12) FUA bit"); \
-        _FSG_MODULE_PARAM(prefix, params, luns, uint,                   \
-                          "number of LUNs");                            \
-        _FSG_MODULE_PARAM(prefix, params, stall, bool,                  \
-                          "false to prevent bulk stalls")
-static void
-fsg_config_from_params(struct fsg_config *cfg,
-                       const struct fsg_module_parameters *params)
 {
        struct fsg_lun_config *lun;
        unsigned i;
@@ -3055,19 +3661,7 @@ fsg_config_from_params(struct fsg_config *cfg,
        /* Finalise */
        cfg->can_stall = params->stall;
+        cfg->fsg_num_buffers = fsg_num_buffers;
 }
+EXPORT_SYMBOL_GPL(fsg_config_from_params);
-static inline struct fsg_common *
-fsg_common_from_params(struct fsg_common *common,
-                       struct usb_composite_dev *cdev,
-                       const struct fsg_module_parameters *params)
-        __attribute__((unused));
-static inline struct fsg_common *
-fsg_common_from_params(struct fsg_common *common,
-                       struct usb_composite_dev *cdev,
-                       const struct fsg_module_parameters *params)
-{
-        struct fsg_config cfg;
-        fsg_config_from_params(&cfg, params);
-        return fsg_common_init(common, cdev, &cfg);
-}
diff --git a/drivers/usb/gadget/f_mass_storage.h b/drivers/usb/gadget/f_mass_storage.h
new file mode 100644
index 000000000000..b4866fcef30b
--- /dev/null
+++ b/drivers/usb/gadget/f_mass_storage.h
@@ -0,0 +1,166 @@
+#ifndef USB_F_MASS_STORAGE_H
+#define USB_F_MASS_STORAGE_H
+#include <linux/usb/composite.h>
+#include "storage_common.h"
+struct fsg_module_parameters {
+        char            *file[FSG_MAX_LUNS];
+        bool            ro[FSG_MAX_LUNS];
+        bool            removable[FSG_MAX_LUNS];
+        bool            cdrom[FSG_MAX_LUNS];
+        bool            nofua[FSG_MAX_LUNS];
+        unsigned int    file_count, ro_count, removable_count, cdrom_count;
+        unsigned int    nofua_count;
+        unsigned int    luns;   /* nluns */
+        bool            stall;  /* can_stall */
+};
+#define _FSG_MODULE_PARAM_ARRAY(prefix, params, name, type, desc)       \
+        module_param_array_named(prefix ## name, params.name, type,     \
+                                 &prefix ## params.name ## _count,      \
+                                 S_IRUGO);                              \
+        MODULE_PARM_DESC(prefix ## name, desc)
+#define _FSG_MODULE_PARAM(prefix, params, name, type, desc)             \
+        module_param_named(prefix ## name, params.name, type,           \
+                           S_IRUGO);                                    \
+        MODULE_PARM_DESC(prefix ## name, desc)
+#define __FSG_MODULE_PARAMETERS(prefix, params)                         \
+        _FSG_MODULE_PARAM_ARRAY(prefix, params, file, charp,            \
+                                "names of backing files or devices");   \
+        _FSG_MODULE_PARAM_ARRAY(prefix, params, ro, bool,               \
+                                "true to force read-only");             \
+        _FSG_MODULE_PARAM_ARRAY(prefix, params, removable, bool,        \
+                                "true to simulate removable media");    \
+        _FSG_MODULE_PARAM_ARRAY(prefix, params, cdrom, bool,            \
+                                "true to simulate CD-ROM instead of disk"); \
+        _FSG_MODULE_PARAM_ARRAY(prefix, params, nofua, bool,            \
+                                "true to ignore SCSI WRITE(10,12) FUA bit"); \
+        _FSG_MODULE_PARAM(prefix, params, luns, uint,                   \
+                          "number of LUNs");                            \
+        _FSG_MODULE_PARAM(prefix, params, stall, bool,                  \
+                          "false to prevent bulk stalls")
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+#define FSG_MODULE_PARAMETERS(prefix, params)                           \
+        __FSG_MODULE_PARAMETERS(prefix, params);                        \
+        module_param_named(num_buffers, fsg_num_buffers, uint, S_IRUGO);\
+        MODULE_PARM_DESC(num_buffers, "Number of pipeline buffers")
+#else
+#define FSG_MODULE_PARAMETERS(prefix, params)                           \
+        __FSG_MODULE_PARAMETERS(prefix, params)
+#endif
+struct fsg_common;
+/* FSF callback functions */
+struct fsg_operations {
+        /*
+         * Callback function to call when thread exits.  If no
+         * callback is set or it returns value lower then zero MSF
+         * will force eject all LUNs it operates on (including those
+         * marked as non-removable or with prevent_medium_removal flag
+         * set).
+         */
+        int (*thread_exits)(struct fsg_common *common);
+};
+struct fsg_lun_opts {
+        struct config_group group;
+        struct fsg_lun *lun;
+        int lun_id;
+};
+struct fsg_opts {
+        struct fsg_common *common;
+        struct usb_function_instance func_inst;
+        struct fsg_lun_opts lun0;
+        struct config_group *default_groups[2];
+        bool no_configfs; /* for legacy gadgets */
+        /*
+         * Read/write access to configfs attributes is handled by configfs.
+         *
+         * This is to protect the data from concurrent access by read/write
+         * and create symlink/remove symlink.
+         */
+        struct mutex                    lock;
+        int                             refcnt;
+};
+struct fsg_lun_config {
+        const char *filename;
+        char ro;
+        char removable;
+        char cdrom;
+        char nofua;
+};
+struct fsg_config {
+        unsigned nluns;
+        struct fsg_lun_config luns[FSG_MAX_LUNS];
+        /* Callback functions. */
+        const struct fsg_operations     *ops;
+        /* Gadget's private data. */
+        void                    *private_data;
+        const char *vendor_name;                /*  8 characters or less */
+        const char *product_name;               /* 16 characters or less */
+        char                    can_stall;
+        unsigned int            fsg_num_buffers;
+};
+static inline struct fsg_opts *
+fsg_opts_from_func_inst(const struct usb_function_instance *fi)
+{
+        return container_of(fi, struct fsg_opts, func_inst);
+}
+void fsg_common_get(struct fsg_common *common);
+void fsg_common_put(struct fsg_common *common);
+void fsg_common_set_sysfs(struct fsg_common *common, bool sysfs);
+int fsg_common_set_num_buffers(struct fsg_common *common, unsigned int n);
+void fsg_common_free_buffers(struct fsg_common *common);
+int fsg_common_set_cdev(struct fsg_common *common,
+                        struct usb_composite_dev *cdev, bool can_stall);
+void fsg_common_remove_lun(struct fsg_lun *lun, bool sysfs);
+void fsg_common_remove_luns(struct fsg_common *common);
+void fsg_common_free_luns(struct fsg_common *common);
+int fsg_common_set_nluns(struct fsg_common *common, int nluns);
+void fsg_common_set_ops(struct fsg_common *common,
+                        const struct fsg_operations *ops);
+int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
+                          unsigned int id, const char *name,
+                          const char **name_pfx);
+int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg);
+void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn,
+                                   const char *pn);
+int fsg_common_run_thread(struct fsg_common *common);
+void fsg_config_from_params(struct fsg_config *cfg,
+                            const struct fsg_module_parameters *params,
+                            unsigned int fsg_num_buffers);
+#endif /* USB_F_MASS_STORAGE_H */
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index 5327c82472ed..2344efe4f4ce 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -76,7 +76,9 @@ struct gfs_ffs_obj {
 USB_GADGET_COMPOSITE_OPTIONS();
+#if defined CONFIG_USB_FUNCTIONFS_ETH || defined CONFIG_USB_FUNCTIONFS_RNDIS
 USB_ETHERNET_MODULE_PARAMETERS();
+#endif
 static struct usb_device_descriptor gfs_dev_desc = {
        .bLength                = sizeof gfs_dev_desc,
diff --git a/drivers/usb/gadget/goku_udc.c b/drivers/usb/gadget/goku_udc.c
index c64deb9e3d62..f82768015715 100644
--- a/drivers/usb/gadget/goku_udc.c
+++ b/drivers/usb/gadget/goku_udc.c
@@ -1165,7 +1165,7 @@ static int udc_proc_read(struct seq_file *m, void *v)
                                s = "invalid"; break;
                        default:
                                s = "?"; break;
-                        }; s; }),
+                        } s; }),
                        (tmp & EPxSTATUS_TOGGLE) ? "data1" : "data0",
                        (tmp & EPxSTATUS_SUSPEND) ? " suspend" : "",
                        (tmp & EPxSTATUS_FIFO_DISABLE) ? " disable" : "",
@@ -1701,7 +1701,6 @@ static void goku_remove(struct pci_dev *pdev)
        if (dev->enabled)
                pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
        dev->regs = NULL;
        INFO(dev, "unbind\n");
diff --git a/drivers/usb/gadget/mass_storage.c b/drivers/usb/gadget/mass_storage.c
index 080e577773d5..8e27a8c96444 100644
--- a/drivers/usb/gadget/mass_storage.c
+++ b/drivers/usb/gadget/mass_storage.c
@@ -37,16 +37,16 @@
 #define DRIVER_DESC             "Mass Storage Gadget"
 #define DRIVER_VERSION          "2009/09/11"
-/*-------------------------------------------------------------------------*/
 /*
- * kbuild is not very cooperative with respect to linking separately
+ * Thanks to NetChip Technologies for donating this product ID.
- * compiled library objects into one module.  So for now we won't use
+ *
- * separate compilation ... ensuring init/exit sections work to shrink
+ * DO NOT REUSE THESE IDs with any other driver!!  Ever!!
- * the runtime footprint, and giving us at least some parts of what
+ * Instead:  allocate your own, using normal USB-IF procedures.
- * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
 */
-#include "f_mass_storage.c"
+#define FSG_VENDOR_ID   0x0525  /* NetChip */
+#define FSG_PRODUCT_ID  0xa4a5  /* Linux-USB File-backed Storage Gadget */
+#include "f_mass_storage.h"
 /*-------------------------------------------------------------------------*/
 USB_GADGET_COMPOSITE_OPTIONS();
@@ -97,11 +97,28 @@ static struct usb_gadget_strings *dev_strings[] = {
        NULL,
 };
+static struct usb_function_instance *fi_msg;
+static struct usb_function *f_msg;
 /****************************** Configurations ******************************/
 static struct fsg_module_parameters mod_data = {
        .stall = 1
 };
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
+#else
+/*
+ * Number of buffers we will use.
+ * 2 is usually enough for good buffering pipeline
+ */
+#define fsg_num_buffers CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS
+#endif /* CONFIG_USB_GADGET_DEBUG_FILES */
 FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
 static unsigned long msg_registered;
@@ -115,13 +132,7 @@ static int msg_thread_exits(struct fsg_common *common)
 static int __init msg_do_config(struct usb_configuration *c)
 {
-        static const struct fsg_operations ops = {
+        struct fsg_opts *opts;
-                .thread_exits = msg_thread_exits,
-        };
-        static struct fsg_common common;
-        struct fsg_common *retp;
-        struct fsg_config config;
        int ret;
        if (gadget_is_otg(c->cdev->gadget)) {
@@ -129,15 +140,24 @@ static int __init msg_do_config(struct usb_configuration *c)
                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
        }
-        fsg_config_from_params(&config, &mod_data);
+        opts = fsg_opts_from_func_inst(fi_msg);
-        config.ops = &ops;
+        f_msg = usb_get_function(fi_msg);
+        if (IS_ERR(f_msg))
+                return PTR_ERR(f_msg);
+        ret = fsg_common_run_thread(opts->common);
+        if (ret)
+                goto put_func;
+        ret = usb_add_function(c, f_msg);
+        if (ret)
+                goto put_func;
-        retp = fsg_common_init(&common, c->cdev, &config);
+        return 0;
-        if (IS_ERR(retp))
-                return PTR_ERR(retp);
-        ret = fsg_bind_config(c->cdev, c, &common);
+put_func:
-        fsg_common_put(&common);
+        usb_put_function(f_msg);
        return ret;
 }
@@ -152,23 +172,79 @@ static struct usb_configuration msg_config_driver = {
 static int __init msg_bind(struct usb_composite_dev *cdev)
 {
+        static const struct fsg_operations ops = {
+                .thread_exits = msg_thread_exits,
+        };
+        struct fsg_opts *opts;
+        struct fsg_config config;
        int status;
+        fi_msg = usb_get_function_instance("mass_storage");
+        if (IS_ERR(fi_msg))
+                return PTR_ERR(fi_msg);
+        fsg_config_from_params(&config, &mod_data, fsg_num_buffers);
+        opts = fsg_opts_from_func_inst(fi_msg);
+        opts->no_configfs = true;
+        status = fsg_common_set_num_buffers(opts->common, fsg_num_buffers);
+        if (status)
+                goto fail;
+        status = fsg_common_set_nluns(opts->common, config.nluns);
+        if (status)
+                goto fail_set_nluns;
+        fsg_common_set_ops(opts->common, &ops);
+        status = fsg_common_set_cdev(opts->common, cdev, config.can_stall);
+        if (status)
+                goto fail_set_cdev;
+        fsg_common_set_sysfs(opts->common, true);
+        status = fsg_common_create_luns(opts->common, &config);
+        if (status)
+                goto fail_set_cdev;
+        fsg_common_set_inquiry_string(opts->common, config.vendor_name,
+                                      config.product_name);
        status = usb_string_ids_tab(cdev, strings_dev);
        if (status < 0)
-                return status;
+                goto fail_string_ids;
        msg_device_desc.iProduct = strings_dev[USB_GADGET_PRODUCT_IDX].id;
        status = usb_add_config(cdev, &msg_config_driver, msg_do_config);
        if (status < 0)
-                return status;
+                goto fail_string_ids;
        usb_composite_overwrite_options(cdev, &coverwrite);
        dev_info(&cdev->gadget->dev,
                 DRIVER_DESC ", version: " DRIVER_VERSION "\n");
        set_bit(0, &msg_registered);
        return 0;
+fail_string_ids:
+        fsg_common_remove_luns(opts->common);
+fail_set_cdev:
+        fsg_common_free_luns(opts->common);
+fail_set_nluns:
+        fsg_common_free_buffers(opts->common);
+fail:
+        usb_put_function_instance(fi_msg);
+        return status;
 }
+static int msg_unbind(struct usb_composite_dev *cdev)
+{
+        if (!IS_ERR(f_msg))
+                usb_put_function(f_msg);
+        if (!IS_ERR(fi_msg))
+                usb_put_function_instance(fi_msg);
+        return 0;
+}
 /****************************** Some noise ******************************/
@@ -179,6 +255,7 @@ static __refdata struct usb_composite_driver msg_driver = {
        .needs_serial   = 1,
        .strings        = dev_strings,
        .bind           = msg_bind,
+        .unbind         = msg_unbind,
 };
 MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 23393254a8a3..4fdaa54a2a2a 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/netdevice.h>
 #include "u_serial.h"
 #if defined USB_ETH_RNDIS
@@ -32,22 +33,11 @@ MODULE_AUTHOR("Michal Nazarewicz");
 MODULE_LICENSE("GPL");
-/***************************** All the files... *****************************/
+#include "f_mass_storage.h"
-/*
+#include "u_ecm.h"
- * kbuild is not very cooperative with respect to linking separately
- * compiled library objects into one module.  So for now we won't use
- * separate compilation ... ensuring init/exit sections work to shrink
- * the runtime footprint, and giving us at least some parts of what
- * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
- */
-#include "f_mass_storage.c"
-#define USBF_ECM_INCLUDED
-#include "f_ecm.c"
 #ifdef USB_ETH_RNDIS
-#  define USB_FRNDIS_INCLUDED
+#  include "u_rndis.h"
-#  include "f_rndis.c"
 #  include "rndis.h"
 #endif
 #include "u_ether.h"
@@ -132,22 +122,36 @@ static struct usb_gadget_strings *dev_strings[] = {
 /****************************** Configurations ******************************/
 static struct fsg_module_parameters fsg_mod_data = { .stall = 1 };
-FSG_MODULE_PARAMETERS(/* no prefix */, fsg_mod_data);
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
-static struct fsg_common fsg_common;
+#else
+/*
+ * Number of buffers we will use.
+ * 2 is usually enough for good buffering pipeline
+ */
+#define fsg_num_buffers CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS
-static u8 host_mac[ETH_ALEN];
+#endif /* CONFIG_USB_DEBUG */
+FSG_MODULE_PARAMETERS(/* no prefix */, fsg_mod_data);
 static struct usb_function_instance *fi_acm;
-static struct eth_dev *the_dev;
+static struct usb_function_instance *fi_msg;
 /********** RNDIS **********/
 #ifdef USB_ETH_RNDIS
+static struct usb_function_instance *fi_rndis;
 static struct usb_function *f_acm_rndis;
+static struct usb_function *f_rndis;
+static struct usb_function *f_msg_rndis;
 static __init int rndis_do_config(struct usb_configuration *c)
 {
+        struct fsg_opts *fsg_opts;
        int ret;
        if (gadget_is_otg(c->cdev->gadget)) {
@@ -155,27 +159,50 @@ static __init int rndis_do_config(struct usb_configuration *c)
                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
        }
-        ret = rndis_bind_config(c, host_mac, the_dev);
+        f_rndis = usb_get_function(fi_rndis);
+        if (IS_ERR(f_rndis))
+                return PTR_ERR(f_rndis);
+        ret = usb_add_function(c, f_rndis);
        if (ret < 0)
-                return ret;
+                goto err_func_rndis;
        f_acm_rndis = usb_get_function(fi_acm);
-        if (IS_ERR(f_acm_rndis))
+        if (IS_ERR(f_acm_rndis)) {
-                return PTR_ERR(f_acm_rndis);
+                ret = PTR_ERR(f_acm_rndis);
+                goto err_func_acm;
+        }
        ret = usb_add_function(c, f_acm_rndis);
        if (ret)
                goto err_conf;
-        ret = fsg_bind_config(c->cdev, c, &fsg_common);
+        f_msg_rndis = usb_get_function(fi_msg);
-        if (ret < 0)
+        if (IS_ERR(f_msg_rndis)) {
+                ret = PTR_ERR(f_msg_rndis);
                goto err_fsg;
+        }
+        fsg_opts = fsg_opts_from_func_inst(fi_msg);
+        ret = fsg_common_run_thread(fsg_opts->common);
+        if (ret)
+                goto err_run;
+        ret = usb_add_function(c, f_msg_rndis);
+        if (ret)
+                goto err_run;
        return 0;
+err_run:
+        usb_put_function(f_msg_rndis);
 err_fsg:
        usb_remove_function(c, f_acm_rndis);
 err_conf:
        usb_put_function(f_acm_rndis);
+err_func_acm:
+        usb_remove_function(c, f_rndis);
+err_func_rndis:
+        usb_put_function(f_rndis);
        return ret;
 }
@@ -205,10 +232,14 @@ static __ref int rndis_config_register(struct usb_composite_dev *cdev)
 /********** CDC ECM **********/
 #ifdef CONFIG_USB_G_MULTI_CDC
+static struct usb_function_instance *fi_ecm;
 static struct usb_function *f_acm_multi;
+static struct usb_function *f_ecm;
+static struct usb_function *f_msg_multi;
 static __init int cdc_do_config(struct usb_configuration *c)
 {
+        struct fsg_opts *fsg_opts;
        int ret;
        if (gadget_is_otg(c->cdev->gadget)) {
@@ -216,28 +247,51 @@ static __init int cdc_do_config(struct usb_configuration *c)
                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
        }
-        ret = ecm_bind_config(c, host_mac, the_dev);
+        f_ecm = usb_get_function(fi_ecm);
+        if (IS_ERR(f_ecm))
+                return PTR_ERR(f_ecm);
+        ret = usb_add_function(c, f_ecm);
        if (ret < 0)
-                return ret;
+                goto err_func_ecm;
        /* implicit port_num is zero */
        f_acm_multi = usb_get_function(fi_acm);
-        if (IS_ERR(f_acm_multi))
+        if (IS_ERR(f_acm_multi)) {
-                return PTR_ERR(f_acm_multi);
+                ret = PTR_ERR(f_acm_multi);
+                goto err_func_acm;
+        }
        ret = usb_add_function(c, f_acm_multi);
        if (ret)
                goto err_conf;
-        ret = fsg_bind_config(c->cdev, c, &fsg_common);
+        f_msg_multi = usb_get_function(fi_msg);
-        if (ret < 0)
+        if (IS_ERR(f_msg_multi)) {
+                ret = PTR_ERR(f_msg_multi);
                goto err_fsg;
+        }
+        fsg_opts = fsg_opts_from_func_inst(fi_msg);
+        ret = fsg_common_run_thread(fsg_opts->common);
+        if (ret)
+                goto err_run;
+        ret = usb_add_function(c, f_msg_multi);
+        if (ret)
+                goto err_run;
        return 0;
+err_run:
+        usb_put_function(f_msg_multi);
 err_fsg:
        usb_remove_function(c, f_acm_multi);
 err_conf:
        usb_put_function(f_acm_multi);
+err_func_acm:
+        usb_remove_function(c, f_ecm);
+err_func_ecm:
+        usb_put_function(f_ecm);
        return ret;
 }
@@ -270,19 +324,67 @@ static __ref int cdc_config_register(struct usb_composite_dev *cdev)
 static int __ref multi_bind(struct usb_composite_dev *cdev)
 {
        struct usb_gadget *gadget = cdev->gadget;
+#ifdef CONFIG_USB_G_MULTI_CDC
+        struct f_ecm_opts *ecm_opts;
+#endif
+#ifdef USB_ETH_RNDIS
+        struct f_rndis_opts *rndis_opts;
+#endif
+        struct fsg_opts *fsg_opts;
+        struct fsg_config config;
        int status;
        if (!can_support_ecm(cdev->gadget)) {
                dev_err(&gadget->dev, "controller '%s' not usable\n",
-                        gadget->name);
+                        gadget->name);
                return -EINVAL;
        }
-        /* set up network link layer */
+#ifdef CONFIG_USB_G_MULTI_CDC
-        the_dev = gether_setup(cdev->gadget, dev_addr, host_addr, host_mac,
+        fi_ecm = usb_get_function_instance("ecm");
-                               qmult);
+        if (IS_ERR(fi_ecm))
-        if (IS_ERR(the_dev))
+                return PTR_ERR(fi_ecm);
-                return PTR_ERR(the_dev);
+        ecm_opts = container_of(fi_ecm, struct f_ecm_opts, func_inst);
+        gether_set_qmult(ecm_opts->net, qmult);
+        if (!gether_set_host_addr(ecm_opts->net, host_addr))
+                pr_info("using host ethernet address: %s", host_addr);
+        if (!gether_set_dev_addr(ecm_opts->net, dev_addr))
+                pr_info("using self ethernet address: %s", dev_addr);
+#endif
+#ifdef USB_ETH_RNDIS
+        fi_rndis = usb_get_function_instance("rndis");
+        if (IS_ERR(fi_rndis)) {
+                status = PTR_ERR(fi_rndis);
+                goto fail;
+        }
+        rndis_opts = container_of(fi_rndis, struct f_rndis_opts, func_inst);
+        gether_set_qmult(rndis_opts->net, qmult);
+        if (!gether_set_host_addr(rndis_opts->net, host_addr))
+                pr_info("using host ethernet address: %s", host_addr);
+        if (!gether_set_dev_addr(rndis_opts->net, dev_addr))
+                pr_info("using self ethernet address: %s", dev_addr);
+#endif
+#if (defined CONFIG_USB_G_MULTI_CDC && defined USB_ETH_RNDIS)
+        /*
+         * If both ecm and rndis are selected then:
+         *      1) rndis borrows the net interface from ecm
+         *      2) since the interface is shared it must not be bound
+         *      twice - in ecm's _and_ rndis' binds, so do it here.
+         */
+        gether_set_gadget(ecm_opts->net, cdev->gadget);
+        status = gether_register_netdev(ecm_opts->net);
+        if (status)
+                goto fail0;
+        rndis_borrow_net(fi_rndis, ecm_opts->net);
+        ecm_opts->bound = true;
+#endif
        /* set up serial link layer */
        fi_acm = usb_get_function_instance("acm");
@@ -292,57 +394,102 @@ static int __ref multi_bind(struct usb_composite_dev *cdev)
        }
        /* set up mass storage function */
-        {
+        fi_msg = usb_get_function_instance("mass_storage");
-                void *retp;
+        if (IS_ERR(fi_msg)) {
-                retp = fsg_common_from_params(&fsg_common, cdev, &fsg_mod_data);
+                status = PTR_ERR(fi_msg);
-                if (IS_ERR(retp)) {
+                goto fail1;
-                        status = PTR_ERR(retp);
-                        goto fail1;
-                }
        }
+        fsg_config_from_params(&config, &fsg_mod_data, fsg_num_buffers);
+        fsg_opts = fsg_opts_from_func_inst(fi_msg);
+        fsg_opts->no_configfs = true;
+        status = fsg_common_set_num_buffers(fsg_opts->common, fsg_num_buffers);
+        if (status)
+                goto fail2;
+        status = fsg_common_set_nluns(fsg_opts->common, config.nluns);
+        if (status)
+                goto fail_set_nluns;
+        status = fsg_common_set_cdev(fsg_opts->common, cdev, config.can_stall);
+        if (status)
+                goto fail_set_cdev;
+        fsg_common_set_sysfs(fsg_opts->common, true);
+        status = fsg_common_create_luns(fsg_opts->common, &config);
+        if (status)
+                goto fail_set_cdev;
+        fsg_common_set_inquiry_string(fsg_opts->common, config.vendor_name,
+                                      config.product_name);
        /* allocate string IDs */
        status = usb_string_ids_tab(cdev, strings_dev);
        if (unlikely(status < 0))
-                goto fail2;
+                goto fail_string_ids;
        device_desc.iProduct = strings_dev[USB_GADGET_PRODUCT_IDX].id;
        /* register configurations */
        status = rndis_config_register(cdev);
        if (unlikely(status < 0))
-                goto fail2;
+                goto fail_string_ids;
        status = cdc_config_register(cdev);
        if (unlikely(status < 0))
-                goto fail2;
+                goto fail_string_ids;
        usb_composite_overwrite_options(cdev, &coverwrite);
        /* we're done */
        dev_info(&gadget->dev, DRIVER_DESC "\n");
-        fsg_common_put(&fsg_common);
        return 0;
        /* error recovery */
+fail_string_ids:
+        fsg_common_remove_luns(fsg_opts->common);
+fail_set_cdev:
+        fsg_common_free_luns(fsg_opts->common);
+fail_set_nluns:
+        fsg_common_free_buffers(fsg_opts->common);
 fail2:
-        fsg_common_put(&fsg_common);
+        usb_put_function_instance(fi_msg);
 fail1:
        usb_put_function_instance(fi_acm);
 fail0:
-        gether_cleanup(the_dev);
+#ifdef USB_ETH_RNDIS
+        usb_put_function_instance(fi_rndis);
+fail:
+#endif
+#ifdef CONFIG_USB_G_MULTI_CDC
+        usb_put_function_instance(fi_ecm);
+#endif
        return status;
 }
 static int __exit multi_unbind(struct usb_composite_dev *cdev)
 {
 #ifdef CONFIG_USB_G_MULTI_CDC
+        usb_put_function(f_msg_multi);
+#endif
+#ifdef USB_ETH_RNDIS
+        usb_put_function(f_msg_rndis);
+#endif
+        usb_put_function_instance(fi_msg);
+#ifdef CONFIG_USB_G_MULTI_CDC
        usb_put_function(f_acm_multi);
 #endif
 #ifdef USB_ETH_RNDIS
        usb_put_function(f_acm_rndis);
 #endif
        usb_put_function_instance(fi_acm);
-        gether_cleanup(the_dev);
+#ifdef USB_ETH_RNDIS
+        usb_put_function(f_rndis);
+        usb_put_function_instance(fi_rndis);
+#endif
+#ifdef CONFIG_USB_G_MULTI_CDC
+        usb_put_function(f_ecm);
+        usb_put_function_instance(fi_ecm);
+#endif
        return 0;
 }
diff --git a/drivers/usb/gadget/mv_u3d_core.c b/drivers/usb/gadget/mv_u3d_core.c
index 561b30efb8ee..234711eabea1 100644
--- a/drivers/usb/gadget/mv_u3d_core.c
+++ b/drivers/usb/gadget/mv_u3d_core.c
@@ -310,6 +310,7 @@ static struct mv_u3d_trb *mv_u3d_build_trb_one(struct mv_u3d_req *req,
         */
        trb_hw = dma_pool_alloc(u3d->trb_pool, GFP_ATOMIC, dma);
        if (!trb_hw) {
+                kfree(trb);
                dev_err(u3d->dev,
                        "%s, dma_pool_alloc fail\n", __func__);
                return NULL;
@@ -454,6 +455,7 @@ static int mv_u3d_req_to_trb(struct mv_u3d_req *req)
                trb_hw = kcalloc(trb_num, sizeof(*trb_hw), GFP_ATOMIC);
                if (!trb_hw) {
+                        kfree(trb);
                        dev_err(u3d->dev,
                                        "%s, trb_hw alloc fail\n", __func__);
                        return -ENOMEM;
@@ -1936,7 +1938,7 @@ static int mv_u3d_probe(struct platform_device *dev)
        }
        u3d->irq = r->start;
        if (request_irq(u3d->irq, mv_u3d_irq,
-                IRQF_DISABLED | IRQF_SHARED, driver_name, u3d)) {
+                IRQF_SHARED, driver_name, u3d)) {
                u3d->irq = 0;
                dev_err(&dev->dev, "Request irq %d for u3d failed\n",
                        u3d->irq);
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index 0781bff70015..fc852177c087 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -129,7 +129,7 @@ static char *type_string (u8 bmAttributes)
        case USB_ENDPOINT_XFER_BULK:    return "bulk";
        case USB_ENDPOINT_XFER_ISOC:    return "iso";
        case USB_ENDPOINT_XFER_INT:     return "intr";
-        };
+        }
        return "control";
 }
 #endif
@@ -1630,7 +1630,7 @@ static ssize_t queues_show(struct device *_dev, struct device_attribute *attr,
                                        val = "intr"; break;
                                 default:
                                        val = "iso"; break;
-                                 }; val; }),
+                                 } val; }),
                                usb_endpoint_maxp (d) & 0x1fff,
                                ep->dma ? "dma" : "pio", ep->fifo_size
                                );
@@ -2680,7 +2680,6 @@ static void net2280_remove (struct pci_dev *pdev)
        if (dev->enabled)
                pci_disable_device (pdev);
        device_remove_file (&pdev->dev, &dev_attr_registers);
-        pci_set_drvdata (pdev, NULL);
        INFO (dev, "unbind\n");
 }
diff --git a/drivers/usb/gadget/pch_udc.c b/drivers/usb/gadget/pch_udc.c
index 24174e1d1564..32d5e923750b 100644
--- a/drivers/usb/gadget/pch_udc.c
+++ b/drivers/usb/gadget/pch_udc.c
@@ -3080,7 +3080,6 @@ static void pch_udc_remove(struct pci_dev *pdev)
        if (dev->active)
                pci_disable_device(pdev);
        kfree(dev);
-        pci_set_drvdata(pdev, NULL);
 }
 #ifdef CONFIG_PM
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 9575085ded81..a3ad732bc812 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -1068,7 +1068,7 @@ static int rndis_proc_show(struct seq_file *m, void *v)
                                s = "RNDIS_INITIALIZED"; break;
                         case RNDIS_DATA_INITIALIZED:
                                s = "RNDIS_DATA_INITIALIZED"; break;
-                        }; s; }),
+                        } s; }),
                         param->medium,
                         (param->media_state) ? 0 : param->speed*100,
                         (param->media_state) ? "disconnected" : "connected",
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index a8a99e4748d5..9875d9c0823f 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -83,9 +83,12 @@ struct s3c_hsotg_req;
 * @dir_in: Set to true if this endpoint is of the IN direction, which
 *          means that it is sending data to the Host.
 * @index: The index for the endpoint registers.
+ * @mc: Multi Count - number of transactions per microframe
+ * @interval - Interval for periodic endpoints
 * @name: The name array passed to the USB core.
 * @halted: Set if the endpoint has been halted.
 * @periodic: Set if this is a periodic ep, such as Interrupt
+ * @isochronous: Set if this is a isochronous ep
 * @sent_zlp: Set if we've sent a zero-length packet.
 * @total_data: The total number of data bytes done.
 * @fifo_size: The size of the FIFO (for periodic IN endpoints)
@@ -121,9 +124,12 @@ struct s3c_hsotg_ep {
        unsigned char           dir_in;
        unsigned char           index;
+        unsigned char           mc;
+        unsigned char           interval;
        unsigned int            halted:1;
        unsigned int            periodic:1;
+        unsigned int            isochronous:1;
        unsigned int            sent_zlp:1;
        char                    name[10];
@@ -468,6 +474,7 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
        void *data;
        int can_write;
        int pkt_round;
+        int max_transfer;
        to_write -= (buf_pos - hs_ep->last_load);
@@ -535,8 +542,10 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
                can_write *= 4; /* fifo size is in 32bit quantities. */
        }
-        dev_dbg(hsotg->dev, "%s: GNPTXSTS=%08x, can=%d, to=%d, mps %d\n",
+        max_transfer = hs_ep->ep.maxpacket * hs_ep->mc;
-                 __func__, gnptxsts, can_write, to_write, hs_ep->ep.maxpacket);
+        dev_dbg(hsotg->dev, "%s: GNPTXSTS=%08x, can=%d, to=%d, max_transfer %d\n",
+                 __func__, gnptxsts, can_write, to_write, max_transfer);
        /*
         * limit to 512 bytes of data, it seems at least on the non-periodic
@@ -551,19 +560,21 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
         * the transfer to return that it did not run out of fifo space
         * doing it.
         */
-        if (to_write > hs_ep->ep.maxpacket) {
+        if (to_write > max_transfer) {
-                to_write = hs_ep->ep.maxpacket;
+                to_write = max_transfer;
-                s3c_hsotg_en_gsint(hsotg,
+                /* it's needed only when we do not use dedicated fifos */
-                                   periodic ? GINTSTS_PTxFEmp :
+                if (!hsotg->dedicated_fifos)
-                                   GINTSTS_NPTxFEmp);
+                        s3c_hsotg_en_gsint(hsotg,
+                                           periodic ? GINTSTS_PTxFEmp :
+                                           GINTSTS_NPTxFEmp);
        }
        /* see if we can write data */
        if (to_write > can_write) {
                to_write = can_write;
-                pkt_round = to_write % hs_ep->ep.maxpacket;
+                pkt_round = to_write % max_transfer;
                /*
                 * Round the write down to an
@@ -581,9 +592,11 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
                 * is more room left.
                 */
-                s3c_hsotg_en_gsint(hsotg,
+                /* it's needed only when we do not use dedicated fifos */
-                                   periodic ? GINTSTS_PTxFEmp :
+                if (!hsotg->dedicated_fifos)
-                                   GINTSTS_NPTxFEmp);
+                        s3c_hsotg_en_gsint(hsotg,
+                                           periodic ? GINTSTS_PTxFEmp :
+                                           GINTSTS_NPTxFEmp);
        }
        dev_dbg(hsotg->dev, "write %d/%d, can_write %d, done %d\n",
@@ -727,8 +740,16 @@ static void s3c_hsotg_start_req(struct s3c_hsotg *hsotg,
        else
                packets = 1;    /* send one packet if length is zero. */
+        if (hs_ep->isochronous && length > (hs_ep->mc * hs_ep->ep.maxpacket)) {
+                dev_err(hsotg->dev, "req length > maxpacket*mc\n");
+                return;
+        }
        if (dir_in && index != 0)
-                epsize = DxEPTSIZ_MC(1);
+                if (hs_ep->isochronous)
+                        epsize = DxEPTSIZ_MC(packets);
+                else
+                        epsize = DxEPTSIZ_MC(1);
        else
                epsize = 0;
@@ -820,6 +841,9 @@ static void s3c_hsotg_start_req(struct s3c_hsotg *hsotg,
        dev_dbg(hsotg->dev, "%s: DxEPCTL=0x%08x\n",
                __func__, readl(hsotg->regs + epctrl_reg));
+        /* enable ep interrupts */
+        s3c_hsotg_ctrl_epint(hsotg, hs_ep->index, hs_ep->dir_in, 1);
 }
 /**
@@ -1091,6 +1115,7 @@ static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
        bool set = (ctrl->bRequest == USB_REQ_SET_FEATURE);
        struct s3c_hsotg_ep *ep;
        int ret;
+        bool halted;
        dev_dbg(hsotg->dev, "%s: %s_FEATURE\n",
                __func__, set ? "SET" : "CLEAR");
@@ -1105,6 +1130,8 @@ static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
                switch (le16_to_cpu(ctrl->wValue)) {
                case USB_ENDPOINT_HALT:
+                        halted = ep->halted;
                        s3c_hsotg_ep_sethalt(&ep->ep, set);
                        ret = s3c_hsotg_send_reply(hsotg, ep0, NULL, 0);
@@ -1114,7 +1141,12 @@ static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
                                return ret;
                        }
-                        if (!set) {
+                        /*
+                         * we have to complete all requests for ep if it was
+                         * halted, and the halt was cleared by CLEAR_FEATURE
+                         */
+                        if (!set && halted) {
                                /*
                                 * If we have request in progress,
                                 * then complete it
@@ -1147,6 +1179,8 @@ static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
        return 1;
 }
+static void s3c_hsotg_enqueue_setup(struct s3c_hsotg *hsotg);
 /**
 * s3c_hsotg_process_control - process a control request
 * @hsotg: The device state
@@ -1246,11 +1280,15 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
                 * don't believe we need to anything more to get the EP
                 * to reply with a STALL packet
                 */
+                 /*
+                  * complete won't be called, so we enqueue
+                  * setup request here
+                  */
+                 s3c_hsotg_enqueue_setup(hsotg);
        }
 }
-static void s3c_hsotg_enqueue_setup(struct s3c_hsotg *hsotg);
 /**
 * s3c_hsotg_complete_setup - completion of a setup transfer
 * @ep: The endpoint the request was on.
@@ -1698,6 +1736,7 @@ static void s3c_hsotg_set_ep_maxpacket(struct s3c_hsotg *hsotg,
        struct s3c_hsotg_ep *hs_ep = &hsotg->eps[ep];
        void __iomem *regs = hsotg->regs;
        u32 mpsval;
+        u32 mcval;
        u32 reg;
        if (ep == 0) {
@@ -1705,15 +1744,19 @@ static void s3c_hsotg_set_ep_maxpacket(struct s3c_hsotg *hsotg,
                mpsval = s3c_hsotg_ep0_mps(mps);
                if (mpsval > 3)
                        goto bad_mps;
+                hs_ep->ep.maxpacket = mps;
+                hs_ep->mc = 1;
        } else {
-                if (mps >= DxEPCTL_MPS_LIMIT+1)
+                mpsval = mps & DxEPCTL_MPS_MASK;
+                if (mpsval > 1024)
                        goto bad_mps;
+                mcval = ((mps >> 11) & 0x3) + 1;
-                mpsval = mps;
+                hs_ep->mc = mcval;
+                if (mcval > 3)
+                        goto bad_mps;
+                hs_ep->ep.maxpacket = mpsval;
        }
-        hs_ep->ep.maxpacket = mps;
        /*
         * update both the in and out endpoint controldir_ registers, even
         * if one of the directions may not be in use.
@@ -1782,8 +1825,16 @@ static int s3c_hsotg_trytx(struct s3c_hsotg *hsotg,
 {
        struct s3c_hsotg_req *hs_req = hs_ep->req;
-        if (!hs_ep->dir_in || !hs_req)
+        if (!hs_ep->dir_in || !hs_req) {
+                /**
+                 * if request is not enqueued, we disable interrupts
+                 * for endpoints, excepting ep0
+                 */
+                if (hs_ep->index != 0)
+                        s3c_hsotg_ctrl_epint(hsotg, hs_ep->index,
+                                             hs_ep->dir_in, 0);
                return 0;
+        }
        if (hs_req->req.actual < hs_req->req.length) {
                dev_dbg(hsotg->dev, "trying to write more for ep%d\n",
@@ -1887,8 +1938,10 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
        u32 epctl_reg = dir_in ? DIEPCTL(idx) : DOEPCTL(idx);
        u32 epsiz_reg = dir_in ? DIEPTSIZ(idx) : DOEPTSIZ(idx);
        u32 ints;
+        u32 ctrl;
        ints = readl(hsotg->regs + epint_reg);
+        ctrl = readl(hsotg->regs + epctl_reg);
        /* Clear endpoint interrupts */
        writel(ints, hsotg->regs + epint_reg);
@@ -1897,6 +1950,14 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
                __func__, idx, dir_in ? "in" : "out", ints);
        if (ints & DxEPINT_XferCompl) {
+                if (hs_ep->isochronous && hs_ep->interval == 1) {
+                        if (ctrl & DxEPCTL_EOFrNum)
+                                ctrl |= DxEPCTL_SetEvenFr;
+                        else
+                                ctrl |= DxEPCTL_SetOddFr;
+                        writel(ctrl, hsotg->regs + epctl_reg);
+                }
                dev_dbg(hsotg->dev,
                        "%s: XferCompl: DxEPCTL=0x%08x, DxEPTSIZ=%08x\n",
                        __func__, readl(hsotg->regs + epctl_reg),
@@ -1963,7 +2024,7 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
        if (ints & DxEPINT_Back2BackSetup)
                dev_dbg(hsotg->dev, "%s: B2BSetup/INEPNakEff\n", __func__);
-        if (dir_in) {
+        if (dir_in && !hs_ep->isochronous) {
                /* not sure if this is important, but we'll clear it anyway */
                if (ints & DIEPMSK_INTknTXFEmpMsk) {
                        dev_dbg(hsotg->dev, "%s: ep%d: INTknTXFEmpMsk\n",
@@ -2092,12 +2153,14 @@ static void kill_all_requests(struct s3c_hsotg *hsotg,
 }
 #define call_gadget(_hs, _entry) \
+do { \
        if ((_hs)->gadget.speed != USB_SPEED_UNKNOWN && \
            (_hs)->driver && (_hs)->driver->_entry) { \
                spin_unlock(&_hs->lock); \
                (_hs)->driver->_entry(&(_hs)->gadget); \
                spin_lock(&_hs->lock); \
-                }
+        } \
+} while (0)
 /**
 * s3c_hsotg_disconnect - disconnect service
@@ -2241,15 +2304,19 @@ static void s3c_hsotg_core_init(struct s3c_hsotg *hsotg)
                       GAHBCFG_HBstLen_Incr4,
                       hsotg->regs + GAHBCFG);
        else
-                writel(GAHBCFG_GlblIntrEn, hsotg->regs + GAHBCFG);
+                writel(((hsotg->dedicated_fifos) ? (GAHBCFG_NPTxFEmpLvl |
+                                                    GAHBCFG_PTxFEmpLvl) : 0) |
+                       GAHBCFG_GlblIntrEn,
+                       hsotg->regs + GAHBCFG);
        /*
-         * Enabling INTknTXFEmpMsk here seems to be a big mistake, we end
+         * If INTknTXFEmpMsk is enabled, it's important to disable ep interrupts
-         * up being flooded with interrupts if the host is polling the
+         * when we have no data to transfer. Otherwise we get being flooded by
-         * endpoint to try and read data.
+         * interrupts.
         */
-        writel(((hsotg->dedicated_fifos) ? DIEPMSK_TxFIFOEmpty : 0) |
+        writel(((hsotg->dedicated_fifos) ? DIEPMSK_TxFIFOEmpty |
+               DIEPMSK_INTknTXFEmpMsk : 0) |
               DIEPMSK_EPDisbldMsk | DIEPMSK_XferComplMsk |
               DIEPMSK_TimeOUTMsk | DIEPMSK_AHBErrMsk |
               DIEPMSK_INTknEPMisMsk,
@@ -2378,10 +2445,14 @@ irq_retry:
        if (gintsts & (GINTSTS_OEPInt | GINTSTS_IEPInt)) {
                u32 daint = readl(hsotg->regs + DAINT);
-                u32 daint_out = daint >> DAINT_OutEP_SHIFT;
+                u32 daintmsk = readl(hsotg->regs + DAINTMSK);
-                u32 daint_in = daint & ~(daint_out << DAINT_OutEP_SHIFT);
+                u32 daint_out, daint_in;
                int ep;
+                daint &= daintmsk;
+                daint_out = daint >> DAINT_OutEP_SHIFT;
+                daint_in = daint & ~(daint_out << DAINT_OutEP_SHIFT);
                dev_dbg(hsotg->dev, "%s: daint=%08x\n", __func__, daint);
                for (ep = 0; ep < 15 && daint_out; ep++, daint_out >>= 1) {
@@ -2577,16 +2648,25 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
        epctrl |= DxEPCTL_SNAK;
        /* update the endpoint state */
-        hs_ep->ep.maxpacket = mps;
+        s3c_hsotg_set_ep_maxpacket(hsotg, hs_ep->index, mps);
        /* default, set to non-periodic */
+        hs_ep->isochronous = 0;
        hs_ep->periodic = 0;
+        hs_ep->halted = 0;
+        hs_ep->interval = desc->bInterval;
+        if (hs_ep->interval > 1 && hs_ep->mc > 1)
+                dev_err(hsotg->dev, "MC > 1 when interval is not 1\n");
        switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
        case USB_ENDPOINT_XFER_ISOC:
-                dev_err(hsotg->dev, "no current ISOC support\n");
+                epctrl |= DxEPCTL_EPType_Iso;
-                ret = -EINVAL;
+                epctrl |= DxEPCTL_SetEvenFr;
-                goto out;
+                hs_ep->isochronous = 1;
+                if (dir_in)
+                        hs_ep->periodic = 1;
+                break;
        case USB_ENDPOINT_XFER_BULK:
                epctrl |= DxEPCTL_EPType_Bulk;
@@ -2634,7 +2714,6 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
        /* enable the endpoint interrupt */
        s3c_hsotg_ctrl_epint(hsotg, index, dir_in, 1);
-out:
        spin_unlock_irqrestore(&hsotg->lock, flags);
        return ret;
 }
@@ -2776,6 +2855,8 @@ static int s3c_hsotg_ep_sethalt(struct usb_ep *ep, int value)
        writel(epctl, hs->regs + epreg);
+        hs_ep->halted = value;
        return 0;
 }
@@ -2903,7 +2984,7 @@ static int s3c_hsotg_udc_start(struct usb_gadget *gadget,
        int ret;
        if (!hsotg) {
-                printk(KERN_ERR "%s: called with no device\n", __func__);
+                pr_err("%s: called with no device\n", __func__);
                return -ENODEV;
        }
@@ -3066,7 +3147,7 @@ static void s3c_hsotg_initep(struct s3c_hsotg *hsotg,
        hs_ep->parent = hsotg;
        hs_ep->ep.name = hs_ep->name;
-        hs_ep->ep.maxpacket = epnum ? 512 : EP0_MPS_LIMIT;
+        hs_ep->ep.maxpacket = epnum ? 1024 : EP0_MPS_LIMIT;
        hs_ep->ep.ops = &s3c_hsotg_ep_ops;
        /*
@@ -3200,7 +3281,7 @@ static int state_show(struct seq_file *seq, void *v)
                   readl(regs + GNPTXSTS),
                   readl(regs + GRXSTSR));
-        seq_printf(seq, "\nEndpoint status:\n");
+        seq_puts(seq, "\nEndpoint status:\n");
        for (idx = 0; idx < 15; idx++) {
                u32 in, out;
@@ -3217,7 +3298,7 @@ static int state_show(struct seq_file *seq, void *v)
                seq_printf(seq, ", DIEPTSIZ=0x%08x, DOEPTSIZ=0x%08x",
                           in, out);
-                seq_printf(seq, "\n");
+                seq_puts(seq, "\n");
        }
        return 0;
@@ -3251,7 +3332,7 @@ static int fifo_show(struct seq_file *seq, void *v)
        u32 val;
        int idx;
-        seq_printf(seq, "Non-periodic FIFOs:\n");
+        seq_puts(seq, "Non-periodic FIFOs:\n");
        seq_printf(seq, "RXFIFO: Size %d\n", readl(regs + GRXFSIZ));
        val = readl(regs + GNPTXFSIZ);
@@ -3259,7 +3340,7 @@ static int fifo_show(struct seq_file *seq, void *v)
                   val >> GNPTXFSIZ_NPTxFDep_SHIFT,
                   val & GNPTXFSIZ_NPTxFStAddr_MASK);
-        seq_printf(seq, "\nPeriodic TXFIFOs:\n");
+        seq_puts(seq, "\nPeriodic TXFIFOs:\n");
        for (idx = 1; idx <= 15; idx++) {
                val = readl(regs + DPTXFSIZn(idx));
@@ -3330,7 +3411,7 @@ static int ep_show(struct seq_file *seq, void *v)
                   readl(regs + DIEPTSIZ(index)),
                   readl(regs + DOEPTSIZ(index)));
-        seq_printf(seq, "\n");
+        seq_puts(seq, "\n");
        seq_printf(seq, "mps %d\n", ep->ep.maxpacket);
        seq_printf(seq, "total_data=%ld\n", ep->total_data);
@@ -3341,7 +3422,7 @@ static int ep_show(struct seq_file *seq, void *v)
        list_for_each_entry(req, &ep->queue, queue) {
                if (--show_limit < 0) {
-                        seq_printf(seq, "not showing more requests...\n");
+                        seq_puts(seq, "not showing more requests...\n");
                        break;
                }
diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
index 08a1a3210a21..ec20a1f50c2d 100644
--- a/drivers/usb/gadget/storage_common.c
+++ b/drivers/usb/gadget/storage_common.c
@@ -23,242 +23,17 @@
 * The valid range of num_buffers is: num >= 2 && num <= 4.
 */
+#include <linux/module.h>
+#include <linux/blkdev.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/usb/composite.h>
-#include <linux/usb/storage.h>
+#include "storage_common.h"
-#include <scsi/scsi.h>
-#include <asm/unaligned.h>
-/*
- * Thanks to NetChip Technologies for donating this product ID.
- *
- * DO NOT REUSE THESE IDs with any other driver!!  Ever!!
- * Instead:  allocate your own, using normal USB-IF procedures.
- */
-#define FSG_VENDOR_ID   0x0525  /* NetChip */
-#define FSG_PRODUCT_ID  0xa4a5  /* Linux-USB File-backed Storage Gadget */
-/*-------------------------------------------------------------------------*/
-#ifndef DEBUG
-#undef VERBOSE_DEBUG
-#undef DUMP_MSGS
-#endif /* !DEBUG */
-#ifdef VERBOSE_DEBUG
-#define VLDBG   LDBG
-#else
-#define VLDBG(lun, fmt, args...) do { } while (0)
-#endif /* VERBOSE_DEBUG */
-#define LDBG(lun, fmt, args...)   dev_dbg (&(lun)->dev, fmt, ## args)
-#define LERROR(lun, fmt, args...) dev_err (&(lun)->dev, fmt, ## args)
-#define LWARN(lun, fmt, args...)  dev_warn(&(lun)->dev, fmt, ## args)
-#define LINFO(lun, fmt, args...)  dev_info(&(lun)->dev, fmt, ## args)
-#ifdef DUMP_MSGS
-#  define dump_msg(fsg, /* const char * */ label,                       \
-                   /* const u8 * */ buf, /* unsigned */ length) do {    \
-        if (length < 512) {                                             \
-                DBG(fsg, "%s, length %u:\n", label, length);            \
-                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET,      \
-                               16, 1, buf, length, 0);                  \
-        }                                                               \
-} while (0)
-#  define dump_cdb(fsg) do { } while (0)
-#else
-#  define dump_msg(fsg, /* const char * */ label, \
-                   /* const u8 * */ buf, /* unsigned */ length) do { } while (0)
-#  ifdef VERBOSE_DEBUG
-#    define dump_cdb(fsg)                                               \
-        print_hex_dump(KERN_DEBUG, "SCSI CDB: ", DUMP_PREFIX_NONE,      \
-                       16, 1, (fsg)->cmnd, (fsg)->cmnd_size, 0)         \
-#  else
-#    define dump_cdb(fsg) do { } while (0)
-#  endif /* VERBOSE_DEBUG */
-#endif /* DUMP_MSGS */
-/*-------------------------------------------------------------------------*/
-/* Length of a SCSI Command Data Block */
-#define MAX_COMMAND_SIZE        16
-/* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
-#define SS_NO_SENSE                             0
-#define SS_COMMUNICATION_FAILURE                0x040800
-#define SS_INVALID_COMMAND                      0x052000
-#define SS_INVALID_FIELD_IN_CDB                 0x052400
-#define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE   0x052100
-#define SS_LOGICAL_UNIT_NOT_SUPPORTED           0x052500
-#define SS_MEDIUM_NOT_PRESENT                   0x023a00
-#define SS_MEDIUM_REMOVAL_PREVENTED             0x055302
-#define SS_NOT_READY_TO_READY_TRANSITION        0x062800
-#define SS_RESET_OCCURRED                       0x062900
-#define SS_SAVING_PARAMETERS_NOT_SUPPORTED      0x053900
-#define SS_UNRECOVERED_READ_ERROR               0x031100
-#define SS_WRITE_ERROR                          0x030c02
-#define SS_WRITE_PROTECTED                      0x072700
-#define SK(x)           ((u8) ((x) >> 16))      /* Sense Key byte, etc. */
-#define ASC(x)          ((u8) ((x) >> 8))
-#define ASCQ(x)         ((u8) (x))
-/*-------------------------------------------------------------------------*/
-struct fsg_lun {
-        struct file     *filp;
-        loff_t          file_length;
-        loff_t          num_sectors;
-        unsigned int    initially_ro:1;
-        unsigned int    ro:1;
-        unsigned int    removable:1;
-        unsigned int    cdrom:1;
-        unsigned int    prevent_medium_removal:1;
-        unsigned int    registered:1;
-        unsigned int    info_valid:1;
-        unsigned int    nofua:1;
-        u32             sense_data;
-        u32             sense_data_info;
-        u32             unit_attention_data;
-        unsigned int    blkbits;        /* Bits of logical block size of bound block device */
-        unsigned int    blksize;        /* logical block size of bound block device */
-        struct device   dev;
-};
-static inline bool fsg_lun_is_open(struct fsg_lun *curlun)
-{
-        return curlun->filp != NULL;
-}
-static inline struct fsg_lun *fsg_lun_from_dev(struct device *dev)
-{
-        return container_of(dev, struct fsg_lun, dev);
-}
-/* Big enough to hold our biggest descriptor */
-#define EP0_BUFSIZE     256
-#define DELAYED_STATUS  (EP0_BUFSIZE + 999)     /* An impossibly large value */
-#ifdef CONFIG_USB_GADGET_DEBUG_FILES
-static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
-module_param_named(num_buffers, fsg_num_buffers, uint, S_IRUGO);
-MODULE_PARM_DESC(num_buffers, "Number of pipeline buffers");
-#else
-/*
- * Number of buffers we will use.
- * 2 is usually enough for good buffering pipeline
- */
-#define fsg_num_buffers CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS
-#endif /* CONFIG_USB_GADGET_DEBUG_FILES */
-/* check if fsg_num_buffers is within a valid range */
-static inline int fsg_num_buffers_validate(void)
-{
-        if (fsg_num_buffers >= 2 && fsg_num_buffers <= 4)
-                return 0;
-        pr_err("fsg_num_buffers %u is out of range (%d to %d)\n",
-               fsg_num_buffers, 2 ,4);
-        return -EINVAL;
-}
-/* Default size of buffer length. */
-#define FSG_BUFLEN      ((u32)16384)
-/* Maximal number of LUNs supported in mass storage function */
-#define FSG_MAX_LUNS    8
-enum fsg_buffer_state {
-        BUF_STATE_EMPTY = 0,
-        BUF_STATE_FULL,
-        BUF_STATE_BUSY
-};
-struct fsg_buffhd {
-        void                            *buf;
-        enum fsg_buffer_state           state;
-        struct fsg_buffhd               *next;
-        /*
-         * The NetChip 2280 is faster, and handles some protocol faults
-         * better, if we don't submit any short bulk-out read requests.
-         * So we will record the intended request length here.
-         */
-        unsigned int                    bulk_out_intended_length;
-        struct usb_request              *inreq;
-        int                             inreq_busy;
-        struct usb_request              *outreq;
-        int                             outreq_busy;
-};
-enum fsg_state {
-        /* This one isn't used anywhere */
-        FSG_STATE_COMMAND_PHASE = -10,
-        FSG_STATE_DATA_PHASE,
-        FSG_STATE_STATUS_PHASE,
-        FSG_STATE_IDLE = 0,
-        FSG_STATE_ABORT_BULK_OUT,
-        FSG_STATE_RESET,
-        FSG_STATE_INTERFACE_CHANGE,
-        FSG_STATE_CONFIG_CHANGE,
-        FSG_STATE_DISCONNECT,
-        FSG_STATE_EXIT,
-        FSG_STATE_TERMINATED
-};
-enum data_direction {
-        DATA_DIR_UNKNOWN = 0,
-        DATA_DIR_FROM_HOST,
-        DATA_DIR_TO_HOST,
-        DATA_DIR_NONE
-};
-/*-------------------------------------------------------------------------*/
-static inline u32 get_unaligned_be24(u8 *buf)
-{
-        return 0xffffff & (u32) get_unaligned_be32(buf - 1);
-}
-/*-------------------------------------------------------------------------*/
-enum {
-        FSG_STRING_INTERFACE
-};
 /* There is only one interface. */
-static struct usb_interface_descriptor
+struct usb_interface_descriptor fsg_intf_desc = {
-fsg_intf_desc = {
        .bLength =              sizeof fsg_intf_desc,
        .bDescriptorType =      USB_DT_INTERFACE,
@@ -268,14 +43,14 @@ fsg_intf_desc = {
        .bInterfaceProtocol =   USB_PR_BULK,    /* Adjusted during fsg_bind() */
        .iInterface =           FSG_STRING_INTERFACE,
 };
+EXPORT_SYMBOL(fsg_intf_desc);
 /*
 * Three full-speed endpoint descriptors: bulk-in, bulk-out, and
 * interrupt-in.
 */
-static struct usb_endpoint_descriptor
+struct usb_endpoint_descriptor fsg_fs_bulk_in_desc = {
-fsg_fs_bulk_in_desc = {
        .bLength =              USB_DT_ENDPOINT_SIZE,
        .bDescriptorType =      USB_DT_ENDPOINT,
@@ -283,9 +58,9 @@ fsg_fs_bulk_in_desc = {
        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
        /* wMaxPacketSize set by autoconfiguration */
 };
+EXPORT_SYMBOL(fsg_fs_bulk_in_desc);
-static struct usb_endpoint_descriptor
+struct usb_endpoint_descriptor fsg_fs_bulk_out_desc = {
-fsg_fs_bulk_out_desc = {
        .bLength =              USB_DT_ENDPOINT_SIZE,
        .bDescriptorType =      USB_DT_ENDPOINT,
@@ -293,13 +68,15 @@ fsg_fs_bulk_out_desc = {
        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
        /* wMaxPacketSize set by autoconfiguration */
 };
+EXPORT_SYMBOL(fsg_fs_bulk_out_desc);
-static struct usb_descriptor_header *fsg_fs_function[] = {
+struct usb_descriptor_header *fsg_fs_function[] = {
        (struct usb_descriptor_header *) &fsg_intf_desc,
        (struct usb_descriptor_header *) &fsg_fs_bulk_in_desc,
        (struct usb_descriptor_header *) &fsg_fs_bulk_out_desc,
        NULL,
 };
+EXPORT_SYMBOL(fsg_fs_function);
 /*
@@ -310,8 +87,7 @@ static struct usb_descriptor_header *fsg_fs_function[] = {
 * and a "device qualifier" ... plus more construction options
 * for the configuration descriptor.
 */
-static struct usb_endpoint_descriptor
+struct usb_endpoint_descriptor fsg_hs_bulk_in_desc = {
-fsg_hs_bulk_in_desc = {
        .bLength =              USB_DT_ENDPOINT_SIZE,
        .bDescriptorType =      USB_DT_ENDPOINT,
@@ -319,9 +95,9 @@ fsg_hs_bulk_in_desc = {
        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
        .wMaxPacketSize =       cpu_to_le16(512),
 };
+EXPORT_SYMBOL(fsg_hs_bulk_in_desc);
-static struct usb_endpoint_descriptor
+struct usb_endpoint_descriptor fsg_hs_bulk_out_desc = {
-fsg_hs_bulk_out_desc = {
        .bLength =              USB_DT_ENDPOINT_SIZE,
        .bDescriptorType =      USB_DT_ENDPOINT,
@@ -330,17 +106,18 @@ fsg_hs_bulk_out_desc = {
        .wMaxPacketSize =       cpu_to_le16(512),
        .bInterval =            1,      /* NAK every 1 uframe */
 };
+EXPORT_SYMBOL(fsg_hs_bulk_out_desc);
-static struct usb_descriptor_header *fsg_hs_function[] = {
+struct usb_descriptor_header *fsg_hs_function[] = {
        (struct usb_descriptor_header *) &fsg_intf_desc,
        (struct usb_descriptor_header *) &fsg_hs_bulk_in_desc,
        (struct usb_descriptor_header *) &fsg_hs_bulk_out_desc,
        NULL,
 };
+EXPORT_SYMBOL(fsg_hs_function);
-static struct usb_endpoint_descriptor
+struct usb_endpoint_descriptor fsg_ss_bulk_in_desc = {
-fsg_ss_bulk_in_desc = {
        .bLength =              USB_DT_ENDPOINT_SIZE,
        .bDescriptorType =      USB_DT_ENDPOINT,
@@ -348,16 +125,17 @@ fsg_ss_bulk_in_desc = {
        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
        .wMaxPacketSize =       cpu_to_le16(1024),
 };
+EXPORT_SYMBOL(fsg_ss_bulk_in_desc);
-static struct usb_ss_ep_comp_descriptor fsg_ss_bulk_in_comp_desc = {
+struct usb_ss_ep_comp_descriptor fsg_ss_bulk_in_comp_desc = {
        .bLength =              sizeof(fsg_ss_bulk_in_comp_desc),
        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
        /*.bMaxBurst =          DYNAMIC, */
 };
+EXPORT_SYMBOL(fsg_ss_bulk_in_comp_desc);
-static struct usb_endpoint_descriptor
+struct usb_endpoint_descriptor fsg_ss_bulk_out_desc = {
-fsg_ss_bulk_out_desc = {
        .bLength =              USB_DT_ENDPOINT_SIZE,
        .bDescriptorType =      USB_DT_ENDPOINT,
@@ -365,15 +143,17 @@ fsg_ss_bulk_out_desc = {
        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
        .wMaxPacketSize =       cpu_to_le16(1024),
 };
+EXPORT_SYMBOL(fsg_ss_bulk_out_desc);
-static struct usb_ss_ep_comp_descriptor fsg_ss_bulk_out_comp_desc = {
+struct usb_ss_ep_comp_descriptor fsg_ss_bulk_out_comp_desc = {
        .bLength =              sizeof(fsg_ss_bulk_in_comp_desc),
        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
        /*.bMaxBurst =          DYNAMIC, */
 };
+EXPORT_SYMBOL(fsg_ss_bulk_out_comp_desc);
-static struct usb_descriptor_header *fsg_ss_function[] = {
+struct usb_descriptor_header *fsg_ss_function[] = {
        (struct usb_descriptor_header *) &fsg_intf_desc,
        (struct usb_descriptor_header *) &fsg_ss_bulk_in_desc,
        (struct usb_descriptor_header *) &fsg_ss_bulk_in_comp_desc,
@@ -381,17 +161,7 @@ static struct usb_descriptor_header *fsg_ss_function[] = {
        (struct usb_descriptor_header *) &fsg_ss_bulk_out_comp_desc,
        NULL,
 };
+EXPORT_SYMBOL(fsg_ss_function);
-/* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
-static struct usb_string                fsg_strings[] = {
-        {FSG_STRING_INTERFACE,          fsg_string_interface},
-        {}
-};
-static struct usb_gadget_strings        fsg_stringtab = {
-        .language       = 0x0409,               /* en-us */
-        .strings        = fsg_strings,
-};
 /*-------------------------------------------------------------------------*/
@@ -401,7 +171,7 @@ static struct usb_gadget_strings	fsg_stringtab = {
 * the caller must own fsg->filesem for writing.
 */
-static void fsg_lun_close(struct fsg_lun *curlun)
+void fsg_lun_close(struct fsg_lun *curlun)
 {
        if (curlun->filp) {
                LDBG(curlun, "close backing file\n");
@@ -409,9 +179,9 @@ static void fsg_lun_close(struct fsg_lun *curlun)
                curlun->filp = NULL;
        }
 }
+EXPORT_SYMBOL(fsg_lun_close);
+int fsg_lun_open(struct fsg_lun *curlun, const char *filename)
-static int fsg_lun_open(struct fsg_lun *curlun, const char *filename)
 {
        int                             ro;
        struct file                     *filp = NULL;
@@ -508,6 +278,7 @@ out:
        fput(filp);
        return rc;
 }
+EXPORT_SYMBOL(fsg_lun_open);
 /*-------------------------------------------------------------------------*/
@@ -516,7 +287,7 @@ out:
 * Sync the file data, don't bother with the metadata.
 * This code was copied from fs/buffer.c:sys_fdatasync().
 */
-static int fsg_lun_fsync_sub(struct fsg_lun *curlun)
+int fsg_lun_fsync_sub(struct fsg_lun *curlun)
 {
        struct file     *filp = curlun->filp;
@@ -524,8 +295,9 @@ static int fsg_lun_fsync_sub(struct fsg_lun *curlun)
                return 0;
        return vfs_fsync(filp, 1);
 }
+EXPORT_SYMBOL(fsg_lun_fsync_sub);
-static void store_cdrom_address(u8 *dest, int msf, u32 addr)
+void store_cdrom_address(u8 *dest, int msf, u32 addr)
 {
        if (msf) {
                /* Convert to Minutes-Seconds-Frames */
@@ -542,34 +314,28 @@ static void store_cdrom_address(u8 *dest, int msf, u32 addr)
                put_unaligned_be32(addr, dest);
        }
 }
+EXPORT_SYMBOL(store_cdrom_address);
 /*-------------------------------------------------------------------------*/
-static ssize_t ro_show(struct device *dev, struct device_attribute *attr,
+ssize_t fsg_show_ro(struct fsg_lun *curlun, char *buf)
-                       char *buf)
 {
-        struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
        return sprintf(buf, "%d\n", fsg_lun_is_open(curlun)
                                  ? curlun->ro
                                  : curlun->initially_ro);
 }
+EXPORT_SYMBOL(fsg_show_ro);
-static ssize_t nofua_show(struct device *dev, struct device_attribute *attr,
+ssize_t fsg_show_nofua(struct fsg_lun *curlun, char *buf)
-                          char *buf)
 {
-        struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
        return sprintf(buf, "%u\n", curlun->nofua);
 }
+EXPORT_SYMBOL(fsg_show_nofua);
-static ssize_t file_show(struct device *dev, struct device_attribute *attr,
+ssize_t fsg_show_file(struct fsg_lun *curlun, struct rw_semaphore *filesem,
-                         char *buf)
+                      char *buf)
 {
-        struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
-        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
        char            *p;
        ssize_t         rc;
@@ -591,17 +357,44 @@ static ssize_t file_show(struct device *dev, struct device_attribute *attr,
        up_read(filesem);
        return rc;
 }
+EXPORT_SYMBOL(fsg_show_file);
+ssize_t fsg_show_cdrom(struct fsg_lun *curlun, char *buf)
+{
+        return sprintf(buf, "%u\n", curlun->cdrom);
+}
+EXPORT_SYMBOL(fsg_show_cdrom);
-static ssize_t ro_store(struct device *dev, struct device_attribute *attr,
+ssize_t fsg_show_removable(struct fsg_lun *curlun, char *buf)
-                        const char *buf, size_t count)
+{
+        return sprintf(buf, "%u\n", curlun->removable);
+}
+EXPORT_SYMBOL(fsg_show_removable);
+/*
+ * The caller must hold fsg->filesem for reading when calling this function.
+ */
+static ssize_t _fsg_store_ro(struct fsg_lun *curlun, bool ro)
+{
+        if (fsg_lun_is_open(curlun)) {
+                LDBG(curlun, "read-only status change prevented\n");
+                return -EBUSY;
+        }
+        curlun->ro = ro;
+        curlun->initially_ro = ro;
+        LDBG(curlun, "read-only status set to %d\n", curlun->ro);
+        return 0;
+}
+ssize_t fsg_store_ro(struct fsg_lun *curlun, struct rw_semaphore *filesem,
+                     const char *buf, size_t count)
 {
        ssize_t         rc;
-        struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
+        bool            ro;
-        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
-        unsigned        ro;
-        rc = kstrtouint(buf, 2, &ro);
+        rc = strtobool(buf, &ro);
        if (rc)
                return rc;
@@ -610,27 +403,21 @@ static ssize_t ro_store(struct device *dev, struct device_attribute *attr,
         * backing file is closed.
         */
        down_read(filesem);
-        if (fsg_lun_is_open(curlun)) {
+        rc = _fsg_store_ro(curlun, ro);
-                LDBG(curlun, "read-only status change prevented\n");
+        if (!rc)
-                rc = -EBUSY;
-        } else {
-                curlun->ro = ro;
-                curlun->initially_ro = ro;
-                LDBG(curlun, "read-only status set to %d\n", curlun->ro);
                rc = count;
-        }
        up_read(filesem);
        return rc;
 }
+EXPORT_SYMBOL(fsg_store_ro);
-static ssize_t nofua_store(struct device *dev, struct device_attribute *attr,
+ssize_t fsg_store_nofua(struct fsg_lun *curlun, const char *buf, size_t count)
-                           const char *buf, size_t count)
 {
-        struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
+        bool            nofua;
-        unsigned        nofua;
        int             ret;
-        ret = kstrtouint(buf, 2, &nofua);
+        ret = strtobool(buf, &nofua);
        if (ret)
                return ret;
@@ -642,12 +429,11 @@ static ssize_t nofua_store(struct device *dev, struct device_attribute *attr,
        return count;
 }
+EXPORT_SYMBOL(fsg_store_nofua);
-static ssize_t file_store(struct device *dev, struct device_attribute *attr,
+ssize_t fsg_store_file(struct fsg_lun *curlun, struct rw_semaphore *filesem,
-                          const char *buf, size_t count)
+                       const char *buf, size_t count)
 {
-        struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
-        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
        int             rc = 0;
        if (curlun->prevent_medium_removal && fsg_lun_is_open(curlun)) {
@@ -674,3 +460,45 @@ static ssize_t file_store(struct device *dev, struct device_attribute *attr,
        up_write(filesem);
        return (rc < 0 ? rc : count);
 }
+EXPORT_SYMBOL(fsg_store_file);
+ssize_t fsg_store_cdrom(struct fsg_lun *curlun, struct rw_semaphore *filesem,
+                        const char *buf, size_t count)
+{
+        bool            cdrom;
+        int             ret;
+        ret = strtobool(buf, &cdrom);
+        if (ret)
+                return ret;
+        down_read(filesem);
+        ret = cdrom ? _fsg_store_ro(curlun, true) : 0;
+        if (!ret) {
+                curlun->cdrom = cdrom;
+                ret = count;
+        }
+        up_read(filesem);
+        return ret;
+}
+EXPORT_SYMBOL(fsg_store_cdrom);
+ssize_t fsg_store_removable(struct fsg_lun *curlun, const char *buf,
+                            size_t count)
+{
+        bool            removable;
+        int             ret;
+        ret = strtobool(buf, &removable);
+        if (ret)
+                return ret;
+        curlun->removable = removable;
+        return count;
+}
+EXPORT_SYMBOL(fsg_store_removable);
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/gadget/storage_common.h b/drivers/usb/gadget/storage_common.h
new file mode 100644
index 000000000000..c74c2fdbd56e
--- /dev/null
+++ b/drivers/usb/gadget/storage_common.h
@@ -0,0 +1,229 @@
+#ifndef USB_STORAGE_COMMON_H
+#define USB_STORAGE_COMMON_H
+#include <linux/device.h>
+#include <linux/usb/storage.h>
+#include <scsi/scsi.h>
+#include <asm/unaligned.h>
+#ifndef DEBUG
+#undef VERBOSE_DEBUG
+#undef DUMP_MSGS
+#endif /* !DEBUG */
+#ifdef VERBOSE_DEBUG
+#define VLDBG   LDBG
+#else
+#define VLDBG(lun, fmt, args...) do { } while (0)
+#endif /* VERBOSE_DEBUG */
+#define _LMSG(func, lun, fmt, args...)                                  \
+        do {                                                            \
+                if ((lun)->name_pfx && *(lun)->name_pfx)                \
+                        func("%s/%s: " fmt, *(lun)->name_pfx,           \
+                                 (lun)->name, ## args);                 \
+                else                                                    \
+                        func("%s: " fmt, (lun)->name, ## args);         \
+        } while (0)
+#define LDBG(lun, fmt, args...)         _LMSG(pr_debug, lun, fmt, ## args)
+#define LERROR(lun, fmt, args...)       _LMSG(pr_err, lun, fmt, ## args)
+#define LWARN(lun, fmt, args...)        _LMSG(pr_warn, lun, fmt, ## args)
+#define LINFO(lun, fmt, args...)        _LMSG(pr_info, lun, fmt, ## args)
+#ifdef DUMP_MSGS
+#  define dump_msg(fsg, /* const char * */ label,                       \
+                   /* const u8 * */ buf, /* unsigned */ length)         \
+do {                                                                    \
+        if (length < 512) {                                             \
+                DBG(fsg, "%s, length %u:\n", label, length);            \
+                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET,      \
+                               16, 1, buf, length, 0);                  \
+        }                                                               \
+} while (0)
+#  define dump_cdb(fsg) do { } while (0)
+#else
+#  define dump_msg(fsg, /* const char * */ label, \
+                   /* const u8 * */ buf, /* unsigned */ length) do { } while (0)
+#  ifdef VERBOSE_DEBUG
+#    define dump_cdb(fsg)                                               \
+        print_hex_dump(KERN_DEBUG, "SCSI CDB: ", DUMP_PREFIX_NONE,      \
+                       16, 1, (fsg)->cmnd, (fsg)->cmnd_size, 0)         \
+#  else
+#    define dump_cdb(fsg) do { } while (0)
+#  endif /* VERBOSE_DEBUG */
+#endif /* DUMP_MSGS */
+/* Length of a SCSI Command Data Block */
+#define MAX_COMMAND_SIZE        16
+/* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
+#define SS_NO_SENSE                             0
+#define SS_COMMUNICATION_FAILURE                0x040800
+#define SS_INVALID_COMMAND                      0x052000
+#define SS_INVALID_FIELD_IN_CDB                 0x052400
+#define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE   0x052100
+#define SS_LOGICAL_UNIT_NOT_SUPPORTED           0x052500
+#define SS_MEDIUM_NOT_PRESENT                   0x023a00
+#define SS_MEDIUM_REMOVAL_PREVENTED             0x055302
+#define SS_NOT_READY_TO_READY_TRANSITION        0x062800
+#define SS_RESET_OCCURRED                       0x062900
+#define SS_SAVING_PARAMETERS_NOT_SUPPORTED      0x053900
+#define SS_UNRECOVERED_READ_ERROR               0x031100
+#define SS_WRITE_ERROR                          0x030c02
+#define SS_WRITE_PROTECTED                      0x072700
+#define SK(x)           ((u8) ((x) >> 16))      /* Sense Key byte, etc. */
+#define ASC(x)          ((u8) ((x) >> 8))
+#define ASCQ(x)         ((u8) (x))
+struct fsg_lun {
+        struct file     *filp;
+        loff_t          file_length;
+        loff_t          num_sectors;
+        unsigned int    initially_ro:1;
+        unsigned int    ro:1;
+        unsigned int    removable:1;
+        unsigned int    cdrom:1;
+        unsigned int    prevent_medium_removal:1;
+        unsigned int    registered:1;
+        unsigned int    info_valid:1;
+        unsigned int    nofua:1;
+        u32             sense_data;
+        u32             sense_data_info;
+        u32             unit_attention_data;
+        unsigned int    blkbits; /* Bits of logical block size
+                                                       of bound block device */
+        unsigned int    blksize; /* logical block size of bound block device */
+        struct device   dev;
+        const char      *name;          /* "lun.name" */
+        const char      **name_pfx;     /* "function.name" */
+};
+static inline bool fsg_lun_is_open(struct fsg_lun *curlun)
+{
+        return curlun->filp != NULL;
+}
+/* Big enough to hold our biggest descriptor */
+#define EP0_BUFSIZE     256
+#define DELAYED_STATUS  (EP0_BUFSIZE + 999)     /* An impossibly large value */
+/* Default size of buffer length. */
+#define FSG_BUFLEN      ((u32)16384)
+/* Maximal number of LUNs supported in mass storage function */
+#define FSG_MAX_LUNS    8
+enum fsg_buffer_state {
+        BUF_STATE_EMPTY = 0,
+        BUF_STATE_FULL,
+        BUF_STATE_BUSY
+};
+struct fsg_buffhd {
+        void                            *buf;
+        enum fsg_buffer_state           state;
+        struct fsg_buffhd               *next;
+        /*
+         * The NetChip 2280 is faster, and handles some protocol faults
+         * better, if we don't submit any short bulk-out read requests.
+         * So we will record the intended request length here.
+         */
+        unsigned int                    bulk_out_intended_length;
+        struct usb_request              *inreq;
+        int                             inreq_busy;
+        struct usb_request              *outreq;
+        int                             outreq_busy;
+};
+enum fsg_state {
+        /* This one isn't used anywhere */
+        FSG_STATE_COMMAND_PHASE = -10,
+        FSG_STATE_DATA_PHASE,
+        FSG_STATE_STATUS_PHASE,
+        FSG_STATE_IDLE = 0,
+        FSG_STATE_ABORT_BULK_OUT,
+        FSG_STATE_RESET,
+        FSG_STATE_INTERFACE_CHANGE,
+        FSG_STATE_CONFIG_CHANGE,
+        FSG_STATE_DISCONNECT,
+        FSG_STATE_EXIT,
+        FSG_STATE_TERMINATED
+};
+enum data_direction {
+        DATA_DIR_UNKNOWN = 0,
+        DATA_DIR_FROM_HOST,
+        DATA_DIR_TO_HOST,
+        DATA_DIR_NONE
+};
+static inline u32 get_unaligned_be24(u8 *buf)
+{
+        return 0xffffff & (u32) get_unaligned_be32(buf - 1);
+}
+static inline struct fsg_lun *fsg_lun_from_dev(struct device *dev)
+{
+        return container_of(dev, struct fsg_lun, dev);
+}
+enum {
+        FSG_STRING_INTERFACE
+};
+extern struct usb_interface_descriptor fsg_intf_desc;
+extern struct usb_endpoint_descriptor fsg_fs_bulk_in_desc;
+extern struct usb_endpoint_descriptor fsg_fs_bulk_out_desc;
+extern struct usb_descriptor_header *fsg_fs_function[];
+extern struct usb_endpoint_descriptor fsg_hs_bulk_in_desc;
+extern struct usb_endpoint_descriptor fsg_hs_bulk_out_desc;
+extern struct usb_descriptor_header *fsg_hs_function[];
+extern struct usb_endpoint_descriptor fsg_ss_bulk_in_desc;
+extern struct usb_ss_ep_comp_descriptor fsg_ss_bulk_in_comp_desc;
+extern struct usb_endpoint_descriptor fsg_ss_bulk_out_desc;
+extern struct usb_ss_ep_comp_descriptor fsg_ss_bulk_out_comp_desc;
+extern struct usb_descriptor_header *fsg_ss_function[];
+void fsg_lun_close(struct fsg_lun *curlun);
+int fsg_lun_open(struct fsg_lun *curlun, const char *filename);
+int fsg_lun_fsync_sub(struct fsg_lun *curlun);
+void store_cdrom_address(u8 *dest, int msf, u32 addr);
+ssize_t fsg_show_ro(struct fsg_lun *curlun, char *buf);
+ssize_t fsg_show_nofua(struct fsg_lun *curlun, char *buf);
+ssize_t fsg_show_file(struct fsg_lun *curlun, struct rw_semaphore *filesem,
+                      char *buf);
+ssize_t fsg_show_cdrom(struct fsg_lun *curlun, char *buf);
+ssize_t fsg_show_removable(struct fsg_lun *curlun, char *buf);
+ssize_t fsg_store_ro(struct fsg_lun *curlun, struct rw_semaphore *filesem,
+                     const char *buf, size_t count);
+ssize_t fsg_store_nofua(struct fsg_lun *curlun, const char *buf, size_t count);
+ssize_t fsg_store_file(struct fsg_lun *curlun, struct rw_semaphore *filesem,
+                       const char *buf, size_t count);
+ssize_t fsg_store_cdrom(struct fsg_lun *curlun, struct rw_semaphore *filesem,
+                        const char *buf, size_t count);
+ssize_t fsg_store_removable(struct fsg_lun *curlun, const char *buf,
+                            size_t count);
+#endif /* USB_STORAGE_COMMON_H */
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
index 0ff33396eef3..eccea1df702d 100644
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -472,7 +472,7 @@ static int usbg_bot_setup(struct usb_function *f,
                bot_enqueue_cmd_cbw(fu);
                return 0;
                break;
-        };
+        }
        return -ENOTSUPP;
 }
@@ -617,7 +617,7 @@ static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
        default:
                BUG();
-        };
+        }
        return;
 cleanup:
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index 59891b1c48fc..27768a7d986a 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -356,7 +356,8 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
        kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
        return 0;
 err1:
-        dev_err(&udc->dev, "failed to start %s: %d\n",
+        if (ret != -EISNAM)
+                dev_err(&udc->dev, "failed to start %s: %d\n",
                        udc->driver->function, ret);
        udc->driver = NULL;
        udc->dev.driver = NULL;
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 0deb9d6cde26..0dd07ae1555d 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -95,6 +95,18 @@ unsigned autoresume = DEFAULT_AUTORESUME;
 module_param(autoresume, uint, S_IRUGO);
 MODULE_PARM_DESC(autoresume, "zero, or seconds before remote wakeup");
+/* Maximum Autoresume time */
+unsigned max_autoresume;
+module_param(max_autoresume, uint, S_IRUGO);
+MODULE_PARM_DESC(max_autoresume, "maximum seconds before remote wakeup");
+/* Interval between two remote wakeups */
+unsigned autoresume_interval_ms;
+module_param(autoresume_interval_ms, uint, S_IRUGO);
+MODULE_PARM_DESC(autoresume_interval_ms,
+                "milliseconds to increase successive wakeup delays");
+static unsigned autoresume_step_ms;
 /*-------------------------------------------------------------------------*/
 static struct usb_device_descriptor device_desc = {
@@ -183,8 +195,16 @@ static void zero_suspend(struct usb_composite_dev *cdev)
                return;
        if (autoresume) {
-                mod_timer(&autoresume_timer, jiffies + (HZ * autoresume));
+                if (max_autoresume &&
-                DBG(cdev, "suspend, wakeup in %d seconds\n", autoresume);
+                        (autoresume_step_ms > max_autoresume * 1000))
+                                autoresume_step_ms = autoresume * 1000;
+                mod_timer(&autoresume_timer, jiffies +
+                        msecs_to_jiffies(autoresume_step_ms));
+                DBG(cdev, "suspend, wakeup in %d milliseconds\n",
+                        autoresume_step_ms);
+                autoresume_step_ms += autoresume_interval_ms;
        } else
                DBG(cdev, "%s\n", __func__);
 }
@@ -316,6 +336,7 @@ static int __init zero_bind(struct usb_composite_dev *cdev)
        if (autoresume) {
                sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
                loopback_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+                autoresume_step_ms = autoresume * 1000;
        }
        /* support OTG systems */
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index b3f20d7f15de..a9707da7da0b 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -54,7 +54,7 @@ config USB_EHCI_HCD
 config USB_EHCI_ROOT_HUB_TT
        bool "Root Hub Transaction Translators"
-        depends on USB_EHCI_HCD || USB_CHIPIDEA_HOST
+        depends on USB_EHCI_HCD
        ---help---
          Some EHCI chips have vendor-specific extensions to integrate
          transaction translators, so that no OHCI or UHCI companion
@@ -66,7 +66,7 @@ config USB_EHCI_ROOT_HUB_TT
 config USB_EHCI_TT_NEWSCHED
        bool "Improved Transaction Translator scheduling"
-        depends on USB_EHCI_HCD || USB_CHIPIDEA_HOST
+        depends on USB_EHCI_HCD
        default y
        ---help---
          This changes the periodic scheduling code to fill more of the low
@@ -203,12 +203,11 @@ config USB_EHCI_SH
          Enables support for the on-chip EHCI controller on the SuperH.
          If you use the PCI EHCI controller, this option is not necessary.
-config USB_EHCI_S5P
+config USB_EHCI_EXYNOS
       tristate "EHCI support for Samsung S5P/EXYNOS SoC Series"
       depends on PLAT_S5P || ARCH_EXYNOS
       help
-        Enable support for the Samsung S5Pxxxx and Exynos3/4/5 SOC's
+        Enable support for the Samsung Exynos SOC's on-chip EHCI controller.
-        on-chip EHCI controller.
 config USB_EHCI_MV
        bool "EHCI support for Marvell PXA/MMP USB controller"
@@ -224,7 +223,7 @@ config USB_EHCI_MV
          on-chip EHCI USB controller" for those.
 config USB_W90X900_EHCI
-        bool "W90X900(W90P910) EHCI support"
+        tristate "W90X900(W90P910) EHCI support"
        depends on ARCH_W90X900
        ---help---
                Enables support for the W90X900 USB controller
@@ -367,14 +366,54 @@ config USB_OHCI_HCD
 if USB_OHCI_HCD
 config USB_OHCI_HCD_OMAP1
-        bool "OHCI support for OMAP1/2 chips"
+        tristate "OHCI support for OMAP1/2 chips"
        depends on ARCH_OMAP1
        default y
        ---help---
          Enables support for the OHCI controller on OMAP1/2 chips.
+config USB_OHCI_HCD_SPEAR
+        tristate "Support for ST SPEAr on-chip OHCI USB controller"
+        depends on USB_OHCI_HCD && PLAT_SPEAR
+        default y
+        ---help---
+          Enables support for the on-chip OHCI controller on
+          ST SPEAr chips.
+config USB_OHCI_HCD_S3C2410
+        tristate "OHCI support for Samsung S3C24xx/S3C64xx SoC series"
+        depends on USB_OHCI_HCD && (ARCH_S3C24XX || ARCH_S3C64XX)
+        default y
+        ---help---
+          Enables support for the on-chip OHCI controller on
+          S3C24xx/S3C64xx chips.
+config USB_OHCI_HCD_LPC32XX
+        tristate "Support for LPC on-chip OHCI USB controller"
+        depends on USB_OHCI_HCD && ARCH_LPC32XX
+        default y
+        ---help---
+          Enables support for the on-chip OHCI controller on
+          NXP chips.
+config USB_OHCI_HCD_PXA27X
+        tristate "Support for PXA27X/PXA3XX on-chip OHCI USB controller"
+        depends on USB_OHCI_HCD && (PXA27x || PXA3xx)
+        default y
+        ---help---
+          Enables support for the on-chip OHCI controller on
+          PXA27x/PXA3xx chips.
+config USB_OHCI_HCD_AT91
+        tristate "Support for Atmel on-chip OHCI USB controller"
+        depends on USB_OHCI_HCD && ARCH_AT91
+        default y
+        ---help---
+          Enables support for the on-chip OHCI controller on
+          Atmel chips.
 config USB_OHCI_HCD_OMAP3
-        bool "OHCI support for OMAP3 and later chips"
+        tristate "OHCI support for OMAP3 and later chips"
        depends on (ARCH_OMAP3 || ARCH_OMAP4)
        default y
        ---help---
@@ -454,8 +493,8 @@ config USB_OHCI_SH
          If you use the PCI OHCI controller, this option is not necessary.
 config USB_OHCI_EXYNOS
-        boolean "OHCI support for Samsung EXYNOS SoC Series"
+        tristate "OHCI support for Samsung S5P/EXYNOS SoC Series"
-        depends on ARCH_EXYNOS
+        depends on PLAT_S5P || ARCH_EXYNOS
        help
         Enable support for the Samsung Exynos SOC's on-chip OHCI controller.
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index 50b0041c09a9..01e879ef3654 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -34,10 +34,11 @@ obj-$(CONFIG_USB_EHCI_MXC)	+= ehci-mxc.o
 obj-$(CONFIG_USB_EHCI_HCD_OMAP) += ehci-omap.o
 obj-$(CONFIG_USB_EHCI_HCD_ORION)        += ehci-orion.o
 obj-$(CONFIG_USB_EHCI_HCD_SPEAR)        += ehci-spear.o
-obj-$(CONFIG_USB_EHCI_S5P)      += ehci-s5p.o
+obj-$(CONFIG_USB_EHCI_EXYNOS)   += ehci-exynos.o
 obj-$(CONFIG_USB_EHCI_HCD_AT91) += ehci-atmel.o
 obj-$(CONFIG_USB_EHCI_MSM)      += ehci-msm.o
 obj-$(CONFIG_USB_EHCI_TEGRA)    += ehci-tegra.o
+obj-$(CONFIG_USB_W90X900_EHCI)  += ehci-w90x900.o
 obj-$(CONFIG_USB_OXU210HP_HCD)  += oxu210hp-hcd.o
 obj-$(CONFIG_USB_ISP116X_HCD)   += isp116x-hcd.o
@@ -46,6 +47,14 @@ obj-$(CONFIG_USB_ISP1362_HCD)	+= isp1362-hcd.o
 obj-$(CONFIG_USB_OHCI_HCD)      += ohci-hcd.o
 obj-$(CONFIG_USB_OHCI_HCD_PCI)  += ohci-pci.o
 obj-$(CONFIG_USB_OHCI_HCD_PLATFORM)     += ohci-platform.o
+obj-$(CONFIG_USB_OHCI_EXYNOS)   += ohci-exynos.o
+obj-$(CONFIG_USB_OHCI_HCD_OMAP1)        += ohci-omap.o
+obj-$(CONFIG_USB_OHCI_HCD_OMAP3)        += ohci-omap3.o
+obj-$(CONFIG_USB_OHCI_HCD_SPEAR)        += ohci-spear.o
+obj-$(CONFIG_USB_OHCI_HCD_AT91) += ohci-at91.o
+obj-$(CONFIG_USB_OHCI_HCD_S3C2410)      += ohci-s3c2410.o
+obj-$(CONFIG_USB_OHCI_HCD_LPC32XX)      += ohci-nxp.o
+obj-$(CONFIG_USB_OHCI_HCD_PXA27X)       += ohci-pxa27x.o
 obj-$(CONFIG_USB_UHCI_HCD)      += uhci-hcd.o
 obj-$(CONFIG_USB_FHCI_HCD)      += fhci.o
diff --git a/drivers/usb/host/ehci-atmel.c b/drivers/usb/host/ehci-atmel.c
index 3b645ff46f7b..f417526fb1f4 100644
--- a/drivers/usb/host/ehci-atmel.c
+++ b/drivers/usb/host/ehci-atmel.c
@@ -30,13 +30,17 @@ static const char hcd_name[] = "ehci-atmel";
 static struct hc_driver __read_mostly ehci_atmel_hc_driver;
 /* interface and function clocks */
-static struct clk *iclk, *fclk;
+static struct clk *iclk, *fclk, *uclk;
 static int clocked;
 /*-------------------------------------------------------------------------*/
 static void atmel_start_clock(void)
 {
+        if (IS_ENABLED(CONFIG_COMMON_CLK)) {
+                clk_set_rate(uclk, 48000000);
+                clk_prepare_enable(uclk);
+        }
        clk_prepare_enable(iclk);
        clk_prepare_enable(fclk);
        clocked = 1;
@@ -46,6 +50,8 @@ static void atmel_stop_clock(void)
 {
        clk_disable_unprepare(fclk);
        clk_disable_unprepare(iclk);
+        if (IS_ENABLED(CONFIG_COMMON_CLK))
+                clk_disable_unprepare(uclk);
        clocked = 0;
 }
@@ -130,6 +136,14 @@ static int ehci_atmel_drv_probe(struct platform_device *pdev)
                retval = -ENOENT;
                goto fail_request_resource;
        }
+        if (IS_ENABLED(CONFIG_COMMON_CLK)) {
+                uclk = devm_clk_get(&pdev->dev, "usb_clk");
+                if (IS_ERR(uclk)) {
+                        dev_err(&pdev->dev, "failed to get uclk\n");
+                        retval = PTR_ERR(uclk);
+                        goto fail_request_resource;
+                }
+        }
        ehci = hcd_to_ehci(hcd);
        /* registers start at offset 0x0 */
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index aa5b603f3933..4a9c2edbcb2b 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -334,6 +334,7 @@ static inline void remove_debug_files (struct ehci_hcd *bus) { }
 /* troubleshooting help: expose state in debugfs */
 static int debug_async_open(struct inode *, struct file *);
+static int debug_bandwidth_open(struct inode *, struct file *);
 static int debug_periodic_open(struct inode *, struct file *);
 static int debug_registers_open(struct inode *, struct file *);
@@ -347,6 +348,13 @@ static const struct file_operations debug_async_fops = {
        .release        = debug_close,
        .llseek         = default_llseek,
 };
+static const struct file_operations debug_bandwidth_fops = {
+        .owner          = THIS_MODULE,
+        .open           = debug_bandwidth_open,
+        .read           = debug_output,
+        .release        = debug_close,
+        .llseek         = default_llseek,
+};
 static const struct file_operations debug_periodic_fops = {
        .owner          = THIS_MODULE,
        .open           = debug_periodic_open,
@@ -379,7 +387,7 @@ struct debug_buffer {
                case QH_LOW_SPEED:  tmp = 'l'; break; \
                case QH_HIGH_SPEED: tmp = 'h'; break; \
                default: tmp = '?'; break; \
-                }; tmp; })
+                } tmp; })
 static inline char token_mark(struct ehci_hcd *ehci, __hc32 token)
 {
@@ -525,6 +533,89 @@ static ssize_t fill_async_buffer(struct debug_buffer *buf)
        return strlen(buf->output_buf);
 }
+static ssize_t fill_bandwidth_buffer(struct debug_buffer *buf)
+{
+        struct ehci_hcd         *ehci;
+        struct ehci_tt          *tt;
+        struct ehci_per_sched   *ps;
+        unsigned                temp, size;
+        char                    *next;
+        unsigned                i;
+        u8                      *bw;
+        u16                     *bf;
+        u8                      budget[EHCI_BANDWIDTH_SIZE];
+        ehci = hcd_to_ehci(bus_to_hcd(buf->bus));
+        next = buf->output_buf;
+        size = buf->alloc_size;
+        *next = 0;
+        spin_lock_irq(&ehci->lock);
+        /* Dump the HS bandwidth table */
+        temp = scnprintf(next, size,
+                        "HS bandwidth allocation (us per microframe)\n");
+        size -= temp;
+        next += temp;
+        for (i = 0; i < EHCI_BANDWIDTH_SIZE; i += 8) {
+                bw = &ehci->bandwidth[i];
+                temp = scnprintf(next, size,
+                                "%2u: %4u%4u%4u%4u%4u%4u%4u%4u\n",
+                                i, bw[0], bw[1], bw[2], bw[3],
+                                        bw[4], bw[5], bw[6], bw[7]);
+                size -= temp;
+                next += temp;
+        }
+        /* Dump all the FS/LS tables */
+        list_for_each_entry(tt, &ehci->tt_list, tt_list) {
+                temp = scnprintf(next, size,
+                                "\nTT %s port %d  FS/LS bandwidth allocation (us per frame)\n",
+                                dev_name(&tt->usb_tt->hub->dev),
+                                tt->tt_port + !!tt->usb_tt->multi);
+                size -= temp;
+                next += temp;
+                bf = tt->bandwidth;
+                temp = scnprintf(next, size,
+                                "  %5u%5u%5u%5u%5u%5u%5u%5u\n",
+                                bf[0], bf[1], bf[2], bf[3],
+                                        bf[4], bf[5], bf[6], bf[7]);
+                size -= temp;
+                next += temp;
+                temp = scnprintf(next, size,
+                                "FS/LS budget (us per microframe)\n");
+                size -= temp;
+                next += temp;
+                compute_tt_budget(budget, tt);
+                for (i = 0; i < EHCI_BANDWIDTH_SIZE; i += 8) {
+                        bw = &budget[i];
+                        temp = scnprintf(next, size,
+                                        "%2u: %4u%4u%4u%4u%4u%4u%4u%4u\n",
+                                        i, bw[0], bw[1], bw[2], bw[3],
+                                                bw[4], bw[5], bw[6], bw[7]);
+                        size -= temp;
+                        next += temp;
+                }
+                list_for_each_entry(ps, &tt->ps_list, ps_list) {
+                        temp = scnprintf(next, size,
+                                        "%s ep %02x:  %4u @ %2u.%u+%u mask %04x\n",
+                                        dev_name(&ps->udev->dev),
+                                        ps->ep->desc.bEndpointAddress,
+                                        ps->tt_usecs,
+                                        ps->bw_phase, ps->phase_uf,
+                                        ps->bw_period, ps->cs_mask);
+                        size -= temp;
+                        next += temp;
+                }
+        }
+        spin_unlock_irq(&ehci->lock);
+        return next - buf->output_buf;
+}
 #define DBG_SCHED_LIMIT 64
 static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
 {
@@ -571,7 +662,7 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
                        case Q_TYPE_QH:
                                hw = p.qh->hw;
                                temp = scnprintf (next, size, " qh%d-%04x/%p",
-                                                p.qh->period,
+                                                p.qh->ps.period,
                                                hc32_to_cpup(ehci,
                                                        &hw->hw_info2)
                                                        /* uframe masks */
@@ -618,7 +709,8 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
                                                speed_char (scratch),
                                                scratch & 0x007f,
                                                (scratch >> 8) & 0x000f, type,
-                                                p.qh->usecs, p.qh->c_usecs,
+                                                p.qh->ps.usecs,
+                                                p.qh->ps.c_usecs,
                                                temp,
                                                0x7ff & (scratch >> 16));
@@ -645,7 +737,7 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
                        case Q_TYPE_SITD:
                                temp = scnprintf (next, size,
                                        " sitd%d-%04x/%p",
-                                        p.sitd->stream->interval,
+                                        p.sitd->stream->ps.period,
                                        hc32_to_cpup(ehci, &p.sitd->hw_uframe)
                                                & 0x0000ffff,
                                        p.sitd);
@@ -918,6 +1010,7 @@ static int debug_close(struct inode *inode, struct file *file)
        return 0;
 }
 static int debug_async_open(struct inode *inode, struct file *file)
 {
        file->private_data = alloc_buffer(inode->i_private, fill_async_buffer);
@@ -925,6 +1018,14 @@ static int debug_async_open(struct inode *inode, struct file *file)
        return file->private_data ? 0 : -ENOMEM;
 }
+static int debug_bandwidth_open(struct inode *inode, struct file *file)
+{
+        file->private_data = alloc_buffer(inode->i_private,
+                        fill_bandwidth_buffer);
+        return file->private_data ? 0 : -ENOMEM;
+}
 static int debug_periodic_open(struct inode *inode, struct file *file)
 {
        struct debug_buffer *buf;
@@ -957,6 +1058,10 @@ static inline void create_debug_files (struct ehci_hcd *ehci)
                                                &debug_async_fops))
                goto file_error;
+        if (!debugfs_create_file("bandwidth", S_IRUGO, ehci->debug_dir, bus,
+                                                &debug_bandwidth_fops))
+                goto file_error;
        if (!debugfs_create_file("periodic", S_IRUGO, ehci->debug_dir, bus,
                                                &debug_periodic_fops))
                goto file_error;
diff --git a/drivers/usb/host/ehci-s5p.c b/drivers/usb/host/ehci-exynos.c
index 7c3de95c7054..016352e0f5a7 100644
--- a/drivers/usb/host/ehci-s5p.c
+++ b/drivers/usb/host/ehci-exynos.c
@@ -1,5 +1,5 @@
 /*
- * SAMSUNG S5P USB HOST EHCI Controller
+ * SAMSUNG EXYNOS USB HOST EHCI Controller
 *
 * Copyright (C) 2011 Samsung Electronics Co.Ltd
 * Author: Jingoo Han <jg1.han@samsung.com>
@@ -20,7 +20,6 @@
 #include <linux/of.h>
 #include <linux/of_gpio.h>
 #include <linux/platform_device.h>
-#include <linux/platform_data/usb-ehci-s5p.h>
 #include <linux/usb/phy.h>
 #include <linux/usb/samsung_usb_phy.h>
 #include <linux/usb.h>
@@ -29,7 +28,7 @@
 #include "ehci.h"
-#define DRIVER_DESC "EHCI s5p driver"
+#define DRIVER_DESC "EHCI EXYNOS driver"
 #define EHCI_INSNREG00(base)                    (base + 0x90)
 #define EHCI_INSNREG00_ENA_INCR16               (0x1 << 25)
@@ -40,21 +39,18 @@
        (EHCI_INSNREG00_ENA_INCR16 | EHCI_INSNREG00_ENA_INCR8 | \
         EHCI_INSNREG00_ENA_INCR4 | EHCI_INSNREG00_ENA_INCRX_ALIGN)
-static const char hcd_name[] = "ehci-s5p";
+static const char hcd_name[] = "ehci-exynos";
-static struct hc_driver __read_mostly s5p_ehci_hc_driver;
+static struct hc_driver __read_mostly exynos_ehci_hc_driver;
-struct s5p_ehci_hcd {
+struct exynos_ehci_hcd {
        struct clk *clk;
        struct usb_phy *phy;
        struct usb_otg *otg;
-        struct s5p_ehci_platdata *pdata;
 };
-static struct s5p_ehci_platdata empty_platdata;
+#define to_exynos_ehci(hcd) (struct exynos_ehci_hcd *)(hcd_to_ehci(hcd)->priv)
-#define to_s5p_ehci(hcd)      (struct s5p_ehci_hcd *)(hcd_to_ehci(hcd)->priv)
+static void exynos_setup_vbus_gpio(struct platform_device *pdev)
-static void s5p_setup_vbus_gpio(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
        int err;
@@ -73,10 +69,9 @@ static void s5p_setup_vbus_gpio(struct platform_device *pdev)
                dev_err(dev, "can't request ehci vbus gpio %d", gpio);
 }
-static int s5p_ehci_probe(struct platform_device *pdev)
+static int exynos_ehci_probe(struct platform_device *pdev)
 {
-        struct s5p_ehci_platdata *pdata = dev_get_platdata(&pdev->dev);
+        struct exynos_ehci_hcd *exynos_ehci;
-        struct s5p_ehci_hcd *s5p_ehci;
        struct usb_hcd *hcd;
        struct ehci_hcd *ehci;
        struct resource *res;
@@ -94,48 +89,41 @@ static int s5p_ehci_probe(struct platform_device *pdev)
        if (!pdev->dev.coherent_dma_mask)
                pdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
-        s5p_setup_vbus_gpio(pdev);
+        exynos_setup_vbus_gpio(pdev);
-        hcd = usb_create_hcd(&s5p_ehci_hc_driver,
+        hcd = usb_create_hcd(&exynos_ehci_hc_driver,
                             &pdev->dev, dev_name(&pdev->dev));
        if (!hcd) {
                dev_err(&pdev->dev, "Unable to create HCD\n");
                return -ENOMEM;
        }
-        s5p_ehci = to_s5p_ehci(hcd);
+        exynos_ehci = to_exynos_ehci(hcd);
        if (of_device_is_compatible(pdev->dev.of_node,
-                                        "samsung,exynos5440-ehci")) {
+                                        "samsung,exynos5440-ehci"))
-                s5p_ehci->pdata = &empty_platdata;
                goto skip_phy;
-        }
        phy = devm_usb_get_phy(&pdev->dev, USB_PHY_TYPE_USB2);
        if (IS_ERR(phy)) {
-                /* Fallback to pdata */
+                usb_put_hcd(hcd);
-                if (!pdata) {
+                dev_warn(&pdev->dev, "no platform data or transceiver defined\n");
-                        usb_put_hcd(hcd);
+                return -EPROBE_DEFER;
-                        dev_warn(&pdev->dev, "no platform data or transceiver defined\n");
-                        return -EPROBE_DEFER;
-                } else {
-                        s5p_ehci->pdata = pdata;
-                }
        } else {
-                s5p_ehci->phy = phy;
+                exynos_ehci->phy = phy;
-                s5p_ehci->otg = phy->otg;
+                exynos_ehci->otg = phy->otg;
        }
 skip_phy:
-        s5p_ehci->clk = devm_clk_get(&pdev->dev, "usbhost");
+        exynos_ehci->clk = devm_clk_get(&pdev->dev, "usbhost");
-        if (IS_ERR(s5p_ehci->clk)) {
+        if (IS_ERR(exynos_ehci->clk)) {
                dev_err(&pdev->dev, "Failed to get usbhost clock\n");
-                err = PTR_ERR(s5p_ehci->clk);
+                err = PTR_ERR(exynos_ehci->clk);
                goto fail_clk;
        }
-        err = clk_prepare_enable(s5p_ehci->clk);
+        err = clk_prepare_enable(exynos_ehci->clk);
        if (err)
                goto fail_clk;
@@ -162,13 +150,11 @@ skip_phy:
                goto fail_io;
        }
-        if (s5p_ehci->otg)
+        if (exynos_ehci->otg)
-                s5p_ehci->otg->set_host(s5p_ehci->otg, &hcd->self);
+                exynos_ehci->otg->set_host(exynos_ehci->otg, &hcd->self);
-        if (s5p_ehci->phy)
+        if (exynos_ehci->phy)
-                usb_phy_init(s5p_ehci->phy);
+                usb_phy_init(exynos_ehci->phy);
-        else if (s5p_ehci->pdata->phy_init)
-                s5p_ehci->pdata->phy_init(pdev, USB_PHY_TYPE_HOST);
        ehci = hcd_to_ehci(hcd);
        ehci->caps = hcd->regs;
@@ -187,33 +173,29 @@ skip_phy:
        return 0;
 fail_add_hcd:
-        if (s5p_ehci->phy)
+        if (exynos_ehci->phy)
-                usb_phy_shutdown(s5p_ehci->phy);
+                usb_phy_shutdown(exynos_ehci->phy);
-        else if (s5p_ehci->pdata->phy_exit)
-                s5p_ehci->pdata->phy_exit(pdev, USB_PHY_TYPE_HOST);
 fail_io:
-        clk_disable_unprepare(s5p_ehci->clk);
+        clk_disable_unprepare(exynos_ehci->clk);
 fail_clk:
        usb_put_hcd(hcd);
        return err;
 }
-static int s5p_ehci_remove(struct platform_device *pdev)
+static int exynos_ehci_remove(struct platform_device *pdev)
 {
        struct usb_hcd *hcd = platform_get_drvdata(pdev);
-        struct s5p_ehci_hcd *s5p_ehci = to_s5p_ehci(hcd);
+        struct exynos_ehci_hcd *exynos_ehci = to_exynos_ehci(hcd);
        usb_remove_hcd(hcd);
-        if (s5p_ehci->otg)
+        if (exynos_ehci->otg)
-                s5p_ehci->otg->set_host(s5p_ehci->otg, &hcd->self);
+                exynos_ehci->otg->set_host(exynos_ehci->otg, &hcd->self);
-        if (s5p_ehci->phy)
+        if (exynos_ehci->phy)
-                usb_phy_shutdown(s5p_ehci->phy);
+                usb_phy_shutdown(exynos_ehci->phy);
-        else if (s5p_ehci->pdata->phy_exit)
-                s5p_ehci->pdata->phy_exit(pdev, USB_PHY_TYPE_HOST);
-        clk_disable_unprepare(s5p_ehci->clk);
+        clk_disable_unprepare(exynos_ehci->clk);
        usb_put_hcd(hcd);
@@ -221,45 +203,39 @@ static int s5p_ehci_remove(struct platform_device *pdev)
 }
 #ifdef CONFIG_PM
-static int s5p_ehci_suspend(struct device *dev)
+static int exynos_ehci_suspend(struct device *dev)
 {
        struct usb_hcd *hcd = dev_get_drvdata(dev);
-        struct s5p_ehci_hcd *s5p_ehci = to_s5p_ehci(hcd);
+        struct exynos_ehci_hcd *exynos_ehci = to_exynos_ehci(hcd);
-        struct platform_device *pdev = to_platform_device(dev);
        bool do_wakeup = device_may_wakeup(dev);
        int rc;
        rc = ehci_suspend(hcd, do_wakeup);
-        if (s5p_ehci->otg)
+        if (exynos_ehci->otg)
-                s5p_ehci->otg->set_host(s5p_ehci->otg, &hcd->self);
+                exynos_ehci->otg->set_host(exynos_ehci->otg, &hcd->self);
-        if (s5p_ehci->phy)
+        if (exynos_ehci->phy)
-                usb_phy_shutdown(s5p_ehci->phy);
+                usb_phy_shutdown(exynos_ehci->phy);
-        else if (s5p_ehci->pdata->phy_exit)
-                s5p_ehci->pdata->phy_exit(pdev, USB_PHY_TYPE_HOST);
-        clk_disable_unprepare(s5p_ehci->clk);
+        clk_disable_unprepare(exynos_ehci->clk);
        return rc;
 }
-static int s5p_ehci_resume(struct device *dev)
+static int exynos_ehci_resume(struct device *dev)
 {
        struct usb_hcd *hcd = dev_get_drvdata(dev);
-        struct  s5p_ehci_hcd *s5p_ehci = to_s5p_ehci(hcd);
+        struct exynos_ehci_hcd *exynos_ehci = to_exynos_ehci(hcd);
-        struct platform_device *pdev = to_platform_device(dev);
-        clk_prepare_enable(s5p_ehci->clk);
+        clk_prepare_enable(exynos_ehci->clk);
-        if (s5p_ehci->otg)
+        if (exynos_ehci->otg)
-                s5p_ehci->otg->set_host(s5p_ehci->otg, &hcd->self);
+                exynos_ehci->otg->set_host(exynos_ehci->otg, &hcd->self);
-        if (s5p_ehci->phy)
+        if (exynos_ehci->phy)
-                usb_phy_init(s5p_ehci->phy);
+                usb_phy_init(exynos_ehci->phy);
-        else if (s5p_ehci->pdata->phy_init)
-                s5p_ehci->pdata->phy_init(pdev, USB_PHY_TYPE_HOST);
        /* DMA burst Enable */
        writel(EHCI_INSNREG00_ENABLE_DMA_BURST, EHCI_INSNREG00(hcd->regs));
@@ -268,13 +244,13 @@ static int s5p_ehci_resume(struct device *dev)
        return 0;
 }
 #else
-#define s5p_ehci_suspend        NULL
+#define exynos_ehci_suspend     NULL
-#define s5p_ehci_resume         NULL
+#define exynos_ehci_resume      NULL
 #endif
-static const struct dev_pm_ops s5p_ehci_pm_ops = {
+static const struct dev_pm_ops exynos_ehci_pm_ops = {
-        .suspend        = s5p_ehci_suspend,
+        .suspend        = exynos_ehci_suspend,
-        .resume         = s5p_ehci_resume,
+        .resume         = exynos_ehci_resume,
 };
 #ifdef CONFIG_OF
@@ -286,40 +262,40 @@ static const struct of_device_id exynos_ehci_match[] = {
 MODULE_DEVICE_TABLE(of, exynos_ehci_match);
 #endif
-static struct platform_driver s5p_ehci_driver = {
+static struct platform_driver exynos_ehci_driver = {
-        .probe          = s5p_ehci_probe,
+        .probe          = exynos_ehci_probe,
-        .remove         = s5p_ehci_remove,
+        .remove         = exynos_ehci_remove,
        .shutdown       = usb_hcd_platform_shutdown,
        .driver = {
-                .name   = "s5p-ehci",
+                .name   = "exynos-ehci",
                .owner  = THIS_MODULE,
-                .pm     = &s5p_ehci_pm_ops,
+                .pm     = &exynos_ehci_pm_ops,
                .of_match_table = of_match_ptr(exynos_ehci_match),
        }
 };
-static const struct ehci_driver_overrides s5p_overrides __initdata = {
+static const struct ehci_driver_overrides exynos_overrides __initdata = {
-        .extra_priv_size = sizeof(struct s5p_ehci_hcd),
+        .extra_priv_size = sizeof(struct exynos_ehci_hcd),
 };
-static int __init ehci_s5p_init(void)
+static int __init ehci_exynos_init(void)
 {
        if (usb_disabled())
                return -ENODEV;
        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
-        ehci_init_driver(&s5p_ehci_hc_driver, &s5p_overrides);
+        ehci_init_driver(&exynos_ehci_hc_driver, &exynos_overrides);
-        return platform_driver_register(&s5p_ehci_driver);
+        return platform_driver_register(&exynos_ehci_driver);
 }
-module_init(ehci_s5p_init);
+module_init(ehci_exynos_init);
-static void __exit ehci_s5p_cleanup(void)
+static void __exit ehci_exynos_cleanup(void)
 {
-        platform_driver_unregister(&s5p_ehci_driver);
+        platform_driver_unregister(&exynos_ehci_driver);
 }
-module_exit(ehci_s5p_cleanup);
+module_exit(ehci_exynos_cleanup);
 MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_ALIAS("platform:s5p-ehci");
+MODULE_ALIAS("platform:exynos-ehci");
 MODULE_AUTHOR("Jingoo Han");
 MODULE_AUTHOR("Joonyoung Shim");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index f2407b2e8a99..a06d5012201f 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -57,7 +57,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
        pr_debug("initializing FSL-SOC USB Controller\n");
        /* Need platform data for setup */
-        pdata = (struct fsl_usb2_platform_data *)dev_get_platdata(&pdev->dev);
+        pdata = dev_get_platdata(&pdev->dev);
        if (!pdata) {
                dev_err(&pdev->dev,
                        "No platform data for %s.\n", dev_name(&pdev->dev));
@@ -664,7 +664,7 @@ static const struct hc_driver ehci_fsl_hc_driver = {
         * generic hardware linkage
         */
        .irq = ehci_irq,
-        .flags = HCD_USB2 | HCD_MEMORY,
+        .flags = HCD_USB2 | HCD_MEMORY | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-grlib.c b/drivers/usb/host/ehci-grlib.c
index 83ab51af250f..b52a66ce92e8 100644
--- a/drivers/usb/host/ehci-grlib.c
+++ b/drivers/usb/host/ehci-grlib.c
@@ -43,7 +43,7 @@ static const struct hc_driver ehci_grlib_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2,
+        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 86ab9fd9fe9e..e8ba4c44223a 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -110,6 +110,9 @@ MODULE_PARM_DESC (ignore_oc, "ignore bogus hardware overcurrent indications");
 #include "ehci.h"
 #include "pci-quirks.h"
+static void compute_tt_budget(u8 budget_table[EHCI_BANDWIDTH_SIZE],
+                struct ehci_tt *tt);
 /*
 * The MosChip MCS9990 controller updates its microframe counter
 * a little before the frame counter, and occasionally we will read
@@ -484,6 +487,7 @@ static int ehci_init(struct usb_hcd *hcd)
        INIT_LIST_HEAD(&ehci->intr_qh_list);
        INIT_LIST_HEAD(&ehci->cached_itd_list);
        INIT_LIST_HEAD(&ehci->cached_sitd_list);
+        INIT_LIST_HEAD(&ehci->tt_list);
        if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
                /* periodic schedule size can be smaller than default */
@@ -956,6 +960,7 @@ rescan:
                        goto idle_timeout;
                /* BUG_ON(!list_empty(&stream->free_list)); */
+                reserve_release_iso_bandwidth(ehci, stream, -1);
                kfree(stream);
                goto done;
        }
@@ -982,6 +987,8 @@ idle_timeout:
                if (qh->clearing_tt)
                        goto idle_timeout;
                if (list_empty (&qh->qtd_list)) {
+                        if (qh->ps.bw_uperiod)
+                                reserve_release_intr_bandwidth(ehci, qh, -1);
                        qh_destroy(ehci, qh);
                        break;
                }
@@ -1022,7 +1029,6 @@ ehci_endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
         * the toggle bit in the QH.
         */
        if (qh) {
-                usb_settoggle(qh->dev, epnum, is_out, 0);
                if (!list_empty(&qh->qtd_list)) {
                        WARN_ONCE(1, "clear_halt for a busy endpoint\n");
                } else {
@@ -1030,6 +1036,7 @@ ehci_endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
                         * while the QH is active.  Unlink it now;
                         * re-linking will call qh_refresh().
                         */
+                        usb_settoggle(qh->ps.udev, epnum, is_out, 0);
                        qh->exception = 1;
                        if (eptype == USB_ENDPOINT_XFER_BULK)
                                start_unlink_async(ehci, qh);
@@ -1048,6 +1055,19 @@ static int ehci_get_frame (struct usb_hcd *hcd)
 /*-------------------------------------------------------------------------*/
+/* Device addition and removal */
+static void ehci_remove_device(struct usb_hcd *hcd, struct usb_device *udev)
+{
+        struct ehci_hcd         *ehci = hcd_to_ehci(hcd);
+        spin_lock_irq(&ehci->lock);
+        drop_tt(udev);
+        spin_unlock_irq(&ehci->lock);
+}
+/*-------------------------------------------------------------------------*/
 #ifdef  CONFIG_PM
 /* suspend/resume, section 4.3 */
@@ -1075,6 +1095,14 @@ int ehci_suspend(struct usb_hcd *hcd, bool do_wakeup)
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
        spin_unlock_irq(&ehci->lock);
+        synchronize_irq(hcd->irq);
+        /* Check for race with a wakeup request */
+        if (do_wakeup && HCD_WAKEUP_PENDING(hcd)) {
+                ehci_resume(hcd, false);
+                return -EBUSY;
+        }
        return 0;
 }
 EXPORT_SYMBOL_GPL(ehci_suspend);
@@ -1158,7 +1186,7 @@ static const struct hc_driver ehci_hc_driver = {
         * generic hardware linkage
         */
        .irq =                  ehci_irq,
-        .flags =                HCD_MEMORY | HCD_USB2,
+        .flags =                HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * basic lifecycle operations
@@ -1191,6 +1219,11 @@ static const struct hc_driver ehci_hc_driver = {
        .bus_resume =           ehci_bus_resume,
        .relinquish_port =      ehci_relinquish_port,
        .port_handed_over =     ehci_port_handed_over,
+        /*
+         * device support
+         */
+        .free_dev =             ehci_remove_device,
 };
 void ehci_init_driver(struct hc_driver *drv,
@@ -1238,11 +1271,6 @@ MODULE_LICENSE ("GPL");
 #define XILINX_OF_PLATFORM_DRIVER       ehci_hcd_xilinx_of_driver
 #endif
-#ifdef CONFIG_USB_W90X900_EHCI
-#include "ehci-w90x900.c"
-#define PLATFORM_DRIVER         ehci_hcd_w90x900_driver
-#endif
 #ifdef CONFIG_USB_OCTEON_EHCI
 #include "ehci-octeon.c"
 #define PLATFORM_DRIVER         ehci_octeon_driver
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index 52a77734a225..c0fb6a8ae6a3 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -224,11 +224,11 @@ static int ehci_mem_init (struct ehci_hcd *ehci, gfp_t flags)
                hw->hw_next = EHCI_LIST_END(ehci);
                hw->hw_qtd_next = EHCI_LIST_END(ehci);
                hw->hw_alt_next = EHCI_LIST_END(ehci);
-                hw->hw_token &= ~QTD_STS_ACTIVE;
                ehci->dummy->hw = hw;
                for (i = 0; i < ehci->periodic_size; i++)
-                        ehci->periodic[i] = ehci->dummy->qh_dma;
+                        ehci->periodic[i] = cpu_to_hc32(ehci,
+                                        ehci->dummy->qh_dma);
        } else {
                for (i = 0; i < ehci->periodic_size; i++)
                        ehci->periodic[i] = EHCI_LIST_END(ehci);
diff --git a/drivers/usb/host/ehci-msm.c b/drivers/usb/host/ehci-msm.c
index 0f717dc688b7..f341651d6f6c 100644
--- a/drivers/usb/host/ehci-msm.c
+++ b/drivers/usb/host/ehci-msm.c
@@ -42,7 +42,6 @@
 static const char hcd_name[] = "ehci-msm";
 static struct hc_driver __read_mostly msm_hc_driver;
-static struct usb_phy *phy;
 static int ehci_msm_reset(struct usb_hcd *hcd)
 {
@@ -70,6 +69,7 @@ static int ehci_msm_probe(struct platform_device *pdev)
 {
        struct usb_hcd *hcd;
        struct resource *res;
+        struct usb_phy *phy;
        int ret;
        dev_dbg(&pdev->dev, "ehci_msm proble\n");
@@ -108,10 +108,14 @@ static int ehci_msm_probe(struct platform_device *pdev)
         * powering up VBUS, mapping of registers address space and power
         * management.
         */
-        phy = devm_usb_get_phy(&pdev->dev, USB_PHY_TYPE_USB2);
+        if (pdev->dev.of_node)
+                phy = devm_usb_get_phy_by_phandle(&pdev->dev, "usb-phy", 0);
+        else
+                phy = devm_usb_get_phy(&pdev->dev, USB_PHY_TYPE_USB2);
        if (IS_ERR(phy)) {
                dev_err(&pdev->dev, "unable to find transceiver\n");
-                ret = -ENODEV;
+                ret = -EPROBE_DEFER;
                goto put_hcd;
        }
@@ -121,6 +125,7 @@ static int ehci_msm_probe(struct platform_device *pdev)
                goto put_hcd;
        }
+        hcd->phy = phy;
        device_init_wakeup(&pdev->dev, 1);
        /*
         * OTG device parent of HCD takes care of putting
@@ -147,7 +152,7 @@ static int ehci_msm_remove(struct platform_device *pdev)
        pm_runtime_disable(&pdev->dev);
        pm_runtime_set_suspended(&pdev->dev);
-        otg_set_host(phy->otg, NULL);
+        otg_set_host(hcd->phy->otg, NULL);
        /* FIXME: need to call usb_remove_hcd() here? */
@@ -186,12 +191,19 @@ static const struct dev_pm_ops ehci_msm_dev_pm_ops = {
        .resume          = ehci_msm_pm_resume,
 };
+static struct of_device_id msm_ehci_dt_match[] = {
+        { .compatible = "qcom,ehci-host", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, msm_ehci_dt_match);
 static struct platform_driver ehci_msm_driver = {
        .probe  = ehci_msm_probe,
        .remove = ehci_msm_remove,
        .driver = {
                   .name = "msm_hsusb_host",
                   .pm = &ehci_msm_dev_pm_ops,
+                   .of_match_table = msm_ehci_dt_match,
        },
 };
diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index 35cdbd88bbbe..417c10da9450 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -96,7 +96,7 @@ static const struct hc_driver mv_ehci_hc_driver = {
         * generic hardware linkage
         */
        .irq = ehci_irq,
-        .flags = HCD_MEMORY | HCD_USB2,
+        .flags = HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-octeon.c b/drivers/usb/host/ehci-octeon.c
index 45cc00158412..ab0397e4d8f3 100644
--- a/drivers/usb/host/ehci-octeon.c
+++ b/drivers/usb/host/ehci-octeon.c
@@ -51,7 +51,7 @@ static const struct hc_driver ehci_octeon_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2,
+        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 854c2ec7b699..3e86bf4371b3 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -58,8 +58,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
 {
        struct ehci_hcd         *ehci = hcd_to_ehci(hcd);
        struct pci_dev          *pdev = to_pci_dev(hcd->self.controller);
-        struct pci_dev          *p_smbus;
-        u8                      rev;
        u32                     temp;
        int                     retval;
@@ -175,22 +173,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                /* SB600 and old version of SB700 have a bug in EHCI controller,
                 * which causes usb devices lose response in some cases.
                 */
-                if ((pdev->device == 0x4386) || (pdev->device == 0x4396)) {
+                if ((pdev->device == 0x4386 || pdev->device == 0x4396) &&
-                        p_smbus = pci_get_device(PCI_VENDOR_ID_ATI,
+                                usb_amd_hang_symptom_quirk()) {
-                                                 PCI_DEVICE_ID_ATI_SBX00_SMBUS,
+                        u8 tmp;
-                                                 NULL);
+                        ehci_info(ehci, "applying AMD SB600/SB700 USB freeze workaround\n");
-                        if (!p_smbus)
+                        pci_read_config_byte(pdev, 0x53, &tmp);
-                                break;
+                        pci_write_config_byte(pdev, 0x53, tmp | (1<<3));
-                        rev = p_smbus->revision;
-                        if ((pdev->device == 0x4386) || (rev == 0x3a)
-                            || (rev == 0x3b)) {
-                                u8 tmp;
-                                ehci_info(ehci, "applying AMD SB600/SB700 USB "
-                                        "freeze workaround\n");
-                                pci_read_config_byte(pdev, 0x53, &tmp);
-                                pci_write_config_byte(pdev, 0x53, tmp | (1<<3));
-                        }
-                        pci_dev_put(p_smbus);
                }
                break;
        case PCI_VENDOR_ID_NETMOS:
diff --git a/drivers/usb/host/ehci-pmcmsp.c b/drivers/usb/host/ehci-pmcmsp.c
index 601e208bd782..893b707f0000 100644
--- a/drivers/usb/host/ehci-pmcmsp.c
+++ b/drivers/usb/host/ehci-pmcmsp.c
@@ -286,7 +286,7 @@ static const struct hc_driver ehci_msp_hc_driver = {
 #else
        .irq =                  ehci_irq,
 #endif
-        .flags =                HCD_MEMORY | HCD_USB2,
+        .flags =                HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c
index 932293fa32de..6cc5567bf9c8 100644
--- a/drivers/usb/host/ehci-ppc-of.c
+++ b/drivers/usb/host/ehci-ppc-of.c
@@ -28,7 +28,7 @@ static const struct hc_driver ehci_ppc_of_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2,
+        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-ps3.c b/drivers/usb/host/ehci-ps3.c
index fd983771b025..8188542ba17e 100644
--- a/drivers/usb/host/ehci-ps3.c
+++ b/drivers/usb/host/ehci-ps3.c
@@ -71,7 +71,7 @@ static const struct hc_driver ps3_ehci_hc_driver = {
        .product_desc           = "PS3 EHCI Host Controller",
        .hcd_priv_size          = sizeof(struct ehci_hcd),
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2,
+        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
        .reset                  = ps3_ehci_hc_reset,
        .start                  = ehci_run,
        .stop                   = ehci_stop,
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index a7f776a13eb1..db05bd8ee9d5 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -105,9 +105,9 @@ qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd)
                is_out = qh->is_out;
                epnum = (hc32_to_cpup(ehci, &hw->hw_info1) >> 8) & 0x0f;
-                if (unlikely (!usb_gettoggle (qh->dev, epnum, is_out))) {
+                if (unlikely(!usb_gettoggle(qh->ps.udev, epnum, is_out))) {
                        hw->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
-                        usb_settoggle (qh->dev, epnum, is_out, 1);
+                        usb_settoggle(qh->ps.udev, epnum, is_out, 1);
                }
        }
@@ -247,8 +247,6 @@ static int qtd_copy_status (
 static void
 ehci_urb_done(struct ehci_hcd *ehci, struct urb *urb, int status)
-__releases(ehci->lock)
-__acquires(ehci->lock)
 {
        if (usb_pipetype(urb->pipe) == PIPE_INTERRUPT) {
                /* ... update hc-wide periodic stats */
@@ -274,11 +272,8 @@ __acquires(ehci->lock)
                urb->actual_length, urb->transfer_buffer_length);
 #endif
-        /* complete() can reenter this HCD */
        usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
-        spin_unlock (&ehci->lock);
        usb_hcd_giveback_urb(ehci_to_hcd(ehci), urb, status);
-        spin_lock (&ehci->lock);
 }
 static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh);
@@ -802,26 +797,35 @@ qh_make (
         * For control/bulk requests, the HC or TT handles these.
         */
        if (type == PIPE_INTERRUPT) {
-                qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
+                unsigned        tmp;
+                qh->ps.usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
                                is_input, 0,
                                hb_mult(maxp) * max_packet(maxp)));
-                qh->start = NO_FRAME;
+                qh->ps.phase = NO_FRAME;
                if (urb->dev->speed == USB_SPEED_HIGH) {
-                        qh->c_usecs = 0;
+                        qh->ps.c_usecs = 0;
                        qh->gap_uf = 0;
-                        qh->period = urb->interval >> 3;
+                        if (urb->interval > 1 && urb->interval < 8) {
-                        if (qh->period == 0 && urb->interval != 1) {
                                /* NOTE interval 2 or 4 uframes could work.
                                 * But interval 1 scheduling is simpler, and
                                 * includes high bandwidth.
                                 */
                                urb->interval = 1;
-                        } else if (qh->period > ehci->periodic_size) {
+                        } else if (urb->interval > ehci->periodic_size << 3) {
-                                qh->period = ehci->periodic_size;
+                                urb->interval = ehci->periodic_size << 3;
-                                urb->interval = qh->period << 3;
                        }
+                        qh->ps.period = urb->interval >> 3;
+                        /* period for bandwidth allocation */
+                        tmp = min_t(unsigned, EHCI_BANDWIDTH_SIZE,
+                                        1 << (urb->ep->desc.bInterval - 1));
+                        /* Allow urb->interval to override */
+                        qh->ps.bw_uperiod = min_t(unsigned, tmp, urb->interval);
+                        qh->ps.bw_period = qh->ps.bw_uperiod >> 3;
                } else {
                        int             think_time;
@@ -831,27 +835,35 @@ qh_make (
                        /* FIXME this just approximates SPLIT/CSPLIT times */
                        if (is_input) {         // SPLIT, gap, CSPLIT+DATA
-                                qh->c_usecs = qh->usecs + HS_USECS (0);
+                                qh->ps.c_usecs = qh->ps.usecs + HS_USECS(0);
-                                qh->usecs = HS_USECS (1);
+                                qh->ps.usecs = HS_USECS(1);
                        } else {                // SPLIT+DATA, gap, CSPLIT
-                                qh->usecs += HS_USECS (1);
+                                qh->ps.usecs += HS_USECS(1);
-                                qh->c_usecs = HS_USECS (0);
+                                qh->ps.c_usecs = HS_USECS(0);
                        }
                        think_time = tt ? tt->think_time : 0;
-                        qh->tt_usecs = NS_TO_US (think_time +
+                        qh->ps.tt_usecs = NS_TO_US(think_time +
                                        usb_calc_bus_time (urb->dev->speed,
                                        is_input, 0, max_packet (maxp)));
-                        qh->period = urb->interval;
+                        if (urb->interval > ehci->periodic_size)
-                        if (qh->period > ehci->periodic_size) {
+                                urb->interval = ehci->periodic_size;
-                                qh->period = ehci->periodic_size;
+                        qh->ps.period = urb->interval;
-                                urb->interval = qh->period;
-                        }
+                        /* period for bandwidth allocation */
+                        tmp = min_t(unsigned, EHCI_BANDWIDTH_FRAMES,
+                                        urb->ep->desc.bInterval);
+                        tmp = rounddown_pow_of_two(tmp);
+                        /* Allow urb->interval to override */
+                        qh->ps.bw_period = min_t(unsigned, tmp, urb->interval);
+                        qh->ps.bw_uperiod = qh->ps.bw_period << 3;
                }
        }
        /* support for tt scheduling, and access to toggles */
-        qh->dev = urb->dev;
+        qh->ps.udev = urb->dev;
+        qh->ps.ep = urb->ep;
        /* using TT? */
        switch (urb->dev->speed) {
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 85dd24ed97a6..e113fd73aeae 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -103,83 +103,210 @@ static void periodic_unlink (struct ehci_hcd *ehci, unsigned frame, void *ptr)
                *hw_p = *shadow_next_periodic(ehci, &here,
                                Q_NEXT_TYPE(ehci, *hw_p));
        else
-                *hw_p = ehci->dummy->qh_dma;
+                *hw_p = cpu_to_hc32(ehci, ehci->dummy->qh_dma);
 }
-/* how many of the uframe's 125 usecs are allocated? */
+/*-------------------------------------------------------------------------*/
-static unsigned short
-periodic_usecs (struct ehci_hcd *ehci, unsigned frame, unsigned uframe)
+/* Bandwidth and TT management */
+/* Find the TT data structure for this device; create it if necessary */
+static struct ehci_tt *find_tt(struct usb_device *udev)
 {
-        __hc32                  *hw_p = &ehci->periodic [frame];
+        struct usb_tt           *utt = udev->tt;
-        union ehci_shadow       *q = &ehci->pshadow [frame];
+        struct ehci_tt          *tt, **tt_index, **ptt;
-        unsigned                usecs = 0;
+        unsigned                port;
-        struct ehci_qh_hw       *hw;
+        bool                    allocated_index = false;
-        while (q->ptr) {
+        if (!utt)
-                switch (hc32_to_cpu(ehci, Q_NEXT_TYPE(ehci, *hw_p))) {
+                return NULL;            /* Not below a TT */
-                case Q_TYPE_QH:
-                        hw = q->qh->hw;
+        /*
-                        /* is it in the S-mask? */
+         * Find/create our data structure.
-                        if (hw->hw_info2 & cpu_to_hc32(ehci, 1 << uframe))
+         * For hubs with a single TT, we get it directly.
-                                usecs += q->qh->usecs;
+         * For hubs with multiple TTs, there's an extra level of pointers.
-                        /* ... or C-mask? */
+         */
-                        if (hw->hw_info2 & cpu_to_hc32(ehci,
+        tt_index = NULL;
-                                        1 << (8 + uframe)))
+        if (utt->multi) {
-                                usecs += q->qh->c_usecs;
+                tt_index = utt->hcpriv;
-                        hw_p = &hw->hw_next;
+                if (!tt_index) {                /* Create the index array */
-                        q = &q->qh->qh_next;
+                        tt_index = kzalloc(utt->hub->maxchild *
-                        break;
+                                        sizeof(*tt_index), GFP_ATOMIC);
-                // case Q_TYPE_FSTN:
+                        if (!tt_index)
-                default:
+                                return ERR_PTR(-ENOMEM);
-                        /* for "save place" FSTNs, count the relevant INTR
+                        utt->hcpriv = tt_index;
-                         * bandwidth from the previous frame
+                        allocated_index = true;
-                         */
+                }
-                        if (q->fstn->hw_prev != EHCI_LIST_END(ehci)) {
+                port = udev->ttport - 1;
-                                ehci_dbg (ehci, "ignoring FSTN cost ...\n");
+                ptt = &tt_index[port];
-                        }
+        } else {
-                        hw_p = &q->fstn->hw_next;
+                port = 0;
-                        q = &q->fstn->fstn_next;
+                ptt = (struct ehci_tt **) &utt->hcpriv;
-                        break;
+        }
-                case Q_TYPE_ITD:
-                        if (q->itd->hw_transaction[uframe])
+        tt = *ptt;
-                                usecs += q->itd->stream->usecs;
+        if (!tt) {                              /* Create the ehci_tt */
-                        hw_p = &q->itd->hw_next;
+                struct ehci_hcd         *ehci =
-                        q = &q->itd->itd_next;
+                                hcd_to_ehci(bus_to_hcd(udev->bus));
-                        break;
-                case Q_TYPE_SITD:
-                        /* is it in the S-mask?  (count SPLIT, DATA) */
-                        if (q->sitd->hw_uframe & cpu_to_hc32(ehci,
-                                        1 << uframe)) {
-                                if (q->sitd->hw_fullspeed_ep &
-                                                cpu_to_hc32(ehci, 1<<31))
-                                        usecs += q->sitd->stream->usecs;
-                                else    /* worst case for OUT start-split */
-                                        usecs += HS_USECS_ISO (188);
-                        }
-                        /* ... C-mask?  (count CSPLIT, DATA) */
+                tt = kzalloc(sizeof(*tt), GFP_ATOMIC);
-                        if (q->sitd->hw_uframe &
+                if (!tt) {
-                                        cpu_to_hc32(ehci, 1 << (8 + uframe))) {
+                        if (allocated_index) {
-                                /* worst case for IN complete-split */
+                                utt->hcpriv = NULL;
-                                usecs += q->sitd->stream->c_usecs;
+                                kfree(tt_index);
                        }
+                        return ERR_PTR(-ENOMEM);
+                }
+                list_add_tail(&tt->tt_list, &ehci->tt_list);
+                INIT_LIST_HEAD(&tt->ps_list);
+                tt->usb_tt = utt;
+                tt->tt_port = port;
+                *ptt = tt;
+        }
-                        hw_p = &q->sitd->hw_next;
+        return tt;
-                        q = &q->sitd->sitd_next;
+}
-                        break;
+/* Release the TT above udev, if it's not in use */
+static void drop_tt(struct usb_device *udev)
+{
+        struct usb_tt           *utt = udev->tt;
+        struct ehci_tt          *tt, **tt_index, **ptt;
+        int                     cnt, i;
+        if (!utt || !utt->hcpriv)
+                return;         /* Not below a TT, or never allocated */
+        cnt = 0;
+        if (utt->multi) {
+                tt_index = utt->hcpriv;
+                ptt = &tt_index[udev->ttport - 1];
+                /* How many entries are left in tt_index? */
+                for (i = 0; i < utt->hub->maxchild; ++i)
+                        cnt += !!tt_index[i];
+        } else {
+                tt_index = NULL;
+                ptt = (struct ehci_tt **) &utt->hcpriv;
+        }
+        tt = *ptt;
+        if (!tt || !list_empty(&tt->ps_list))
+                return;         /* never allocated, or still in use */
+        list_del(&tt->tt_list);
+        *ptt = NULL;
+        kfree(tt);
+        if (cnt == 1) {
+                utt->hcpriv = NULL;
+                kfree(tt_index);
+        }
+}
+static void bandwidth_dbg(struct ehci_hcd *ehci, int sign, char *type,
+                struct ehci_per_sched *ps)
+{
+        dev_dbg(&ps->udev->dev,
+                        "ep %02x: %s %s @ %u+%u (%u.%u+%u) [%u/%u us] mask %04x\n",
+                        ps->ep->desc.bEndpointAddress,
+                        (sign >= 0 ? "reserve" : "release"), type,
+                        (ps->bw_phase << 3) + ps->phase_uf, ps->bw_uperiod,
+                        ps->phase, ps->phase_uf, ps->period,
+                        ps->usecs, ps->c_usecs, ps->cs_mask);
+}
+static void reserve_release_intr_bandwidth(struct ehci_hcd *ehci,
+                struct ehci_qh *qh, int sign)
+{
+        unsigned                start_uf;
+        unsigned                i, j, m;
+        int                     usecs = qh->ps.usecs;
+        int                     c_usecs = qh->ps.c_usecs;
+        int                     tt_usecs = qh->ps.tt_usecs;
+        struct ehci_tt          *tt;
+        if (qh->ps.phase == NO_FRAME)   /* Bandwidth wasn't reserved */
+                return;
+        start_uf = qh->ps.bw_phase << 3;
+        bandwidth_dbg(ehci, sign, "intr", &qh->ps);
+        if (sign < 0) {         /* Release bandwidth */
+                usecs = -usecs;
+                c_usecs = -c_usecs;
+                tt_usecs = -tt_usecs;
+        }
+        /* Entire transaction (high speed) or start-split (full/low speed) */
+        for (i = start_uf + qh->ps.phase_uf; i < EHCI_BANDWIDTH_SIZE;
+                        i += qh->ps.bw_uperiod)
+                ehci->bandwidth[i] += usecs;
+        /* Complete-split (full/low speed) */
+        if (qh->ps.c_usecs) {
+                /* NOTE: adjustments needed for FSTN */
+                for (i = start_uf; i < EHCI_BANDWIDTH_SIZE;
+                                i += qh->ps.bw_uperiod) {
+                        for ((j = 2, m = 1 << (j+8)); j < 8; (++j, m <<= 1)) {
+                                if (qh->ps.cs_mask & m)
+                                        ehci->bandwidth[i+j] += c_usecs;
+                        }
                }
        }
-#if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
-        if (usecs > ehci->uframe_periodic_max)
+        /* FS/LS bus bandwidth */
-                ehci_err (ehci, "uframe %d sched overrun: %d usecs\n",
+        if (tt_usecs) {
-                        frame * 8 + uframe, usecs);
+                tt = find_tt(qh->ps.udev);
-#endif
+                if (sign > 0)
-        return usecs;
+                        list_add_tail(&qh->ps.ps_list, &tt->ps_list);
+                else
+                        list_del(&qh->ps.ps_list);
+                for (i = start_uf >> 3; i < EHCI_BANDWIDTH_FRAMES;
+                                i += qh->ps.bw_period)
+                        tt->bandwidth[i] += tt_usecs;
+        }
 }
 /*-------------------------------------------------------------------------*/
-static int same_tt (struct usb_device *dev1, struct usb_device *dev2)
+static void compute_tt_budget(u8 budget_table[EHCI_BANDWIDTH_SIZE],
+                struct ehci_tt *tt)
+{
+        struct ehci_per_sched   *ps;
+        unsigned                uframe, uf, x;
+        u8                      *budget_line;
+        if (!tt)
+                return;
+        memset(budget_table, 0, EHCI_BANDWIDTH_SIZE);
+        /* Add up the contributions from all the endpoints using this TT */
+        list_for_each_entry(ps, &tt->ps_list, ps_list) {
+                for (uframe = ps->bw_phase << 3; uframe < EHCI_BANDWIDTH_SIZE;
+                                uframe += ps->bw_uperiod) {
+                        budget_line = &budget_table[uframe];
+                        x = ps->tt_usecs;
+                        /* propagate the time forward */
+                        for (uf = ps->phase_uf; uf < 8; ++uf) {
+                                x += budget_line[uf];
+                                /* Each microframe lasts 125 us */
+                                if (x <= 125) {
+                                        budget_line[uf] = x;
+                                        break;
+                                } else {
+                                        budget_line[uf] = 125;
+                                        x -= 125;
+                                }
+                        }
+                }
+        }
+}
+static int __maybe_unused same_tt(struct usb_device *dev1,
+                struct usb_device *dev2)
 {
        if (!dev1->tt || !dev2->tt)
                return 0;
@@ -227,68 +354,6 @@ static inline void carryover_tt_bandwidth(unsigned short tt_usecs[8])
        }
 }
-/* How many of the tt's periodic downstream 1000 usecs are allocated?
- *
- * While this measures the bandwidth in terms of usecs/uframe,
- * the low/fullspeed bus has no notion of uframes, so any particular
- * low/fullspeed transfer can "carry over" from one uframe to the next,
- * since the TT just performs downstream transfers in sequence.
- *
- * For example two separate 100 usec transfers can start in the same uframe,
- * and the second one would "carry over" 75 usecs into the next uframe.
- */
-static void
-periodic_tt_usecs (
-        struct ehci_hcd *ehci,
-        struct usb_device *dev,
-        unsigned frame,
-        unsigned short tt_usecs[8]
-)
-{
-        __hc32                  *hw_p = &ehci->periodic [frame];
-        union ehci_shadow       *q = &ehci->pshadow [frame];
-        unsigned char           uf;
-        memset(tt_usecs, 0, 16);
-        while (q->ptr) {
-                switch (hc32_to_cpu(ehci, Q_NEXT_TYPE(ehci, *hw_p))) {
-                case Q_TYPE_ITD:
-                        hw_p = &q->itd->hw_next;
-                        q = &q->itd->itd_next;
-                        continue;
-                case Q_TYPE_QH:
-                        if (same_tt(dev, q->qh->dev)) {
-                                uf = tt_start_uframe(ehci, q->qh->hw->hw_info2);
-                                tt_usecs[uf] += q->qh->tt_usecs;
-                        }
-                        hw_p = &q->qh->hw->hw_next;
-                        q = &q->qh->qh_next;
-                        continue;
-                case Q_TYPE_SITD:
-                        if (same_tt(dev, q->sitd->urb->dev)) {
-                                uf = tt_start_uframe(ehci, q->sitd->hw_uframe);
-                                tt_usecs[uf] += q->sitd->stream->tt_usecs;
-                        }
-                        hw_p = &q->sitd->hw_next;
-                        q = &q->sitd->sitd_next;
-                        continue;
-                // case Q_TYPE_FSTN:
-                default:
-                        ehci_dbg(ehci, "ignoring periodic frame %d FSTN\n",
-                                        frame);
-                        hw_p = &q->fstn->hw_next;
-                        q = &q->fstn->fstn_next;
-                }
-        }
-        carryover_tt_bandwidth(tt_usecs);
-        if (max_tt_usecs[7] < tt_usecs[7])
-                ehci_err(ehci, "frame %d tt sched overrun: %d usecs\n",
-                        frame, tt_usecs[7] - max_tt_usecs[7]);
-}
 /*
 * Return true if the device's tt's downstream bus is available for a
 * periodic transfer of the specified length (usecs), starting at the
@@ -312,20 +377,29 @@ periodic_tt_usecs (
 */
 static int tt_available (
        struct ehci_hcd         *ehci,
-        unsigned                period,
+        struct ehci_per_sched   *ps,
-        struct usb_device       *dev,
+        struct ehci_tt          *tt,
        unsigned                frame,
-        unsigned                uframe,
+        unsigned                uframe
-        u16                     usecs
 )
 {
+        unsigned                period = ps->bw_period;
+        unsigned                usecs = ps->tt_usecs;
        if ((period == 0) || (uframe >= 7))     /* error */
                return 0;
-        for (; frame < ehci->periodic_size; frame += period) {
+        for (frame &= period - 1; frame < EHCI_BANDWIDTH_FRAMES;
-                unsigned short tt_usecs[8];
+                        frame += period) {
+                unsigned        i, uf;
+                unsigned short  tt_usecs[8];
-                periodic_tt_usecs (ehci, dev, frame, tt_usecs);
+                if (tt->bandwidth[frame] + usecs > 900)
+                        return 0;
+                uf = frame << 3;
+                for (i = 0; i < 8; (++i, ++uf))
+                        tt_usecs[i] = ehci->tt_budget[uf];
                if (max_tt_usecs[uframe] <= tt_usecs[uframe])
                        return 0;
@@ -337,7 +411,7 @@ static int tt_available (
                 */
                if (125 < usecs) {
                        int ufs = (usecs / 125);
-                        int i;
                        for (i = uframe; i < (uframe + ufs) && i < 8; i++)
                                if (0 < tt_usecs[i])
                                        return 0;
@@ -391,7 +465,7 @@ static int tt_no_collision (
                                continue;
                        case Q_TYPE_QH:
                                hw = here.qh->hw;
-                                if (same_tt (dev, here.qh->dev)) {
+                                if (same_tt(dev, here.qh->ps.udev)) {
                                        u32             mask;
                                        mask = hc32_to_cpu(ehci,
@@ -471,19 +545,19 @@ static void disable_periodic(struct ehci_hcd *ehci)
 static void qh_link_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
        unsigned        i;
-        unsigned        period = qh->period;
+        unsigned        period = qh->ps.period;
-        dev_dbg (&qh->dev->dev,
+        dev_dbg(&qh->ps.udev->dev,
                "link qh%d-%04x/%p start %d [%d/%d us]\n",
                period, hc32_to_cpup(ehci, &qh->hw->hw_info2)
                        & (QH_CMASK | QH_SMASK),
-                qh, qh->start, qh->usecs, qh->c_usecs);
+                qh, qh->ps.phase, qh->ps.usecs, qh->ps.c_usecs);
        /* high bandwidth, or otherwise every microframe */
        if (period == 0)
                period = 1;
-        for (i = qh->start; i < ehci->periodic_size; i += period) {
+        for (i = qh->ps.phase; i < ehci->periodic_size; i += period) {
                union ehci_shadow       *prev = &ehci->pshadow[i];
                __hc32                  *hw_p = &ehci->periodic[i];
                union ehci_shadow       here = *prev;
@@ -503,7 +577,7 @@ static void qh_link_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh)
                 * enables sharing interior tree nodes
                 */
                while (here.ptr && qh != here.qh) {
-                        if (qh->period > here.qh->period)
+                        if (qh->ps.period > here.qh->ps.period)
                                break;
                        prev = &here.qh->qh_next;
                        hw_p = &here.qh->hw->hw_next;
@@ -523,10 +597,10 @@ static void qh_link_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh)
        qh->xacterrs = 0;
        qh->exception = 0;
-        /* update per-qh bandwidth for usbfs */
+        /* update per-qh bandwidth for debugfs */
-        ehci_to_hcd(ehci)->self.bandwidth_allocated += qh->period
+        ehci_to_hcd(ehci)->self.bandwidth_allocated += qh->ps.bw_period
-                ? ((qh->usecs + qh->c_usecs) / qh->period)
+                ? ((qh->ps.usecs + qh->ps.c_usecs) / qh->ps.bw_period)
-                : (qh->usecs * 8);
+                : (qh->ps.usecs * 8);
        list_add(&qh->intr_node, &ehci->intr_qh_list);
@@ -556,22 +630,21 @@ static void qh_unlink_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh)
         */
        /* high bandwidth, or otherwise part of every microframe */
-        if ((period = qh->period) == 0)
+        period = qh->ps.period ? : 1;
-                period = 1;
-        for (i = qh->start; i < ehci->periodic_size; i += period)
+        for (i = qh->ps.phase; i < ehci->periodic_size; i += period)
                periodic_unlink (ehci, i, qh);
-        /* update per-qh bandwidth for usbfs */
+        /* update per-qh bandwidth for debugfs */
-        ehci_to_hcd(ehci)->self.bandwidth_allocated -= qh->period
+        ehci_to_hcd(ehci)->self.bandwidth_allocated -= qh->ps.bw_period
-                ? ((qh->usecs + qh->c_usecs) / qh->period)
+                ? ((qh->ps.usecs + qh->ps.c_usecs) / qh->ps.bw_period)
-                : (qh->usecs * 8);
+                : (qh->ps.usecs * 8);
-        dev_dbg (&qh->dev->dev,
+        dev_dbg(&qh->ps.udev->dev,
                "unlink qh%d-%04x/%p start %d [%d/%d us]\n",
-                qh->period,
+                qh->ps.period,
                hc32_to_cpup(ehci, &qh->hw->hw_info2) & (QH_CMASK | QH_SMASK),
-                qh, qh->start, qh->usecs, qh->c_usecs);
+                qh, qh->ps.phase, qh->ps.usecs, qh->ps.c_usecs);
        /* qh->qh_next still "live" to HC */
        qh->qh_state = QH_STATE_UNLINK;
@@ -694,11 +767,9 @@ static int check_period (
        struct ehci_hcd *ehci,
        unsigned        frame,
        unsigned        uframe,
-        unsigned        period,
+        unsigned        uperiod,
        unsigned        usecs
 ) {
-        int             claimed;
        /* complete split running into next frame?
         * given FSTN support, we could sometimes check...
         */
@@ -708,25 +779,10 @@ static int check_period (
        /* convert "usecs we need" to "max already claimed" */
        usecs = ehci->uframe_periodic_max - usecs;
-        /* we "know" 2 and 4 uframe intervals were rejected; so
+        for (uframe += frame << 3; uframe < EHCI_BANDWIDTH_SIZE;
-         * for period 0, check _every_ microframe in the schedule.
+                        uframe += uperiod) {
-         */
+                if (ehci->bandwidth[uframe] > usecs)
-        if (unlikely (period == 0)) {
+                        return 0;
-                do {
-                        for (uframe = 0; uframe < 7; uframe++) {
-                                claimed = periodic_usecs (ehci, frame, uframe);
-                                if (claimed > usecs)
-                                        return 0;
-                        }
-                } while ((frame += 1) < ehci->periodic_size);
-        /* just check the specified uframe, at that period */
-        } else {
-                do {
-                        claimed = periodic_usecs (ehci, frame, uframe);
-                        if (claimed > usecs)
-                                return 0;
-                } while ((frame += period) < ehci->periodic_size);
        }
        // success!
@@ -737,40 +793,40 @@ static int check_intr_schedule (
        struct ehci_hcd         *ehci,
        unsigned                frame,
        unsigned                uframe,
-        const struct ehci_qh    *qh,
+        struct ehci_qh          *qh,
-        __hc32                  *c_maskp
+        unsigned                *c_maskp,
+        struct ehci_tt          *tt
 )
 {
        int             retval = -ENOSPC;
        u8              mask = 0;
-        if (qh->c_usecs && uframe >= 6)         /* FSTN territory? */
+        if (qh->ps.c_usecs && uframe >= 6)      /* FSTN territory? */
                goto done;
-        if (!check_period (ehci, frame, uframe, qh->period, qh->usecs))
+        if (!check_period(ehci, frame, uframe, qh->ps.bw_uperiod, qh->ps.usecs))
                goto done;
-        if (!qh->c_usecs) {
+        if (!qh->ps.c_usecs) {
                retval = 0;
                *c_maskp = 0;
                goto done;
        }
 #ifdef CONFIG_USB_EHCI_TT_NEWSCHED
-        if (tt_available (ehci, qh->period, qh->dev, frame, uframe,
+        if (tt_available(ehci, &qh->ps, tt, frame, uframe)) {
-                                qh->tt_usecs)) {
                unsigned i;
                /* TODO : this may need FSTN for SSPLIT in uframe 5. */
-                for (i=uframe+1; i<8 && i<uframe+4; i++)
+                for (i = uframe+2; i < 8 && i <= uframe+4; i++)
-                        if (!check_period (ehci, frame, i,
+                        if (!check_period(ehci, frame, i,
-                                                qh->period, qh->c_usecs))
+                                        qh->ps.bw_uperiod, qh->ps.c_usecs))
                                goto done;
                        else
                                mask |= 1 << i;
                retval = 0;
-                *c_maskp = cpu_to_hc32(ehci, mask << 8);
+                *c_maskp = mask;
        }
 #else
        /* Make sure this tt's buffer is also available for CSPLITs.
@@ -781,15 +837,15 @@ static int check_intr_schedule (
         * one smart pass...
         */
        mask = 0x03 << (uframe + qh->gap_uf);
-        *c_maskp = cpu_to_hc32(ehci, mask << 8);
+        *c_maskp = mask;
        mask |= 1 << uframe;
-        if (tt_no_collision (ehci, qh->period, qh->dev, frame, mask)) {
+        if (tt_no_collision(ehci, qh->ps.bw_period, qh->ps.udev, frame, mask)) {
-                if (!check_period (ehci, frame, uframe + qh->gap_uf + 1,
+                if (!check_period(ehci, frame, uframe + qh->gap_uf + 1,
-                                        qh->period, qh->c_usecs))
+                                qh->ps.bw_uperiod, qh->ps.c_usecs))
                        goto done;
-                if (!check_period (ehci, frame, uframe + qh->gap_uf,
+                if (!check_period(ehci, frame, uframe + qh->gap_uf,
-                                        qh->period, qh->c_usecs))
+                                qh->ps.bw_uperiod, qh->ps.c_usecs))
                        goto done;
                retval = 0;
        }
@@ -803,62 +859,67 @@ done:
 */
 static int qh_schedule(struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
-        int             status;
+        int             status = 0;
        unsigned        uframe;
-        __hc32          c_mask;
+        unsigned        c_mask;
-        unsigned        frame;          /* 0..(qh->period - 1), or NO_FRAME */
        struct ehci_qh_hw       *hw = qh->hw;
+        struct ehci_tt          *tt;
        hw->hw_next = EHCI_LIST_END(ehci);
-        frame = qh->start;
        /* reuse the previous schedule slots, if we can */
-        if (frame < qh->period) {
+        if (qh->ps.phase != NO_FRAME) {
-                uframe = ffs(hc32_to_cpup(ehci, &hw->hw_info2) & QH_SMASK);
+                ehci_dbg(ehci, "reused qh %p schedule\n", qh);
-                status = check_intr_schedule (ehci, frame, --uframe,
+                return 0;
-                                qh, &c_mask);
+        }
-        } else {
-                uframe = 0;
+        uframe = 0;
-                c_mask = 0;
+        c_mask = 0;
-                status = -ENOSPC;
+        tt = find_tt(qh->ps.udev);
+        if (IS_ERR(tt)) {
+                status = PTR_ERR(tt);
+                goto done;
        }
+        compute_tt_budget(ehci->tt_budget, tt);
        /* else scan the schedule to find a group of slots such that all
         * uframes have enough periodic bandwidth available.
         */
-        if (status) {
+        /* "normal" case, uframing flexible except with splits */
-                /* "normal" case, uframing flexible except with splits */
+        if (qh->ps.bw_period) {
-                if (qh->period) {
+                int             i;
-                        int             i;
+                unsigned        frame;
-                        for (i = qh->period; status && i > 0; --i) {
+                for (i = qh->ps.bw_period; i > 0; --i) {
-                                frame = ++ehci->random_frame % qh->period;
+                        frame = ++ehci->random_frame & (qh->ps.bw_period - 1);
-                                for (uframe = 0; uframe < 8; uframe++) {
+                        for (uframe = 0; uframe < 8; uframe++) {
-                                        status = check_intr_schedule (ehci,
+                                status = check_intr_schedule(ehci,
-                                                        frame, uframe, qh,
+                                                frame, uframe, qh, &c_mask, tt);
-                                                        &c_mask);
+                                if (status == 0)
-                                        if (status == 0)
+                                        goto got_it;
-                                                break;
-                                }
                        }
-                /* qh->period == 0 means every uframe */
-                } else {
-                        frame = 0;
-                        status = check_intr_schedule (ehci, 0, 0, qh, &c_mask);
                }
-                if (status)
-                        goto done;
-                qh->start = frame;
-                /* reset S-frame and (maybe) C-frame masks */
+        /* qh->ps.bw_period == 0 means every uframe */
-                hw->hw_info2 &= cpu_to_hc32(ehci, ~(QH_CMASK | QH_SMASK));
+        } else {
-                hw->hw_info2 |= qh->period
+                status = check_intr_schedule(ehci, 0, 0, qh, &c_mask, tt);
-                        ? cpu_to_hc32(ehci, 1 << uframe)
+        }
-                        : cpu_to_hc32(ehci, QH_SMASK);
+        if (status)
-                hw->hw_info2 |= c_mask;
+                goto done;
-        } else
-                ehci_dbg (ehci, "reused qh %p schedule\n", qh);
+ got_it:
+        qh->ps.phase = (qh->ps.period ? ehci->random_frame &
+                        (qh->ps.period - 1) : 0);
+        qh->ps.bw_phase = qh->ps.phase & (qh->ps.bw_period - 1);
+        qh->ps.phase_uf = uframe;
+        qh->ps.cs_mask = qh->ps.period ?
+                        (c_mask << 8) | (1 << uframe) :
+                        QH_SMASK;
+        /* reset S-frame and (maybe) C-frame masks */
+        hw->hw_info2 &= cpu_to_hc32(ehci, ~(QH_CMASK | QH_SMASK));
+        hw->hw_info2 |= cpu_to_hc32(ehci, qh->ps.cs_mask);
+        reserve_release_intr_bandwidth(ehci, qh, 1);
 done:
        return status;
@@ -969,7 +1030,8 @@ iso_stream_alloc (gfp_t mem_flags)
        if (likely (stream != NULL)) {
                INIT_LIST_HEAD(&stream->td_list);
                INIT_LIST_HEAD(&stream->free_list);
-                stream->next_uframe = -1;
+                stream->next_uframe = NO_FRAME;
+                stream->ps.phase = NO_FRAME;
        }
        return stream;
 }
@@ -978,25 +1040,24 @@ static void
 iso_stream_init (
        struct ehci_hcd         *ehci,
        struct ehci_iso_stream  *stream,
-        struct usb_device       *dev,
+        struct urb              *urb
-        int                     pipe,
-        unsigned                interval
 )
 {
        static const u8 smask_out [] = { 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f };
+        struct usb_device       *dev = urb->dev;
        u32                     buf1;
        unsigned                epnum, maxp;
        int                     is_input;
-        long                    bandwidth;
+        unsigned                tmp;
        /*
         * this might be a "high bandwidth" highspeed endpoint,
         * as encoded in the ep descriptor's wMaxPacket field
         */
-        epnum = usb_pipeendpoint (pipe);
+        epnum = usb_pipeendpoint(urb->pipe);
-        is_input = usb_pipein (pipe) ? USB_DIR_IN : 0;
+        is_input = usb_pipein(urb->pipe) ? USB_DIR_IN : 0;
-        maxp = usb_maxpacket(dev, pipe, !is_input);
+        maxp = usb_endpoint_maxp(&urb->ep->desc);
        if (is_input) {
                buf1 = (1 << 11);
        } else {
@@ -1020,9 +1081,19 @@ iso_stream_init (
                /* usbfs wants to report the average usecs per frame tied up
                 * when transfers on this endpoint are scheduled ...
                 */
-                stream->usecs = HS_USECS_ISO (maxp);
+                stream->ps.usecs = HS_USECS_ISO(maxp);
-                bandwidth = stream->usecs * 8;
-                bandwidth /= interval;
+                /* period for bandwidth allocation */
+                tmp = min_t(unsigned, EHCI_BANDWIDTH_SIZE,
+                                1 << (urb->ep->desc.bInterval - 1));
+                /* Allow urb->interval to override */
+                stream->ps.bw_uperiod = min_t(unsigned, tmp, urb->interval);
+                stream->uperiod = urb->interval;
+                stream->ps.period = urb->interval >> 3;
+                stream->bandwidth = stream->ps.usecs * 8 /
+                                stream->ps.bw_uperiod;
        } else {
                u32             addr;
@@ -1036,36 +1107,46 @@ iso_stream_init (
                        addr |= dev->tt->hub->devnum << 16;
                addr |= epnum << 8;
                addr |= dev->devnum;
-                stream->usecs = HS_USECS_ISO (maxp);
+                stream->ps.usecs = HS_USECS_ISO(maxp);
                think_time = dev->tt ? dev->tt->think_time : 0;
-                stream->tt_usecs = NS_TO_US (think_time + usb_calc_bus_time (
+                stream->ps.tt_usecs = NS_TO_US(think_time + usb_calc_bus_time(
                                dev->speed, is_input, 1, maxp));
                hs_transfers = max (1u, (maxp + 187) / 188);
                if (is_input) {
                        u32     tmp;
                        addr |= 1 << 31;
-                        stream->c_usecs = stream->usecs;
+                        stream->ps.c_usecs = stream->ps.usecs;
-                        stream->usecs = HS_USECS_ISO (1);
+                        stream->ps.usecs = HS_USECS_ISO(1);
-                        stream->raw_mask = 1;
+                        stream->ps.cs_mask = 1;
                        /* c-mask as specified in USB 2.0 11.18.4 3.c */
                        tmp = (1 << (hs_transfers + 2)) - 1;
-                        stream->raw_mask |= tmp << (8 + 2);
+                        stream->ps.cs_mask |= tmp << (8 + 2);
                } else
-                        stream->raw_mask = smask_out [hs_transfers - 1];
+                        stream->ps.cs_mask = smask_out[hs_transfers - 1];
-                bandwidth = stream->usecs + stream->c_usecs;
-                bandwidth /= interval << 3;
+                /* period for bandwidth allocation */
+                tmp = min_t(unsigned, EHCI_BANDWIDTH_FRAMES,
+                                1 << (urb->ep->desc.bInterval - 1));
+                /* Allow urb->interval to override */
+                stream->ps.bw_period = min_t(unsigned, tmp, urb->interval);
+                stream->ps.bw_uperiod = stream->ps.bw_period << 3;
-                /* stream->splits gets created from raw_mask later */
+                stream->ps.period = urb->interval;
+                stream->uperiod = urb->interval << 3;
+                stream->bandwidth = (stream->ps.usecs + stream->ps.c_usecs) /
+                                stream->ps.bw_period;
+                /* stream->splits gets created from cs_mask later */
                stream->address = cpu_to_hc32(ehci, addr);
        }
-        stream->bandwidth = bandwidth;
-        stream->udev = dev;
+        stream->ps.udev = dev;
+        stream->ps.ep = urb->ep;
        stream->bEndpointAddress = is_input | epnum;
-        stream->interval = interval;
        stream->maxp = maxp;
 }
@@ -1090,9 +1171,7 @@ iso_stream_find (struct ehci_hcd *ehci, struct urb *urb)
                stream = iso_stream_alloc(GFP_ATOMIC);
                if (likely (stream != NULL)) {
                        ep->hcpriv = stream;
-                        stream->ep = ep;
+                        iso_stream_init(ehci, stream, urb);
-                        iso_stream_init(ehci, stream, urb->dev, urb->pipe,
-                                        urb->interval);
                }
        /* if dev->ep [epnum] is a QH, hw is set */
@@ -1137,7 +1216,7 @@ itd_sched_init(
        dma_addr_t      dma = urb->transfer_dma;
        /* how many uframes are needed for these transfers */
-        iso_sched->span = urb->number_of_packets * stream->interval;
+        iso_sched->span = urb->number_of_packets * stream->uperiod;
        /* figure out per-uframe itd fields that we'll need later
         * when we fit new itds into the schedule.
@@ -1236,7 +1315,7 @@ itd_urb_transaction (
                memset (itd, 0, sizeof *itd);
                itd->itd_dma = itd_dma;
-                itd->frame = 9999;              /* an invalid value */
+                itd->frame = NO_FRAME;
                list_add (&itd->itd_list, &sched->td_list);
        }
        spin_unlock_irqrestore (&ehci->lock, flags);
@@ -1249,49 +1328,106 @@ itd_urb_transaction (
 /*-------------------------------------------------------------------------*/
+static void reserve_release_iso_bandwidth(struct ehci_hcd *ehci,
+                struct ehci_iso_stream *stream, int sign)
+{
+        unsigned                uframe;
+        unsigned                i, j;
+        unsigned                s_mask, c_mask, m;
+        int                     usecs = stream->ps.usecs;
+        int                     c_usecs = stream->ps.c_usecs;
+        int                     tt_usecs = stream->ps.tt_usecs;
+        struct ehci_tt          *tt;
+        if (stream->ps.phase == NO_FRAME)       /* Bandwidth wasn't reserved */
+                return;
+        uframe = stream->ps.bw_phase << 3;
+        bandwidth_dbg(ehci, sign, "iso", &stream->ps);
+        if (sign < 0) {         /* Release bandwidth */
+                usecs = -usecs;
+                c_usecs = -c_usecs;
+                tt_usecs = -tt_usecs;
+        }
+        if (!stream->splits) {          /* High speed */
+                for (i = uframe + stream->ps.phase_uf; i < EHCI_BANDWIDTH_SIZE;
+                                i += stream->ps.bw_uperiod)
+                        ehci->bandwidth[i] += usecs;
+        } else {                        /* Full speed */
+                s_mask = stream->ps.cs_mask;
+                c_mask = s_mask >> 8;
+                /* NOTE: adjustment needed for frame overflow */
+                for (i = uframe; i < EHCI_BANDWIDTH_SIZE;
+                                i += stream->ps.bw_uperiod) {
+                        for ((j = stream->ps.phase_uf, m = 1 << j); j < 8;
+                                        (++j, m <<= 1)) {
+                                if (s_mask & m)
+                                        ehci->bandwidth[i+j] += usecs;
+                                else if (c_mask & m)
+                                        ehci->bandwidth[i+j] += c_usecs;
+                        }
+                }
+                tt = find_tt(stream->ps.udev);
+                if (sign > 0)
+                        list_add_tail(&stream->ps.ps_list, &tt->ps_list);
+                else
+                        list_del(&stream->ps.ps_list);
+                for (i = uframe >> 3; i < EHCI_BANDWIDTH_FRAMES;
+                                i += stream->ps.bw_period)
+                        tt->bandwidth[i] += tt_usecs;
+        }
+}
 static inline int
 itd_slot_ok (
        struct ehci_hcd         *ehci,
-        u32                     mod,
+        struct ehci_iso_stream  *stream,
-        u32                     uframe,
+        unsigned                uframe
-        u8                      usecs,
-        u32                     period
 )
 {
-        uframe %= period;
+        unsigned                usecs;
-        do {
-                /* can't commit more than uframe_periodic_max usec */
+        /* convert "usecs we need" to "max already claimed" */
-                if (periodic_usecs (ehci, uframe >> 3, uframe & 0x7)
+        usecs = ehci->uframe_periodic_max - stream->ps.usecs;
-                                > (ehci->uframe_periodic_max - usecs))
-                        return 0;
-                /* we know urb->interval is 2^N uframes */
+        for (uframe &= stream->ps.bw_uperiod - 1; uframe < EHCI_BANDWIDTH_SIZE;
-                uframe += period;
+                        uframe += stream->ps.bw_uperiod) {
-        } while (uframe < mod);
+                if (ehci->bandwidth[uframe] > usecs)
+                        return 0;
+        }
        return 1;
 }
 static inline int
 sitd_slot_ok (
        struct ehci_hcd         *ehci,
-        u32                     mod,
        struct ehci_iso_stream  *stream,
-        u32                     uframe,
+        unsigned                uframe,
        struct ehci_iso_sched   *sched,
-        u32                     period_uframes
+        struct ehci_tt          *tt
 )
 {
-        u32                     mask, tmp;
+        unsigned                mask, tmp;
-        u32                     frame, uf;
+        unsigned                frame, uf;
+        mask = stream->ps.cs_mask << (uframe & 7);
-        mask = stream->raw_mask << (uframe & 7);
+        /* for OUT, don't wrap SSPLIT into H-microframe 7 */
+        if (((stream->ps.cs_mask & 0xff) << (uframe & 7)) >= (1 << 7))
+                return 0;
        /* for IN, don't wrap CSPLIT into the next frame */
        if (mask & ~0xffff)
                return 0;
        /* check bandwidth */
-        uframe %= period_uframes;
+        uframe &= stream->ps.bw_uperiod - 1;
        frame = uframe >> 3;
 #ifdef CONFIG_USB_EHCI_TT_NEWSCHED
@@ -1299,54 +1435,48 @@ sitd_slot_ok (
         * tt_available scheduling guarantees 10+% for control/bulk.
         */
        uf = uframe & 7;
-        if (!tt_available(ehci, period_uframes >> 3,
+        if (!tt_available(ehci, &stream->ps, tt, frame, uf))
-                        stream->udev, frame, uf, stream->tt_usecs))
                return 0;
 #else
        /* tt must be idle for start(s), any gap, and csplit.
         * assume scheduling slop leaves 10+% for control/bulk.
         */
-        if (!tt_no_collision(ehci, period_uframes >> 3,
+        if (!tt_no_collision(ehci, stream->ps.bw_period,
-                        stream->udev, frame, mask))
+                        stream->ps.udev, frame, mask))
                return 0;
 #endif
-        /* this multi-pass logic is simple, but performance may
-         * suffer when the schedule data isn't cached.
-         */
        do {
-                u32             max_used;
+                unsigned        max_used;
+                unsigned        i;
-                frame = uframe >> 3;
-                uf = uframe & 7;
                /* check starts (OUT uses more than one) */
-                max_used = ehci->uframe_periodic_max - stream->usecs;
+                uf = uframe;
-                for (tmp = stream->raw_mask & 0xff; tmp; tmp >>= 1, uf++) {
+                max_used = ehci->uframe_periodic_max - stream->ps.usecs;
-                        if (periodic_usecs (ehci, frame, uf) > max_used)
+                for (tmp = stream->ps.cs_mask & 0xff; tmp; tmp >>= 1, uf++) {
+                        if (ehci->bandwidth[uf] > max_used)
                                return 0;
                }
                /* for IN, check CSPLIT */
-                if (stream->c_usecs) {
+                if (stream->ps.c_usecs) {
-                        uf = uframe & 7;
+                        max_used = ehci->uframe_periodic_max -
-                        max_used = ehci->uframe_periodic_max - stream->c_usecs;
+                                        stream->ps.c_usecs;
-                        do {
+                        uf = uframe & ~7;
-                                tmp = 1 << uf;
+                        tmp = 1 << (2+8);
-                                tmp <<= 8;
+                        for (i = (uframe & 7) + 2; i < 8; (++i, tmp <<= 1)) {
-                                if ((stream->raw_mask & tmp) == 0)
+                                if ((stream->ps.cs_mask & tmp) == 0)
                                        continue;
-                                if (periodic_usecs (ehci, frame, uf)
+                                if (ehci->bandwidth[uf+i] > max_used)
-                                                > max_used)
                                        return 0;
-                        } while (++uf < 8);
+                        }
                }
-                /* we know urb->interval is 2^N uframes */
+                uframe += stream->ps.bw_uperiod;
-                uframe += period_uframes;
+        } while (uframe < EHCI_BANDWIDTH_SIZE);
-        } while (uframe < mod);
-        stream->splits = cpu_to_hc32(ehci, stream->raw_mask << (uframe & 7));
+        stream->ps.cs_mask <<= uframe & 7;
+        stream->splits = cpu_to_hc32(ehci, stream->ps.cs_mask);
        return 1;
 }
@@ -1361,8 +1491,6 @@ sitd_slot_ok (
 * given EHCI_TUNE_FLS and the slop).  Or, write a smarter scheduler!
 */
-#define SCHEDULING_DELAY        40      /* microframes */
 static int
 iso_stream_schedule (
        struct ehci_hcd         *ehci,
@@ -1370,134 +1498,184 @@ iso_stream_schedule (
        struct ehci_iso_stream  *stream
 )
 {
-        u32                     now, base, next, start, period, span;
+        u32                     now, base, next, start, period, span, now2;
-        int                     status;
+        u32                     wrap = 0, skip = 0;
+        int                     status = 0;
        unsigned                mod = ehci->periodic_size << 3;
        struct ehci_iso_sched   *sched = urb->hcpriv;
+        bool                    empty = list_empty(&stream->td_list);
+        bool                    new_stream = false;
-        period = urb->interval;
+        period = stream->uperiod;
        span = sched->span;
-        if (!stream->highspeed) {
+        if (!stream->highspeed)
-                period <<= 3;
                span <<= 3;
-        }
-        now = ehci_read_frame_index(ehci) & (mod - 1);
+        /* Start a new isochronous stream? */
+        if (unlikely(empty && !hcd_periodic_completion_in_progress(
+                        ehci_to_hcd(ehci), urb->ep))) {
-        /* Typical case: reuse current schedule, stream is still active.
+                /* Schedule the endpoint */
-         * Hopefully there are no gaps from the host falling behind
+                if (stream->ps.phase == NO_FRAME) {
-         * (irq delays etc).  If there are, the behavior depends on
+                        int             done = 0;
-         * whether URB_ISO_ASAP is set.
+                        struct ehci_tt  *tt = find_tt(stream->ps.udev);
-         */
-        if (likely (!list_empty (&stream->td_list))) {
-                /* Take the isochronous scheduling threshold into account */
+                        if (IS_ERR(tt)) {
-                if (ehci->i_thresh)
+                                status = PTR_ERR(tt);
-                        next = now + ehci->i_thresh;    /* uframe cache */
+                                goto fail;
-                else
+                        }
-                        next = (now + 2 + 7) & ~0x07;   /* full frame cache */
+                        compute_tt_budget(ehci->tt_budget, tt);
-                /*
-                 * Use ehci->last_iso_frame as the base.  There can't be any
-                 * TDs scheduled for earlier than that.
-                 */
-                base = ehci->last_iso_frame << 3;
-                next = (next - base) & (mod - 1);
-                start = (stream->next_uframe - base) & (mod - 1);
-                /* Is the schedule already full? */
-                if (unlikely(start < period)) {
-                        ehci_dbg(ehci, "iso sched full %p (%u-%u < %u mod %u)\n",
-                                        urb, stream->next_uframe, base,
-                                        period, mod);
-                        status = -ENOSPC;
-                        goto fail;
-                }
-                /* Behind the scheduling threshold? */
-                if (unlikely(start < next)) {
-                        unsigned now2 = (now - base) & (mod - 1);
-                        /* USB_ISO_ASAP: Round up to the first available slot */
+                        start = ((-(++ehci->random_frame)) << 3) & (period - 1);
-                        if (urb->transfer_flags & URB_ISO_ASAP)
-                                start += (next - start + period - 1) & -period;
-                        /*
+                        /* find a uframe slot with enough bandwidth.
-                         * Not ASAP: Use the next slot in the stream,
+                         * Early uframes are more precious because full-speed
-                         * no matter what.
+                         * iso IN transfers can't use late uframes,
+                         * and therefore they should be allocated last.
                         */
-                        else if (start + span - period < now2) {
+                        next = start;
-                                ehci_dbg(ehci, "iso underrun %p (%u+%u < %u)\n",
+                        start += period;
-                                                urb, start + base,
+                        do {
-                                                span - period, now2 + base);
+                                start--;
+                                /* check schedule: enough space? */
+                                if (stream->highspeed) {
+                                        if (itd_slot_ok(ehci, stream, start))
+                                                done = 1;
+                                } else {
+                                        if ((start % 8) >= 6)
+                                                continue;
+                                        if (sitd_slot_ok(ehci, stream, start,
+                                                        sched, tt))
+                                                done = 1;
+                                }
+                        } while (start > next && !done);
+                        /* no room in the schedule */
+                        if (!done) {
+                                ehci_dbg(ehci, "iso sched full %p", urb);
+                                status = -ENOSPC;
+                                goto fail;
                        }
+                        stream->ps.phase = (start >> 3) &
+                                        (stream->ps.period - 1);
+                        stream->ps.bw_phase = stream->ps.phase &
+                                        (stream->ps.bw_period - 1);
+                        stream->ps.phase_uf = start & 7;
+                        reserve_release_iso_bandwidth(ehci, stream, 1);
+                }
+                /* New stream is already scheduled; use the upcoming slot */
+                else {
+                        start = (stream->ps.phase << 3) + stream->ps.phase_uf;
                }
-                start += base;
+                stream->next_uframe = start;
+                new_stream = true;
        }
-        /* need to schedule; when's the next (u)frame we could start?
+        now = ehci_read_frame_index(ehci) & (mod - 1);
-         * this is bigger than ehci->i_thresh allows; scheduling itself
-         * isn't free, the delay should handle reasonably slow cpus.  it
+        /* Take the isochronous scheduling threshold into account */
-         * can also help high bandwidth if the dma and irq loads don't
+        if (ehci->i_thresh)
-         * jump until after the queue is primed.
+                next = now + ehci->i_thresh;    /* uframe cache */
+        else
+                next = (now + 2 + 7) & ~0x07;   /* full frame cache */
+        /*
+         * Use ehci->last_iso_frame as the base.  There can't be any
+         * TDs scheduled for earlier than that.
         */
-        else {
+        base = ehci->last_iso_frame << 3;
-                int done = 0;
+        next = (next - base) & (mod - 1);
+        start = (stream->next_uframe - base) & (mod - 1);
-                base = now & ~0x07;
+        if (unlikely(new_stream))
-                start = base + SCHEDULING_DELAY;
+                goto do_ASAP;
-                /* find a uframe slot with enough bandwidth.
+        /*
-                 * Early uframes are more precious because full-speed
+         * Typical case: reuse current schedule, stream may still be active.
-                 * iso IN transfers can't use late uframes,
+         * Hopefully there are no gaps from the host falling behind
-                 * and therefore they should be allocated last.
+         * (irq delays etc).  If there are, the behavior depends on
-                 */
+         * whether URB_ISO_ASAP is set.
-                next = start;
+         */
-                start += period;
+        now2 = (now - base) & (mod - 1);
-                do {
-                        start--;
+        /* Is the schedule already full? */
-                        /* check schedule: enough space? */
+        if (unlikely(!empty && start < period)) {
-                        if (stream->highspeed) {
+                ehci_dbg(ehci, "iso sched full %p (%u-%u < %u mod %u)\n",
-                                if (itd_slot_ok(ehci, mod, start,
+                                urb, stream->next_uframe, base, period, mod);
-                                                stream->usecs, period))
+                status = -ENOSPC;
-                                        done = 1;
+                goto fail;
-                        } else {
+        }
-                                if ((start % 8) >= 6)
-                                        continue;
+        /* Is the next packet scheduled after the base time? */
-                                if (sitd_slot_ok(ehci, mod, stream,
+        if (likely(!empty || start <= now2 + period)) {
-                                                start, sched, period))
-                                        done = 1;
+                /* URB_ISO_ASAP: make sure that start >= next */
-                        }
+                if (unlikely(start < next &&
-                } while (start > next && !done);
+                                (urb->transfer_flags & URB_ISO_ASAP)))
+                        goto do_ASAP;
+                /* Otherwise use start, if it's not in the past */
+                if (likely(start >= now2))
+                        goto use_start;
-                /* no room in the schedule */
+        /* Otherwise we got an underrun while the queue was empty */
-                if (!done) {
+        } else {
-                        ehci_dbg(ehci, "iso sched full %p", urb);
+                if (urb->transfer_flags & URB_ISO_ASAP)
-                        status = -ENOSPC;
+                        goto do_ASAP;
-                        goto fail;
+                wrap = mod;
+                now2 += mod;
+        }
+        /* How many uframes and packets do we need to skip? */
+        skip = (now2 - start + period - 1) & -period;
+        if (skip >= span) {             /* Entirely in the past? */
+                ehci_dbg(ehci, "iso underrun %p (%u+%u < %u) [%u]\n",
+                                urb, start + base, span - period, now2 + base,
+                                base);
+                /* Try to keep the last TD intact for scanning later */
+                skip = span - period;
+                /* Will it come before the current scan position? */
+                if (empty) {
+                        skip = span;    /* Skip the entire URB */
+                        status = 1;     /* and give it back immediately */
+                        iso_sched_free(stream, sched);
+                        sched = NULL;
                }
        }
+        urb->error_count = skip / period;
+        if (sched)
+                sched->first_packet = urb->error_count;
+        goto use_start;
+ do_ASAP:
+        /* Use the first slot after "next" */
+        start = next + ((start - next) & (period - 1));
+ use_start:
        /* Tried to schedule too far into the future? */
-        if (unlikely(start - base + span - period >= mod)) {
+        if (unlikely(start + span - period >= mod + wrap)) {
                ehci_dbg(ehci, "request %p would overflow (%u+%u >= %u)\n",
-                                urb, start - base, span - period, mod);
+                                urb, start, span - period, mod + wrap);
                status = -EFBIG;
                goto fail;
        }
-        stream->next_uframe = start & (mod - 1);
+        start += base;
+        stream->next_uframe = (start + skip) & (mod - 1);
        /* report high speed start in uframes; full speed, in frames */
-        urb->start_frame = stream->next_uframe;
+        urb->start_frame = start & (mod - 1);
        if (!stream->highspeed)
                urb->start_frame >>= 3;
        /* Make sure scan_isoc() sees these */
        if (ehci->isoc_count == 0)
                ehci->last_iso_frame = now >> 3;
-        return 0;
+        return status;
 fail:
        iso_sched_free(stream, sched);
@@ -1610,7 +1788,8 @@ static void itd_link_urb(
        ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs++;
        /* fill iTDs uframe by uframe */
-        for (packet = 0, itd = NULL; packet < urb->number_of_packets; ) {
+        for (packet = iso_sched->first_packet, itd = NULL;
+                        packet < urb->number_of_packets;) {
                if (itd == NULL) {
                        /* ASSERT:  we have all necessary itds */
                        // BUG_ON (list_empty (&iso_sched->td_list));
@@ -1630,7 +1809,7 @@ static void itd_link_urb(
                itd_patch(ehci, itd, iso_sched, packet, uframe);
-                next_uframe += stream->interval;
+                next_uframe += stream->uperiod;
                next_uframe &= mod - 1;
                packet++;
@@ -1770,9 +1949,9 @@ static int itd_submit (struct ehci_hcd *ehci, struct urb *urb,
                ehci_dbg (ehci, "can't get iso stream\n");
                return -ENOMEM;
        }
-        if (unlikely (urb->interval != stream->interval)) {
+        if (unlikely(urb->interval != stream->uperiod)) {
                ehci_dbg (ehci, "can't change iso interval %d --> %d\n",
-                        stream->interval, urb->interval);
+                        stream->uperiod, urb->interval);
                goto done;
        }
@@ -1804,10 +1983,14 @@ static int itd_submit (struct ehci_hcd *ehci, struct urb *urb,
        if (unlikely(status))
                goto done_not_linked;
        status = iso_stream_schedule(ehci, urb, stream);
-        if (likely (status == 0))
+        if (likely(status == 0)) {
                itd_link_urb (ehci, urb, ehci->periodic_size << 3, stream);
-        else
+        } else if (status > 0) {
+                status = 0;
+                ehci_urb_done(ehci, urb, 0);
+        } else {
                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+        }
 done_not_linked:
        spin_unlock_irqrestore (&ehci->lock, flags);
 done:
@@ -1833,7 +2016,7 @@ sitd_sched_init(
        dma_addr_t      dma = urb->transfer_dma;
        /* how many frames are needed for these transfers */
-        iso_sched->span = urb->number_of_packets * stream->interval;
+        iso_sched->span = urb->number_of_packets * stream->ps.period;
        /* figure out per-frame sitd fields that we'll need later
         * when we fit new sitds into the schedule.
@@ -1925,7 +2108,7 @@ sitd_urb_transaction (
                memset (sitd, 0, sizeof *sitd);
                sitd->sitd_dma = sitd_dma;
-                sitd->frame = 9999;             /* an invalid value */
+                sitd->frame = NO_FRAME;
                list_add (&sitd->sitd_list, &iso_sched->td_list);
        }
@@ -2008,7 +2191,7 @@ static void sitd_link_urb(
        ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs++;
        /* fill sITDs frame by frame */
-        for (packet = 0, sitd = NULL;
+        for (packet = sched->first_packet, sitd = NULL;
                        packet < urb->number_of_packets;
                        packet++) {
@@ -2027,7 +2210,7 @@ static void sitd_link_urb(
                sitd_link(ehci, (next_uframe >> 3) & (ehci->periodic_size - 1),
                                sitd);
-                next_uframe += stream->interval << 3;
+                next_uframe += stream->uperiod;
        }
        stream->next_uframe = next_uframe & (mod - 1);
@@ -2146,9 +2329,9 @@ static int sitd_submit (struct ehci_hcd *ehci, struct urb *urb,
                ehci_dbg (ehci, "can't get iso stream\n");
                return -ENOMEM;
        }
-        if (urb->interval != stream->interval) {
+        if (urb->interval != stream->ps.period) {
                ehci_dbg (ehci, "can't change iso interval %d --> %d\n",
-                        stream->interval, urb->interval);
+                        stream->ps.period, urb->interval);
                goto done;
        }
@@ -2178,10 +2361,14 @@ static int sitd_submit (struct ehci_hcd *ehci, struct urb *urb,
        if (unlikely(status))
                goto done_not_linked;
        status = iso_stream_schedule(ehci, urb, stream);
-        if (status == 0)
+        if (likely(status == 0)) {
                sitd_link_urb (ehci, urb, ehci->periodic_size << 3, stream);
-        else
+        } else if (status > 0) {
+                status = 0;
+                ehci_urb_done(ehci, urb, 0);
+        } else {
                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+        }
 done_not_linked:
        spin_unlock_irqrestore (&ehci->lock, flags);
 done:
@@ -2259,7 +2446,8 @@ restart:
                                    q.itd->hw_next != EHCI_LIST_END(ehci))
                                        *hw_p = q.itd->hw_next;
                                else
-                                        *hw_p = ehci->dummy->qh_dma;
+                                        *hw_p = cpu_to_hc32(ehci,
+                                                        ehci->dummy->qh_dma);
                                type = Q_NEXT_TYPE(ehci, q.itd->hw_next);
                                wmb();
                                modified = itd_complete (ehci, q.itd);
@@ -2294,7 +2482,8 @@ restart:
                                    q.sitd->hw_next != EHCI_LIST_END(ehci))
                                        *hw_p = q.sitd->hw_next;
                                else
-                                        *hw_p = ehci->dummy->qh_dma;
+                                        *hw_p = cpu_to_hc32(ehci,
+                                                        ehci->dummy->qh_dma);
                                type = Q_NEXT_TYPE(ehci, q.sitd->hw_next);
                                wmb();
                                modified = sitd_complete (ehci, q.sitd);
diff --git a/drivers/usb/host/ehci-sead3.c b/drivers/usb/host/ehci-sead3.c
index b2de52d39614..8a734498079b 100644
--- a/drivers/usb/host/ehci-sead3.c
+++ b/drivers/usb/host/ehci-sead3.c
@@ -55,7 +55,7 @@ const struct hc_driver ehci_sead3_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2,
+        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-sh.c b/drivers/usb/host/ehci-sh.c
index 93e59a13bc1f..dc899eb2b861 100644
--- a/drivers/usb/host/ehci-sh.c
+++ b/drivers/usb/host/ehci-sh.c
@@ -36,7 +36,7 @@ static const struct hc_driver ehci_sh_hc_driver = {
         * generic hardware linkage
         */
        .irq                            = ehci_irq,
-        .flags                          = HCD_USB2 | HCD_MEMORY,
+        .flags                          = HCD_USB2 | HCD_MEMORY | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-sysfs.c b/drivers/usb/host/ehci-sysfs.c
index 14ced00ba220..f6459dfb6f54 100644
--- a/drivers/usb/host/ehci-sysfs.c
+++ b/drivers/usb/host/ehci-sysfs.c
@@ -97,8 +97,7 @@ static ssize_t store_uframe_periodic_max(struct device *dev,
 {
        struct ehci_hcd         *ehci;
        unsigned                uframe_periodic_max;
-        unsigned                frame, uframe;
+        unsigned                uframe;
-        unsigned short          allocated_max;
        unsigned long           flags;
        ssize_t                 ret;
@@ -122,16 +121,14 @@ static ssize_t store_uframe_periodic_max(struct device *dev,
        /*
         * for request to decrease max periodic bandwidth, we have to check
-         * every microframe in the schedule to see whether the decrease is
+         * to see whether the decrease is possible.
-         * possible.
         */
        if (uframe_periodic_max < ehci->uframe_periodic_max) {
-                allocated_max = 0;
+                u8              allocated_max = 0;
-                for (frame = 0; frame < ehci->periodic_size; ++frame)
+                for (uframe = 0; uframe < EHCI_BANDWIDTH_SIZE; ++uframe)
-                        for (uframe = 0; uframe < 7; ++uframe)
+                        allocated_max = max(allocated_max,
-                                allocated_max = max(allocated_max,
+                                        ehci->bandwidth[uframe]);
-                                                    periodic_usecs (ehci, frame, uframe));
                if (allocated_max > uframe_periodic_max) {
                        ehci_info(ehci,
diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
index 78fa76da3324..e6d8e26e48cc 100644
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -388,7 +388,7 @@ static int tegra_ehci_probe(struct platform_device *pdev)
        err = clk_prepare_enable(tegra->clk);
        if (err)
-                goto cleanup_clk_get;
+                goto cleanup_hcd_create;
        tegra_periph_reset_assert(tegra->clk);
        udelay(1);
@@ -465,8 +465,6 @@ cleanup_phy:
        usb_phy_shutdown(hcd->phy);
 cleanup_clk_en:
        clk_disable_unprepare(tegra->clk);
-cleanup_clk_get:
-        clk_put(tegra->clk);
 cleanup_hcd_create:
        usb_put_hcd(hcd);
        return err;
diff --git a/drivers/usb/host/ehci-tilegx.c b/drivers/usb/host/ehci-tilegx.c
index cca4be90a864..67026ffbf9a8 100644
--- a/drivers/usb/host/ehci-tilegx.c
+++ b/drivers/usb/host/ehci-tilegx.c
@@ -61,7 +61,7 @@ static const struct hc_driver ehci_tilegx_hc_driver = {
         * Generic hardware linkage.
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2,
+        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * Basic lifecycle operations.
diff --git a/drivers/usb/host/ehci-w90x900.c b/drivers/usb/host/ehci-w90x900.c
index 59e0e24c753f..cdad8438c02b 100644
--- a/drivers/usb/host/ehci-w90x900.c
+++ b/drivers/usb/host/ehci-w90x900.c
@@ -11,13 +11,28 @@
 *
 */
+#include <linux/dma-mapping.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
 #include <linux/platform_device.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+#include "ehci.h"
 /* enable phy0 and phy1 for w90p910 */
 #define ENPHY           (0x01<<8)
 #define PHY0_CTR        (0xA4)
 #define PHY1_CTR        (0xA8)
+#define DRIVER_DESC "EHCI w90x900 driver"
+static const char hcd_name[] = "ehci-w90x900 ";
+static struct hc_driver __read_mostly ehci_w90x900_hc_driver;
 static int usb_w90x900_probe(const struct hc_driver *driver,
                      struct platform_device *pdev)
 {
@@ -90,8 +105,8 @@ err1:
        return retval;
 }
-static
+static void usb_w90x900_remove(struct usb_hcd *hcd,
-void usb_w90x900_remove(struct usb_hcd *hcd, struct platform_device *pdev)
+                        struct platform_device *pdev)
 {
        usb_remove_hcd(hcd);
        iounmap(hcd->regs);
@@ -99,54 +114,6 @@ void usb_w90x900_remove(struct usb_hcd *hcd, struct platform_device *pdev)
        usb_put_hcd(hcd);
 }
-static const struct hc_driver ehci_w90x900_hc_driver = {
-        .description = hcd_name,
-        .product_desc = "Nuvoton w90x900 EHCI Host Controller",
-        .hcd_priv_size = sizeof(struct ehci_hcd),
-        /*
-         * generic hardware linkage
-         */
-        .irq = ehci_irq,
-        .flags = HCD_USB2|HCD_MEMORY,
-        /*
-         * basic lifecycle operations
-         */
-        .reset = ehci_setup,
-        .start = ehci_run,
-        .stop = ehci_stop,
-        .shutdown = ehci_shutdown,
-        /*
-         * managing i/o requests and associated device resources
-         */
-        .urb_enqueue = ehci_urb_enqueue,
-        .urb_dequeue = ehci_urb_dequeue,
-        .endpoint_disable = ehci_endpoint_disable,
-        .endpoint_reset = ehci_endpoint_reset,
-        /*
-         * scheduling support
-         */
-        .get_frame_number = ehci_get_frame,
-        /*
-         * root hub support
-         */
-        .hub_status_data = ehci_hub_status_data,
-        .hub_control = ehci_hub_control,
-#ifdef  CONFIG_PM
-        .bus_suspend = ehci_bus_suspend,
-        .bus_resume = ehci_bus_resume,
-#endif
-        .relinquish_port        = ehci_relinquish_port,
-        .port_handed_over       = ehci_port_handed_over,
-        .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
-};
 static int ehci_w90x900_probe(struct platform_device *pdev)
 {
        if (usb_disabled())
@@ -173,7 +140,25 @@ static struct platform_driver ehci_hcd_w90x900_driver = {
        },
 };
+static int __init ehci_w90X900_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ehci_init_driver(&ehci_w90x900_hc_driver, NULL);
+        return platform_driver_register(&ehci_hcd_w90x900_driver);
+}
+module_init(ehci_w90X900_init);
+static void __exit ehci_w90X900_cleanup(void)
+{
+        platform_driver_unregister(&ehci_hcd_w90x900_driver);
+}
+module_exit(ehci_w90X900_cleanup);
+MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
-MODULE_DESCRIPTION("w90p910 usb ehci driver!");
-MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:w90p910-ehci");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/host/ehci-xilinx-of.c b/drivers/usb/host/ehci-xilinx-of.c
index eba962e6ebfb..95979f9f4381 100644
--- a/drivers/usb/host/ehci-xilinx-of.c
+++ b/drivers/usb/host/ehci-xilinx-of.c
@@ -79,7 +79,7 @@ static const struct hc_driver ehci_xilinx_of_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2,
+        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 291db7d09f22..e8f41c5e771b 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -54,6 +54,28 @@ struct ehci_stats {
        unsigned long           unlink;
 };
+/*
+ * Scheduling and budgeting information for periodic transfers, for both
+ * high-speed devices and full/low-speed devices lying behind a TT.
+ */
+struct ehci_per_sched {
+        struct usb_device       *udev;          /* access to the TT */
+        struct usb_host_endpoint *ep;
+        struct list_head        ps_list;        /* node on ehci_tt's ps_list */
+        u16                     tt_usecs;       /* time on the FS/LS bus */
+        u16                     cs_mask;        /* C-mask and S-mask bytes */
+        u16                     period;         /* actual period in frames */
+        u16                     phase;          /* actual phase, frame part */
+        u8                      bw_phase;       /* same, for bandwidth
+                                                   reservation */
+        u8                      phase_uf;       /* uframe part of the phase */
+        u8                      usecs, c_usecs; /* times on the HS bus */
+        u8                      bw_uperiod;     /* period in microframes, for
+                                                   bandwidth reservation */
+        u8                      bw_period;      /* same, in frames */
+};
+#define NO_FRAME        29999                   /* frame not assigned yet */
 /* ehci_hcd->lock guards shared data against other CPUs:
 *   ehci_hcd:  async, unlink, periodic (and shadow), ...
 *   usb_host_endpoint: hcpriv
@@ -230,6 +252,15 @@ struct ehci_hcd {			/* one per controller */
        struct dentry           *debug_dir;
 #endif
+        /* bandwidth usage */
+#define EHCI_BANDWIDTH_SIZE     64
+#define EHCI_BANDWIDTH_FRAMES   (EHCI_BANDWIDTH_SIZE >> 3)
+        u8                      bandwidth[EHCI_BANDWIDTH_SIZE];
+                                                /* us allocated per uframe */
+        u8                      tt_budget[EHCI_BANDWIDTH_SIZE];
+                                                /* us budgeted per uframe */
+        struct list_head        tt_list;
        /* platform-specific data -- must come last */
        unsigned long           priv[0] __aligned(sizeof(s64));
 };
@@ -385,6 +416,7 @@ struct ehci_qh {
        struct list_head        intr_node;      /* list of intr QHs */
        struct ehci_qtd         *dummy;
        struct list_head        unlink_node;
+        struct ehci_per_sched   ps;             /* scheduling info */
        unsigned                unlink_cycle;
@@ -398,16 +430,8 @@ struct ehci_qh {
        u8                      xacterrs;       /* XactErr retry counter */
 #define QH_XACTERR_MAX          32              /* XactErr retry limit */
-        /* periodic schedule info */
-        u8                      usecs;          /* intr bandwidth */
        u8                      gap_uf;         /* uframes split/csplit gap */
-        u8                      c_usecs;        /* ... split completion bw */
-        u16                     tt_usecs;       /* tt downstream bandwidth */
-        unsigned short          period;         /* polling interval */
-        unsigned short          start;          /* where polling starts */
-#define NO_FRAME ((unsigned short)~0)                   /* pick new start */
-        struct usb_device       *dev;           /* access to TT */
        unsigned                is_out:1;       /* bulk or intr OUT */
        unsigned                clearing_tt:1;  /* Clear-TT-Buf in progress */
        unsigned                dequeue_during_giveback:1;
@@ -434,6 +458,7 @@ struct ehci_iso_packet {
 struct ehci_iso_sched {
        struct list_head        td_list;
        unsigned                span;
+        unsigned                first_packet;
        struct ehci_iso_packet  packet [0];
 };
@@ -449,22 +474,17 @@ struct ehci_iso_stream {
        u8                      highspeed;
        struct list_head        td_list;        /* queued itds/sitds */
        struct list_head        free_list;      /* list of unused itds/sitds */
-        struct usb_device       *udev;
-        struct usb_host_endpoint *ep;
        /* output of (re)scheduling */
-        int                     next_uframe;
+        struct ehci_per_sched   ps;             /* scheduling info */
+        unsigned                next_uframe;
        __hc32                  splits;
        /* the rest is derived from the endpoint descriptor,
-         * trusting urb->interval == f(epdesc->bInterval) and
         * including the extra info for hw_bufp[0..2]
         */
-        u8                      usecs, c_usecs;
+        u16                     uperiod;        /* period in uframes */
-        u16                     interval;
-        u16                     tt_usecs;
        u16                     maxp;
-        u16                     raw_mask;
        unsigned                bandwidth;
        /* This is used to initialize iTD's hw_bufp fields */
@@ -579,6 +599,35 @@ struct ehci_fstn {
 /*-------------------------------------------------------------------------*/
+/*
+ * USB-2.0 Specification Sections 11.14 and 11.18
+ * Scheduling and budgeting split transactions using TTs
+ *
+ * A hub can have a single TT for all its ports, or multiple TTs (one for each
+ * port).  The bandwidth and budgeting information for the full/low-speed bus
+ * below each TT is self-contained and independent of the other TTs or the
+ * high-speed bus.
+ *
+ * "Bandwidth" refers to the number of microseconds on the FS/LS bus allocated
+ * to an interrupt or isochronous endpoint for each frame.  "Budget" refers to
+ * the best-case estimate of the number of full-speed bytes allocated to an
+ * endpoint for each microframe within an allocated frame.
+ *
+ * Removal of an endpoint invalidates a TT's budget.  Instead of trying to
+ * keep an up-to-date record, we recompute the budget when it is needed.
+ */
+struct ehci_tt {
+        u16                     bandwidth[EHCI_BANDWIDTH_FRAMES];
+        struct list_head        tt_list;        /* List of all ehci_tt's */
+        struct list_head        ps_list;        /* Items using this TT */
+        struct usb_tt           *usb_tt;
+        int                     tt_port;        /* TT port number */
+};
+/*-------------------------------------------------------------------------*/
 /* Prepare the PORTSC wakeup flags during controller suspend/resume */
 #define ehci_prepare_ports_for_controller_suspend(ehci, do_wakeup)      \
diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index fce13bcc4a3e..55486bd23cf1 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -412,7 +412,7 @@ struct debug_buffer {
                        tmp = 'h'; break; \
                default:                \
                        tmp = '?'; break; \
-                }; tmp; })
+                } tmp; })
 static inline char token_mark(struct fotg210_hcd *fotg210, __hc32 token)
 {
diff --git a/drivers/usb/host/fusbh200-hcd.c b/drivers/usb/host/fusbh200-hcd.c
index 299253c826c7..e1c6d850a7e1 100644
--- a/drivers/usb/host/fusbh200-hcd.c
+++ b/drivers/usb/host/fusbh200-hcd.c
@@ -402,7 +402,7 @@ struct debug_buffer {
                case QH_LOW_SPEED:  tmp = 'l'; break; \
                case QH_HIGH_SPEED: tmp = 'h'; break; \
                default: tmp = '?'; break; \
-                }; tmp; })
+                } tmp; })
 static inline char token_mark(struct fusbh200_hcd *fusbh200, __hc32 token)
 {
diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 5b86ffb88f1c..ada0a52797b1 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -199,10 +199,14 @@ static int hwahc_op_get_frame_number(struct usb_hcd *usb_hcd)
 {
        struct wusbhc *wusbhc = usb_hcd_to_wusbhc(usb_hcd);
        struct hwahc *hwahc = container_of(wusbhc, struct hwahc, wusbhc);
+        struct wahc *wa = &hwahc->wa;
-        dev_err(wusbhc->dev, "%s (%p [%p]) UNIMPLEMENTED\n", __func__,
+        /*
-                usb_hcd, hwahc);
+         * We cannot query the HWA for the WUSB time since that requires sending
-        return -ENOSYS;
+         * a synchronous URB and this function can be called in_interrupt.
+         * Instead, query the USB frame number for our parent and use that.
+         */
+        return usb_get_current_frame_number(wa->usb_dev);
 }
 static int hwahc_op_urb_enqueue(struct usb_hcd *usb_hcd, struct urb *urb,
@@ -566,14 +570,10 @@ found:
                goto error;
        }
        wa->wa_descr = wa_descr = (struct usb_wa_descriptor *) hdr;
-        /* Make LE fields CPU order */
+        if (le16_to_cpu(wa_descr->bcdWAVersion) > 0x0100)
-        wa_descr->bcdWAVersion = le16_to_cpu(wa_descr->bcdWAVersion);
-        wa_descr->wNumRPipes = le16_to_cpu(wa_descr->wNumRPipes);
-        wa_descr->wRPipeMaxBlock = le16_to_cpu(wa_descr->wRPipeMaxBlock);
-        if (wa_descr->bcdWAVersion > 0x0100)
                dev_warn(dev, "Wire Adapter v%d.%d newer than groked v1.0\n",
-                         wa_descr->bcdWAVersion & 0xff00 >> 8,
+                         le16_to_cpu(wa_descr->bcdWAVersion) & 0xff00 >> 8,
-                         wa_descr->bcdWAVersion & 0x00ff);
+                         le16_to_cpu(wa_descr->bcdWAVersion) & 0x00ff);
        result = 0;
 error:
        return result;
@@ -679,7 +679,8 @@ static void hwahc_security_release(struct hwahc *hwahc)
        /* nothing to do here so far... */
 }
-static int hwahc_create(struct hwahc *hwahc, struct usb_interface *iface)
+static int hwahc_create(struct hwahc *hwahc, struct usb_interface *iface,
+        kernel_ulong_t quirks)
 {
        int result;
        struct device *dev = &iface->dev;
@@ -724,7 +725,7 @@ static int hwahc_create(struct hwahc *hwahc, struct usb_interface *iface)
                dev_err(dev, "Can't create WUSB HC structures: %d\n", result);
                goto error_wusbhc_create;
        }
-        result = wa_create(&hwahc->wa, iface);
+        result = wa_create(&hwahc->wa, iface, quirks);
        if (result < 0)
                goto error_wa_create;
        return 0;
@@ -780,7 +781,7 @@ static int hwahc_probe(struct usb_interface *usb_iface,
        wusbhc = usb_hcd_to_wusbhc(usb_hcd);
        hwahc = container_of(wusbhc, struct hwahc, wusbhc);
        hwahc_init(hwahc);
-        result = hwahc_create(hwahc, usb_iface);
+        result = hwahc_create(hwahc, usb_iface, id->driver_info);
        if (result < 0) {
                dev_err(dev, "Cannot initialize internals: %d\n", result);
                goto error_hwahc_create;
@@ -824,6 +825,12 @@ static void hwahc_disconnect(struct usb_interface *usb_iface)
 }
 static struct usb_device_id hwahc_id_table[] = {
+        /* Alereon 5310 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x13dc, 0x5310, 0xe0, 0x02, 0x01),
+          .driver_info = WUSB_QUIRK_ALEREON_HWA_CONCAT_ISOC },
+        /* Alereon 5611 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x13dc, 0x5611, 0xe0, 0x02, 0x01),
+          .driver_info = WUSB_QUIRK_ALEREON_HWA_CONCAT_ISOC },
        /* FIXME: use class labels for this */
        { USB_INTERFACE_INFO(0xe0, 0x02, 0x01), },
        {},
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index 6f29abad6815..935a2dd367a8 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -2108,7 +2108,7 @@ static int isp1362_show(struct seq_file *s, void *unused)
                                   default:
                                           s = "?";
                                           break;
-                                   };
+                                   }
                                   s;}), ep->maxpacket) ;
                list_for_each_entry(urb, &ep->hep->urb_list, urb_list) {
                        seq_printf(s, "  urb%p, %d/%d\n", urb,
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index caa3764a3407..476b5a5baf25 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -13,19 +13,24 @@
 */
 #include <linux/clk.h>
-#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
 #include <linux/of_platform.h>
 #include <linux/of_gpio.h>
+#include <linux/platform_device.h>
 #include <linux/platform_data/atmel.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
 #include <mach/hardware.h>
 #include <asm/gpio.h>
 #include <mach/cpu.h>
-#ifndef CONFIG_ARCH_AT91
-#error "CONFIG_ARCH_AT91 must be defined."
+#include "ohci.h"
-#endif
 #define valid_port(index)       ((index) >= 0 && (index) < AT91_MAX_USBH_PORTS)
 #define at91_for_each_port(index)       \
@@ -33,7 +38,17 @@
 /* interface, function and usb clocks; sometimes also an AHB clock */
 static struct clk *iclk, *fclk, *uclk, *hclk;
+/* interface and function clocks; sometimes also an AHB clock */
+#define DRIVER_DESC "OHCI Atmel driver"
+static const char hcd_name[] = "ohci-atmel";
+static struct hc_driver __read_mostly ohci_at91_hc_driver;
 static int clocked;
+static int (*orig_ohci_hub_control)(struct usb_hcd  *hcd, u16 typeReq,
+                        u16 wValue, u16 wIndex, char *buf, u16 wLength);
+static int (*orig_ohci_hub_status_data)(struct usb_hcd *hcd, char *buf);
 extern int usb_disabled(void);
@@ -117,6 +132,8 @@ static void usb_hcd_at91_remove (struct usb_hcd *, struct platform_device *);
 static int usb_hcd_at91_probe(const struct hc_driver *driver,
                        struct platform_device *pdev)
 {
+        struct at91_usbh_data *board;
+        struct ohci_hcd *ohci;
        int retval;
        struct usb_hcd *hcd = NULL;
@@ -177,8 +194,10 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
                }
        }
+        board = hcd->self.controller->platform_data;
+        ohci = hcd_to_ohci(hcd);
+        ohci->num_ports = board->ports;
        at91_start_hc(pdev);
-        ohci_hcd_init(hcd_to_ohci(hcd));
        retval = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_SHARED);
        if (retval == 0)
@@ -238,36 +257,6 @@ static void usb_hcd_at91_remove(struct usb_hcd *hcd,
 }
 /*-------------------------------------------------------------------------*/
-static int
-ohci_at91_reset (struct usb_hcd *hcd)
-{
-        struct at91_usbh_data   *board = dev_get_platdata(hcd->self.controller);
-        struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
-        int                     ret;
-        if ((ret = ohci_init(ohci)) < 0)
-                return ret;
-        ohci->num_ports = board->ports;
-        return 0;
-}
-static int
-ohci_at91_start (struct usb_hcd *hcd)
-{
-        struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
-        int                     ret;
-        if ((ret = ohci_run(ohci)) < 0) {
-                dev_err(hcd->self.controller, "can't start %s\n",
-                        hcd->self.bus_name);
-                ohci_stop(hcd);
-                return ret;
-        }
-        return 0;
-}
 static void ohci_at91_usb_set_power(struct at91_usbh_data *pdata, int port, int enable)
 {
        if (!valid_port(port))
@@ -297,8 +286,8 @@ static int ohci_at91_usb_get_power(struct at91_usbh_data *pdata, int port)
 */
 static int ohci_at91_hub_status_data(struct usb_hcd *hcd, char *buf)
 {
-        struct at91_usbh_data *pdata = dev_get_platdata(hcd->self.controller);
+        struct at91_usbh_data *pdata = hcd->self.controller->platform_data;
-        int length = ohci_hub_status_data(hcd, buf);
+        int length = orig_ohci_hub_status_data(hcd, buf);
        int port;
        at91_for_each_port(port) {
@@ -376,7 +365,8 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                break;
        }
-        ret = ohci_hub_control(hcd, typeReq, wValue, wIndex + 1, buf, wLength);
+        ret = orig_ohci_hub_control(hcd, typeReq, wValue, wIndex + 1,
+                                buf, wLength);
        if (ret)
                goto out;
@@ -430,51 +420,6 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 /*-------------------------------------------------------------------------*/
-static const struct hc_driver ohci_at91_hc_driver = {
-        .description =          hcd_name,
-        .product_desc =         "AT91 OHCI",
-        .hcd_priv_size =        sizeof(struct ohci_hcd),
-        /*
-         * generic hardware linkage
-         */
-        .irq =                  ohci_irq,
-        .flags =                HCD_USB11 | HCD_MEMORY,
-        /*
-         * basic lifecycle operations
-         */
-        .reset =                ohci_at91_reset,
-        .start =                ohci_at91_start,
-        .stop =                 ohci_stop,
-        .shutdown =             ohci_shutdown,
-        /*
-         * managing i/o requests and associated device resources
-         */
-        .urb_enqueue =          ohci_urb_enqueue,
-        .urb_dequeue =          ohci_urb_dequeue,
-        .endpoint_disable =     ohci_endpoint_disable,
-        /*
-         * scheduling support
-         */
-        .get_frame_number =     ohci_get_frame,
-        /*
-         * root hub support
-         */
-        .hub_status_data =      ohci_at91_hub_status_data,
-        .hub_control =          ohci_at91_hub_control,
-#ifdef CONFIG_PM
-        .bus_suspend =          ohci_bus_suspend,
-        .bus_resume =           ohci_bus_resume,
-#endif
-        .start_port_reset =     ohci_start_port_reset,
-};
-/*-------------------------------------------------------------------------*/
 static irqreturn_t ohci_hcd_at91_overcurrent_irq(int irq, void *data)
 {
        struct platform_device *pdev = data;
@@ -703,7 +648,11 @@ ohci_hcd_at91_drv_suspend(struct platform_device *pdev, pm_message_t mesg)
         * REVISIT: some boards will be able to turn VBUS off...
         */
        if (at91_suspend_entering_slow_clock()) {
-                ohci_usb_reset (ohci);
+                ohci->hc_control = ohci_readl(ohci, &ohci->regs->control);
+                ohci->hc_control &= OHCI_CTRL_RWC;
+                ohci_writel(ohci, ohci->hc_control, &ohci->regs->control);
+                ohci->rh_state = OHCI_RH_HALTED;
                /* flush the writes */
                (void) ohci_readl (ohci, &ohci->regs->control);
                at91_stop_clock();
@@ -730,8 +679,6 @@ static int ohci_hcd_at91_drv_resume(struct platform_device *pdev)
 #define ohci_hcd_at91_drv_resume  NULL
 #endif
-MODULE_ALIAS("platform:at91_ohci");
 static struct platform_driver ohci_hcd_at91_driver = {
        .probe          = ohci_hcd_at91_drv_probe,
        .remove         = ohci_hcd_at91_drv_remove,
@@ -744,3 +691,40 @@ static struct platform_driver ohci_hcd_at91_driver = {
                .of_match_table = of_match_ptr(at91_ohci_dt_ids),
        },
 };
+static int __init ohci_at91_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ohci_init_driver(&ohci_at91_hc_driver, NULL);
+        /*
+         * The Atmel HW has some unusual quirks, which require Atmel-specific
+         * workarounds. We override certain hc_driver functions here to
+         * achieve that. We explicitly do not enhance ohci_driver_overrides to
+         * allow this more easily, since this is an unusual case, and we don't
+         * want to encourage others to override these functions by making it
+         * too easy.
+         */
+        orig_ohci_hub_control = ohci_at91_hc_driver.hub_control;
+        orig_ohci_hub_status_data = ohci_at91_hc_driver.hub_status_data;
+        ohci_at91_hc_driver.hub_status_data     = ohci_at91_hub_status_data;
+        ohci_at91_hc_driver.hub_control         = ohci_at91_hub_control;
+        return platform_driver_register(&ohci_hcd_at91_driver);
+}
+module_init(ohci_at91_init);
+static void __exit ohci_at91_cleanup(void)
+{
+        platform_driver_unregister(&ohci_hcd_at91_driver);
+}
+module_exit(ohci_at91_cleanup);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:at91_ohci");
diff --git a/drivers/usb/host/ohci-dbg.c b/drivers/usb/host/ohci-dbg.c
index 31b81f9eacdc..3fca52ec02ac 100644
--- a/drivers/usb/host/ohci-dbg.c
+++ b/drivers/usb/host/ohci-dbg.c
@@ -17,7 +17,7 @@
        case PIPE_BULK:         temp = "bulk"; break; \
        case PIPE_INTERRUPT:    temp = "intr"; break; \
        default:                temp = "isoc"; break; \
-        }; temp;})
+        } temp;})
 #define pipestring(pipe) edstring(usb_pipetype(pipe))
 /* debug| print the main components of an URB
diff --git a/drivers/usb/host/ohci-ep93xx.c b/drivers/usb/host/ohci-ep93xx.c
deleted file mode 100644
index 84a20d5223b9..000000000000
--- a/drivers/usb/host/ohci-ep93xx.c
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * OHCI HCD (Host Controller Driver) for USB.
- *
- * (C) Copyright 1999 Roman Weissgaerber <weissg@vienna.at>
- * (C) Copyright 2000-2002 David Brownell <dbrownell@users.sourceforge.net>
- * (C) Copyright 2002 Hewlett-Packard Company
- *
- * Bus Glue for ep93xx.
- *
- * Written by Christopher Hoover <ch@hpl.hp.com>
- * Based on fragments of previous driver by Russell King et al.
- *
- * Modified for LH7A404 from ohci-sa1111.c
- *  by Durgesh Pattamatta <pattamattad@sharpsec.com>
- *
- * Modified for pxa27x from ohci-lh7a404.c
- *  by Nick Bane <nick@cecomputing.co.uk> 26-8-2004
- *
- * Modified for ep93xx from ohci-pxa27x.c
- *  by Lennert Buytenhek <buytenh@wantstofly.org> 28-2-2006
- *  Based on an earlier driver by Ray Lehtiniemi
- *
- * This file is licenced under the GPL.
- */
-#include <linux/clk.h>
-#include <linux/device.h>
-#include <linux/signal.h>
-#include <linux/platform_device.h>
-static struct clk *usb_host_clock;
-static int ohci_ep93xx_start(struct usb_hcd *hcd)
-{
-        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        int ret;
-        if ((ret = ohci_init(ohci)) < 0)
-                return ret;
-        if ((ret = ohci_run(ohci)) < 0) {
-                dev_err(hcd->self.controller, "can't start %s\n",
-                        hcd->self.bus_name);
-                ohci_stop(hcd);
-                return ret;
-        }
-        return 0;
-}
-static struct hc_driver ohci_ep93xx_hc_driver = {
-        .description            = hcd_name,
-        .product_desc           = "EP93xx OHCI",
-        .hcd_priv_size          = sizeof(struct ohci_hcd),
-        .irq                    = ohci_irq,
-        .flags                  = HCD_USB11 | HCD_MEMORY,
-        .start                  = ohci_ep93xx_start,
-        .stop                   = ohci_stop,
-        .shutdown               = ohci_shutdown,
-        .urb_enqueue            = ohci_urb_enqueue,
-        .urb_dequeue            = ohci_urb_dequeue,
-        .endpoint_disable       = ohci_endpoint_disable,
-        .get_frame_number       = ohci_get_frame,
-        .hub_status_data        = ohci_hub_status_data,
-        .hub_control            = ohci_hub_control,
-#ifdef CONFIG_PM
-        .bus_suspend            = ohci_bus_suspend,
-        .bus_resume             = ohci_bus_resume,
-#endif
-        .start_port_reset       = ohci_start_port_reset,
-};
-static int ohci_hcd_ep93xx_drv_probe(struct platform_device *pdev)
-{
-        struct usb_hcd *hcd;
-        struct resource *res;
-        int irq;
-        int ret;
-        if (usb_disabled())
-                return -ENODEV;
-        irq = platform_get_irq(pdev, 0);
-        if (irq < 0)
-                return irq;
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res)
-                return -ENXIO;
-        hcd = usb_create_hcd(&ohci_ep93xx_hc_driver, &pdev->dev, "ep93xx");
-        if (!hcd)
-                return -ENOMEM;
-        hcd->rsrc_start = res->start;
-        hcd->rsrc_len = resource_size(res);
-        hcd->regs = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(hcd->regs)) {
-                ret = PTR_ERR(hcd->regs);
-                goto err_put_hcd;
-        }
-        usb_host_clock = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(usb_host_clock)) {
-                ret = PTR_ERR(usb_host_clock);
-                goto err_put_hcd;
-        }
-        clk_enable(usb_host_clock);
-        ohci_hcd_init(hcd_to_ohci(hcd));
-        ret = usb_add_hcd(hcd, irq, 0);
-        if (ret)
-                goto err_clk_disable;
-        return 0;
-err_clk_disable:
-        clk_disable(usb_host_clock);
-err_put_hcd:
-        usb_put_hcd(hcd);
-        return ret;
-}
-static int ohci_hcd_ep93xx_drv_remove(struct platform_device *pdev)
-{
-        struct usb_hcd *hcd = platform_get_drvdata(pdev);
-        usb_remove_hcd(hcd);
-        clk_disable(usb_host_clock);
-        usb_put_hcd(hcd);
-        return 0;
-}
-#ifdef CONFIG_PM
-static int ohci_hcd_ep93xx_drv_suspend(struct platform_device *pdev, pm_message_t state)
-{
-        struct usb_hcd *hcd = platform_get_drvdata(pdev);
-        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        if (time_before(jiffies, ohci->next_statechange))
-                msleep(5);
-        ohci->next_statechange = jiffies;
-        clk_disable(usb_host_clock);
-        return 0;
-}
-static int ohci_hcd_ep93xx_drv_resume(struct platform_device *pdev)
-{
-        struct usb_hcd *hcd = platform_get_drvdata(pdev);
-        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        if (time_before(jiffies, ohci->next_statechange))
-                msleep(5);
-        ohci->next_statechange = jiffies;
-        clk_enable(usb_host_clock);
-        ohci_resume(hcd, false);
-        return 0;
-}
-#endif
-static struct platform_driver ohci_hcd_ep93xx_driver = {
-        .probe          = ohci_hcd_ep93xx_drv_probe,
-        .remove         = ohci_hcd_ep93xx_drv_remove,
-        .shutdown       = usb_hcd_platform_shutdown,
-#ifdef CONFIG_PM
-        .suspend        = ohci_hcd_ep93xx_drv_suspend,
-        .resume         = ohci_hcd_ep93xx_drv_resume,
-#endif
-        .driver         = {
-                .name   = "ep93xx-ohci",
-                .owner  = THIS_MODULE,
-        },
-};
-MODULE_ALIAS("platform:ep93xx-ohci");
diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c
index dc6ee9adacf5..a87baedc0aa7 100644
--- a/drivers/usb/host/ohci-exynos.c
+++ b/drivers/usb/host/ohci-exynos.c
@@ -12,98 +12,55 @@
 */
 #include <linux/clk.h>
+#include <linux/dma-mapping.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
-#include <linux/platform_data/usb-ohci-exynos.h>
 #include <linux/usb/phy.h>
 #include <linux/usb/samsung_usb_phy.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+#include <linux/usb/otg.h>
+#include "ohci.h"
+#define DRIVER_DESC "OHCI EXYNOS driver"
+static const char hcd_name[] = "ohci-exynos";
+static struct hc_driver __read_mostly exynos_ohci_hc_driver;
+#define to_exynos_ohci(hcd) (struct exynos_ohci_hcd *)(hcd_to_ohci(hcd)->priv)
 struct exynos_ohci_hcd {
-        struct device *dev;
-        struct usb_hcd *hcd;
        struct clk *clk;
        struct usb_phy *phy;
        struct usb_otg *otg;
-        struct exynos4_ohci_platdata *pdata;
 };
-static void exynos_ohci_phy_enable(struct exynos_ohci_hcd *exynos_ohci)
+static void exynos_ohci_phy_enable(struct platform_device *pdev)
 {
-        struct platform_device *pdev = to_platform_device(exynos_ohci->dev);
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct exynos_ohci_hcd *exynos_ohci = to_exynos_ohci(hcd);
        if (exynos_ohci->phy)
                usb_phy_init(exynos_ohci->phy);
-        else if (exynos_ohci->pdata && exynos_ohci->pdata->phy_init)
-                exynos_ohci->pdata->phy_init(pdev, USB_PHY_TYPE_HOST);
 }
-static void exynos_ohci_phy_disable(struct exynos_ohci_hcd *exynos_ohci)
+static void exynos_ohci_phy_disable(struct platform_device *pdev)
 {
-        struct platform_device *pdev = to_platform_device(exynos_ohci->dev);
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct exynos_ohci_hcd *exynos_ohci = to_exynos_ohci(hcd);
        if (exynos_ohci->phy)
                usb_phy_shutdown(exynos_ohci->phy);
-        else if (exynos_ohci->pdata && exynos_ohci->pdata->phy_exit)
-                exynos_ohci->pdata->phy_exit(pdev, USB_PHY_TYPE_HOST);
-}
-static int ohci_exynos_reset(struct usb_hcd *hcd)
-{
-        return ohci_init(hcd_to_ohci(hcd));
 }
-static int ohci_exynos_start(struct usb_hcd *hcd)
-{
-        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        int ret;
-        ohci_dbg(ohci, "ohci_exynos_start, ohci:%p", ohci);
-        ret = ohci_run(ohci);
-        if (ret < 0) {
-                dev_err(hcd->self.controller, "can't start %s\n",
-                        hcd->self.bus_name);
-                ohci_stop(hcd);
-                return ret;
-        }
-        return 0;
-}
-static const struct hc_driver exynos_ohci_hc_driver = {
-        .description            = hcd_name,
-        .product_desc           = "EXYNOS OHCI Host Controller",
-        .hcd_priv_size          = sizeof(struct ohci_hcd),
-        .irq                    = ohci_irq,
-        .flags                  = HCD_MEMORY|HCD_USB11,
-        .reset                  = ohci_exynos_reset,
-        .start                  = ohci_exynos_start,
-        .stop                   = ohci_stop,
-        .shutdown               = ohci_shutdown,
-        .get_frame_number       = ohci_get_frame,
-        .urb_enqueue            = ohci_urb_enqueue,
-        .urb_dequeue            = ohci_urb_dequeue,
-        .endpoint_disable       = ohci_endpoint_disable,
-        .hub_status_data        = ohci_hub_status_data,
-        .hub_control            = ohci_hub_control,
-#ifdef  CONFIG_PM
-        .bus_suspend            = ohci_bus_suspend,
-        .bus_resume             = ohci_bus_resume,
-#endif
-        .start_port_reset       = ohci_start_port_reset,
-};
 static int exynos_ohci_probe(struct platform_device *pdev)
 {
-        struct exynos4_ohci_platdata *pdata = dev_get_platdata(&pdev->dev);
        struct exynos_ohci_hcd *exynos_ohci;
        struct usb_hcd *hcd;
-        struct ohci_hcd *ohci;
        struct resource *res;
        struct usb_phy *phy;
        int irq;
@@ -119,10 +76,14 @@ static int exynos_ohci_probe(struct platform_device *pdev)
        if (!pdev->dev.coherent_dma_mask)
                pdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
-        exynos_ohci = devm_kzalloc(&pdev->dev, sizeof(struct exynos_ohci_hcd),
+        hcd = usb_create_hcd(&exynos_ohci_hc_driver,
-                                        GFP_KERNEL);
+                                &pdev->dev, dev_name(&pdev->dev));
-        if (!exynos_ohci)
+        if (!hcd) {
+                dev_err(&pdev->dev, "Unable to create HCD\n");
                return -ENOMEM;
+        }
+        exynos_ohci = to_exynos_ohci(hcd);
        if (of_device_is_compatible(pdev->dev.of_node,
                                        "samsung,exynos5440-ohci"))
@@ -130,30 +91,15 @@ static int exynos_ohci_probe(struct platform_device *pdev)
        phy = devm_usb_get_phy(&pdev->dev, USB_PHY_TYPE_USB2);
        if (IS_ERR(phy)) {
-                /* Fallback to pdata */
+                usb_put_hcd(hcd);
-                if (!pdata) {
+                dev_warn(&pdev->dev, "no platform data or transceiver defined\n");
-                        dev_warn(&pdev->dev, "no platform data or transceiver defined\n");
+                return -EPROBE_DEFER;
-                        return -EPROBE_DEFER;
-                } else {
-                        exynos_ohci->pdata = pdata;
-                }
        } else {
                exynos_ohci->phy = phy;
                exynos_ohci->otg = phy->otg;
        }
 skip_phy:
-        exynos_ohci->dev = &pdev->dev;
-        hcd = usb_create_hcd(&exynos_ohci_hc_driver, &pdev->dev,
-                                        dev_name(&pdev->dev));
-        if (!hcd) {
-                dev_err(&pdev->dev, "Unable to create HCD\n");
-                return -ENOMEM;
-        }
-        exynos_ohci->hcd = hcd;
        exynos_ohci->clk = devm_clk_get(&pdev->dev, "usbhost");
        if (IS_ERR(exynos_ohci->clk)) {
@@ -190,26 +136,21 @@ skip_phy:
        }
        if (exynos_ohci->otg)
-                exynos_ohci->otg->set_host(exynos_ohci->otg,
+                exynos_ohci->otg->set_host(exynos_ohci->otg, &hcd->self);
-                                        &exynos_ohci->hcd->self);
-        exynos_ohci_phy_enable(exynos_ohci);
+        platform_set_drvdata(pdev, hcd);
-        ohci = hcd_to_ohci(hcd);
+        exynos_ohci_phy_enable(pdev);
-        ohci_hcd_init(ohci);
        err = usb_add_hcd(hcd, irq, IRQF_SHARED);
        if (err) {
                dev_err(&pdev->dev, "Failed to add USB HCD\n");
                goto fail_add_hcd;
        }
-        platform_set_drvdata(pdev, exynos_ohci);
        return 0;
 fail_add_hcd:
-        exynos_ohci_phy_disable(exynos_ohci);
+        exynos_ohci_phy_disable(pdev);
 fail_io:
        clk_disable_unprepare(exynos_ohci->clk);
 fail_clk:
@@ -219,16 +160,15 @@ fail_clk:
 static int exynos_ohci_remove(struct platform_device *pdev)
 {
-        struct exynos_ohci_hcd *exynos_ohci = platform_get_drvdata(pdev);
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
-        struct usb_hcd *hcd = exynos_ohci->hcd;
+        struct exynos_ohci_hcd *exynos_ohci = to_exynos_ohci(hcd);
        usb_remove_hcd(hcd);
        if (exynos_ohci->otg)
-                exynos_ohci->otg->set_host(exynos_ohci->otg,
+                exynos_ohci->otg->set_host(exynos_ohci->otg, &hcd->self);
-                                        &exynos_ohci->hcd->self);
-        exynos_ohci_phy_disable(exynos_ohci);
+        exynos_ohci_phy_disable(pdev);
        clk_disable_unprepare(exynos_ohci->clk);
@@ -239,8 +179,7 @@ static int exynos_ohci_remove(struct platform_device *pdev)
 static void exynos_ohci_shutdown(struct platform_device *pdev)
 {
-        struct exynos_ohci_hcd *exynos_ohci = platform_get_drvdata(pdev);
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
-        struct usb_hcd *hcd = exynos_ohci->hcd;
        if (hcd->driver->shutdown)
                hcd->driver->shutdown(hcd);
@@ -249,9 +188,10 @@ static void exynos_ohci_shutdown(struct platform_device *pdev)
 #ifdef CONFIG_PM
 static int exynos_ohci_suspend(struct device *dev)
 {
-        struct exynos_ohci_hcd *exynos_ohci = dev_get_drvdata(dev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
-        struct usb_hcd *hcd = exynos_ohci->hcd;
+        struct exynos_ohci_hcd *exynos_ohci = to_exynos_ohci(hcd);
        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        struct platform_device *pdev = to_platform_device(dev);
        unsigned long flags;
        int rc = 0;
@@ -271,10 +211,9 @@ static int exynos_ohci_suspend(struct device *dev)
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
        if (exynos_ohci->otg)
-                exynos_ohci->otg->set_host(exynos_ohci->otg,
+                exynos_ohci->otg->set_host(exynos_ohci->otg, &hcd->self);
-                                        &exynos_ohci->hcd->self);
-        exynos_ohci_phy_disable(exynos_ohci);
+        exynos_ohci_phy_disable(pdev);
        clk_disable_unprepare(exynos_ohci->clk);
@@ -286,16 +225,16 @@ fail:
 static int exynos_ohci_resume(struct device *dev)
 {
-        struct exynos_ohci_hcd *exynos_ohci = dev_get_drvdata(dev);
+        struct usb_hcd *hcd                     = dev_get_drvdata(dev);
-        struct usb_hcd *hcd = exynos_ohci->hcd;
+        struct exynos_ohci_hcd *exynos_ohci     = to_exynos_ohci(hcd);
+        struct platform_device *pdev            = to_platform_device(dev);
        clk_prepare_enable(exynos_ohci->clk);
        if (exynos_ohci->otg)
-                exynos_ohci->otg->set_host(exynos_ohci->otg,
+                exynos_ohci->otg->set_host(exynos_ohci->otg, &hcd->self);
-                                        &exynos_ohci->hcd->self);
-        exynos_ohci_phy_enable(exynos_ohci);
+        exynos_ohci_phy_enable(pdev);
        ohci_resume(hcd, false);
@@ -306,6 +245,10 @@ static int exynos_ohci_resume(struct device *dev)
 #define exynos_ohci_resume      NULL
 #endif
+static const struct ohci_driver_overrides exynos_overrides __initconst = {
+        .extra_priv_size =      sizeof(struct exynos_ohci_hcd),
+};
 static const struct dev_pm_ops exynos_ohci_pm_ops = {
        .suspend        = exynos_ohci_suspend,
        .resume         = exynos_ohci_resume,
@@ -331,6 +274,23 @@ static struct platform_driver exynos_ohci_driver = {
                .of_match_table = of_match_ptr(exynos_ohci_match),
        }
 };
+static int __init ohci_exynos_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ohci_init_driver(&exynos_ohci_hc_driver, &exynos_overrides);
+        return platform_driver_register(&exynos_ohci_driver);
+}
+module_init(ohci_exynos_init);
+static void __exit ohci_exynos_cleanup(void)
+{
+        platform_driver_unregister(&exynos_ohci_driver);
+}
+module_exit(ohci_exynos_cleanup);
 MODULE_ALIAS("platform:exynos-ohci");
 MODULE_AUTHOR("Jingoo Han <jg1.han@samsung.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 604cad1bcf9c..8ada13f8dde2 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -1161,10 +1161,12 @@ void ohci_init_driver(struct hc_driver *drv,
        /* Copy the generic table to drv and then apply the overrides */
        *drv = ohci_hc_driver;
-        drv->product_desc = over->product_desc;
+        if (over) {
-        drv->hcd_priv_size += over->extra_priv_size;
+                drv->product_desc = over->product_desc;
-        if (over->reset)
+                drv->hcd_priv_size += over->extra_priv_size;
-                drv->reset = over->reset;
+                if (over->reset)
+                        drv->reset = over->reset;
+        }
 }
 EXPORT_SYMBOL_GPL(ohci_init_driver);
@@ -1179,46 +1181,6 @@ MODULE_LICENSE ("GPL");
 #define SA1111_DRIVER           ohci_hcd_sa1111_driver
 #endif
-#if defined(CONFIG_ARCH_S3C24XX) || defined(CONFIG_ARCH_S3C64XX)
-#include "ohci-s3c2410.c"
-#define S3C2410_PLATFORM_DRIVER ohci_hcd_s3c2410_driver
-#endif
-#ifdef CONFIG_USB_OHCI_EXYNOS
-#include "ohci-exynos.c"
-#define EXYNOS_PLATFORM_DRIVER  exynos_ohci_driver
-#endif
-#ifdef CONFIG_USB_OHCI_HCD_OMAP1
-#include "ohci-omap.c"
-#define OMAP1_PLATFORM_DRIVER   ohci_hcd_omap_driver
-#endif
-#ifdef CONFIG_USB_OHCI_HCD_OMAP3
-#include "ohci-omap3.c"
-#define OMAP3_PLATFORM_DRIVER   ohci_hcd_omap3_driver
-#endif
-#if defined(CONFIG_PXA27x) || defined(CONFIG_PXA3xx)
-#include "ohci-pxa27x.c"
-#define PLATFORM_DRIVER         ohci_hcd_pxa27x_driver
-#endif
-#ifdef CONFIG_ARCH_EP93XX
-#include "ohci-ep93xx.c"
-#define EP93XX_PLATFORM_DRIVER  ohci_hcd_ep93xx_driver
-#endif
-#ifdef CONFIG_ARCH_AT91
-#include "ohci-at91.c"
-#define AT91_PLATFORM_DRIVER    ohci_hcd_at91_driver
-#endif
-#ifdef CONFIG_ARCH_LPC32XX
-#include "ohci-nxp.c"
-#define NXP_PLATFORM_DRIVER     usb_hcd_nxp_driver
-#endif
 #ifdef CONFIG_ARCH_DAVINCI_DA8XX
 #include "ohci-da8xx.c"
 #define DAVINCI_PLATFORM_DRIVER ohci_hcd_da8xx_driver
@@ -1229,11 +1191,6 @@ MODULE_LICENSE ("GPL");
 #define OF_PLATFORM_DRIVER      ohci_hcd_ppc_of_driver
 #endif
-#ifdef CONFIG_PLAT_SPEAR
-#include "ohci-spear.c"
-#define SPEAR_PLATFORM_DRIVER   spear_ohci_hcd_driver
-#endif
 #ifdef CONFIG_PPC_PS3
 #include "ohci-ps3.c"
 #define PS3_SYSTEM_BUS_DRIVER   ps3_ohci_driver
@@ -1296,18 +1253,6 @@ static int __init ohci_hcd_mod_init(void)
                goto error_platform;
 #endif
-#ifdef OMAP1_PLATFORM_DRIVER
-        retval = platform_driver_register(&OMAP1_PLATFORM_DRIVER);
-        if (retval < 0)
-                goto error_omap1_platform;
-#endif
-#ifdef OMAP3_PLATFORM_DRIVER
-        retval = platform_driver_register(&OMAP3_PLATFORM_DRIVER);
-        if (retval < 0)
-                goto error_omap3_platform;
-#endif
 #ifdef OF_PLATFORM_DRIVER
        retval = platform_driver_register(&OF_PLATFORM_DRIVER);
        if (retval < 0)
@@ -1332,79 +1277,19 @@ static int __init ohci_hcd_mod_init(void)
                goto error_tmio;
 #endif
-#ifdef S3C2410_PLATFORM_DRIVER
-        retval = platform_driver_register(&S3C2410_PLATFORM_DRIVER);
-        if (retval < 0)
-                goto error_s3c2410;
-#endif
-#ifdef EXYNOS_PLATFORM_DRIVER
-        retval = platform_driver_register(&EXYNOS_PLATFORM_DRIVER);
-        if (retval < 0)
-                goto error_exynos;
-#endif
-#ifdef EP93XX_PLATFORM_DRIVER
-        retval = platform_driver_register(&EP93XX_PLATFORM_DRIVER);
-        if (retval < 0)
-                goto error_ep93xx;
-#endif
-#ifdef AT91_PLATFORM_DRIVER
-        retval = platform_driver_register(&AT91_PLATFORM_DRIVER);
-        if (retval < 0)
-                goto error_at91;
-#endif
-#ifdef NXP_PLATFORM_DRIVER
-        retval = platform_driver_register(&NXP_PLATFORM_DRIVER);
-        if (retval < 0)
-                goto error_nxp;
-#endif
 #ifdef DAVINCI_PLATFORM_DRIVER
        retval = platform_driver_register(&DAVINCI_PLATFORM_DRIVER);
        if (retval < 0)
                goto error_davinci;
 #endif
-#ifdef SPEAR_PLATFORM_DRIVER
-        retval = platform_driver_register(&SPEAR_PLATFORM_DRIVER);
-        if (retval < 0)
-                goto error_spear;
-#endif
        return retval;
        /* Error path */
-#ifdef SPEAR_PLATFORM_DRIVER
-        platform_driver_unregister(&SPEAR_PLATFORM_DRIVER);
- error_spear:
-#endif
 #ifdef DAVINCI_PLATFORM_DRIVER
        platform_driver_unregister(&DAVINCI_PLATFORM_DRIVER);
 error_davinci:
 #endif
-#ifdef NXP_PLATFORM_DRIVER
-        platform_driver_unregister(&NXP_PLATFORM_DRIVER);
- error_nxp:
-#endif
-#ifdef AT91_PLATFORM_DRIVER
-        platform_driver_unregister(&AT91_PLATFORM_DRIVER);
- error_at91:
-#endif
-#ifdef EP93XX_PLATFORM_DRIVER
-        platform_driver_unregister(&EP93XX_PLATFORM_DRIVER);
- error_ep93xx:
-#endif
-#ifdef EXYNOS_PLATFORM_DRIVER
-        platform_driver_unregister(&EXYNOS_PLATFORM_DRIVER);
- error_exynos:
-#endif
-#ifdef S3C2410_PLATFORM_DRIVER
-        platform_driver_unregister(&S3C2410_PLATFORM_DRIVER);
- error_s3c2410:
-#endif
 #ifdef TMIO_OHCI_DRIVER
        platform_driver_unregister(&TMIO_OHCI_DRIVER);
 error_tmio:
@@ -1421,14 +1306,6 @@ static int __init ohci_hcd_mod_init(void)
        platform_driver_unregister(&OF_PLATFORM_DRIVER);
 error_of_platform:
 #endif
-#ifdef OMAP3_PLATFORM_DRIVER
-        platform_driver_unregister(&OMAP3_PLATFORM_DRIVER);
- error_omap3_platform:
-#endif
-#ifdef OMAP1_PLATFORM_DRIVER
-        platform_driver_unregister(&OMAP1_PLATFORM_DRIVER);
- error_omap1_platform:
-#endif
 #ifdef PLATFORM_DRIVER
        platform_driver_unregister(&PLATFORM_DRIVER);
 error_platform:
@@ -1450,27 +1327,9 @@ module_init(ohci_hcd_mod_init);
 static void __exit ohci_hcd_mod_exit(void)
 {
-#ifdef SPEAR_PLATFORM_DRIVER
-        platform_driver_unregister(&SPEAR_PLATFORM_DRIVER);
-#endif
 #ifdef DAVINCI_PLATFORM_DRIVER
        platform_driver_unregister(&DAVINCI_PLATFORM_DRIVER);
 #endif
-#ifdef NXP_PLATFORM_DRIVER
-        platform_driver_unregister(&NXP_PLATFORM_DRIVER);
-#endif
-#ifdef AT91_PLATFORM_DRIVER
-        platform_driver_unregister(&AT91_PLATFORM_DRIVER);
-#endif
-#ifdef EP93XX_PLATFORM_DRIVER
-        platform_driver_unregister(&EP93XX_PLATFORM_DRIVER);
-#endif
-#ifdef EXYNOS_PLATFORM_DRIVER
-        platform_driver_unregister(&EXYNOS_PLATFORM_DRIVER);
-#endif
-#ifdef S3C2410_PLATFORM_DRIVER
-        platform_driver_unregister(&S3C2410_PLATFORM_DRIVER);
-#endif
 #ifdef TMIO_OHCI_DRIVER
        platform_driver_unregister(&TMIO_OHCI_DRIVER);
 #endif
@@ -1483,12 +1342,6 @@ static void __exit ohci_hcd_mod_exit(void)
 #ifdef OF_PLATFORM_DRIVER
        platform_driver_unregister(&OF_PLATFORM_DRIVER);
 #endif
-#ifdef OMAP3_PLATFORM_DRIVER
-        platform_driver_unregister(&OMAP3_PLATFORM_DRIVER);
-#endif
-#ifdef OMAP1_PLATFORM_DRIVER
-        platform_driver_unregister(&OMAP1_PLATFORM_DRIVER);
-#endif
 #ifdef PLATFORM_DRIVER
        platform_driver_unregister(&PLATFORM_DRIVER);
 #endif
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 2347ab83f046..61705a760e7d 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -212,10 +212,11 @@ __acquires(ohci->lock)
        /* Sometimes PCI D3 suspend trashes frame timings ... */
        periodic_reinit (ohci);
-        /* the following code is executed with ohci->lock held and
+        /*
-         * irqs disabled if and only if autostopped is true
+         * The following code is executed with ohci->lock held and
+         * irqs disabled if and only if autostopped is true.  This
+         * will cause sparse to warn about a "context imbalance".
         */
 skip_resume:
        /* interrupts might have been disabled */
        ohci_writel (ohci, OHCI_INTR_INIT, &ohci->regs->intrenable);
@@ -531,7 +532,7 @@ ohci_hub_descriptor (
            temp |= 0x0010;
        else if (rh & RH_A_OCPM)        /* per-port overcurrent reporting? */
            temp |= 0x0008;
-        desc->wHubCharacteristics = (__force __u16)cpu_to_hc16(ohci, temp);
+        desc->wHubCharacteristics = cpu_to_le16(temp);
        /* ports removable, and usb 1.0 legacy PortPwrCtrlMask */
        rh = roothub_b (ohci);
diff --git a/drivers/usb/host/ohci-nxp.c b/drivers/usb/host/ohci-nxp.c
index 7d7d507d54e8..9ab7e24ba65d 100644
--- a/drivers/usb/host/ohci-nxp.c
+++ b/drivers/usb/host/ohci-nxp.c
@@ -19,10 +19,19 @@
 * or implied.
 */
 #include <linux/clk.h>
-#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <linux/io.h>
 #include <linux/i2c.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/of.h>
+#include <linux/platform_device.h>
 #include <linux/usb/isp1301.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+#include "ohci.h"
 #include <mach/hardware.h>
 #include <asm/mach-types.h>
@@ -57,6 +66,11 @@
 #define start_int_umask(irq)
 #endif
+#define DRIVER_DESC "OHCI NXP driver"
+static const char hcd_name[] = "ohci-nxp";
+static struct hc_driver __read_mostly ohci_nxp_hc_driver;
 static struct i2c_client *isp1301_i2c_client;
 extern int usb_disabled(void);
@@ -132,14 +146,14 @@ static inline void isp1301_vbus_off(void)
                OTG1_VBUS_DRV);
 }
-static void nxp_start_hc(void)
+static void ohci_nxp_start_hc(void)
 {
        unsigned long tmp = __raw_readl(USB_OTG_STAT_CONTROL) | HOST_EN;
        __raw_writel(tmp, USB_OTG_STAT_CONTROL);
        isp1301_vbus_on();
 }
-static void nxp_stop_hc(void)
+static void ohci_nxp_stop_hc(void)
 {
        unsigned long tmp;
        isp1301_vbus_off();
@@ -147,68 +161,9 @@ static void nxp_stop_hc(void)
        __raw_writel(tmp, USB_OTG_STAT_CONTROL);
 }
-static int ohci_nxp_start(struct usb_hcd *hcd)
+static int ohci_hcd_nxp_probe(struct platform_device *pdev)
-{
-        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        int ret;
-        if ((ret = ohci_init(ohci)) < 0)
-                return ret;
-        if ((ret = ohci_run(ohci)) < 0) {
-                dev_err(hcd->self.controller, "can't start\n");
-                ohci_stop(hcd);
-                return ret;
-        }
-        return 0;
-}
-static const struct hc_driver ohci_nxp_hc_driver = {
-        .description = hcd_name,
-        .product_desc =         "nxp OHCI",
-        /*
-         * generic hardware linkage
-         */
-        .irq = ohci_irq,
-        .flags = HCD_USB11 | HCD_MEMORY,
-        .hcd_priv_size =        sizeof(struct ohci_hcd),
-        /*
-         * basic lifecycle operations
-         */
-        .start = ohci_nxp_start,
-        .stop = ohci_stop,
-        .shutdown = ohci_shutdown,
-        /*
-         * managing i/o requests and associated device resources
-         */
-        .urb_enqueue = ohci_urb_enqueue,
-        .urb_dequeue = ohci_urb_dequeue,
-        .endpoint_disable = ohci_endpoint_disable,
-        /*
-         * scheduling support
-         */
-        .get_frame_number = ohci_get_frame,
-        /*
-         * root hub support
-         */
-        .hub_status_data = ohci_hub_status_data,
-        .hub_control = ohci_hub_control,
-#ifdef  CONFIG_PM
-        .bus_suspend = ohci_bus_suspend,
-        .bus_resume = ohci_bus_resume,
-#endif
-        .start_port_reset = ohci_start_port_reset,
-};
-static int usb_hcd_nxp_probe(struct platform_device *pdev)
 {
        struct usb_hcd *hcd = 0;
-        struct ohci_hcd *ohci;
        const struct hc_driver *driver = &ohci_nxp_hc_driver;
        struct resource *res;
        int ret = 0, irq;
@@ -313,17 +268,15 @@ static int usb_hcd_nxp_probe(struct platform_device *pdev)
                goto fail_resource;
        }
-        nxp_start_hc();
+        ohci_nxp_start_hc();
        platform_set_drvdata(pdev, hcd);
-        ohci = hcd_to_ohci(hcd);
-        ohci_hcd_init(ohci);
        dev_info(&pdev->dev, "at 0x%p, irq %d\n", hcd->regs, hcd->irq);
        ret = usb_add_hcd(hcd, irq, 0);
        if (ret == 0)
                return ret;
-        nxp_stop_hc();
+        ohci_nxp_stop_hc();
 fail_resource:
        usb_put_hcd(hcd);
 fail_hcd:
@@ -345,12 +298,12 @@ fail_disable:
        return ret;
 }
-static int usb_hcd_nxp_remove(struct platform_device *pdev)
+static int ohci_hcd_nxp_remove(struct platform_device *pdev)
 {
        struct usb_hcd *hcd = platform_get_drvdata(pdev);
        usb_remove_hcd(hcd);
-        nxp_stop_hc();
+        ohci_nxp_stop_hc();
        usb_put_hcd(hcd);
        clk_disable(usb_pll_clk);
        clk_put(usb_pll_clk);
@@ -366,20 +319,40 @@ static int usb_hcd_nxp_remove(struct platform_device *pdev)
 MODULE_ALIAS("platform:usb-ohci");
 #ifdef CONFIG_OF
-static const struct of_device_id usb_hcd_nxp_match[] = {
+static const struct of_device_id ohci_hcd_nxp_match[] = {
        { .compatible = "nxp,ohci-nxp" },
        {},
 };
-MODULE_DEVICE_TABLE(of, usb_hcd_nxp_match);
+MODULE_DEVICE_TABLE(of, ohci_hcd_nxp_match);
 #endif
-static struct platform_driver usb_hcd_nxp_driver = {
+static struct platform_driver ohci_hcd_nxp_driver = {
        .driver = {
                .name = "usb-ohci",
                .owner  = THIS_MODULE,
-                .of_match_table = of_match_ptr(usb_hcd_nxp_match),
+                .of_match_table = of_match_ptr(ohci_hcd_nxp_match),
        },
-        .probe = usb_hcd_nxp_probe,
+        .probe = ohci_hcd_nxp_probe,
-        .remove = usb_hcd_nxp_remove,
+        .remove = ohci_hcd_nxp_remove,
 };
+static int __init ohci_nxp_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ohci_init_driver(&ohci_nxp_hc_driver, NULL);
+        return platform_driver_register(&ohci_hcd_nxp_driver);
+}
+module_init(ohci_nxp_init);
+static void __exit ohci_nxp_cleanup(void)
+{
+        platform_driver_unregister(&ohci_hcd_nxp_driver);
+}
+module_exit(ohci_nxp_cleanup);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c
index 31d3a12eb486..f253214741ba 100644
--- a/drivers/usb/host/ohci-omap.c
+++ b/drivers/usb/host/ohci-omap.c
@@ -14,12 +14,21 @@
 * This file is licenced under the GPL.
 */
-#include <linux/signal.h>
-#include <linux/jiffies.h>
-#include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/dma-mapping.h>
 #include <linux/err.h>
 #include <linux/gpio.h>
+#include <linux/io.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/usb/otg.h>
+#include <linux/platform_device.h>
+#include <linux/signal.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+#include "ohci.h"
 #include <asm/io.h>
 #include <asm/mach-types.h>
@@ -42,10 +51,7 @@
 #define OMAP1510_LB_MMU_RAM_H   0xfffec234
 #define OMAP1510_LB_MMU_RAM_L   0xfffec238
+#define DRIVER_DESC "OHCI OMAP driver"
-#ifndef CONFIG_ARCH_OMAP
-#error "This file is OMAP bus glue.  CONFIG_OMAP must be defined."
-#endif
 #ifdef CONFIG_TPS65010
 #include <linux/i2c/tps65010.h>
@@ -68,8 +74,9 @@ extern int ocpi_enable(void);
 static struct clk *usb_host_ck;
 static struct clk *usb_dc_ck;
-static int host_enabled;
-static int host_initialized;
+static const char hcd_name[] = "ohci-omap";
+static struct hc_driver __read_mostly ohci_omap_hc_driver;
 static void omap_ohci_clock_power(int on)
 {
@@ -188,7 +195,7 @@ static void start_hnp(struct ohci_hcd *ohci)
 /*-------------------------------------------------------------------------*/
-static int ohci_omap_init(struct usb_hcd *hcd)
+static int ohci_omap_reset(struct usb_hcd *hcd)
 {
        struct ohci_hcd         *ohci = hcd_to_ohci(hcd);
        struct omap_usb_config  *config = dev_get_platdata(hcd->self.controller);
@@ -198,9 +205,9 @@ static int ohci_omap_init(struct usb_hcd *hcd)
        dev_dbg(hcd->self.controller, "starting USB Controller\n");
        if (config->otg) {
-                ohci_to_hcd(ohci)->self.otg_port = config->otg;
+                hcd->self.otg_port = config->otg;
                /* default/minimum OTG power budget:  8 mA */
-                ohci_to_hcd(ohci)->power_budget = 8;
+                hcd->power_budget = 8;
        }
        /* boards can use OTG transceivers in non-OTG modes */
@@ -238,9 +245,15 @@ static int ohci_omap_init(struct usb_hcd *hcd)
                omap_1510_local_bus_init();
        }
-        if ((ret = ohci_init(ohci)) < 0)
+        ret = ohci_setup(hcd);
+        if (ret < 0)
                return ret;
+        if (config->otg || config->rwc) {
+                ohci->hc_control = OHCI_CTRL_RWC;
+                writel(OHCI_CTRL_RWC, &ohci->regs->control);
+        }
        /* board-specific power switching and overcurrent support */
        if (machine_is_omap_osk() || machine_is_omap_innovator()) {
                u32     rh = roothub_a (ohci);
@@ -281,14 +294,6 @@ static int ohci_omap_init(struct usb_hcd *hcd)
        return 0;
 }
-static void ohci_omap_stop(struct usb_hcd *hcd)
-{
-        dev_dbg(hcd->self.controller, "stopping USB Controller\n");
-        ohci_stop(hcd);
-        omap_ohci_clock_power(0);
-}
 /*-------------------------------------------------------------------------*/
 /**
@@ -304,7 +309,6 @@ static int usb_hcd_omap_probe (const struct hc_driver *driver,
 {
        int retval, irq;
        struct usb_hcd *hcd = 0;
-        struct ohci_hcd *ohci;
        if (pdev->num_resources != 2) {
                printk(KERN_ERR "hcd probe: invalid num_resources: %i\n",
@@ -354,12 +358,6 @@ static int usb_hcd_omap_probe (const struct hc_driver *driver,
                goto err2;
        }
-        ohci = hcd_to_ohci(hcd);
-        ohci_hcd_init(ohci);
-        host_initialized = 0;
-        host_enabled = 1;
        irq = platform_get_irq(pdev, 0);
        if (irq < 0) {
                retval = -ENXIO;
@@ -369,11 +367,6 @@ static int usb_hcd_omap_probe (const struct hc_driver *driver,
        if (retval)
                goto err3;
-        host_initialized = 1;
-        if (!host_enabled)
-                omap_ohci_clock_power(0);
        return 0;
 err3:
        iounmap(hcd->regs);
@@ -402,7 +395,9 @@ err0:
 static inline void
 usb_hcd_omap_remove (struct usb_hcd *hcd, struct platform_device *pdev)
 {
+        dev_dbg(hcd->self.controller, "stopping USB Controller\n");
        usb_remove_hcd(hcd);
+        omap_ohci_clock_power(0);
        if (!IS_ERR_OR_NULL(hcd->phy)) {
                (void) otg_set_host(hcd->phy->otg, 0);
                usb_put_phy(hcd->phy);
@@ -418,76 +413,6 @@ usb_hcd_omap_remove (struct usb_hcd *hcd, struct platform_device *pdev)
 /*-------------------------------------------------------------------------*/
-static int
-ohci_omap_start (struct usb_hcd *hcd)
-{
-        struct omap_usb_config *config;
-        struct ohci_hcd *ohci = hcd_to_ohci (hcd);
-        int             ret;
-        if (!host_enabled)
-                return 0;
-        config = dev_get_platdata(hcd->self.controller);
-        if (config->otg || config->rwc) {
-                ohci->hc_control = OHCI_CTRL_RWC;
-                writel(OHCI_CTRL_RWC, &ohci->regs->control);
-        }
-        if ((ret = ohci_run (ohci)) < 0) {
-                dev_err(hcd->self.controller, "can't start\n");
-                ohci_stop (hcd);
-                return ret;
-        }
-        return 0;
-}
-/*-------------------------------------------------------------------------*/
-static const struct hc_driver ohci_omap_hc_driver = {
-        .description =          hcd_name,
-        .product_desc =         "OMAP OHCI",
-        .hcd_priv_size =        sizeof(struct ohci_hcd),
-        /*
-         * generic hardware linkage
-         */
-        .irq =                  ohci_irq,
-        .flags =                HCD_USB11 | HCD_MEMORY,
-        /*
-         * basic lifecycle operations
-         */
-        .reset =                ohci_omap_init,
-        .start =                ohci_omap_start,
-        .stop =                 ohci_omap_stop,
-        .shutdown =             ohci_shutdown,
-        /*
-         * managing i/o requests and associated device resources
-         */
-        .urb_enqueue =          ohci_urb_enqueue,
-        .urb_dequeue =          ohci_urb_dequeue,
-        .endpoint_disable =     ohci_endpoint_disable,
-        /*
-         * scheduling support
-         */
-        .get_frame_number =     ohci_get_frame,
-        /*
-         * root hub support
-         */
-        .hub_status_data =      ohci_hub_status_data,
-        .hub_control =          ohci_hub_control,
-#ifdef  CONFIG_PM
-        .bus_suspend =          ohci_bus_suspend,
-        .bus_resume =           ohci_bus_resume,
-#endif
-        .start_port_reset =     ohci_start_port_reset,
-};
-/*-------------------------------------------------------------------------*/
 static int ohci_hcd_omap_drv_probe(struct platform_device *dev)
 {
        return usb_hcd_omap_probe(&ohci_omap_hc_driver, dev);
@@ -506,16 +431,23 @@ static int ohci_hcd_omap_drv_remove(struct platform_device *dev)
 #ifdef  CONFIG_PM
-static int ohci_omap_suspend(struct platform_device *dev, pm_message_t message)
+static int ohci_omap_suspend(struct platform_device *pdev, pm_message_t message)
 {
-        struct ohci_hcd *ohci = hcd_to_ohci(platform_get_drvdata(dev));
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        bool do_wakeup = device_may_wakeup(&pdev->dev);
+        int ret;
        if (time_before(jiffies, ohci->next_statechange))
                msleep(5);
        ohci->next_statechange = jiffies;
+        ret = ohci_suspend(hcd, do_wakeup);
+        if (ret)
+                return ret;
        omap_ohci_clock_power(0);
-        return 0;
+        return ret;
 }
 static int ohci_omap_resume(struct platform_device *dev)
@@ -553,4 +485,29 @@ static struct platform_driver ohci_hcd_omap_driver = {
        },
 };
+static const struct ohci_driver_overrides omap_overrides __initconst = {
+        .product_desc   = "OMAP OHCI",
+        .reset          = ohci_omap_reset
+};
+static int __init ohci_omap_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ohci_init_driver(&ohci_omap_hc_driver, &omap_overrides);
+        return platform_driver_register(&ohci_hcd_omap_driver);
+}
+module_init(ohci_omap_init);
+static void __exit ohci_omap_cleanup(void)
+{
+        platform_driver_unregister(&ohci_hcd_omap_driver);
+}
+module_exit(ohci_omap_cleanup);
+MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_ALIAS("platform:ohci");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/host/ohci-omap3.c b/drivers/usb/host/ohci-omap3.c
index a09af26f69ed..408d06a68571 100644
--- a/drivers/usb/host/ohci-omap3.c
+++ b/drivers/usb/host/ohci-omap3.c
@@ -29,90 +29,22 @@
 *      - add kernel-doc
 */
+#include <linux/dma-mapping.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/usb/otg.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
-#include <linux/of.h>
+#include <linux/usb.h>
-#include <linux/dma-mapping.h>
+#include <linux/usb/hcd.h>
-/*-------------------------------------------------------------------------*/
-static int ohci_omap3_init(struct usb_hcd *hcd)
-{
-        dev_dbg(hcd->self.controller, "starting OHCI controller\n");
-        return ohci_init(hcd_to_ohci(hcd));
-}
-/*-------------------------------------------------------------------------*/
-static int ohci_omap3_start(struct usb_hcd *hcd)
-{
-        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        int ret;
-        /*
-         * RemoteWakeupConnected has to be set explicitly before
-         * calling ohci_run. The reset value of RWC is 0.
-         */
-        ohci->hc_control = OHCI_CTRL_RWC;
-        writel(OHCI_CTRL_RWC, &ohci->regs->control);
-        ret = ohci_run(ohci);
-        if (ret < 0) {
-                dev_err(hcd->self.controller, "can't start\n");
-                ohci_stop(hcd);
-        }
-        return ret;
+#include "ohci.h"
-}
-/*-------------------------------------------------------------------------*/
+#define DRIVER_DESC "OHCI OMAP3 driver"
-static const struct hc_driver ohci_omap3_hc_driver = {
+static const char hcd_name[] = "ohci-omap3";
-        .description =          hcd_name,
+static struct hc_driver __read_mostly ohci_omap3_hc_driver;
-        .product_desc =         "OMAP3 OHCI Host Controller",
-        .hcd_priv_size =        sizeof(struct ohci_hcd),
-        /*
-         * generic hardware linkage
-         */
-        .irq =                  ohci_irq,
-        .flags =                HCD_USB11 | HCD_MEMORY,
-        /*
-         * basic lifecycle operations
-         */
-        .reset =                ohci_omap3_init,
-        .start =                ohci_omap3_start,
-        .stop =                 ohci_stop,
-        .shutdown =             ohci_shutdown,
-        /*
-         * managing i/o requests and associated device resources
-         */
-        .urb_enqueue =          ohci_urb_enqueue,
-        .urb_dequeue =          ohci_urb_dequeue,
-        .endpoint_disable =     ohci_endpoint_disable,
-        /*
-         * scheduling support
-         */
-        .get_frame_number =     ohci_get_frame,
-        /*
-         * root hub support
-         */
-        .hub_status_data =      ohci_hub_status_data,
-        .hub_control =          ohci_hub_control,
-#ifdef  CONFIG_PM
-        .bus_suspend =          ohci_bus_suspend,
-        .bus_resume =           ohci_bus_resume,
-#endif
-        .start_port_reset =     ohci_start_port_reset,
-};
-/*-------------------------------------------------------------------------*/
 /*
 * configure so an HC device and id are always provided
@@ -129,6 +61,7 @@ static const struct hc_driver ohci_omap3_hc_driver = {
 static int ohci_hcd_omap3_probe(struct platform_device *pdev)
 {
        struct device           *dev = &pdev->dev;
+        struct ohci_hcd         *ohci;
        struct usb_hcd          *hcd = NULL;
        void __iomem            *regs = NULL;
        struct resource         *res;
@@ -185,7 +118,12 @@ static int ohci_hcd_omap3_probe(struct platform_device *pdev)
        pm_runtime_enable(dev);
        pm_runtime_get_sync(dev);
-        ohci_hcd_init(hcd_to_ohci(hcd));
+        ohci = hcd_to_ohci(hcd);
+        /*
+         * RemoteWakeupConnected has to be set explicitly before
+         * calling ohci_run. The reset value of RWC is 0.
+         */
+        ohci->hc_control = OHCI_CTRL_RWC;
        ret = usb_add_hcd(hcd, irq, 0);
        if (ret) {
@@ -248,5 +186,25 @@ static struct platform_driver ohci_hcd_omap3_driver = {
        },
 };
+static int __init ohci_omap3_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ohci_init_driver(&ohci_omap3_hc_driver, NULL);
+        return platform_driver_register(&ohci_hcd_omap3_driver);
+}
+module_init(ohci_omap3_init);
+static void __exit ohci_omap3_cleanup(void)
+{
+        platform_driver_unregister(&ohci_hcd_omap3_driver);
+}
+module_exit(ohci_omap3_cleanup);
+MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_ALIAS("platform:ohci-omap3");
 MODULE_AUTHOR("Anand Gadiyar <gadiyar@ti.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index ec337c2bd5e0..90879e9ccbec 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -150,28 +150,16 @@ static int ohci_quirk_nec(struct usb_hcd *hcd)
 static int ohci_quirk_amd700(struct usb_hcd *hcd)
 {
        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        struct pci_dev *amd_smbus_dev;
-        u8 rev;
        if (usb_amd_find_chipset_info())
                ohci->flags |= OHCI_QUIRK_AMD_PLL;
-        amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI,
-                        PCI_DEVICE_ID_ATI_SBX00_SMBUS, NULL);
-        if (!amd_smbus_dev)
-                return 0;
-        rev = amd_smbus_dev->revision;
        /* SB800 needs pre-fetch fix */
-        if ((rev >= 0x40) && (rev <= 0x4f)) {
+        if (usb_amd_prefetch_quirk()) {
                ohci->flags |= OHCI_QUIRK_AMD_PREFETCH;
                ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
        }
-        pci_dev_put(amd_smbus_dev);
-        amd_smbus_dev = NULL;
        return 0;
 }
@@ -323,3 +311,4 @@ module_exit(ohci_pci_cleanup);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
+MODULE_SOFTDEP("pre: ehci_pci");
diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c
index a4c6410f0ed4..f351ff5b171f 100644
--- a/drivers/usb/host/ohci-platform.c
+++ b/drivers/usb/host/ohci-platform.c
@@ -139,14 +139,21 @@ static int ohci_platform_remove(struct platform_device *dev)
 static int ohci_platform_suspend(struct device *dev)
 {
-        struct usb_ohci_pdata *pdata = dev_get_platdata(dev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+        struct usb_ohci_pdata *pdata = dev->platform_data;
        struct platform_device *pdev =
                container_of(dev, struct platform_device, dev);
+        bool do_wakeup = device_may_wakeup(dev);
+        int ret;
+        ret = ohci_suspend(hcd, do_wakeup);
+        if (ret)
+                return ret;
        if (pdata->power_suspend)
                pdata->power_suspend(pdev);
-        return 0;
+        return ret;
 }
 static int ohci_platform_resume(struct device *dev)
diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
index 93371a235e82..deea5d1d6394 100644
--- a/drivers/usb/host/ohci-pxa27x.c
+++ b/drivers/usb/host/ohci-pxa27x.c
@@ -19,15 +19,26 @@
 * This file is licenced under the GPL.
 */
-#include <linux/device.h>
-#include <linux/signal.h>
-#include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/of_platform.h>
 #include <linux/of_gpio.h>
-#include <mach/hardware.h>
 #include <linux/platform_data/usb-ohci-pxa27x.h>
 #include <linux/platform_data/usb-pxa3xx-ulpi.h>
+#include <linux/platform_device.h>
+#include <linux/signal.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+#include <linux/usb/otg.h>
+#include <mach/hardware.h>
+#include "ohci.h"
+#define DRIVER_DESC "OHCI PXA27x/PXA3x driver"
 /*
 * UHC: USB Host Controller (OHCI-like) register definitions
@@ -101,16 +112,16 @@
 #define PXA_UHC_MAX_PORTNUM    3
-struct pxa27x_ohci {
+static const char hcd_name[] = "ohci-pxa27x";
-        /* must be 1st member here for hcd_to_ohci() to work */
-        struct ohci_hcd ohci;
+static struct hc_driver __read_mostly ohci_pxa27x_hc_driver;
-        struct device   *dev;
+struct pxa27x_ohci {
        struct clk      *clk;
        void __iomem    *mmio_base;
 };
-#define to_pxa27x_ohci(hcd)     (struct pxa27x_ohci *)hcd_to_ohci(hcd)
+#define to_pxa27x_ohci(hcd)     (struct pxa27x_ohci *)(hcd_to_ohci(hcd)->priv)
 /*
  PMM_NPS_MODE -- PMM Non-power switching mode
@@ -122,10 +133,10 @@ struct pxa27x_ohci {
  PMM_PERPORT_MODE -- PMM per port switching mode
      Ports are powered individually.
 */
-static int pxa27x_ohci_select_pmm(struct pxa27x_ohci *ohci, int mode)
+static int pxa27x_ohci_select_pmm(struct pxa27x_ohci *pxa_ohci, int mode)
 {
-        uint32_t uhcrhda = __raw_readl(ohci->mmio_base + UHCRHDA);
+        uint32_t uhcrhda = __raw_readl(pxa_ohci->mmio_base + UHCRHDA);
-        uint32_t uhcrhdb = __raw_readl(ohci->mmio_base + UHCRHDB);
+        uint32_t uhcrhdb = __raw_readl(pxa_ohci->mmio_base + UHCRHDB);
        switch (mode) {
        case PMM_NPS_MODE:
@@ -149,20 +160,18 @@ static int pxa27x_ohci_select_pmm(struct pxa27x_ohci *ohci, int mode)
                uhcrhda |= RH_A_NPS;
        }
-        __raw_writel(uhcrhda, ohci->mmio_base + UHCRHDA);
+        __raw_writel(uhcrhda, pxa_ohci->mmio_base + UHCRHDA);
-        __raw_writel(uhcrhdb, ohci->mmio_base + UHCRHDB);
+        __raw_writel(uhcrhdb, pxa_ohci->mmio_base + UHCRHDB);
        return 0;
 }
-extern int usb_disabled(void);
 /*-------------------------------------------------------------------------*/
-static inline void pxa27x_setup_hc(struct pxa27x_ohci *ohci,
+static inline void pxa27x_setup_hc(struct pxa27x_ohci *pxa_ohci,
                                   struct pxaohci_platform_data *inf)
 {
-        uint32_t uhchr = __raw_readl(ohci->mmio_base + UHCHR);
+        uint32_t uhchr = __raw_readl(pxa_ohci->mmio_base + UHCHR);
-        uint32_t uhcrhda = __raw_readl(ohci->mmio_base + UHCRHDA);
+        uint32_t uhcrhda = __raw_readl(pxa_ohci->mmio_base + UHCRHDA);
        if (inf->flags & ENABLE_PORT1)
                uhchr &= ~UHCHR_SSEP1;
@@ -194,17 +203,17 @@ static inline void pxa27x_setup_hc(struct pxa27x_ohci *ohci,
                uhcrhda |= UHCRHDA_POTPGT(inf->power_on_delay / 2);
        }
-        __raw_writel(uhchr, ohci->mmio_base + UHCHR);
+        __raw_writel(uhchr, pxa_ohci->mmio_base + UHCHR);
-        __raw_writel(uhcrhda, ohci->mmio_base + UHCRHDA);
+        __raw_writel(uhcrhda, pxa_ohci->mmio_base + UHCRHDA);
 }
-static inline void pxa27x_reset_hc(struct pxa27x_ohci *ohci)
+static inline void pxa27x_reset_hc(struct pxa27x_ohci *pxa_ohci)
 {
-        uint32_t uhchr = __raw_readl(ohci->mmio_base + UHCHR);
+        uint32_t uhchr = __raw_readl(pxa_ohci->mmio_base + UHCHR);
-        __raw_writel(uhchr | UHCHR_FHR, ohci->mmio_base + UHCHR);
+        __raw_writel(uhchr | UHCHR_FHR, pxa_ohci->mmio_base + UHCHR);
        udelay(11);
-        __raw_writel(uhchr & ~UHCHR_FHR, ohci->mmio_base + UHCHR);
+        __raw_writel(uhchr & ~UHCHR_FHR, pxa_ohci->mmio_base + UHCHR);
 }
 #ifdef CONFIG_PXA27x
@@ -213,25 +222,26 @@ extern void pxa27x_clear_otgph(void);
 #define pxa27x_clear_otgph()    do {} while (0)
 #endif
-static int pxa27x_start_hc(struct pxa27x_ohci *ohci, struct device *dev)
+static int pxa27x_start_hc(struct pxa27x_ohci *pxa_ohci, struct device *dev)
 {
        int retval = 0;
        struct pxaohci_platform_data *inf;
        uint32_t uhchr;
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
        inf = dev_get_platdata(dev);
-        clk_prepare_enable(ohci->clk);
+        clk_prepare_enable(pxa_ohci->clk);
-        pxa27x_reset_hc(ohci);
+        pxa27x_reset_hc(pxa_ohci);
-        uhchr = __raw_readl(ohci->mmio_base + UHCHR) | UHCHR_FSBIR;
+        uhchr = __raw_readl(pxa_ohci->mmio_base + UHCHR) | UHCHR_FSBIR;
-        __raw_writel(uhchr, ohci->mmio_base + UHCHR);
+        __raw_writel(uhchr, pxa_ohci->mmio_base + UHCHR);
-        while (__raw_readl(ohci->mmio_base + UHCHR) & UHCHR_FSBIR)
+        while (__raw_readl(pxa_ohci->mmio_base + UHCHR) & UHCHR_FSBIR)
                cpu_relax();
-        pxa27x_setup_hc(ohci, inf);
+        pxa27x_setup_hc(pxa_ohci, inf);
        if (inf->init)
                retval = inf->init(dev);
@@ -240,38 +250,39 @@ static int pxa27x_start_hc(struct pxa27x_ohci *ohci, struct device *dev)
                return retval;
        if (cpu_is_pxa3xx())
-                pxa3xx_u2d_start_hc(&ohci_to_hcd(&ohci->ohci)->self);
+                pxa3xx_u2d_start_hc(&hcd->self);
-        uhchr = __raw_readl(ohci->mmio_base + UHCHR) & ~UHCHR_SSE;
+        uhchr = __raw_readl(pxa_ohci->mmio_base + UHCHR) & ~UHCHR_SSE;
-        __raw_writel(uhchr, ohci->mmio_base + UHCHR);
+        __raw_writel(uhchr, pxa_ohci->mmio_base + UHCHR);
-        __raw_writel(UHCHIE_UPRIE | UHCHIE_RWIE, ohci->mmio_base + UHCHIE);
+        __raw_writel(UHCHIE_UPRIE | UHCHIE_RWIE, pxa_ohci->mmio_base + UHCHIE);
        /* Clear any OTG Pin Hold */
        pxa27x_clear_otgph();
        return 0;
 }
-static void pxa27x_stop_hc(struct pxa27x_ohci *ohci, struct device *dev)
+static void pxa27x_stop_hc(struct pxa27x_ohci *pxa_ohci, struct device *dev)
 {
        struct pxaohci_platform_data *inf;
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
        uint32_t uhccoms;
        inf = dev_get_platdata(dev);
        if (cpu_is_pxa3xx())
-                pxa3xx_u2d_stop_hc(&ohci_to_hcd(&ohci->ohci)->self);
+                pxa3xx_u2d_stop_hc(&hcd->self);
        if (inf->exit)
                inf->exit(dev);
-        pxa27x_reset_hc(ohci);
+        pxa27x_reset_hc(pxa_ohci);
        /* Host Controller Reset */
-        uhccoms = __raw_readl(ohci->mmio_base + UHCCOMS) | 0x01;
+        uhccoms = __raw_readl(pxa_ohci->mmio_base + UHCCOMS) | 0x01;
-        __raw_writel(uhccoms, ohci->mmio_base + UHCCOMS);
+        __raw_writel(uhccoms, pxa_ohci->mmio_base + UHCCOMS);
        udelay(10);
-        clk_disable_unprepare(ohci->clk);
+        clk_disable_unprepare(pxa_ohci->clk);
 }
 #ifdef CONFIG_OF
@@ -356,7 +367,8 @@ int usb_hcd_pxa27x_probe (const struct hc_driver *driver, struct platform_device
        int retval, irq;
        struct usb_hcd *hcd;
        struct pxaohci_platform_data *inf;
-        struct pxa27x_ohci *ohci;
+        struct pxa27x_ohci *pxa_ohci;
+        struct ohci_hcd *ohci;
        struct resource *r;
        struct clk *usb_clk;
@@ -409,29 +421,31 @@ int usb_hcd_pxa27x_probe (const struct hc_driver *driver, struct platform_device
        }
        /* initialize "struct pxa27x_ohci" */
-        ohci = (struct pxa27x_ohci *)hcd_to_ohci(hcd);
+        pxa_ohci = to_pxa27x_ohci(hcd);
-        ohci->dev = &pdev->dev;
+        pxa_ohci->clk = usb_clk;
-        ohci->clk = usb_clk;
+        pxa_ohci->mmio_base = (void __iomem *)hcd->regs;
-        ohci->mmio_base = (void __iomem *)hcd->regs;
-        if ((retval = pxa27x_start_hc(ohci, &pdev->dev)) < 0) {
+        retval = pxa27x_start_hc(pxa_ohci, &pdev->dev);
+        if (retval < 0) {
                pr_debug("pxa27x_start_hc failed");
                goto err3;
        }
        /* Select Power Management Mode */
-        pxa27x_ohci_select_pmm(ohci, inf->port_mode);
+        pxa27x_ohci_select_pmm(pxa_ohci, inf->port_mode);
        if (inf->power_budget)
                hcd->power_budget = inf->power_budget;
-        ohci_hcd_init(hcd_to_ohci(hcd));
+        /* The value of NDP in roothub_a is incorrect on this hardware */
+        ohci = hcd_to_ohci(hcd);
+        ohci->num_ports = 3;
        retval = usb_add_hcd(hcd, irq, 0);
        if (retval == 0)
                return retval;
-        pxa27x_stop_hc(ohci, &pdev->dev);
+        pxa27x_stop_hc(pxa_ohci, &pdev->dev);
 err3:
        iounmap(hcd->regs);
 err2:
@@ -459,88 +473,18 @@ int usb_hcd_pxa27x_probe (const struct hc_driver *driver, struct platform_device
 */
 void usb_hcd_pxa27x_remove (struct usb_hcd *hcd, struct platform_device *pdev)
 {
-        struct pxa27x_ohci *ohci = to_pxa27x_ohci(hcd);
+        struct pxa27x_ohci *pxa_ohci = to_pxa27x_ohci(hcd);
        usb_remove_hcd(hcd);
-        pxa27x_stop_hc(ohci, &pdev->dev);
+        pxa27x_stop_hc(pxa_ohci, &pdev->dev);
        iounmap(hcd->regs);
        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        clk_put(pxa_ohci->clk);
        usb_put_hcd(hcd);
-        clk_put(ohci->clk);
-}
-/*-------------------------------------------------------------------------*/
-static int
-ohci_pxa27x_start (struct usb_hcd *hcd)
-{
-        struct ohci_hcd *ohci = hcd_to_ohci (hcd);
-        int             ret;
-        ohci_dbg (ohci, "ohci_pxa27x_start, ohci:%p", ohci);
-        /* The value of NDP in roothub_a is incorrect on this hardware */
-        ohci->num_ports = 3;
-        if ((ret = ohci_init(ohci)) < 0)
-                return ret;
-        if ((ret = ohci_run (ohci)) < 0) {
-                dev_err(hcd->self.controller, "can't start %s",
-                        hcd->self.bus_name);
-                ohci_stop (hcd);
-                return ret;
-        }
-        return 0;
 }
 /*-------------------------------------------------------------------------*/
-static const struct hc_driver ohci_pxa27x_hc_driver = {
-        .description =          hcd_name,
-        .product_desc =         "PXA27x OHCI",
-        .hcd_priv_size =        sizeof(struct pxa27x_ohci),
-        /*
-         * generic hardware linkage
-         */
-        .irq =                  ohci_irq,
-        .flags =                HCD_USB11 | HCD_MEMORY,
-        /*
-         * basic lifecycle operations
-         */
-        .start =                ohci_pxa27x_start,
-        .stop =                 ohci_stop,
-        .shutdown =             ohci_shutdown,
-        /*
-         * managing i/o requests and associated device resources
-         */
-        .urb_enqueue =          ohci_urb_enqueue,
-        .urb_dequeue =          ohci_urb_dequeue,
-        .endpoint_disable =     ohci_endpoint_disable,
-        /*
-         * scheduling support
-         */
-        .get_frame_number =     ohci_get_frame,
-        /*
-         * root hub support
-         */
-        .hub_status_data =      ohci_hub_status_data,
-        .hub_control =          ohci_hub_control,
-#ifdef  CONFIG_PM
-        .bus_suspend =          ohci_bus_suspend,
-        .bus_resume =           ohci_bus_resume,
-#endif
-        .start_port_reset =     ohci_start_port_reset,
-};
-/*-------------------------------------------------------------------------*/
 static int ohci_hcd_pxa27x_drv_probe(struct platform_device *pdev)
 {
        pr_debug ("In ohci_hcd_pxa27x_drv_probe");
@@ -563,32 +507,42 @@ static int ohci_hcd_pxa27x_drv_remove(struct platform_device *pdev)
 static int ohci_hcd_pxa27x_drv_suspend(struct device *dev)
 {
        struct usb_hcd *hcd = dev_get_drvdata(dev);
-        struct pxa27x_ohci *ohci = to_pxa27x_ohci(hcd);
+        struct pxa27x_ohci *pxa_ohci = to_pxa27x_ohci(hcd);
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        bool do_wakeup = device_may_wakeup(dev);
+        int ret;
-        if (time_before(jiffies, ohci->ohci.next_statechange))
+        if (time_before(jiffies, ohci->next_statechange))
                msleep(5);
-        ohci->ohci.next_statechange = jiffies;
+        ohci->next_statechange = jiffies;
-        pxa27x_stop_hc(ohci, dev);
+        ret = ohci_suspend(hcd, do_wakeup);
-        return 0;
+        if (ret)
+                return ret;
+        pxa27x_stop_hc(pxa_ohci, dev);
+        return ret;
 }
 static int ohci_hcd_pxa27x_drv_resume(struct device *dev)
 {
        struct usb_hcd *hcd = dev_get_drvdata(dev);
-        struct pxa27x_ohci *ohci = to_pxa27x_ohci(hcd);
+        struct pxa27x_ohci *pxa_ohci = to_pxa27x_ohci(hcd);
        struct pxaohci_platform_data *inf = dev_get_platdata(dev);
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
        int status;
-        if (time_before(jiffies, ohci->ohci.next_statechange))
+        if (time_before(jiffies, ohci->next_statechange))
                msleep(5);
-        ohci->ohci.next_statechange = jiffies;
+        ohci->next_statechange = jiffies;
-        if ((status = pxa27x_start_hc(ohci, dev)) < 0)
+        status = pxa27x_start_hc(pxa_ohci, dev);
+        if (status < 0)
                return status;
        /* Select Power Management Mode */
-        pxa27x_ohci_select_pmm(ohci, inf->port_mode);
+        pxa27x_ohci_select_pmm(pxa_ohci, inf->port_mode);
        ohci_resume(hcd, false);
        return 0;
@@ -600,9 +554,6 @@ static const struct dev_pm_ops ohci_hcd_pxa27x_pm_ops = {
 };
 #endif
-/* work with hotplug and coldplug */
-MODULE_ALIAS("platform:pxa27x-ohci");
 static struct platform_driver ohci_hcd_pxa27x_driver = {
        .probe          = ohci_hcd_pxa27x_drv_probe,
        .remove         = ohci_hcd_pxa27x_drv_remove,
@@ -617,3 +568,27 @@ static struct platform_driver ohci_hcd_pxa27x_driver = {
        },
 };
+static const struct ohci_driver_overrides pxa27x_overrides __initconst = {
+        .extra_priv_size =      sizeof(struct pxa27x_ohci),
+};
+static int __init ohci_pxa27x_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ohci_init_driver(&ohci_pxa27x_hc_driver, &pxa27x_overrides);
+        return platform_driver_register(&ohci_hcd_pxa27x_driver);
+}
+module_init(ohci_pxa27x_init);
+static void __exit ohci_pxa27x_cleanup(void)
+{
+        platform_driver_unregister(&ohci_hcd_pxa27x_driver);
+}
+module_exit(ohci_pxa27x_cleanup);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:pxa27x-ohci");
diff --git a/drivers/usb/host/ohci-s3c2410.c b/drivers/usb/host/ohci-s3c2410.c
index 4919afa4125e..be3429e08d90 100644
--- a/drivers/usb/host/ohci-s3c2410.c
+++ b/drivers/usb/host/ohci-s3c2410.c
@@ -19,19 +19,36 @@
 * This file is licenced under the GPL.
 */
-#include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
 #include <linux/platform_data/usb-ohci-s3c2410.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+#include "ohci.h"
 #define valid_port(idx) ((idx) == 1 || (idx) == 2)
 /* clock device associated with the hcd */
+#define DRIVER_DESC "OHCI S3C2410 driver"
+static const char hcd_name[] = "ohci-s3c2410";
 static struct clk *clk;
 static struct clk *usb_clk;
 /* forward definitions */
+static int (*orig_ohci_hub_control)(struct usb_hcd  *hcd, u16 typeReq,
+                        u16 wValue, u16 wIndex, char *buf, u16 wLength);
+static int (*orig_ohci_hub_status_data)(struct usb_hcd *hcd, char *buf);
 static void s3c2410_hcd_oc(struct s3c2410_hcd_info *info, int port_oc);
 /* conversion functions */
@@ -93,7 +110,7 @@ ohci_s3c2410_hub_status_data(struct usb_hcd *hcd, char *buf)
        int orig;
        int portno;
-        orig  = ohci_hub_status_data(hcd, buf);
+        orig = orig_ohci_hub_status_data(hcd, buf);
        if (info == NULL)
                return orig;
@@ -164,7 +181,7 @@ static int ohci_s3c2410_hub_control(
         * process the request straight away and exit */
        if (info == NULL) {
-                ret = ohci_hub_control(hcd, typeReq, wValue,
+                ret = orig_ohci_hub_control(hcd, typeReq, wValue,
                                       wIndex, buf, wLength);
                goto out;
        }
@@ -214,7 +231,7 @@ static int ohci_s3c2410_hub_control(
                break;
        }
-        ret = ohci_hub_control(hcd, typeReq, wValue, wIndex, buf, wLength);
+        ret = orig_ohci_hub_control(hcd, typeReq, wValue, wIndex, buf, wLength);
        if (ret)
                goto out;
@@ -374,8 +391,6 @@ static int usb_hcd_s3c2410_probe(const struct hc_driver *driver,
        s3c2410_start_hc(dev, hcd);
-        ohci_hcd_init(hcd_to_ohci(hcd));
        retval = usb_add_hcd(hcd, dev->resource[1].start, 0);
        if (retval != 0)
                goto err_ioremap;
@@ -392,71 +407,7 @@ static int usb_hcd_s3c2410_probe(const struct hc_driver *driver,
 /*-------------------------------------------------------------------------*/
-static int
+static struct hc_driver __read_mostly ohci_s3c2410_hc_driver;
-ohci_s3c2410_start(struct usb_hcd *hcd)
-{
-        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        int ret;
-        ret = ohci_init(ohci);
-        if (ret < 0)
-                return ret;
-        ret = ohci_run(ohci);
-        if (ret < 0) {
-                dev_err(hcd->self.controller, "can't start %s\n",
-                        hcd->self.bus_name);
-                ohci_stop(hcd);
-                return ret;
-        }
-        return 0;
-}
-static const struct hc_driver ohci_s3c2410_hc_driver = {
-        .description =          hcd_name,
-        .product_desc =         "S3C24XX OHCI",
-        .hcd_priv_size =        sizeof(struct ohci_hcd),
-        /*
-         * generic hardware linkage
-         */
-        .irq =                  ohci_irq,
-        .flags =                HCD_USB11 | HCD_MEMORY,
-        /*
-         * basic lifecycle operations
-         */
-        .start =                ohci_s3c2410_start,
-        .stop =                 ohci_stop,
-        .shutdown =             ohci_shutdown,
-        /*
-         * managing i/o requests and associated device resources
-         */
-        .urb_enqueue =          ohci_urb_enqueue,
-        .urb_dequeue =          ohci_urb_dequeue,
-        .endpoint_disable =     ohci_endpoint_disable,
-        /*
-         * scheduling support
-         */
-        .get_frame_number =     ohci_get_frame,
-        /*
-         * root hub support
-         */
-        .hub_status_data =      ohci_s3c2410_hub_status_data,
-        .hub_control =          ohci_s3c2410_hub_control,
-#ifdef  CONFIG_PM
-        .bus_suspend =          ohci_bus_suspend,
-        .bus_resume =           ohci_bus_resume,
-#endif
-        .start_port_reset =     ohci_start_port_reset,
-};
-/* device driver */
 static int ohci_hcd_s3c2410_drv_probe(struct platform_device *pdev)
 {
@@ -533,4 +484,39 @@ static struct platform_driver ohci_hcd_s3c2410_driver = {
        },
 };
+static int __init ohci_s3c2410_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ohci_init_driver(&ohci_s3c2410_hc_driver, NULL);
+        /*
+         * The Samsung HW has some unusual quirks, which require
+         * Sumsung-specific workarounds. We override certain hc_driver
+         * functions here to achieve that. We explicitly do not enhance
+         * ohci_driver_overrides to allow this more easily, since this
+         * is an unusual case, and we don't want to encourage others to
+         * override these functions by making it too easy.
+         */
+        orig_ohci_hub_control = ohci_s3c2410_hc_driver.hub_control;
+        orig_ohci_hub_status_data = ohci_s3c2410_hc_driver.hub_status_data;
+        ohci_s3c2410_hc_driver.hub_status_data  = ohci_s3c2410_hub_status_data;
+        ohci_s3c2410_hc_driver.hub_control      = ohci_s3c2410_hub_control;
+        return platform_driver_register(&ohci_hcd_s3c2410_driver);
+}
+module_init(ohci_s3c2410_init);
+static void __exit ohci_s3c2410_cleanup(void)
+{
+        platform_driver_unregister(&ohci_hcd_s3c2410_driver);
+}
+module_exit(ohci_s3c2410_cleanup);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:s3c2410-ohci");
diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c
index d479d5ddab88..2a5de5fecd8f 100644
--- a/drivers/usb/host/ohci-sm501.c
+++ b/drivers/usb/host/ohci-sm501.c
@@ -216,14 +216,21 @@ static int ohci_hcd_sm501_drv_remove(struct platform_device *pdev)
 static int ohci_sm501_suspend(struct platform_device *pdev, pm_message_t msg)
 {
        struct device *dev = &pdev->dev;
-        struct ohci_hcd *ohci = hcd_to_ohci(platform_get_drvdata(pdev));
+        struct usb_hcd  *hcd = platform_get_drvdata(pdev);
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        bool do_wakeup = device_may_wakeup(dev);
+        int ret;
        if (time_before(jiffies, ohci->next_statechange))
                msleep(5);
        ohci->next_statechange = jiffies;
+        ret = ohci_suspend(hcd, do_wakeup);
+        if (ret)
+                return ret;
        sm501_unit_power(dev->parent, SM501_GATE_USB_HOST, 0);
-        return 0;
+        return ret;
 }
 static int ohci_sm501_resume(struct platform_device *pdev)
diff --git a/drivers/usb/host/ohci-spear.c b/drivers/usb/host/ohci-spear.c
index cc9dd9e4f05e..31ff3fc4e26f 100644
--- a/drivers/usb/host/ohci-spear.c
+++ b/drivers/usb/host/ohci-spear.c
@@ -11,92 +11,37 @@
 * warranty of any kind, whether express or implied.
 */
-#include <linux/signal.h>
-#include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/dma-mapping.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/signal.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+#include "ohci.h"
+#define DRIVER_DESC "OHCI SPEAr driver"
+static const char hcd_name[] = "SPEAr-ohci";
 struct spear_ohci {
-        struct ohci_hcd ohci;
        struct clk *clk;
 };
-#define to_spear_ohci(hcd)      (struct spear_ohci *)hcd_to_ohci(hcd)
+#define to_spear_ohci(hcd)     (struct spear_ohci *)(hcd_to_ohci(hcd)->priv)
-static void spear_start_ohci(struct spear_ohci *ohci)
-{
-        clk_prepare_enable(ohci->clk);
-}
-static void spear_stop_ohci(struct spear_ohci *ohci)
-{
-        clk_disable_unprepare(ohci->clk);
-}
-static int ohci_spear_start(struct usb_hcd *hcd)
-{
-        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        int ret;
-        ret = ohci_init(ohci);
-        if (ret < 0)
-                return ret;
-        ohci->regs = hcd->regs;
-        ret = ohci_run(ohci);
-        if (ret < 0) {
-                dev_err(hcd->self.controller, "can't start\n");
-                ohci_stop(hcd);
-                return ret;
-        }
-        create_debug_files(ohci);
-#ifdef DEBUG
-        ohci_dump(ohci, 1);
-#endif
-        return 0;
-}
-static const struct hc_driver ohci_spear_hc_driver = {
-        .description            = hcd_name,
-        .product_desc           = "SPEAr OHCI",
-        .hcd_priv_size          = sizeof(struct spear_ohci),
-        /* generic hardware linkage */
-        .irq                    = ohci_irq,
-        .flags                  = HCD_USB11 | HCD_MEMORY,
-        /* basic lifecycle operations */
-        .start                  = ohci_spear_start,
-        .stop                   = ohci_stop,
-        .shutdown               = ohci_shutdown,
-#ifdef  CONFIG_PM
-        .bus_suspend            = ohci_bus_suspend,
-        .bus_resume             = ohci_bus_resume,
-#endif
-        /* managing i/o requests and associated device resources */
-        .urb_enqueue            = ohci_urb_enqueue,
-        .urb_dequeue            = ohci_urb_dequeue,
-        .endpoint_disable       = ohci_endpoint_disable,
-        /* scheduling support */
-        .get_frame_number       = ohci_get_frame,
-        /* root hub support */
+static struct hc_driver __read_mostly ohci_spear_hc_driver;
-        .hub_status_data        = ohci_hub_status_data,
-        .hub_control            = ohci_hub_control,
-        .start_port_reset       = ohci_start_port_reset,
-};
 static int spear_ohci_hcd_drv_probe(struct platform_device *pdev)
 {
        const struct hc_driver *driver = &ohci_spear_hc_driver;
+        struct ohci_hcd *ohci;
        struct usb_hcd *hcd = NULL;
        struct clk *usbh_clk;
-        struct spear_ohci *ohci_p;
+        struct spear_ohci *sohci_p;
        struct resource *res;
        int retval, irq;
@@ -151,16 +96,18 @@ static int spear_ohci_hcd_drv_probe(struct platform_device *pdev)
                goto err_put_hcd;
        }
-        ohci_p = (struct spear_ohci *)hcd_to_ohci(hcd);
+        sohci_p = to_spear_ohci(hcd);
-        ohci_p->clk = usbh_clk;
+        sohci_p->clk = usbh_clk;
-        spear_start_ohci(ohci_p);
-        ohci_hcd_init(hcd_to_ohci(hcd));
+        clk_prepare_enable(sohci_p->clk);
+        ohci = hcd_to_ohci(hcd);
        retval = usb_add_hcd(hcd, platform_get_irq(pdev, 0), 0);
        if (retval == 0)
                return retval;
-        spear_stop_ohci(ohci_p);
+        clk_disable_unprepare(sohci_p->clk);
 err_put_hcd:
        usb_put_hcd(hcd);
 fail:
@@ -172,11 +119,11 @@ fail:
 static int spear_ohci_hcd_drv_remove(struct platform_device *pdev)
 {
        struct usb_hcd *hcd = platform_get_drvdata(pdev);
-        struct spear_ohci *ohci_p = to_spear_ohci(hcd);
+        struct spear_ohci *sohci_p = to_spear_ohci(hcd);
        usb_remove_hcd(hcd);
-        if (ohci_p->clk)
+        if (sohci_p->clk)
-                spear_stop_ohci(ohci_p);
+                clk_disable_unprepare(sohci_p->clk);
        usb_put_hcd(hcd);
        return 0;
@@ -188,13 +135,14 @@ static int spear_ohci_hcd_drv_suspend(struct platform_device *dev,
 {
        struct usb_hcd *hcd = platform_get_drvdata(dev);
        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        struct spear_ohci *ohci_p = to_spear_ohci(hcd);
+        struct spear_ohci *sohci_p = to_spear_ohci(hcd);
        if (time_before(jiffies, ohci->next_statechange))
                msleep(5);
        ohci->next_statechange = jiffies;
-        spear_stop_ohci(ohci_p);
+        clk_disable_unprepare(sohci_p->clk);
        return 0;
 }
@@ -202,13 +150,13 @@ static int spear_ohci_hcd_drv_resume(struct platform_device *dev)
 {
        struct usb_hcd *hcd = platform_get_drvdata(dev);
        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        struct spear_ohci *ohci_p = to_spear_ohci(hcd);
+        struct spear_ohci *sohci_p = to_spear_ohci(hcd);
        if (time_before(jiffies, ohci->next_statechange))
                msleep(5);
        ohci->next_statechange = jiffies;
-        spear_start_ohci(ohci_p);
+        clk_prepare_enable(sohci_p->clk);
        ohci_resume(hcd, false);
        return 0;
 }
@@ -234,4 +182,28 @@ static struct platform_driver spear_ohci_hcd_driver = {
        },
 };
+static const struct ohci_driver_overrides spear_overrides __initconst = {
+        .extra_priv_size = sizeof(struct spear_ohci),
+};
+static int __init ohci_spear_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+        ohci_init_driver(&ohci_spear_hc_driver, &spear_overrides);
+        return platform_driver_register(&spear_ohci_hcd_driver);
+}
+module_init(ohci_spear_init);
+static void __exit ohci_spear_cleanup(void)
+{
+        platform_driver_unregister(&spear_ohci_hcd_driver);
+}
+module_exit(ohci_spear_cleanup);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Deepak Sikri");
+MODULE_LICENSE("GPL v2");
 MODULE_ALIAS("platform:spear-ohci");
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 08ef2829a7e2..dfbdd3aefe98 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -79,11 +79,30 @@
 #define USB_INTEL_USB3_PSSEN   0xD8
 #define USB_INTEL_USB3PRM      0xDC
+/*
+ * amd_chipset_gen values represent AMD different chipset generations
+ */
+enum amd_chipset_gen {
+        NOT_AMD_CHIPSET = 0,
+        AMD_CHIPSET_SB600,
+        AMD_CHIPSET_SB700,
+        AMD_CHIPSET_SB800,
+        AMD_CHIPSET_HUDSON2,
+        AMD_CHIPSET_BOLTON,
+        AMD_CHIPSET_YANGTZE,
+        AMD_CHIPSET_UNKNOWN,
+};
+struct amd_chipset_type {
+        enum amd_chipset_gen gen;
+        u8 rev;
+};
 static struct amd_chipset_info {
        struct pci_dev  *nb_dev;
        struct pci_dev  *smbus_dev;
        int nb_type;
-        int sb_type;
+        struct amd_chipset_type sb_type;
        int isoc_reqs;
        int probe_count;
        int probe_result;
@@ -91,6 +110,51 @@ static struct amd_chipset_info {
 static DEFINE_SPINLOCK(amd_lock);
+/*
+ * amd_chipset_sb_type_init - initialize amd chipset southbridge type
+ *
+ * AMD FCH/SB generation and revision is identified by SMBus controller
+ * vendor, device and revision IDs.
+ *
+ * Returns: 1 if it is an AMD chipset, 0 otherwise.
+ */
+static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
+{
+        u8 rev = 0;
+        pinfo->sb_type.gen = AMD_CHIPSET_UNKNOWN;
+        pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI,
+                        PCI_DEVICE_ID_ATI_SBX00_SMBUS, NULL);
+        if (pinfo->smbus_dev) {
+                rev = pinfo->smbus_dev->revision;
+                if (rev >= 0x10 && rev <= 0x1f)
+                        pinfo->sb_type.gen = AMD_CHIPSET_SB600;
+                else if (rev >= 0x30 && rev <= 0x3f)
+                        pinfo->sb_type.gen = AMD_CHIPSET_SB700;
+                else if (rev >= 0x40 && rev <= 0x4f)
+                        pinfo->sb_type.gen = AMD_CHIPSET_SB800;
+        } else {
+                pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+                                PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
+                if (!pinfo->smbus_dev) {
+                        pinfo->sb_type.gen = NOT_AMD_CHIPSET;
+                        return 0;
+                }
+                rev = pinfo->smbus_dev->revision;
+                if (rev >= 0x11 && rev <= 0x14)
+                        pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
+                else if (rev >= 0x15 && rev <= 0x18)
+                        pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
+                else if (rev >= 0x39 && rev <= 0x3a)
+                        pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
+        }
+        pinfo->sb_type.rev = rev;
+        return 1;
+}
 void sb800_prefetch(struct device *dev, int on)
 {
        u16 misc;
@@ -106,7 +170,6 @@ EXPORT_SYMBOL_GPL(sb800_prefetch);
 int usb_amd_find_chipset_info(void)
 {
-        u8 rev = 0;
        unsigned long flags;
        struct amd_chipset_info info;
        int ret;
@@ -122,27 +185,17 @@ int usb_amd_find_chipset_info(void)
        memset(&info, 0, sizeof(info));
        spin_unlock_irqrestore(&amd_lock, flags);
-        info.smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
+        if (!amd_chipset_sb_type_init(&info)) {
-        if (info.smbus_dev) {
+                ret = 0;
-                rev = info.smbus_dev->revision;
+                goto commit;
-                if (rev >= 0x40)
-                        info.sb_type = 1;
-                else if (rev >= 0x30 && rev <= 0x3b)
-                        info.sb_type = 3;
-        } else {
-                info.smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
-                                                0x780b, NULL);
-                if (!info.smbus_dev) {
-                        ret = 0;
-                        goto commit;
-                }
-                rev = info.smbus_dev->revision;
-                if (rev >= 0x11 && rev <= 0x18)
-                        info.sb_type = 2;
        }
-        if (info.sb_type == 0) {
+        /* Below chipset generations needn't enable AMD PLL quirk */
+        if (info.sb_type.gen == AMD_CHIPSET_UNKNOWN ||
+                        info.sb_type.gen == AMD_CHIPSET_SB600 ||
+                        info.sb_type.gen == AMD_CHIPSET_YANGTZE ||
+                        (info.sb_type.gen == AMD_CHIPSET_SB700 &&
+                        info.sb_type.rev > 0x3b)) {
                if (info.smbus_dev) {
                        pci_dev_put(info.smbus_dev);
                        info.smbus_dev = NULL;
@@ -197,6 +250,39 @@ commit:
 }
 EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info);
+int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev)
+{
+        /* Make sure amd chipset type has already been initialized */
+        usb_amd_find_chipset_info();
+        if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE)
+                return 0;
+        dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
+        return 1;
+}
+EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk);
+bool usb_amd_hang_symptom_quirk(void)
+{
+        u8 rev;
+        usb_amd_find_chipset_info();
+        rev = amd_chipset.sb_type.rev;
+        /* SB600 and old version of SB700 have hang symptom bug */
+        return amd_chipset.sb_type.gen == AMD_CHIPSET_SB600 ||
+                        (amd_chipset.sb_type.gen == AMD_CHIPSET_SB700 &&
+                         rev >= 0x3a && rev <= 0x3b);
+}
+EXPORT_SYMBOL_GPL(usb_amd_hang_symptom_quirk);
+bool usb_amd_prefetch_quirk(void)
+{
+        usb_amd_find_chipset_info();
+        /* SB800 needs pre-fetch fix */
+        return amd_chipset.sb_type.gen == AMD_CHIPSET_SB800;
+}
+EXPORT_SYMBOL_GPL(usb_amd_prefetch_quirk);
 /*
 * The hardware normally enables the A-link power management feature, which
 * lets the system lower the power consumption in idle states.
@@ -229,7 +315,9 @@ static void usb_amd_quirk_pll(int disable)
                }
        }
-        if (amd_chipset.sb_type == 1 || amd_chipset.sb_type == 2) {
+        if (amd_chipset.sb_type.gen == AMD_CHIPSET_SB800 ||
+                        amd_chipset.sb_type.gen == AMD_CHIPSET_HUDSON2 ||
+                        amd_chipset.sb_type.gen == AMD_CHIPSET_BOLTON) {
                outb_p(AB_REG_BAR_LOW, 0xcd6);
                addr_low = inb_p(0xcd7);
                outb_p(AB_REG_BAR_HIGH, 0xcd6);
@@ -240,7 +328,8 @@ static void usb_amd_quirk_pll(int disable)
                outl_p(0x40, AB_DATA(addr));
                outl_p(0x34, AB_INDX(addr));
                val = inl_p(AB_DATA(addr));
-        } else if (amd_chipset.sb_type == 3) {
+        } else if (amd_chipset.sb_type.gen == AMD_CHIPSET_SB700 &&
+                        amd_chipset.sb_type.rev <= 0x3b) {
                pci_read_config_dword(amd_chipset.smbus_dev,
                                        AB_REG_BAR_SB700, &addr);
                outl(AX_INDXC, AB_INDX(addr));
@@ -353,7 +442,7 @@ void usb_amd_dev_put(void)
        amd_chipset.nb_dev = NULL;
        amd_chipset.smbus_dev = NULL;
        amd_chipset.nb_type = 0;
-        amd_chipset.sb_type = 0;
+        memset(&amd_chipset.sb_type, 0, sizeof(amd_chipset.sb_type));
        amd_chipset.isoc_reqs = 0;
        amd_chipset.probe_result = 0;
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index ed6700d00fe6..638e88f7a28b 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -5,6 +5,8 @@
 void uhci_reset_hc(struct pci_dev *pdev, unsigned long base);
 int uhci_check_and_reset_hc(struct pci_dev *pdev, unsigned long base);
 int usb_amd_find_chipset_info(void);
+bool usb_amd_hang_symptom_quirk(void);
+bool usb_amd_prefetch_quirk(void);
 void usb_amd_dev_put(void);
 void usb_amd_quirk_pll_disable(void);
 void usb_amd_quirk_pll_enable(void);
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index 5477bf5df218..79620c39217e 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -1413,7 +1413,7 @@ static int sl811h_show(struct seq_file *s, void *unused)
                        case SL11H_CTL1MASK_SE0: s = " se0/reset"; break;
                        case SL11H_CTL1MASK_K: s = " k/resume"; break;
                        default: s = "j"; break;
-                        }; s; }),
+                        } s; }),
                        (t & SL11H_CTL1MASK_LSPD) ? " lowspeed" : "",
                        (t & SL11H_CTL1MASK_SUSPEND) ? " suspend" : "");
@@ -1446,7 +1446,7 @@ static int sl811h_show(struct seq_file *s, void *unused)
                        case USB_PID_SETUP: s = "setup"; break;
                        case USB_PID_ACK: s = "status"; break;
                        default: s = "?"; break;
-                        }; s;}),
+                        } s;}),
                        ep->maxpacket,
                        ep->nak_count, ep->error_count);
                list_for_each_entry (urb, &ep->hep->urb_list, urb_list) {
diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index 455737546525..8e239cdd95d5 100644
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -310,14 +310,14 @@ static int uhci_show_status(struct uhci_hcd *uhci, char *buf, int len)
        unsigned short portsc1, portsc2;
-        usbcmd    = uhci_readw(uhci, 0);
+        usbcmd    = uhci_readw(uhci, USBCMD);
-        usbstat   = uhci_readw(uhci, 2);
+        usbstat   = uhci_readw(uhci, USBSTS);
-        usbint    = uhci_readw(uhci, 4);
+        usbint    = uhci_readw(uhci, USBINTR);
-        usbfrnum  = uhci_readw(uhci, 6);
+        usbfrnum  = uhci_readw(uhci, USBFRNUM);
-        flbaseadd = uhci_readl(uhci, 8);
+        flbaseadd = uhci_readl(uhci, USBFLBASEADD);
-        sof       = uhci_readb(uhci, 12);
+        sof       = uhci_readb(uhci, USBSOF);
-        portsc1   = uhci_readw(uhci, 16);
+        portsc1   = uhci_readw(uhci, USBPORTSC1);
-        portsc2   = uhci_readw(uhci, 18);
+        portsc2   = uhci_readw(uhci, USBPORTSC2);
        out += sprintf(out, "  usbcmd    =     %04x   %s%s%s%s%s%s%s%s\n",
                usbcmd,
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index 9189bc984c98..93e17b12fb33 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -75,8 +75,6 @@ static inline int get_hub_status_data(struct uhci_hcd *uhci, char *buf)
        return !!*buf;
 }
-#define OK(x)                   len = (x); break
 #define CLR_RH_PORTSTAT(x) \
        status = uhci_readw(uhci, port_addr);   \
        status &= ~(RWC_BITS|WZ_BITS); \
@@ -244,7 +242,7 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                        u16 wIndex, char *buf, u16 wLength)
 {
        struct uhci_hcd *uhci = hcd_to_uhci(hcd);
-        int status, lstatus, retval = 0, len = 0;
+        int status, lstatus, retval = 0;
        unsigned int port = wIndex - 1;
        unsigned long port_addr = USBPORTSC1 + 2 * port;
        u16 wPortChange, wPortStatus;
@@ -258,7 +256,8 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
        case GetHubStatus:
                *(__le32 *)buf = cpu_to_le32(0);
-                OK(4);          /* hub power */
+                retval = 4; /* hub power */
+                break;
        case GetPortStatus:
                if (port >= uhci->rh_numports)
                        goto err;
@@ -311,13 +310,14 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                *(__le16 *)buf = cpu_to_le16(wPortStatus);
                *(__le16 *)(buf + 2) = cpu_to_le16(wPortChange);
-                OK(4);
+                retval = 4;
+                break;
        case SetHubFeature:             /* We don't implement these */
        case ClearHubFeature:
                switch (wValue) {
                case C_HUB_OVER_CURRENT:
                case C_HUB_LOCAL_POWER:
-                        OK(0);
+                        break;
                default:
                        goto err;
                }
@@ -329,7 +329,7 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                switch (wValue) {
                case USB_PORT_FEAT_SUSPEND:
                        SET_RH_PORTSTAT(USBPORTSC_SUSP);
-                        OK(0);
+                        break;
                case USB_PORT_FEAT_RESET:
                        SET_RH_PORTSTAT(USBPORTSC_PR);
@@ -338,10 +338,10 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                        /* USB v2.0 7.1.7.5 */
                        uhci->ports_timeout = jiffies + msecs_to_jiffies(50);
-                        OK(0);
+                        break;
                case USB_PORT_FEAT_POWER:
                        /* UHCI has no power switching */
-                        OK(0);
+                        break;
                default:
                        goto err;
                }
@@ -356,10 +356,10 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                        /* Disable terminates Resume signalling */
                        uhci_finish_suspend(uhci, port, port_addr);
-                        OK(0);
+                        break;
                case USB_PORT_FEAT_C_ENABLE:
                        CLR_RH_PORTSTAT(USBPORTSC_PEC);
-                        OK(0);
+                        break;
                case USB_PORT_FEAT_SUSPEND:
                        if (!(uhci_readw(uhci, port_addr) & USBPORTSC_SUSP)) {
@@ -382,32 +382,32 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                        uhci->ports_timeout = jiffies +
                                                msecs_to_jiffies(20);
                        }
-                        OK(0);
+                        break;
                case USB_PORT_FEAT_C_SUSPEND:
                        clear_bit(port, &uhci->port_c_suspend);
-                        OK(0);
+                        break;
                case USB_PORT_FEAT_POWER:
                        /* UHCI has no power switching */
                        goto err;
                case USB_PORT_FEAT_C_CONNECTION:
                        CLR_RH_PORTSTAT(USBPORTSC_CSC);
-                        OK(0);
+                        break;
                case USB_PORT_FEAT_C_OVER_CURRENT:
                        CLR_RH_PORTSTAT(USBPORTSC_OCC);
-                        OK(0);
+                        break;
                case USB_PORT_FEAT_C_RESET:
                        /* this driver won't report these */
-                        OK(0);
+                        break;
                default:
                        goto err;
                }
                break;
        case GetHubDescriptor:
-                len = min_t(unsigned int, sizeof(root_hub_hub_des), wLength);
+                retval = min_t(unsigned int, sizeof(root_hub_hub_des), wLength);
-                memcpy(buf, root_hub_hub_des, len);
+                memcpy(buf, root_hub_hub_des, retval);
-                if (len > 2)
+                if (retval > 2)
                        buf[2] = uhci->rh_numports;
-                OK(len);
+                break;
        default:
 err:
                retval = -EPIPE;
diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c
index 0f228c46eeda..4cd79888804b 100644
--- a/drivers/usb/host/uhci-pci.c
+++ b/drivers/usb/host/uhci-pci.c
@@ -162,6 +162,8 @@ static void uhci_shutdown(struct pci_dev *pdev)
 #ifdef CONFIG_PM
+static int uhci_pci_resume(struct usb_hcd *hcd, bool hibernated);
 static int uhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
 {
        struct uhci_hcd *uhci = hcd_to_uhci(hcd);
@@ -174,12 +176,6 @@ static int uhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
        if (!HCD_HW_ACCESSIBLE(hcd) || uhci->dead)
                goto done_okay;         /* Already suspended or dead */
-        if (uhci->rh_state > UHCI_RH_SUSPENDED) {
-                dev_warn(uhci_dev(uhci), "Root hub isn't suspended!\n");
-                rc = -EBUSY;
-                goto done;
-        };
        /* All PCI host controllers are required to disable IRQ generation
         * at the source, so we must turn off PIRQ.
         */
@@ -195,8 +191,15 @@ static int uhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
 done_okay:
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
-done:
        spin_unlock_irq(&uhci->lock);
+        synchronize_irq(hcd->irq);
+        /* Check for race with a wakeup request */
+        if (do_wakeup && HCD_WAKEUP_PENDING(hcd)) {
+                uhci_pci_resume(hcd, false);
+                rc = -EBUSY;
+        }
        return rc;
 }
@@ -299,3 +302,5 @@ static struct pci_driver uhci_pci_driver = {
        },
 #endif
 };
+MODULE_SOFTDEP("pre: ehci_pci");
diff --git a/drivers/usb/host/uhci-platform.c b/drivers/usb/host/uhci-platform.c
index d033a0ec7f0d..ded842bc6578 100644
--- a/drivers/usb/host/uhci-platform.c
+++ b/drivers/usb/host/uhci-platform.c
@@ -105,8 +105,7 @@ static int uhci_hcd_platform_probe(struct platform_device *pdev)
        uhci->regs = hcd->regs;
-        ret = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_DISABLED |
+        ret = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_SHARED);
-                                                                IRQF_SHARED);
        if (ret)
                goto err_uhci;
diff --git a/drivers/usb/host/whci/hcd.c b/drivers/usb/host/whci/hcd.c
index ecc88db804e0..1b0888f8da9a 100644
--- a/drivers/usb/host/whci/hcd.c
+++ b/drivers/usb/host/whci/hcd.c
@@ -134,7 +134,7 @@ static int whc_urb_enqueue(struct usb_hcd *usb_hcd, struct urb *urb,
        default:
                ret = asl_urb_enqueue(whc, urb, mem_flags);
                break;
-        };
+        }
        return ret;
 }
@@ -160,7 +160,7 @@ static int whc_urb_dequeue(struct usb_hcd *usb_hcd, struct urb *urb, int status)
        default:
                ret = asl_urb_dequeue(whc, urb, status);
                break;
-        };
+        }
        return ret;
 }
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index e8b4c56dcf62..805f2348eeba 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -296,7 +296,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
        /* Wait for last stop endpoint command to finish */
        timeleft = wait_for_completion_interruptible_timeout(
                        cmd->completion,
-                        USB_CTRL_SET_TIMEOUT);
+                        XHCI_CMD_DEFAULT_TIMEOUT);
        if (timeleft <= 0) {
                xhci_warn(xhci, "%s while waiting for stop endpoint command\n",
                                timeleft == 0 ? "Timeout" : "Signal");
@@ -524,7 +524,8 @@ static void xhci_hub_report_usb3_link_state(u32 *status, u32 status_reg)
 * the compliance mode timer is deleted. A port won't enter
 * compliance mode if it has previously entered U0.
 */
-void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
+static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status,
+                                    u16 wIndex)
 {
        u32 all_ports_seen_u0 = ((1 << xhci->num_usb3_ports)-1);
        bool port_in_u0 = ((status & PORT_PLS_MASK) == XDEV_U0);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 83bcd13622c3..49b8bd063fab 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1693,9 +1693,7 @@ void xhci_free_command(struct xhci_hcd *xhci,
 void xhci_mem_cleanup(struct xhci_hcd *xhci)
 {
        struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
-        struct dev_info *dev_info, *next;
        struct xhci_cd  *cur_cd, *next_cd;
-        unsigned long   flags;
        int size;
        int i, j, num_ports;
@@ -1756,13 +1754,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
        scratchpad_free(xhci);
-        spin_lock_irqsave(&xhci->lock, flags);
-        list_for_each_entry_safe(dev_info, next, &xhci->lpm_failed_devs, list) {
-                list_del(&dev_info->list);
-                kfree(dev_info);
-        }
-        spin_unlock_irqrestore(&xhci->lock, flags);
        if (!xhci->rh_bw)
                goto no_bw;
@@ -2231,7 +2222,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
        u32 page_size, temp;
        int i;
-        INIT_LIST_HEAD(&xhci->lpm_failed_devs);
        INIT_LIST_HEAD(&xhci->cancel_cmd_list);
        page_size = xhci_readl(xhci, &xhci->op_regs->page_size);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6bfbd80ec2b9..1e2f3f495843 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -178,7 +178,7 @@ static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring)
                        if (ring->type == TYPE_EVENT &&
                                        last_trb_on_last_seg(xhci, ring,
                                                ring->deq_seg, ring->dequeue)) {
-                                ring->cycle_state = (ring->cycle_state ? 0 : 1);
+                                ring->cycle_state ^= 1;
                        }
                        ring->deq_seg = ring->deq_seg->next;
                        ring->dequeue = ring->deq_seg->trbs;
@@ -726,7 +726,7 @@ static void xhci_stop_watchdog_timer_in_irq(struct xhci_hcd *xhci,
 /* Must be called with xhci->lock held in interrupt context */
 static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
-                struct xhci_td *cur_td, int status, char *adjective)
+                struct xhci_td *cur_td, int status)
 {
        struct usb_hcd *hcd;
        struct urb      *urb;
@@ -765,10 +765,9 @@ static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
 *  2. Otherwise, we turn all the TRBs in the TD into No-op TRBs (with the chain
 *     bit cleared) so that the HW will skip over them.
 */
-static void handle_stopped_endpoint(struct xhci_hcd *xhci,
+static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
                union xhci_trb *trb, struct xhci_event_cmd *event)
 {
-        unsigned int slot_id;
        unsigned int ep_index;
        struct xhci_virt_device *virt_dev;
        struct xhci_ring *ep_ring;
@@ -779,10 +778,7 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
        struct xhci_dequeue_state deq_state;
-        if (unlikely(TRB_TO_SUSPEND_PORT(
+        if (unlikely(TRB_TO_SUSPEND_PORT(le32_to_cpu(trb->generic.field[3])))) {
-                             le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])))) {
-                slot_id = TRB_TO_SLOT_ID(
-                        le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3]));
                virt_dev = xhci->devs[slot_id];
                if (virt_dev)
                        handle_cmd_in_cmd_wait_list(xhci, virt_dev,
@@ -795,7 +791,6 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
        }
        memset(&deq_state, 0, sizeof(deq_state));
-        slot_id = TRB_TO_SLOT_ID(le32_to_cpu(trb->generic.field[3]));
        ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
        ep = &xhci->devs[slot_id]->eps[ep_index];
@@ -891,7 +886,7 @@ remove_finished_td:
                /* Doesn't matter what we pass for status, since the core will
                 * just overwrite it (because the URB has been unlinked).
                 */
-                xhci_giveback_urb_in_irq(xhci, cur_td, 0, "cancelled");
+                xhci_giveback_urb_in_irq(xhci, cur_td, 0);
                /* Stop processing the cancelled list if the watchdog timer is
                 * running.
@@ -1001,7 +996,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
                                if (!list_empty(&cur_td->cancelled_td_list))
                                        list_del_init(&cur_td->cancelled_td_list);
                                xhci_giveback_urb_in_irq(xhci, cur_td,
-                                                -ESHUTDOWN, "killed");
+                                                -ESHUTDOWN);
                        }
                        while (!list_empty(&temp_ep->cancelled_td_list)) {
                                cur_td = list_first_entry(
@@ -1010,7 +1005,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
                                                cancelled_td_list);
                                list_del_init(&cur_td->cancelled_td_list);
                                xhci_giveback_urb_in_irq(xhci, cur_td,
-                                                -ESHUTDOWN, "killed");
+                                                -ESHUTDOWN);
                        }
                }
        }
@@ -1077,11 +1072,9 @@ static void update_ring_for_set_deq_completion(struct xhci_hcd *xhci,
 * endpoint doorbell to restart the ring, but only if there aren't more
 * cancellations pending.
 */
-static void handle_set_deq_completion(struct xhci_hcd *xhci,
+static void xhci_handle_cmd_set_deq(struct xhci_hcd *xhci, int slot_id,
-                struct xhci_event_cmd *event,
+                union xhci_trb *trb, u32 cmd_comp_code)
-                union xhci_trb *trb)
 {
-        unsigned int slot_id;
        unsigned int ep_index;
        unsigned int stream_id;
        struct xhci_ring *ep_ring;
@@ -1089,7 +1082,6 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
        struct xhci_ep_ctx *ep_ctx;
        struct xhci_slot_ctx *slot_ctx;
-        slot_id = TRB_TO_SLOT_ID(le32_to_cpu(trb->generic.field[3]));
        ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
        stream_id = TRB_TO_STREAM_ID(le32_to_cpu(trb->generic.field[2]));
        dev = xhci->devs[slot_id];
@@ -1107,11 +1099,11 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
        ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
        slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx);
-        if (GET_COMP_CODE(le32_to_cpu(event->status)) != COMP_SUCCESS) {
+        if (cmd_comp_code != COMP_SUCCESS) {
                unsigned int ep_state;
                unsigned int slot_state;
-                switch (GET_COMP_CODE(le32_to_cpu(event->status))) {
+                switch (cmd_comp_code) {
                case COMP_TRB_ERR:
                        xhci_warn(xhci, "WARN Set TR Deq Ptr cmd invalid because "
                                        "of stream ID configuration\n");
@@ -1134,7 +1126,7 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
                default:
                        xhci_warn(xhci, "WARN Set TR Deq Ptr cmd with unknown "
                                        "completion code of %u.\n",
-                                  GET_COMP_CODE(le32_to_cpu(event->status)));
+                                  cmd_comp_code);
                        break;
                }
                /* OK what do we do now?  The endpoint state is hosed, and we
@@ -1171,21 +1163,17 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
        ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
 }
-static void handle_reset_ep_completion(struct xhci_hcd *xhci,
+static void xhci_handle_cmd_reset_ep(struct xhci_hcd *xhci, int slot_id,
-                struct xhci_event_cmd *event,
+                union xhci_trb *trb, u32 cmd_comp_code)
-                union xhci_trb *trb)
 {
-        int slot_id;
        unsigned int ep_index;
-        slot_id = TRB_TO_SLOT_ID(le32_to_cpu(trb->generic.field[3]));
        ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
        /* This command will only fail if the endpoint wasn't halted,
         * but we don't care.
         */
        xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
-                "Ignoring reset ep completion code of %u",
+                "Ignoring reset ep completion code of %u", cmd_comp_code);
-                 GET_COMP_CODE(le32_to_cpu(event->status)));
        /* HW with the reset endpoint quirk needs to have a configure endpoint
         * command complete before the endpoint can be used.  Queue that here
@@ -1386,21 +1374,149 @@ static int handle_stopped_cmd_ring(struct xhci_hcd *xhci,
        return cur_trb_is_good;
 }
+static void xhci_handle_cmd_enable_slot(struct xhci_hcd *xhci, int slot_id,
+                u32 cmd_comp_code)
+{
+        if (cmd_comp_code == COMP_SUCCESS)
+                xhci->slot_id = slot_id;
+        else
+                xhci->slot_id = 0;
+        complete(&xhci->addr_dev);
+}
+static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id)
+{
+        struct xhci_virt_device *virt_dev;
+        virt_dev = xhci->devs[slot_id];
+        if (!virt_dev)
+                return;
+        if (xhci->quirks & XHCI_EP_LIMIT_QUIRK)
+                /* Delete default control endpoint resources */
+                xhci_free_device_endpoint_resources(xhci, virt_dev, true);
+        xhci_free_virt_device(xhci, slot_id);
+}
+static void xhci_handle_cmd_config_ep(struct xhci_hcd *xhci, int slot_id,
+                struct xhci_event_cmd *event, u32 cmd_comp_code)
+{
+        struct xhci_virt_device *virt_dev;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        unsigned int ep_index;
+        unsigned int ep_state;
+        u32 add_flags, drop_flags;
+        virt_dev = xhci->devs[slot_id];
+        if (handle_cmd_in_cmd_wait_list(xhci, virt_dev, event))
+                return;
+        /*
+         * Configure endpoint commands can come from the USB core
+         * configuration or alt setting changes, or because the HW
+         * needed an extra configure endpoint command after a reset
+         * endpoint command or streams were being configured.
+         * If the command was for a halted endpoint, the xHCI driver
+         * is not waiting on the configure endpoint command.
+         */
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, virt_dev->in_ctx);
+        if (!ctrl_ctx) {
+                xhci_warn(xhci, "Could not get input context, bad type.\n");
+                return;
+        }
+        add_flags = le32_to_cpu(ctrl_ctx->add_flags);
+        drop_flags = le32_to_cpu(ctrl_ctx->drop_flags);
+        /* Input ctx add_flags are the endpoint index plus one */
+        ep_index = xhci_last_valid_endpoint(add_flags) - 1;
+        /* A usb_set_interface() call directly after clearing a halted
+         * condition may race on this quirky hardware.  Not worth
+         * worrying about, since this is prototype hardware.  Not sure
+         * if this will work for streams, but streams support was
+         * untested on this prototype.
+         */
+        if (xhci->quirks & XHCI_RESET_EP_QUIRK &&
+                        ep_index != (unsigned int) -1 &&
+                        add_flags - SLOT_FLAG == drop_flags) {
+                ep_state = virt_dev->eps[ep_index].ep_state;
+                if (!(ep_state & EP_HALTED))
+                        goto bandwidth_change;
+                xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+                                "Completed config ep cmd - "
+                                "last ep index = %d, state = %d",
+                                ep_index, ep_state);
+                /* Clear internal halted state and restart ring(s) */
+                virt_dev->eps[ep_index].ep_state &= ~EP_HALTED;
+                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+                return;
+        }
+bandwidth_change:
+        xhci_dbg_trace(xhci,  trace_xhci_dbg_context_change,
+                        "Completed config ep cmd");
+        virt_dev->cmd_status = cmd_comp_code;
+        complete(&virt_dev->cmd_completion);
+        return;
+}
+static void xhci_handle_cmd_eval_ctx(struct xhci_hcd *xhci, int slot_id,
+                struct xhci_event_cmd *event, u32 cmd_comp_code)
+{
+        struct xhci_virt_device *virt_dev;
+        virt_dev = xhci->devs[slot_id];
+        if (handle_cmd_in_cmd_wait_list(xhci, virt_dev, event))
+                return;
+        virt_dev->cmd_status = cmd_comp_code;
+        complete(&virt_dev->cmd_completion);
+}
+static void xhci_handle_cmd_addr_dev(struct xhci_hcd *xhci, int slot_id,
+                u32 cmd_comp_code)
+{
+        xhci->devs[slot_id]->cmd_status = cmd_comp_code;
+        complete(&xhci->addr_dev);
+}
+static void xhci_handle_cmd_reset_dev(struct xhci_hcd *xhci, int slot_id,
+                struct xhci_event_cmd *event)
+{
+        struct xhci_virt_device *virt_dev;
+        xhci_dbg(xhci, "Completed reset device command.\n");
+        virt_dev = xhci->devs[slot_id];
+        if (virt_dev)
+                handle_cmd_in_cmd_wait_list(xhci, virt_dev, event);
+        else
+                xhci_warn(xhci, "Reset device command completion "
+                                "for disabled slot %u\n", slot_id);
+}
+static void xhci_handle_cmd_nec_get_fw(struct xhci_hcd *xhci,
+                struct xhci_event_cmd *event)
+{
+        if (!(xhci->quirks & XHCI_NEC_HOST)) {
+                xhci->error_bitmask |= 1 << 6;
+                return;
+        }
+        xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+                        "NEC firmware version %2x.%02x",
+                        NEC_FW_MAJOR(le32_to_cpu(event->status)),
+                        NEC_FW_MINOR(le32_to_cpu(event->status)));
+}
 static void handle_cmd_completion(struct xhci_hcd *xhci,
                struct xhci_event_cmd *event)
 {
        int slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
        u64 cmd_dma;
        dma_addr_t cmd_dequeue_dma;
-        struct xhci_input_control_ctx *ctrl_ctx;
+        u32 cmd_comp_code;
-        struct xhci_virt_device *virt_dev;
+        union xhci_trb *cmd_trb;
-        unsigned int ep_index;
+        u32 cmd_type;
-        struct xhci_ring *ep_ring;
-        unsigned int ep_state;
        cmd_dma = le64_to_cpu(event->cmd_trb);
+        cmd_trb = xhci->cmd_ring->dequeue;
        cmd_dequeue_dma = xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
-                        xhci->cmd_ring->dequeue);
+                        cmd_trb);
        /* Is the command ring deq ptr out of sync with the deq seg ptr? */
        if (cmd_dequeue_dma == 0) {
                xhci->error_bitmask |= 1 << 4;
@@ -1412,19 +1528,17 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                return;
        }
-        trace_xhci_cmd_completion(&xhci->cmd_ring->dequeue->generic,
+        trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
-                                        (struct xhci_generic_trb *) event);
-        if ((GET_COMP_CODE(le32_to_cpu(event->status)) == COMP_CMD_ABORT) ||
+        cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
-                (GET_COMP_CODE(le32_to_cpu(event->status)) == COMP_CMD_STOP)) {
+        if (cmd_comp_code == COMP_CMD_ABORT || cmd_comp_code == COMP_CMD_STOP) {
                /* If the return value is 0, we think the trb pointed by
                 * command ring dequeue pointer is a good trb. The good
                 * trb means we don't want to cancel the trb, but it have
                 * been stopped by host. So we should handle it normally.
                 * Otherwise, driver should invoke inc_deq() and return.
                 */
-                if (handle_stopped_cmd_ring(xhci,
+                if (handle_stopped_cmd_ring(xhci, cmd_comp_code)) {
-                                GET_COMP_CODE(le32_to_cpu(event->status)))) {
                        inc_deq(xhci, xhci->cmd_ring);
                        return;
                }
@@ -1436,117 +1550,47 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                        return;
        }
-        switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
+        cmd_type = TRB_FIELD_TO_TYPE(le32_to_cpu(cmd_trb->generic.field[3]));
-                & TRB_TYPE_BITMASK) {
+        switch (cmd_type) {
-        case TRB_TYPE(TRB_ENABLE_SLOT):
+        case TRB_ENABLE_SLOT:
-                if (GET_COMP_CODE(le32_to_cpu(event->status)) == COMP_SUCCESS)
+                xhci_handle_cmd_enable_slot(xhci, slot_id, cmd_comp_code);
-                        xhci->slot_id = slot_id;
-                else
-                        xhci->slot_id = 0;
-                complete(&xhci->addr_dev);
                break;
-        case TRB_TYPE(TRB_DISABLE_SLOT):
+        case TRB_DISABLE_SLOT:
-                if (xhci->devs[slot_id]) {
+                xhci_handle_cmd_disable_slot(xhci, slot_id);
-                        if (xhci->quirks & XHCI_EP_LIMIT_QUIRK)
-                                /* Delete default control endpoint resources */
-                                xhci_free_device_endpoint_resources(xhci,
-                                                xhci->devs[slot_id], true);
-                        xhci_free_virt_device(xhci, slot_id);
-                }
                break;
-        case TRB_TYPE(TRB_CONFIG_EP):
+        case TRB_CONFIG_EP:
-                virt_dev = xhci->devs[slot_id];
+                xhci_handle_cmd_config_ep(xhci, slot_id, event, cmd_comp_code);
-                if (handle_cmd_in_cmd_wait_list(xhci, virt_dev, event))
-                        break;
-                /*
-                 * Configure endpoint commands can come from the USB core
-                 * configuration or alt setting changes, or because the HW
-                 * needed an extra configure endpoint command after a reset
-                 * endpoint command or streams were being configured.
-                 * If the command was for a halted endpoint, the xHCI driver
-                 * is not waiting on the configure endpoint command.
-                 */
-                ctrl_ctx = xhci_get_input_control_ctx(xhci,
-                                virt_dev->in_ctx);
-                if (!ctrl_ctx) {
-                        xhci_warn(xhci, "Could not get input context, bad type.\n");
-                        break;
-                }
-                /* Input ctx add_flags are the endpoint index plus one */
-                ep_index = xhci_last_valid_endpoint(le32_to_cpu(ctrl_ctx->add_flags)) - 1;
-                /* A usb_set_interface() call directly after clearing a halted
-                 * condition may race on this quirky hardware.  Not worth
-                 * worrying about, since this is prototype hardware.  Not sure
-                 * if this will work for streams, but streams support was
-                 * untested on this prototype.
-                 */
-                if (xhci->quirks & XHCI_RESET_EP_QUIRK &&
-                                ep_index != (unsigned int) -1 &&
-                    le32_to_cpu(ctrl_ctx->add_flags) - SLOT_FLAG ==
-                    le32_to_cpu(ctrl_ctx->drop_flags)) {
-                        ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
-                        ep_state = xhci->devs[slot_id]->eps[ep_index].ep_state;
-                        if (!(ep_state & EP_HALTED))
-                                goto bandwidth_change;
-                        xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
-                                        "Completed config ep cmd - "
-                                        "last ep index = %d, state = %d",
-                                        ep_index, ep_state);
-                        /* Clear internal halted state and restart ring(s) */
-                        xhci->devs[slot_id]->eps[ep_index].ep_state &=
-                                ~EP_HALTED;
-                        ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
-                        break;
-                }
-bandwidth_change:
-                xhci_dbg_trace(xhci,  trace_xhci_dbg_context_change,
-                                "Completed config ep cmd");
-                xhci->devs[slot_id]->cmd_status =
-                        GET_COMP_CODE(le32_to_cpu(event->status));
-                complete(&xhci->devs[slot_id]->cmd_completion);
                break;
-        case TRB_TYPE(TRB_EVAL_CONTEXT):
+        case TRB_EVAL_CONTEXT:
-                virt_dev = xhci->devs[slot_id];
+                xhci_handle_cmd_eval_ctx(xhci, slot_id, event, cmd_comp_code);
-                if (handle_cmd_in_cmd_wait_list(xhci, virt_dev, event))
-                        break;
-                xhci->devs[slot_id]->cmd_status = GET_COMP_CODE(le32_to_cpu(event->status));
-                complete(&xhci->devs[slot_id]->cmd_completion);
                break;
-        case TRB_TYPE(TRB_ADDR_DEV):
+        case TRB_ADDR_DEV:
-                xhci->devs[slot_id]->cmd_status = GET_COMP_CODE(le32_to_cpu(event->status));
+                xhci_handle_cmd_addr_dev(xhci, slot_id, cmd_comp_code);
-                complete(&xhci->addr_dev);
                break;
-        case TRB_TYPE(TRB_STOP_RING):
+        case TRB_STOP_RING:
-                handle_stopped_endpoint(xhci, xhci->cmd_ring->dequeue, event);
+                WARN_ON(slot_id != TRB_TO_SLOT_ID(
+                                le32_to_cpu(cmd_trb->generic.field[3])));
+                xhci_handle_cmd_stop_ep(xhci, slot_id, cmd_trb, event);
                break;
-        case TRB_TYPE(TRB_SET_DEQ):
+        case TRB_SET_DEQ:
-                handle_set_deq_completion(xhci, event, xhci->cmd_ring->dequeue);
+                WARN_ON(slot_id != TRB_TO_SLOT_ID(
+                                le32_to_cpu(cmd_trb->generic.field[3])));
+                xhci_handle_cmd_set_deq(xhci, slot_id, cmd_trb, cmd_comp_code);
                break;
-        case TRB_TYPE(TRB_CMD_NOOP):
+        case TRB_CMD_NOOP:
                break;
-        case TRB_TYPE(TRB_RESET_EP):
+        case TRB_RESET_EP:
-                handle_reset_ep_completion(xhci, event, xhci->cmd_ring->dequeue);
+                WARN_ON(slot_id != TRB_TO_SLOT_ID(
+                                le32_to_cpu(cmd_trb->generic.field[3])));
+                xhci_handle_cmd_reset_ep(xhci, slot_id, cmd_trb, cmd_comp_code);
                break;
-        case TRB_TYPE(TRB_RESET_DEV):
+        case TRB_RESET_DEV:
-                xhci_dbg(xhci, "Completed reset device command.\n");
+                WARN_ON(slot_id != TRB_TO_SLOT_ID(
-                slot_id = TRB_TO_SLOT_ID(
+                                le32_to_cpu(cmd_trb->generic.field[3])));
-                        le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3]));
+                xhci_handle_cmd_reset_dev(xhci, slot_id, event);
-                virt_dev = xhci->devs[slot_id];
-                if (virt_dev)
-                        handle_cmd_in_cmd_wait_list(xhci, virt_dev, event);
-                else
-                        xhci_warn(xhci, "Reset device command completion "
-                                        "for disabled slot %u\n", slot_id);
                break;
-        case TRB_TYPE(TRB_NEC_GET_FW):
+        case TRB_NEC_GET_FW:
-                if (!(xhci->quirks & XHCI_NEC_HOST)) {
+                xhci_handle_cmd_nec_get_fw(xhci, event);
-                        xhci->error_bitmask |= 1 << 6;
-                        break;
-                }
-                xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
-                        "NEC firmware version %2x.%02x",
-                         NEC_FW_MAJOR(le32_to_cpu(event->status)),
-                         NEC_FW_MINOR(le32_to_cpu(event->status)));
                break;
        default:
                /* Skip over unknown commands on the event ring */
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6e0d886bcce5..4265b48856f6 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3459,7 +3459,7 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
        /* Wait for the Reset Device command to finish */
        timeleft = wait_for_completion_interruptible_timeout(
                        reset_device_cmd->completion,
-                        USB_CTRL_SET_TIMEOUT);
+                        XHCI_CMD_DEFAULT_TIMEOUT);
        if (timeleft <= 0) {
                xhci_warn(xhci, "%s while waiting for reset device command\n",
                                timeleft == 0 ? "Timeout" : "Signal");
@@ -3583,11 +3583,6 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
                del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
        }
-        if (udev->usb2_hw_lpm_enabled) {
-                xhci_set_usb2_hardware_lpm(hcd, udev, 0);
-                udev->usb2_hw_lpm_enabled = 0;
-        }
        spin_lock_irqsave(&xhci->lock, flags);
        /* Don't disable the slot if the host controller is dead. */
        state = xhci_readl(xhci, &xhci->op_regs->status);
@@ -3721,9 +3716,6 @@ disable_slot:
 * the device).
 * We should be protected by the usb_address0_mutex in khubd's hub_port_init, so
 * we should only issue and wait on one address command at the same time.
- *
- * We add one to the device address issued by the hardware because the USB core
- * uses address 1 for the root hubs (even though they're not really devices).
 */
 int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
 {
@@ -3868,16 +3860,13 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
        slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
        trace_xhci_address_ctx(xhci, virt_dev->out_ctx,
                                slot_ctx->dev_info >> 27);
-        /* Use kernel assigned address for devices; store xHC assigned
-         * address locally. */
-        virt_dev->address = (le32_to_cpu(slot_ctx->dev_state) & DEV_ADDR_MASK)
-                + 1;
        /* Zero the input context control for later use */
        ctrl_ctx->add_flags = 0;
        ctrl_ctx->drop_flags = 0;
        xhci_dbg_trace(xhci, trace_xhci_dbg_address,
-                        "Internal device address = %d", virt_dev->address);
+                       "Internal device address = %d",
+                       le32_to_cpu(slot_ctx->dev_state) & DEV_ADDR_MASK);
        return 0;
 }
@@ -4025,133 +4014,6 @@ static int xhci_calculate_usb2_hw_lpm_params(struct usb_device *udev)
        return PORT_BESLD(besld) | PORT_L1_TIMEOUT(l1) | PORT_HIRDM(hirdm);
 }
-static int xhci_usb2_software_lpm_test(struct usb_hcd *hcd,
-                                        struct usb_device *udev)
-{
-        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-        struct dev_info *dev_info;
-        __le32 __iomem  **port_array;
-        __le32 __iomem  *addr, *pm_addr;
-        u32             temp, dev_id;
-        unsigned int    port_num;
-        unsigned long   flags;
-        int             hird;
-        int             ret;
-        if (hcd->speed == HCD_USB3 || !xhci->sw_lpm_support ||
-                        !udev->lpm_capable)
-                return -EINVAL;
-        /* we only support lpm for non-hub device connected to root hub yet */
-        if (!udev->parent || udev->parent->parent ||
-                        udev->descriptor.bDeviceClass == USB_CLASS_HUB)
-                return -EINVAL;
-        spin_lock_irqsave(&xhci->lock, flags);
-        /* Look for devices in lpm_failed_devs list */
-        dev_id = le16_to_cpu(udev->descriptor.idVendor) << 16 |
-                        le16_to_cpu(udev->descriptor.idProduct);
-        list_for_each_entry(dev_info, &xhci->lpm_failed_devs, list) {
-                if (dev_info->dev_id == dev_id) {
-                        ret = -EINVAL;
-                        goto finish;
-                }
-        }
-        port_array = xhci->usb2_ports;
-        port_num = udev->portnum - 1;
-        if (port_num > HCS_MAX_PORTS(xhci->hcs_params1)) {
-                xhci_dbg(xhci, "invalid port number %d\n", udev->portnum);
-                ret = -EINVAL;
-                goto finish;
-        }
-        /*
-         * Test USB 2.0 software LPM.
-         * FIXME: some xHCI 1.0 hosts may implement a new register to set up
-         * hardware-controlled USB 2.0 LPM. See section 5.4.11 and 4.23.5.1.1.1
-         * in the June 2011 errata release.
-         */
-        xhci_dbg(xhci, "test port %d software LPM\n", port_num);
-        /*
-         * Set L1 Device Slot and HIRD/BESL.
-         * Check device's USB 2.0 extension descriptor to determine whether
-         * HIRD or BESL shoule be used. See USB2.0 LPM errata.
-         */
-        pm_addr = port_array[port_num] + PORTPMSC;
-        hird = xhci_calculate_hird_besl(xhci, udev);
-        temp = PORT_L1DS(udev->slot_id) | PORT_HIRD(hird);
-        xhci_writel(xhci, temp, pm_addr);
-        /* Set port link state to U2(L1) */
-        addr = port_array[port_num];
-        xhci_set_link_state(xhci, port_array, port_num, XDEV_U2);
-        /* wait for ACK */
-        spin_unlock_irqrestore(&xhci->lock, flags);
-        msleep(10);
-        spin_lock_irqsave(&xhci->lock, flags);
-        /* Check L1 Status */
-        ret = xhci_handshake(xhci, pm_addr,
-                        PORT_L1S_MASK, PORT_L1S_SUCCESS, 125);
-        if (ret != -ETIMEDOUT) {
-                /* enter L1 successfully */
-                temp = xhci_readl(xhci, addr);
-                xhci_dbg(xhci, "port %d entered L1 state, port status 0x%x\n",
-                                port_num, temp);
-                ret = 0;
-        } else {
-                temp = xhci_readl(xhci, pm_addr);
-                xhci_dbg(xhci, "port %d software lpm failed, L1 status %d\n",
-                                port_num, temp & PORT_L1S_MASK);
-                ret = -EINVAL;
-        }
-        /* Resume the port */
-        xhci_set_link_state(xhci, port_array, port_num, XDEV_U0);
-        spin_unlock_irqrestore(&xhci->lock, flags);
-        msleep(10);
-        spin_lock_irqsave(&xhci->lock, flags);
-        /* Clear PLC */
-        xhci_test_and_clear_bit(xhci, port_array, port_num, PORT_PLC);
-        /* Check PORTSC to make sure the device is in the right state */
-        if (!ret) {
-                temp = xhci_readl(xhci, addr);
-                xhci_dbg(xhci, "resumed port %d status 0x%x\n", port_num, temp);
-                if (!(temp & PORT_CONNECT) || !(temp & PORT_PE) ||
-                                (temp & PORT_PLS_MASK) != XDEV_U0) {
-                        xhci_dbg(xhci, "port L1 resume fail\n");
-                        ret = -EINVAL;
-                }
-        }
-        if (ret) {
-                /* Insert dev to lpm_failed_devs list */
-                xhci_warn(xhci, "device LPM test failed, may disconnect and "
-                                "re-enumerate\n");
-                dev_info = kzalloc(sizeof(struct dev_info), GFP_ATOMIC);
-                if (!dev_info) {
-                        ret = -ENOMEM;
-                        goto finish;
-                }
-                dev_info->dev_id = dev_id;
-                INIT_LIST_HEAD(&dev_info->list);
-                list_add(&dev_info->list, &xhci->lpm_failed_devs);
-        } else {
-                xhci_ring_device(xhci, udev->slot_id);
-        }
-finish:
-        spin_unlock_irqrestore(&xhci->lock, flags);
-        return ret;
-}
 int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
                        struct usb_device *udev, int enable)
 {
@@ -4228,7 +4090,7 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
                }
                pm_val &= ~PORT_HIRD_MASK;
-                pm_val |= PORT_HIRD(hird) | PORT_RWE;
+                pm_val |= PORT_HIRD(hird) | PORT_RWE | PORT_L1DS(udev->slot_id);
                xhci_writel(xhci, pm_val, pm_addr);
                pm_val = xhci_readl(xhci, pm_addr);
                pm_val |= PORT_HLE;
@@ -4236,7 +4098,7 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
                /* flush write */
                xhci_readl(xhci, pm_addr);
        } else {
-                pm_val &= ~(PORT_HLE | PORT_RWE | PORT_HIRD_MASK);
+                pm_val &= ~(PORT_HLE | PORT_RWE | PORT_HIRD_MASK | PORT_L1DS_MASK);
                xhci_writel(xhci, pm_val, pm_addr);
                /* flush write */
                xhci_readl(xhci, pm_addr);
@@ -4279,24 +4141,26 @@ static int xhci_check_usb2_port_capability(struct xhci_hcd *xhci, int port,
 int xhci_update_device(struct usb_hcd *hcd, struct usb_device *udev)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-        int             ret;
        int             portnum = udev->portnum - 1;
-        ret = xhci_usb2_software_lpm_test(hcd, udev);
+        if (hcd->speed == HCD_USB3 || !xhci->sw_lpm_support ||
-        if (!ret) {
+                        !udev->lpm_capable)
-                xhci_dbg(xhci, "software LPM test succeed\n");
+                return 0;
-                if (xhci->hw_lpm_support == 1 &&
-                    xhci_check_usb2_port_capability(xhci, portnum, XHCI_HLC)) {
+        /* we only support lpm for non-hub device connected to root hub yet */
-                        udev->usb2_hw_lpm_capable = 1;
+        if (!udev->parent || udev->parent->parent ||
-                        udev->l1_params.timeout = XHCI_L1_TIMEOUT;
+                        udev->descriptor.bDeviceClass == USB_CLASS_HUB)
-                        udev->l1_params.besl = XHCI_DEFAULT_BESL;
+                return 0;
-                        if (xhci_check_usb2_port_capability(xhci, portnum,
-                                                            XHCI_BLC))
+        if (xhci->hw_lpm_support == 1 &&
-                                udev->usb2_hw_lpm_besl_capable = 1;
+                        xhci_check_usb2_port_capability(
-                        ret = xhci_set_usb2_hardware_lpm(hcd, udev, 1);
+                                xhci, portnum, XHCI_HLC)) {
-                        if (!ret)
+                udev->usb2_hw_lpm_capable = 1;
-                                udev->usb2_hw_lpm_enabled = 1;
+                udev->l1_params.timeout = XHCI_L1_TIMEOUT;
-                }
+                udev->l1_params.besl = XHCI_DEFAULT_BESL;
+                if (xhci_check_usb2_port_capability(xhci, portnum,
+                                        XHCI_BLC))
+                        udev->usb2_hw_lpm_besl_capable = 1;
        }
        return 0;
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 941d5f59e4dc..03c74b7965f8 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -383,6 +383,7 @@ struct xhci_op_regs {
 #define PORT_RWE                (1 << 3)
 #define PORT_HIRD(p)            (((p) & 0xf) << 4)
 #define PORT_HIRD_MASK          (0xf << 4)
+#define PORT_L1DS_MASK          (0xff << 8)
 #define PORT_L1DS(p)            (((p) & 0xff) << 8)
 #define PORT_HLE                (1 << 16)
@@ -934,8 +935,6 @@ struct xhci_virt_device {
        /* Rings saved to ensure old alt settings can be re-instated */
        struct xhci_ring                **ring_cache;
        int                             num_rings_cached;
-        /* Store xHC assigned device address */
-        int                             address;
 #define XHCI_MAX_RINGS_CACHED   31
        struct xhci_virt_ep             eps[31];
        struct completion               cmd_completion;
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index aa28ac8c7607..b4152820d655 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -120,7 +120,7 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
                        struct usb_host_endpoint        *e;
                        e = alt->endpoint + ep;
-                        switch (e->desc.bmAttributes) {
+                        switch (usb_endpoint_type(&e->desc)) {
                        case USB_ENDPOINT_XFER_BULK:
                                break;
                        case USB_ENDPOINT_XFER_ISOC:
@@ -437,7 +437,7 @@ alloc_sglist(int nents, int max, int vary)
        if (max == 0)
                return NULL;
-        sg = kmalloc_array(nents, sizeof *sg, GFP_KERNEL);
+        sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
        if (!sg)
                return NULL;
        sg_init_table(sg, nents);
@@ -573,7 +573,7 @@ static int is_good_config(struct usbtest_dev *tdev, int len)
 {
        struct usb_config_descriptor    *config;
-        if (len < sizeof *config)
+        if (len < sizeof(*config))
                return 0;
        config = (struct usb_config_descriptor *) tdev->buf;
@@ -606,6 +606,76 @@ static int is_good_config(struct usbtest_dev *tdev, int len)
        return 0;
 }
+static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
+{
+        struct usb_ext_cap_descriptor *ext;
+        u32 attr;
+        ext = (struct usb_ext_cap_descriptor *) buf;
+        if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
+                ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
+                return 0;
+        }
+        attr = le32_to_cpu(ext->bmAttributes);
+        /* bits[1:4] is used and others are reserved */
+        if (attr & ~0x1e) {     /* reserved == 0 */
+                ERROR(tdev, "reserved bits set\n");
+                return 0;
+        }
+        return 1;
+}
+static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
+{
+        struct usb_ss_cap_descriptor *ss;
+        ss = (struct usb_ss_cap_descriptor *) buf;
+        if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
+                ERROR(tdev, "bogus superspeed device capability descriptor length\n");
+                return 0;
+        }
+        /*
+         * only bit[1] of bmAttributes is used for LTM and others are
+         * reserved
+         */
+        if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
+                ERROR(tdev, "reserved bits set in bmAttributes\n");
+                return 0;
+        }
+        /* bits[0:3] of wSpeedSupported is used and others are reserved */
+        if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
+                ERROR(tdev, "reserved bits set in wSpeedSupported\n");
+                return 0;
+        }
+        return 1;
+}
+static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
+{
+        struct usb_ss_container_id_descriptor *con_id;
+        con_id = (struct usb_ss_container_id_descriptor *) buf;
+        if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
+                ERROR(tdev, "bogus container id descriptor length\n");
+                return 0;
+        }
+        if (con_id->bReserved) {        /* reserved == 0 */
+                ERROR(tdev, "reserved bits set\n");
+                return 0;
+        }
+        return 1;
+}
 /* sanity test for standard requests working with usb_control_mesg() and some
 * of the utility functions which use it.
 *
@@ -683,12 +753,96 @@ static int ch9_postconfig(struct usbtest_dev *dev)
        /* there's always [9.4.3] a device descriptor [9.6.1] */
        retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
-                        dev->buf, sizeof udev->descriptor);
+                        dev->buf, sizeof(udev->descriptor));
-        if (retval != sizeof udev->descriptor) {
+        if (retval != sizeof(udev->descriptor)) {
                dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
                return (retval < 0) ? retval : -EDOM;
        }
+        /*
+         * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
+         * 3.0 spec
+         */
+        if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0300) {
+                struct usb_bos_descriptor *bos = NULL;
+                struct usb_dev_cap_header *header = NULL;
+                unsigned total, num, length;
+                u8 *buf;
+                retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
+                                sizeof(*udev->bos->desc));
+                if (retval != sizeof(*udev->bos->desc)) {
+                        dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
+                        return (retval < 0) ? retval : -EDOM;
+                }
+                bos = (struct usb_bos_descriptor *)dev->buf;
+                total = le16_to_cpu(bos->wTotalLength);
+                num = bos->bNumDeviceCaps;
+                if (total > TBUF_SIZE)
+                        total = TBUF_SIZE;
+                /*
+                 * get generic device-level capability descriptors [9.6.2]
+                 * in USB 3.0 spec
+                 */
+                retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
+                                total);
+                if (retval != total) {
+                        dev_err(&iface->dev, "bos descriptor set --> %d\n",
+                                        retval);
+                        return (retval < 0) ? retval : -EDOM;
+                }
+                length = sizeof(*udev->bos->desc);
+                buf = dev->buf;
+                for (i = 0; i < num; i++) {
+                        buf += length;
+                        if (buf + sizeof(struct usb_dev_cap_header) >
+                                        dev->buf + total)
+                                break;
+                        header = (struct usb_dev_cap_header *)buf;
+                        length = header->bLength;
+                        if (header->bDescriptorType !=
+                                        USB_DT_DEVICE_CAPABILITY) {
+                                dev_warn(&udev->dev, "not device capability descriptor, skip\n");
+                                continue;
+                        }
+                        switch (header->bDevCapabilityType) {
+                        case USB_CAP_TYPE_EXT:
+                                if (buf + USB_DT_USB_EXT_CAP_SIZE >
+                                                dev->buf + total ||
+                                                !is_good_ext(dev, buf)) {
+                                        dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
+                                        return -EDOM;
+                                }
+                                break;
+                        case USB_SS_CAP_TYPE:
+                                if (buf + USB_DT_USB_SS_CAP_SIZE >
+                                                dev->buf + total ||
+                                                !is_good_ss_cap(dev, buf)) {
+                                        dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
+                                        return -EDOM;
+                                }
+                                break;
+                        case CONTAINER_ID_TYPE:
+                                if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
+                                                dev->buf + total ||
+                                                !is_good_con_id(dev, buf)) {
+                                        dev_err(&iface->dev, "bogus container id descriptor\n");
+                                        return -EDOM;
+                                }
+                                break;
+                        default:
+                                break;
+                        }
+                }
+        }
        /* there's always [9.4.3] at least one config descriptor [9.6.3] */
        for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
                retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
@@ -954,7 +1108,7 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
                 * device, but some are chosen to trigger protocol stalls
                 * or short reads.
                 */
-                memset(&req, 0, sizeof req);
+                memset(&req, 0, sizeof(req));
                req.bRequest = USB_REQ_GET_DESCRIPTOR;
                req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
@@ -1074,7 +1228,7 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
                if (!u)
                        goto cleanup;
-                reqp = kmalloc(sizeof *reqp, GFP_KERNEL);
+                reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
                if (!reqp)
                        goto cleanup;
                reqp->setup = req;
@@ -1667,13 +1821,13 @@ test_iso_queue(struct usbtest_dev *dev, struct usbtest_param *param,
        if (param->sglen > 10)
                return -EDOM;
-        memset(&context, 0, sizeof context);
+        memset(&context, 0, sizeof(context));
        context.count = param->iterations * param->sglen;
        context.dev = dev;
        init_completion(&context.done);
        spin_lock_init(&context.lock);
-        memset(urbs, 0, sizeof urbs);
+        memset(urbs, 0, sizeof(urbs));
        udev = testdev_to_usbdev(dev);
        dev_info(&dev->intf->dev,
                "... iso period %d %sframes, wMaxPacket %04x\n",
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index c258a97ef1b0..57dfc0cedb00 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -75,6 +75,7 @@ config USB_MUSB_TUSB6010
 config USB_MUSB_OMAP2PLUS
        tristate "OMAP2430 and onwards"
        depends on ARCH_OMAP2PLUS
+        select GENERIC_PHY
 config USB_MUSB_AM35X
        tristate "AM35x"
@@ -90,7 +91,7 @@ config USB_MUSB_BLACKFIN
        depends on (BF54x && !BF544) || (BF52x && ! BF522 && !BF523)
 config USB_MUSB_UX500
-        tristate "U8500 and U5500"
+        tristate "Ux500 platforms"
 endchoice
@@ -112,7 +113,7 @@ choice
          allow using DMA on multiplatform kernels.
 config USB_UX500_DMA
-        bool 'ST Ericsson U8500 and U5500'
+        bool 'ST Ericsson Ux500'
        depends on USB_MUSB_UX500
        help
          Enable DMA transfers on UX500 platforms.
diff --git a/drivers/usb/musb/am35x.c b/drivers/usb/musb/am35x.c
index 5c310c664218..ca45b39db5b9 100644
--- a/drivers/usb/musb/am35x.c
+++ b/drivers/usb/musb/am35x.c
@@ -89,7 +89,6 @@ struct am35x_glue {
        struct clk              *phy_clk;
        struct clk              *clk;
 };
-#define glue_to_musb(g)         platform_get_drvdata(g->musb)
 /*
 * am35x_musb_enable - enable interrupts
@@ -452,14 +451,18 @@ static const struct musb_platform_ops am35x_ops = {
        .set_vbus       = am35x_musb_set_vbus,
 };
-static u64 am35x_dmamask = DMA_BIT_MASK(32);
+static const struct platform_device_info am35x_dev_info = {
+        .name           = "musb-hdrc",
+        .id             = PLATFORM_DEVID_AUTO,
+        .dma_mask       = DMA_BIT_MASK(32),
+};
 static int am35x_probe(struct platform_device *pdev)
 {
        struct musb_hdrc_platform_data  *pdata = dev_get_platdata(&pdev->dev);
        struct platform_device          *musb;
        struct am35x_glue               *glue;
+        struct platform_device_info     pinfo;
        struct clk                      *phy_clk;
        struct clk                      *clk;
@@ -471,12 +474,6 @@ static int am35x_probe(struct platform_device *pdev)
                goto err0;
        }
-        musb = platform_device_alloc("musb-hdrc", PLATFORM_DEVID_AUTO);
-        if (!musb) {
-                dev_err(&pdev->dev, "failed to allocate musb device\n");
-                goto err1;
-        }
        phy_clk = clk_get(&pdev->dev, "fck");
        if (IS_ERR(phy_clk)) {
                dev_err(&pdev->dev, "failed to get PHY clock\n");
@@ -503,12 +500,7 @@ static int am35x_probe(struct platform_device *pdev)
                goto err6;
        }
-        musb->dev.parent                = &pdev->dev;
-        musb->dev.dma_mask              = &am35x_dmamask;
-        musb->dev.coherent_dma_mask     = am35x_dmamask;
        glue->dev                       = &pdev->dev;
-        glue->musb                      = musb;
        glue->phy_clk                   = phy_clk;
        glue->clk                       = clk;
@@ -516,22 +508,17 @@ static int am35x_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, glue);
-        ret = platform_device_add_resources(musb, pdev->resource,
+        pinfo = am35x_dev_info;
-                        pdev->num_resources);
+        pinfo.parent = &pdev->dev;
-        if (ret) {
+        pinfo.res = pdev->resource;
-                dev_err(&pdev->dev, "failed to add resources\n");
+        pinfo.num_res = pdev->num_resources;
-                goto err7;
+        pinfo.data = pdata;
-        }
+        pinfo.size_data = sizeof(*pdata);
-        ret = platform_device_add_data(musb, pdata, sizeof(*pdata));
+        glue->musb = musb = platform_device_register_full(&pinfo);
-        if (ret) {
+        if (IS_ERR(musb)) {
-                dev_err(&pdev->dev, "failed to add platform_data\n");
+                ret = PTR_ERR(musb);
-                goto err7;
+                dev_err(&pdev->dev, "failed to register musb device: %d\n", ret);
-        }
-        ret = platform_device_add(musb);
-        if (ret) {
-                dev_err(&pdev->dev, "failed to register musb device\n");
                goto err7;
        }
@@ -550,9 +537,6 @@ err4:
        clk_put(phy_clk);
 err3:
-        platform_device_put(musb);
-err1:
        kfree(glue);
 err0:
@@ -615,23 +599,16 @@ static int am35x_resume(struct device *dev)
        return 0;
 }
-static struct dev_pm_ops am35x_pm_ops = {
-        .suspend        = am35x_suspend,
-        .resume         = am35x_resume,
-};
-#define DEV_PM_OPS      &am35x_pm_ops
-#else
-#define DEV_PM_OPS      NULL
 #endif
+static SIMPLE_DEV_PM_OPS(am35x_pm_ops, am35x_suspend, am35x_resume);
 static struct platform_driver am35x_driver = {
        .probe          = am35x_probe,
        .remove         = am35x_remove,
        .driver         = {
                .name   = "musb-am35x",
-                .pm     = DEV_PM_OPS,
+                .pm     = &am35x_pm_ops,
        },
 };
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index 72e2056b6082..d9692f78e227 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -561,23 +561,16 @@ static int bfin_resume(struct device *dev)
        return 0;
 }
-static struct dev_pm_ops bfin_pm_ops = {
-        .suspend        = bfin_suspend,
-        .resume         = bfin_resume,
-};
-#define DEV_PM_OPS      &bfin_pm_ops
-#else
-#define DEV_PM_OPS      NULL
 #endif
+static SIMPLE_DEV_PM_OPS(bfin_pm_ops, bfin_suspend, bfin_resume);
 static struct platform_driver bfin_driver = {
        .probe          = bfin_probe,
        .remove         = __exit_p(bfin_remove),
        .driver         = {
                .name   = "musb-blackfin",
-                .pm     = DEV_PM_OPS,
+                .pm     = &bfin_pm_ops,
        },
 };
diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
index d9ddf4122f37..2f2c1cb36421 100644
--- a/drivers/usb/musb/da8xx.c
+++ b/drivers/usb/musb/da8xx.c
@@ -472,7 +472,11 @@ static const struct musb_platform_ops da8xx_ops = {
        .set_vbus       = da8xx_musb_set_vbus,
 };
-static u64 da8xx_dmamask = DMA_BIT_MASK(32);
+static const struct platform_device_info da8xx_dev_info = {
+        .name           = "musb-hdrc",
+        .id             = PLATFORM_DEVID_AUTO,
+        .dma_mask       = DMA_BIT_MASK(32),
+};
 static int da8xx_probe(struct platform_device *pdev)
 {
@@ -480,7 +484,7 @@ static int da8xx_probe(struct platform_device *pdev)
        struct musb_hdrc_platform_data  *pdata = dev_get_platdata(&pdev->dev);
        struct platform_device          *musb;
        struct da8xx_glue               *glue;
+        struct platform_device_info     pinfo;
        struct clk                      *clk;
        int                             ret = -ENOMEM;
@@ -491,12 +495,6 @@ static int da8xx_probe(struct platform_device *pdev)
                goto err0;
        }
-        musb = platform_device_alloc("musb-hdrc", PLATFORM_DEVID_AUTO);
-        if (!musb) {
-                dev_err(&pdev->dev, "failed to allocate musb device\n");
-                goto err1;
-        }
        clk = clk_get(&pdev->dev, "usb20");
        if (IS_ERR(clk)) {
                dev_err(&pdev->dev, "failed to get clock\n");
@@ -510,12 +508,7 @@ static int da8xx_probe(struct platform_device *pdev)
                goto err4;
        }
-        musb->dev.parent                = &pdev->dev;
-        musb->dev.dma_mask              = &da8xx_dmamask;
-        musb->dev.coherent_dma_mask     = da8xx_dmamask;
        glue->dev                       = &pdev->dev;
-        glue->musb                      = musb;
        glue->clk                       = clk;
        pdata->platform_ops             = &da8xx_ops;
@@ -535,22 +528,17 @@ static int da8xx_probe(struct platform_device *pdev)
        musb_resources[1].end = pdev->resource[1].end;
        musb_resources[1].flags = pdev->resource[1].flags;
-        ret = platform_device_add_resources(musb, musb_resources,
+        pinfo = da8xx_dev_info;
-                        ARRAY_SIZE(musb_resources));
+        pinfo.parent = &pdev->dev;
-        if (ret) {
+        pinfo.res = musb_resources;
-                dev_err(&pdev->dev, "failed to add resources\n");
+        pinfo.num_res = ARRAY_SIZE(musb_resources);
-                goto err5;
+        pinfo.data = pdata;
-        }
+        pinfo.size_data = sizeof(*pdata);
-        ret = platform_device_add_data(musb, pdata, sizeof(*pdata));
+        glue->musb = musb = platform_device_register_full(&pinfo);
-        if (ret) {
+        if (IS_ERR(musb)) {
-                dev_err(&pdev->dev, "failed to add platform_data\n");
+                ret = PTR_ERR(musb);
-                goto err5;
+                dev_err(&pdev->dev, "failed to register musb device: %d\n", ret);
-        }
-        ret = platform_device_add(musb);
-        if (ret) {
-                dev_err(&pdev->dev, "failed to register musb device\n");
                goto err5;
        }
@@ -563,9 +551,6 @@ err4:
        clk_put(clk);
 err3:
-        platform_device_put(musb);
-err1:
        kfree(glue);
 err0:
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index ed0834e2b72e..1121fd741bf8 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -505,14 +505,19 @@ static const struct musb_platform_ops davinci_ops = {
        .set_vbus       = davinci_musb_set_vbus,
 };
-static u64 davinci_dmamask = DMA_BIT_MASK(32);
+static const struct platform_device_info davinci_dev_info = {
+        .name           = "musb-hdrc",
+        .id             = PLATFORM_DEVID_AUTO,
+        .dma_mask       = DMA_BIT_MASK(32),
+};
 static int davinci_probe(struct platform_device *pdev)
 {
-        struct resource musb_resources[2];
+        struct resource                 musb_resources[3];
        struct musb_hdrc_platform_data  *pdata = dev_get_platdata(&pdev->dev);
        struct platform_device          *musb;
        struct davinci_glue             *glue;
+        struct platform_device_info     pinfo;
        struct clk                      *clk;
        int                             ret = -ENOMEM;
@@ -523,12 +528,6 @@ static int davinci_probe(struct platform_device *pdev)
                goto err0;
        }
-        musb = platform_device_alloc("musb-hdrc", PLATFORM_DEVID_AUTO);
-        if (!musb) {
-                dev_err(&pdev->dev, "failed to allocate musb device\n");
-                goto err1;
-        }
        clk = clk_get(&pdev->dev, "usb");
        if (IS_ERR(clk)) {
                dev_err(&pdev->dev, "failed to get clock\n");
@@ -542,12 +541,7 @@ static int davinci_probe(struct platform_device *pdev)
                goto err4;
        }
-        musb->dev.parent                = &pdev->dev;
-        musb->dev.dma_mask              = &davinci_dmamask;
-        musb->dev.coherent_dma_mask     = davinci_dmamask;
        glue->dev                       = &pdev->dev;
-        glue->musb                      = musb;
        glue->clk                       = clk;
        pdata->platform_ops             = &davinci_ops;
@@ -567,22 +561,26 @@ static int davinci_probe(struct platform_device *pdev)
        musb_resources[1].end = pdev->resource[1].end;
        musb_resources[1].flags = pdev->resource[1].flags;
-        ret = platform_device_add_resources(musb, musb_resources,
+        /*
-                        ARRAY_SIZE(musb_resources));
+         * For DM6467 3 resources are passed. A placeholder for the 3rd
-        if (ret) {
+         * resource is always there, so it's safe to always copy it...
-                dev_err(&pdev->dev, "failed to add resources\n");
+         */
-                goto err5;
+        musb_resources[2].name = pdev->resource[2].name;
-        }
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
-        ret = platform_device_add_data(musb, pdata, sizeof(*pdata));
+        musb_resources[2].flags = pdev->resource[2].flags;
-        if (ret) {
-                dev_err(&pdev->dev, "failed to add platform_data\n");
+        pinfo = davinci_dev_info;
-                goto err5;
+        pinfo.parent = &pdev->dev;
-        }
+        pinfo.res = musb_resources;
+        pinfo.num_res = ARRAY_SIZE(musb_resources);
-        ret = platform_device_add(musb);
+        pinfo.data = pdata;
-        if (ret) {
+        pinfo.size_data = sizeof(*pdata);
-                dev_err(&pdev->dev, "failed to register musb device\n");
+        glue->musb = musb = platform_device_register_full(&pinfo);
+        if (IS_ERR(musb)) {
+                ret = PTR_ERR(musb);
+                dev_err(&pdev->dev, "failed to register musb device: %d\n", ret);
                goto err5;
        }
@@ -595,9 +593,6 @@ err4:
        clk_put(clk);
 err3:
-        platform_device_put(musb);
-err1:
        kfree(glue);
 err0:
diff --git a/drivers/usb/musb/musb_am335x.c b/drivers/usb/musb/musb_am335x.c
index 41ac5b5b57ce..8be9b02c3cc2 100644
--- a/drivers/usb/musb/musb_am335x.c
+++ b/drivers/usb/musb/musb_am335x.c
@@ -46,7 +46,7 @@ static struct platform_driver am335x_child_driver = {
        .remove         = am335x_child_remove,
        .driver         = {
                .name   = "am335x-usb-childs",
-                .of_match_table = of_match_ptr(am335x_child_of_match),
+                .of_match_table = am335x_child_of_match,
        },
 };
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index cd70cc886171..0a43329569d1 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -617,7 +617,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                /* case 3 << MUSB_DEVCTL_VBUS_SHIFT: */
                                default:
                                        s = "VALID"; break;
-                                }; s; }),
+                                } s; }),
                                VBUSERR_RETRY_COUNT - musb->vbuserr_retry,
                                musb->port1_status);
@@ -1809,8 +1809,7 @@ static void musb_free(struct musb *musb)
                        disable_irq_wake(musb->nIrq);
                free_irq(musb->nIrq, musb);
        }
-        if (musb->dma_controller)
+        cancel_work_sync(&musb->irq_work);
-                dma_controller_destroy(musb->dma_controller);
        musb_host_free(musb);
 }
@@ -1885,8 +1884,13 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        pm_runtime_get_sync(musb->controller);
-        if (use_dma && dev->dma_mask)
+        if (use_dma && dev->dma_mask) {
                musb->dma_controller = dma_controller_create(musb, musb->mregs);
+                if (IS_ERR(musb->dma_controller)) {
+                        status = PTR_ERR(musb->dma_controller);
+                        goto fail2_5;
+                }
+        }
        /* be sure interrupts are disabled before connecting ISR */
        musb_platform_disable(musb);
@@ -1946,6 +1950,8 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
                if (status < 0)
                        goto fail3;
                status = musb_gadget_setup(musb);
+                if (status)
+                        musb_host_cleanup(musb);
                break;
        default:
                dev_err(dev, "unsupported port mode %d\n", musb->port_mode);
@@ -1972,10 +1978,12 @@ fail5:
 fail4:
        musb_gadget_cleanup(musb);
+        musb_host_cleanup(musb);
 fail3:
        if (musb->dma_controller)
                dma_controller_destroy(musb->dma_controller);
+fail2_5:
        pm_runtime_put_sync(musb->controller);
 fail2:
@@ -2032,6 +2040,9 @@ static int musb_remove(struct platform_device *pdev)
        musb_exit_debugfs(musb);
        musb_shutdown(pdev);
+        if (musb->dma_controller)
+                dma_controller_destroy(musb->dma_controller);
        musb_free(musb);
        device_init_wakeup(dev, 0);
        return 0;
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 1c5bf75ee8ff..29f7cd7c7964 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -46,6 +46,7 @@
 #include <linux/usb.h>
 #include <linux/usb/otg.h>
 #include <linux/usb/musb.h>
+#include <linux/phy/phy.h>
 struct musb;
 struct musb_hw_ep;
@@ -341,6 +342,7 @@ struct musb {
        u16                     int_tx;
        struct usb_phy          *xceiv;
+        struct phy              *phy;
        int nIrq;
        unsigned                irq_wake:1;
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index ae959746f77f..ff9d6de2b746 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -484,6 +484,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
                if (ret)
                        goto err;
+                ret = -EINVAL;
                if (port > MUSB_DMA_NUM_CHANNELS || !port)
                        goto err;
                if (is_tx)
@@ -503,6 +504,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
                dc = dma_request_slave_channel(dev, str);
                if (!dc) {
                        dev_err(dev, "Falied to request %s.\n", str);
+                        ret = -EPROBE_DEFER;
                        goto err;
                }
                cppi41_channel->dc = dc;
@@ -510,7 +512,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
        return 0;
 err:
        cppi41_release_all_dma_chans(controller);
-        return -EINVAL;
+        return ret;
 }
 void dma_controller_destroy(struct dma_controller *c)
@@ -526,7 +528,7 @@ struct dma_controller *dma_controller_create(struct musb *musb,
                                        void __iomem *base)
 {
        struct cppi41_dma_controller *controller;
-        int ret;
+        int ret = 0;
        if (!musb->controller->of_node) {
                dev_err(musb->controller, "Need DT for the DMA engine.\n");
@@ -553,5 +555,7 @@ struct dma_controller *dma_controller_create(struct musb *musb,
 plat_get_fail:
        kfree(controller);
 kzalloc_fail:
+        if (ret == -EPROBE_DEFER)
+                return ERR_PTR(ret);
        return NULL;
 }
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index bd4138d80a48..1901f6fe5807 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -121,6 +121,43 @@ struct dsps_glue {
        unsigned long last_timer;    /* last timer data for each instance */
 };
+static void dsps_musb_try_idle(struct musb *musb, unsigned long timeout)
+{
+        struct device *dev = musb->controller;
+        struct dsps_glue *glue = dev_get_drvdata(dev->parent);
+        if (timeout == 0)
+                timeout = jiffies + msecs_to_jiffies(3);
+        /* Never idle if active, or when VBUS timeout is not set as host */
+        if (musb->is_active || (musb->a_wait_bcon == 0 &&
+                                musb->xceiv->state == OTG_STATE_A_WAIT_BCON)) {
+                dev_dbg(musb->controller, "%s active, deleting timer\n",
+                                usb_otg_state_string(musb->xceiv->state));
+                del_timer(&glue->timer);
+                glue->last_timer = jiffies;
+                return;
+        }
+        if (musb->port_mode != MUSB_PORT_MODE_DUAL_ROLE)
+                return;
+        if (!musb->g.dev.driver)
+                return;
+        if (time_after(glue->last_timer, timeout) &&
+                                timer_pending(&glue->timer)) {
+                dev_dbg(musb->controller,
+                        "Longer idle timer already pending, ignoring...\n");
+                return;
+        }
+        glue->last_timer = timeout;
+        dev_dbg(musb->controller, "%s inactive, starting idle timer for %u ms\n",
+                usb_otg_state_string(musb->xceiv->state),
+                        jiffies_to_msecs(timeout - jiffies));
+        mod_timer(&glue->timer, timeout);
+}
 /**
 * dsps_musb_enable - enable interrupts
 */
@@ -143,6 +180,7 @@ static void dsps_musb_enable(struct musb *musb)
        /* Force the DRVVBUS IRQ so we can start polling for ID change. */
        dsps_writel(reg_base, wrp->coreintr_set,
                    (1 << wrp->drvvbus) << wrp->usb_shift);
+        dsps_musb_try_idle(musb, 0);
 }
 /**
@@ -171,6 +209,7 @@ static void otg_timer(unsigned long _musb)
        const struct dsps_musb_wrapper *wrp = glue->wrp;
        u8 devctl;
        unsigned long flags;
+        int skip_session = 0;
        /*
         * We poll because DSPS IP's won't expose several OTG-critical
@@ -183,10 +222,12 @@ static void otg_timer(unsigned long _musb)
        spin_lock_irqsave(&musb->lock, flags);
        switch (musb->xceiv->state) {
        case OTG_STATE_A_WAIT_BCON:
-                devctl &= ~MUSB_DEVCTL_SESSION;
+                dsps_writeb(musb->mregs, MUSB_DEVCTL, 0);
-                dsps_writeb(musb->mregs, MUSB_DEVCTL, devctl);
+                skip_session = 1;
+                /* fall */
-                devctl = dsps_readb(musb->mregs, MUSB_DEVCTL);
+        case OTG_STATE_A_IDLE:
+        case OTG_STATE_B_IDLE:
                if (devctl & MUSB_DEVCTL_BDEVICE) {
                        musb->xceiv->state = OTG_STATE_B_IDLE;
                        MUSB_DEV_MODE(musb);
@@ -194,60 +235,21 @@ static void otg_timer(unsigned long _musb)
                        musb->xceiv->state = OTG_STATE_A_IDLE;
                        MUSB_HST_MODE(musb);
                }
+                if (!(devctl & MUSB_DEVCTL_SESSION) && !skip_session)
+                        dsps_writeb(mregs, MUSB_DEVCTL, MUSB_DEVCTL_SESSION);
+                mod_timer(&glue->timer, jiffies + wrp->poll_seconds * HZ);
                break;
        case OTG_STATE_A_WAIT_VFALL:
                musb->xceiv->state = OTG_STATE_A_WAIT_VRISE;
                dsps_writel(musb->ctrl_base, wrp->coreintr_set,
                            MUSB_INTR_VBUSERROR << wrp->usb_shift);
                break;
-        case OTG_STATE_B_IDLE:
-                devctl = dsps_readb(mregs, MUSB_DEVCTL);
-                if (devctl & MUSB_DEVCTL_BDEVICE)
-                        mod_timer(&glue->timer,
-                                        jiffies + wrp->poll_seconds * HZ);
-                else
-                        musb->xceiv->state = OTG_STATE_A_IDLE;
-                break;
        default:
                break;
        }
        spin_unlock_irqrestore(&musb->lock, flags);
 }
-static void dsps_musb_try_idle(struct musb *musb, unsigned long timeout)
-{
-        struct device *dev = musb->controller;
-        struct dsps_glue *glue = dev_get_drvdata(dev->parent);
-        if (timeout == 0)
-                timeout = jiffies + msecs_to_jiffies(3);
-        /* Never idle if active, or when VBUS timeout is not set as host */
-        if (musb->is_active || (musb->a_wait_bcon == 0 &&
-                                musb->xceiv->state == OTG_STATE_A_WAIT_BCON)) {
-                dev_dbg(musb->controller, "%s active, deleting timer\n",
-                                usb_otg_state_string(musb->xceiv->state));
-                del_timer(&glue->timer);
-                glue->last_timer = jiffies;
-                return;
-        }
-        if (musb->port_mode == MUSB_PORT_MODE_HOST)
-                return;
-        if (time_after(glue->last_timer, timeout) &&
-                                timer_pending(&glue->timer)) {
-                dev_dbg(musb->controller,
-                        "Longer idle timer already pending, ignoring...\n");
-                return;
-        }
-        glue->last_timer = timeout;
-        dev_dbg(musb->controller, "%s inactive, starting idle timer for %u ms\n",
-                usb_otg_state_string(musb->xceiv->state),
-                        jiffies_to_msecs(timeout - jiffies));
-        mod_timer(&glue->timer, timeout);
-}
 static irqreturn_t dsps_interrupt(int irq, void *hci)
 {
        struct musb  *musb = hci;
@@ -443,7 +445,7 @@ static int get_musb_port_mode(struct device *dev)
        case USB_DR_MODE_OTG:
        default:
                return MUSB_PORT_MODE_DUAL_ROLE;
-        };
+        }
 }
 static int dsps_create_musb_pdev(struct dsps_glue *glue,
@@ -631,7 +633,7 @@ static struct platform_driver dsps_usbss_driver = {
        .remove         = dsps_remove,
        .driver         = {
                .name   = "musb-dsps",
-                .of_match_table = of_match_ptr(musb_dsps_of_match),
+                .of_match_table = musb_dsps_of_match,
        },
 };
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 3671898a4535..d2d3a173b315 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1121,7 +1121,7 @@ static int musb_gadget_enable(struct usb_ep *ep,
                        case USB_ENDPOINT_XFER_BULK:    s = "bulk"; break;
                        case USB_ENDPOINT_XFER_INT:     s = "int"; break;
                        default:                        s = "iso"; break;
-                        }; s; }),
+                        } s; }),
                        musb_ep->is_in ? "IN" : "OUT",
                        musb_ep->dma ? "dma, " : "",
                        musb_ep->packet_sz);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 9a2b8c85f19a..6582a20bec05 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -253,7 +253,7 @@ musb_start_urb(struct musb *musb, int is_in, struct musb_qh *qh)
                        case USB_ENDPOINT_XFER_BULK:    s = "-bulk"; break;
                        case USB_ENDPOINT_XFER_ISOC:    s = "-iso"; break;
                        default:                        s = "-intr"; break;
-                        }; s; }),
+                        } s; }),
                        epnum, buf + offset, len);
        /* Configure endpoint */
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index d1d6b83aabca..9af6bba5eac9 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -220,6 +220,23 @@ int musb_hub_status_data(struct usb_hcd *hcd, char *buf)
        return retval;
 }
+static int musb_has_gadget(struct musb *musb)
+{
+        /*
+         * In host-only mode we start a connection right away. In OTG mode
+         * we have to wait until we loaded a gadget. We don't really need a
+         * gadget if we operate as a host but we should not start a session
+         * as a device without a gadget or else we explode.
+         */
+#ifdef CONFIG_USB_MUSB_HOST
+        return 1;
+#else
+        if (musb->port_mode == MUSB_PORT_MODE_HOST)
+                return 1;
+        return musb->g.dev.driver != NULL;
+#endif
+}
 int musb_hub_control(
        struct usb_hcd  *hcd,
        u16             typeReq,
@@ -362,7 +379,7 @@ int musb_hub_control(
                         * initialization logic, e.g. for OTG, or change any
                         * logic relating to VBUS power-up.
                         */
-                        if (!hcd->self.is_b_host)
+                        if (!hcd->self.is_b_host && musb_has_gadget(musb))
                                musb_start(musb);
                        break;
                case USB_PORT_FEAT_RESET:
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 59d2245db1c8..2a408cdaf7b2 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -38,6 +38,7 @@
 #include <linux/delay.h>
 #include <linux/usb/musb-omap.h>
 #include <linux/usb/omap_control_usb.h>
+#include <linux/of_platform.h>
 #include "musb_core.h"
 #include "omap2430.h"
@@ -305,6 +306,9 @@ static void omap_musb_set_mailbox(struct omap2430_glue *glue)
        default:
                dev_dbg(dev, "ID float\n");
        }
+        atomic_notifier_call_chain(&musb->xceiv->notifier,
+                        musb->xceiv->last_event, NULL);
 }
@@ -348,11 +352,21 @@ static int omap2430_musb_init(struct musb *musb)
         * up through ULPI.  TWL4030-family PMICs include one,
         * which needs a driver, drivers aren't always needed.
         */
-        if (dev->parent->of_node)
+        if (dev->parent->of_node) {
+                musb->phy = devm_phy_get(dev->parent, "usb2-phy");
+                /* We can't totally remove musb->xceiv as of now because
+                 * musb core uses xceiv.state and xceiv.otg. Once we have
+                 * a separate state machine to handle otg, these can be moved
+                 * out of xceiv and then we can start using the generic PHY
+                 * framework
+                 */
                musb->xceiv = devm_usb_get_phy_by_phandle(dev->parent,
                    "usb-phy", 0);
-        else
+        } else {
                musb->xceiv = devm_usb_get_phy_dev(dev, 0);
+                musb->phy = devm_phy_get(dev, "usb");
+        }
        if (IS_ERR(musb->xceiv)) {
                status = PTR_ERR(musb->xceiv);
@@ -364,6 +378,10 @@ static int omap2430_musb_init(struct musb *musb)
                return -EPROBE_DEFER;
        }
+        if (IS_ERR(musb->phy)) {
+                pr_err("HS USB OTG: no PHY configured\n");
+                return PTR_ERR(musb->phy);
+        }
        musb->isr = omap2430_musb_interrupt;
        status = pm_runtime_get_sync(dev);
@@ -397,7 +415,7 @@ static int omap2430_musb_init(struct musb *musb)
        if (glue->status != OMAP_MUSB_UNKNOWN)
                omap_musb_set_mailbox(glue);
-        usb_phy_init(musb->xceiv);
+        phy_init(musb->phy);
        pm_runtime_put_noidle(musb->controller);
        return 0;
@@ -460,6 +478,7 @@ static int omap2430_musb_exit(struct musb *musb)
        del_timer_sync(&musb_idle_timer);
        omap2430_low_level_exit(musb);
+        phy_exit(musb->phy);
        return 0;
 }
@@ -509,8 +528,12 @@ static int omap2430_probe(struct platform_device *pdev)
        glue->dev                       = &pdev->dev;
        glue->musb                      = musb;
        glue->status                    = OMAP_MUSB_UNKNOWN;
+        glue->control_otghs = ERR_PTR(-ENODEV);
        if (np) {
+                struct device_node *control_node;
+                struct platform_device *control_pdev;
                pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
                if (!pdata) {
                        dev_err(&pdev->dev,
@@ -539,22 +562,20 @@ static int omap2430_probe(struct platform_device *pdev)
                of_property_read_u32(np, "ram-bits", (u32 *)&config->ram_bits);
                of_property_read_u32(np, "power", (u32 *)&pdata->power);
                config->multipoint = of_property_read_bool(np, "multipoint");
-                pdata->has_mailbox = of_property_read_bool(np,
-                    "ti,has-mailbox");
                pdata->board_data       = data;
                pdata->config           = config;
-        }
-        if (pdata->has_mailbox) {
+                control_node = of_parse_phandle(np, "ctrl-module", 0);
-                glue->control_otghs = omap_get_control_dev();
+                if (control_node) {
-                if (IS_ERR(glue->control_otghs)) {
+                        control_pdev = of_find_device_by_node(control_node);
-                        dev_vdbg(&pdev->dev, "Failed to get control device\n");
+                        if (!control_pdev) {
-                        ret = PTR_ERR(glue->control_otghs);
+                                dev_err(&pdev->dev, "Failed to get control device\n");
-                        goto err2;
+                                ret = -EINVAL;
+                                goto err2;
+                        }
+                        glue->control_otghs = &control_pdev->dev;
                }
-        } else {
-                glue->control_otghs = ERR_PTR(-ENODEV);
        }
        pdata->platform_ops             = &omap2430_ops;
@@ -638,7 +659,7 @@ static int omap2430_runtime_suspend(struct device *dev)
                                OTG_INTERFSEL);
                omap2430_low_level_exit(musb);
-                usb_phy_set_suspend(musb->xceiv, 1);
+                phy_power_off(musb->phy);
        }
        return 0;
@@ -653,8 +674,7 @@ static int omap2430_runtime_resume(struct device *dev)
                omap2430_low_level_init(musb);
                musb_writel(musb->mregs, OTG_INTERFSEL,
                                musb->context.otg_interfsel);
+                phy_power_on(musb->phy);
-                usb_phy_set_suspend(musb->xceiv, 0);
        }
        return 0;
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index b3b3ed723882..4432314d70ee 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1152,7 +1152,11 @@ static const struct musb_platform_ops tusb_ops = {
        .set_vbus       = tusb_musb_set_vbus,
 };
-static u64 tusb_dmamask = DMA_BIT_MASK(32);
+static const struct platform_device_info tusb_dev_info = {
+        .name           = "musb-hdrc",
+        .id             = PLATFORM_DEVID_AUTO,
+        .dma_mask       = DMA_BIT_MASK(32),
+};
 static int tusb_probe(struct platform_device *pdev)
 {
@@ -1160,7 +1164,7 @@ static int tusb_probe(struct platform_device *pdev)
        struct musb_hdrc_platform_data  *pdata = dev_get_platdata(&pdev->dev);
        struct platform_device          *musb;
        struct tusb6010_glue            *glue;
+        struct platform_device_info     pinfo;
        int                             ret = -ENOMEM;
        glue = kzalloc(sizeof(*glue), GFP_KERNEL);
@@ -1169,18 +1173,7 @@ static int tusb_probe(struct platform_device *pdev)
                goto err0;
        }
-        musb = platform_device_alloc("musb-hdrc", PLATFORM_DEVID_AUTO);
-        if (!musb) {
-                dev_err(&pdev->dev, "failed to allocate musb device\n");
-                goto err1;
-        }
-        musb->dev.parent                = &pdev->dev;
-        musb->dev.dma_mask              = &tusb_dmamask;
-        musb->dev.coherent_dma_mask     = tusb_dmamask;
        glue->dev                       = &pdev->dev;
-        glue->musb                      = musb;
        pdata->platform_ops             = &tusb_ops;
@@ -1204,31 +1197,23 @@ static int tusb_probe(struct platform_device *pdev)
        musb_resources[2].end = pdev->resource[2].end;
        musb_resources[2].flags = pdev->resource[2].flags;
-        ret = platform_device_add_resources(musb, musb_resources,
+        pinfo = tusb_dev_info;
-                        ARRAY_SIZE(musb_resources));
+        pinfo.parent = &pdev->dev;
-        if (ret) {
+        pinfo.res = musb_resources;
-                dev_err(&pdev->dev, "failed to add resources\n");
+        pinfo.num_res = ARRAY_SIZE(musb_resources);
-                goto err3;
+        pinfo.data = pdata;
-        }
+        pinfo.size_data = sizeof(*pdata);
-        ret = platform_device_add_data(musb, pdata, sizeof(*pdata));
+        glue->musb = musb = platform_device_register_full(&pinfo);
-        if (ret) {
+        if (IS_ERR(musb)) {
-                dev_err(&pdev->dev, "failed to add platform_data\n");
+                ret = PTR_ERR(musb);
-                goto err3;
+                dev_err(&pdev->dev, "failed to register musb device: %d\n", ret);
-        }
-        ret = platform_device_add(musb);
-        if (ret) {
-                dev_err(&pdev->dev, "failed to register musb device\n");
                goto err3;
        }
        return 0;
 err3:
-        platform_device_put(musb);
-err1:
        kfree(glue);
 err0:
diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index 59256b12f746..f483d1924c28 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -376,17 +376,10 @@ static int ux500_resume(struct device *dev)
        return 0;
 }
-static const struct dev_pm_ops ux500_pm_ops = {
-        .suspend        = ux500_suspend,
-        .resume         = ux500_resume,
-};
-#define DEV_PM_OPS      (&ux500_pm_ops)
-#else
-#define DEV_PM_OPS      NULL
 #endif
+static SIMPLE_DEV_PM_OPS(ux500_pm_ops, ux500_suspend, ux500_resume);
 static const struct of_device_id ux500_match[] = {
        { .compatible = "stericsson,db8500-musb", },
        {}
@@ -397,7 +390,7 @@ static struct platform_driver ux500_driver = {
        .remove         = ux500_remove,
        .driver         = {
                .name   = "musb-ux500",
-                .pm     = DEV_PM_OPS,
+                .pm     = &ux500_pm_ops,
                .of_match_table = ux500_match,
        },
 };
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index d5589f9c60a9..08e2f39027ec 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -66,17 +66,6 @@ config OMAP_CONTROL_USB
          power on the USB2 PHY is present in OMAP4 and OMAP5. OMAP5 has an
          additional register to power on USB3 PHY.
-config OMAP_USB2
-        tristate "OMAP USB2 PHY Driver"
-        depends on ARCH_OMAP2PLUS
-        select OMAP_CONTROL_USB
-        select USB_PHY
-        help
-          Enable this to support the transceiver that is part of SOC. This
-          driver takes care of all the PHY functionality apart from comparator.
-          The USB OTG controller communicates with the comparator using this
-          driver.
 config OMAP_USB3
        tristate "OMAP USB3 PHY Driver"
        depends on ARCH_OMAP2PLUS || COMPILE_TEST
@@ -93,6 +82,7 @@ config AM335X_CONTROL_USB
 config AM335X_PHY_USB
        tristate "AM335x USB PHY Driver"
+        depends on ARM || COMPILE_TEST
        select USB_PHY
        select AM335X_CONTROL_USB
        select NOP_USB_XCEIV
@@ -123,16 +113,6 @@ config SAMSUNG_USB3PHY
          Enable this to support Samsung USB 3.0 (Super Speed) phy controller
          for samsung SoCs.
-config TWL4030_USB
-        tristate "TWL4030 USB Transceiver Driver"
-        depends on TWL4030_CORE && REGULATOR_TWL4030 && USB_MUSB_OMAP2PLUS
-        select USB_PHY
-        help
-          Enable this to support the USB OTG transceiver on TWL4030
-          family chips (including the TWL5030 and TPS659x0 devices).
-          This transceiver supports high and full speed devices plus,
-          in host mode, low speed.
 config TWL6030_USB
        tristate "TWL6030 USB Transceiver Driver"
        depends on TWL4030_CORE && OMAP_USB2 && USB_MUSB_OMAP2PLUS
@@ -214,6 +194,19 @@ config USB_RCAR_PHY
          To compile this driver as a module, choose M here: the
          module will be called phy-rcar-usb.
+config USB_RCAR_GEN2_PHY
+        tristate "Renesas R-Car Gen2 USB PHY support"
+        depends on ARCH_R8A7790 || ARCH_R8A7791 || COMPILE_TEST
+        select USB_PHY
+        help
+          Say Y here to add support for the Renesas R-Car Gen2 USB PHY driver.
+          It is typically used to control internal USB PHY for USBHS,
+          and to configure shared USB channels 0 and 2.
+          This driver supports R8A7790 and R8A7791.
+          To compile this driver as a module, choose M here: the
+          module will be called phy-rcar-gen2-usb.
 config USB_ULPI
        bool "Generic ULPI Transceiver Driver"
        depends on ARM
diff --git a/drivers/usb/phy/Makefile b/drivers/usb/phy/Makefile
index 2135e85f46ed..022c1da7fb78 100644
--- a/drivers/usb/phy/Makefile
+++ b/drivers/usb/phy/Makefile
@@ -15,12 +15,10 @@ obj-$(CONFIG_NOP_USB_XCEIV)		+= phy-generic.o
 obj-$(CONFIG_OMAP_CONTROL_USB)          += phy-omap-control.o
 obj-$(CONFIG_AM335X_CONTROL_USB)        += phy-am335x-control.o
 obj-$(CONFIG_AM335X_PHY_USB)            += phy-am335x.o
-obj-$(CONFIG_OMAP_USB2)                 += phy-omap-usb2.o
 obj-$(CONFIG_OMAP_USB3)                 += phy-omap-usb3.o
 obj-$(CONFIG_SAMSUNG_USBPHY)            += phy-samsung-usb.o
 obj-$(CONFIG_SAMSUNG_USB2PHY)           += phy-samsung-usb2.o
 obj-$(CONFIG_SAMSUNG_USB3PHY)           += phy-samsung-usb3.o
-obj-$(CONFIG_TWL4030_USB)               += phy-twl4030-usb.o
 obj-$(CONFIG_TWL6030_USB)               += phy-twl6030-usb.o
 obj-$(CONFIG_USB_EHCI_TEGRA)            += phy-tegra-usb.o
 obj-$(CONFIG_USB_GPIO_VBUS)             += phy-gpio-vbus-usb.o
@@ -29,5 +27,6 @@ obj-$(CONFIG_USB_MSM_OTG)		+= phy-msm-usb.o
 obj-$(CONFIG_USB_MV_OTG)                += phy-mv-usb.o
 obj-$(CONFIG_USB_MXS_PHY)               += phy-mxs-usb.o
 obj-$(CONFIG_USB_RCAR_PHY)              += phy-rcar-usb.o
+obj-$(CONFIG_USB_RCAR_GEN2_PHY)         += phy-rcar-gen2-usb.o
 obj-$(CONFIG_USB_ULPI)                  += phy-ulpi.o
 obj-$(CONFIG_USB_ULPI_VIEWPORT)         += phy-ulpi-viewport.o
diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
index 22cf07d62e4c..634f49acd20e 100644
--- a/drivers/usb/phy/phy-am335x-control.c
+++ b/drivers/usb/phy/phy-am335x-control.c
@@ -26,6 +26,41 @@ struct am335x_control_usb {
 #define USBPHY_OTGVDET_EN       (1 << 19)
 #define USBPHY_OTGSESSEND_EN    (1 << 20)
+#define AM335X_PHY0_WK_EN       (1 << 0)
+#define AM335X_PHY1_WK_EN       (1 << 8)
+static void am335x_phy_wkup(struct  phy_control *phy_ctrl, u32 id, bool on)
+{
+        struct am335x_control_usb *usb_ctrl;
+        u32 val;
+        u32 reg;
+        usb_ctrl = container_of(phy_ctrl, struct am335x_control_usb, phy_ctrl);
+        switch (id) {
+        case 0:
+                reg = AM335X_PHY0_WK_EN;
+                break;
+        case 1:
+                reg = AM335X_PHY1_WK_EN;
+                break;
+        default:
+                WARN_ON(1);
+                return;
+        }
+        spin_lock(&usb_ctrl->lock);
+        val = readl(usb_ctrl->wkup);
+        if (on)
+                val |= reg;
+        else
+                val &= ~reg;
+        writel(val, usb_ctrl->wkup);
+        spin_unlock(&usb_ctrl->lock);
+}
 static void am335x_phy_power(struct phy_control *phy_ctrl, u32 id, bool on)
 {
        struct am335x_control_usb *usb_ctrl;
@@ -59,6 +94,7 @@ static void am335x_phy_power(struct phy_control *phy_ctrl, u32 id, bool on)
 static const struct phy_control ctrl_am335x = {
        .phy_power = am335x_phy_power,
+        .phy_wkup = am335x_phy_wkup,
 };
 static const struct of_device_id omap_control_usb_id_table[] = {
@@ -117,6 +153,12 @@ static int am335x_control_usb_probe(struct platform_device *pdev)
        ctrl_usb->phy_reg = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(ctrl_usb->phy_reg))
                return PTR_ERR(ctrl_usb->phy_reg);
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "wakeup");
+        ctrl_usb->wkup = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(ctrl_usb->wkup))
+                return PTR_ERR(ctrl_usb->wkup);
        spin_lock_init(&ctrl_usb->lock);
        ctrl_usb->phy_ctrl = *phy_ctrl;
@@ -129,7 +171,7 @@ static struct platform_driver am335x_control_driver = {
        .driver         = {
                .name   = "am335x-control-usb",
                .owner  = THIS_MODULE,
-                .of_match_table = of_match_ptr(omap_control_usb_id_table),
+                .of_match_table = omap_control_usb_id_table,
        },
 };
diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
index c4d614d1f173..6370e50649d7 100644
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -53,21 +53,20 @@ static int am335x_phy_probe(struct platform_device *pdev)
        }
        ret = usb_phy_gen_create_phy(dev, &am_phy->usb_phy_gen,
-                        USB_PHY_TYPE_USB2, 0, false, false);
+                        USB_PHY_TYPE_USB2, 0, false);
        if (ret)
                return ret;
        ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
        if (ret)
-                goto err_add;
+                return ret;
        am_phy->usb_phy_gen.phy.init = am335x_init;
        am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown;
        platform_set_drvdata(pdev, am_phy);
        return 0;
-err_add:
-        usb_phy_gen_cleanup_phy(&am_phy->usb_phy_gen);
        return ret;
 }
@@ -79,6 +78,40 @@ static int am335x_phy_remove(struct platform_device *pdev)
        return 0;
 }
+#ifdef CONFIG_PM_RUNTIME
+static int am335x_phy_runtime_suspend(struct device *dev)
+{
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct am335x_phy *am_phy = platform_get_drvdata(pdev);
+        if (device_may_wakeup(dev))
+                phy_ctrl_wkup(am_phy->phy_ctrl, am_phy->id, true);
+        phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, false);
+        return 0;
+}
+static int am335x_phy_runtime_resume(struct device *dev)
+{
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct am335x_phy       *am_phy = platform_get_drvdata(pdev);
+        phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, true);
+        if (device_may_wakeup(dev))
+                phy_ctrl_wkup(am_phy->phy_ctrl, am_phy->id, false);
+        return 0;
+}
+static const struct dev_pm_ops am335x_pm_ops = {
+        SET_RUNTIME_PM_OPS(am335x_phy_runtime_suspend,
+                        am335x_phy_runtime_resume, NULL)
+};
+#define DEV_PM_OPS      (&am335x_pm_ops)
+#else
+#define DEV_PM_OPS      NULL
+#endif
 static const struct of_device_id am335x_phy_ids[] = {
        { .compatible = "ti,am335x-usb-phy" },
        { }
@@ -91,7 +124,8 @@ static struct platform_driver am335x_phy_driver = {
        .driver         = {
                .name   = "am335x-phy-driver",
                .owner  = THIS_MODULE,
-                .of_match_table = of_match_ptr(am335x_phy_ids),
+                .pm = DEV_PM_OPS,
+                .of_match_table = am335x_phy_ids,
        },
 };
diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
index fa7c9f9628b5..7f3c73b967ce 100644
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -134,7 +134,7 @@ int write_ulpi(u8 addr, u8 data)
 /* Operations that will be called from OTG Finite State Machine */
 /* Charge vbus for vbus pulsing in SRP */
-void fsl_otg_chrg_vbus(int on)
+void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
 {
        u32 tmp;
@@ -170,7 +170,7 @@ void fsl_otg_dischrg_vbus(int on)
 }
 /* A-device driver vbus, controlled through PP bit in PORTSC */
-void fsl_otg_drv_vbus(int on)
+void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
 {
        u32 tmp;
@@ -188,7 +188,7 @@ void fsl_otg_drv_vbus(int on)
 * Pull-up D+, signalling connect by periperal. Also used in
 * data-line pulsing in SRP
 */
-void fsl_otg_loc_conn(int on)
+void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
 {
        u32 tmp;
@@ -207,7 +207,7 @@ void fsl_otg_loc_conn(int on)
 * port.  In host mode, controller will automatically send SOF.
 * Suspend will block the data on the port.
 */
-void fsl_otg_loc_sof(int on)
+void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
 {
        u32 tmp;
@@ -222,7 +222,7 @@ void fsl_otg_loc_sof(int on)
 }
 /* Start SRP pulsing by data-line pulsing, followed with v-bus pulsing. */
-void fsl_otg_start_pulse(void)
+void fsl_otg_start_pulse(struct otg_fsm *fsm)
 {
        u32 tmp;
@@ -235,7 +235,7 @@ void fsl_otg_start_pulse(void)
        fsl_otg_loc_conn(1);
 #endif
-        fsl_otg_add_timer(b_data_pulse_tmr);
+        fsl_otg_add_timer(fsm, b_data_pulse_tmr);
 }
 void b_data_pulse_end(unsigned long foo)
@@ -252,14 +252,14 @@ void b_data_pulse_end(unsigned long foo)
 void fsl_otg_pulse_vbus(void)
 {
        srp_wait_done = 0;
-        fsl_otg_chrg_vbus(1);
+        fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 1);
        /* start the timer to end vbus charge */
-        fsl_otg_add_timer(b_vbus_pulse_tmr);
+        fsl_otg_add_timer(&fsl_otg_dev->fsm, b_vbus_pulse_tmr);
 }
 void b_vbus_pulse_end(unsigned long foo)
 {
-        fsl_otg_chrg_vbus(0);
+        fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 0);
        /*
         * As USB3300 using the same a_sess_vld and b_sess_vld voltage
@@ -267,7 +267,7 @@ void b_vbus_pulse_end(unsigned long foo)
         * residual voltage of vbus pulsing and A device pull up
         */
        fsl_otg_dischrg_vbus(1);
-        fsl_otg_add_timer(b_srp_wait_tmr);
+        fsl_otg_add_timer(&fsl_otg_dev->fsm, b_srp_wait_tmr);
 }
 void b_srp_end(unsigned long foo)
@@ -289,7 +289,7 @@ void a_wait_enum(unsigned long foo)
 {
        VDBG("a_wait_enum timeout\n");
        if (!fsl_otg_dev->phy.otg->host->b_hnp_enable)
-                fsl_otg_add_timer(a_wait_enum_tmr);
+                fsl_otg_add_timer(&fsl_otg_dev->fsm, a_wait_enum_tmr);
        else
                otg_statemachine(&fsl_otg_dev->fsm);
 }
@@ -375,8 +375,42 @@ void fsl_otg_uninit_timers(void)
        kfree(b_vbus_pulse_tmr);
 }
+static struct fsl_otg_timer *fsl_otg_get_timer(enum otg_fsm_timer t)
+{
+        struct fsl_otg_timer *timer;
+        /* REVISIT: use array of pointers to timers instead */
+        switch (t) {
+        case A_WAIT_VRISE:
+                timer = a_wait_vrise_tmr;
+                break;
+        case A_WAIT_BCON:
+                timer = a_wait_vrise_tmr;
+                break;
+        case A_AIDL_BDIS:
+                timer = a_wait_vrise_tmr;
+                break;
+        case B_ASE0_BRST:
+                timer = a_wait_vrise_tmr;
+                break;
+        case B_SE0_SRP:
+                timer = a_wait_vrise_tmr;
+                break;
+        case B_SRP_FAIL:
+                timer = a_wait_vrise_tmr;
+                break;
+        case A_WAIT_ENUM:
+                timer = a_wait_vrise_tmr;
+                break;
+        default:
+                timer = NULL;
+        }
+        return timer;
+}
 /* Add timer to timer list */
-void fsl_otg_add_timer(void *gtimer)
+void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
 {
        struct fsl_otg_timer *timer = gtimer;
        struct fsl_otg_timer *tmp_timer;
@@ -394,8 +428,19 @@ void fsl_otg_add_timer(void *gtimer)
        list_add_tail(&timer->list, &active_timers);
 }
+static void fsl_otg_fsm_add_timer(struct otg_fsm *fsm, enum otg_fsm_timer t)
+{
+        struct fsl_otg_timer *timer;
+        timer = fsl_otg_get_timer(t);
+        if (!timer)
+                return;
+        fsl_otg_add_timer(fsm, timer);
+}
 /* Remove timer from the timer list; clear timeout status */
-void fsl_otg_del_timer(void *gtimer)
+void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
 {
        struct fsl_otg_timer *timer = gtimer;
        struct fsl_otg_timer *tmp_timer, *del_tmp;
@@ -405,6 +450,17 @@ void fsl_otg_del_timer(void *gtimer)
                        list_del(&timer->list);
 }
+static void fsl_otg_fsm_del_timer(struct otg_fsm *fsm, enum otg_fsm_timer t)
+{
+        struct fsl_otg_timer *timer;
+        timer = fsl_otg_get_timer(t);
+        if (!timer)
+                return;
+        fsl_otg_del_timer(fsm, timer);
+}
 /*
 * Reduce timer count by 1, and find timeout conditions.
 * Called by fsl_otg 1ms timer interrupt
@@ -468,7 +524,7 @@ int fsl_otg_start_host(struct otg_fsm *fsm, int on)
                                retval = dev->driver->pm->resume(dev);
                                if (fsm->id) {
                                        /* default-b */
-                                        fsl_otg_drv_vbus(1);
+                                        fsl_otg_drv_vbus(fsm, 1);
                                        /*
                                         * Workaround: b_host can't driver
                                         * vbus, but PP in PORTSC needs to
@@ -493,7 +549,7 @@ int fsl_otg_start_host(struct otg_fsm *fsm, int on)
                                        retval = dev->driver->pm->suspend(dev);
                                if (fsm->id)
                                        /* default-b */
-                                        fsl_otg_drv_vbus(0);
+                                        fsl_otg_drv_vbus(fsm, 0);
                        }
                        otg_dev->host_working = 0;
                }
@@ -757,8 +813,8 @@ static struct otg_fsm_ops fsl_otg_ops = {
        .loc_sof = fsl_otg_loc_sof,
        .start_pulse = fsl_otg_start_pulse,
-        .add_timer = fsl_otg_add_timer,
+        .add_timer = fsl_otg_fsm_add_timer,
-        .del_timer = fsl_otg_del_timer,
+        .del_timer = fsl_otg_fsm_del_timer,
        .start_host = fsl_otg_start_host,
        .start_gadget = fsl_otg_start_gadget,
@@ -1011,7 +1067,7 @@ static int show_fsl_usb2_otg_state(struct device *dev,
                        "b_bus_suspend: %d\n"
                        "b_conn: %d\n"
                        "b_se0_srp: %d\n"
-                        "b_sess_end: %d\n"
+                        "b_ssend_srp: %d\n"
                        "b_sess_vld: %d\n"
                        "id: %d\n",
                        fsm->a_bus_req,
@@ -1026,7 +1082,7 @@ static int show_fsl_usb2_otg_state(struct device *dev,
                        fsm->b_bus_suspend,
                        fsm->b_conn,
                        fsm->b_se0_srp,
-                        fsm->b_sess_end,
+                        fsm->b_ssend_srp,
                        fsm->b_sess_vld,
                        fsm->id);
        size -= t;
@@ -1057,7 +1113,7 @@ static long fsl_otg_ioctl(struct file *file, unsigned int cmd,
                break;
        case SET_A_SUSPEND_REQ:
-                fsl_otg_dev->fsm.a_suspend_req = arg;
+                fsl_otg_dev->fsm.a_suspend_req_inf = arg;
                break;
        case SET_A_BUS_DROP:
diff --git a/drivers/usb/phy/phy-fsl-usb.h b/drivers/usb/phy/phy-fsl-usb.h
index e1859b8ef567..7365170a2f23 100644
--- a/drivers/usb/phy/phy-fsl-usb.h
+++ b/drivers/usb/phy/phy-fsl-usb.h
@@ -401,6 +401,6 @@ struct fsl_otg_config {
 #define GET_A_BUS_REQ           _IOR(OTG_IOCTL_MAGIC, 8, int)
 #define GET_B_BUS_REQ           _IOR(OTG_IOCTL_MAGIC, 9, int)
-void fsl_otg_add_timer(void *timer);
+void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_del_timer(void *timer);
+void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
 void fsl_otg_pulse_vbus(void);
diff --git a/drivers/usb/phy/phy-fsm-usb.c b/drivers/usb/phy/phy-fsm-usb.c
index 7f4596606e18..329c2d2f8595 100644
--- a/drivers/usb/phy/phy-fsm-usb.c
+++ b/drivers/usb/phy/phy-fsm-usb.c
@@ -41,17 +41,17 @@ static int otg_set_protocol(struct otg_fsm *fsm, int protocol)
                        fsm->protocol, protocol);
                /* stop old protocol */
                if (fsm->protocol == PROTO_HOST)
-                        ret = fsm->ops->start_host(fsm, 0);
+                        ret = otg_start_host(fsm, 0);
                else if (fsm->protocol == PROTO_GADGET)
-                        ret = fsm->ops->start_gadget(fsm, 0);
+                        ret = otg_start_gadget(fsm, 0);
                if (ret)
                        return ret;
                /* start new protocol */
                if (protocol == PROTO_HOST)
-                        ret = fsm->ops->start_host(fsm, 1);
+                        ret = otg_start_host(fsm, 1);
                else if (protocol == PROTO_GADGET)
-                        ret = fsm->ops->start_gadget(fsm, 1);
+                        ret = otg_start_gadget(fsm, 1);
                if (ret)
                        return ret;
@@ -69,42 +69,50 @@ void otg_leave_state(struct otg_fsm *fsm, enum usb_otg_state old_state)
 {
        switch (old_state) {
        case OTG_STATE_B_IDLE:
-                otg_del_timer(fsm, b_se0_srp_tmr);
+                otg_del_timer(fsm, B_SE0_SRP);
                fsm->b_se0_srp = 0;
+                fsm->adp_sns = 0;
+                fsm->adp_prb = 0;
                break;
        case OTG_STATE_B_SRP_INIT:
+                fsm->data_pulse = 0;
                fsm->b_srp_done = 0;
                break;
        case OTG_STATE_B_PERIPHERAL:
                break;
        case OTG_STATE_B_WAIT_ACON:
-                otg_del_timer(fsm, b_ase0_brst_tmr);
+                otg_del_timer(fsm, B_ASE0_BRST);
                fsm->b_ase0_brst_tmout = 0;
                break;
        case OTG_STATE_B_HOST:
                break;
        case OTG_STATE_A_IDLE:
+                fsm->adp_prb = 0;
                break;
        case OTG_STATE_A_WAIT_VRISE:
-                otg_del_timer(fsm, a_wait_vrise_tmr);
+                otg_del_timer(fsm, A_WAIT_VRISE);
                fsm->a_wait_vrise_tmout = 0;
                break;
        case OTG_STATE_A_WAIT_BCON:
-                otg_del_timer(fsm, a_wait_bcon_tmr);
+                otg_del_timer(fsm, A_WAIT_BCON);
                fsm->a_wait_bcon_tmout = 0;
                break;
        case OTG_STATE_A_HOST:
-                otg_del_timer(fsm, a_wait_enum_tmr);
+                otg_del_timer(fsm, A_WAIT_ENUM);
                break;
        case OTG_STATE_A_SUSPEND:
-                otg_del_timer(fsm, a_aidl_bdis_tmr);
+                otg_del_timer(fsm, A_AIDL_BDIS);
                fsm->a_aidl_bdis_tmout = 0;
-                fsm->a_suspend_req = 0;
+                fsm->a_suspend_req_inf = 0;
                break;
        case OTG_STATE_A_PERIPHERAL:
+                otg_del_timer(fsm, A_BIDL_ADIS);
+                fsm->a_bidl_adis_tmout = 0;
                break;
        case OTG_STATE_A_WAIT_VFALL:
-                otg_del_timer(fsm, a_wait_vrise_tmr);
+                otg_del_timer(fsm, A_WAIT_VFALL);
+                fsm->a_wait_vfall_tmout = 0;
+                otg_del_timer(fsm, A_WAIT_VRISE);
                break;
        case OTG_STATE_A_VBUS_ERR:
                break;
@@ -127,14 +135,19 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                otg_chrg_vbus(fsm, 0);
                otg_loc_conn(fsm, 0);
                otg_loc_sof(fsm, 0);
+                /*
+                 * Driver is responsible for starting ADP probing
+                 * if ADP sensing times out.
+                 */
+                otg_start_adp_sns(fsm);
                otg_set_protocol(fsm, PROTO_UNDEF);
-                otg_add_timer(fsm, b_se0_srp_tmr);
+                otg_add_timer(fsm, B_SE0_SRP);
                break;
        case OTG_STATE_B_SRP_INIT:
                otg_start_pulse(fsm);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_UNDEF);
-                otg_add_timer(fsm, b_srp_fail_tmr);
+                otg_add_timer(fsm, B_SRP_FAIL);
                break;
        case OTG_STATE_B_PERIPHERAL:
                otg_chrg_vbus(fsm, 0);
@@ -147,7 +160,7 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                otg_loc_conn(fsm, 0);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_HOST);
-                otg_add_timer(fsm, b_ase0_brst_tmr);
+                otg_add_timer(fsm, B_ASE0_BRST);
                fsm->a_bus_suspend = 0;
                break;
        case OTG_STATE_B_HOST:
@@ -163,6 +176,7 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                otg_chrg_vbus(fsm, 0);
                otg_loc_conn(fsm, 0);
                otg_loc_sof(fsm, 0);
+                otg_start_adp_prb(fsm);
                otg_set_protocol(fsm, PROTO_HOST);
                break;
        case OTG_STATE_A_WAIT_VRISE:
@@ -170,14 +184,14 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                otg_loc_conn(fsm, 0);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_HOST);
-                otg_add_timer(fsm, a_wait_vrise_tmr);
+                otg_add_timer(fsm, A_WAIT_VRISE);
                break;
        case OTG_STATE_A_WAIT_BCON:
                otg_drv_vbus(fsm, 1);
                otg_loc_conn(fsm, 0);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_HOST);
-                otg_add_timer(fsm, a_wait_bcon_tmr);
+                otg_add_timer(fsm, A_WAIT_BCON);
                break;
        case OTG_STATE_A_HOST:
                otg_drv_vbus(fsm, 1);
@@ -188,15 +202,15 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                 * When HNP is triggered while a_bus_req = 0, a_host will
                 * suspend too fast to complete a_set_b_hnp_en
                 */
-                if (!fsm->a_bus_req || fsm->a_suspend_req)
+                if (!fsm->a_bus_req || fsm->a_suspend_req_inf)
-                        otg_add_timer(fsm, a_wait_enum_tmr);
+                        otg_add_timer(fsm, A_WAIT_ENUM);
                break;
        case OTG_STATE_A_SUSPEND:
                otg_drv_vbus(fsm, 1);
                otg_loc_conn(fsm, 0);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_HOST);
-                otg_add_timer(fsm, a_aidl_bdis_tmr);
+                otg_add_timer(fsm, A_AIDL_BDIS);
                break;
        case OTG_STATE_A_PERIPHERAL:
@@ -204,12 +218,14 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_GADGET);
                otg_drv_vbus(fsm, 1);
+                otg_add_timer(fsm, A_BIDL_ADIS);
                break;
        case OTG_STATE_A_WAIT_VFALL:
                otg_drv_vbus(fsm, 0);
                otg_loc_conn(fsm, 0);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_HOST);
+                otg_add_timer(fsm, A_WAIT_VFALL);
                break;
        case OTG_STATE_A_VBUS_ERR:
                otg_drv_vbus(fsm, 0);
@@ -250,7 +266,8 @@ int otg_statemachine(struct otg_fsm *fsm)
                        otg_set_state(fsm, OTG_STATE_A_IDLE);
                else if (fsm->b_sess_vld && fsm->otg->gadget)
                        otg_set_state(fsm, OTG_STATE_B_PERIPHERAL);
-                else if (fsm->b_bus_req && fsm->b_sess_end && fsm->b_se0_srp)
+                else if ((fsm->b_bus_req || fsm->adp_change || fsm->power_up) &&
+                                fsm->b_ssend_srp && fsm->b_se0_srp)
                        otg_set_state(fsm, OTG_STATE_B_SRP_INIT);
                break;
        case OTG_STATE_B_SRP_INIT:
@@ -277,13 +294,14 @@ int otg_statemachine(struct otg_fsm *fsm)
        case OTG_STATE_B_HOST:
                if (!fsm->id || !fsm->b_sess_vld)
                        otg_set_state(fsm, OTG_STATE_B_IDLE);
-                else if (!fsm->b_bus_req || !fsm->a_conn)
+                else if (!fsm->b_bus_req || !fsm->a_conn || fsm->test_device)
                        otg_set_state(fsm, OTG_STATE_B_PERIPHERAL);
                break;
        case OTG_STATE_A_IDLE:
                if (fsm->id)
                        otg_set_state(fsm, OTG_STATE_B_IDLE);
-                else if (!fsm->a_bus_drop && (fsm->a_bus_req || fsm->a_srp_det))
+                else if (!fsm->a_bus_drop && (fsm->a_bus_req ||
+                          fsm->a_srp_det || fsm->adp_change || fsm->power_up))
                        otg_set_state(fsm, OTG_STATE_A_WAIT_VRISE);
                break;
        case OTG_STATE_A_WAIT_VRISE:
@@ -301,7 +319,7 @@ int otg_statemachine(struct otg_fsm *fsm)
                        otg_set_state(fsm, OTG_STATE_A_WAIT_VFALL);
                break;
        case OTG_STATE_A_HOST:
-                if ((!fsm->a_bus_req || fsm->a_suspend_req) &&
+                if ((!fsm->a_bus_req || fsm->a_suspend_req_inf) &&
                                fsm->otg->host->b_hnp_enable)
                        otg_set_state(fsm, OTG_STATE_A_SUSPEND);
                else if (fsm->id || !fsm->b_conn || fsm->a_bus_drop)
@@ -324,14 +342,14 @@ int otg_statemachine(struct otg_fsm *fsm)
        case OTG_STATE_A_PERIPHERAL:
                if (fsm->id || fsm->a_bus_drop)
                        otg_set_state(fsm, OTG_STATE_A_WAIT_VFALL);
-                else if (fsm->b_bus_suspend)
+                else if (fsm->a_bidl_adis_tmout || fsm->b_bus_suspend)
                        otg_set_state(fsm, OTG_STATE_A_WAIT_BCON);
                else if (!fsm->a_vbus_vld)
                        otg_set_state(fsm, OTG_STATE_A_VBUS_ERR);
                break;
        case OTG_STATE_A_WAIT_VFALL:
-                if (fsm->id || fsm->a_bus_req || (!fsm->a_sess_vld &&
+                if (fsm->a_wait_vfall_tmout || fsm->id || fsm->a_bus_req ||
-                                        !fsm->b_conn))
+                                (!fsm->a_sess_vld && !fsm->b_conn))
                        otg_set_state(fsm, OTG_STATE_A_IDLE);
                break;
        case OTG_STATE_A_VBUS_ERR:
diff --git a/drivers/usb/phy/phy-fsm-usb.h b/drivers/usb/phy/phy-fsm-usb.h
index fbe586206f33..7441b46a27f1 100644
--- a/drivers/usb/phy/phy-fsm-usb.h
+++ b/drivers/usb/phy/phy-fsm-usb.h
@@ -34,45 +34,76 @@
 #define PROTO_HOST      (1)
 #define PROTO_GADGET    (2)
+enum otg_fsm_timer {
+        /* Standard OTG timers */
+        A_WAIT_VRISE,
+        A_WAIT_VFALL,
+        A_WAIT_BCON,
+        A_AIDL_BDIS,
+        B_ASE0_BRST,
+        A_BIDL_ADIS,
+        /* Auxiliary timers */
+        B_SE0_SRP,
+        B_SRP_FAIL,
+        A_WAIT_ENUM,
+        NUM_OTG_FSM_TIMERS,
+};
 /* OTG state machine according to the OTG spec */
 struct otg_fsm {
        /* Input */
+        int id;
+        int adp_change;
+        int power_up;
+        int test_device;
+        int a_bus_drop;
+        int a_bus_req;
+        int a_srp_det;
+        int a_vbus_vld;
+        int b_conn;
        int a_bus_resume;
        int a_bus_suspend;
        int a_conn;
+        int b_bus_req;
+        int b_se0_srp;
+        int b_ssend_srp;
+        int b_sess_vld;
+        /* Auxilary inputs */
        int a_sess_vld;
-        int a_srp_det;
-        int a_vbus_vld;
        int b_bus_resume;
        int b_bus_suspend;
-        int b_conn;
-        int b_se0_srp;
+        /* Output */
-        int b_sess_end;
+        int data_pulse;
-        int b_sess_vld;
+        int drv_vbus;
-        int id;
+        int loc_conn;
+        int loc_sof;
+        int adp_prb;
+        int adp_sns;
        /* Internal variables */
        int a_set_b_hnp_en;
        int b_srp_done;
        int b_hnp_enable;
+        int a_clr_err;
+        /* Informative variables */
+        int a_bus_drop_inf;
+        int a_bus_req_inf;
+        int a_clr_err_inf;
+        int b_bus_req_inf;
+        /* Auxilary informative variables */
+        int a_suspend_req_inf;
        /* Timeout indicator for timers */
        int a_wait_vrise_tmout;
+        int a_wait_vfall_tmout;
        int a_wait_bcon_tmout;
        int a_aidl_bdis_tmout;
        int b_ase0_brst_tmout;
+        int a_bidl_adis_tmout;
-        /* Informative variables */
-        int a_bus_drop;
-        int a_bus_req;
-        int a_clr_err;
-        int a_suspend_req;
-        int b_bus_req;
-        /* Output */
-        int drv_vbus;
-        int loc_conn;
-        int loc_sof;
        struct otg_fsm_ops *ops;
        struct usb_otg *otg;
@@ -83,65 +114,123 @@ struct otg_fsm {
 };
 struct otg_fsm_ops {
-        void    (*chrg_vbus)(int on);
+        void    (*chrg_vbus)(struct otg_fsm *fsm, int on);
-        void    (*drv_vbus)(int on);
+        void    (*drv_vbus)(struct otg_fsm *fsm, int on);
-        void    (*loc_conn)(int on);
+        void    (*loc_conn)(struct otg_fsm *fsm, int on);
-        void    (*loc_sof)(int on);
+        void    (*loc_sof)(struct otg_fsm *fsm, int on);
-        void    (*start_pulse)(void);
+        void    (*start_pulse)(struct otg_fsm *fsm);
-        void    (*add_timer)(void *timer);
+        void    (*start_adp_prb)(struct otg_fsm *fsm);
-        void    (*del_timer)(void *timer);
+        void    (*start_adp_sns)(struct otg_fsm *fsm);
+        void    (*add_timer)(struct otg_fsm *fsm, enum otg_fsm_timer timer);
+        void    (*del_timer)(struct otg_fsm *fsm, enum otg_fsm_timer timer);
        int     (*start_host)(struct otg_fsm *fsm, int on);
        int     (*start_gadget)(struct otg_fsm *fsm, int on);
 };
-static inline void otg_chrg_vbus(struct otg_fsm *fsm, int on)
+static inline int otg_chrg_vbus(struct otg_fsm *fsm, int on)
 {
-        fsm->ops->chrg_vbus(on);
+        if (!fsm->ops->chrg_vbus)
+                return -EOPNOTSUPP;
+        fsm->ops->chrg_vbus(fsm, on);
+        return 0;
 }
-static inline void otg_drv_vbus(struct otg_fsm *fsm, int on)
+static inline int otg_drv_vbus(struct otg_fsm *fsm, int on)
 {
+        if (!fsm->ops->drv_vbus)
+                return -EOPNOTSUPP;
        if (fsm->drv_vbus != on) {
                fsm->drv_vbus = on;
-                fsm->ops->drv_vbus(on);
+                fsm->ops->drv_vbus(fsm, on);
        }
+        return 0;
 }
-static inline void otg_loc_conn(struct otg_fsm *fsm, int on)
+static inline int otg_loc_conn(struct otg_fsm *fsm, int on)
 {
+        if (!fsm->ops->loc_conn)
+                return -EOPNOTSUPP;
        if (fsm->loc_conn != on) {
                fsm->loc_conn = on;
-                fsm->ops->loc_conn(on);
+                fsm->ops->loc_conn(fsm, on);
        }
+        return 0;
 }
-static inline void otg_loc_sof(struct otg_fsm *fsm, int on)
+static inline int otg_loc_sof(struct otg_fsm *fsm, int on)
 {
+        if (!fsm->ops->loc_sof)
+                return -EOPNOTSUPP;
        if (fsm->loc_sof != on) {
                fsm->loc_sof = on;
-                fsm->ops->loc_sof(on);
+                fsm->ops->loc_sof(fsm, on);
+        }
+        return 0;
+}
+static inline int otg_start_pulse(struct otg_fsm *fsm)
+{
+        if (!fsm->ops->start_pulse)
+                return -EOPNOTSUPP;
+        if (!fsm->data_pulse) {
+                fsm->data_pulse = 1;
+                fsm->ops->start_pulse(fsm);
        }
+        return 0;
 }
-static inline void otg_start_pulse(struct otg_fsm *fsm)
+static inline int otg_start_adp_prb(struct otg_fsm *fsm)
 {
-        fsm->ops->start_pulse();
+        if (!fsm->ops->start_adp_prb)
+                return -EOPNOTSUPP;
+        if (!fsm->adp_prb) {
+                fsm->adp_sns = 0;
+                fsm->adp_prb = 1;
+                fsm->ops->start_adp_prb(fsm);
+        }
+        return 0;
 }
-static inline void otg_add_timer(struct otg_fsm *fsm, void *timer)
+static inline int otg_start_adp_sns(struct otg_fsm *fsm)
 {
-        fsm->ops->add_timer(timer);
+        if (!fsm->ops->start_adp_sns)
+                return -EOPNOTSUPP;
+        if (!fsm->adp_sns) {
+                fsm->adp_sns = 1;
+                fsm->ops->start_adp_sns(fsm);
+        }
+        return 0;
 }
-static inline void otg_del_timer(struct otg_fsm *fsm, void *timer)
+static inline int otg_add_timer(struct otg_fsm *fsm, enum otg_fsm_timer timer)
 {
-        fsm->ops->del_timer(timer);
+        if (!fsm->ops->add_timer)
+                return -EOPNOTSUPP;
+        fsm->ops->add_timer(fsm, timer);
+        return 0;
 }
-int otg_statemachine(struct otg_fsm *fsm);
+static inline int otg_del_timer(struct otg_fsm *fsm, enum otg_fsm_timer timer)
+{
+        if (!fsm->ops->del_timer)
+                return -EOPNOTSUPP;
+        fsm->ops->del_timer(fsm, timer);
+        return 0;
+}
-/* Defined by device specific driver, for different timer implementation */
+static inline int otg_start_host(struct otg_fsm *fsm, int on)
-extern struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr,
+{
-        *a_aidl_bdis_tmr, *b_ase0_brst_tmr, *b_se0_srp_tmr, *b_srp_fail_tmr,
+        if (!fsm->ops->start_host)
-        *a_wait_enum_tmr;
+                return -EOPNOTSUPP;
+        return fsm->ops->start_host(fsm, on);
+}
+static inline int otg_start_gadget(struct otg_fsm *fsm, int on)
+{
+        if (!fsm->ops->start_gadget)
+                return -EOPNOTSUPP;
+        return fsm->ops->start_gadget(fsm, on);
+}
+int otg_statemachine(struct otg_fsm *fsm);
diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
index efe59f3f7fda..fce3a9e9bb5d 100644
--- a/drivers/usb/phy/phy-generic.c
+++ b/drivers/usb/phy/phy-generic.c
@@ -35,6 +35,9 @@
 #include <linux/clk.h>
 #include <linux/regulator/consumer.h>
 #include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/gpio.h>
+#include <linux/delay.h>
 #include "phy-generic.h"
@@ -64,6 +67,23 @@ static int nop_set_suspend(struct usb_phy *x, int suspend)
        return 0;
 }
+static void nop_reset_set(struct usb_phy_gen_xceiv *nop, int asserted)
+{
+        int value;
+        if (!gpio_is_valid(nop->gpio_reset))
+                return;
+        value = asserted;
+        if (nop->reset_active_low)
+                value = !value;
+        gpio_set_value_cansleep(nop->gpio_reset, value);
+        if (!asserted)
+                usleep_range(10000, 20000);
+}
 int usb_gen_phy_init(struct usb_phy *phy)
 {
        struct usb_phy_gen_xceiv *nop = dev_get_drvdata(phy->dev);
@@ -74,13 +94,10 @@ int usb_gen_phy_init(struct usb_phy *phy)
        }
        if (!IS_ERR(nop->clk))
-                clk_enable(nop->clk);
+                clk_prepare_enable(nop->clk);
-        if (!IS_ERR(nop->reset)) {
+        /* De-assert RESET */
-                /* De-assert RESET */
+        nop_reset_set(nop, 0);
-                if (regulator_enable(nop->reset))
-                        dev_err(phy->dev, "Failed to de-assert reset\n");
-        }
        return 0;
 }
@@ -90,14 +107,11 @@ void usb_gen_phy_shutdown(struct usb_phy *phy)
 {
        struct usb_phy_gen_xceiv *nop = dev_get_drvdata(phy->dev);
-        if (!IS_ERR(nop->reset)) {
+        /* Assert RESET */
-                /* Assert RESET */
+        nop_reset_set(nop, 1);
-                if (regulator_disable(nop->reset))
-                        dev_err(phy->dev, "Failed to assert reset\n");
-        }
        if (!IS_ERR(nop->clk))
-                clk_disable(nop->clk);
+                clk_disable_unprepare(nop->clk);
        if (!IS_ERR(nop->vcc)) {
                if (regulator_disable(nop->vcc))
@@ -136,8 +150,7 @@ static int nop_set_host(struct usb_otg *otg, struct usb_bus *host)
 }
 int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
-                enum usb_phy_type type, u32 clk_rate, bool needs_vcc,
+                enum usb_phy_type type, u32 clk_rate, bool needs_vcc)
-                bool needs_reset)
 {
        int err;
@@ -160,14 +173,6 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
                }
        }
-        if (!IS_ERR(nop->clk)) {
-                err = clk_prepare(nop->clk);
-                if (err) {
-                        dev_err(dev, "Error preparing clock\n");
-                        return err;
-                }
-        }
        nop->vcc = devm_regulator_get(dev, "vcc");
        if (IS_ERR(nop->vcc)) {
                dev_dbg(dev, "Error getting vcc regulator: %ld\n",
@@ -176,12 +181,22 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
                        return -EPROBE_DEFER;
        }
-        nop->reset = devm_regulator_get(dev, "reset");
+        if (gpio_is_valid(nop->gpio_reset)) {
-        if (IS_ERR(nop->reset)) {
+                unsigned long gpio_flags;
-                dev_dbg(dev, "Error getting reset regulator: %ld\n",
-                                        PTR_ERR(nop->reset));
+                /* Assert RESET */
-                if (needs_reset)
+                if (nop->reset_active_low)
-                        return -EPROBE_DEFER;
+                        gpio_flags = GPIOF_OUT_INIT_LOW;
+                else
+                        gpio_flags = GPIOF_OUT_INIT_HIGH;
+                err = devm_gpio_request_one(dev, nop->gpio_reset,
+                                                gpio_flags, dev_name(dev));
+                if (err) {
+                        dev_err(dev, "Error requesting RESET GPIO %d\n",
+                                        nop->gpio_reset);
+                        return err;
+                }
        }
        nop->dev                = dev;
@@ -200,13 +215,6 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
 }
 EXPORT_SYMBOL_GPL(usb_phy_gen_create_phy);
-void usb_phy_gen_cleanup_phy(struct usb_phy_gen_xceiv *nop)
-{
-        if (!IS_ERR(nop->clk))
-                clk_unprepare(nop->clk);
-}
-EXPORT_SYMBOL_GPL(usb_phy_gen_cleanup_phy);
 static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
@@ -217,31 +225,36 @@ static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
        int err;
        u32 clk_rate = 0;
        bool needs_vcc = false;
-        bool needs_reset = false;
+        nop = devm_kzalloc(dev, sizeof(*nop), GFP_KERNEL);
+        if (!nop)
+                return -ENOMEM;
+        nop->reset_active_low = true;   /* default behaviour */
        if (dev->of_node) {
                struct device_node *node = dev->of_node;
+                enum of_gpio_flags flags;
                if (of_property_read_u32(node, "clock-frequency", &clk_rate))
                        clk_rate = 0;
                needs_vcc = of_property_read_bool(node, "vcc-supply");
-                needs_reset = of_property_read_bool(node, "reset-supply");
+                nop->gpio_reset = of_get_named_gpio_flags(node, "reset-gpios",
+                                                                0, &flags);
+                if (nop->gpio_reset == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+                nop->reset_active_low = flags & OF_GPIO_ACTIVE_LOW;
        } else if (pdata) {
                type = pdata->type;
                clk_rate = pdata->clk_rate;
                needs_vcc = pdata->needs_vcc;
-                needs_reset = pdata->needs_reset;
+                nop->gpio_reset = pdata->gpio_reset;
        }
-        nop = devm_kzalloc(dev, sizeof(*nop), GFP_KERNEL);
+        err = usb_phy_gen_create_phy(dev, nop, type, clk_rate, needs_vcc);
-        if (!nop)
-                return -ENOMEM;
-        err = usb_phy_gen_create_phy(dev, nop, type, clk_rate, needs_vcc,
-                        needs_reset);
        if (err)
                return err;
@@ -252,15 +265,13 @@ static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
        if (err) {
                dev_err(&pdev->dev, "can't register transceiver, err: %d\n",
                        err);
-                goto err_add;
+                return err;
        }
        platform_set_drvdata(pdev, nop);
        return 0;
-err_add:
-        usb_phy_gen_cleanup_phy(nop);
        return err;
 }
@@ -268,7 +279,6 @@ static int usb_phy_gen_xceiv_remove(struct platform_device *pdev)
 {
        struct usb_phy_gen_xceiv *nop = platform_get_drvdata(pdev);
-        usb_phy_gen_cleanup_phy(nop);
        usb_remove_phy(&nop->phy);
        return 0;
diff --git a/drivers/usb/phy/phy-generic.h b/drivers/usb/phy/phy-generic.h
index 61687d5a965b..d2a220d81734 100644
--- a/drivers/usb/phy/phy-generic.h
+++ b/drivers/usb/phy/phy-generic.h
@@ -6,15 +6,14 @@ struct usb_phy_gen_xceiv {
        struct device *dev;
        struct clk *clk;
        struct regulator *vcc;
-        struct regulator *reset;
+        int gpio_reset;
+        bool reset_active_low;
 };
 int usb_gen_phy_init(struct usb_phy *phy);
 void usb_gen_phy_shutdown(struct usb_phy *phy);
 int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
-                enum usb_phy_type type, u32 clk_rate, bool needs_vcc,
+                enum usb_phy_type type, u32 clk_rate, bool needs_vcc);
-                bool needs_reset);
-void usb_phy_gen_cleanup_phy(struct usb_phy_gen_xceiv *nop);
 #endif
diff --git a/drivers/usb/phy/phy-omap-control.c b/drivers/usb/phy/phy-omap-control.c
index a4dda8e12562..09c5ace1edd8 100644
--- a/drivers/usb/phy/phy-omap-control.c
+++ b/drivers/usb/phy/phy-omap-control.c
@@ -20,87 +20,77 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/err.h>
 #include <linux/io.h>
 #include <linux/clk.h>
 #include <linux/usb/omap_control_usb.h>
-static struct omap_control_usb *control_usb;
-/**
- * omap_get_control_dev - returns the device pointer for this control device
- *
- * This API should be called to get the device pointer for this control
- * module device. This device pointer should be used for called other
- * exported API's in this driver.
- *
- * To be used by PHY driver and glue driver.
- */
-struct device *omap_get_control_dev(void)
-{
-        if (!control_usb)
-                return ERR_PTR(-ENODEV);
-        return control_usb->dev;
-}
-EXPORT_SYMBOL_GPL(omap_get_control_dev);
 /**
- * omap_control_usb3_phy_power - power on/off the serializer using control
+ * omap_control_usb_phy_power - power on/off the phy using control module reg
- *      module
 * @dev: the control module device
- * @on: 0 to off and 1 to on based on powering on or off the PHY
+ * @on: 0 or 1, based on powering on or off the PHY
- *
- * usb3 PHY driver should call this API to power on or off the PHY.
 */
-void omap_control_usb3_phy_power(struct device *dev, bool on)
+void omap_control_usb_phy_power(struct device *dev, int on)
 {
        u32 val;
        unsigned long rate;
-        struct omap_control_usb *control_usb = dev_get_drvdata(dev);
+        struct omap_control_usb *control_usb;
-        if (control_usb->type != OMAP_CTRL_DEV_TYPE2)
+        if (IS_ERR(dev) || !dev) {
+                pr_err("%s: invalid device\n", __func__);
                return;
+        }
-        rate = clk_get_rate(control_usb->sys_clk);
+        control_usb = dev_get_drvdata(dev);
-        rate = rate/1000000;
+        if (!control_usb) {
+                dev_err(dev, "%s: invalid control usb device\n", __func__);
-        val = readl(control_usb->phy_power);
+                return;
-        if (on) {
-                val &= ~(OMAP_CTRL_USB_PWRCTL_CLK_CMD_MASK |
-                        OMAP_CTRL_USB_PWRCTL_CLK_FREQ_MASK);
-                val |= OMAP_CTRL_USB3_PHY_TX_RX_POWERON <<
-                        OMAP_CTRL_USB_PWRCTL_CLK_CMD_SHIFT;
-                val |= rate << OMAP_CTRL_USB_PWRCTL_CLK_FREQ_SHIFT;
-        } else {
-                val &= ~OMAP_CTRL_USB_PWRCTL_CLK_CMD_MASK;
-                val |= OMAP_CTRL_USB3_PHY_TX_RX_POWEROFF <<
-                        OMAP_CTRL_USB_PWRCTL_CLK_CMD_SHIFT;
        }
-        writel(val, control_usb->phy_power);
+        if (control_usb->type == OMAP_CTRL_TYPE_OTGHS)
-}
+                return;
-EXPORT_SYMBOL_GPL(omap_control_usb3_phy_power);
-/**
+        val = readl(control_usb->power);
- * omap_control_usb_phy_power - power on/off the phy using control module reg
- * @dev: the control module device
- * @on: 0 or 1, based on powering on or off the PHY
- */
-void omap_control_usb_phy_power(struct device *dev, int on)
-{
-        u32 val;
-        struct omap_control_usb *control_usb = dev_get_drvdata(dev);
-        val = readl(control_usb->dev_conf);
+        switch (control_usb->type) {
+        case OMAP_CTRL_TYPE_USB2:
+                if (on)
+                        val &= ~OMAP_CTRL_DEV_PHY_PD;
+                else
+                        val |= OMAP_CTRL_DEV_PHY_PD;
+                break;
-        if (on)
+        case OMAP_CTRL_TYPE_PIPE3:
-                val &= ~OMAP_CTRL_DEV_PHY_PD;
+                rate = clk_get_rate(control_usb->sys_clk);
-        else
+                rate = rate/1000000;
-                val |= OMAP_CTRL_DEV_PHY_PD;
+                if (on) {
+                        val &= ~(OMAP_CTRL_USB_PWRCTL_CLK_CMD_MASK |
+                                        OMAP_CTRL_USB_PWRCTL_CLK_FREQ_MASK);
+                        val |= OMAP_CTRL_USB3_PHY_TX_RX_POWERON <<
+                                OMAP_CTRL_USB_PWRCTL_CLK_CMD_SHIFT;
+                        val |= rate << OMAP_CTRL_USB_PWRCTL_CLK_FREQ_SHIFT;
+                } else {
+                        val &= ~OMAP_CTRL_USB_PWRCTL_CLK_CMD_MASK;
+                        val |= OMAP_CTRL_USB3_PHY_TX_RX_POWEROFF <<
+                                OMAP_CTRL_USB_PWRCTL_CLK_CMD_SHIFT;
+                }
+                break;
-        writel(val, control_usb->dev_conf);
+        case OMAP_CTRL_TYPE_DRA7USB2:
+                if (on)
+                        val &= ~OMAP_CTRL_USB2_PHY_PD;
+                else
+                        val |= OMAP_CTRL_USB2_PHY_PD;
+                break;
+        default:
+                dev_err(dev, "%s: type %d not recognized\n",
+                                        __func__, control_usb->type);
+                break;
+        }
+        writel(val, control_usb->power);
 }
 EXPORT_SYMBOL_GPL(omap_control_usb_phy_power);
@@ -172,11 +162,19 @@ void omap_control_usb_set_mode(struct device *dev,
 {
        struct omap_control_usb *ctrl_usb;
-        if (IS_ERR(dev) || control_usb->type != OMAP_CTRL_DEV_TYPE1)
+        if (IS_ERR(dev) || !dev)
                return;
        ctrl_usb = dev_get_drvdata(dev);
+        if (!ctrl_usb) {
+                dev_err(dev, "Invalid control usb device\n");
+                return;
+        }
+        if (ctrl_usb->type != OMAP_CTRL_TYPE_OTGHS)
+                return;
        switch (mode) {
        case USB_MODE_HOST:
                omap_control_usb_host_mode(ctrl_usb);
@@ -193,12 +191,46 @@ void omap_control_usb_set_mode(struct device *dev,
 }
 EXPORT_SYMBOL_GPL(omap_control_usb_set_mode);
+#ifdef CONFIG_OF
+static const enum omap_control_usb_type otghs_data = OMAP_CTRL_TYPE_OTGHS;
+static const enum omap_control_usb_type usb2_data = OMAP_CTRL_TYPE_USB2;
+static const enum omap_control_usb_type pipe3_data = OMAP_CTRL_TYPE_PIPE3;
+static const enum omap_control_usb_type dra7usb2_data = OMAP_CTRL_TYPE_DRA7USB2;
+static const struct of_device_id omap_control_usb_id_table[] = {
+        {
+                .compatible = "ti,control-phy-otghs",
+                .data = &otghs_data,
+        },
+        {
+                .compatible = "ti,control-phy-usb2",
+                .data = &usb2_data,
+        },
+        {
+                .compatible = "ti,control-phy-pipe3",
+                .data = &pipe3_data,
+        },
+        {
+                .compatible = "ti,control-phy-dra7usb2",
+                .data = &dra7usb2_data,
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, omap_control_usb_id_table);
+#endif
 static int omap_control_usb_probe(struct platform_device *pdev)
 {
        struct resource *res;
-        struct device_node *np = pdev->dev.of_node;
+        const struct of_device_id *of_id;
-        struct omap_control_usb_platform_data *pdata =
+        struct omap_control_usb *control_usb;
-                        dev_get_platdata(&pdev->dev);
+        of_id = of_match_device(of_match_ptr(omap_control_usb_id_table),
+                                                                &pdev->dev);
+        if (!of_id)
+                return -EINVAL;
        control_usb = devm_kzalloc(&pdev->dev, sizeof(*control_usb),
                GFP_KERNEL);
@@ -207,40 +239,27 @@ static int omap_control_usb_probe(struct platform_device *pdev)
                return -ENOMEM;
        }
-        if (np) {
+        control_usb->dev = &pdev->dev;
-                of_property_read_u32(np, "ti,type", &control_usb->type);
+        control_usb->type = *(enum omap_control_usb_type *)of_id->data;
-        } else if (pdata) {
-                control_usb->type = pdata->type;
-        } else {
-                dev_err(&pdev->dev, "no pdata present\n");
-                return -EINVAL;
-        }
-        control_usb->dev        = &pdev->dev;
-        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
-                "control_dev_conf");
-        control_usb->dev_conf = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(control_usb->dev_conf))
-                return PTR_ERR(control_usb->dev_conf);
-        if (control_usb->type == OMAP_CTRL_DEV_TYPE1) {
+        if (control_usb->type == OMAP_CTRL_TYPE_OTGHS) {
                res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                        "otghs_control");
                control_usb->otghs_control = devm_ioremap_resource(
                        &pdev->dev, res);
                if (IS_ERR(control_usb->otghs_control))
                        return PTR_ERR(control_usb->otghs_control);
-        }
+        } else {
-        if (control_usb->type == OMAP_CTRL_DEV_TYPE2) {
                res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
-                        "phy_power_usb");
+                                "power");
-                control_usb->phy_power = devm_ioremap_resource(
+                control_usb->power = devm_ioremap_resource(&pdev->dev, res);
-                        &pdev->dev, res);
+                if (IS_ERR(control_usb->power)) {
-                if (IS_ERR(control_usb->phy_power))
+                        dev_err(&pdev->dev, "Couldn't get power register\n");
-                        return PTR_ERR(control_usb->phy_power);
+                        return PTR_ERR(control_usb->power);
+                }
+        }
+        if (control_usb->type == OMAP_CTRL_TYPE_PIPE3) {
                control_usb->sys_clk = devm_clk_get(control_usb->dev,
                        "sys_clkin");
                if (IS_ERR(control_usb->sys_clk)) {
@@ -249,20 +268,11 @@ static int omap_control_usb_probe(struct platform_device *pdev)
                }
        }
        dev_set_drvdata(control_usb->dev, control_usb);
        return 0;
 }
-#ifdef CONFIG_OF
-static const struct of_device_id omap_control_usb_id_table[] = {
-        { .compatible = "ti,omap-control-usb" },
-        {}
-};
-MODULE_DEVICE_TABLE(of, omap_control_usb_id_table);
-#endif
 static struct platform_driver omap_control_usb_driver = {
        .probe          = omap_control_usb_probe,
        .driver         = {
diff --git a/drivers/usb/phy/phy-omap-usb3.c b/drivers/usb/phy/phy-omap-usb3.c
index 4e8a0405f956..0c6ba29bdddd 100644
--- a/drivers/usb/phy/phy-omap-usb3.c
+++ b/drivers/usb/phy/phy-omap-usb3.c
@@ -26,6 +26,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/delay.h>
 #include <linux/usb/omap_control_usb.h>
+#include <linux/of_platform.h>
 #define PLL_STATUS              0x00000004
 #define PLL_GO                  0x00000008
@@ -100,7 +101,7 @@ static int omap_usb3_suspend(struct usb_phy *x, int suspend)
                        udelay(1);
                } while (--timeout);
-                omap_control_usb3_phy_power(phy->control_dev, 0);
+                omap_control_usb_phy_power(phy->control_dev, 0);
                phy->is_suspended       = 1;
        } else if (!suspend && phy->is_suspended) {
@@ -189,15 +190,21 @@ static int omap_usb3_init(struct usb_phy *x)
        if (ret)
                return ret;
-        omap_control_usb3_phy_power(phy->control_dev, 1);
+        omap_control_usb_phy_power(phy->control_dev, 1);
        return 0;
 }
 static int omap_usb3_probe(struct platform_device *pdev)
 {
-        struct omap_usb                 *phy;
+        struct omap_usb *phy;
-        struct resource                 *res;
+        struct resource *res;
+        struct device_node *node = pdev->dev.of_node;
+        struct device_node *control_node;
+        struct platform_device *control_pdev;
+        if (!node)
+                return -EINVAL;
        phy = devm_kzalloc(&pdev->dev, sizeof(*phy), GFP_KERNEL);
        if (!phy) {
@@ -239,13 +246,20 @@ static int omap_usb3_probe(struct platform_device *pdev)
                return -EINVAL;
        }
-        phy->control_dev = omap_get_control_dev();
+        control_node = of_parse_phandle(node, "ctrl-module", 0);
-        if (IS_ERR(phy->control_dev)) {
+        if (!control_node) {
-                dev_dbg(&pdev->dev, "Failed to get control device\n");
+                dev_err(&pdev->dev, "Failed to get control device phandle\n");
-                return -ENODEV;
+                return -EINVAL;
        }
+        control_pdev = of_find_device_by_node(control_node);
+        if (!control_pdev) {
+                dev_err(&pdev->dev, "Failed to get control device\n");
+                return -EINVAL;
+        }
+        phy->control_dev = &control_pdev->dev;
-        omap_control_usb3_phy_power(phy->control_dev, 0);
+        omap_control_usb_phy_power(phy->control_dev, 0);
        usb_add_phy_dev(&phy->phy);
        platform_set_drvdata(pdev, phy);
diff --git a/drivers/usb/phy/phy-rcar-gen2-usb.c b/drivers/usb/phy/phy-rcar-gen2-usb.c
new file mode 100644
index 000000000000..a99a6953f11c
--- /dev/null
+++ b/drivers/usb/phy/phy-rcar-gen2-usb.c
@@ -0,0 +1,248 @@
+/*
+ * Renesas R-Car Gen2 USB phy driver
+ *
+ * Copyright (C) 2013 Renesas Solutions Corp.
+ * Copyright (C) 2013 Cogent Embedded, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/platform_data/usb-rcar-gen2-phy.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/usb/otg.h>
+struct rcar_gen2_usb_phy_priv {
+        struct usb_phy phy;
+        void __iomem *base;
+        struct clk *clk;
+        spinlock_t lock;
+        int usecount;
+        u32 ugctrl2;
+};
+#define usb_phy_to_priv(p) container_of(p, struct rcar_gen2_usb_phy_priv, phy)
+/* Low Power Status register */
+#define USBHS_LPSTS_REG                 0x02
+#define USBHS_LPSTS_SUSPM               (1 << 14)
+/* USB General control register */
+#define USBHS_UGCTRL_REG                0x80
+#define USBHS_UGCTRL_CONNECT            (1 << 2)
+#define USBHS_UGCTRL_PLLRESET           (1 << 0)
+/* USB General control register 2 */
+#define USBHS_UGCTRL2_REG               0x84
+#define USBHS_UGCTRL2_USB0_PCI          (1 << 4)
+#define USBHS_UGCTRL2_USB0_HS           (3 << 4)
+#define USBHS_UGCTRL2_USB2_PCI          (0 << 31)
+#define USBHS_UGCTRL2_USB2_SS           (1 << 31)
+/* USB General status register */
+#define USBHS_UGSTS_REG                 0x88
+#define USBHS_UGSTS_LOCK                (3 << 8)
+/* Enable USBHS internal phy */
+static int __rcar_gen2_usbhs_phy_enable(void __iomem *base)
+{
+        u32 val;
+        int i;
+        /* USBHS PHY power on */
+        val = ioread32(base + USBHS_UGCTRL_REG);
+        val &= ~USBHS_UGCTRL_PLLRESET;
+        iowrite32(val, base + USBHS_UGCTRL_REG);
+        val = ioread16(base + USBHS_LPSTS_REG);
+        val |= USBHS_LPSTS_SUSPM;
+        iowrite16(val, base + USBHS_LPSTS_REG);
+        for (i = 0; i < 20; i++) {
+                val = ioread32(base + USBHS_UGSTS_REG);
+                if ((val & USBHS_UGSTS_LOCK) == USBHS_UGSTS_LOCK) {
+                        val = ioread32(base + USBHS_UGCTRL_REG);
+                        val |= USBHS_UGCTRL_CONNECT;
+                        iowrite32(val, base + USBHS_UGCTRL_REG);
+                        return 0;
+                }
+                udelay(1);
+        }
+        /* Timed out waiting for the PLL lock */
+        return -ETIMEDOUT;
+}
+/* Disable USBHS internal phy */
+static int __rcar_gen2_usbhs_phy_disable(void __iomem *base)
+{
+        u32 val;
+        /* USBHS PHY power off */
+        val = ioread32(base + USBHS_UGCTRL_REG);
+        val &= ~USBHS_UGCTRL_CONNECT;
+        iowrite32(val, base + USBHS_UGCTRL_REG);
+        val = ioread16(base + USBHS_LPSTS_REG);
+        val &= ~USBHS_LPSTS_SUSPM;
+        iowrite16(val, base + USBHS_LPSTS_REG);
+        val = ioread32(base + USBHS_UGCTRL_REG);
+        val |= USBHS_UGCTRL_PLLRESET;
+        iowrite32(val, base + USBHS_UGCTRL_REG);
+        return 0;
+}
+/* Setup USB channels */
+static void __rcar_gen2_usb_phy_init(struct rcar_gen2_usb_phy_priv *priv)
+{
+        u32 val;
+        clk_prepare_enable(priv->clk);
+        /* Set USB channels in the USBHS UGCTRL2 register */
+        val = ioread32(priv->base);
+        val &= ~(USBHS_UGCTRL2_USB0_HS | USBHS_UGCTRL2_USB2_SS);
+        val |= priv->ugctrl2;
+        iowrite32(val, priv->base);
+}
+/* Shutdown USB channels */
+static void __rcar_gen2_usb_phy_shutdown(struct rcar_gen2_usb_phy_priv *priv)
+{
+        __rcar_gen2_usbhs_phy_disable(priv->base);
+        clk_disable_unprepare(priv->clk);
+}
+static int rcar_gen2_usb_phy_set_suspend(struct usb_phy *phy, int suspend)
+{
+        struct rcar_gen2_usb_phy_priv *priv = usb_phy_to_priv(phy);
+        unsigned long flags;
+        int retval;
+        spin_lock_irqsave(&priv->lock, flags);
+        retval = suspend ? __rcar_gen2_usbhs_phy_disable(priv->base) :
+                           __rcar_gen2_usbhs_phy_enable(priv->base);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return retval;
+}
+static int rcar_gen2_usb_phy_init(struct usb_phy *phy)
+{
+        struct rcar_gen2_usb_phy_priv *priv = usb_phy_to_priv(phy);
+        unsigned long flags;
+        spin_lock_irqsave(&priv->lock, flags);
+        /*
+         * Enable the clock and setup USB channels
+         * if it's the first user
+         */
+        if (!priv->usecount++)
+                __rcar_gen2_usb_phy_init(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return 0;
+}
+static void rcar_gen2_usb_phy_shutdown(struct usb_phy *phy)
+{
+        struct rcar_gen2_usb_phy_priv *priv = usb_phy_to_priv(phy);
+        unsigned long flags;
+        spin_lock_irqsave(&priv->lock, flags);
+        if (!priv->usecount) {
+                dev_warn(phy->dev, "Trying to disable phy with 0 usecount\n");
+                goto out;
+        }
+        /* Disable everything if it's the last user */
+        if (!--priv->usecount)
+                __rcar_gen2_usb_phy_shutdown(priv);
+out:
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+static int rcar_gen2_usb_phy_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct rcar_gen2_phy_platform_data *pdata;
+        struct rcar_gen2_usb_phy_priv *priv;
+        struct resource *res;
+        void __iomem *base;
+        struct clk *clk;
+        int retval;
+        pdata = dev_get_platdata(&pdev->dev);
+        if (!pdata) {
+                dev_err(dev, "No platform data\n");
+                return -EINVAL;
+        }
+        clk = devm_clk_get(&pdev->dev, "usbhs");
+        if (IS_ERR(clk)) {
+                dev_err(&pdev->dev, "Can't get the clock\n");
+                return PTR_ERR(clk);
+        }
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        base = devm_ioremap_resource(dev, res);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv) {
+                dev_err(dev, "Memory allocation failed\n");
+                return -ENOMEM;
+        }
+        spin_lock_init(&priv->lock);
+        priv->clk = clk;
+        priv->base = base;
+        priv->ugctrl2 = pdata->chan0_pci ?
+                        USBHS_UGCTRL2_USB0_PCI : USBHS_UGCTRL2_USB0_HS;
+        priv->ugctrl2 |= pdata->chan2_pci ?
+                        USBHS_UGCTRL2_USB2_PCI : USBHS_UGCTRL2_USB2_SS;
+        priv->phy.dev = dev;
+        priv->phy.label = dev_name(dev);
+        priv->phy.init = rcar_gen2_usb_phy_init;
+        priv->phy.shutdown = rcar_gen2_usb_phy_shutdown;
+        priv->phy.set_suspend = rcar_gen2_usb_phy_set_suspend;
+        retval = usb_add_phy(&priv->phy, USB_PHY_TYPE_USB2);
+        if (retval < 0) {
+                dev_err(dev, "Failed to add USB phy\n");
+                return retval;
+        }
+        platform_set_drvdata(pdev, priv);
+        return retval;
+}
+static int rcar_gen2_usb_phy_remove(struct platform_device *pdev)
+{
+        struct rcar_gen2_usb_phy_priv *priv = platform_get_drvdata(pdev);
+        usb_remove_phy(&priv->phy);
+        return 0;
+}
+static struct platform_driver rcar_gen2_usb_phy_driver = {
+        .driver = {
+                .name = "usb_phy_rcar_gen2",
+        },
+        .probe = rcar_gen2_usb_phy_probe,
+        .remove = rcar_gen2_usb_phy_remove,
+};
+module_platform_driver(rcar_gen2_usb_phy_driver);
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Renesas R-Car Gen2 USB phy");
+MODULE_AUTHOR("Valentine Barshak <valentine.barshak@cogentembedded.com>");
diff --git a/drivers/usb/phy/phy-samsung-usb2.c b/drivers/usb/phy/phy-samsung-usb2.c
index ff70e4b19b97..b3ba86627b72 100644
--- a/drivers/usb/phy/phy-samsung-usb2.c
+++ b/drivers/usb/phy/phy-samsung-usb2.c
@@ -411,6 +411,7 @@ static int samsung_usb2phy_probe(struct platform_device *pdev)
        sphy->drv_data          = drv_data;
        sphy->phy.dev           = sphy->dev;
        sphy->phy.label         = "samsung-usb2phy";
+        sphy->phy.type          = USB_PHY_TYPE_USB2;
        sphy->phy.init          = samsung_usb2phy_init;
        sphy->phy.shutdown      = samsung_usb2phy_shutdown;
@@ -426,7 +427,7 @@ static int samsung_usb2phy_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, sphy);
-        return usb_add_phy(&sphy->phy, USB_PHY_TYPE_USB2);
+        return usb_add_phy_dev(&sphy->phy);
 }
 static int samsung_usb2phy_remove(struct platform_device *pdev)
diff --git a/drivers/usb/phy/phy-samsung-usb3.c b/drivers/usb/phy/phy-samsung-usb3.c
index c6eb22213de6..cc0819248acf 100644
--- a/drivers/usb/phy/phy-samsung-usb3.c
+++ b/drivers/usb/phy/phy-samsung-usb3.c
@@ -271,6 +271,7 @@ static int samsung_usb3phy_probe(struct platform_device *pdev)
        sphy->clk               = clk;
        sphy->phy.dev           = sphy->dev;
        sphy->phy.label         = "samsung-usb3phy";
+        sphy->phy.type          = USB_PHY_TYPE_USB3;
        sphy->phy.init          = samsung_usb3phy_init;
        sphy->phy.shutdown      = samsung_usb3phy_shutdown;
        sphy->drv_data          = samsung_usbphy_get_driver_data(pdev);
@@ -283,7 +284,7 @@ static int samsung_usb3phy_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, sphy);
-        return usb_add_phy(&sphy->phy, USB_PHY_TYPE_USB3);
+        return usb_add_phy_dev(&sphy->phy);
 }
 static int samsung_usb3phy_remove(struct platform_device *pdev)
diff --git a/drivers/usb/phy/phy-tegra-usb.c b/drivers/usb/phy/phy-tegra-usb.c
index e9cb1cb8abc7..82232acf1ab6 100644
--- a/drivers/usb/phy/phy-tegra-usb.c
+++ b/drivers/usb/phy/phy-tegra-usb.c
@@ -1090,7 +1090,7 @@ static struct platform_driver tegra_usb_phy_driver = {
        .driver         = {
                .name   = "tegra-phy",
                .owner  = THIS_MODULE,
-                .of_match_table = of_match_ptr(tegra_usb_phy_id_table),
+                .of_match_table = tegra_usb_phy_id_table,
        },
 };
 module_platform_driver(tegra_usb_phy_driver);
diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 16dbc9382678..30e8a61552d4 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -33,6 +33,7 @@
 #include <linux/err.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
+#include <linux/of.h>
 /* usb register definitions */
 #define USB_VENDOR_ID_LSB               0x00
diff --git a/drivers/usb/phy/phy-ulpi-viewport.c b/drivers/usb/phy/phy-ulpi-viewport.c
index 7c22a5390fc3..18bb8264b5a0 100644
--- a/drivers/usb/phy/phy-ulpi-viewport.c
+++ b/drivers/usb/phy/phy-ulpi-viewport.c
@@ -36,7 +36,7 @@ static int ulpi_viewport_wait(void __iomem *view, u32 mask)
                        return 0;
                udelay(1);
-        };
+        }
        return -ETIMEDOUT;
 }
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index a9984c700d2c..1b74523e1fee 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -98,7 +98,7 @@ struct usb_phy *devm_usb_get_phy(struct device *dev, enum usb_phy_type type)
        ptr = devres_alloc(devm_usb_phy_release, sizeof(*ptr), GFP_KERNEL);
        if (!ptr)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        phy = usb_get_phy(type);
        if (!IS_ERR(phy)) {
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 781426230d69..6e1b69d0f5f5 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -279,7 +279,7 @@ static void cyberjack_read_int_callback(struct urb *urb)
                old_rdtodo = priv->rdtodo;
-                if (old_rdtodo + size < old_rdtodo) {
+                if (old_rdtodo > SHRT_MAX - size) {
                        dev_dbg(dev, "To many bulk_in urbs to do.\n");
                        spin_unlock(&priv->lock);
                        goto resubmit;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index c45f9c0a1b34..9ced8937a8f3 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -904,6 +904,7 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },
        /* Crucible Devices */
        { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
        { }                                     /* Terminating entry */
 };
@@ -1966,8 +1967,16 @@ static int ftdi_process_packet(struct usb_serial_port *port,
                        port->icount.dsr++;
                if (diff_status & FTDI_RS0_RI)
                        port->icount.rng++;
-                if (diff_status & FTDI_RS0_RLSD)
+                if (diff_status & FTDI_RS0_RLSD) {
+                        struct tty_struct *tty;
                        port->icount.dcd++;
+                        tty = tty_port_tty_get(&port->port);
+                        if (tty)
+                                usb_serial_handle_dcd_change(port, tty,
+                                                status & FTDI_RS0_RLSD);
+                        tty_kref_put(tty);
+                }
                wake_up_interruptible(&port->port.delta_msr_wait);
                priv->prev_status = status;
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 1b8af461b522..a7019d1e3058 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1307,3 +1307,9 @@
 * Manufacturer: Crucible Technologies
 */
 #define FTDI_CT_COMET_PID       0x8e08
+/*
+ * Product: Z3X Box
+ * Manufacturer: Smart GSM Team
+ */
+#define FTDI_Z3X_PID            0x0011
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 1f31e6b4c251..2b01ec8651c2 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -7,7 +7,6 @@
 *      This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License version
 *      2 as published by the Free Software Foundation.
- *
 */
 #include <linux/kernel.h>
@@ -37,7 +36,6 @@ MODULE_PARM_DESC(product, "User specified USB idProduct");
 static struct usb_device_id generic_device_ids[2]; /* Initially all zeroes. */
-/* All of the device info needed for the Generic Serial Converter */
 struct usb_serial_driver usb_serial_generic_device = {
        .driver = {
                .owner =        THIS_MODULE,
@@ -66,7 +64,6 @@ int usb_serial_generic_register(void)
        generic_device_ids[0].match_flags =
                USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_PRODUCT;
-        /* register our generic driver with ourselves */
        retval = usb_serial_register_drivers(serial_drivers,
                        "usbserial_generic", generic_device_ids);
 #endif
@@ -76,7 +73,6 @@ int usb_serial_generic_register(void)
 void usb_serial_generic_deregister(void)
 {
 #ifdef CONFIG_USB_SERIAL_GENERIC
-        /* remove our generic driver */
        usb_serial_deregister_drivers(serial_drivers);
 #endif
 }
@@ -86,13 +82,11 @@ int usb_serial_generic_open(struct tty_struct *tty, struct usb_serial_port *port
        int result = 0;
        unsigned long flags;
-        /* clear the throttle flags */
        spin_lock_irqsave(&port->lock, flags);
        port->throttled = 0;
        port->throttle_req = 0;
        spin_unlock_irqrestore(&port->lock, flags);
-        /* if we have a bulk endpoint, start reading from it */
        if (port->bulk_in_size)
                result = usb_serial_generic_submit_read_urbs(port, GFP_KERNEL);
@@ -127,12 +121,16 @@ int usb_serial_generic_prepare_write_buffer(struct usb_serial_port *port,
 }
 /**
- * usb_serial_generic_write_start - kick off an URB write
+ * usb_serial_generic_write_start - start writing buffered data
- * @port:       Pointer to the &struct usb_serial_port data
+ * @port: usb-serial port
+ * @mem_flags: flags to use for memory allocations
+ *
+ * Serialised using USB_SERIAL_WRITE_BUSY flag.
 *
- * Returns zero on success, or a negative errno value
+ * Return: Zero on success or if busy, otherwise a negative errno value.
 */
-static int usb_serial_generic_write_start(struct usb_serial_port *port)
+int usb_serial_generic_write_start(struct usb_serial_port *port,
+                                                        gfp_t mem_flags)
 {
        struct urb *urb;
        int count, result;
@@ -163,7 +161,7 @@ retry:
        spin_unlock_irqrestore(&port->lock, flags);
        clear_bit(i, &port->write_urbs_free);
-        result = usb_submit_urb(urb, GFP_ATOMIC);
+        result = usb_submit_urb(urb, mem_flags);
        if (result) {
                dev_err_console(port, "%s - error submitting urb: %d\n",
                                                __func__, result);
@@ -175,34 +173,34 @@ retry:
                clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
                return result;
        }
+        /*
-        /* Try sending off another urb, unless in irq context (in which case
+         * Try sending off another urb, unless called from completion handler
-         * there will be no free urb). */
+         * (in which case there will be no free urb or no data).
-        if (!in_irq())
+         */
+        if (mem_flags != GFP_ATOMIC)
                goto retry;
        clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
        return 0;
 }
+EXPORT_SYMBOL_GPL(usb_serial_generic_write_start);
 /**
- * usb_serial_generic_write - generic write function for serial USB devices
+ * usb_serial_generic_write - generic write function
- * @tty:        Pointer to &struct tty_struct for the device
+ * @tty: tty for the port
- * @port:       Pointer to the &usb_serial_port structure for the device
+ * @port: usb-serial port
- * @buf:        Pointer to the data to write
+ * @buf: data to write
- * @count:      Number of bytes to write
+ * @count: number of bytes to write
 *
- * Returns the number of characters actually written, which may be anything
+ * Return: The number of characters buffered, which may be anything from
- * from zero to @count. If an error occurs, it returns the negative errno
+ * zero to @count, or a negative errno value.
- * value.
 */
 int usb_serial_generic_write(struct tty_struct *tty,
        struct usb_serial_port *port, const unsigned char *buf, int count)
 {
        int result;
-        /* only do something if we have a bulk out endpoint */
        if (!port->bulk_out_size)
                return -ENODEV;
@@ -210,7 +208,7 @@ int usb_serial_generic_write(struct tty_struct *tty,
                return 0;
        count = kfifo_in_locked(&port->write_fifo, buf, count, &port->lock);
-        result = usb_serial_generic_write_start(port);
+        result = usb_serial_generic_write_start(port, GFP_KERNEL);
        if (result)
                return result;
@@ -337,10 +335,11 @@ void usb_serial_generic_process_read_urb(struct urb *urb)
        if (!urb->actual_length)
                return;
+        /*
-        /* The per character mucking around with sysrq path it too slow for
+         * The per character mucking around with sysrq path it too slow for
-           stuff like 3G modems, so shortcircuit it in the 99.9999999% of cases
+         * stuff like 3G modems, so shortcircuit it in the 99.9999999% of
-           where the USB serial is not a console anyway */
+         * cases where the USB serial is not a console anyway.
+         */
        if (!port->port.console || !port->sysrq)
                tty_insert_flip_string(&port->port, ch, urb->actual_length);
        else {
@@ -413,7 +412,7 @@ void usb_serial_generic_write_bulk_callback(struct urb *urb)
                kfifo_reset_out(&port->write_fifo);
                spin_unlock_irqrestore(&port->lock, flags);
        } else {
-                usb_serial_generic_write_start(port);
+                usb_serial_generic_write_start(port, GFP_ATOMIC);
        }
        usb_serial_port_softint(port);
@@ -425,8 +424,6 @@ void usb_serial_generic_throttle(struct tty_struct *tty)
        struct usb_serial_port *port = tty->driver_data;
        unsigned long flags;
-        /* Set the throttle request flag. It will be picked up
-         * by usb_serial_generic_read_bulk_callback(). */
        spin_lock_irqsave(&port->lock, flags);
        port->throttle_req = 1;
        spin_unlock_irqrestore(&port->lock, flags);
@@ -438,7 +435,6 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty)
        struct usb_serial_port *port = tty->driver_data;
        int was_throttled;
-        /* Clear the throttle flags */
        spin_lock_irq(&port->lock);
        was_throttled = port->throttled;
        port->throttled = port->throttle_req = 0;
@@ -558,10 +554,10 @@ int usb_serial_handle_break(struct usb_serial_port *port)
 EXPORT_SYMBOL_GPL(usb_serial_handle_break);
 /**
- *      usb_serial_handle_dcd_change - handle a change of carrier detect state
+ * usb_serial_handle_dcd_change - handle a change of carrier detect state
- *      @port: usb_serial_port structure for the open port
+ * @port: usb-serial port
- *      @tty: tty_struct structure for the port
+ * @tty: tty for the port
- *      @status: new carrier detect status, nonzero if active
+ * @status: new carrier detect status, nonzero if active
 */
 void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
                                struct tty_struct *tty, unsigned int status)
@@ -570,6 +566,16 @@ void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
        dev_dbg(&usb_port->dev, "%s - status %d\n", __func__, status);
+        if (tty) {
+                struct tty_ldisc *ld = tty_ldisc_ref(tty);
+                if (ld) {
+                        if (ld->ops->dcd_change)
+                                ld->ops->dcd_change(tty, status);
+                        tty_ldisc_deref(ld);
+                }
+        }
        if (status)
                wake_up_interruptible(&port->open_wait);
        else if (tty && !C_CLOCAL(tty))
@@ -595,7 +601,7 @@ int usb_serial_generic_resume(struct usb_serial *serial)
                }
                if (port->bulk_out_size) {
-                        r = usb_serial_generic_write_start(port);
+                        r = usb_serial_generic_write_start(port, GFP_NOIO);
                        if (r < 0)
                                c++;
                }
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index fdf953539c62..e5bdd987b9e8 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1532,7 +1532,11 @@ static int mos7840_tiocmget(struct tty_struct *tty)
                return -ENODEV;
        status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
+        if (status != 1)
+                return -EIO;
        status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
+        if (status != 1)
+                return -EIO;
        result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
            | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
            | ((mcr & MCR_LOOPBACK) ? TIOCM_LOOP : 0)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index acaee066b99a..c3d94853b4ab 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1376,6 +1376,23 @@ static const struct usb_device_id option_ids[] = {
                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff),  /* ZTE MF91 */
                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1545, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1546, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1547, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1565, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1566, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1567, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1589, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1590, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1591, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1592, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1594, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1596, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1598, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1600, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
          0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index bedf8e47713b..1e6de4cd079d 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -4,11 +4,6 @@
 * Copyright (C) 2001-2007 Greg Kroah-Hartman (greg@kroah.com)
 * Copyright (C) 2003 IBM Corp.
 *
- * Copyright (C) 2009, 2013 Frank Schäfer <fschaefer.oss@googlemail.com>
- *  - fixes, improvements and documentation for the baud rate encoding methods
- * Copyright (C) 2013 Reinhard Max <max@suse.de>
- *  - fixes and improvements for the divisor based baud rate encoding method
- *
 * Original driver for 2.2.x by anonymous
 *
 *      This program is free software; you can redistribute it and/or
@@ -134,18 +129,10 @@ MODULE_DEVICE_TABLE(usb, id_table);
 enum pl2303_type {
-        type_0,         /* H version ? */
+        type_0,         /* don't know the difference between type 0 and */
-        type_1,         /* H version ? */
+        type_1,         /* type 1, until someone from prolific tells us... */
-        HX_TA,          /* HX(A) / X(A) / TA version  */ /* TODO: improve */
+        HX,             /* HX version of the pl2303 chip */
-        HXD_EA_RA_SA,   /* HXD / EA / RA / SA version */ /* TODO: improve */
-        TB,             /* TB version */
-        HX_CLONE,       /* Cheap and less functional clone of the HX chip */
 };
-/*
- * NOTE: don't know the difference between type 0 and type 1,
- * until someone from Prolific tells us...
- * TODO: distinguish between X/HX, TA and HXD, EA, RA, SA variants
- */
 struct pl2303_serial_private {
        enum pl2303_type type;
@@ -185,7 +172,6 @@ static int pl2303_startup(struct usb_serial *serial)
 {
        struct pl2303_serial_private *spriv;
        enum pl2303_type type = type_0;
-        char *type_str = "unknown (treating as type_0)";
        unsigned char *buf;
        spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
@@ -198,53 +184,15 @@ static int pl2303_startup(struct usb_serial *serial)
                return -ENOMEM;
        }
-        if (serial->dev->descriptor.bDeviceClass == 0x02) {
+        if (serial->dev->descriptor.bDeviceClass == 0x02)
                type = type_0;
-                type_str = "type_0";
+        else if (serial->dev->descriptor.bMaxPacketSize0 == 0x40)
-        } else if (serial->dev->descriptor.bMaxPacketSize0 == 0x40) {
+                type = HX;
-                /*
+        else if (serial->dev->descriptor.bDeviceClass == 0x00)
-                 * NOTE: The bcdDevice version is the only difference between
-                 * the device descriptors of the X/HX, HXD, EA, RA, SA, TA, TB
-                 */
-                if (le16_to_cpu(serial->dev->descriptor.bcdDevice) == 0x300) {
-                        /* Check if the device is a clone */
-                        pl2303_vendor_read(0x9494, 0, serial, buf);
-                        /*
-                         * NOTE: Not sure if this read is really needed.
-                         * The HX returns 0x00, the clone 0x02, but the Windows
-                         * driver seems to ignore the value and continues.
-                         */
-                        pl2303_vendor_write(0x0606, 0xaa, serial);
-                        pl2303_vendor_read(0x8686, 0, serial, buf);
-                        if (buf[0] != 0xaa) {
-                                type = HX_CLONE;
-                                type_str = "X/HX clone (limited functionality)";
-                        } else {
-                                type = HX_TA;
-                                type_str = "X/HX/TA";
-                        }
-                        pl2303_vendor_write(0x0606, 0x00, serial);
-                } else if (le16_to_cpu(serial->dev->descriptor.bcdDevice)
-                                                                     == 0x400) {
-                        type = HXD_EA_RA_SA;
-                        type_str = "HXD/EA/RA/SA";
-                } else if (le16_to_cpu(serial->dev->descriptor.bcdDevice)
-                                                                     == 0x500) {
-                        type = TB;
-                        type_str = "TB";
-                } else {
-                        dev_info(&serial->interface->dev,
-                                           "unknown/unsupported device type\n");
-                        kfree(spriv);
-                        kfree(buf);
-                        return -ENODEV;
-                }
-        } else if (serial->dev->descriptor.bDeviceClass == 0x00
-                   || serial->dev->descriptor.bDeviceClass == 0xFF) {
                type = type_1;
-                type_str = "type_1";
+        else if (serial->dev->descriptor.bDeviceClass == 0xFF)
-        }
+                type = type_1;
-        dev_dbg(&serial->interface->dev, "device type: %s\n", type_str);
+        dev_dbg(&serial->interface->dev, "device type: %d\n", type);
        spriv->type = type;
        usb_set_serial_data(serial, spriv);
@@ -259,10 +207,10 @@ static int pl2303_startup(struct usb_serial *serial)
        pl2303_vendor_read(0x8383, 0, serial, buf);
        pl2303_vendor_write(0, 1, serial);
        pl2303_vendor_write(1, 0, serial);
-        if (type == type_0 || type == type_1)
+        if (type == HX)
-                pl2303_vendor_write(2, 0x24, serial);
-        else
                pl2303_vendor_write(2, 0x44, serial);
+        else
+                pl2303_vendor_write(2, 0x24, serial);
        kfree(buf);
        return 0;
@@ -316,174 +264,65 @@ static int pl2303_set_control_lines(struct usb_serial_port *port, u8 value)
        return retval;
 }
-static int pl2303_baudrate_encode_direct(int baud, enum pl2303_type type,
+static void pl2303_encode_baudrate(struct tty_struct *tty,
-                                                                      u8 buf[4])
+                                        struct usb_serial_port *port,
+                                        u8 buf[4])
 {
-        /*
-         * NOTE: Only the values defined in baud_sup are supported !
-         * => if unsupported values are set, the PL2303 uses 9600 baud instead
-         * => HX clones just don't work at unsupported baud rates < 115200 baud,
-         *    for baud rates > 115200 they run at 115200 baud
-         */
        const int baud_sup[] = { 75, 150, 300, 600, 1200, 1800, 2400, 3600,
-                                 4800, 7200, 9600, 14400, 19200, 28800, 38400,
+                                 4800, 7200, 9600, 14400, 19200, 28800, 38400,
-                                 57600, 115200, 230400, 460800, 614400, 921600,
+                                 57600, 115200, 230400, 460800, 500000, 614400,
-                                 1228800, 2457600, 3000000, 6000000, 12000000 };
+                                 921600, 1228800, 2457600, 3000000, 6000000 };
+        struct usb_serial *serial = port->serial;
+        struct pl2303_serial_private *spriv = usb_get_serial_data(serial);
+        int baud;
+        int i;
        /*
-         * NOTE: With the exception of type_0/1 devices, the following
+         * NOTE: Only the values defined in baud_sup are supported!
-         * additional baud rates are supported (tested with HX rev. 3A only):
+         *       => if unsupported values are set, the PL2303 seems to use
-         * 110*, 56000*, 128000, 134400, 161280, 201600, 256000*, 268800,
+         *          9600 baud (at least my PL2303X always does)
-         * 403200, 806400.      (*: not HX and HX clones)
-         *
-         * Maximum values: HXD, TB: 12000000; HX, TA: 6000000;
-         *                 type_0+1: 1228800; RA: 921600; HX clones, SA: 115200
-         *
-         * As long as we are not using this encoding method for anything else
-         * than the type_0+1, HX and HX clone chips, there is no point in
-         * complicating the code to support them.
         */
-        int i;
+        baud = tty_get_baud_rate(tty);
+        dev_dbg(&port->dev, "baud requested = %d\n", baud);
+        if (!baud)
+                return;
        /* Set baudrate to nearest supported value */
        for (i = 0; i < ARRAY_SIZE(baud_sup); ++i) {
                if (baud_sup[i] > baud)
                        break;
        }
        if (i == ARRAY_SIZE(baud_sup))
                baud = baud_sup[i - 1];
        else if (i > 0 && (baud_sup[i] - baud) > (baud - baud_sup[i - 1]))
                baud = baud_sup[i - 1];
        else
                baud = baud_sup[i];
-        /* Respect the chip type specific baud rate limits */
-        /*
-         * FIXME: as long as we don't know how to distinguish between the
-         * HXD, EA, RA, and SA chip variants, allow the max. value of 12M.
-         */
-        if (type == HX_TA)
-                baud = min_t(int, baud, 6000000);
-        else if (type == type_0 || type == type_1)
-                baud = min_t(int, baud, 1228800);
-        else if (type == HX_CLONE)
-                baud = min_t(int, baud, 115200);
-        /* Direct (standard) baud rate encoding method */
-        put_unaligned_le32(baud, buf);
-        return baud;
-}
-static int pl2303_baudrate_encode_divisor(int baud, enum pl2303_type type,
+        /* type_0, type_1 only support up to 1228800 baud */
-                                                                      u8 buf[4])
+        if (spriv->type != HX)
-{
+                baud = min_t(int, baud, 1228800);
-        /*
-         * Divisor based baud rate encoding method
-         *
-         * NOTE: HX clones do NOT support this method.
-         * It's not clear if the type_0/1 chips support it.
-         *
-         * divisor = 12MHz * 32 / baudrate = 2^A * B
-         *
-         * with
-         *
-         * A = buf[1] & 0x0e
-         * B = buf[0]  +  (buf[1] & 0x01) << 8
-         *
-         * Special cases:
-         * => 8 < B < 16: device seems to work not properly
-         * => B <= 8: device uses the max. value B = 512 instead
-         */
-        unsigned int A, B;
-        /*
+        if (baud <= 115200) {
-         * NOTE: The Windows driver allows maximum baud rates of 110% of the
+                put_unaligned_le32(baud, buf);
-         * specified maximium value.
-         * Quick tests with early (2004) HX (rev. A) chips suggest, that even
-         * higher baud rates (up to the maximum of 24M baud !) are working fine,
-         * but that should really be tested carefully in "real life" scenarios
-         * before removing the upper limit completely.
-         * Baud rates smaller than the specified 75 baud are definitely working
-         * fine.
-         */
-        if (type == type_0 || type == type_1)
-                baud = min_t(int, baud, 1228800 * 1.1);
-        else if (type == HX_TA)
-                baud = min_t(int, baud, 6000000 * 1.1);
-        else if (type == HXD_EA_RA_SA)
-                /* HXD, EA: 12Mbps; RA: 1Mbps; SA: 115200 bps */
-                /*
-                 * FIXME: as long as we don't know how to distinguish between
-                 * these chip variants, allow the max. of these values
-                 */
-                baud = min_t(int, baud, 12000000 * 1.1);
-        else if (type == TB)
-                baud = min_t(int, baud, 12000000 * 1.1);
-        /* Determine factors A and B */
-        A = 0;
-        B = 12000000 * 32 / baud;  /* 12MHz */
-        B <<= 1; /* Add one bit for rounding */
-        while (B > (512 << 1) && A <= 14) {
-                A += 2;
-                B >>= 2;
-        }
-        if (A > 14) { /* max. divisor = min. baudrate reached */
-                A = 14;
-                B = 512;
-                /* => ~45.78 baud */
        } else {
-                B = (B + 1) >> 1; /* Round the last bit */
-        }
-        /* Handle special cases */
-        if (B == 512)
-                B = 0; /* also: 1 to 8 */
-        else if (B < 16)
                /*
-                 * NOTE: With the current algorithm this happens
+                 * Apparently the formula for higher speeds is:
-                 * only for A=0 and means that the min. divisor
+                 * baudrate = 12M * 32 / (2^buf[1]) / buf[0]
-                 * (respectively: the max. baudrate) is reached.
                 */
-                B = 16;         /* => 24 MBaud */
+                unsigned tmp = 12000000 * 32 / baud;
-        /* Encode the baud rate */
+                buf[3] = 0x80;
-        buf[3] = 0x80;     /* Select divisor encoding method */
+                buf[2] = 0;
-        buf[2] = 0;
+                buf[1] = (tmp >= 256);
-        buf[1] = (A & 0x0e);            /* A */
+                while (tmp >= 256) {
-        buf[1] |= ((B & 0x100) >> 8);   /* MSB of B */
+                        tmp >>= 2;
-        buf[0] = B & 0xff;              /* 8 LSBs of B */
+                        buf[1] <<= 1;
-        /* Calculate the actual/resulting baud rate */
+                }
-        if (B <= 8)
+                buf[0] = tmp;
-                B = 512;
+        }
-        baud = 12000000 * 32 / ((1 << A) * B);
-        return baud;
-}
-static void pl2303_encode_baudrate(struct tty_struct *tty,
-                                        struct usb_serial_port *port,
-                                        enum pl2303_type type,
-                                        u8 buf[4])
-{
-        int baud;
-        baud = tty_get_baud_rate(tty);
-        dev_dbg(&port->dev, "baud requested = %d\n", baud);
-        if (!baud)
-                return;
-        /*
-         * There are two methods for setting/encoding the baud rate
-         * 1) Direct method: encodes the baud rate value directly
-         *    => supported by all chip types
-         * 2) Divisor based method: encodes a divisor to a base value (12MHz*32)
-         *    => not supported by HX clones (and likely type_0/1 chips)
-         *
-         * NOTE: Although the divisor based baud rate encoding method is much
-         * more flexible, some of the standard baud rate values can not be
-         * realized exactly. But the difference is very small (max. 0.2%) and
-         * the device likely uses the same baud rate generator for both methods
-         * so that there is likley no difference.
-         */
-        if (type == type_0 || type == type_1 || type == HX_CLONE)
-                baud = pl2303_baudrate_encode_direct(baud, type, buf);
-        else
-                baud = pl2303_baudrate_encode_divisor(baud, type, buf);
        /* Save resulting baud rate */
        tty_encode_baud_rate(tty, baud, baud);
        dev_dbg(&port->dev, "baud set = %d\n", baud);
@@ -540,8 +379,8 @@ static void pl2303_set_termios(struct tty_struct *tty,
                dev_dbg(&port->dev, "data bits = %d\n", buf[6]);
        }
-        /* For reference:   buf[0]:buf[3] baud rate value */
+        /* For reference buf[0]:buf[3] baud rate value */
-        pl2303_encode_baudrate(tty, port, spriv->type, buf);
+        pl2303_encode_baudrate(tty, port, &buf[0]);
        /* For reference buf[4]=0 is 1 stop bits */
        /* For reference buf[4]=1 is 1.5 stop bits */
@@ -618,10 +457,10 @@ static void pl2303_set_termios(struct tty_struct *tty,
        dev_dbg(&port->dev, "0xa1:0x21:0:0  %d - %7ph\n", i, buf);
        if (C_CRTSCTS(tty)) {
-                if (spriv->type == type_0 || spriv->type == type_1)
+                if (spriv->type == HX)
-                        pl2303_vendor_write(0x0, 0x41, serial);
-                else
                        pl2303_vendor_write(0x0, 0x61, serial);
+                else
+                        pl2303_vendor_write(0x0, 0x41, serial);
        } else {
                pl2303_vendor_write(0x0, 0x0, serial);
        }
@@ -658,7 +497,7 @@ static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port)
        struct pl2303_serial_private *spriv = usb_get_serial_data(serial);
        int result;
-        if (spriv->type == type_0 || spriv->type == type_1) {
+        if (spriv->type != HX) {
                usb_clear_halt(serial->dev, port->write_urb->pipe);
                usb_clear_halt(serial->dev, port->read_urb->pipe);
        } else {
@@ -833,7 +672,6 @@ static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
        result = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
                                 BREAK_REQUEST, BREAK_REQUEST_TYPE, state,
                                 0, NULL, 0, 100);
-        /* NOTE: HX clones don't support sending breaks, -EPIPE is returned */
        if (result)
                dev_err(&port->dev, "error sending break = %d\n", result);
 }
diff --git a/drivers/usb/wusbcore/cbaf.c b/drivers/usb/wusbcore/cbaf.c
index 7f78f300f8fb..f06ed82e63d1 100644
--- a/drivers/usb/wusbcore/cbaf.c
+++ b/drivers/usb/wusbcore/cbaf.c
@@ -208,9 +208,9 @@ static int cbaf_check(struct cbaf *cbaf)
                                ar_name = "ASSOCIATE";
                                ar_assoc = 1;
                                break;
-                        };
+                        }
                        break;
-                };
+                }
                dev_dbg(dev, "Association request #%02u: 0x%04x/%04x "
                         "(%zu bytes): %s\n",
@@ -623,6 +623,8 @@ static int cbaf_probe(struct usb_interface *iface,
 error_create_group:
 error_check:
+        usb_put_intf(iface);
+        usb_put_dev(cbaf->usb_dev);
        kfree(cbaf->buffer);
 error_kmalloc_buffer:
        kfree(cbaf);
@@ -637,6 +639,7 @@ static void cbaf_disconnect(struct usb_interface *iface)
        sysfs_remove_group(&dev->kobj, &cbaf_dev_attr_group);
        usb_set_intfdata(iface, NULL);
        usb_put_intf(iface);
+        usb_put_dev(cbaf->usb_dev);
        kfree(cbaf->buffer);
        /* paranoia: clean up crypto keys */
        kzfree(cbaf);
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index 33a12788f9ca..e538b72c4e3a 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -973,7 +973,7 @@ int wusb_usb_ncb(struct notifier_block *nb, unsigned long val,
        default:
                WARN_ON(1);
                result = NOTIFY_BAD;
-        };
+        }
        return result;
 }
diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c
index a09b65ebd9bb..368360f9a93a 100644
--- a/drivers/usb/wusbcore/wa-hc.c
+++ b/drivers/usb/wusbcore/wa-hc.c
@@ -33,7 +33,8 @@
 * wa->usb_dev and wa->usb_iface initialized and refcounted,
 * wa->wa_descr initialized.
 */
-int wa_create(struct wahc *wa, struct usb_interface *iface)
+int wa_create(struct wahc *wa, struct usb_interface *iface,
+        kernel_ulong_t quirks)
 {
        int result;
        struct device *dev = &iface->dev;
@@ -41,14 +42,15 @@ int wa_create(struct wahc *wa, struct usb_interface *iface)
        result = wa_rpipes_create(wa);
        if (result < 0)
                goto error_rpipes_create;
+        wa->quirks = quirks;
        /* Fill up Data Transfer EP pointers */
        wa->dti_epd = &iface->cur_altsetting->endpoint[1].desc;
        wa->dto_epd = &iface->cur_altsetting->endpoint[2].desc;
-        wa->xfer_result_size = usb_endpoint_maxp(wa->dti_epd);
+        wa->dti_buf_size = usb_endpoint_maxp(wa->dti_epd);
-        wa->xfer_result = kmalloc(wa->xfer_result_size, GFP_KERNEL);
+        wa->dti_buf = kmalloc(wa->dti_buf_size, GFP_KERNEL);
-        if (wa->xfer_result == NULL) {
+        if (wa->dti_buf == NULL) {
                result = -ENOMEM;
-                goto error_xfer_result_alloc;
+                goto error_dti_buf_alloc;
        }
        result = wa_nep_create(wa, iface);
        if (result < 0) {
@@ -59,8 +61,8 @@ int wa_create(struct wahc *wa, struct usb_interface *iface)
        return 0;
 error_nep_create:
-        kfree(wa->xfer_result);
+        kfree(wa->dti_buf);
-error_xfer_result_alloc:
+error_dti_buf_alloc:
        wa_rpipes_destroy(wa);
 error_rpipes_create:
        return result;
@@ -76,7 +78,7 @@ void __wa_destroy(struct wahc *wa)
                usb_kill_urb(wa->buf_in_urb);
                usb_put_urb(wa->buf_in_urb);
        }
-        kfree(wa->xfer_result);
+        kfree(wa->dti_buf);
        wa_nep_destroy(wa);
        wa_rpipes_destroy(wa);
 }
diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
index cf250c21e946..e614f02f0cf2 100644
--- a/drivers/usb/wusbcore/wa-hc.h
+++ b/drivers/usb/wusbcore/wa-hc.h
@@ -117,11 +117,25 @@ struct wa_rpipe {
        struct wahc *wa;
        spinlock_t seg_lock;
        struct list_head seg_list;
+        struct list_head list_node;
        atomic_t segs_available;
        u8 buffer[1];   /* For reads/writes on USB */
 };
+enum wa_dti_state {
+        WA_DTI_TRANSFER_RESULT_PENDING,
+        WA_DTI_ISOC_PACKET_STATUS_PENDING
+};
+enum wa_quirks {
+        /*
+         * The Alereon HWA expects the data frames in isochronous transfer
+         * requests to be concatenated and not sent as separate packets.
+         */
+        WUSB_QUIRK_ALEREON_HWA_CONCAT_ISOC      = 0x01,
+};
 /**
 * Instance of a HWA Host Controller
 *
@@ -178,14 +192,26 @@ struct wahc {
        u16 rpipes;
        unsigned long *rpipe_bm;        /* rpipe usage bitmap */
-        spinlock_t rpipe_bm_lock;       /* protect rpipe_bm */
+        struct list_head rpipe_delayed_list;    /* delayed RPIPES. */
+        spinlock_t rpipe_lock;  /* protect rpipe_bm and delayed list */
        struct mutex rpipe_mutex;       /* assigning resources to endpoints */
+        /*
+         * dti_state is used to track the state of the dti_urb.  When dti_state
+         * is WA_DTI_ISOC_PACKET_STATUS_PENDING, dti_isoc_xfer_in_progress and
+         * dti_isoc_xfer_seg identify which xfer the incoming isoc packet status
+         * refers to.
+         */
+        enum wa_dti_state dti_state;
+        u32 dti_isoc_xfer_in_progress;
+        u8  dti_isoc_xfer_seg;
        struct urb *dti_urb;            /* URB for reading xfer results */
        struct urb *buf_in_urb;         /* URB for reading data in */
        struct edc dti_edc;             /* DTI error density counter */
-        struct wa_xfer_result *xfer_result; /* real size = dti_ep maxpktsize */
+        void *dti_buf;
-        size_t xfer_result_size;
+        size_t dti_buf_size;
+        unsigned long dto_in_use;       /* protect dto endoint serialization. */
        s32 status;                     /* For reading status */
@@ -200,10 +226,13 @@ struct wahc {
        struct work_struct xfer_enqueue_work;
        struct work_struct xfer_error_work;
        atomic_t xfer_id_count;
+        kernel_ulong_t  quirks;
 };
-extern int wa_create(struct wahc *wa, struct usb_interface *iface);
+extern int wa_create(struct wahc *wa, struct usb_interface *iface,
+        kernel_ulong_t);
 extern void __wa_destroy(struct wahc *wa);
 void wa_reset_all(struct wahc *wa);
@@ -239,7 +268,8 @@ static inline void wa_nep_disarm(struct wahc *wa)
 /* RPipes */
 static inline void wa_rpipe_init(struct wahc *wa)
 {
-        spin_lock_init(&wa->rpipe_bm_lock);
+        INIT_LIST_HEAD(&wa->rpipe_delayed_list);
+        spin_lock_init(&wa->rpipe_lock);
        mutex_init(&wa->rpipe_mutex);
 }
@@ -247,6 +277,7 @@ static inline void wa_init(struct wahc *wa)
 {
        edc_init(&wa->nep_edc);
        atomic_set(&wa->notifs_queued, 0);
+        wa->dti_state = WA_DTI_TRANSFER_RESULT_PENDING;
        wa_rpipe_init(wa);
        edc_init(&wa->dti_edc);
        INIT_LIST_HEAD(&wa->xfer_list);
@@ -255,6 +286,7 @@ static inline void wa_init(struct wahc *wa)
        spin_lock_init(&wa->xfer_list_lock);
        INIT_WORK(&wa->xfer_enqueue_work, wa_urb_enqueue_run);
        INIT_WORK(&wa->xfer_error_work, wa_process_errored_transfers_run);
+        wa->dto_in_use = 0;
        atomic_set(&wa->xfer_id_count, 1);
 }
diff --git a/drivers/usb/wusbcore/wa-rpipe.c b/drivers/usb/wusbcore/wa-rpipe.c
index fd4f1ce6256a..b48e74cc54d7 100644
--- a/drivers/usb/wusbcore/wa-rpipe.c
+++ b/drivers/usb/wusbcore/wa-rpipe.c
@@ -143,17 +143,18 @@ static void rpipe_init(struct wa_rpipe *rpipe)
        kref_init(&rpipe->refcnt);
        spin_lock_init(&rpipe->seg_lock);
        INIT_LIST_HEAD(&rpipe->seg_list);
+        INIT_LIST_HEAD(&rpipe->list_node);
 }
 static unsigned rpipe_get_idx(struct wahc *wa, unsigned rpipe_idx)
 {
        unsigned long flags;
-        spin_lock_irqsave(&wa->rpipe_bm_lock, flags);
+        spin_lock_irqsave(&wa->rpipe_lock, flags);
        rpipe_idx = find_next_zero_bit(wa->rpipe_bm, wa->rpipes, rpipe_idx);
        if (rpipe_idx < wa->rpipes)
                set_bit(rpipe_idx, wa->rpipe_bm);
-        spin_unlock_irqrestore(&wa->rpipe_bm_lock, flags);
+        spin_unlock_irqrestore(&wa->rpipe_lock, flags);
        return rpipe_idx;
 }
@@ -162,9 +163,9 @@ static void rpipe_put_idx(struct wahc *wa, unsigned rpipe_idx)
 {
        unsigned long flags;
-        spin_lock_irqsave(&wa->rpipe_bm_lock, flags);
+        spin_lock_irqsave(&wa->rpipe_lock, flags);
        clear_bit(rpipe_idx, wa->rpipe_bm);
-        spin_unlock_irqrestore(&wa->rpipe_bm_lock, flags);
+        spin_unlock_irqrestore(&wa->rpipe_lock, flags);
 }
 void rpipe_destroy(struct kref *_rpipe)
@@ -333,7 +334,10 @@ static int rpipe_aim(struct wa_rpipe *rpipe, struct wahc *wa,
        /* FIXME: compute so seg_size > ep->maxpktsize */
        rpipe->descr.wBlocks = cpu_to_le16(16);         /* given */
        /* ep0 maxpktsize is 0x200 (WUSB1.0[4.8.1]) */
-        rpipe->descr.wMaxPacketSize = cpu_to_le16(ep->desc.wMaxPacketSize);
+        if (usb_endpoint_xfer_isoc(&ep->desc))
+                rpipe->descr.wMaxPacketSize = epcd->wOverTheAirPacketSize;
+        else
+                rpipe->descr.wMaxPacketSize = ep->desc.wMaxPacketSize;
        rpipe->descr.hwa_bMaxBurst = max(min_t(unsigned int,
                                epcd->bMaxBurst, 16U), 1U);
@@ -361,8 +365,10 @@ static int rpipe_aim(struct wa_rpipe *rpipe, struct wahc *wa,
                        epcd->bMaxSequence, 32U), 2U);
        rpipe->descr.bMaxDataSequence = epcd_max_sequence - 1;
        rpipe->descr.bInterval = ep->desc.bInterval;
-        /* FIXME: bOverTheAirInterval */
+        if (usb_endpoint_xfer_isoc(&ep->desc))
-        rpipe->descr.bOverTheAirInterval = 0;   /* 0 if not isoc */
+                rpipe->descr.bOverTheAirInterval = epcd->bOverTheAirInterval;
+        else
+                rpipe->descr.bOverTheAirInterval = 0;   /* 0 if not isoc */
        /* FIXME: xmit power & preamble blah blah */
        rpipe->descr.bmAttribute = (ep->desc.bmAttributes &
                                        USB_ENDPOINT_XFERTYPE_MASK);
@@ -477,7 +483,7 @@ error:
 */
 int wa_rpipes_create(struct wahc *wa)
 {
-        wa->rpipes = wa->wa_descr->wNumRPipes;
+        wa->rpipes = le16_to_cpu(wa->wa_descr->wNumRPipes);
        wa->rpipe_bm = kzalloc(BITS_TO_LONGS(wa->rpipes)*sizeof(unsigned long),
                               GFP_KERNEL);
        if (wa->rpipe_bm == NULL)
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 6ad02f57c366..ed5abe87b049 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -91,7 +91,8 @@
 #include "wusbhc.h"
 enum {
-        WA_SEGS_MAX = 255,
+        /* [WUSB] section 8.3.3 allocates 7 bits for the segment index. */
+        WA_SEGS_MAX = 128,
 };
 enum wa_seg_status {
@@ -107,6 +108,7 @@ enum wa_seg_status {
 };
 static void wa_xfer_delayed_run(struct wa_rpipe *);
+static int __wa_xfer_delayed_run(struct wa_rpipe *rpipe, int *dto_waiting);
 /*
 * Life cycle governed by 'struct urb' (the refcount of the struct is
@@ -114,24 +116,27 @@ static void wa_xfer_delayed_run(struct wa_rpipe *);
 * struct).
 */
 struct wa_seg {
-        struct urb urb;
+        struct urb tr_urb;              /* transfer request urb. */
-        struct urb *dto_urb;            /* for data output? */
+        struct urb *isoc_pack_desc_urb; /* for isoc packet descriptor. */
+        struct urb *dto_urb;            /* for data output. */
        struct list_head list_node;     /* for rpipe->req_list */
        struct wa_xfer *xfer;           /* out xfer */
        u8 index;                       /* which segment we are */
+        int isoc_frame_count;   /* number of isoc frames in this segment. */
+        int isoc_frame_offset;  /* starting frame offset in the xfer URB. */
+        int isoc_size;  /* size of all isoc frames sent by this seg. */
        enum wa_seg_status status;
        ssize_t result;                 /* bytes xfered or error */
        struct wa_xfer_hdr xfer_hdr;
-        u8 xfer_extra[];                /* xtra space for xfer_hdr_ctl */
 };
 static inline void wa_seg_init(struct wa_seg *seg)
 {
-        usb_init_urb(&seg->urb);
+        usb_init_urb(&seg->tr_urb);
        /* set the remaining memory to 0. */
-        memset(((void *)seg) + sizeof(seg->urb), 0,
+        memset(((void *)seg) + sizeof(seg->tr_urb), 0,
-                sizeof(*seg) - sizeof(seg->urb));
+                sizeof(*seg) - sizeof(seg->tr_urb));
 }
 /*
@@ -153,12 +158,17 @@ struct wa_xfer {
        unsigned is_dma:1;
        size_t seg_size;
        int result;
+        /* Isoc frame that the current transfer buffer corresponds to. */
+        int dto_isoc_frame_index;
        gfp_t gfp;                      /* allocation mask */
        struct wusb_dev *wusb_dev;      /* for activity timestamps */
 };
+static void __wa_populate_dto_urb_isoc(struct wa_xfer *xfer,
+        struct wa_seg *seg, int curr_iso_frame);
 static inline void wa_xfer_init(struct wa_xfer *xfer)
 {
        kref_init(&xfer->refcnt);
@@ -169,7 +179,7 @@ static inline void wa_xfer_init(struct wa_xfer *xfer)
 /*
 * Destroy a transfer structure
 *
- * Note that freeing xfer->seg[cnt]->urb will free the containing
+ * Note that freeing xfer->seg[cnt]->tr_urb will free the containing
 * xfer->seg[cnt] memory that was allocated by __wa_xfer_setup_segs.
 */
 static void wa_xfer_destroy(struct kref *_xfer)
@@ -178,9 +188,17 @@ static void wa_xfer_destroy(struct kref *_xfer)
        if (xfer->seg) {
                unsigned cnt;
                for (cnt = 0; cnt < xfer->segs; cnt++) {
-                        usb_free_urb(xfer->seg[cnt]->dto_urb);
+                        struct wa_seg *seg = xfer->seg[cnt];
-                        usb_free_urb(&xfer->seg[cnt]->urb);
+                        if (seg) {
+                                usb_free_urb(seg->isoc_pack_desc_urb);
+                                if (seg->dto_urb) {
+                                        kfree(seg->dto_urb->sg);
+                                        usb_free_urb(seg->dto_urb);
+                                }
+                                usb_free_urb(&seg->tr_urb);
+                        }
                }
+                kfree(xfer->seg);
        }
        kfree(xfer);
 }
@@ -196,6 +214,59 @@ static void wa_xfer_put(struct wa_xfer *xfer)
 }
 /*
+ * Try to get exclusive access to the DTO endpoint resource.  Return true
+ * if successful.
+ */
+static inline int __wa_dto_try_get(struct wahc *wa)
+{
+        return (test_and_set_bit(0, &wa->dto_in_use) == 0);
+}
+/* Release the DTO endpoint resource. */
+static inline void __wa_dto_put(struct wahc *wa)
+{
+        clear_bit_unlock(0, &wa->dto_in_use);
+}
+/* Service RPIPEs that are waiting on the DTO resource. */
+static void wa_check_for_delayed_rpipes(struct wahc *wa)
+{
+        unsigned long flags;
+        int dto_waiting = 0;
+        struct wa_rpipe *rpipe;
+        spin_lock_irqsave(&wa->rpipe_lock, flags);
+        while (!list_empty(&wa->rpipe_delayed_list) && !dto_waiting) {
+                rpipe = list_first_entry(&wa->rpipe_delayed_list,
+                                struct wa_rpipe, list_node);
+                __wa_xfer_delayed_run(rpipe, &dto_waiting);
+                /* remove this RPIPE from the list if it is not waiting. */
+                if (!dto_waiting) {
+                        pr_debug("%s: RPIPE %d serviced and removed from delayed list.\n",
+                                __func__,
+                                le16_to_cpu(rpipe->descr.wRPipeIndex));
+                        list_del_init(&rpipe->list_node);
+                }
+        }
+        spin_unlock_irqrestore(&wa->rpipe_lock, flags);
+}
+/* add this RPIPE to the end of the delayed RPIPE list. */
+static void wa_add_delayed_rpipe(struct wahc *wa, struct wa_rpipe *rpipe)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&wa->rpipe_lock, flags);
+        /* add rpipe to the list if it is not already on it. */
+        if (list_empty(&rpipe->list_node)) {
+                pr_debug("%s: adding RPIPE %d to the delayed list.\n",
+                        __func__, le16_to_cpu(rpipe->descr.wRPipeIndex));
+                list_add_tail(&rpipe->list_node, &wa->rpipe_delayed_list);
+        }
+        spin_unlock_irqrestore(&wa->rpipe_lock, flags);
+}
+/*
 * xfer is referenced
 *
 * xfer->lock has to be unlocked
@@ -232,6 +303,31 @@ static void wa_xfer_completion(struct wa_xfer *xfer)
 }
 /*
+ * Initialize a transfer's ID
+ *
+ * We need to use a sequential number; if we use the pointer or the
+ * hash of the pointer, it can repeat over sequential transfers and
+ * then it will confuse the HWA....wonder why in hell they put a 32
+ * bit handle in there then.
+ */
+static void wa_xfer_id_init(struct wa_xfer *xfer)
+{
+        xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
+}
+/* Return the xfer's ID. */
+static inline u32 wa_xfer_id(struct wa_xfer *xfer)
+{
+        return xfer->id;
+}
+/* Return the xfer's ID in transport format (little endian). */
+static inline __le32 wa_xfer_id_le32(struct wa_xfer *xfer)
+{
+        return cpu_to_le32(xfer->id);
+}
+/*
 * If transfer is done, wrap it up and return true
 *
 * xfer->lock has to be locked
@@ -253,33 +349,37 @@ static unsigned __wa_xfer_is_done(struct wa_xfer *xfer)
                switch (seg->status) {
                case WA_SEG_DONE:
                        if (found_short && seg->result > 0) {
-                                dev_dbg(dev, "xfer %p#%u: bad short segments (%zu)\n",
+                                dev_dbg(dev, "xfer %p ID %08X#%u: bad short segments (%zu)\n",
-                                        xfer, cnt, seg->result);
+                                        xfer, wa_xfer_id(xfer), cnt,
+                                        seg->result);
                                urb->status = -EINVAL;
                                goto out;
                        }
                        urb->actual_length += seg->result;
-                        if (seg->result < xfer->seg_size
+                        if (!(usb_pipeisoc(xfer->urb->pipe))
+                                && seg->result < xfer->seg_size
                            && cnt != xfer->segs-1)
                                found_short = 1;
-                        dev_dbg(dev, "xfer %p#%u: DONE short %d "
+                        dev_dbg(dev, "xfer %p ID %08X#%u: DONE short %d "
                                "result %zu urb->actual_length %d\n",
-                                xfer, seg->index, found_short, seg->result,
+                                xfer, wa_xfer_id(xfer), seg->index, found_short,
-                                urb->actual_length);
+                                seg->result, urb->actual_length);
                        break;
                case WA_SEG_ERROR:
                        xfer->result = seg->result;
-                        dev_dbg(dev, "xfer %p#%u: ERROR result %zu\n",
+                        dev_dbg(dev, "xfer %p ID %08X#%u: ERROR result %zu(0x%08zX)\n",
-                                xfer, seg->index, seg->result);
+                                xfer, wa_xfer_id(xfer), seg->index, seg->result,
+                                seg->result);
                        goto out;
                case WA_SEG_ABORTED:
-                        dev_dbg(dev, "xfer %p#%u ABORTED: result %d\n",
+                        dev_dbg(dev, "xfer %p ID %08X#%u ABORTED: result %d\n",
-                                xfer, seg->index, urb->status);
+                                xfer, wa_xfer_id(xfer), seg->index,
+                                urb->status);
                        xfer->result = urb->status;
                        goto out;
                default:
-                        dev_warn(dev, "xfer %p#%u: is_done bad state %d\n",
+                        dev_warn(dev, "xfer %p ID %08X#%u: is_done bad state %d\n",
-                                 xfer, cnt, seg->status);
+                                 xfer, wa_xfer_id(xfer), cnt, seg->status);
                        xfer->result = -EINVAL;
                        goto out;
                }
@@ -290,29 +390,6 @@ out:
 }
 /*
- * Initialize a transfer's ID
- *
- * We need to use a sequential number; if we use the pointer or the
- * hash of the pointer, it can repeat over sequential transfers and
- * then it will confuse the HWA....wonder why in hell they put a 32
- * bit handle in there then.
- */
-static void wa_xfer_id_init(struct wa_xfer *xfer)
-{
-        xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
-}
-/*
- * Return the xfer's ID associated with xfer
- *
- * Need to generate a
- */
-static u32 wa_xfer_id(struct wa_xfer *xfer)
-{
-        return xfer->id;
-}
-/*
 * Search for a transfer list ID on the HCD's URB list
 *
 * For 32 bit architectures, we use the pointer itself; for 64 bits, a
@@ -356,15 +433,11 @@ static void __wa_xfer_abort_cb(struct urb *urb)
 *
 * The callback (see above) does nothing but freeing up the data by
 * putting the URB. Because the URB is allocated at the head of the
- * struct, the whole space we allocated is kfreed.
+ * struct, the whole space we allocated is kfreed. *
- *
- * We'll get an 'aborted transaction' xfer result on DTI, that'll
- * politely ignore because at this point the transaction has been
- * marked as aborted already.
 */
-static void __wa_xfer_abort(struct wa_xfer *xfer)
+static int __wa_xfer_abort(struct wa_xfer *xfer)
 {
-        int result;
+        int result = -ENOMEM;
        struct device *dev = &xfer->wa->usb_iface->dev;
        struct wa_xfer_abort_buffer *b;
        struct wa_rpipe *rpipe = xfer->ep->hcpriv;
@@ -375,7 +448,7 @@ static void __wa_xfer_abort(struct wa_xfer *xfer)
        b->cmd.bLength =  sizeof(b->cmd);
        b->cmd.bRequestType = WA_XFER_ABORT;
        b->cmd.wRPipe = rpipe->descr.wRPipeIndex;
-        b->cmd.dwTransferID = wa_xfer_id(xfer);
+        b->cmd.dwTransferID = wa_xfer_id_le32(xfer);
        usb_init_urb(&b->urb);
        usb_fill_bulk_urb(&b->urb, xfer->wa->usb_dev,
@@ -385,7 +458,7 @@ static void __wa_xfer_abort(struct wa_xfer *xfer)
        result = usb_submit_urb(&b->urb, GFP_ATOMIC);
        if (result < 0)
                goto error_submit;
-        return;                         /* callback frees! */
+        return result;                          /* callback frees! */
 error_submit:
@@ -394,11 +467,52 @@ error_submit:
                        xfer, result);
        kfree(b);
 error_kmalloc:
-        return;
+        return result;
 }
 /*
+ * Calculate the number of isoc frames starting from isoc_frame_offset
+ * that will fit a in transfer segment.
+ */
+static int __wa_seg_calculate_isoc_frame_count(struct wa_xfer *xfer,
+        int isoc_frame_offset, int *total_size)
+{
+        int segment_size = 0, frame_count = 0;
+        int index = isoc_frame_offset;
+        struct usb_iso_packet_descriptor *iso_frame_desc =
+                xfer->urb->iso_frame_desc;
+        while ((index < xfer->urb->number_of_packets)
+                && ((segment_size + iso_frame_desc[index].length)
+                                <= xfer->seg_size)) {
+                /*
+                 * For Alereon HWA devices, only include an isoc frame in a
+                 * segment if it is physically contiguous with the previous
+                 * frame.  This is required because those devices expect
+                 * the isoc frames to be sent as a single USB transaction as
+                 * opposed to one transaction per frame with standard HWA.
+                 */
+                if ((xfer->wa->quirks & WUSB_QUIRK_ALEREON_HWA_CONCAT_ISOC)
+                        && (index > isoc_frame_offset)
+                        && ((iso_frame_desc[index - 1].offset +
+                                iso_frame_desc[index - 1].length) !=
+                                iso_frame_desc[index].offset))
+                        break;
+                /* this frame fits. count it. */
+                ++frame_count;
+                segment_size += iso_frame_desc[index].length;
+                /* move to the next isoc frame. */
+                ++index;
+        }
+        *total_size = segment_size;
+        return frame_count;
+}
+/*
 *
 * @returns < 0 on error, transfer segment request size if ok
 */
@@ -422,43 +536,92 @@ static ssize_t __wa_xfer_setup_sizes(struct wa_xfer *xfer,
                result = sizeof(struct wa_xfer_bi);
                break;
        case USB_ENDPOINT_XFER_ISOC:
-                dev_err(dev, "FIXME: ISOC not implemented\n");
+                if (usb_pipeout(urb->pipe)) {
-                result = -ENOSYS;
+                        *pxfer_type = WA_XFER_TYPE_ISO;
-                goto error;
+                        result = sizeof(struct wa_xfer_hwaiso);
+                } else {
+                        dev_err(dev, "FIXME: ISOC IN not implemented\n");
+                        result = -ENOSYS;
+                        goto error;
+                }
+                break;
        default:
                /* never happens */
                BUG();
                result = -EINVAL;       /* shut gcc up */
-        };
+        }
        xfer->is_inbound = urb->pipe & USB_DIR_IN ? 1 : 0;
        xfer->is_dma = urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP ? 1 : 0;
-        xfer->seg_size = le16_to_cpu(rpipe->descr.wBlocks)
-                * 1 << (xfer->wa->wa_descr->bRPipeBlockSize - 1);
-        /* Compute the segment size and make sure it is a multiple of
-         * the maxpktsize (WUSB1.0[8.3.3.1])...not really too much of
-         * a check (FIXME) */
        maxpktsize = le16_to_cpu(rpipe->descr.wMaxPacketSize);
-        if (xfer->seg_size < maxpktsize) {
+        if ((rpipe->descr.bmAttribute & 0x3) == USB_ENDPOINT_XFER_ISOC) {
-                dev_err(dev, "HW BUG? seg_size %zu smaller than maxpktsize "
+                int index = 0;
-                        "%zu\n", xfer->seg_size, maxpktsize);
-                result = -EINVAL;
+                xfer->seg_size = maxpktsize;
-                goto error;
+                xfer->segs = 0;
+                /*
+                 * loop over urb->number_of_packets to determine how many
+                 * xfer segments will be needed to send the isoc frames.
+                 */
+                while (index < urb->number_of_packets) {
+                        int seg_size; /* don't care. */
+                        index += __wa_seg_calculate_isoc_frame_count(xfer,
+                                        index, &seg_size);
+                        ++xfer->segs;
+                }
+        } else {
+                xfer->seg_size = le16_to_cpu(rpipe->descr.wBlocks)
+                        * 1 << (xfer->wa->wa_descr->bRPipeBlockSize - 1);
+                /* Compute the segment size and make sure it is a multiple of
+                 * the maxpktsize (WUSB1.0[8.3.3.1])...not really too much of
+                 * a check (FIXME) */
+                if (xfer->seg_size < maxpktsize) {
+                        dev_err(dev,
+                                "HW BUG? seg_size %zu smaller than maxpktsize %zu\n",
+                                xfer->seg_size, maxpktsize);
+                        result = -EINVAL;
+                        goto error;
+                }
+                xfer->seg_size = (xfer->seg_size / maxpktsize) * maxpktsize;
+                xfer->segs = DIV_ROUND_UP(urb->transfer_buffer_length,
+                                                xfer->seg_size);
+                if (xfer->segs == 0 && *pxfer_type == WA_XFER_TYPE_CTL)
+                        xfer->segs = 1;
        }
-        xfer->seg_size = (xfer->seg_size / maxpktsize) * maxpktsize;
-        xfer->segs = DIV_ROUND_UP(urb->transfer_buffer_length, xfer->seg_size);
+        if (xfer->segs > WA_SEGS_MAX) {
-        if (xfer->segs >= WA_SEGS_MAX) {
+                dev_err(dev, "BUG? oops, number of segments %zu bigger than %d\n",
-                dev_err(dev, "BUG? ops, number of segments %d bigger than %d\n",
+                        (urb->transfer_buffer_length/xfer->seg_size),
-                        (int)(urb->transfer_buffer_length / xfer->seg_size),
                        WA_SEGS_MAX);
                result = -EINVAL;
                goto error;
        }
-        if (xfer->segs == 0 && *pxfer_type == WA_XFER_TYPE_CTL)
-                xfer->segs = 1;
 error:
        return result;
 }
+static void __wa_setup_isoc_packet_descr(
+                struct wa_xfer_packet_info_hwaiso *packet_desc,
+                struct wa_xfer *xfer,
+                struct wa_seg *seg) {
+        struct usb_iso_packet_descriptor *iso_frame_desc =
+                xfer->urb->iso_frame_desc;
+        int frame_index;
+        /* populate isoc packet descriptor. */
+        packet_desc->bPacketType = WA_XFER_ISO_PACKET_INFO;
+        packet_desc->wLength = cpu_to_le16(sizeof(*packet_desc) +
+                (sizeof(packet_desc->PacketLength[0]) *
+                        seg->isoc_frame_count));
+        for (frame_index = 0; frame_index < seg->isoc_frame_count;
+                ++frame_index) {
+                int offset_index = frame_index + seg->isoc_frame_offset;
+                packet_desc->PacketLength[frame_index] =
+                        cpu_to_le16(iso_frame_desc[offset_index].length);
+        }
+}
 /* Fill in the common request header and xfer-type specific data. */
 static void __wa_xfer_setup_hdr0(struct wa_xfer *xfer,
                                 struct wa_xfer_hdr *xfer_hdr0,
@@ -466,12 +629,13 @@ static void __wa_xfer_setup_hdr0(struct wa_xfer *xfer,
                                 size_t xfer_hdr_size)
 {
        struct wa_rpipe *rpipe = xfer->ep->hcpriv;
+        struct wa_seg *seg = xfer->seg[0];
-        xfer_hdr0 = &xfer->seg[0]->xfer_hdr;
+        xfer_hdr0 = &seg->xfer_hdr;
        xfer_hdr0->bLength = xfer_hdr_size;
        xfer_hdr0->bRequestType = xfer_type;
        xfer_hdr0->wRPipe = rpipe->descr.wRPipeIndex;
-        xfer_hdr0->dwTransferID = wa_xfer_id(xfer);
+        xfer_hdr0->dwTransferID = wa_xfer_id_le32(xfer);
        xfer_hdr0->bTransferSegment = 0;
        switch (xfer_type) {
        case WA_XFER_TYPE_CTL: {
@@ -484,8 +648,18 @@ static void __wa_xfer_setup_hdr0(struct wa_xfer *xfer,
        }
        case WA_XFER_TYPE_BI:
                break;
-        case WA_XFER_TYPE_ISO:
+        case WA_XFER_TYPE_ISO: {
-                printk(KERN_ERR "FIXME: ISOC not implemented\n");
+                struct wa_xfer_hwaiso *xfer_iso =
+                        container_of(xfer_hdr0, struct wa_xfer_hwaiso, hdr);
+                struct wa_xfer_packet_info_hwaiso *packet_desc =
+                        ((void *)xfer_iso) + xfer_hdr_size;
+                /* populate the isoc section of the transfer request. */
+                xfer_iso->dwNumOfPackets = cpu_to_le32(seg->isoc_frame_count);
+                /* populate isoc packet descriptor. */
+                __wa_setup_isoc_packet_descr(packet_desc, xfer, seg);
+                break;
+        }
        default:
                BUG();
        };
@@ -494,12 +668,12 @@ static void __wa_xfer_setup_hdr0(struct wa_xfer *xfer,
 /*
 * Callback for the OUT data phase of the segment request
 *
- * Check wa_seg_cb(); most comments also apply here because this
+ * Check wa_seg_tr_cb(); most comments also apply here because this
 * function does almost the same thing and they work closely
 * together.
 *
 * If the seg request has failed but this DTO phase has succeeded,
- * wa_seg_cb() has already failed the segment and moved the
+ * wa_seg_tr_cb() has already failed the segment and moved the
 * status to WA_SEG_ERROR, so this will go through 'case 0' and
 * effectively do nothing.
 */
@@ -512,6 +686,139 @@ static void wa_seg_dto_cb(struct urb *urb)
        struct wa_rpipe *rpipe;
        unsigned long flags;
        unsigned rpipe_ready = 0;
+        int data_send_done = 1, release_dto = 0, holding_dto = 0;
+        u8 done = 0;
+        int result;
+        /* free the sg if it was used. */
+        kfree(urb->sg);
+        urb->sg = NULL;
+        spin_lock_irqsave(&xfer->lock, flags);
+        wa = xfer->wa;
+        dev = &wa->usb_iface->dev;
+        if (usb_pipeisoc(xfer->urb->pipe)) {
+                /* Alereon HWA sends all isoc frames in a single transfer. */
+                if (wa->quirks & WUSB_QUIRK_ALEREON_HWA_CONCAT_ISOC)
+                        xfer->dto_isoc_frame_index += seg->isoc_frame_count;
+                else
+                        xfer->dto_isoc_frame_index += 1;
+                if (xfer->dto_isoc_frame_index < seg->isoc_frame_count) {
+                        data_send_done = 0;
+                        holding_dto = 1; /* checked in error cases. */
+                        /*
+                         * if this is the last isoc frame of the segment, we
+                         * can release DTO after sending this frame.
+                         */
+                        if ((xfer->dto_isoc_frame_index + 1) >=
+                                seg->isoc_frame_count)
+                                release_dto = 1;
+                }
+                dev_dbg(dev, "xfer 0x%08X#%u: isoc frame = %d, holding_dto = %d, release_dto = %d.\n",
+                        wa_xfer_id(xfer), seg->index,
+                        xfer->dto_isoc_frame_index, holding_dto, release_dto);
+        }
+        spin_unlock_irqrestore(&xfer->lock, flags);
+        switch (urb->status) {
+        case 0:
+                spin_lock_irqsave(&xfer->lock, flags);
+                seg->result += urb->actual_length;
+                if (data_send_done) {
+                        dev_dbg(dev, "xfer 0x%08X#%u: data out done (%zu bytes)\n",
+                                wa_xfer_id(xfer), seg->index, seg->result);
+                        if (seg->status < WA_SEG_PENDING)
+                                seg->status = WA_SEG_PENDING;
+                } else {
+                        /* should only hit this for isoc xfers. */
+                        /*
+                         * Populate the dto URB with the next isoc frame buffer,
+                         * send the URB and release DTO if we no longer need it.
+                         */
+                         __wa_populate_dto_urb_isoc(xfer, seg,
+                                seg->isoc_frame_offset +
+                                xfer->dto_isoc_frame_index);
+                        /* resubmit the URB with the next isoc frame. */
+                        result = usb_submit_urb(seg->dto_urb, GFP_ATOMIC);
+                        if (result < 0) {
+                                dev_err(dev, "xfer 0x%08X#%u: DTO submit failed: %d\n",
+                                       wa_xfer_id(xfer), seg->index, result);
+                                spin_unlock_irqrestore(&xfer->lock, flags);
+                                goto error_dto_submit;
+                        }
+                }
+                spin_unlock_irqrestore(&xfer->lock, flags);
+                if (release_dto) {
+                        __wa_dto_put(wa);
+                        wa_check_for_delayed_rpipes(wa);
+                }
+                break;
+        case -ECONNRESET:       /* URB unlinked; no need to do anything */
+        case -ENOENT:           /* as it was done by the who unlinked us */
+                if (holding_dto) {
+                        __wa_dto_put(wa);
+                        wa_check_for_delayed_rpipes(wa);
+                }
+                break;
+        default:                /* Other errors ... */
+                dev_err(dev, "xfer 0x%08X#%u: data out error %d\n",
+                        wa_xfer_id(xfer), seg->index, urb->status);
+                goto error_default;
+        }
+        return;
+error_dto_submit:
+error_default:
+        spin_lock_irqsave(&xfer->lock, flags);
+        rpipe = xfer->ep->hcpriv;
+        if (edc_inc(&wa->nep_edc, EDC_MAX_ERRORS,
+                    EDC_ERROR_TIMEFRAME)){
+                dev_err(dev, "DTO: URB max acceptable errors exceeded, resetting device\n");
+                wa_reset_all(wa);
+        }
+        if (seg->status != WA_SEG_ERROR) {
+                seg->status = WA_SEG_ERROR;
+                seg->result = urb->status;
+                xfer->segs_done++;
+                __wa_xfer_abort(xfer);
+                rpipe_ready = rpipe_avail_inc(rpipe);
+                done = __wa_xfer_is_done(xfer);
+        }
+        spin_unlock_irqrestore(&xfer->lock, flags);
+        if (holding_dto) {
+                __wa_dto_put(wa);
+                wa_check_for_delayed_rpipes(wa);
+        }
+        if (done)
+                wa_xfer_completion(xfer);
+        if (rpipe_ready)
+                wa_xfer_delayed_run(rpipe);
+}
+/*
+ * Callback for the isoc packet descriptor phase of the segment request
+ *
+ * Check wa_seg_tr_cb(); most comments also apply here because this
+ * function does almost the same thing and they work closely
+ * together.
+ *
+ * If the seg request has failed but this phase has succeeded,
+ * wa_seg_tr_cb() has already failed the segment and moved the
+ * status to WA_SEG_ERROR, so this will go through 'case 0' and
+ * effectively do nothing.
+ */
+static void wa_seg_iso_pack_desc_cb(struct urb *urb)
+{
+        struct wa_seg *seg = urb->context;
+        struct wa_xfer *xfer = seg->xfer;
+        struct wahc *wa;
+        struct device *dev;
+        struct wa_rpipe *rpipe;
+        unsigned long flags;
+        unsigned rpipe_ready = 0;
        u8 done = 0;
        switch (urb->status) {
@@ -519,11 +826,10 @@ static void wa_seg_dto_cb(struct urb *urb)
                spin_lock_irqsave(&xfer->lock, flags);
                wa = xfer->wa;
                dev = &wa->usb_iface->dev;
-                dev_dbg(dev, "xfer %p#%u: data out done (%d bytes)\n",
+                dev_dbg(dev, "iso xfer %08X#%u: packet descriptor done\n",
-                        xfer, seg->index, urb->actual_length);
+                        wa_xfer_id(xfer), seg->index);
-                if (seg->status < WA_SEG_PENDING)
+                if (xfer->is_inbound && seg->status < WA_SEG_PENDING)
                        seg->status = WA_SEG_PENDING;
-                seg->result = urb->actual_length;
                spin_unlock_irqrestore(&xfer->lock, flags);
                break;
        case -ECONNRESET:       /* URB unlinked; no need to do anything */
@@ -534,15 +840,15 @@ static void wa_seg_dto_cb(struct urb *urb)
                wa = xfer->wa;
                dev = &wa->usb_iface->dev;
                rpipe = xfer->ep->hcpriv;
-                dev_dbg(dev, "xfer %p#%u: data out error %d\n",
+                pr_err_ratelimited("iso xfer %08X#%u: packet descriptor error %d\n",
-                        xfer, seg->index, urb->status);
+                                wa_xfer_id(xfer), seg->index, urb->status);
                if (edc_inc(&wa->nep_edc, EDC_MAX_ERRORS,
                            EDC_ERROR_TIMEFRAME)){
-                        dev_err(dev, "DTO: URB max acceptable errors "
+                        dev_err(dev, "DTO: URB max acceptable errors exceeded, resetting device\n");
-                                "exceeded, resetting device\n");
                        wa_reset_all(wa);
                }
                if (seg->status != WA_SEG_ERROR) {
+                        usb_unlink_urb(seg->dto_urb);
                        seg->status = WA_SEG_ERROR;
                        seg->result = urb->status;
                        xfer->segs_done++;
@@ -572,11 +878,11 @@ static void wa_seg_dto_cb(struct urb *urb)
 * We have to check before setting the status to WA_SEG_PENDING
 * because sometimes the xfer result callback arrives before this
 * callback (geeeeeeze), so it might happen that we are already in
- * another state. As well, we don't set it if the transfer is inbound,
+ * another state. As well, we don't set it if the transfer is not inbound,
 * as in that case, wa_seg_dto_cb will do it when the OUT data phase
 * finishes.
 */
-static void wa_seg_cb(struct urb *urb)
+static void wa_seg_tr_cb(struct urb *urb)
 {
        struct wa_seg *seg = urb->context;
        struct wa_xfer *xfer = seg->xfer;
@@ -592,8 +898,11 @@ static void wa_seg_cb(struct urb *urb)
                spin_lock_irqsave(&xfer->lock, flags);
                wa = xfer->wa;
                dev = &wa->usb_iface->dev;
-                dev_dbg(dev, "xfer %p#%u: request done\n", xfer, seg->index);
+                dev_dbg(dev, "xfer %p ID 0x%08X#%u: request done\n",
-                if (xfer->is_inbound && seg->status < WA_SEG_PENDING)
+                        xfer, wa_xfer_id(xfer), seg->index);
+                if (xfer->is_inbound &&
+                        seg->status < WA_SEG_PENDING &&
+                        !(usb_pipeisoc(xfer->urb->pipe)))
                        seg->status = WA_SEG_PENDING;
                spin_unlock_irqrestore(&xfer->lock, flags);
                break;
@@ -606,14 +915,16 @@ static void wa_seg_cb(struct urb *urb)
                dev = &wa->usb_iface->dev;
                rpipe = xfer->ep->hcpriv;
                if (printk_ratelimit())
-                        dev_err(dev, "xfer %p#%u: request error %d\n",
+                        dev_err(dev, "xfer %p ID 0x%08X#%u: request error %d\n",
-                                xfer, seg->index, urb->status);
+                                xfer, wa_xfer_id(xfer), seg->index,
+                                urb->status);
                if (edc_inc(&wa->nep_edc, EDC_MAX_ERRORS,
                            EDC_ERROR_TIMEFRAME)){
                        dev_err(dev, "DTO: URB max acceptable errors "
                                "exceeded, resetting device\n");
                        wa_reset_all(wa);
                }
+                usb_unlink_urb(seg->isoc_pack_desc_urb);
                usb_unlink_urb(seg->dto_urb);
                seg->status = WA_SEG_ERROR;
                seg->result = urb->status;
@@ -629,9 +940,11 @@ static void wa_seg_cb(struct urb *urb)
        }
 }
-/* allocate an SG list to store bytes_to_transfer bytes and copy the
+/*
+ * Allocate an SG list to store bytes_to_transfer bytes and copy the
 * subset of the in_sg that matches the buffer subset
- * we are about to transfer. */
+ * we are about to transfer.
+ */
 static struct scatterlist *wa_xfer_create_subset_sg(struct scatterlist *in_sg,
        const unsigned int bytes_transferred,
        const unsigned int bytes_to_transfer, unsigned int *out_num_sgs)
@@ -710,6 +1023,75 @@ static struct scatterlist *wa_xfer_create_subset_sg(struct scatterlist *in_sg,
 }
 /*
+ * Populate DMA buffer info for the isoc dto urb.
+ */
+static void __wa_populate_dto_urb_isoc(struct wa_xfer *xfer,
+        struct wa_seg *seg, int curr_iso_frame)
+{
+        seg->dto_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+        seg->dto_urb->sg = NULL;
+        seg->dto_urb->num_sgs = 0;
+        /* dto urb buffer address pulled from iso_frame_desc. */
+        seg->dto_urb->transfer_dma = xfer->urb->transfer_dma +
+                xfer->urb->iso_frame_desc[curr_iso_frame].offset;
+        /* The Alereon HWA sends a single URB with all isoc segs. */
+        if (xfer->wa->quirks & WUSB_QUIRK_ALEREON_HWA_CONCAT_ISOC)
+                seg->dto_urb->transfer_buffer_length = seg->isoc_size;
+        else
+                seg->dto_urb->transfer_buffer_length =
+                        xfer->urb->iso_frame_desc[curr_iso_frame].length;
+}
+/*
+ * Populate buffer ptr and size, DMA buffer or SG list for the dto urb.
+ */
+static int __wa_populate_dto_urb(struct wa_xfer *xfer,
+        struct wa_seg *seg, size_t buf_itr_offset, size_t buf_itr_size)
+{
+        int result = 0;
+        if (xfer->is_dma) {
+                seg->dto_urb->transfer_dma =
+                        xfer->urb->transfer_dma + buf_itr_offset;
+                seg->dto_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+                seg->dto_urb->sg = NULL;
+                seg->dto_urb->num_sgs = 0;
+        } else {
+                /* do buffer or SG processing. */
+                seg->dto_urb->transfer_flags &=
+                        ~URB_NO_TRANSFER_DMA_MAP;
+                /* this should always be 0 before a resubmit. */
+                seg->dto_urb->num_mapped_sgs = 0;
+                if (xfer->urb->transfer_buffer) {
+                        seg->dto_urb->transfer_buffer =
+                                xfer->urb->transfer_buffer +
+                                buf_itr_offset;
+                        seg->dto_urb->sg = NULL;
+                        seg->dto_urb->num_sgs = 0;
+                } else {
+                        seg->dto_urb->transfer_buffer = NULL;
+                        /*
+                         * allocate an SG list to store seg_size bytes
+                         * and copy the subset of the xfer->urb->sg that
+                         * matches the buffer subset we are about to
+                         * read.
+                         */
+                        seg->dto_urb->sg = wa_xfer_create_subset_sg(
+                                xfer->urb->sg,
+                                buf_itr_offset, buf_itr_size,
+                                &(seg->dto_urb->num_sgs));
+                        if (!(seg->dto_urb->sg))
+                                result = -ENOMEM;
+                }
+        }
+        seg->dto_urb->transfer_buffer_length = buf_itr_size;
+        return result;
+}
+/*
 * Allocate the segs array and initialize each of them
 *
 * The segments are freed by wa_xfer_destroy() when the xfer use count
@@ -719,13 +1101,14 @@ static struct scatterlist *wa_xfer_create_subset_sg(struct scatterlist *in_sg,
 */
 static int __wa_xfer_setup_segs(struct wa_xfer *xfer, size_t xfer_hdr_size)
 {
-        int result, cnt;
+        int result, cnt, iso_frame_offset;
        size_t alloc_size = sizeof(*xfer->seg[0])
                - sizeof(xfer->seg[0]->xfer_hdr) + xfer_hdr_size;
        struct usb_device *usb_dev = xfer->wa->usb_dev;
        const struct usb_endpoint_descriptor *dto_epd = xfer->wa->dto_epd;
        struct wa_seg *seg;
        size_t buf_itr, buf_size, buf_itr_size;
+        int xfer_isoc_frame_offset = 0;
        result = -ENOMEM;
        xfer->seg = kcalloc(xfer->segs, sizeof(xfer->seg[0]), GFP_ATOMIC);
@@ -733,18 +1116,35 @@ static int __wa_xfer_setup_segs(struct wa_xfer *xfer, size_t xfer_hdr_size)
                goto error_segs_kzalloc;
        buf_itr = 0;
        buf_size = xfer->urb->transfer_buffer_length;
+        iso_frame_offset = 0;
        for (cnt = 0; cnt < xfer->segs; cnt++) {
-                seg = xfer->seg[cnt] = kmalloc(alloc_size, GFP_ATOMIC);
+                size_t iso_pkt_descr_size = 0;
+                int seg_isoc_frame_count = 0, seg_isoc_size = 0;
+                if (usb_pipeisoc(xfer->urb->pipe)) {
+                        seg_isoc_frame_count =
+                                __wa_seg_calculate_isoc_frame_count(xfer,
+                                        xfer_isoc_frame_offset, &seg_isoc_size);
+                        iso_pkt_descr_size =
+                                sizeof(struct wa_xfer_packet_info_hwaiso) +
+                                (seg_isoc_frame_count * sizeof(__le16));
+                }
+                seg = xfer->seg[cnt] = kmalloc(alloc_size + iso_pkt_descr_size,
+                                                GFP_ATOMIC);
                if (seg == NULL)
                        goto error_seg_kmalloc;
                wa_seg_init(seg);
                seg->xfer = xfer;
                seg->index = cnt;
-                usb_fill_bulk_urb(&seg->urb, usb_dev,
+                seg->isoc_frame_count = seg_isoc_frame_count;
+                seg->isoc_frame_offset = xfer_isoc_frame_offset;
+                seg->isoc_size = seg_isoc_size;
+                usb_fill_bulk_urb(&seg->tr_urb, usb_dev,
                                  usb_sndbulkpipe(usb_dev,
                                                  dto_epd->bEndpointAddress),
                                  &seg->xfer_hdr, xfer_hdr_size,
-                                  wa_seg_cb, seg);
+                                  wa_seg_tr_cb, seg);
                buf_itr_size = min(buf_size, xfer->seg_size);
                if (xfer->is_inbound == 0 && buf_size > 0) {
                        /* outbound data. */
@@ -756,69 +1156,64 @@ static int __wa_xfer_setup_segs(struct wa_xfer *xfer, size_t xfer_hdr_size)
                                usb_sndbulkpipe(usb_dev,
                                                dto_epd->bEndpointAddress),
                                NULL, 0, wa_seg_dto_cb, seg);
-                        if (xfer->is_dma) {
-                                seg->dto_urb->transfer_dma =
+                        if (usb_pipeisoc(xfer->urb->pipe)) {
-                                        xfer->urb->transfer_dma + buf_itr;
+                                /* iso packet descriptor. */
-                                seg->dto_urb->transfer_flags |=
+                                seg->isoc_pack_desc_urb =
-                                        URB_NO_TRANSFER_DMA_MAP;
+                                                usb_alloc_urb(0, GFP_ATOMIC);
-                                seg->dto_urb->transfer_buffer = NULL;
+                                if (seg->isoc_pack_desc_urb == NULL)
-                                seg->dto_urb->sg = NULL;
+                                        goto error_iso_pack_desc_alloc;
-                                seg->dto_urb->num_sgs = 0;
+                                /*
+                                 * The buffer for the isoc packet descriptor
+                                 * after the transfer request header in the
+                                 * segment object memory buffer.
+                                 */
+                                usb_fill_bulk_urb(
+                                        seg->isoc_pack_desc_urb, usb_dev,
+                                        usb_sndbulkpipe(usb_dev,
+                                                dto_epd->bEndpointAddress),
+                                        (void *)(&seg->xfer_hdr) +
+                                                xfer_hdr_size,
+                                        iso_pkt_descr_size,
+                                        wa_seg_iso_pack_desc_cb, seg);
+                                /*
+                                 * Fill in the xfer buffer information for the
+                                 * first isoc frame.  Subsequent frames in this
+                                 * segment will be filled in and sent from the
+                                 * DTO completion routine, if needed.
+                                 */
+                                __wa_populate_dto_urb_isoc(xfer, seg,
+                                        xfer_isoc_frame_offset);
+                                /* adjust starting frame offset for next seg. */
+                                xfer_isoc_frame_offset += seg_isoc_frame_count;
                        } else {
-                                /* do buffer or SG processing. */
+                                /* fill in the xfer buffer information. */
-                                seg->dto_urb->transfer_flags &=
+                                result = __wa_populate_dto_urb(xfer, seg,
-                                        ~URB_NO_TRANSFER_DMA_MAP;
+                                                        buf_itr, buf_itr_size);
-                                /* this should always be 0 before a resubmit. */
+                                if (result < 0)
-                                seg->dto_urb->num_mapped_sgs = 0;
+                                        goto error_seg_outbound_populate;
-                                if (xfer->urb->transfer_buffer) {
+                                buf_itr += buf_itr_size;
-                                        seg->dto_urb->transfer_buffer =
+                                buf_size -= buf_itr_size;
-                                                xfer->urb->transfer_buffer +
-                                                buf_itr;
-                                        seg->dto_urb->sg = NULL;
-                                        seg->dto_urb->num_sgs = 0;
-                                } else {
-                                        /* allocate an SG list to store seg_size
-                                            bytes and copy the subset of the
-                                            xfer->urb->sg that matches the
-                                            buffer subset we are about to read.
-                                        */
-                                        seg->dto_urb->sg =
-                                                wa_xfer_create_subset_sg(
-                                                xfer->urb->sg,
-                                                buf_itr, buf_itr_size,
-                                                &(seg->dto_urb->num_sgs));
-                                        if (!(seg->dto_urb->sg)) {
-                                                seg->dto_urb->num_sgs   = 0;
-                                                goto error_sg_alloc;
-                                        }
-                                        seg->dto_urb->transfer_buffer = NULL;
-                                }
                        }
-                        seg->dto_urb->transfer_buffer_length = buf_itr_size;
                }
                seg->status = WA_SEG_READY;
-                buf_itr += buf_itr_size;
-                buf_size -= buf_itr_size;
        }
        return 0;
-error_sg_alloc:
+        /*
+         * Free the memory for the current segment which failed to init.
+         * Use the fact that cnt is left at were it failed.  The remaining
+         * segments will be cleaned up by wa_xfer_destroy.
+         */
+error_iso_pack_desc_alloc:
+error_seg_outbound_populate:
        usb_free_urb(xfer->seg[cnt]->dto_urb);
 error_dto_alloc:
        kfree(xfer->seg[cnt]);
-        cnt--;
+        xfer->seg[cnt] = NULL;
 error_seg_kmalloc:
-        /* use the fact that cnt is left at were it failed */
-        for (; cnt >= 0; cnt--) {
-                if (xfer->seg[cnt] && xfer->is_inbound == 0) {
-                        usb_free_urb(xfer->seg[cnt]->dto_urb);
-                        kfree(xfer->seg[cnt]->dto_urb->sg);
-                }
-                kfree(xfer->seg[cnt]);
-        }
 error_segs_kzalloc:
        return result;
 }
@@ -856,21 +1251,45 @@ static int __wa_xfer_setup(struct wa_xfer *xfer, struct urb *urb)
        wa_xfer_id_init(xfer);
        __wa_xfer_setup_hdr0(xfer, xfer_hdr0, xfer_type, xfer_hdr_size);
-        /* Fill remainig headers */
+        /* Fill remaining headers */
        xfer_hdr = xfer_hdr0;
-        transfer_size = urb->transfer_buffer_length;
+        if (xfer_type == WA_XFER_TYPE_ISO) {
-        xfer_hdr0->dwTransferLength = transfer_size > xfer->seg_size ?
+                xfer_hdr0->dwTransferLength =
-                xfer->seg_size : transfer_size;
+                        cpu_to_le32(xfer->seg[0]->isoc_size);
-        transfer_size -=  xfer->seg_size;
+                for (cnt = 1; cnt < xfer->segs; cnt++) {
-        for (cnt = 1; cnt < xfer->segs; cnt++) {
+                        struct wa_xfer_packet_info_hwaiso *packet_desc;
-                xfer_hdr = &xfer->seg[cnt]->xfer_hdr;
+                        struct wa_seg *seg = xfer->seg[cnt];
-                memcpy(xfer_hdr, xfer_hdr0, xfer_hdr_size);
-                xfer_hdr->bTransferSegment = cnt;
+                        xfer_hdr = &seg->xfer_hdr;
-                xfer_hdr->dwTransferLength = transfer_size > xfer->seg_size ?
+                        packet_desc = ((void *)xfer_hdr) + xfer_hdr_size;
-                        cpu_to_le32(xfer->seg_size)
+                        /*
-                        : cpu_to_le32(transfer_size);
+                         * Copy values from the 0th header. Segment specific
-                xfer->seg[cnt]->status = WA_SEG_READY;
+                         * values are set below.
+                         */
+                        memcpy(xfer_hdr, xfer_hdr0, xfer_hdr_size);
+                        xfer_hdr->bTransferSegment = cnt;
+                        xfer_hdr->dwTransferLength =
+                                cpu_to_le32(seg->isoc_size);
+                        __wa_setup_isoc_packet_descr(packet_desc, xfer, seg);
+                        seg->status = WA_SEG_READY;
+                }
+        } else {
+                transfer_size = urb->transfer_buffer_length;
+                xfer_hdr0->dwTransferLength = transfer_size > xfer->seg_size ?
+                        cpu_to_le32(xfer->seg_size) :
+                        cpu_to_le32(transfer_size);
                transfer_size -=  xfer->seg_size;
+                for (cnt = 1; cnt < xfer->segs; cnt++) {
+                        xfer_hdr = &xfer->seg[cnt]->xfer_hdr;
+                        memcpy(xfer_hdr, xfer_hdr0, xfer_hdr_size);
+                        xfer_hdr->bTransferSegment = cnt;
+                        xfer_hdr->dwTransferLength =
+                                transfer_size > xfer->seg_size ?
+                                        cpu_to_le32(xfer->seg_size)
+                                        : cpu_to_le32(transfer_size);
+                        xfer->seg[cnt]->status = WA_SEG_READY;
+                        transfer_size -=  xfer->seg_size;
+                }
        }
        xfer_hdr->bTransferSegment |= 0x80;     /* this is the last segment */
        result = 0;
@@ -885,20 +1304,46 @@ error_setup_sizes:
 * rpipe->seg_lock is held!
 */
 static int __wa_seg_submit(struct wa_rpipe *rpipe, struct wa_xfer *xfer,
-                           struct wa_seg *seg)
+                           struct wa_seg *seg, int *dto_done)
 {
        int result;
-        result = usb_submit_urb(&seg->urb, GFP_ATOMIC);
+        /* default to done unless we encounter a multi-frame isoc segment. */
+        *dto_done = 1;
+        /* submit the transfer request. */
+        result = usb_submit_urb(&seg->tr_urb, GFP_ATOMIC);
        if (result < 0) {
-                printk(KERN_ERR "xfer %p#%u: REQ submit failed: %d\n",
+                pr_err("%s: xfer %p#%u: REQ submit failed: %d\n",
-                       xfer, seg->index, result);
+                       __func__, xfer, seg->index, result);
                goto error_seg_submit;
        }
+        /* submit the isoc packet descriptor if present. */
+        if (seg->isoc_pack_desc_urb) {
+                struct wahc *wa = xfer->wa;
+                result = usb_submit_urb(seg->isoc_pack_desc_urb, GFP_ATOMIC);
+                if (result < 0) {
+                        pr_err("%s: xfer %p#%u: ISO packet descriptor submit failed: %d\n",
+                               __func__, xfer, seg->index, result);
+                        goto error_iso_pack_desc_submit;
+                }
+                xfer->dto_isoc_frame_index = 0;
+                /*
+                 * If this segment contains more than one isoc frame, hold
+                 * onto the dto resource until we send all frames.
+                 * Only applies to non-Alereon devices.
+                 */
+                if (((wa->quirks & WUSB_QUIRK_ALEREON_HWA_CONCAT_ISOC) == 0)
+                        && (seg->isoc_frame_count > 1))
+                        *dto_done = 0;
+        }
+        /* submit the out data if this is an out request. */
        if (seg->dto_urb) {
                result = usb_submit_urb(seg->dto_urb, GFP_ATOMIC);
                if (result < 0) {
-                        printk(KERN_ERR "xfer %p#%u: DTO submit failed: %d\n",
+                        pr_err("%s: xfer %p#%u: DTO submit failed: %d\n",
-                               xfer, seg->index, result);
+                               __func__, xfer, seg->index, result);
                        goto error_dto_submit;
                }
        }
@@ -907,38 +1352,48 @@ static int __wa_seg_submit(struct wa_rpipe *rpipe, struct wa_xfer *xfer,
        return 0;
 error_dto_submit:
-        usb_unlink_urb(&seg->urb);
+        usb_unlink_urb(seg->isoc_pack_desc_urb);
+error_iso_pack_desc_submit:
+        usb_unlink_urb(&seg->tr_urb);
 error_seg_submit:
        seg->status = WA_SEG_ERROR;
        seg->result = result;
+        *dto_done = 1;
        return result;
 }
 /*
- * Execute more queued request segments until the maximum concurrent allowed
+ * Execute more queued request segments until the maximum concurrent allowed.
+ * Return true if the DTO resource was acquired and released.
 *
 * The ugly unlock/lock sequence on the error path is needed as the
 * xfer->lock normally nests the seg_lock and not viceversa.
- *
 */
-static void wa_xfer_delayed_run(struct wa_rpipe *rpipe)
+static int __wa_xfer_delayed_run(struct wa_rpipe *rpipe, int *dto_waiting)
 {
-        int result;
+        int result, dto_acquired = 0, dto_done = 0;
        struct device *dev = &rpipe->wa->usb_iface->dev;
        struct wa_seg *seg;
        struct wa_xfer *xfer;
        unsigned long flags;
+        *dto_waiting = 0;
        spin_lock_irqsave(&rpipe->seg_lock, flags);
        while (atomic_read(&rpipe->segs_available) > 0
-              && !list_empty(&rpipe->seg_list)) {
+              && !list_empty(&rpipe->seg_list)
+              && (dto_acquired = __wa_dto_try_get(rpipe->wa))) {
                seg = list_first_entry(&(rpipe->seg_list), struct wa_seg,
                                 list_node);
                list_del(&seg->list_node);
                xfer = seg->xfer;
-                result = __wa_seg_submit(rpipe, xfer, seg);
+                result = __wa_seg_submit(rpipe, xfer, seg, &dto_done);
-                dev_dbg(dev, "xfer %p#%u submitted from delayed [%d segments available] %d\n",
+                /* release the dto resource if this RPIPE is done with it. */
-                        xfer, seg->index, atomic_read(&rpipe->segs_available), result);
+                if (dto_done)
+                        __wa_dto_put(rpipe->wa);
+                dev_dbg(dev, "xfer %p ID %08X#%u submitted from delayed [%d segments available] %d\n",
+                        xfer, wa_xfer_id(xfer), seg->index,
+                        atomic_read(&rpipe->segs_available), result);
                if (unlikely(result < 0)) {
                        spin_unlock_irqrestore(&rpipe->seg_lock, flags);
                        spin_lock_irqsave(&xfer->lock, flags);
@@ -948,7 +1403,37 @@ static void wa_xfer_delayed_run(struct wa_rpipe *rpipe)
                        spin_lock_irqsave(&rpipe->seg_lock, flags);
                }
        }
+        /*
+         * Mark this RPIPE as waiting if dto was not acquired, there are
+         * delayed segs and no active transfers to wake us up later.
+         */
+        if (!dto_acquired && !list_empty(&rpipe->seg_list)
+                && (atomic_read(&rpipe->segs_available) ==
+                        le16_to_cpu(rpipe->descr.wRequests)))
+                *dto_waiting = 1;
        spin_unlock_irqrestore(&rpipe->seg_lock, flags);
+        return dto_done;
+}
+static void wa_xfer_delayed_run(struct wa_rpipe *rpipe)
+{
+        int dto_waiting;
+        int dto_done = __wa_xfer_delayed_run(rpipe, &dto_waiting);
+        /*
+         * If this RPIPE is waiting on the DTO resource, add it to the tail of
+         * the waiting list.
+         * Otherwise, if the WA DTO resource was acquired and released by
+         *  __wa_xfer_delayed_run, another RPIPE may have attempted to acquire
+         * DTO and failed during that time.  Check the delayed list and process
+         * any waiters.  Start searching from the next RPIPE index.
+         */
+        if (dto_waiting)
+                wa_add_delayed_rpipe(rpipe->wa, rpipe);
+        else if (dto_done)
+                wa_check_for_delayed_rpipes(rpipe->wa);
 }
 /*
@@ -960,7 +1445,7 @@ static void wa_xfer_delayed_run(struct wa_rpipe *rpipe)
 */
 static int __wa_xfer_submit(struct wa_xfer *xfer)
 {
-        int result;
+        int result, dto_acquired = 0, dto_done = 0, dto_waiting = 0;
        struct wahc *wa = xfer->wa;
        struct device *dev = &wa->usb_iface->dev;
        unsigned cnt;
@@ -979,27 +1464,58 @@ static int __wa_xfer_submit(struct wa_xfer *xfer)
        result = 0;
        spin_lock_irqsave(&rpipe->seg_lock, flags);
        for (cnt = 0; cnt < xfer->segs; cnt++) {
+                int delay_seg = 1;
                available = atomic_read(&rpipe->segs_available);
                empty = list_empty(&rpipe->seg_list);
                seg = xfer->seg[cnt];
-                dev_dbg(dev, "xfer %p#%u: available %u empty %u (%s)\n",
+                if (available && empty) {
-                        xfer, cnt, available, empty,
+                        /*
-                        available == 0 || !empty ? "delayed" : "submitted");
+                         * Only attempt to acquire DTO if we have a segment
-                if (available == 0 || !empty) {
+                         * to send.
-                        dev_dbg(dev, "xfer %p#%u: delayed\n", xfer, cnt);
+                         */
+                        dto_acquired = __wa_dto_try_get(rpipe->wa);
+                        if (dto_acquired) {
+                                delay_seg = 0;
+                                result = __wa_seg_submit(rpipe, xfer, seg,
+                                                        &dto_done);
+                                dev_dbg(dev, "xfer %p ID 0x%08X#%u: available %u empty %u submitted\n",
+                                        xfer, wa_xfer_id(xfer), cnt, available,
+                                        empty);
+                                if (dto_done)
+                                        __wa_dto_put(rpipe->wa);
+                                if (result < 0) {
+                                        __wa_xfer_abort(xfer);
+                                        goto error_seg_submit;
+                                }
+                        }
+                }
+                if (delay_seg) {
+                        dev_dbg(dev, "xfer %p ID 0x%08X#%u: available %u empty %u delayed\n",
+                                xfer, wa_xfer_id(xfer), cnt, available,  empty);
                        seg->status = WA_SEG_DELAYED;
                        list_add_tail(&seg->list_node, &rpipe->seg_list);
-                } else {
-                        result = __wa_seg_submit(rpipe, xfer, seg);
-                        if (result < 0) {
-                                __wa_xfer_abort(xfer);
-                                goto error_seg_submit;
-                        }
                }
                xfer->segs_submitted++;
        }
 error_seg_submit:
+        /*
+         * Mark this RPIPE as waiting if dto was not acquired, there are
+         * delayed segs and no active transfers to wake us up later.
+         */
+        if (!dto_acquired && !list_empty(&rpipe->seg_list)
+                && (atomic_read(&rpipe->segs_available) ==
+                        le16_to_cpu(rpipe->descr.wRequests)))
+                dto_waiting = 1;
        spin_unlock_irqrestore(&rpipe->seg_lock, flags);
+        if (dto_waiting)
+                wa_add_delayed_rpipe(rpipe->wa, rpipe);
+        else if (dto_done)
+                wa_check_for_delayed_rpipes(rpipe->wa);
        return result;
 }
@@ -1025,7 +1541,7 @@ error_seg_submit:
 * result never kicks in, the xfer will timeout from the USB code and
 * dequeue() will be called.
 */
-static void wa_urb_enqueue_b(struct wa_xfer *xfer)
+static int wa_urb_enqueue_b(struct wa_xfer *xfer)
 {
        int result;
        unsigned long flags;
@@ -1036,18 +1552,22 @@ static void wa_urb_enqueue_b(struct wa_xfer *xfer)
        unsigned done;
        result = rpipe_get_by_ep(wa, xfer->ep, urb, xfer->gfp);
-        if (result < 0)
+        if (result < 0) {
+                pr_err("%s: error_rpipe_get\n", __func__);
                goto error_rpipe_get;
+        }
        result = -ENODEV;
        /* FIXME: segmentation broken -- kills DWA */
        mutex_lock(&wusbhc->mutex);             /* get a WUSB dev */
        if (urb->dev == NULL) {
                mutex_unlock(&wusbhc->mutex);
+                pr_err("%s: error usb dev gone\n", __func__);
                goto error_dev_gone;
        }
        wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, urb->dev);
        if (wusb_dev == NULL) {
                mutex_unlock(&wusbhc->mutex);
+                pr_err("%s: error wusb dev gone\n", __func__);
                goto error_dev_gone;
        }
        mutex_unlock(&wusbhc->mutex);
@@ -1055,21 +1575,28 @@ static void wa_urb_enqueue_b(struct wa_xfer *xfer)
        spin_lock_irqsave(&xfer->lock, flags);
        xfer->wusb_dev = wusb_dev;
        result = urb->status;
-        if (urb->status != -EINPROGRESS)
+        if (urb->status != -EINPROGRESS) {
+                pr_err("%s: error_dequeued\n", __func__);
                goto error_dequeued;
+        }
        result = __wa_xfer_setup(xfer, urb);
-        if (result < 0)
+        if (result < 0) {
+                pr_err("%s: error_xfer_setup\n", __func__);
                goto error_xfer_setup;
+        }
        result = __wa_xfer_submit(xfer);
-        if (result < 0)
+        if (result < 0) {
+                pr_err("%s: error_xfer_submit\n", __func__);
                goto error_xfer_submit;
+        }
        spin_unlock_irqrestore(&xfer->lock, flags);
-        return;
+        return 0;
-        /* this is basically wa_xfer_completion() broken up wa_xfer_giveback()
+        /*
-         * does a wa_xfer_put() that will call wa_xfer_destroy() and clean
+         * this is basically wa_xfer_completion() broken up wa_xfer_giveback()
-         * upundo setup().
+         * does a wa_xfer_put() that will call wa_xfer_destroy() and undo
+         * setup().
         */
 error_xfer_setup:
 error_dequeued:
@@ -1081,8 +1608,7 @@ error_dev_gone:
        rpipe_put(xfer->ep->hcpriv);
 error_rpipe_get:
        xfer->result = result;
-        wa_xfer_giveback(xfer);
+        return result;
-        return;
 error_xfer_submit:
        done = __wa_xfer_is_done(xfer);
@@ -1090,6 +1616,8 @@ error_xfer_submit:
        spin_unlock_irqrestore(&xfer->lock, flags);
        if (done)
                wa_xfer_completion(xfer);
+        /* return success since the completion routine will run. */
+        return 0;
 }
 /*
@@ -1123,7 +1651,8 @@ void wa_urb_enqueue_run(struct work_struct *ws)
                list_del_init(&xfer->list_node);
                urb = xfer->urb;
-                wa_urb_enqueue_b(xfer);
+                if (wa_urb_enqueue_b(xfer) < 0)
+                        wa_xfer_giveback(xfer);
                usb_put_urb(urb);       /* taken when queuing */
        }
 }
@@ -1229,7 +1758,19 @@ int wa_urb_enqueue(struct wahc *wa, struct usb_host_endpoint *ep,
                spin_unlock_irqrestore(&wa->xfer_list_lock, my_flags);
                queue_work(wusbd, &wa->xfer_enqueue_work);
        } else {
-                wa_urb_enqueue_b(xfer);
+                result = wa_urb_enqueue_b(xfer);
+                if (result < 0) {
+                        /*
+                         * URB submit/enqueue failed.  Clean up, return an
+                         * error and do not run the callback.  This avoids
+                         * an infinite submit/complete loop.
+                         */
+                        dev_err(dev, "%s: URB enqueue failed: %d\n",
+                           __func__, result);
+                        wa_put(xfer->wa);
+                        wa_xfer_put(xfer);
+                        return result;
+                }
        }
        return 0;
@@ -1264,7 +1805,7 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb)
        struct wa_xfer *xfer;
        struct wa_seg *seg;
        struct wa_rpipe *rpipe;
-        unsigned cnt;
+        unsigned cnt, done = 0, xfer_abort_pending;
        unsigned rpipe_ready = 0;
        xfer = urb->hcpriv;
@@ -1278,6 +1819,7 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb)
                goto out;
        }
        spin_lock_irqsave(&xfer->lock, flags);
+        pr_debug("%s: DEQUEUE xfer id 0x%08X\n", __func__, wa_xfer_id(xfer));
        rpipe = xfer->ep->hcpriv;
        if (rpipe == NULL) {
                pr_debug("%s: xfer id 0x%08X has no RPIPE.  %s",
@@ -1293,9 +1835,11 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb)
        if (xfer->seg == NULL)          /* still hasn't reached */
                goto out_unlock;        /* setup(), enqueue_b() completes */
        /* Ok, the xfer is in flight already, it's been setup and submitted.*/
-        __wa_xfer_abort(xfer);
+        xfer_abort_pending = __wa_xfer_abort(xfer) >= 0;
        for (cnt = 0; cnt < xfer->segs; cnt++) {
                seg = xfer->seg[cnt];
+                pr_debug("%s: xfer id 0x%08X#%d status = %d\n",
+                        __func__, wa_xfer_id(xfer), cnt, seg->status);
                switch (seg->status) {
                case WA_SEG_NOTREADY:
                case WA_SEG_READY:
@@ -1304,42 +1848,50 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb)
                        WARN_ON(1);
                        break;
                case WA_SEG_DELAYED:
+                        /*
+                         * delete from rpipe delayed list.  If no segments on
+                         * this xfer have been submitted, __wa_xfer_is_done will
+                         * trigger a giveback below.  Otherwise, the submitted
+                         * segments will be completed in the DTI interrupt.
+                         */
                        seg->status = WA_SEG_ABORTED;
                        spin_lock_irqsave(&rpipe->seg_lock, flags2);
                        list_del(&seg->list_node);
                        xfer->segs_done++;
-                        rpipe_ready = rpipe_avail_inc(rpipe);
                        spin_unlock_irqrestore(&rpipe->seg_lock, flags2);
                        break;
-                case WA_SEG_SUBMITTED:
-                        seg->status = WA_SEG_ABORTED;
-                        usb_unlink_urb(&seg->urb);
-                        if (xfer->is_inbound == 0)
-                                usb_unlink_urb(seg->dto_urb);
-                        xfer->segs_done++;
-                        rpipe_ready = rpipe_avail_inc(rpipe);
-                        break;
-                case WA_SEG_PENDING:
-                        seg->status = WA_SEG_ABORTED;
-                        xfer->segs_done++;
-                        rpipe_ready = rpipe_avail_inc(rpipe);
-                        break;
-                case WA_SEG_DTI_PENDING:
-                        usb_unlink_urb(wa->dti_urb);
-                        seg->status = WA_SEG_ABORTED;
-                        xfer->segs_done++;
-                        rpipe_ready = rpipe_avail_inc(rpipe);
-                        break;
                case WA_SEG_DONE:
                case WA_SEG_ERROR:
                case WA_SEG_ABORTED:
                        break;
+                        /*
+                         * In the states below, the HWA device already knows
+                         * about the transfer.  If an abort request was sent,
+                         * allow the HWA to process it and wait for the
+                         * results.  Otherwise, the DTI state and seg completed
+                         * counts can get out of sync.
+                         */
+                case WA_SEG_SUBMITTED:
+                case WA_SEG_PENDING:
+                case WA_SEG_DTI_PENDING:
+                        /*
+                         * Check if the abort was successfully sent.  This could
+                         * be false if the HWA has been removed but we haven't
+                         * gotten the disconnect notification yet.
+                         */
+                        if (!xfer_abort_pending) {
+                                seg->status = WA_SEG_ABORTED;
+                                rpipe_ready = rpipe_avail_inc(rpipe);
+                                xfer->segs_done++;
+                        }
+                        break;
                }
        }
        xfer->result = urb->status;     /* -ENOENT or -ECONNRESET */
-        __wa_xfer_is_done(xfer);
+        done = __wa_xfer_is_done(xfer);
        spin_unlock_irqrestore(&xfer->lock, flags);
-        wa_xfer_completion(xfer);
+        if (done)
+                wa_xfer_completion(xfer);
        if (rpipe_ready)
                wa_xfer_delayed_run(rpipe);
        return 0;
@@ -1410,13 +1962,56 @@ static int wa_xfer_status_to_errno(u8 status)
 }
 /*
+ * If a last segment flag and/or a transfer result error is encountered,
+ * no other segment transfer results will be returned from the device.
+ * Mark the remaining submitted or pending xfers as completed so that
+ * the xfer will complete cleanly.
+ */
+static void wa_complete_remaining_xfer_segs(struct wa_xfer *xfer,
+                struct wa_seg *incoming_seg)
+{
+        int index;
+        struct wa_rpipe *rpipe = xfer->ep->hcpriv;
+        for (index = incoming_seg->index + 1; index < xfer->segs_submitted;
+                index++) {
+                struct wa_seg *current_seg = xfer->seg[index];
+                BUG_ON(current_seg == NULL);
+                switch (current_seg->status) {
+                case WA_SEG_SUBMITTED:
+                case WA_SEG_PENDING:
+                case WA_SEG_DTI_PENDING:
+                        rpipe_avail_inc(rpipe);
+                /*
+                 * do not increment RPIPE avail for the WA_SEG_DELAYED case
+                 * since it has not been submitted to the RPIPE.
+                 */
+                case WA_SEG_DELAYED:
+                        xfer->segs_done++;
+                        current_seg->status = incoming_seg->status;
+                        break;
+                case WA_SEG_ABORTED:
+                        break;
+                default:
+                        WARN(1, "%s: xfer 0x%08X#%d. bad seg status = %d\n",
+                                __func__, wa_xfer_id(xfer), index,
+                                current_seg->status);
+                        break;
+                }
+        }
+}
+/*
 * Process a xfer result completion message
 *
- * inbound transfers: need to schedule a DTI read
+ * inbound transfers: need to schedule a buf_in_urb read
 *
 * FIXME: this function needs to be broken up in parts
 */
-static void wa_xfer_result_chew(struct wahc *wa, struct wa_xfer *xfer)
+static void wa_xfer_result_chew(struct wahc *wa, struct wa_xfer *xfer,
+                struct wa_xfer_result *xfer_result)
 {
        int result;
        struct device *dev = &wa->usb_iface->dev;
@@ -1424,8 +2019,7 @@ static void wa_xfer_result_chew(struct wahc *wa, struct wa_xfer *xfer)
        u8 seg_idx;
        struct wa_seg *seg;
        struct wa_rpipe *rpipe;
-        struct wa_xfer_result *xfer_result = wa->xfer_result;
+        unsigned done = 0;
-        u8 done = 0;
        u8 usb_status;
        unsigned rpipe_ready = 0;
@@ -1436,8 +2030,8 @@ static void wa_xfer_result_chew(struct wahc *wa, struct wa_xfer *xfer)
        seg = xfer->seg[seg_idx];
        rpipe = xfer->ep->hcpriv;
        usb_status = xfer_result->bTransferStatus;
-        dev_dbg(dev, "xfer %p#%u: bTransferStatus 0x%02x (seg status %u)\n",
+        dev_dbg(dev, "xfer %p ID 0x%08X#%u: bTransferStatus 0x%02x (seg status %u)\n",
-                xfer, seg_idx, usb_status, seg->status);
+                xfer, wa_xfer_id(xfer), seg_idx, usb_status, seg->status);
        if (seg->status == WA_SEG_ABORTED
            || seg->status == WA_SEG_ERROR)     /* already handled */
                goto segment_aborted;
@@ -1453,12 +2047,19 @@ static void wa_xfer_result_chew(struct wahc *wa, struct wa_xfer *xfer)
                seg->result = wa_xfer_status_to_errno(usb_status);
                dev_err(dev, "DTI: xfer %p#:%08X:%u failed (0x%02x)\n",
                        xfer, xfer->id, seg->index, usb_status);
+                seg->status = ((usb_status & 0x7F) == WA_XFER_STATUS_ABORTED) ?
+                        WA_SEG_ABORTED : WA_SEG_ERROR;
                goto error_complete;
        }
        /* FIXME: we ignore warnings, tally them for stats */
        if (usb_status & 0x40)          /* Warning?... */
                usb_status = 0;         /* ... pass */
-        if (xfer->is_inbound) { /* IN data phase: read to buffer */
+        if (usb_pipeisoc(xfer->urb->pipe)) {
+                /* set up WA state to read the isoc packet status next. */
+                wa->dti_isoc_xfer_in_progress = wa_xfer_id(xfer);
+                wa->dti_isoc_xfer_seg = seg_idx;
+                wa->dti_state = WA_DTI_ISOC_PACKET_STATUS_PENDING;
+        } else if (xfer->is_inbound) {  /* IN data phase: read to buffer */
                seg->status = WA_SEG_DTI_PENDING;
                BUG_ON(wa->buf_in_urb->status == -EINPROGRESS);
                /* this should always be 0 before a resubmit. */
@@ -1535,12 +2136,14 @@ error_submit_buf_in:
                        xfer, seg_idx, result);
        seg->result = result;
        kfree(wa->buf_in_urb->sg);
+        wa->buf_in_urb->sg = NULL;
 error_sg_alloc:
        __wa_xfer_abort(xfer);
-error_complete:
        seg->status = WA_SEG_ERROR;
+error_complete:
        xfer->segs_done++;
        rpipe_ready = rpipe_avail_inc(rpipe);
+        wa_complete_remaining_xfer_segs(xfer, seg);
        done = __wa_xfer_is_done(xfer);
        /*
         * queue work item to clear STALL for control endpoints.
@@ -1552,10 +2155,8 @@ error_complete:
                dev_info(dev, "Control EP stall.  Queue delayed work.\n");
                spin_lock_irq(&wa->xfer_list_lock);
-                /* remove xfer from xfer_list. */
+                /* move xfer from xfer_list to xfer_errored_list. */
-                list_del(&xfer->list_node);
+                list_move_tail(&xfer->list_node, &wa->xfer_errored_list);
-                /* add xfer to xfer_errored_list. */
-                list_add_tail(&xfer->list_node, &wa->xfer_errored_list);
                spin_unlock_irq(&wa->xfer_list_lock);
                spin_unlock_irqrestore(&xfer->lock, flags);
                queue_work(wusbd, &wa->xfer_error_work);
@@ -1587,6 +2188,90 @@ segment_aborted:
 }
 /*
+ * Process a isochronous packet status message
+ *
+ * inbound transfers: need to schedule a buf_in_urb read
+ */
+static void wa_process_iso_packet_status(struct wahc *wa, struct urb *urb)
+{
+        struct device *dev = &wa->usb_iface->dev;
+        struct wa_xfer_packet_status_hwaiso *packet_status;
+        struct wa_xfer_packet_status_len_hwaiso *status_array;
+        struct wa_xfer *xfer;
+        unsigned long flags;
+        struct wa_seg *seg;
+        struct wa_rpipe *rpipe;
+        unsigned done = 0;
+        unsigned rpipe_ready = 0, seg_index;
+        int expected_size;
+        /* We have a xfer result buffer; check it */
+        dev_dbg(dev, "DTI: isoc packet status %d bytes at %p\n",
+                urb->actual_length, urb->transfer_buffer);
+        packet_status = (struct wa_xfer_packet_status_hwaiso *)(wa->dti_buf);
+        if (packet_status->bPacketType != WA_XFER_ISO_PACKET_STATUS) {
+                dev_err(dev, "DTI Error: isoc packet status--bad type 0x%02x\n",
+                        packet_status->bPacketType);
+                goto error_parse_buffer;
+        }
+        xfer = wa_xfer_get_by_id(wa, wa->dti_isoc_xfer_in_progress);
+        if (xfer == NULL) {
+                dev_err(dev, "DTI Error: isoc packet status--unknown xfer 0x%08x\n",
+                        wa->dti_isoc_xfer_in_progress);
+                goto error_parse_buffer;
+        }
+        spin_lock_irqsave(&xfer->lock, flags);
+        if (unlikely(wa->dti_isoc_xfer_seg >= xfer->segs))
+                goto error_bad_seg;
+        seg = xfer->seg[wa->dti_isoc_xfer_seg];
+        rpipe = xfer->ep->hcpriv;
+        expected_size = sizeof(*packet_status) +
+                        (sizeof(packet_status->PacketStatus[0]) *
+                        seg->isoc_frame_count);
+        if (urb->actual_length != expected_size) {
+                dev_err(dev, "DTI Error: isoc packet status--bad urb length (%d bytes vs %d needed)\n",
+                        urb->actual_length, expected_size);
+                goto error_bad_seg;
+        }
+        if (le16_to_cpu(packet_status->wLength) != expected_size) {
+                dev_err(dev, "DTI Error: isoc packet status--bad length %u\n",
+                        le16_to_cpu(packet_status->wLength));
+                goto error_bad_seg;
+        }
+        /* isoc packet status and lengths back xfer urb. */
+        status_array = packet_status->PacketStatus;
+        for (seg_index = 0; seg_index < seg->isoc_frame_count; ++seg_index) {
+                xfer->urb->iso_frame_desc[seg->index].status =
+                        wa_xfer_status_to_errno(
+                        le16_to_cpu(status_array[seg_index].PacketStatus));
+                xfer->urb->iso_frame_desc[seg->index].actual_length =
+                        le16_to_cpu(status_array[seg_index].PacketLength);
+        }
+        if (!xfer->is_inbound) {
+                /* OUT transfer, complete it -- */
+                seg->status = WA_SEG_DONE;
+                xfer->segs_done++;
+                rpipe_ready = rpipe_avail_inc(rpipe);
+                done = __wa_xfer_is_done(xfer);
+        }
+        spin_unlock_irqrestore(&xfer->lock, flags);
+        wa->dti_state = WA_DTI_TRANSFER_RESULT_PENDING;
+        if (done)
+                wa_xfer_completion(xfer);
+        if (rpipe_ready)
+                wa_xfer_delayed_run(rpipe);
+        wa_xfer_put(xfer);
+        return;
+error_bad_seg:
+        spin_unlock_irqrestore(&xfer->lock, flags);
+        wa_xfer_put(xfer);
+error_parse_buffer:
+        return;
+}
+/*
 * Callback for the IN data phase
 *
 * If successful transition state; otherwise, take a note of the
@@ -1687,56 +2372,61 @@ static void wa_buf_in_cb(struct urb *urb)
 * We go back to OFF when we detect a ENOENT or ESHUTDOWN (or too many
 * errors) in the URBs.
 */
-static void wa_xfer_result_cb(struct urb *urb)
+static void wa_dti_cb(struct urb *urb)
 {
        int result;
        struct wahc *wa = urb->context;
        struct device *dev = &wa->usb_iface->dev;
-        struct wa_xfer_result *xfer_result;
        u32 xfer_id;
-        struct wa_xfer *xfer;
        u8 usb_status;
        BUG_ON(wa->dti_urb != urb);
        switch (wa->dti_urb->status) {
        case 0:
-                /* We have a xfer result buffer; check it */
+                if (wa->dti_state == WA_DTI_TRANSFER_RESULT_PENDING) {
-                dev_dbg(dev, "DTI: xfer result %d bytes at %p\n",
+                        struct wa_xfer_result *xfer_result;
-                        urb->actual_length, urb->transfer_buffer);
+                        struct wa_xfer *xfer;
-                if (wa->dti_urb->actual_length != sizeof(*xfer_result)) {
-                        dev_err(dev, "DTI Error: xfer result--bad size "
+                        /* We have a xfer result buffer; check it */
-                                "xfer result (%d bytes vs %zu needed)\n",
+                        dev_dbg(dev, "DTI: xfer result %d bytes at %p\n",
-                                urb->actual_length, sizeof(*xfer_result));
+                                urb->actual_length, urb->transfer_buffer);
-                        break;
+                        if (urb->actual_length != sizeof(*xfer_result)) {
-                }
+                                dev_err(dev, "DTI Error: xfer result--bad size xfer result (%d bytes vs %zu needed)\n",
-                xfer_result = wa->xfer_result;
+                                        urb->actual_length,
-                if (xfer_result->hdr.bLength != sizeof(*xfer_result)) {
+                                        sizeof(*xfer_result));
-                        dev_err(dev, "DTI Error: xfer result--"
+                                break;
-                                "bad header length %u\n",
+                        }
-                                xfer_result->hdr.bLength);
+                        xfer_result = (struct wa_xfer_result *)(wa->dti_buf);
-                        break;
+                        if (xfer_result->hdr.bLength != sizeof(*xfer_result)) {
-                }
+                                dev_err(dev, "DTI Error: xfer result--bad header length %u\n",
-                if (xfer_result->hdr.bNotifyType != WA_XFER_RESULT) {
+                                        xfer_result->hdr.bLength);
-                        dev_err(dev, "DTI Error: xfer result--"
+                                break;
-                                "bad header type 0x%02x\n",
+                        }
-                                xfer_result->hdr.bNotifyType);
+                        if (xfer_result->hdr.bNotifyType != WA_XFER_RESULT) {
-                        break;
+                                dev_err(dev, "DTI Error: xfer result--bad header type 0x%02x\n",
-                }
+                                        xfer_result->hdr.bNotifyType);
-                usb_status = xfer_result->bTransferStatus & 0x3f;
+                                break;
-                if (usb_status == WA_XFER_STATUS_NOT_FOUND)
+                        }
-                        /* taken care of already */
+                        usb_status = xfer_result->bTransferStatus & 0x3f;
-                        break;
+                        if (usb_status == WA_XFER_STATUS_NOT_FOUND)
-                xfer_id = xfer_result->dwTransferID;
+                                /* taken care of already */
-                xfer = wa_xfer_get_by_id(wa, xfer_id);
+                                break;
-                if (xfer == NULL) {
+                        xfer_id = le32_to_cpu(xfer_result->dwTransferID);
-                        /* FIXME: transaction might have been cancelled */
+                        xfer = wa_xfer_get_by_id(wa, xfer_id);
-                        dev_err(dev, "DTI Error: xfer result--"
+                        if (xfer == NULL) {
-                                "unknown xfer 0x%08x (status 0x%02x)\n",
+                                /* FIXME: transaction not found. */
-                                xfer_id, usb_status);
+                                dev_err(dev, "DTI Error: xfer result--unknown xfer 0x%08x (status 0x%02x)\n",
-                        break;
+                                        xfer_id, usb_status);
+                                break;
+                        }
+                        wa_xfer_result_chew(wa, xfer, xfer_result);
+                        wa_xfer_put(xfer);
+                } else if (wa->dti_state == WA_DTI_ISOC_PACKET_STATUS_PENDING) {
+                        wa_process_iso_packet_status(wa, urb);
+                } else {
+                        dev_err(dev, "DTI Error: unexpected EP state = %d\n",
+                                wa->dti_state);
                }
-                wa_xfer_result_chew(wa, xfer);
-                wa_xfer_put(xfer);
                break;
        case -ENOENT:           /* (we killed the URB)...so, no broadcast */
        case -ESHUTDOWN:        /* going away! */
@@ -1777,7 +2467,7 @@ out:
 * don't really set it up and start it until the first xfer complete
 * notification arrives, which is what we do here.
 *
- * Follow up in wa_xfer_result_cb(), as that's where the whole state
+ * Follow up in wa_dti_cb(), as that's where the whole state
 * machine starts.
 *
 * So here we just initialize the DTI URB for reading transfer result
@@ -1813,8 +2503,8 @@ void wa_handle_notif_xfer(struct wahc *wa, struct wa_notif_hdr *notif_hdr)
        usb_fill_bulk_urb(
                wa->dti_urb, wa->usb_dev,
                usb_rcvbulkpipe(wa->usb_dev, 0x80 | notif_xfer->bEndpoint),
-                wa->xfer_result, wa->xfer_result_size,
+                wa->dti_buf, wa->dti_buf_size,
-                wa_xfer_result_cb, wa);
+                wa_dti_cb, wa);
        wa->buf_in_urb = usb_alloc_urb(0, GFP_KERNEL);
        if (wa->buf_in_urb == NULL) {
@@ -1836,6 +2526,7 @@ out:
 error_dti_urb_submit:
        usb_put_urb(wa->buf_in_urb);
+        wa->buf_in_urb = NULL;
 error_buf_in_urb_alloc:
        usb_put_urb(wa->dti_urb);
        wa->dti_urb = NULL;
diff --git a/drivers/uwb/lc-dev.c b/drivers/uwb/lc-dev.c
index 9209eafc75b1..80079b8fed15 100644
--- a/drivers/uwb/lc-dev.c
+++ b/drivers/uwb/lc-dev.c
@@ -244,7 +244,7 @@ static ssize_t uwb_dev_RSSI_store(struct device *dev,
 static DEVICE_ATTR(RSSI, S_IRUGO | S_IWUSR, uwb_dev_RSSI_show, uwb_dev_RSSI_store);
-static struct attribute *dev_attrs[] = {
+static struct attribute *uwb_dev_attrs[] = {
        &dev_attr_EUI_48.attr,
        &dev_attr_DevAddr.attr,
        &dev_attr_BPST.attr,
@@ -253,20 +253,10 @@ static struct attribute *dev_attrs[] = {
        &dev_attr_RSSI.attr,
        NULL,
 };
+ATTRIBUTE_GROUPS(uwb_dev);
-static struct attribute_group dev_attr_group = {
-        .attrs = dev_attrs,
-};
-static const struct attribute_group *groups[] = {
-        &dev_attr_group,
-        NULL,
-};
 /**
 * Device SYSFS registration
- *
- *
 */
 static int __uwb_dev_sys_add(struct uwb_dev *uwb_dev, struct device *parent_dev)
 {
@@ -276,7 +266,7 @@ static int __uwb_dev_sys_add(struct uwb_dev *uwb_dev, struct device *parent_dev)
        /* Device sysfs files are only useful for neighbor devices not
           local radio controllers. */
        if (&uwb_dev->rc->uwb_dev != uwb_dev)
-                dev->groups = groups;
+                dev->groups = uwb_dev_groups;
        dev->parent = parent_dev;
        dev_set_drvdata(dev, uwb_dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index ce5221fa393a..e663921eebb6 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1056,7 +1056,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                if (data_direction != DMA_NONE) {
                        ret = vhost_scsi_map_iov_to_sgl(cmd,
                                        &vq->iov[data_first], data_num,
-                                        data_direction == DMA_TO_DEVICE);
+                                        data_direction == DMA_FROM_DEVICE);
                        if (unlikely(ret)) {
                                vq_err(vq, "Failed to map iov to sgl\n");
                                goto err_free;
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index a54ccdc4d661..22ad85242e5b 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -361,37 +361,13 @@ void au1100fb_fb_rotate(struct fb_info *fbi, int angle)
 int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
 {
        struct au1100fb_device *fbdev;
-        unsigned int len;
-        unsigned long start=0, off;
        fbdev = to_au1100fb_device(fbi);
-        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
-                return -EINVAL;
-        }
-        start = fbdev->fb_phys & PAGE_MASK;
-        len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
-        off = vma->vm_pgoff << PAGE_SHIFT;
-        if ((vma->vm_end - vma->vm_start + off) > len) {
-                return -EINVAL;
-        }
-        off += start;
-        vma->vm_pgoff = off >> PAGE_SHIFT;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
        pgprot_val(vma->vm_page_prot) |= (6 << 9); //CCA=6
-        if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+        return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
-                                vma->vm_end - vma->vm_start,
-                                vma->vm_page_prot)) {
-                return -EAGAIN;
-        }
-        return 0;
 }
 static struct fb_ops au1100fb_ops =
diff --git a/drivers/video/au1200fb.c b/drivers/video/au1200fb.c
index 301224ecc950..1d02897d17f2 100644
--- a/drivers/video/au1200fb.c
+++ b/drivers/video/au1200fb.c
@@ -1233,34 +1233,13 @@ static int au1200fb_fb_blank(int blank_mode, struct fb_info *fbi)
 * method mainly to allow the use of the TLB streaming flag (CCA=6)
 */
 static int au1200fb_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
-        unsigned int len;
-        unsigned long start=0, off;
        struct au1200fb_device *fbdev = info->par;
-        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
-                return -EINVAL;
-        }
-        start = fbdev->fb_phys & PAGE_MASK;
-        len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
-        off = vma->vm_pgoff << PAGE_SHIFT;
-        if ((vma->vm_end - vma->vm_start + off) > len) {
-                return -EINVAL;
-        }
-        off += start;
-        vma->vm_pgoff = off >> PAGE_SHIFT;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
        pgprot_val(vma->vm_page_prot) |= _CACHE_MASK; /* CCA=7 */
-        return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+        return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
-                                  vma->vm_end - vma->vm_start,
-                                  vma->vm_page_prot);
 }
 static void set_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)
diff --git a/drivers/video/exynos/Kconfig b/drivers/video/exynos/Kconfig
index 1b035b2eb6b6..1129d0e9e640 100644
--- a/drivers/video/exynos/Kconfig
+++ b/drivers/video/exynos/Kconfig
@@ -16,6 +16,7 @@ if EXYNOS_VIDEO
 config EXYNOS_MIPI_DSI
        bool "EXYNOS MIPI DSI driver support."
        depends on ARCH_S5PV210 || ARCH_EXYNOS
+        select GENERIC_PHY
        help
          This enables support for MIPI-DSI device.
@@ -29,7 +30,7 @@ config EXYNOS_LCD_S6E8AX0
 config EXYNOS_DP
        bool "EXYNOS DP driver support"
-        depends on ARCH_EXYNOS
+        depends on OF && ARCH_EXYNOS
        default n
        help
          This enables support for DP device.
diff --git a/drivers/video/exynos/exynos_dp_core.c b/drivers/video/exynos/exynos_dp_core.c
index 12bbede3b091..5e1a71580051 100644
--- a/drivers/video/exynos/exynos_dp_core.c
+++ b/drivers/video/exynos/exynos_dp_core.c
@@ -19,8 +19,7 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/of.h>
+#include <linux/phy/phy.h>
-#include <video/exynos_dp.h>
 #include "exynos_dp_core.h"
@@ -894,26 +893,17 @@ static void exynos_dp_hotplug(struct work_struct *work)
                dev_err(dp->dev, "unable to config video\n");
 }
-#ifdef CONFIG_OF
+static struct video_info *exynos_dp_dt_parse_pdata(struct device *dev)
-static struct exynos_dp_platdata *exynos_dp_dt_parse_pdata(struct device *dev)
 {
        struct device_node *dp_node = dev->of_node;
-        struct exynos_dp_platdata *pd;
        struct video_info *dp_video_config;
-        pd = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL);
-        if (!pd) {
-                dev_err(dev, "memory allocation for pdata failed\n");
-                return ERR_PTR(-ENOMEM);
-        }
        dp_video_config = devm_kzalloc(dev,
                                sizeof(*dp_video_config), GFP_KERNEL);
        if (!dp_video_config) {
                dev_err(dev, "memory allocation for video config failed\n");
                return ERR_PTR(-ENOMEM);
        }
-        pd->video_info = dp_video_config;
        dp_video_config->h_sync_polarity =
                of_property_read_bool(dp_node, "hsync-active-high");
@@ -960,7 +950,7 @@ static struct exynos_dp_platdata *exynos_dp_dt_parse_pdata(struct device *dev)
                return ERR_PTR(-EINVAL);
        }
-        return pd;
+        return dp_video_config;
 }
 static int exynos_dp_dt_parse_phydata(struct exynos_dp_device *dp)
@@ -971,8 +961,11 @@ static int exynos_dp_dt_parse_phydata(struct exynos_dp_device *dp)
        dp_phy_node = of_find_node_by_name(dp_phy_node, "dptx-phy");
        if (!dp_phy_node) {
-                dev_err(dp->dev, "could not find dptx-phy node\n");
+                dp->phy = devm_phy_get(dp->dev, "dp");
-                return -ENODEV;
+                if (IS_ERR(dp->phy))
+                        return PTR_ERR(dp->phy);
+                else
+                        return 0;
        }
        if (of_property_read_u32(dp_phy_node, "reg", &phy_base)) {
@@ -1003,48 +996,34 @@ err:
 static void exynos_dp_phy_init(struct exynos_dp_device *dp)
 {
-        u32 reg;
+        if (dp->phy) {
+                phy_power_on(dp->phy);
-        reg = __raw_readl(dp->phy_addr);
+        } else if (dp->phy_addr) {
-        reg |= dp->enable_mask;
+                u32 reg;
-        __raw_writel(reg, dp->phy_addr);
-}
+                reg = __raw_readl(dp->phy_addr);
+                reg |= dp->enable_mask;
-static void exynos_dp_phy_exit(struct exynos_dp_device *dp)
+                __raw_writel(reg, dp->phy_addr);
-{
+        }
-        u32 reg;
-        reg = __raw_readl(dp->phy_addr);
-        reg &= ~(dp->enable_mask);
-        __raw_writel(reg, dp->phy_addr);
-}
-#else
-static struct exynos_dp_platdata *exynos_dp_dt_parse_pdata(struct device *dev)
-{
-        return NULL;
-}
-static int exynos_dp_dt_parse_phydata(struct exynos_dp_device *dp)
-{
-        return -EINVAL;
-}
-static void exynos_dp_phy_init(struct exynos_dp_device *dp)
-{
-        return;
 }
 static void exynos_dp_phy_exit(struct exynos_dp_device *dp)
 {
-        return;
+        if (dp->phy) {
+                phy_power_off(dp->phy);
+        } else if (dp->phy_addr) {
+                u32 reg;
+                reg = __raw_readl(dp->phy_addr);
+                reg &= ~(dp->enable_mask);
+                __raw_writel(reg, dp->phy_addr);
+        }
 }
-#endif /* CONFIG_OF */
 static int exynos_dp_probe(struct platform_device *pdev)
 {
        struct resource *res;
        struct exynos_dp_device *dp;
-        struct exynos_dp_platdata *pdata;
        int ret = 0;
@@ -1057,21 +1036,13 @@ static int exynos_dp_probe(struct platform_device *pdev)
        dp->dev = &pdev->dev;
-        if (pdev->dev.of_node) {
+        dp->video_info = exynos_dp_dt_parse_pdata(&pdev->dev);
-                pdata = exynos_dp_dt_parse_pdata(&pdev->dev);
+        if (IS_ERR(dp->video_info))
-                if (IS_ERR(pdata))
+                return PTR_ERR(dp->video_info);
-                        return PTR_ERR(pdata);
-                ret = exynos_dp_dt_parse_phydata(dp);
+        ret = exynos_dp_dt_parse_phydata(dp);
-                if (ret)
+        if (ret)
-                        return ret;
+                return ret;
-        } else {
-                pdata = pdev->dev.platform_data;
-                if (!pdata) {
-                        dev_err(&pdev->dev, "no platform data\n");
-                        return -EINVAL;
-                }
-        }
        dp->clock = devm_clk_get(&pdev->dev, "dp");
        if (IS_ERR(dp->clock)) {
@@ -1095,15 +1066,7 @@ static int exynos_dp_probe(struct platform_device *pdev)
        INIT_WORK(&dp->hotplug_work, exynos_dp_hotplug);
-        dp->video_info = pdata->video_info;
+        exynos_dp_phy_init(dp);
-        if (pdev->dev.of_node) {
-                if (dp->phy_addr)
-                        exynos_dp_phy_init(dp);
-        } else {
-                if (pdata->phy_init)
-                        pdata->phy_init();
-        }
        exynos_dp_init_dp(dp);
@@ -1121,18 +1084,11 @@ static int exynos_dp_probe(struct platform_device *pdev)
 static int exynos_dp_remove(struct platform_device *pdev)
 {
-        struct exynos_dp_platdata *pdata = pdev->dev.platform_data;
        struct exynos_dp_device *dp = platform_get_drvdata(pdev);
        flush_work(&dp->hotplug_work);
-        if (pdev->dev.of_node) {
+        exynos_dp_phy_exit(dp);
-                if (dp->phy_addr)
-                        exynos_dp_phy_exit(dp);
-        } else {
-                if (pdata->phy_exit)
-                        pdata->phy_exit();
-        }
        clk_disable_unprepare(dp->clock);
@@ -1143,20 +1099,13 @@ static int exynos_dp_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM_SLEEP
 static int exynos_dp_suspend(struct device *dev)
 {
-        struct exynos_dp_platdata *pdata = dev->platform_data;
        struct exynos_dp_device *dp = dev_get_drvdata(dev);
        disable_irq(dp->irq);
        flush_work(&dp->hotplug_work);
-        if (dev->of_node) {
+        exynos_dp_phy_exit(dp);
-                if (dp->phy_addr)
-                        exynos_dp_phy_exit(dp);
-        } else {
-                if (pdata->phy_exit)
-                        pdata->phy_exit();
-        }
        clk_disable_unprepare(dp->clock);
@@ -1165,16 +1114,9 @@ static int exynos_dp_suspend(struct device *dev)
 static int exynos_dp_resume(struct device *dev)
 {
-        struct exynos_dp_platdata *pdata = dev->platform_data;
        struct exynos_dp_device *dp = dev_get_drvdata(dev);
-        if (dev->of_node) {
+        exynos_dp_phy_init(dp);
-                if (dp->phy_addr)
-                        exynos_dp_phy_init(dp);
-        } else {
-                if (pdata->phy_init)
-                        pdata->phy_init();
-        }
        clk_prepare_enable(dp->clock);
@@ -1203,7 +1145,7 @@ static struct platform_driver exynos_dp_driver = {
                .name   = "exynos-dp",
                .owner  = THIS_MODULE,
                .pm     = &exynos_dp_pm_ops,
-                .of_match_table = of_match_ptr(exynos_dp_match),
+                .of_match_table = exynos_dp_match,
        },
 };
diff --git a/drivers/video/exynos/exynos_dp_core.h b/drivers/video/exynos/exynos_dp_core.h
index 6c567bbf2fb8..607e36d0c147 100644
--- a/drivers/video/exynos/exynos_dp_core.h
+++ b/drivers/video/exynos/exynos_dp_core.h
@@ -13,6 +13,99 @@
 #ifndef _EXYNOS_DP_CORE_H
 #define _EXYNOS_DP_CORE_H
+#define DP_TIMEOUT_LOOP_COUNT 100
+#define MAX_CR_LOOP 5
+#define MAX_EQ_LOOP 5
+enum link_rate_type {
+        LINK_RATE_1_62GBPS = 0x06,
+        LINK_RATE_2_70GBPS = 0x0a
+};
+enum link_lane_count_type {
+        LANE_COUNT1 = 1,
+        LANE_COUNT2 = 2,
+        LANE_COUNT4 = 4
+};
+enum link_training_state {
+        START,
+        CLOCK_RECOVERY,
+        EQUALIZER_TRAINING,
+        FINISHED,
+        FAILED
+};
+enum voltage_swing_level {
+        VOLTAGE_LEVEL_0,
+        VOLTAGE_LEVEL_1,
+        VOLTAGE_LEVEL_2,
+        VOLTAGE_LEVEL_3,
+};
+enum pre_emphasis_level {
+        PRE_EMPHASIS_LEVEL_0,
+        PRE_EMPHASIS_LEVEL_1,
+        PRE_EMPHASIS_LEVEL_2,
+        PRE_EMPHASIS_LEVEL_3,
+};
+enum pattern_set {
+        PRBS7,
+        D10_2,
+        TRAINING_PTN1,
+        TRAINING_PTN2,
+        DP_NONE
+};
+enum color_space {
+        COLOR_RGB,
+        COLOR_YCBCR422,
+        COLOR_YCBCR444
+};
+enum color_depth {
+        COLOR_6,
+        COLOR_8,
+        COLOR_10,
+        COLOR_12
+};
+enum color_coefficient {
+        COLOR_YCBCR601,
+        COLOR_YCBCR709
+};
+enum dynamic_range {
+        VESA,
+        CEA
+};
+enum pll_status {
+        PLL_UNLOCKED,
+        PLL_LOCKED
+};
+enum clock_recovery_m_value_type {
+        CALCULATED_M,
+        REGISTER_M
+};
+enum video_timing_recognition_type {
+        VIDEO_TIMING_FROM_CAPTURE,
+        VIDEO_TIMING_FROM_REGISTER
+};
+enum analog_power_block {
+        AUX_BLOCK,
+        CH0_BLOCK,
+        CH1_BLOCK,
+        CH2_BLOCK,
+        CH3_BLOCK,
+        ANALOG_TOTAL,
+        POWER_ALL
+};
 enum dp_irq_type {
        DP_IRQ_TYPE_HP_CABLE_IN,
        DP_IRQ_TYPE_HP_CABLE_OUT,
@@ -20,6 +113,22 @@ enum dp_irq_type {
        DP_IRQ_TYPE_UNKNOWN,
 };
+struct video_info {
+        char *name;
+        bool h_sync_polarity;
+        bool v_sync_polarity;
+        bool interlaced;
+        enum color_space color_space;
+        enum dynamic_range dynamic_range;
+        enum color_coefficient ycbcr_coeff;
+        enum color_depth color_depth;
+        enum link_rate_type link_rate;
+        enum link_lane_count_type lane_count;
+};
 struct link_train {
        int eq_loop;
        int cr_loop[4];
@@ -42,6 +151,7 @@ struct exynos_dp_device {
        struct video_info       *video_info;
        struct link_train       link_train;
        struct work_struct      hotplug_work;
+        struct phy              *phy;
 };
 /* exynos_dp_reg.c */
diff --git a/drivers/video/exynos/exynos_dp_reg.c b/drivers/video/exynos/exynos_dp_reg.c
index 29d9d035c73a..b70da5052ff0 100644
--- a/drivers/video/exynos/exynos_dp_reg.c
+++ b/drivers/video/exynos/exynos_dp_reg.c
@@ -14,8 +14,6 @@
 #include <linux/io.h>
 #include <linux/delay.h>
-#include <video/exynos_dp.h>
 #include "exynos_dp_core.h"
 #include "exynos_dp_reg.h"
diff --git a/drivers/video/exynos/exynos_mipi_dsi.c b/drivers/video/exynos/exynos_mipi_dsi.c
index 32e540600f99..00b3a52c1d68 100644
--- a/drivers/video/exynos/exynos_mipi_dsi.c
+++ b/drivers/video/exynos/exynos_mipi_dsi.c
@@ -30,6 +30,7 @@
 #include <linux/interrupt.h>
 #include <linux/kthread.h>
 #include <linux/notifier.h>
+#include <linux/phy/phy.h>
 #include <linux/regulator/consumer.h>
 #include <linux/pm_runtime.h>
 #include <linux/err.h>
@@ -156,8 +157,7 @@ static int exynos_mipi_dsi_blank_mode(struct mipi_dsim_device *dsim, int power)
                exynos_mipi_regulator_enable(dsim);
                /* enable MIPI-DSI PHY. */
-                if (dsim->pd->phy_enable)
+                phy_power_on(dsim->phy);
-                        dsim->pd->phy_enable(pdev, true);
                clk_enable(dsim->clock);
@@ -373,6 +373,10 @@ static int exynos_mipi_dsi_probe(struct platform_device *pdev)
                return ret;
        }
+        dsim->phy = devm_phy_get(&pdev->dev, "dsim");
+        if (IS_ERR(dsim->phy))
+                return PTR_ERR(dsim->phy);
        dsim->clock = devm_clk_get(&pdev->dev, "dsim0");
        if (IS_ERR(dsim->clock)) {
                dev_err(&pdev->dev, "failed to get dsim clock source\n");
@@ -439,8 +443,7 @@ static int exynos_mipi_dsi_probe(struct platform_device *pdev)
        exynos_mipi_regulator_enable(dsim);
        /* enable MIPI-DSI PHY. */
-        if (dsim->pd->phy_enable)
+        phy_power_on(dsim->phy);
-                dsim->pd->phy_enable(pdev, true);
        exynos_mipi_update_cfg(dsim);
@@ -504,9 +507,8 @@ static int exynos_mipi_dsi_suspend(struct device *dev)
        if (client_drv && client_drv->suspend)
                client_drv->suspend(client_dev);
-        /* enable MIPI-DSI PHY. */
+        /* disable MIPI-DSI PHY. */
-        if (dsim->pd->phy_enable)
+        phy_power_off(dsim->phy);
-                dsim->pd->phy_enable(pdev, false);
        clk_disable(dsim->clock);
@@ -536,8 +538,7 @@ static int exynos_mipi_dsi_resume(struct device *dev)
        exynos_mipi_regulator_enable(dsim);
        /* enable MIPI-DSI PHY. */
-        if (dsim->pd->phy_enable)
+        phy_power_on(dsim->phy);
-                dsim->pd->phy_enable(pdev, true);
        clk_enable(dsim->clock);
diff --git a/fs/dcache.c b/fs/dcache.c
index 41000305d716..ae6ebb88ceff 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -542,7 +542,7 @@ EXPORT_SYMBOL(d_drop);
 * If ref is non-zero, then decrement the refcount too.
 * Returns dentry requiring refcount drop, or NULL if we're done.
 */
-static inline struct dentry *
+static struct dentry *
 dentry_kill(struct dentry *dentry, int unlock_on_failure)
        __releases(dentry->d_lock)
 {
@@ -630,7 +630,8 @@ repeat:
                        goto kill_it;
        }
-        dentry->d_flags |= DCACHE_REFERENCED;
+        if (!(dentry->d_flags & DCACHE_REFERENCED))
+                dentry->d_flags |= DCACHE_REFERENCED;
        dentry_lru_add(dentry);
        dentry->d_lockref.count--;
@@ -1331,14 +1332,6 @@ rename_retry:
 * list is non-empty and continue searching.
 */
-/**
- * have_submounts - check for mounts over a dentry
- * @parent: dentry to check.
- *
- * Return true if the parent or its subdirectories contain
- * a mount point
- */
 static enum d_walk_ret check_mount(void *data, struct dentry *dentry)
 {
        int *ret = data;
@@ -1349,6 +1342,13 @@ static enum d_walk_ret check_mount(void *data, struct dentry *dentry)
        return D_WALK_CONTINUE;
 }
+/**
+ * have_submounts - check for mounts over a dentry
+ * @parent: dentry to check.
+ *
+ * Return true if the parent or its subdirectories contain
+ * a mount point
+ */
 int have_submounts(struct dentry *parent)
 {
        int ret = 0;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index c88e355f7635..000eae2782b6 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -408,7 +408,7 @@ static loff_t lower_offset_for_page(struct ecryptfs_crypt_stat *crypt_stat,
                                    struct page *page)
 {
        return ecryptfs_lower_header_size(crypt_stat) +
-               (page->index << PAGE_CACHE_SHIFT);
+               ((loff_t)page->index << PAGE_CACHE_SHIFT);
 }
 /**
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 7d52806c2119..4725a07f003c 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1149,7 +1149,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
        struct ecryptfs_msg_ctx *msg_ctx;
        struct ecryptfs_message *msg = NULL;
        char *auth_tok_sig;
-        char *payload;
+        char *payload = NULL;
        size_t payload_len = 0;
        int rc;
@@ -1203,6 +1203,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
        }
 out:
        kfree(msg);
+        kfree(payload);
        return rc;
 }
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 473e09da7d02..810c28fb8c3c 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -34,7 +34,6 @@
 #include <linux/mutex.h>
 #include <linux/anon_inodes.h>
 #include <linux/device.h>
-#include <linux/freezer.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/mman.h>
@@ -1605,8 +1604,7 @@ fetch_events:
                        }
                        spin_unlock_irqrestore(&ep->lock, flags);
-                        if (!freezable_schedule_hrtimeout_range(to, slack,
+                        if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS))
-                                                                HRTIMER_MODE_ABS))
                                timed_out = 1;
                        spin_lock_irqsave(&ep->lock, flags);
diff --git a/fs/file_table.c b/fs/file_table.c
index abdd15ad13c9..e900ca518635 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -297,7 +297,7 @@ void flush_delayed_fput(void)
        delayed_fput(NULL);
 }
-static DECLARE_WORK(delayed_fput_work, delayed_fput);
+static DECLARE_DELAYED_WORK(delayed_fput_work, delayed_fput);
 void fput(struct file *file)
 {
@@ -317,7 +317,7 @@ void fput(struct file *file)
                }
                if (llist_add(&file->f_u.fu_llist, &delayed_fput_list))
-                        schedule_work(&delayed_fput_work);
+                        schedule_delayed_work(&delayed_fput_work, 1);
        }
 }
diff --git a/fs/jfs/jfs_inode.c b/fs/jfs/jfs_inode.c
index c1a3e603279c..7f464c513ba0 100644
--- a/fs/jfs/jfs_inode.c
+++ b/fs/jfs/jfs_inode.c
@@ -95,7 +95,7 @@ struct inode *ialloc(struct inode *parent, umode_t mode)
        if (insert_inode_locked(inode) < 0) {
                rc = -EINVAL;
-                goto fail_unlock;
+                goto fail_put;
        }
        inode_init_owner(inode, parent, mode);
@@ -156,7 +156,6 @@ struct inode *ialloc(struct inode *parent, umode_t mode)
 fail_drop:
        dquot_drop(inode);
        inode->i_flags |= S_NOQUOTA;
-fail_unlock:
        clear_nlink(inode);
        unlock_new_inode(inode);
 fail_put:
diff --git a/fs/namei.c b/fs/namei.c
index 645268f23eb6..caa28051e197 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2294,10 +2294,11 @@ out:
 * path_mountpoint - look up a path to be umounted
 * @dfd:        directory file descriptor to start walk from
 * @name:       full pathname to walk
+ * @path:       pointer to container for result
 * @flags:      lookup flags
 *
 * Look up the given name, but don't attempt to revalidate the last component.
- * Returns 0 and "path" will be valid on success; Retuns error otherwise.
+ * Returns 0 and "path" will be valid on success; Returns error otherwise.
 */
 static int
 path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags)
diff --git a/fs/select.c b/fs/select.c
index 35d4adc749d9..dfd5cb18c012 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -238,8 +238,7 @@ int poll_schedule_timeout(struct poll_wqueues *pwq, int state,
        set_current_state(state);
        if (!pwq->triggered)
-                rc = freezable_schedule_hrtimeout_range(expires, slack,
+                rc = schedule_hrtimeout_range(expires, slack, HRTIMER_MODE_ABS);
-                                                        HRTIMER_MODE_ABS);
        __set_current_state(TASK_RUNNING);
        /*
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 3135c2525c76..a290157265ef 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -328,6 +328,8 @@ loff_t seq_lseek(struct file *file, loff_t offset, int whence)
                                m->read_pos = offset;
                                retval = file->f_pos = offset;
                        }
+                } else {
+                        file->f_pos = offset;
                }
        }
        file->f_version = m->version;
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a6ac84871d6d..ff4e40cd45b1 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -6,6 +6,7 @@
 #include <linux/atomic.h>
 #include <linux/compat.h>
+#include <linux/workqueue.h>
 #include <uapi/linux/filter.h>
 #ifdef CONFIG_COMPAT
@@ -25,15 +26,19 @@ struct sk_filter
 {
        atomic_t                refcnt;
        unsigned int            len;    /* Number of filter blocks */
+        struct rcu_head         rcu;
        unsigned int            (*bpf_func)(const struct sk_buff *skb,
                                            const struct sock_filter *filter);
-        struct rcu_head         rcu;
+        union {
-        struct sock_filter      insns[0];
+                struct sock_filter      insns[0];
+                struct work_struct      work;
+        };
 };
-static inline unsigned int sk_filter_len(const struct sk_filter *fp)
+static inline unsigned int sk_filter_size(unsigned int proglen)
 {
-        return fp->len * sizeof(struct sock_filter) + sizeof(*fp);
+        return max(sizeof(struct sk_filter),
+                   offsetof(struct sk_filter, insns[proglen]));
 }
 extern int sk_filter(struct sock *sk, struct sk_buff *skb);
@@ -67,11 +72,13 @@ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
 }
 #define SK_RUN_FILTER(FILTER, SKB) (*FILTER->bpf_func)(SKB, FILTER->insns)
 #else
+#include <linux/slab.h>
 static inline void bpf_jit_compile(struct sk_filter *fp)
 {
 }
 static inline void bpf_jit_free(struct sk_filter *fp)
 {
+        kfree(fp);
 }
 #define SK_RUN_FILTER(FILTER, SKB) sk_run_filter(SKB, FILTER->insns)
 #endif
diff --git a/include/linux/i2c/twl.h b/include/linux/i2c/twl.h
index 81cbbdb96aae..673a3ce67f31 100644
--- a/include/linux/i2c/twl.h
+++ b/include/linux/i2c/twl.h
@@ -26,6 +26,7 @@
 #define __TWL_H_
 #include <linux/types.h>
+#include <linux/phy/phy.h>
 #include <linux/input/matrix_keypad.h>
 /*
@@ -615,6 +616,7 @@ enum twl4030_usb_mode {
 struct twl4030_usb_data {
        enum twl4030_usb_mode   usb_mode;
        unsigned long           features;
+        struct phy_init_data    *init_data;
        int             (*phy_init)(struct device *dev);
        int             (*phy_exit)(struct device *dev);
diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
index 19c19a5eee29..f6c82de12541 100644
--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -34,9 +34,9 @@ struct ipc_namespace {
        int             sem_ctls[4];
        int             used_sems;
-        int             msg_ctlmax;
+        unsigned int    msg_ctlmax;
-        int             msg_ctlmnb;
+        unsigned int    msg_ctlmnb;
-        int             msg_ctlmni;
+        unsigned int    msg_ctlmni;
        atomic_t        msg_bytes;
        atomic_t        msg_hdrs;
        int             auto_msgmni;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3de49aca4519..25f5d2d11e7c 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2264,11 +2264,12 @@ static inline void netif_wake_subqueue(struct net_device *dev, u16 queue_index)
 }
 #ifdef CONFIG_XPS
-extern int netif_set_xps_queue(struct net_device *dev, struct cpumask *mask,
+extern int netif_set_xps_queue(struct net_device *dev,
+                               const struct cpumask *mask,
                               u16 index);
 #else
 static inline int netif_set_xps_queue(struct net_device *dev,
-                                      struct cpumask *mask,
+                                      const struct cpumask *mask,
                                      u16 index)
 {
        return 0;
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index f3c7c24bec1c..fbfdb9d8d3a7 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -24,7 +24,8 @@ struct netpoll {
        struct net_device *dev;
        char dev_name[IFNAMSIZ];
        const char *name;
-        void (*rx_hook)(struct netpoll *, int, char *, int);
+        void (*rx_skb_hook)(struct netpoll *np, int source, struct sk_buff *skb,
+                            int offset, int len);
        union inet_addr local_ip, remote_ip;
        bool ipv6;
@@ -41,7 +42,7 @@ struct netpoll_info {
        unsigned long rx_flags;
        spinlock_t rx_lock;
        struct semaphore dev_lock;
-        struct list_head rx_np; /* netpolls that registered an rx_hook */
+        struct list_head rx_np; /* netpolls that registered an rx_skb_hook */
        struct sk_buff_head neigh_tx; /* list of neigh requests to reply to */
        struct sk_buff_head txq;
diff --git a/include/linux/percpu.h b/include/linux/percpu.h
index cc88172c7d9a..c74088ab103b 100644
--- a/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -332,7 +332,7 @@ do {									\
 #endif
 #ifndef this_cpu_sub
-# define this_cpu_sub(pcp, val)         this_cpu_add((pcp), -(val))
+# define this_cpu_sub(pcp, val)         this_cpu_add((pcp), -(typeof(pcp))(val))
 #endif
 #ifndef this_cpu_inc
@@ -418,7 +418,7 @@ do {									\
 # define this_cpu_add_return(pcp, val)  __pcpu_size_call_return2(this_cpu_add_return_, pcp, val)
 #endif
-#define this_cpu_sub_return(pcp, val)   this_cpu_add_return(pcp, -(val))
+#define this_cpu_sub_return(pcp, val)   this_cpu_add_return(pcp, -(typeof(pcp))(val))
 #define this_cpu_inc_return(pcp)        this_cpu_add_return(pcp, 1)
 #define this_cpu_dec_return(pcp)        this_cpu_add_return(pcp, -1)
@@ -586,7 +586,7 @@ do {									\
 #endif
 #ifndef __this_cpu_sub
-# define __this_cpu_sub(pcp, val)       __this_cpu_add((pcp), -(val))
+# define __this_cpu_sub(pcp, val)       __this_cpu_add((pcp), -(typeof(pcp))(val))
 #endif
 #ifndef __this_cpu_inc
@@ -668,7 +668,7 @@ do {									\
        __pcpu_size_call_return2(__this_cpu_add_return_, pcp, val)
 #endif
-#define __this_cpu_sub_return(pcp, val) __this_cpu_add_return(pcp, -(val))
+#define __this_cpu_sub_return(pcp, val) __this_cpu_add_return(pcp, -(typeof(pcp))(val))
 #define __this_cpu_inc_return(pcp)      __this_cpu_add_return(pcp, 1)
 #define __this_cpu_dec_return(pcp)      __this_cpu_add_return(pcp, -1)
diff --git a/include/linux/phy/phy.h b/include/linux/phy/phy.h
new file mode 100644
index 000000000000..6d722695e027
--- /dev/null
+++ b/include/linux/phy/phy.h
@@ -0,0 +1,270 @@
+/*
+ * phy.h -- generic phy header file
+ *
+ * Copyright (C) 2013 Texas Instruments Incorporated - http://www.ti.com
+ *
+ * Author: Kishon Vijay Abraham I <kishon@ti.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#ifndef __DRIVERS_PHY_H
+#define __DRIVERS_PHY_H
+#include <linux/err.h>
+#include <linux/of.h>
+#include <linux/device.h>
+#include <linux/pm_runtime.h>
+struct phy;
+/**
+ * struct phy_ops - set of function pointers for performing phy operations
+ * @init: operation to be performed for initializing phy
+ * @exit: operation to be performed while exiting
+ * @power_on: powering on the phy
+ * @power_off: powering off the phy
+ * @owner: the module owner containing the ops
+ */
+struct phy_ops {
+        int     (*init)(struct phy *phy);
+        int     (*exit)(struct phy *phy);
+        int     (*power_on)(struct phy *phy);
+        int     (*power_off)(struct phy *phy);
+        struct module *owner;
+};
+/**
+ * struct phy - represents the phy device
+ * @dev: phy device
+ * @id: id of the phy device
+ * @ops: function pointers for performing phy operations
+ * @init_data: list of PHY consumers (non-dt only)
+ * @mutex: mutex to protect phy_ops
+ * @init_count: used to protect when the PHY is used by multiple consumers
+ * @power_count: used to protect when the PHY is used by multiple consumers
+ */
+struct phy {
+        struct device           dev;
+        int                     id;
+        const struct phy_ops    *ops;
+        struct phy_init_data    *init_data;
+        struct mutex            mutex;
+        int                     init_count;
+        int                     power_count;
+};
+/**
+ * struct phy_provider - represents the phy provider
+ * @dev: phy provider device
+ * @owner: the module owner having of_xlate
+ * @of_xlate: function pointer to obtain phy instance from phy pointer
+ * @list: to maintain a linked list of PHY providers
+ */
+struct phy_provider {
+        struct device           *dev;
+        struct module           *owner;
+        struct list_head        list;
+        struct phy * (*of_xlate)(struct device *dev,
+                struct of_phandle_args *args);
+};
+/**
+ * struct phy_consumer - represents the phy consumer
+ * @dev_name: the device name of the controller that will use this PHY device
+ * @port: name given to the consumer port
+ */
+struct phy_consumer {
+        const char *dev_name;
+        const char *port;
+};
+/**
+ * struct phy_init_data - contains the list of PHY consumers
+ * @num_consumers: number of consumers for this PHY device
+ * @consumers: list of PHY consumers
+ */
+struct phy_init_data {
+        unsigned int num_consumers;
+        struct phy_consumer *consumers;
+};
+#define PHY_CONSUMER(_dev_name, _port)                          \
+{                                                               \
+        .dev_name       = _dev_name,                            \
+        .port           = _port,                                \
+}
+#define to_phy(dev)     (container_of((dev), struct phy, dev))
+#define of_phy_provider_register(dev, xlate)    \
+        __of_phy_provider_register((dev), THIS_MODULE, (xlate))
+#define devm_of_phy_provider_register(dev, xlate)       \
+        __devm_of_phy_provider_register((dev), THIS_MODULE, (xlate))
+static inline void phy_set_drvdata(struct phy *phy, void *data)
+{
+        dev_set_drvdata(&phy->dev, data);
+}
+static inline void *phy_get_drvdata(struct phy *phy)
+{
+        return dev_get_drvdata(&phy->dev);
+}
+#if IS_ENABLED(CONFIG_GENERIC_PHY)
+int phy_pm_runtime_get(struct phy *phy);
+int phy_pm_runtime_get_sync(struct phy *phy);
+int phy_pm_runtime_put(struct phy *phy);
+int phy_pm_runtime_put_sync(struct phy *phy);
+void phy_pm_runtime_allow(struct phy *phy);
+void phy_pm_runtime_forbid(struct phy *phy);
+int phy_init(struct phy *phy);
+int phy_exit(struct phy *phy);
+int phy_power_on(struct phy *phy);
+int phy_power_off(struct phy *phy);
+struct phy *phy_get(struct device *dev, const char *string);
+struct phy *devm_phy_get(struct device *dev, const char *string);
+void phy_put(struct phy *phy);
+void devm_phy_put(struct device *dev, struct phy *phy);
+struct phy *of_phy_simple_xlate(struct device *dev,
+        struct of_phandle_args *args);
+struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
+        struct phy_init_data *init_data);
+struct phy *devm_phy_create(struct device *dev,
+        const struct phy_ops *ops, struct phy_init_data *init_data);
+void phy_destroy(struct phy *phy);
+void devm_phy_destroy(struct device *dev, struct phy *phy);
+struct phy_provider *__of_phy_provider_register(struct device *dev,
+        struct module *owner, struct phy * (*of_xlate)(struct device *dev,
+        struct of_phandle_args *args));
+struct phy_provider *__devm_of_phy_provider_register(struct device *dev,
+        struct module *owner, struct phy * (*of_xlate)(struct device *dev,
+        struct of_phandle_args *args));
+void of_phy_provider_unregister(struct phy_provider *phy_provider);
+void devm_of_phy_provider_unregister(struct device *dev,
+        struct phy_provider *phy_provider);
+#else
+static inline int phy_pm_runtime_get(struct phy *phy)
+{
+        return -ENOSYS;
+}
+static inline int phy_pm_runtime_get_sync(struct phy *phy)
+{
+        return -ENOSYS;
+}
+static inline int phy_pm_runtime_put(struct phy *phy)
+{
+        return -ENOSYS;
+}
+static inline int phy_pm_runtime_put_sync(struct phy *phy)
+{
+        return -ENOSYS;
+}
+static inline void phy_pm_runtime_allow(struct phy *phy)
+{
+        return;
+}
+static inline void phy_pm_runtime_forbid(struct phy *phy)
+{
+        return;
+}
+static inline int phy_init(struct phy *phy)
+{
+        return -ENOSYS;
+}
+static inline int phy_exit(struct phy *phy)
+{
+        return -ENOSYS;
+}
+static inline int phy_power_on(struct phy *phy)
+{
+        return -ENOSYS;
+}
+static inline int phy_power_off(struct phy *phy)
+{
+        return -ENOSYS;
+}
+static inline struct phy *phy_get(struct device *dev, const char *string)
+{
+        return ERR_PTR(-ENOSYS);
+}
+static inline struct phy *devm_phy_get(struct device *dev, const char *string)
+{
+        return ERR_PTR(-ENOSYS);
+}
+static inline void phy_put(struct phy *phy)
+{
+}
+static inline void devm_phy_put(struct device *dev, struct phy *phy)
+{
+}
+static inline struct phy *of_phy_simple_xlate(struct device *dev,
+        struct of_phandle_args *args)
+{
+        return ERR_PTR(-ENOSYS);
+}
+static inline struct phy *phy_create(struct device *dev,
+        const struct phy_ops *ops, struct phy_init_data *init_data)
+{
+        return ERR_PTR(-ENOSYS);
+}
+static inline struct phy *devm_phy_create(struct device *dev,
+        const struct phy_ops *ops, struct phy_init_data *init_data)
+{
+        return ERR_PTR(-ENOSYS);
+}
+static inline void phy_destroy(struct phy *phy)
+{
+}
+static inline void devm_phy_destroy(struct device *dev, struct phy *phy)
+{
+}
+static inline struct phy_provider *__of_phy_provider_register(
+        struct device *dev, struct module *owner, struct phy * (*of_xlate)(
+        struct device *dev, struct of_phandle_args *args))
+{
+        return ERR_PTR(-ENOSYS);
+}
+static inline struct phy_provider *__devm_of_phy_provider_register(struct device
+        *dev, struct module *owner, struct phy * (*of_xlate)(struct device *dev,
+        struct of_phandle_args *args))
+{
+        return ERR_PTR(-ENOSYS);
+}
+static inline void of_phy_provider_unregister(struct phy_provider *phy_provider)
+{
+}
+static inline void devm_of_phy_provider_unregister(struct device *dev,
+        struct phy_provider *phy_provider)
+{
+}
+#endif
+#endif /* __DRIVERS_PHY_H */
diff --git a/include/linux/platform_data/mipi-csis.h b/include/linux/platform_data/mipi-csis.h
index bf34e17cee7f..c2fd9024717c 100644
--- a/include/linux/platform_data/mipi-csis.h
+++ b/include/linux/platform_data/mipi-csis.h
@@ -25,13 +25,4 @@ struct s5p_platform_mipi_csis {
        u8 hs_settle;
 };
-/**
- * s5p_csis_phy_enable - global MIPI-CSI receiver D-PHY control
- * @id:     MIPI-CSIS harware instance index (0...1)
- * @on:     true to enable D-PHY and deassert its reset
- *          false to disable D-PHY
- * @return: 0 on success, or negative error code on failure
- */
-int s5p_csis_phy_enable(int id, bool on);
 #endif /* __PLAT_SAMSUNG_MIPI_CSIS_H_ */
diff --git a/include/linux/platform_data/usb-ehci-s5p.h b/include/linux/platform_data/usb-ehci-s5p.h
deleted file mode 100644
index 5f28cae18582..000000000000
--- a/include/linux/platform_data/usb-ehci-s5p.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright (C) 2011 Samsung Electronics Co.Ltd
- * Author: Joonyoung Shim <jy0922.shim@samsung.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#ifndef __PLAT_SAMSUNG_EHCI_H
-#define __PLAT_SAMSUNG_EHCI_H __FILE__
-struct s5p_ehci_platdata {
-        int (*phy_init)(struct platform_device *pdev, int type);
-        int (*phy_exit)(struct platform_device *pdev, int type);
-};
-extern void s5p_ehci_set_platdata(struct s5p_ehci_platdata *pd);
-#endif /* __PLAT_SAMSUNG_EHCI_H */
diff --git a/include/linux/platform_data/usb-ohci-exynos.h b/include/linux/platform_data/usb-ohci-exynos.h
deleted file mode 100644
index c256c595be5e..000000000000
--- a/include/linux/platform_data/usb-ohci-exynos.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright (C) 2011 Samsung Electronics Co.Ltd
- *              http://www.samsung.com/
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#ifndef __MACH_EXYNOS_OHCI_H
-#define __MACH_EXYNOS_OHCI_H
-struct exynos4_ohci_platdata {
-        int (*phy_init)(struct platform_device *pdev, int type);
-        int (*phy_exit)(struct platform_device *pdev, int type);
-};
-extern void exynos4_ohci_set_platdata(struct exynos4_ohci_platdata *pd);
-#endif /* __MACH_EXYNOS_OHCI_H */
diff --git a/include/linux/platform_data/usb-rcar-gen2-phy.h b/include/linux/platform_data/usb-rcar-gen2-phy.h
new file mode 100644
index 000000000000..dd3ba46c0d90
--- /dev/null
+++ b/include/linux/platform_data/usb-rcar-gen2-phy.h
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2013 Renesas Solutions Corp.
+ * Copyright (C) 2013 Cogent Embedded, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __USB_RCAR_GEN2_PHY_H
+#define __USB_RCAR_GEN2_PHY_H
+#include <linux/types.h>
+struct rcar_gen2_phy_platform_data {
+        /* USB channel 0 configuration */
+        bool chan0_pci:1;       /* true: PCI USB host 0, false: USBHS */
+        /* USB channel 2 configuration */
+        bool chan2_pci:1;       /* true: PCI USB host 2, false: USBSS */
+};
+#endif
diff --git a/include/linux/printk.h b/include/linux/printk.h
index e6131a782481..694925837a16 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -233,6 +233,8 @@ extern asmlinkage void dump_stack(void) __cold;
        no_printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
 #endif
+#include <linux/dynamic_debug.h>
 /* If you are writing a driver, please use dev_dbg instead */
 #if defined(CONFIG_DYNAMIC_DEBUG)
 /* dynamic_pr_debug() uses pr_fmt() internally so we don't need it here */
@@ -343,7 +345,19 @@ extern asmlinkage void dump_stack(void) __cold;
 #endif
 /* If you are writing a driver, please use dev_dbg instead */
-#if defined(DEBUG)
+#if defined(CONFIG_DYNAMIC_DEBUG)
+/* descriptor check is first to prevent flooding with "callbacks suppressed" */
+#define pr_debug_ratelimited(fmt, ...)                                  \
+do {                                                                    \
+        static DEFINE_RATELIMIT_STATE(_rs,                              \
+                                      DEFAULT_RATELIMIT_INTERVAL,       \
+                                      DEFAULT_RATELIMIT_BURST);         \
+        DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt);                 \
+        if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) &&        \
+            __ratelimit(&_rs))                                          \
+                __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__);    \
+} while (0)
+#elif defined(DEBUG)
 #define pr_debug_ratelimited(fmt, ...)                                  \
        printk_ratelimited(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
 #else
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 001629cd1a97..7454865ad148 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -475,7 +475,8 @@ struct usb3_lpm_parameters {
 * @lpm_capable: device supports LPM
 * @usb2_hw_lpm_capable: device can perform USB2 hardware LPM
 * @usb2_hw_lpm_besl_capable: device can perform USB2 hardware BESL LPM
- * @usb2_hw_lpm_enabled: USB2 hardware LPM enabled
+ * @usb2_hw_lpm_enabled: USB2 hardware LPM is enabled
+ * @usb2_hw_lpm_allowed: Userspace allows USB 2.0 LPM to be enabled
 * @usb3_lpm_enabled: USB3 hardware LPM enabled
 * @string_langid: language ID for strings
 * @product: iProduct string, if present (static)
@@ -548,6 +549,7 @@ struct usb_device {
        unsigned usb2_hw_lpm_capable:1;
        unsigned usb2_hw_lpm_besl_capable:1;
        unsigned usb2_hw_lpm_enabled:1;
+        unsigned usb2_hw_lpm_allowed:1;
        unsigned usb3_lpm_enabled:1;
        int string_langid;
@@ -702,7 +704,7 @@ extern int usb_alloc_streams(struct usb_interface *interface,
                unsigned int num_streams, gfp_t mem_flags);
 /* Reverts a group of bulk endpoints back to not using stream IDs. */
-extern void usb_free_streams(struct usb_interface *interface,
+extern int usb_free_streams(struct usb_interface *interface,
                struct usb_host_endpoint **eps, unsigned int num_eps,
                gfp_t mem_flags);
@@ -1209,11 +1211,13 @@ struct usb_anchor {
        struct list_head urb_list;
        wait_queue_head_t wait;
        spinlock_t lock;
+        atomic_t suspend_wakeups;
        unsigned int poisoned:1;
 };
 static inline void init_usb_anchor(struct usb_anchor *anchor)
 {
+        memset(anchor, 0, sizeof(*anchor));
        INIT_LIST_HEAD(&anchor->urb_list);
        init_waitqueue_head(&anchor->wait);
        spin_lock_init(&anchor->lock);
@@ -1574,6 +1578,8 @@ extern void usb_kill_anchored_urbs(struct usb_anchor *anchor);
 extern void usb_poison_anchored_urbs(struct usb_anchor *anchor);
 extern void usb_unpoison_anchored_urbs(struct usb_anchor *anchor);
 extern void usb_unlink_anchored_urbs(struct usb_anchor *anchor);
+extern void usb_anchor_suspend_wakeups(struct usb_anchor *anchor);
+extern void usb_anchor_resume_wakeups(struct usb_anchor *anchor);
 extern void usb_anchor_urb(struct urb *urb, struct usb_anchor *anchor);
 extern void usb_unanchor_urb(struct urb *urb);
 extern int usb_wait_anchor_empty_timeout(struct usb_anchor *anchor,
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 75efc45eaa2f..b8aba196f7f1 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -73,6 +73,7 @@ struct giveback_urb_bh {
        spinlock_t lock;
        struct list_head  head;
        struct tasklet_struct bh;
+        struct usb_host_endpoint *completing_ep;
 };
 struct usb_hcd {
@@ -140,6 +141,7 @@ struct usb_hcd {
        unsigned                wireless:1;     /* Wireless USB HCD */
        unsigned                authorized_default:1;
        unsigned                has_tt:1;       /* Integrated TT in root hub */
+        unsigned                amd_resume_bug:1; /* AMD remote wakeup quirk */
        unsigned int            irq;            /* irq allocated */
        void __iomem            *regs;          /* device memory/io */
@@ -378,6 +380,12 @@ static inline int hcd_giveback_urb_in_bh(struct usb_hcd *hcd)
        return hcd->driver->flags & HCD_BH;
 }
+static inline bool hcd_periodic_completion_in_progress(struct usb_hcd *hcd,
+                struct usb_host_endpoint *ep)
+{
+        return hcd->high_prio_bh.completing_ep == ep;
+}
 extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
 extern int usb_hcd_check_unlink_urb(struct usb_hcd *hcd, struct urb *urb,
                int status);
@@ -428,6 +436,8 @@ extern int usb_hcd_pci_probe(struct pci_dev *dev,
 extern void usb_hcd_pci_remove(struct pci_dev *dev);
 extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
+extern int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *dev);
 #ifdef CONFIG_PM
 extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
 #endif
@@ -496,6 +506,7 @@ struct usb_tt {
        struct usb_device       *hub;   /* upstream highspeed hub */
        int                     multi;  /* true means one TT per port */
        unsigned                think_time;     /* think time in ns */
+        void                    *hcpriv;        /* HCD private data */
        /* for control/bulk error recovery (CLEAR_TT_BUFFER) */
        spinlock_t              lock;
@@ -554,9 +565,8 @@ extern void usb_ep0_reinit(struct usb_device *);
                 * of (7/6 * 8 * bytecount) = 9.33 * bytecount */
                /* bytecount = data payload byte count */
-#define NS_TO_US(ns)    ((ns + 500L) / 1000L)
+#define NS_TO_US(ns)    DIV_ROUND_UP(ns, 1000L)
-                        /* convert & round nanoseconds to microseconds */
+                        /* convert nanoseconds to microseconds, rounding up */
 /*
 * Full/low speed bandwidth allocation constants/support.
diff --git a/include/linux/usb/intel_mid_otg.h b/include/linux/usb/intel_mid_otg.h
deleted file mode 100644
index 756cf5543ffd..000000000000
--- a/include/linux/usb/intel_mid_otg.h
+++ /dev/null
@@ -1,180 +0,0 @@
-/*
- * Intel MID (Langwell/Penwell) USB OTG Transceiver driver
- * Copyright (C) 2008 - 2010, Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- */
-#ifndef __INTEL_MID_OTG_H
-#define __INTEL_MID_OTG_H
-#include <linux/pm.h>
-#include <linux/usb/otg.h>
-#include <linux/notifier.h>
-struct intel_mid_otg_xceiv;
-/* This is a common data structure for Intel MID platform to
- * save values of the OTG state machine */
-struct otg_hsm {
-        /* Input */
-        int a_bus_resume;
-        int a_bus_suspend;
-        int a_conn;
-        int a_sess_vld;
-        int a_srp_det;
-        int a_vbus_vld;
-        int b_bus_resume;
-        int b_bus_suspend;
-        int b_conn;
-        int b_se0_srp;
-        int b_ssend_srp;
-        int b_sess_end;
-        int b_sess_vld;
-        int id;
-/* id values */
-#define ID_B            0x05
-#define ID_A            0x04
-#define ID_ACA_C        0x03
-#define ID_ACA_B        0x02
-#define ID_ACA_A        0x01
-        int power_up;
-        int adp_change;
-        int test_device;
-        /* Internal variables */
-        int a_set_b_hnp_en;
-        int b_srp_done;
-        int b_hnp_enable;
-        int hnp_poll_enable;
-        /* Timeout indicator for timers */
-        int a_wait_vrise_tmout;
-        int a_wait_bcon_tmout;
-        int a_aidl_bdis_tmout;
-        int a_bidl_adis_tmout;
-        int a_bidl_adis_tmr;
-        int a_wait_vfall_tmout;
-        int b_ase0_brst_tmout;
-        int b_bus_suspend_tmout;
-        int b_srp_init_tmout;
-        int b_srp_fail_tmout;
-        int b_srp_fail_tmr;
-        int b_adp_sense_tmout;
-        /* Informative variables */
-        int a_bus_drop;
-        int a_bus_req;
-        int a_clr_err;
-        int b_bus_req;
-        int a_suspend_req;
-        int b_bus_suspend_vld;
-        /* Output */
-        int drv_vbus;
-        int loc_conn;
-        int loc_sof;
-        /* Others */
-        int vbus_srp_up;
-};
-/* must provide ULPI access function to read/write registers implemented in
- * ULPI address space */
-struct iotg_ulpi_access_ops {
-        int     (*read)(struct intel_mid_otg_xceiv *iotg, u8 reg, u8 *val);
-        int     (*write)(struct intel_mid_otg_xceiv *iotg, u8 reg, u8 val);
-};
-#define OTG_A_DEVICE    0x0
-#define OTG_B_DEVICE    0x1
-/*
- * the Intel MID (Langwell/Penwell) otg transceiver driver needs to interact
- * with device and host drivers to implement the USB OTG related feature. More
- * function members are added based on usb_phy data structure for this
- * purpose.
- */
-struct intel_mid_otg_xceiv {
-        struct usb_phy          otg;
-        struct otg_hsm          hsm;
-        /* base address */
-        void __iomem            *base;
-        /* ops to access ulpi */
-        struct iotg_ulpi_access_ops     ulpi_ops;
-        /* atomic notifier for interrupt context */
-        struct atomic_notifier_head     iotg_notifier;
-        /* start/stop USB Host function */
-        int     (*start_host)(struct intel_mid_otg_xceiv *iotg);
-        int     (*stop_host)(struct intel_mid_otg_xceiv *iotg);
-        /* start/stop USB Peripheral function */
-        int     (*start_peripheral)(struct intel_mid_otg_xceiv *iotg);
-        int     (*stop_peripheral)(struct intel_mid_otg_xceiv *iotg);
-        /* start/stop ADP sense/probe function */
-        int     (*set_adp_probe)(struct intel_mid_otg_xceiv *iotg,
-                                        bool enabled, int dev);
-        int     (*set_adp_sense)(struct intel_mid_otg_xceiv *iotg,
-                                        bool enabled);
-#ifdef CONFIG_PM
-        /* suspend/resume USB host function */
-        int     (*suspend_host)(struct intel_mid_otg_xceiv *iotg,
-                                        pm_message_t message);
-        int     (*resume_host)(struct intel_mid_otg_xceiv *iotg);
-        int     (*suspend_peripheral)(struct intel_mid_otg_xceiv *iotg,
-                                        pm_message_t message);
-        int     (*resume_peripheral)(struct intel_mid_otg_xceiv *iotg);
-#endif
-};
-static inline
-struct intel_mid_otg_xceiv *otg_to_mid_xceiv(struct usb_phy *otg)
-{
-        return container_of(otg, struct intel_mid_otg_xceiv, otg);
-}
-#define MID_OTG_NOTIFY_CONNECT          0x0001
-#define MID_OTG_NOTIFY_DISCONN          0x0002
-#define MID_OTG_NOTIFY_HSUSPEND         0x0003
-#define MID_OTG_NOTIFY_HRESUME          0x0004
-#define MID_OTG_NOTIFY_CSUSPEND         0x0005
-#define MID_OTG_NOTIFY_CRESUME          0x0006
-#define MID_OTG_NOTIFY_HOSTADD          0x0007
-#define MID_OTG_NOTIFY_HOSTREMOVE       0x0008
-#define MID_OTG_NOTIFY_CLIENTADD        0x0009
-#define MID_OTG_NOTIFY_CLIENTREMOVE     0x000a
-static inline int
-intel_mid_otg_register_notifier(struct intel_mid_otg_xceiv *iotg,
-                                struct notifier_block *nb)
-{
-        return atomic_notifier_chain_register(&iotg->iotg_notifier, nb);
-}
-static inline void
-intel_mid_otg_unregister_notifier(struct intel_mid_otg_xceiv *iotg,
-                                struct notifier_block *nb)
-{
-        atomic_notifier_chain_unregister(&iotg->iotg_notifier, nb);
-}
-#endif /* __INTEL_MID_OTG_H */
diff --git a/include/linux/usb/musb.h b/include/linux/usb/musb.h
index 053c26841cc3..eb505250940a 100644
--- a/include/linux/usb/musb.h
+++ b/include/linux/usb/musb.h
@@ -99,8 +99,6 @@ struct musb_hdrc_platform_data {
        /* MUSB_HOST, MUSB_PERIPHERAL, or MUSB_OTG */
        u8              mode;
-        u8              has_mailbox:1;
        /* for clk_get() */
        const char      *clock;
diff --git a/include/linux/usb/omap_control_usb.h b/include/linux/usb/omap_control_usb.h
index 27b5b8c931b0..596b01918813 100644
--- a/include/linux/usb/omap_control_usb.h
+++ b/include/linux/usb/omap_control_usb.h
@@ -19,20 +19,23 @@
 #ifndef __OMAP_CONTROL_USB_H__
 #define __OMAP_CONTROL_USB_H__
+enum omap_control_usb_type {
+        OMAP_CTRL_TYPE_OTGHS = 1,       /* Mailbox OTGHS_CONTROL */
+        OMAP_CTRL_TYPE_USB2,    /* USB2_PHY, power down in CONTROL_DEV_CONF */
+        OMAP_CTRL_TYPE_PIPE3,   /* PIPE3 PHY, DPLL & seperate Rx/Tx power */
+        OMAP_CTRL_TYPE_DRA7USB2, /* USB2 PHY, power and power_aux e.g. DRA7 */
+};
 struct omap_control_usb {
        struct device *dev;
-        u32 __iomem *dev_conf;
        u32 __iomem *otghs_control;
-        u32 __iomem *phy_power;
+        u32 __iomem *power;
+        u32 __iomem *power_aux;
        struct clk *sys_clk;
-        u32 type;
+        enum omap_control_usb_type type;
-};
-struct omap_control_usb_platform_data {
-        u8 type;
 };
 enum omap_control_usb_mode {
@@ -42,10 +45,6 @@ enum omap_control_usb_mode {
        USB_MODE_DISCONNECT,
 };
-/* To differentiate ctrl module IP having either mailbox or USB3 PHY power */
-#define OMAP_CTRL_DEV_TYPE1             0x1
-#define OMAP_CTRL_DEV_TYPE2             0x2
 #define OMAP_CTRL_DEV_PHY_PD            BIT(0)
 #define OMAP_CTRL_DEV_AVALID            BIT(0)
@@ -63,26 +62,18 @@ enum omap_control_usb_mode {
 #define OMAP_CTRL_USB3_PHY_TX_RX_POWERON        0x3
 #define OMAP_CTRL_USB3_PHY_TX_RX_POWEROFF       0x0
+#define OMAP_CTRL_USB2_PHY_PD           BIT(28)
 #if IS_ENABLED(CONFIG_OMAP_CONTROL_USB)
-extern struct device *omap_get_control_dev(void);
 extern void omap_control_usb_phy_power(struct device *dev, int on);
-extern void omap_control_usb3_phy_power(struct device *dev, bool on);
 extern void omap_control_usb_set_mode(struct device *dev,
        enum omap_control_usb_mode mode);
 #else
-static inline struct device *omap_get_control_dev(void)
-{
-        return ERR_PTR(-ENODEV);
-}
 static inline void omap_control_usb_phy_power(struct device *dev, int on)
 {
 }
-static inline void omap_control_usb3_phy_power(struct device *dev, int on)
-{
-}
 static inline void omap_control_usb_set_mode(struct device *dev,
        enum omap_control_usb_mode mode)
 {
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index d528b8045150..704a1ab8240c 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -320,6 +320,8 @@ extern struct usb_serial_port *usb_serial_port_get_by_minor(unsigned int minor);
 extern void usb_serial_put(struct usb_serial *serial);
 extern int usb_serial_generic_open(struct tty_struct *tty,
        struct usb_serial_port *port);
+extern int usb_serial_generic_write_start(struct usb_serial_port *port,
+                                                        gfp_t mem_flags);
 extern int usb_serial_generic_write(struct tty_struct *tty,
        struct usb_serial_port *port, const unsigned char *buf, int count);
 extern void usb_serial_generic_close(struct usb_serial_port *port);
diff --git a/include/linux/usb/usb_phy_gen_xceiv.h b/include/linux/usb/usb_phy_gen_xceiv.h
index 11d85b9c1b08..cc8d818a83be 100644
--- a/include/linux/usb/usb_phy_gen_xceiv.h
+++ b/include/linux/usb/usb_phy_gen_xceiv.h
@@ -9,7 +9,8 @@ struct usb_phy_gen_xceiv_platform_data {
        /* if set fails with -EPROBE_DEFER if can't get regulator */
        unsigned int needs_vcc:1;
-        unsigned int needs_reset:1;
+        unsigned int needs_reset:1;     /* deprecated */
+        int gpio_reset;
 };
 #if defined(CONFIG_NOP_USB_XCEIV) || (defined(CONFIG_NOP_USB_XCEIV_MODULE) && defined(MODULE))
diff --git a/include/linux/usb/wusb-wa.h b/include/linux/usb/wusb-wa.h
index 4ff744e2b678..c1257130769b 100644
--- a/include/linux/usb/wusb-wa.h
+++ b/include/linux/usb/wusb-wa.h
@@ -142,7 +142,7 @@ enum wa_notif_type {
 struct wa_notif_hdr {
        u8 bLength;
        u8 bNotifyType;                 /* enum wa_notif_type */
-} __attribute__((packed));
+} __packed;
 /**
 * HWA DN Received notification [(WUSB] section 8.5.4.2)
@@ -158,7 +158,7 @@ struct hwa_notif_dn {
        u8 bSourceDeviceAddr;           /* from errata 2005/07 */
        u8 bmAttributes;
        struct wusb_dn_hdr dndata[];
-} __attribute__((packed));
+} __packed;
 /* [WUSB] section 8.3.3 */
 enum wa_xfer_type {
@@ -167,6 +167,8 @@ enum wa_xfer_type {
        WA_XFER_TYPE_ISO = 0x82,
        WA_XFER_RESULT = 0x83,
        WA_XFER_ABORT = 0x84,
+        WA_XFER_ISO_PACKET_INFO = 0xA0,
+        WA_XFER_ISO_PACKET_STATUS = 0xA1,
 };
 /* [WUSB] section 8.3.3 */
@@ -177,28 +179,47 @@ struct wa_xfer_hdr {
        __le32 dwTransferID;            /* Host-assigned ID */
        __le32 dwTransferLength;        /* Length of data to xfer */
        u8 bTransferSegment;
-} __attribute__((packed));
+} __packed;
 struct wa_xfer_ctl {
        struct wa_xfer_hdr hdr;
        u8 bmAttribute;
        __le16 wReserved;
        struct usb_ctrlrequest baSetupData;
-} __attribute__((packed));
+} __packed;
 struct wa_xfer_bi {
        struct wa_xfer_hdr hdr;
        u8 bReserved;
        __le16 wReserved;
-} __attribute__((packed));
+} __packed;
+/* [WUSB] section 8.5.5 */
 struct wa_xfer_hwaiso {
        struct wa_xfer_hdr hdr;
        u8 bReserved;
        __le16 wPresentationTime;
        __le32 dwNumOfPackets;
-        /* FIXME: u8 pktdata[]? */
+} __packed;
-} __attribute__((packed));
+struct wa_xfer_packet_info_hwaiso {
+        __le16 wLength;
+        u8 bPacketType;
+        u8 bReserved;
+        __le16 PacketLength[0];
+} __packed;
+struct wa_xfer_packet_status_len_hwaiso {
+        __le16 PacketLength;
+        __le16 PacketStatus;
+} __packed;
+struct wa_xfer_packet_status_hwaiso {
+        __le16 wLength;
+        u8 bPacketType;
+        u8 bReserved;
+        struct wa_xfer_packet_status_len_hwaiso PacketStatus[0];
+} __packed;
 /* [WUSB] section 8.3.3.5 */
 struct wa_xfer_abort {
@@ -206,7 +227,7 @@ struct wa_xfer_abort {
        u8 bRequestType;
        __le16 wRPipe;                  /* RPipe index */
        __le32 dwTransferID;            /* Host-assigned ID */
-} __attribute__((packed));
+} __packed;
 /**
 * WA Transfer Complete notification ([WUSB] section 8.3.3.3)
@@ -216,7 +237,7 @@ struct wa_notif_xfer {
        struct wa_notif_hdr hdr;
        u8 bEndpoint;
        u8 Reserved;
-} __attribute__((packed));
+} __packed;
 /** Transfer result basic codes [WUSB] table 8-15 */
 enum {
@@ -243,7 +264,7 @@ struct wa_xfer_result {
        u8     bTransferSegment;
        u8     bTransferStatus;
        __le32 dwNumOfPackets;
-} __attribute__((packed));
+} __packed;
 /**
 * Wire Adapter Class Descriptor ([WUSB] section 8.5.2.7).
@@ -258,16 +279,16 @@ struct wa_xfer_result {
 struct usb_wa_descriptor {
        u8      bLength;
        u8      bDescriptorType;
-        u16     bcdWAVersion;
+        __le16  bcdWAVersion;
        u8      bNumPorts;              /* don't use!! */
        u8      bmAttributes;           /* Reserved == 0 */
-        u16     wNumRPipes;
+        __le16  wNumRPipes;
-        u16     wRPipeMaxBlock;
+        __le16  wRPipeMaxBlock;
        u8      bRPipeBlockSize;
        u8      bPwrOn2PwrGood;
        u8      bNumMMCIEs;
        u8      DeviceRemovable;        /* FIXME: in DWA this is up to 16 bytes */
-} __attribute__((packed));
+} __packed;
 /**
 * HWA Device Information Buffer (WUSB1.0[T8.54])
@@ -277,6 +298,6 @@ struct hwa_dev_info {
        u8      bDeviceAddress;
        __le16  wPHYRates;
        u8      bmDeviceAttribute;
-} __attribute__((packed));
+} __packed;
 #endif /* #ifndef __LINUX_USB_WUSB_WA_H */
diff --git a/include/linux/yam.h b/include/linux/yam.h
index 7fe28228b274..512cdc2fb80f 100644
--- a/include/linux/yam.h
+++ b/include/linux/yam.h
@@ -77,6 +77,6 @@ struct yamdrv_ioctl_cfg {
 struct yamdrv_ioctl_mcs {
        int cmd;
-        int bitrate;
+        unsigned int bitrate;
        unsigned char bits[YAM_FPGA_SIZE];
 };
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index a7a683e30b64..a8c2ef6d3b93 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -290,6 +290,7 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
        unsigned char err_offset = 0;
        u8 opt_len = opt[1];
        u8 opt_iter;
+        u8 tag_len;
        if (opt_len < 8) {
                err_offset = 1;
@@ -302,11 +303,12 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
        }
        for (opt_iter = 6; opt_iter < opt_len;) {
-                if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
+                tag_len = opt[opt_iter + 1];
+                if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) {
                        err_offset = opt_iter + 1;
                        goto out;
                }
-                opt_iter += opt[opt_iter + 1];
+                opt_iter += tag_len;
        }
 out:
diff --git a/include/net/dst.h b/include/net/dst.h
index 3bc4865f8267..3c4c944096c9 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -479,10 +479,22 @@ static inline struct dst_entry *xfrm_lookup(struct net *net,
 {
        return dst_orig;
 } 
+static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
+{
+        return NULL;
+}
 #else
 extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                                     const struct flowi *fl, struct sock *sk,
                                     int flags);
+/* skb attached with this dst needs transformation if dst->xfrm is valid */
+static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
+{
+        return dst->xfrm;
+}
 #endif
 #endif /* _NET_DST_H */
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 48ec25a7fcb6..5e661a979694 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -165,6 +165,7 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
 static inline void rt6_clean_expires(struct rt6_info *rt)
 {
        rt->rt6i_flags &= ~RTF_EXPIRES;
+        rt->dst.expires = 0;
 }
 static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index f525e7038cca..2b786b7e3585 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -194,11 +194,9 @@ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
 }
-static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt, struct in6_addr *dest)
+static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt)
 {
-        if (rt->rt6i_flags & RTF_GATEWAY)
+        return &rt->rt6i_gateway;
-                return &rt->rt6i_gateway;
-        return dest;
 }
 #endif
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index d0d11df9cba1..807d6b7a943f 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -133,7 +133,7 @@ struct ieee802154_ops {
 /* Basic interface to register ieee802154 device */
 struct ieee802154_dev *
-ieee802154_alloc_device(size_t priv_data_lex, struct ieee802154_ops *ops);
+ieee802154_alloc_device(size_t priv_data_len, struct ieee802154_ops *ops);
 void ieee802154_free_device(struct ieee802154_dev *dev);
 int ieee802154_register_device(struct ieee802154_dev *dev);
 void ieee802154_unregister_device(struct ieee802154_dev *dev);
diff --git a/include/net/sock.h b/include/net/sock.h
index 1d37a8086bed..808cbc2ec6c1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1630,16 +1630,14 @@ static inline void sk_filter_release(struct sk_filter *fp)
 static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
 {
-        unsigned int size = sk_filter_len(fp);
+        atomic_sub(sk_filter_size(fp->len), &sk->sk_omem_alloc);
-        atomic_sub(size, &sk->sk_omem_alloc);
        sk_filter_release(fp);
 }
 static inline void sk_filter_charge(struct sock *sk, struct sk_filter *fp)
 {
        atomic_inc(&fp->refcnt);
-        atomic_add(sk_filter_len(fp), &sk->sk_omem_alloc);
+        atomic_add(sk_filter_size(fp->len), &sk->sk_omem_alloc);
 }
 /*
diff --git a/include/sound/rcar_snd.h b/include/sound/rcar_snd.h
index fe66533e9b7a..fb0a312bcb81 100644
--- a/include/sound/rcar_snd.h
+++ b/include/sound/rcar_snd.h
@@ -68,6 +68,7 @@ struct rsnd_scu_platform_info {
 *
 * A : generation
 */
+#define RSND_GEN_MASK   (0xF << 0)
 #define RSND_GEN1       (1 << 0) /* fixme */
 #define RSND_GEN2       (2 << 0) /* fixme */
diff --git a/include/trace/events/target.h b/include/trace/events/target.h
index aef8fc354025..da9cc0f05c93 100644
--- a/include/trace/events/target.h
+++ b/include/trace/events/target.h
@@ -144,7 +144,7 @@ TRACE_EVENT(target_sequencer_start,
        ),
        TP_fast_assign(
-                __entry->unpacked_lun   = cmd->se_lun->unpacked_lun;
+                __entry->unpacked_lun   = cmd->orig_fe_lun;
                __entry->opcode         = cmd->t_task_cdb[0];
                __entry->data_length    = cmd->data_length;
                __entry->task_attribute = cmd->sam_task_attr;
@@ -182,7 +182,7 @@ TRACE_EVENT(target_cmd_complete,
        ),
        TP_fast_assign(
-                __entry->unpacked_lun   = cmd->se_lun->unpacked_lun;
+                __entry->unpacked_lun   = cmd->orig_fe_lun;
                __entry->opcode         = cmd->t_task_cdb[0];
                __entry->data_length    = cmd->data_length;
                __entry->task_attribute = cmd->sam_task_attr;
diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h
index 550811712f78..28acbaf4a81e 100644
--- a/include/uapi/drm/drm_mode.h
+++ b/include/uapi/drm/drm_mode.h
@@ -223,6 +223,8 @@ struct drm_mode_get_connector {
        __u32 connection;
        __u32 mm_width, mm_height; /**< HxW in millimeters */
        __u32 subpixel;
+        __u32 pad;
 };
 #define DRM_MODE_PROP_PENDING   (1<<0)
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index 009a655a5d35..2fc1602e23bb 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -456,13 +456,15 @@ struct perf_event_mmap_page {
        /*
         * Control data for the mmap() data buffer.
         *
-         * User-space reading the @data_head value should issue an rmb(), on
+         * User-space reading the @data_head value should issue an smp_rmb(),
-         * SMP capable platforms, after reading this value -- see
+         * after reading this value.
-         * perf_event_wakeup().
         *
         * When the mapping is PROT_WRITE the @data_tail value should be
-         * written by userspace to reflect the last read data. In this case
+         * written by userspace to reflect the last read data, after issueing
-         * the kernel will not over-write unread data.
+         * an smp_mb() to separate the data read from the ->data_tail store.
+         * In this case the kernel will not over-write unread data.
+         *
+         * See perf_output_put_handle() for the data ordering.
         */
        __u64   data_head;              /* head in the data section */
        __u64   data_tail;              /* user-space written tail */
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index 0623ec4e728f..56f121605c99 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -1,5 +1,6 @@
 # UAPI Header export list
 header-y += tc_csum.h
+header-y += tc_defact.h
 header-y += tc_gact.h
 header-y += tc_ipt.h
 header-y += tc_mirred.h
diff --git a/include/linux/tc_act/tc_defact.h b/include/uapi/linux/tc_act/tc_defact.h
index 6f65d07c7ce2..17dddb40f740 100644
--- a/include/linux/tc_act/tc_defact.h
+++ b/include/uapi/linux/tc_act/tc_defact.h
@@ -6,7 +6,7 @@
 struct tc_defact {
        tc_gen;
 };
-                                                                                
 enum {
        TCA_DEF_UNSPEC,
        TCA_DEF_TM,
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 0b233c56b0e4..e3ddd86c90a6 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -87,8 +87,10 @@ enum {
        IB_USER_VERBS_CMD_CLOSE_XRCD,
        IB_USER_VERBS_CMD_CREATE_XSRQ,
        IB_USER_VERBS_CMD_OPEN_QP,
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
        IB_USER_VERBS_CMD_CREATE_FLOW = IB_USER_VERBS_CMD_THRESHOLD,
        IB_USER_VERBS_CMD_DESTROY_FLOW
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 };
 /*
@@ -126,6 +128,7 @@ struct ib_uverbs_cmd_hdr {
        __u16 out_words;
 };
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 struct ib_uverbs_cmd_hdr_ex {
        __u32 command;
        __u16 in_words;
@@ -134,6 +137,7 @@ struct ib_uverbs_cmd_hdr_ex {
        __u16 provider_out_words;
        __u32 cmd_hdr_reserved;
 };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 struct ib_uverbs_get_context {
        __u64 response;
@@ -696,6 +700,7 @@ struct ib_uverbs_detach_mcast {
        __u64 driver_data[0];
 };
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 struct ib_kern_eth_filter {
        __u8  dst_mac[6];
        __u8  src_mac[6];
@@ -780,6 +785,7 @@ struct ib_uverbs_destroy_flow  {
        __u32 comp_mask;
        __u32 flow_handle;
 };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 struct ib_uverbs_create_srq {
        __u64 response;
diff --git a/include/video/exynos_dp.h b/include/video/exynos_dp.h
deleted file mode 100644
index bd8cabd344db..000000000000
--- a/include/video/exynos_dp.h
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Samsung SoC DP device support
- *
- * Copyright (C) 2012 Samsung Electronics Co., Ltd.
- * Author: Jingoo Han <jg1.han@samsung.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _EXYNOS_DP_H
-#define _EXYNOS_DP_H
-#define DP_TIMEOUT_LOOP_COUNT 100
-#define MAX_CR_LOOP 5
-#define MAX_EQ_LOOP 5
-enum link_rate_type {
-        LINK_RATE_1_62GBPS = 0x06,
-        LINK_RATE_2_70GBPS = 0x0a
-};
-enum link_lane_count_type {
-        LANE_COUNT1 = 1,
-        LANE_COUNT2 = 2,
-        LANE_COUNT4 = 4
-};
-enum link_training_state {
-        START,
-        CLOCK_RECOVERY,
-        EQUALIZER_TRAINING,
-        FINISHED,
-        FAILED
-};
-enum voltage_swing_level {
-        VOLTAGE_LEVEL_0,
-        VOLTAGE_LEVEL_1,
-        VOLTAGE_LEVEL_2,
-        VOLTAGE_LEVEL_3,
-};
-enum pre_emphasis_level {
-        PRE_EMPHASIS_LEVEL_0,
-        PRE_EMPHASIS_LEVEL_1,
-        PRE_EMPHASIS_LEVEL_2,
-        PRE_EMPHASIS_LEVEL_3,
-};
-enum pattern_set {
-        PRBS7,
-        D10_2,
-        TRAINING_PTN1,
-        TRAINING_PTN2,
-        DP_NONE
-};
-enum color_space {
-        COLOR_RGB,
-        COLOR_YCBCR422,
-        COLOR_YCBCR444
-};
-enum color_depth {
-        COLOR_6,
-        COLOR_8,
-        COLOR_10,
-        COLOR_12
-};
-enum color_coefficient {
-        COLOR_YCBCR601,
-        COLOR_YCBCR709
-};
-enum dynamic_range {
-        VESA,
-        CEA
-};
-enum pll_status {
-        PLL_UNLOCKED,
-        PLL_LOCKED
-};
-enum clock_recovery_m_value_type {
-        CALCULATED_M,
-        REGISTER_M
-};
-enum video_timing_recognition_type {
-        VIDEO_TIMING_FROM_CAPTURE,
-        VIDEO_TIMING_FROM_REGISTER
-};
-enum analog_power_block {
-        AUX_BLOCK,
-        CH0_BLOCK,
-        CH1_BLOCK,
-        CH2_BLOCK,
-        CH3_BLOCK,
-        ANALOG_TOTAL,
-        POWER_ALL
-};
-struct video_info {
-        char *name;
-        bool h_sync_polarity;
-        bool v_sync_polarity;
-        bool interlaced;
-        enum color_space color_space;
-        enum dynamic_range dynamic_range;
-        enum color_coefficient ycbcr_coeff;
-        enum color_depth color_depth;
-        enum link_rate_type link_rate;
-        enum link_lane_count_type lane_count;
-};
-struct exynos_dp_platdata {
-        struct video_info *video_info;
-        void (*phy_init)(void);
-        void (*phy_exit)(void);
-};
-#endif /* _EXYNOS_DP_H */
diff --git a/include/video/exynos_mipi_dsim.h b/include/video/exynos_mipi_dsim.h
index 89dc88a171af..6a578f8a1b3e 100644
--- a/include/video/exynos_mipi_dsim.h
+++ b/include/video/exynos_mipi_dsim.h
@@ -216,6 +216,7 @@ struct mipi_dsim_config {
 *      automatically.
 * @e_clk_src: select byte clock source.
 * @pd: pointer to MIPI-DSI driver platform data.
+ * @phy: pointer to the MIPI-DSI PHY
 */
 struct mipi_dsim_device {
        struct device                   *dev;
@@ -236,6 +237,7 @@ struct mipi_dsim_device {
        bool                            suspended;
        struct mipi_dsim_platform_data  *pd;
+        struct phy                      *phy;
 };
 /*
@@ -248,7 +250,6 @@ struct mipi_dsim_device {
 * @enabled: indicate whether mipi controller got enabled or not.
 * @lcd_panel_info: pointer for lcd panel specific structure.
 *      this structure specifies width, height, timing and polarity and so on.
- * @phy_enable: pointer to a callback controlling D-PHY enable/reset
 */
 struct mipi_dsim_platform_data {
        char                            lcd_panel_name[PANEL_NAME_SIZE];
@@ -256,8 +257,6 @@ struct mipi_dsim_platform_data {
        struct mipi_dsim_config         *dsim_config;
        unsigned int                    enabled;
        void                            *lcd_panel_info;
-        int (*phy_enable)(struct platform_device *pdev, bool on);
 };
 /*
diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
index 130dfece27ac..b0e99deb6d05 100644
--- a/ipc/ipc_sysctl.c
+++ b/ipc/ipc_sysctl.c
@@ -62,7 +62,7 @@ static int proc_ipc_dointvec_minmax_orphans(ctl_table *table, int write,
        return err;
 }
-static int proc_ipc_callback_dointvec(ctl_table *table, int write,
+static int proc_ipc_callback_dointvec_minmax(ctl_table *table, int write,
        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct ctl_table ipc_table;
@@ -72,7 +72,7 @@ static int proc_ipc_callback_dointvec(ctl_table *table, int write,
        memcpy(&ipc_table, table, sizeof(ipc_table));
        ipc_table.data = get_ipc(table);
-        rc = proc_dointvec(&ipc_table, write, buffer, lenp, ppos);
+        rc = proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
        if (write && !rc && lenp_bef == *lenp)
                /*
@@ -152,15 +152,13 @@ static int proc_ipcauto_dointvec_minmax(ctl_table *table, int write,
 #define proc_ipc_dointvec          NULL
 #define proc_ipc_dointvec_minmax   NULL
 #define proc_ipc_dointvec_minmax_orphans   NULL
-#define proc_ipc_callback_dointvec NULL
+#define proc_ipc_callback_dointvec_minmax  NULL
 #define proc_ipcauto_dointvec_minmax NULL
 #endif
 static int zero;
 static int one = 1;
-#ifdef CONFIG_CHECKPOINT_RESTORE
 static int int_max = INT_MAX;
-#endif
 static struct ctl_table ipc_kern_table[] = {
        {
@@ -198,21 +196,27 @@ static struct ctl_table ipc_kern_table[] = {
                .data           = &init_ipc_ns.msg_ctlmax,
                .maxlen         = sizeof (init_ipc_ns.msg_ctlmax),
                .mode           = 0644,
-                .proc_handler   = proc_ipc_dointvec,
+                .proc_handler   = proc_ipc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &int_max,
        },
        {
                .procname       = "msgmni",
                .data           = &init_ipc_ns.msg_ctlmni,
                .maxlen         = sizeof (init_ipc_ns.msg_ctlmni),
                .mode           = 0644,
-                .proc_handler   = proc_ipc_callback_dointvec,
+                .proc_handler   = proc_ipc_callback_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &int_max,
        },
        {
                .procname       =  "msgmnb",
                .data           = &init_ipc_ns.msg_ctlmnb,
                .maxlen         = sizeof (init_ipc_ns.msg_ctlmnb),
                .mode           = 0644,
-                .proc_handler   = proc_ipc_dointvec,
+                .proc_handler   = proc_ipc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &int_max,
        },
        {
                .procname       = "sem",
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2418b6e71a85..8bd9cfdc70d7 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2039,7 +2039,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
                /* @tsk either already exited or can't exit until the end */
                if (tsk->flags & PF_EXITING)
-                        continue;
+                        goto next;
                /* as per above, nr_threads may decrease, but not increase. */
                BUG_ON(i >= group_size);
@@ -2047,7 +2047,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
                ent.cgrp = task_cgroup_from_root(tsk, root);
                /* nothing to do if this task is already in the cgroup */
                if (ent.cgrp == cgrp)
-                        continue;
+                        goto next;
                /*
                 * saying GFP_ATOMIC has no effect here because we did prealloc
                 * earlier, but it's good form to communicate our expectations.
@@ -2055,7 +2055,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
                retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
                BUG_ON(retval != 0);
                i++;
+        next:
                if (!threadgroup)
                        break;
        } while_each_thread(leader, tsk);
@@ -3188,11 +3188,9 @@ css_next_descendant_post(struct cgroup_subsys_state *pos,
        WARN_ON_ONCE(!rcu_read_lock_held());
-        /* if first iteration, visit the leftmost descendant */
+        /* if first iteration, visit leftmost descendant which may be @root */
-        if (!pos) {
+        if (!pos)
-                next = css_leftmost_descendant(root);
+                return css_leftmost_descendant(root);
-                return next != root ? next : NULL;
-        }
        /* if we visited @root, we're done */
        if (pos == root)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index d49a9d29334c..953c14348375 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6767,6 +6767,10 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
        if (ret)
                return -EFAULT;
+        /* disabled for now */
+        if (attr->mmap2)
+                return -EINVAL;
        if (attr->__reserved_1)
                return -EINVAL;
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index cd55144270b5..9c2ddfbf4525 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -87,10 +87,31 @@ again:
                goto out;
        /*
-         * Publish the known good head. Rely on the full barrier implied
+         * Since the mmap() consumer (userspace) can run on a different CPU:
-         * by atomic_dec_and_test() order the rb->head read and this
+         *
-         * write.
+         *   kernel                             user
+         *
+         *   READ ->data_tail                   READ ->data_head
+         *   smp_mb()   (A)                     smp_rmb()       (C)
+         *   WRITE $data                        READ $data
+         *   smp_wmb()  (B)                     smp_mb()        (D)
+         *   STORE ->data_head                  WRITE ->data_tail
+         *
+         * Where A pairs with D, and B pairs with C.
+         *
+         * I don't think A needs to be a full barrier because we won't in fact
+         * write data until we see the store from userspace. So we simply don't
+         * issue the data WRITE until we observe it. Be conservative for now.
+         *
+         * OTOH, D needs to be a full barrier since it separates the data READ
+         * from the tail WRITE.
+         *
+         * For B a WMB is sufficient since it separates two WRITEs, and for C
+         * an RMB is sufficient since it separates two READs.
+         *
+         * See perf_output_begin().
         */
+        smp_wmb();
        rb->user_page->data_head = head;
        /*
@@ -154,9 +175,11 @@ int perf_output_begin(struct perf_output_handle *handle,
                 * Userspace could choose to issue a mb() before updating the
                 * tail pointer. So that all reads will be completed before the
                 * write is issued.
+                 *
+                 * See perf_output_put_handle().
                 */
                tail = ACCESS_ONCE(rb->user_page->data_tail);
-                smp_rmb();
+                smp_mb();
                offset = head = local_read(&rb->head);
                head += size;
                if (unlikely(!perf_output_space(rb, tail, offset, head)))
diff --git a/kernel/mutex.c b/kernel/mutex.c
index 6d647aedffea..d24105b1b794 100644
--- a/kernel/mutex.c
+++ b/kernel/mutex.c
@@ -410,7 +410,7 @@ ww_mutex_set_context_fastpath(struct ww_mutex *lock,
 static __always_inline int __sched
 __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                    struct lockdep_map *nest_lock, unsigned long ip,
-                    struct ww_acquire_ctx *ww_ctx)
+                    struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
 {
        struct task_struct *task = current;
        struct mutex_waiter waiter;
@@ -450,7 +450,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                struct task_struct *owner;
                struct mspin_node  node;
-                if (!__builtin_constant_p(ww_ctx == NULL) && ww_ctx->acquired > 0) {
+                if (use_ww_ctx && ww_ctx->acquired > 0) {
                        struct ww_mutex *ww;
                        ww = container_of(lock, struct ww_mutex, base);
@@ -480,7 +480,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                if ((atomic_read(&lock->count) == 1) &&
                    (atomic_cmpxchg(&lock->count, 1, 0) == 1)) {
                        lock_acquired(&lock->dep_map, ip);
-                        if (!__builtin_constant_p(ww_ctx == NULL)) {
+                        if (use_ww_ctx) {
                                struct ww_mutex *ww;
                                ww = container_of(lock, struct ww_mutex, base);
@@ -551,7 +551,7 @@ slowpath:
                        goto err;
                }
-                if (!__builtin_constant_p(ww_ctx == NULL) && ww_ctx->acquired > 0) {
+                if (use_ww_ctx && ww_ctx->acquired > 0) {
                        ret = __mutex_lock_check_stamp(lock, ww_ctx);
                        if (ret)
                                goto err;
@@ -575,7 +575,7 @@ skip_wait:
        lock_acquired(&lock->dep_map, ip);
        mutex_set_owner(lock);
-        if (!__builtin_constant_p(ww_ctx == NULL)) {
+        if (use_ww_ctx) {
                struct ww_mutex *ww = container_of(lock, struct ww_mutex, base);
                struct mutex_waiter *cur;
@@ -615,7 +615,7 @@ mutex_lock_nested(struct mutex *lock, unsigned int subclass)
 {
        might_sleep();
        __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE,
-                            subclass, NULL, _RET_IP_, NULL);
+                            subclass, NULL, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(mutex_lock_nested);
@@ -625,7 +625,7 @@ _mutex_lock_nest_lock(struct mutex *lock, struct lockdep_map *nest)
 {
        might_sleep();
        __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE,
-                            0, nest, _RET_IP_, NULL);
+                            0, nest, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(_mutex_lock_nest_lock);
@@ -635,7 +635,7 @@ mutex_lock_killable_nested(struct mutex *lock, unsigned int subclass)
 {
        might_sleep();
        return __mutex_lock_common(lock, TASK_KILLABLE,
-                                   subclass, NULL, _RET_IP_, NULL);
+                                   subclass, NULL, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(mutex_lock_killable_nested);
@@ -644,7 +644,7 @@ mutex_lock_interruptible_nested(struct mutex *lock, unsigned int subclass)
 {
        might_sleep();
        return __mutex_lock_common(lock, TASK_INTERRUPTIBLE,
-                                   subclass, NULL, _RET_IP_, NULL);
+                                   subclass, NULL, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(mutex_lock_interruptible_nested);
@@ -682,7 +682,7 @@ __ww_mutex_lock(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
        might_sleep();
        ret =  __mutex_lock_common(&lock->base, TASK_UNINTERRUPTIBLE,
-                                   0, &ctx->dep_map, _RET_IP_, ctx);
+                                   0, &ctx->dep_map, _RET_IP_, ctx, 1);
        if (!ret && ctx->acquired > 1)
                return ww_mutex_deadlock_injection(lock, ctx);
@@ -697,7 +697,7 @@ __ww_mutex_lock_interruptible(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
        might_sleep();
        ret = __mutex_lock_common(&lock->base, TASK_INTERRUPTIBLE,
-                                  0, &ctx->dep_map, _RET_IP_, ctx);
+                                  0, &ctx->dep_map, _RET_IP_, ctx, 1);
        if (!ret && ctx->acquired > 1)
                return ww_mutex_deadlock_injection(lock, ctx);
@@ -809,28 +809,28 @@ __mutex_lock_slowpath(atomic_t *lock_count)
        struct mutex *lock = container_of(lock_count, struct mutex, count);
        __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE, 0,
-                            NULL, _RET_IP_, NULL);
+                            NULL, _RET_IP_, NULL, 0);
 }
 static noinline int __sched
 __mutex_lock_killable_slowpath(struct mutex *lock)
 {
        return __mutex_lock_common(lock, TASK_KILLABLE, 0,
-                                   NULL, _RET_IP_, NULL);
+                                   NULL, _RET_IP_, NULL, 0);
 }
 static noinline int __sched
 __mutex_lock_interruptible_slowpath(struct mutex *lock)
 {
        return __mutex_lock_common(lock, TASK_INTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, NULL);
+                                   NULL, _RET_IP_, NULL, 0);
 }
 static noinline int __sched
 __ww_mutex_lock_slowpath(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
 {
        return __mutex_lock_common(&lock->base, TASK_UNINTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, ctx);
+                                   NULL, _RET_IP_, ctx, 1);
 }
 static noinline int __sched
@@ -838,7 +838,7 @@ __ww_mutex_lock_interruptible_slowpath(struct ww_mutex *lock,
                                            struct ww_acquire_ctx *ctx)
 {
        return __mutex_lock_common(&lock->base, TASK_INTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, ctx);
+                                   NULL, _RET_IP_, ctx, 1);
 }
 #endif
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index c9c759d5a15c..0121dab83f43 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -846,7 +846,7 @@ static int software_resume(void)
        goto Finish;
 }
-late_initcall(software_resume);
+late_initcall_sync(software_resume);
 static const char * const hibernation_modes[] = {
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 38959c866789..662c5798a685 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -33,29 +33,64 @@ struct ce_unbind {
        int res;
 };
-/**
+static u64 cev_delta2ns(unsigned long latch, struct clock_event_device *evt,
- * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
+                        bool ismax)
- * @latch:      value to convert
- * @evt:        pointer to clock event device descriptor
- *
- * Math helper, returns latch value converted to nanoseconds (bound checked)
- */
-u64 clockevent_delta2ns(unsigned long latch, struct clock_event_device *evt)
 {
        u64 clc = (u64) latch << evt->shift;
+        u64 rnd;
        if (unlikely(!evt->mult)) {
                evt->mult = 1;
                WARN_ON(1);
        }
+        rnd = (u64) evt->mult - 1;
+        /*
+         * Upper bound sanity check. If the backwards conversion is
+         * not equal latch, we know that the above shift overflowed.
+         */
+        if ((clc >> evt->shift) != (u64)latch)
+                clc = ~0ULL;
+        /*
+         * Scaled math oddities:
+         *
+         * For mult <= (1 << shift) we can safely add mult - 1 to
+         * prevent integer rounding loss. So the backwards conversion
+         * from nsec to device ticks will be correct.
+         *
+         * For mult > (1 << shift), i.e. device frequency is > 1GHz we
+         * need to be careful. Adding mult - 1 will result in a value
+         * which when converted back to device ticks can be larger
+         * than latch by up to (mult - 1) >> shift. For the min_delta
+         * calculation we still want to apply this in order to stay
+         * above the minimum device ticks limit. For the upper limit
+         * we would end up with a latch value larger than the upper
+         * limit of the device, so we omit the add to stay below the
+         * device upper boundary.
+         *
+         * Also omit the add if it would overflow the u64 boundary.
+         */
+        if ((~0ULL - clc > rnd) &&
+            (!ismax || evt->mult <= (1U << evt->shift)))
+                clc += rnd;
        do_div(clc, evt->mult);
-        if (clc < 1000)
-                clc = 1000;
-        if (clc > KTIME_MAX)
-                clc = KTIME_MAX;
-        return clc;
+        /* Deltas less than 1usec are pointless noise */
+        return clc > 1000 ? clc : 1000;
+}
+/**
+ * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
+ * @latch:      value to convert
+ * @evt:        pointer to clock event device descriptor
+ *
+ * Math helper, returns latch value converted to nanoseconds (bound checked)
+ */
+u64 clockevent_delta2ns(unsigned long latch, struct clock_event_device *evt)
+{
+        return cev_delta2ns(latch, evt, false);
 }
 EXPORT_SYMBOL_GPL(clockevent_delta2ns);
@@ -380,8 +415,8 @@ void clockevents_config(struct clock_event_device *dev, u32 freq)
                sec = 600;
        clockevents_calc_mult_shift(dev, freq, sec);
-        dev->min_delta_ns = clockevent_delta2ns(dev->min_delta_ticks, dev);
+        dev->min_delta_ns = cev_delta2ns(dev->min_delta_ticks, dev, false);
-        dev->max_delta_ns = clockevent_delta2ns(dev->max_delta_ticks, dev);
+        dev->max_delta_ns = cev_delta2ns(dev->max_delta_ticks, dev, true);
 }
 /**
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 06344d986eb9..094f3152ec2b 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -983,7 +983,7 @@ config DEBUG_KOBJECT
 config DEBUG_KOBJECT_RELEASE
        bool "kobject release debugging"
-        depends on DEBUG_KERNEL
+        depends on DEBUG_OBJECTS_TIMERS
        help
          kobjects are reference counted objects.  This means that their
          last reference count put is not predictable, and the kobject can
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index a685c8a79578..d16fa295ae1d 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -577,7 +577,8 @@ void sg_miter_stop(struct sg_mapping_iter *miter)
                miter->__offset += miter->consumed;
                miter->__remaining -= miter->consumed;
-                if (miter->__flags & SG_MITER_TO_SG)
+                if ((miter->__flags & SG_MITER_TO_SG) &&
+                    !PageSlab(miter->page))
                        flush_kernel_dcache_page(miter->page);
                if (miter->__flags & SG_MITER_ATOMIC) {
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 610e3df2768a..cca80d96e509 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1278,64 +1278,90 @@ out:
 int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                                unsigned long addr, pmd_t pmd, pmd_t *pmdp)
 {
+        struct anon_vma *anon_vma = NULL;
        struct page *page;
        unsigned long haddr = addr & HPAGE_PMD_MASK;
+        int page_nid = -1, this_nid = numa_node_id();
        int target_nid;
-        int current_nid = -1;
+        bool page_locked;
-        bool migrated;
+        bool migrated = false;
        spin_lock(&mm->page_table_lock);
        if (unlikely(!pmd_same(pmd, *pmdp)))
                goto out_unlock;
        page = pmd_page(pmd);
-        get_page(page);
+        page_nid = page_to_nid(page);
-        current_nid = page_to_nid(page);
        count_vm_numa_event(NUMA_HINT_FAULTS);
-        if (current_nid == numa_node_id())
+        if (page_nid == this_nid)
                count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
+        /*
+         * Acquire the page lock to serialise THP migrations but avoid dropping
+         * page_table_lock if at all possible
+         */
+        page_locked = trylock_page(page);
        target_nid = mpol_misplaced(page, vma, haddr);
        if (target_nid == -1) {
-                put_page(page);
+                /* If the page was locked, there are no parallel migrations */
-                goto clear_pmdnuma;
+                if (page_locked)
+                        goto clear_pmdnuma;
+                /*
+                 * Otherwise wait for potential migrations and retry. We do
+                 * relock and check_same as the page may no longer be mapped.
+                 * As the fault is being retried, do not account for it.
+                 */
+                spin_unlock(&mm->page_table_lock);
+                wait_on_page_locked(page);
+                page_nid = -1;
+                goto out;
        }
-        /* Acquire the page lock to serialise THP migrations */
+        /* Page is misplaced, serialise migrations and parallel THP splits */
+        get_page(page);
        spin_unlock(&mm->page_table_lock);
-        lock_page(page);
+        if (!page_locked)
+                lock_page(page);
+        anon_vma = page_lock_anon_vma_read(page);
        /* Confirm the PTE did not while locked */
        spin_lock(&mm->page_table_lock);
        if (unlikely(!pmd_same(pmd, *pmdp))) {
                unlock_page(page);
                put_page(page);
+                page_nid = -1;
                goto out_unlock;
        }
-        spin_unlock(&mm->page_table_lock);
-        /* Migrate the THP to the requested node */
+        /*
+         * Migrate the THP to the requested node, returns with page unlocked
+         * and pmd_numa cleared.
+         */
+        spin_unlock(&mm->page_table_lock);
        migrated = migrate_misplaced_transhuge_page(mm, vma,
                                pmdp, pmd, addr, page, target_nid);
-        if (!migrated)
+        if (migrated)
-                goto check_same;
+                page_nid = target_nid;
-        task_numa_fault(target_nid, HPAGE_PMD_NR, true);
-        return 0;
-check_same:
+        goto out;
-        spin_lock(&mm->page_table_lock);
-        if (unlikely(!pmd_same(pmd, *pmdp)))
-                goto out_unlock;
 clear_pmdnuma:
+        BUG_ON(!PageLocked(page));
        pmd = pmd_mknonnuma(pmd);
        set_pmd_at(mm, haddr, pmdp, pmd);
        VM_BUG_ON(pmd_numa(*pmdp));
        update_mmu_cache_pmd(vma, addr, pmdp);
+        unlock_page(page);
 out_unlock:
        spin_unlock(&mm->page_table_lock);
-        if (current_nid != -1)
-                task_numa_fault(current_nid, HPAGE_PMD_NR, false);
+out:
+        if (anon_vma)
+                page_unlock_anon_vma_read(anon_vma);
+        if (page_nid != -1)
+                task_numa_fault(page_nid, HPAGE_PMD_NR, migrated);
        return 0;
 }
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 72467914b856..72f9decb0104 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -81,8 +81,9 @@ restart:
                 * decrement nr_to_walk first so that we don't livelock if we
                 * get stuck on large numbesr of LRU_RETRY items
                 */
-                if (--(*nr_to_walk) == 0)
+                if (!*nr_to_walk)
                        break;
+                --*nr_to_walk;
                ret = isolate(item, &nlru->lock, cb_arg);
                switch (ret) {
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 34d3ca9572d6..13b9d0f221b8 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -54,6 +54,7 @@
 #include <linux/page_cgroup.h>
 #include <linux/cpu.h>
 #include <linux/oom.h>
+#include <linux/lockdep.h>
 #include "internal.h"
 #include <net/sock.h>
 #include <net/ip.h>
@@ -2046,6 +2047,12 @@ static int mem_cgroup_soft_reclaim(struct mem_cgroup *root_memcg,
        return total;
 }
+#ifdef CONFIG_LOCKDEP
+static struct lockdep_map memcg_oom_lock_dep_map = {
+        .name = "memcg_oom_lock",
+};
+#endif
 static DEFINE_SPINLOCK(memcg_oom_lock);
 /*
@@ -2083,7 +2090,8 @@ static bool mem_cgroup_oom_trylock(struct mem_cgroup *memcg)
                        }
                        iter->oom_lock = false;
                }
-        }
+        } else
+                mutex_acquire(&memcg_oom_lock_dep_map, 0, 1, _RET_IP_);
        spin_unlock(&memcg_oom_lock);
@@ -2095,6 +2103,7 @@ static void mem_cgroup_oom_unlock(struct mem_cgroup *memcg)
        struct mem_cgroup *iter;
        spin_lock(&memcg_oom_lock);
+        mutex_release(&memcg_oom_lock_dep_map, 1, _RET_IP_);
        for_each_mem_cgroup_tree(iter, memcg)
                iter->oom_lock = false;
        spin_unlock(&memcg_oom_lock);
@@ -2765,10 +2774,10 @@ done:
        *ptr = memcg;
        return 0;
 nomem:
-        *ptr = NULL;
+        if (!(gfp_mask & __GFP_NOFAIL)) {
-        if (gfp_mask & __GFP_NOFAIL)
+                *ptr = NULL;
-                return 0;
+                return -ENOMEM;
-        return -ENOMEM;
+        }
 bypass:
        *ptr = root_mem_cgroup;
        return -EINTR;
@@ -3773,8 +3782,7 @@ void mem_cgroup_move_account_page_stat(struct mem_cgroup *from,
 {
        /* Update stat data for mem_cgroup */
        preempt_disable();
-        WARN_ON_ONCE(from->stat->count[idx] < nr_pages);
+        __this_cpu_sub(from->stat->count[idx], nr_pages);
-        __this_cpu_add(from->stat->count[idx], -nr_pages);
        __this_cpu_add(to->stat->count[idx], nr_pages);
        preempt_enable();
 }
@@ -4950,31 +4958,18 @@ static void mem_cgroup_reparent_charges(struct mem_cgroup *memcg)
        } while (usage > 0);
 }
-/*
- * This mainly exists for tests during the setting of set of use_hierarchy.
- * Since this is the very setting we are changing, the current hierarchy value
- * is meaningless
- */
-static inline bool __memcg_has_children(struct mem_cgroup *memcg)
-{
-        struct cgroup_subsys_state *pos;
-        /* bounce at first found */
-        css_for_each_child(pos, &memcg->css)
-                return true;
-        return false;
-}
-/*
- * Must be called with memcg_create_mutex held, unless the cgroup is guaranteed
- * to be already dead (as in mem_cgroup_force_empty, for instance).  This is
- * from mem_cgroup_count_children(), in the sense that we don't really care how
- * many children we have; we only need to know if we have any.  It also counts
- * any memcg without hierarchy as infertile.
- */
 static inline bool memcg_has_children(struct mem_cgroup *memcg)
 {
-        return memcg->use_hierarchy && __memcg_has_children(memcg);
+        lockdep_assert_held(&memcg_create_mutex);
+        /*
+         * The lock does not prevent addition or deletion to the list
+         * of children, but it prevents a new child from being
+         * initialized based on this parent in css_online(), so it's
+         * enough to decide whether hierarchically inherited
+         * attributes can still be changed or not.
+         */
+        return memcg->use_hierarchy &&
+                !list_empty(&memcg->css.cgroup->children);
 }
 /*
@@ -5054,7 +5049,7 @@ static int mem_cgroup_hierarchy_write(struct cgroup_subsys_state *css,
         */
        if ((!parent_memcg || !parent_memcg->use_hierarchy) &&
                                (val == 1 || val == 0)) {
-                if (!__memcg_has_children(memcg))
+                if (list_empty(&memcg->css.cgroup->children))
                        memcg->use_hierarchy = val;
                else
                        retval = -EBUSY;
diff --git a/mm/memory.c b/mm/memory.c
index 1311f26497e6..d176154c243f 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3521,12 +3521,12 @@ static int do_nonlinear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 }
 int numa_migrate_prep(struct page *page, struct vm_area_struct *vma,
-                                unsigned long addr, int current_nid)
+                                unsigned long addr, int page_nid)
 {
        get_page(page);
        count_vm_numa_event(NUMA_HINT_FAULTS);
-        if (current_nid == numa_node_id())
+        if (page_nid == numa_node_id())
                count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
        return mpol_misplaced(page, vma, addr);
@@ -3537,7 +3537,7 @@ int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
 {
        struct page *page = NULL;
        spinlock_t *ptl;
-        int current_nid = -1;
+        int page_nid = -1;
        int target_nid;
        bool migrated = false;
@@ -3567,15 +3567,10 @@ int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                return 0;
        }
-        current_nid = page_to_nid(page);
+        page_nid = page_to_nid(page);
-        target_nid = numa_migrate_prep(page, vma, addr, current_nid);
+        target_nid = numa_migrate_prep(page, vma, addr, page_nid);
        pte_unmap_unlock(ptep, ptl);
        if (target_nid == -1) {
-                /*
-                 * Account for the fault against the current node if it not
-                 * being replaced regardless of where the page is located.
-                 */
-                current_nid = numa_node_id();
                put_page(page);
                goto out;
        }
@@ -3583,11 +3578,11 @@ int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        /* Migrate to the requested node */
        migrated = migrate_misplaced_page(page, target_nid);
        if (migrated)
-                current_nid = target_nid;
+                page_nid = target_nid;
 out:
-        if (current_nid != -1)
+        if (page_nid != -1)
-                task_numa_fault(current_nid, 1, migrated);
+                task_numa_fault(page_nid, 1, migrated);
        return 0;
 }
@@ -3602,7 +3597,6 @@ static int do_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        unsigned long offset;
        spinlock_t *ptl;
        bool numa = false;
-        int local_nid = numa_node_id();
        spin_lock(&mm->page_table_lock);
        pmd = *pmdp;
@@ -3625,9 +3619,10 @@ static int do_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        for (addr = _addr + offset; addr < _addr + PMD_SIZE; pte++, addr += PAGE_SIZE) {
                pte_t pteval = *pte;
                struct page *page;
-                int curr_nid = local_nid;
+                int page_nid = -1;
                int target_nid;
-                bool migrated;
+                bool migrated = false;
                if (!pte_present(pteval))
                        continue;
                if (!pte_numa(pteval))
@@ -3649,25 +3644,19 @@ static int do_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                if (unlikely(page_mapcount(page) != 1))
                        continue;
-                /*
+                page_nid = page_to_nid(page);
-                 * Note that the NUMA fault is later accounted to either
+                target_nid = numa_migrate_prep(page, vma, addr, page_nid);
-                 * the node that is currently running or where the page is
+                pte_unmap_unlock(pte, ptl);
-                 * migrated to.
+                if (target_nid != -1) {
-                 */
+                        migrated = migrate_misplaced_page(page, target_nid);
-                curr_nid = local_nid;
+                        if (migrated)
-                target_nid = numa_migrate_prep(page, vma, addr,
+                                page_nid = target_nid;
-                                               page_to_nid(page));
+                } else {
-                if (target_nid == -1) {
                        put_page(page);
-                        continue;
                }
-                /* Migrate to the requested node */
+                if (page_nid != -1)
-                pte_unmap_unlock(pte, ptl);
+                        task_numa_fault(page_nid, 1, migrated);
-                migrated = migrate_misplaced_page(page, target_nid);
-                if (migrated)
-                        curr_nid = target_nid;
-                task_numa_fault(curr_nid, 1, migrated);
                pte = pte_offset_map_lock(mm, pmdp, addr, &ptl);
        }
diff --git a/mm/migrate.c b/mm/migrate.c
index 7a7325ee1d08..c04692774e88 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1715,12 +1715,12 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                unlock_page(new_page);
                put_page(new_page);             /* Free it */
-                unlock_page(page);
+                /* Retake the callers reference and putback on LRU */
+                get_page(page);
                putback_lru_page(page);
+                mod_zone_page_state(page_zone(page),
-                count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
+                         NR_ISOLATED_ANON + page_lru, -HPAGE_PMD_NR);
-                isolated = 0;
+                goto out_fail;
-                goto out;
        }
        /*
@@ -1737,9 +1737,9 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
        entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
        entry = pmd_mkhuge(entry);
-        page_add_new_anon_rmap(new_page, vma, haddr);
+        pmdp_clear_flush(vma, haddr, pmd);
        set_pmd_at(mm, haddr, pmd, entry);
+        page_add_new_anon_rmap(new_page, vma, haddr);
        update_mmu_cache_pmd(vma, address, &entry);
        page_remove_rmap(page);
        /*
@@ -1758,7 +1758,6 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
        count_vm_events(PGMIGRATE_SUCCESS, HPAGE_PMD_NR);
        count_vm_numa_events(NUMA_PAGE_MIGRATE, HPAGE_PMD_NR);
-out:
        mod_zone_page_state(page_zone(page),
                        NR_ISOLATED_ANON + page_lru,
                        -HPAGE_PMD_NR);
@@ -1767,6 +1766,10 @@ out:
 out_fail:
        count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
 out_dropref:
+        entry = pmd_mknonnuma(entry);
+        set_pmd_at(mm, haddr, pmd, entry);
+        update_mmu_cache_pmd(vma, address, &entry);
        unlock_page(page);
        put_page(page);
        return 0;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index a3af058f68e4..412ba2b7326a 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -148,7 +148,7 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
                                split_huge_page_pmd(vma, addr, pmd);
                        else if (change_huge_pmd(vma, pmd, addr, newprot,
                                                 prot_numa)) {
-                                pages += HPAGE_PMD_NR;
+                                pages++;
                                continue;
                        }
                        /* fall through */
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 5da2cbcfdbb5..2beeabf502c5 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -242,7 +242,7 @@ int walk_page_range(unsigned long addr, unsigned long end,
                if (err)
                        break;
                pgd++;
-        } while (addr = next, addr != end);
+        } while (addr = next, addr < end);
        return err;
 }
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index 309129732285..c7e634af8516 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -171,7 +171,7 @@ static size_t vlan_get_size(const struct net_device *dev)
        return nla_total_size(2) +      /* IFLA_VLAN_PROTOCOL */
               nla_total_size(2) +      /* IFLA_VLAN_ID */
-               sizeof(struct ifla_vlan_flags) + /* IFLA_VLAN_FLAGS */
+               nla_total_size(sizeof(struct ifla_vlan_flags)) + /* IFLA_VLAN_FLAGS */
               vlan_qos_map_size(vlan->nr_ingress_mappings) +
               vlan_qos_map_size(vlan->nr_egress_mappings);
 }
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index c72d1bcdcf49..1356af660b5b 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -65,6 +65,7 @@ static int __init batadv_init(void)
        batadv_recv_handler_init();
        batadv_iv_init();
+        batadv_nc_init();
        batadv_event_workqueue = create_singlethread_workqueue("bat_events");
@@ -142,7 +143,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
        if (ret < 0)
                goto err;
-        ret = batadv_nc_init(bat_priv);
+        ret = batadv_nc_mesh_init(bat_priv);
        if (ret < 0)
                goto err;
@@ -167,7 +168,7 @@ void batadv_mesh_free(struct net_device *soft_iface)
        batadv_vis_quit(bat_priv);
        batadv_gw_node_purge(bat_priv);
-        batadv_nc_free(bat_priv);
+        batadv_nc_mesh_free(bat_priv);
        batadv_dat_free(bat_priv);
        batadv_bla_free(bat_priv);
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index a487d46e0aec..4ecc0b6bf8ab 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -35,6 +35,20 @@ static int batadv_nc_recv_coded_packet(struct sk_buff *skb,
                                       struct batadv_hard_iface *recv_if);
 /**
+ * batadv_nc_init - one-time initialization for network coding
+ */
+int __init batadv_nc_init(void)
+{
+        int ret;
+        /* Register our packet type */
+        ret = batadv_recv_handler_register(BATADV_CODED,
+                                           batadv_nc_recv_coded_packet);
+        return ret;
+}
+/**
 * batadv_nc_start_timer - initialise the nc periodic worker
 * @bat_priv: the bat priv with all the soft interface information
 */
@@ -45,10 +59,10 @@ static void batadv_nc_start_timer(struct batadv_priv *bat_priv)
 }
 /**
- * batadv_nc_init - initialise coding hash table and start house keeping
+ * batadv_nc_mesh_init - initialise coding hash table and start house keeping
 * @bat_priv: the bat priv with all the soft interface information
 */
-int batadv_nc_init(struct batadv_priv *bat_priv)
+int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
 {
        bat_priv->nc.timestamp_fwd_flush = jiffies;
        bat_priv->nc.timestamp_sniffed_purge = jiffies;
@@ -70,11 +84,6 @@ int batadv_nc_init(struct batadv_priv *bat_priv)
        batadv_hash_set_lock_class(bat_priv->nc.coding_hash,
                                   &batadv_nc_decoding_hash_lock_class_key);
-        /* Register our packet type */
-        if (batadv_recv_handler_register(BATADV_CODED,
-                                         batadv_nc_recv_coded_packet) < 0)
-                goto err;
        INIT_DELAYED_WORK(&bat_priv->nc.work, batadv_nc_worker);
        batadv_nc_start_timer(bat_priv);
@@ -1721,12 +1730,11 @@ free_nc_packet:
 }
 /**
- * batadv_nc_free - clean up network coding memory
+ * batadv_nc_mesh_free - clean up network coding memory
 * @bat_priv: the bat priv with all the soft interface information
 */
-void batadv_nc_free(struct batadv_priv *bat_priv)
+void batadv_nc_mesh_free(struct batadv_priv *bat_priv)
 {
-        batadv_recv_handler_unregister(BATADV_CODED);
        cancel_delayed_work_sync(&bat_priv->nc.work);
        batadv_nc_purge_paths(bat_priv, bat_priv->nc.coding_hash, NULL);
diff --git a/net/batman-adv/network-coding.h b/net/batman-adv/network-coding.h
index 85a4ec81ad50..ddfa618e80bf 100644
--- a/net/batman-adv/network-coding.h
+++ b/net/batman-adv/network-coding.h
@@ -22,8 +22,9 @@
 #ifdef CONFIG_BATMAN_ADV_NC
-int batadv_nc_init(struct batadv_priv *bat_priv);
+int batadv_nc_init(void);
-void batadv_nc_free(struct batadv_priv *bat_priv);
+int batadv_nc_mesh_init(struct batadv_priv *bat_priv);
+void batadv_nc_mesh_free(struct batadv_priv *bat_priv);
 void batadv_nc_update_nc_node(struct batadv_priv *bat_priv,
                              struct batadv_orig_node *orig_node,
                              struct batadv_orig_node *orig_neigh_node,
@@ -46,12 +47,17 @@ int batadv_nc_init_debugfs(struct batadv_priv *bat_priv);
 #else /* ifdef CONFIG_BATMAN_ADV_NC */
-static inline int batadv_nc_init(struct batadv_priv *bat_priv)
+static inline int batadv_nc_init(void)
 {
        return 0;
 }
-static inline void batadv_nc_free(struct batadv_priv *bat_priv)
+static inline int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
+{
+        return 0;
+}
+static inline void batadv_nc_mesh_free(struct batadv_priv *bat_priv)
 {
        return;
 }
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index ca04163635da..e6b7fecb3af1 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -64,7 +64,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                        br_flood_deliver(br, skb, false);
                        goto out;
                }
-                if (br_multicast_rcv(br, NULL, skb)) {
+                if (br_multicast_rcv(br, NULL, skb, vid)) {
                        kfree_skb(skb);
                        goto out;
                }
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index ffd5874f2592..33e8f23acddd 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -700,7 +700,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                vid = nla_get_u16(tb[NDA_VLAN]);
-                if (vid >= VLAN_N_VID) {
+                if (!vid || vid >= VLAN_VID_MASK) {
                        pr_info("bridge: RTM_NEWNEIGH with invalid vlan id %d\n",
                                vid);
                        return -EINVAL;
@@ -794,7 +794,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                vid = nla_get_u16(tb[NDA_VLAN]);
-                if (vid >= VLAN_N_VID) {
+                if (!vid || vid >= VLAN_VID_MASK) {
                        pr_info("bridge: RTM_NEWNEIGH with invalid vlan id %d\n",
                                vid);
                        return -EINVAL;
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index a2fd37ec35f7..7e73c32e205d 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -80,7 +80,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
                br_fdb_update(br, p, eth_hdr(skb)->h_source, vid);
        if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
-            br_multicast_rcv(br, p, skb))
+            br_multicast_rcv(br, p, skb, vid))
                goto drop;
        if (p->state == BR_STATE_LEARNING)
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 85a09bb5ca51..b7b1914dfa25 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -453,7 +453,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
                call_rcu_bh(&p->rcu, br_multicast_free_pg);
                err = 0;
-                if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                if (!mp->ports && !mp->mglist &&
                    netif_running(br->dev))
                        mod_timer(&mp->timer, jiffies);
                break;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index d1c578630678..686284ff3d6a 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -272,7 +272,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                del_timer(&p->timer);
                call_rcu_bh(&p->rcu, br_multicast_free_pg);
-                if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                if (!mp->ports && !mp->mglist &&
                    netif_running(br->dev))
                        mod_timer(&mp->timer, jiffies);
@@ -620,7 +620,6 @@ rehash:
        mp->br = br;
        mp->addr = *group;
        setup_timer(&mp->timer, br_multicast_group_expired,
                    (unsigned long)mp);
@@ -660,6 +659,7 @@ static int br_multicast_add_group(struct net_bridge *br,
        struct net_bridge_mdb_entry *mp;
        struct net_bridge_port_group *p;
        struct net_bridge_port_group __rcu **pp;
+        unsigned long now = jiffies;
        int err;
        spin_lock(&br->multicast_lock);
@@ -674,6 +674,7 @@ static int br_multicast_add_group(struct net_bridge *br,
        if (!port) {
                mp->mglist = true;
+                mod_timer(&mp->timer, now + br->multicast_membership_interval);
                goto out;
        }
@@ -681,7 +682,7 @@ static int br_multicast_add_group(struct net_bridge *br,
             (p = mlock_dereference(*pp, br)) != NULL;
             pp = &p->next) {
                if (p->port == port)
-                        goto out;
+                        goto found;
                if ((unsigned long)p->port < (unsigned long)port)
                        break;
        }
@@ -692,6 +693,8 @@ static int br_multicast_add_group(struct net_bridge *br,
        rcu_assign_pointer(*pp, p);
        br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
+found:
+        mod_timer(&p->timer, now + br->multicast_membership_interval);
 out:
        err = 0;
@@ -944,7 +947,8 @@ void br_multicast_disable_port(struct net_bridge_port *port)
 static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
                                         struct net_bridge_port *port,
-                                         struct sk_buff *skb)
+                                         struct sk_buff *skb,
+                                         u16 vid)
 {
        struct igmpv3_report *ih;
        struct igmpv3_grec *grec;
@@ -954,12 +958,10 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
        int type;
        int err = 0;
        __be32 group;
-        u16 vid = 0;
        if (!pskb_may_pull(skb, sizeof(*ih)))
                return -EINVAL;
-        br_vlan_get_tag(skb, &vid);
        ih = igmpv3_report_hdr(skb);
        num = ntohs(ih->ngrec);
        len = sizeof(*ih);
@@ -1002,7 +1004,8 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
 #if IS_ENABLED(CONFIG_IPV6)
 static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                                        struct net_bridge_port *port,
-                                        struct sk_buff *skb)
+                                        struct sk_buff *skb,
+                                        u16 vid)
 {
        struct icmp6hdr *icmp6h;
        struct mld2_grec *grec;
@@ -1010,12 +1013,10 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
        int len;
        int num;
        int err = 0;
-        u16 vid = 0;
        if (!pskb_may_pull(skb, sizeof(*icmp6h)))
                return -EINVAL;
-        br_vlan_get_tag(skb, &vid);
        icmp6h = icmp6_hdr(skb);
        num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
        len = sizeof(*icmp6h);
@@ -1138,7 +1139,8 @@ static void br_multicast_query_received(struct net_bridge *br,
 static int br_ip4_multicast_query(struct net_bridge *br,
                                  struct net_bridge_port *port,
-                                  struct sk_buff *skb)
+                                  struct sk_buff *skb,
+                                  u16 vid)
 {
        const struct iphdr *iph = ip_hdr(skb);
        struct igmphdr *ih = igmp_hdr(skb);
@@ -1150,7 +1152,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
        unsigned long now = jiffies;
        __be32 group;
        int err = 0;
-        u16 vid = 0;
        spin_lock(&br->multicast_lock);
        if (!netif_running(br->dev) ||
@@ -1186,14 +1187,10 @@ static int br_ip4_multicast_query(struct net_bridge *br,
        if (!group)
                goto out;
-        br_vlan_get_tag(skb, &vid);
        mp = br_mdb_ip4_get(mlock_dereference(br->mdb, br), group, vid);
        if (!mp)
                goto out;
-        mod_timer(&mp->timer, now + br->multicast_membership_interval);
-        mp->timer_armed = true;
        max_delay *= br->multicast_last_member_count;
        if (mp->mglist &&
@@ -1219,7 +1216,8 @@ out:
 #if IS_ENABLED(CONFIG_IPV6)
 static int br_ip6_multicast_query(struct net_bridge *br,
                                  struct net_bridge_port *port,
-                                  struct sk_buff *skb)
+                                  struct sk_buff *skb,
+                                  u16 vid)
 {
        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
        struct mld_msg *mld;
@@ -1231,7 +1229,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
        unsigned long now = jiffies;
        const struct in6_addr *group = NULL;
        int err = 0;
-        u16 vid = 0;
        spin_lock(&br->multicast_lock);
        if (!netif_running(br->dev) ||
@@ -1265,14 +1262,10 @@ static int br_ip6_multicast_query(struct net_bridge *br,
        if (!group)
                goto out;
-        br_vlan_get_tag(skb, &vid);
        mp = br_mdb_ip6_get(mlock_dereference(br->mdb, br), group, vid);
        if (!mp)
                goto out;
-        mod_timer(&mp->timer, now + br->multicast_membership_interval);
-        mp->timer_armed = true;
        max_delay *= br->multicast_last_member_count;
        if (mp->mglist &&
            (timer_pending(&mp->timer) ?
@@ -1358,7 +1351,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
                        call_rcu_bh(&p->rcu, br_multicast_free_pg);
                        br_mdb_notify(br->dev, port, group, RTM_DELMDB);
-                        if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                        if (!mp->ports && !mp->mglist &&
                            netif_running(br->dev))
                                mod_timer(&mp->timer, jiffies);
                }
@@ -1370,12 +1363,30 @@ static void br_multicast_leave_group(struct net_bridge *br,
                     br->multicast_last_member_interval;
        if (!port) {
-                if (mp->mglist && mp->timer_armed &&
+                if (mp->mglist &&
                    (timer_pending(&mp->timer) ?
                     time_after(mp->timer.expires, time) :
                     try_to_del_timer_sync(&mp->timer) >= 0)) {
                        mod_timer(&mp->timer, time);
                }
+                goto out;
+        }
+        for (p = mlock_dereference(mp->ports, br);
+             p != NULL;
+             p = mlock_dereference(p->next, br)) {
+                if (p->port != port)
+                        continue;
+                if (!hlist_unhashed(&p->mglist) &&
+                    (timer_pending(&p->timer) ?
+                     time_after(p->timer.expires, time) :
+                     try_to_del_timer_sync(&p->timer) >= 0)) {
+                        mod_timer(&p->timer, time);
+                }
+                break;
        }
 out:
        spin_unlock(&br->multicast_lock);
@@ -1424,7 +1435,8 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
 static int br_multicast_ipv4_rcv(struct net_bridge *br,
                                 struct net_bridge_port *port,
-                                 struct sk_buff *skb)
+                                 struct sk_buff *skb,
+                                 u16 vid)
 {
        struct sk_buff *skb2 = skb;
        const struct iphdr *iph;
@@ -1432,7 +1444,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
        unsigned int len;
        unsigned int offset;
        int err;
-        u16 vid = 0;
        /* We treat OOM as packet loss for now. */
        if (!pskb_may_pull(skb, sizeof(*iph)))
@@ -1493,7 +1504,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
        err = 0;
-        br_vlan_get_tag(skb2, &vid);
        BR_INPUT_SKB_CB(skb)->igmp = 1;
        ih = igmp_hdr(skb2);
@@ -1504,10 +1514,10 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
                err = br_ip4_multicast_add_group(br, port, ih->group, vid);
                break;
        case IGMPV3_HOST_MEMBERSHIP_REPORT:
-                err = br_ip4_multicast_igmp3_report(br, port, skb2);
+                err = br_ip4_multicast_igmp3_report(br, port, skb2, vid);
                break;
        case IGMP_HOST_MEMBERSHIP_QUERY:
-                err = br_ip4_multicast_query(br, port, skb2);
+                err = br_ip4_multicast_query(br, port, skb2, vid);
                break;
        case IGMP_HOST_LEAVE_MESSAGE:
                br_ip4_multicast_leave_group(br, port, ih->group, vid);
@@ -1525,7 +1535,8 @@ err_out:
 #if IS_ENABLED(CONFIG_IPV6)
 static int br_multicast_ipv6_rcv(struct net_bridge *br,
                                 struct net_bridge_port *port,
-                                 struct sk_buff *skb)
+                                 struct sk_buff *skb,
+                                 u16 vid)
 {
        struct sk_buff *skb2;
        const struct ipv6hdr *ip6h;
@@ -1535,7 +1546,6 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
        unsigned int len;
        int offset;
        int err;
-        u16 vid = 0;
        if (!pskb_may_pull(skb, sizeof(*ip6h)))
                return -EINVAL;
@@ -1625,7 +1635,6 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
        err = 0;
-        br_vlan_get_tag(skb, &vid);
        BR_INPUT_SKB_CB(skb)->igmp = 1;
        switch (icmp6_type) {
@@ -1642,10 +1651,10 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                break;
            }
        case ICMPV6_MLD2_REPORT:
-                err = br_ip6_multicast_mld2_report(br, port, skb2);
+                err = br_ip6_multicast_mld2_report(br, port, skb2, vid);
                break;
        case ICMPV6_MGM_QUERY:
-                err = br_ip6_multicast_query(br, port, skb2);
+                err = br_ip6_multicast_query(br, port, skb2, vid);
                break;
        case ICMPV6_MGM_REDUCTION:
            {
@@ -1666,7 +1675,7 @@ out:
 #endif
 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
-                     struct sk_buff *skb)
+                     struct sk_buff *skb, u16 vid)
 {
        BR_INPUT_SKB_CB(skb)->igmp = 0;
        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
@@ -1676,10 +1685,10 @@ int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
        switch (skb->protocol) {
        case htons(ETH_P_IP):
-                return br_multicast_ipv4_rcv(br, port, skb);
+                return br_multicast_ipv4_rcv(br, port, skb, vid);
 #if IS_ENABLED(CONFIG_IPV6)
        case htons(ETH_P_IPV6):
-                return br_multicast_ipv6_rcv(br, port, skb);
+                return br_multicast_ipv6_rcv(br, port, skb, vid);
 #endif
        }
@@ -1798,7 +1807,6 @@ void br_multicast_stop(struct net_bridge *br)
                hlist_for_each_entry_safe(mp, n, &mdb->mhash[i],
                                          hlist[ver]) {
                        del_timer(&mp->timer);
-                        mp->timer_armed = false;
                        call_rcu_bh(&mp->rcu, br_multicast_free_group);
                }
        }
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index e74ddc1c29a8..f75d92e4f96b 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -243,7 +243,7 @@ static int br_afspec(struct net_bridge *br,
                vinfo = nla_data(tb[IFLA_BRIDGE_VLAN_INFO]);
-                if (vinfo->vid >= VLAN_N_VID)
+                if (!vinfo->vid || vinfo->vid >= VLAN_VID_MASK)
                        return -EINVAL;
                switch (cmd) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index efb57d911569..2e8244efb262 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -126,7 +126,6 @@ struct net_bridge_mdb_entry
        struct timer_list               timer;
        struct br_ip                    addr;
        bool                            mglist;
-        bool                            timer_armed;
 };
 struct net_bridge_mdb_htable
@@ -452,7 +451,8 @@ extern int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __us
 extern unsigned int br_mdb_rehash_seq;
 extern int br_multicast_rcv(struct net_bridge *br,
                            struct net_bridge_port *port,
-                            struct sk_buff *skb);
+                            struct sk_buff *skb,
+                            u16 vid);
 extern struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                                               struct sk_buff *skb, u16 vid);
 extern void br_multicast_add_port(struct net_bridge_port *port);
@@ -523,7 +523,8 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br,
 #else
 static inline int br_multicast_rcv(struct net_bridge *br,
                                   struct net_bridge_port *port,
-                                   struct sk_buff *skb)
+                                   struct sk_buff *skb,
+                                   u16 vid)
 {
        return 0;
 }
@@ -643,9 +644,7 @@ static inline u16 br_get_pvid(const struct net_port_vlans *v)
         * vid wasn't set
         */
        smp_rmb();
-        return (v->pvid & VLAN_TAG_PRESENT) ?
+        return v->pvid ?: VLAN_N_VID;
-                        (v->pvid & ~VLAN_TAG_PRESENT) :
-                        VLAN_N_VID;
 }
 #else
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 108084a04671..656a6f3e40de 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -134,7 +134,7 @@ static void br_stp_start(struct net_bridge *br)
        if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY)
                __br_set_forward_delay(br, BR_MIN_FORWARD_DELAY);
-        else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY)
+        else if (br->bridge_forward_delay > BR_MAX_FORWARD_DELAY)
                __br_set_forward_delay(br, BR_MAX_FORWARD_DELAY);
        if (r == 0) {
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 9a9ffe7e4019..53f0990eab58 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -45,37 +45,34 @@ static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
                return 0;
        }
-        if (vid) {
+        if (v->port_idx) {
-                if (v->port_idx) {
+                p = v->parent.port;
-                        p = v->parent.port;
+                br = p->br;
-                        br = p->br;
+                dev = p->dev;
-                        dev = p->dev;
+        } else {
-                } else {
+                br = v->parent.br;
-                        br = v->parent.br;
+                dev = br->dev;
-                        dev = br->dev;
+        }
-                }
+        ops = dev->netdev_ops;
-                ops = dev->netdev_ops;
+        if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) {
-                if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) {
+                /* Add VLAN to the device filter if it is supported.
-                        /* Add VLAN to the device filter if it is supported.
+                 * Stricly speaking, this is not necessary now, since
-                         * Stricly speaking, this is not necessary now, since
+                 * devices are made promiscuous by the bridge, but if
-                         * devices are made promiscuous by the bridge, but if
+                 * that ever changes this code will allow tagged
-                         * that ever changes this code will allow tagged
+                 * traffic to enter the bridge.
-                         * traffic to enter the bridge.
+                 */
-                         */
+                err = ops->ndo_vlan_rx_add_vid(dev, htons(ETH_P_8021Q),
-                        err = ops->ndo_vlan_rx_add_vid(dev, htons(ETH_P_8021Q),
+                                               vid);
-                                                       vid);
+                if (err)
-                        if (err)
+                        return err;
-                                return err;
+        }
-                }
-                err = br_fdb_insert(br, p, dev->dev_addr, vid);
-                if (err) {
-                        br_err(br, "failed insert local address into bridge "
-                               "forwarding table\n");
-                        goto out_filt;
-                }
+        err = br_fdb_insert(br, p, dev->dev_addr, vid);
+        if (err) {
+                br_err(br, "failed insert local address into bridge "
+                       "forwarding table\n");
+                goto out_filt;
        }
        set_bit(vid, v->vlan_bitmap);
@@ -98,7 +95,7 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
        __vlan_delete_pvid(v, vid);
        clear_bit(vid, v->untagged_bitmap);
-        if (v->port_idx && vid) {
+        if (v->port_idx) {
                struct net_device *dev = v->parent.port->dev;
                const struct net_device_ops *ops = dev->netdev_ops;
@@ -192,6 +189,8 @@ out:
 bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
                        struct sk_buff *skb, u16 *vid)
 {
+        int err;
        /* If VLAN filtering is disabled on the bridge, all packets are
         * permitted.
         */
@@ -204,20 +203,32 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
        if (!v)
                return false;
-        if (br_vlan_get_tag(skb, vid)) {
+        err = br_vlan_get_tag(skb, vid);
+        if (!*vid) {
                u16 pvid = br_get_pvid(v);
-                /* Frame did not have a tag.  See if pvid is set
+                /* Frame had a tag with VID 0 or did not have a tag.
-                 * on this port.  That tells us which vlan untagged
+                 * See if pvid is set on this port.  That tells us which
-                 * traffic belongs to.
+                 * vlan untagged or priority-tagged traffic belongs to.
                 */
                if (pvid == VLAN_N_VID)
                        return false;
-                /* PVID is set on this port.  Any untagged ingress
+                /* PVID is set on this port.  Any untagged or priority-tagged
-                 * frame is considered to belong to this vlan.
+                 * ingress frame is considered to belong to this vlan.
                 */
-                __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), pvid);
+                *vid = pvid;
+                if (likely(err))
+                        /* Untagged Frame. */
+                        __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), pvid);
+                else
+                        /* Priority-tagged Frame.
+                         * At this point, We know that skb->vlan_tci had
+                         * VLAN_TAG_PRESENT bit and its VID field was 0x000.
+                         * We update only VID field and preserve PCP field.
+                         */
+                        skb->vlan_tci |= pvid;
                return true;
        }
@@ -248,7 +259,9 @@ bool br_allowed_egress(struct net_bridge *br,
        return false;
 }
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
 {
        struct net_port_vlans *pv = NULL;
@@ -278,7 +291,9 @@ out:
        return err;
 }
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int br_vlan_delete(struct net_bridge *br, u16 vid)
 {
        struct net_port_vlans *pv;
@@ -289,14 +304,9 @@ int br_vlan_delete(struct net_bridge *br, u16 vid)
        if (!pv)
                return -EINVAL;
-        if (vid) {
+        spin_lock_bh(&br->hash_lock);
-                /* If the VID !=0 remove fdb for this vid. VID 0 is special
+        fdb_delete_by_addr(br, br->dev->dev_addr, vid);
-                 * in that it's the default and is always there in the fdb.
+        spin_unlock_bh(&br->hash_lock);
-                 */
-                spin_lock_bh(&br->hash_lock);
-                fdb_delete_by_addr(br, br->dev->dev_addr, vid);
-                spin_unlock_bh(&br->hash_lock);
-        }
        __vlan_del(pv, vid);
        return 0;
@@ -329,7 +339,9 @@ unlock:
        return 0;
 }
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
 {
        struct net_port_vlans *pv = NULL;
@@ -363,7 +375,9 @@ clean_up:
        return err;
 }
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
 {
        struct net_port_vlans *pv;
@@ -374,14 +388,9 @@ int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
        if (!pv)
                return -EINVAL;
-        if (vid) {
+        spin_lock_bh(&port->br->hash_lock);
-                /* If the VID !=0 remove fdb for this vid. VID 0 is special
+        fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
-                 * in that it's the default and is always there in the fdb.
+        spin_unlock_bh(&port->br->hash_lock);
-                 */
-                spin_lock_bh(&port->br->hash_lock);
-                fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
-                spin_unlock_bh(&port->br->hash_lock);
-        }
        return __vlan_del(pv, vid);
 }
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 518093802d1d..7c470c371e14 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -181,6 +181,7 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
        ub->qlen++;
        pm = nlmsg_data(nlh);
+        memset(pm, 0, sizeof(*pm));
        /* Fill in the ulog data */
        pm->version = EBT_ULOG_VERSION;
@@ -193,8 +194,6 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
        pm->hook = hooknr;
        if (uloginfo->prefix != NULL)
                strcpy(pm->prefix, uloginfo->prefix);
-        else
-                *(pm->prefix) = '\0';
        if (in) {
                strcpy(pm->physindev, in->name);
@@ -204,16 +203,14 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
                        strcpy(pm->indev, br_port_get_rcu(in)->br->dev->name);
                else
                        strcpy(pm->indev, in->name);
-        } else
+        }
-                pm->indev[0] = pm->physindev[0] = '\0';
        if (out) {
                /* If out exists, then out is a bridge port */
                strcpy(pm->physoutdev, out->name);
                /* rcu_read_lock()ed by nf_hook_slow */
                strcpy(pm->outdev, br_port_get_rcu(out)->br->dev->name);
-        } else
+        }
-                pm->outdev[0] = pm->physoutdev[0] = '\0';
        if (skb_copy_bits(skb, -ETH_HLEN, pm->data, copy_len) < 0)
                BUG();
diff --git a/net/compat.c b/net/compat.c
index f0a1ba6c8086..89032580bd1d 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -71,6 +71,8 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
            __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
            __get_user(kmsg->msg_flags, &umsg->msg_flags))
                return -EFAULT;
+        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+                return -EINVAL;
        kmsg->msg_name = compat_ptr(tmp1);
        kmsg->msg_iov = compat_ptr(tmp2);
        kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/core/dev.c b/net/core/dev.c
index 65f829cfd928..3430b1ed12e5 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1917,7 +1917,8 @@ static struct xps_map *expand_xps_map(struct xps_map *map,
        return new_map;
 }
-int netif_set_xps_queue(struct net_device *dev, struct cpumask *mask, u16 index)
+int netif_set_xps_queue(struct net_device *dev, const struct cpumask *mask,
+                        u16 index)
 {
        struct xps_dev_maps *dev_maps, *new_dev_maps = NULL;
        struct xps_map *map, *new_map;
diff --git a/net/core/filter.c b/net/core/filter.c
index 6438f29ff266..01b780856db2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -644,7 +644,6 @@ void sk_filter_release_rcu(struct rcu_head *rcu)
        struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
        bpf_jit_free(fp);
-        kfree(fp);
 }
 EXPORT_SYMBOL(sk_filter_release_rcu);
@@ -683,7 +682,7 @@ int sk_unattached_filter_create(struct sk_filter **pfp,
        if (fprog->filter == NULL)
                return -EINVAL;
-        fp = kmalloc(fsize + sizeof(*fp), GFP_KERNEL);
+        fp = kmalloc(sk_filter_size(fprog->len), GFP_KERNEL);
        if (!fp)
                return -ENOMEM;
        memcpy(fp->insns, fprog->filter, fsize);
@@ -723,6 +722,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 {
        struct sk_filter *fp, *old_fp;
        unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
+        unsigned int sk_fsize = sk_filter_size(fprog->len);
        int err;
        if (sock_flag(sk, SOCK_FILTER_LOCKED))
@@ -732,11 +732,11 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
        if (fprog->filter == NULL)
                return -EINVAL;
-        fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
+        fp = sock_kmalloc(sk, sk_fsize, GFP_KERNEL);
        if (!fp)
                return -ENOMEM;
        if (copy_from_user(fp->insns, fprog->filter, fsize)) {
-                sock_kfree_s(sk, fp, fsize+sizeof(*fp));
+                sock_kfree_s(sk, fp, sk_fsize);
                return -EFAULT;
        }
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 8d7d0dd72db2..143b6fdb9647 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -40,7 +40,7 @@ again:
                struct iphdr _iph;
 ip:
                iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
-                if (!iph)
+                if (!iph || iph->ihl < 5)
                        return false;
                if (ip_is_fragment(iph))
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index fc75c9e461b8..8f971990677c 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -636,8 +636,9 @@ static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo
                        netpoll_send_skb(np, send_skb);
-                        /* If there are several rx_hooks for the same address,
+                        /* If there are several rx_skb_hooks for the same
-                           we're fine by sending a single reply */
+                         * address we're fine by sending a single reply
+                         */
                        break;
                }
                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
@@ -719,8 +720,9 @@ static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo
                        netpoll_send_skb(np, send_skb);
-                        /* If there are several rx_hooks for the same address,
+                        /* If there are several rx_skb_hooks for the same
-                           we're fine by sending a single reply */
+                         * address, we're fine by sending a single reply
+                         */
                        break;
                }
                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
@@ -756,11 +758,12 @@ static bool pkt_is_ns(struct sk_buff *skb)
 int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
 {
-        int proto, len, ulen;
+        int proto, len, ulen, data_len;
-        int hits = 0;
+        int hits = 0, offset;
        const struct iphdr *iph;
        struct udphdr *uh;
        struct netpoll *np, *tmp;
+        uint16_t source;
        if (list_empty(&npinfo->rx_np))
                goto out;
@@ -820,7 +823,10 @@ int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
                len -= iph->ihl*4;
                uh = (struct udphdr *)(((char *)iph) + iph->ihl*4);
+                offset = (unsigned char *)(uh + 1) - skb->data;
                ulen = ntohs(uh->len);
+                data_len = skb->len - offset;
+                source = ntohs(uh->source);
                if (ulen != len)
                        goto out;
@@ -834,9 +840,7 @@ int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
                        if (np->local_port && np->local_port != ntohs(uh->dest))
                                continue;
-                        np->rx_hook(np, ntohs(uh->source),
+                        np->rx_skb_hook(np, source, skb, offset, data_len);
-                                       (char *)(uh+1),
-                                       ulen - sizeof(struct udphdr));
                        hits++;
                }
        } else {
@@ -859,7 +863,10 @@ int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
                if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                        goto out;
                uh = udp_hdr(skb);
+                offset = (unsigned char *)(uh + 1) - skb->data;
                ulen = ntohs(uh->len);
+                data_len = skb->len - offset;
+                source = ntohs(uh->source);
                if (ulen != skb->len)
                        goto out;
                if (udp6_csum_init(skb, uh, IPPROTO_UDP))
@@ -872,9 +879,7 @@ int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
                        if (np->local_port && np->local_port != ntohs(uh->dest))
                                continue;
-                        np->rx_hook(np, ntohs(uh->source),
+                        np->rx_skb_hook(np, source, skb, offset, data_len);
-                                       (char *)(uh+1),
-                                       ulen - sizeof(struct udphdr));
                        hits++;
                }
 #endif
@@ -1062,7 +1067,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
        npinfo->netpoll = np;
-        if (np->rx_hook) {
+        if (np->rx_skb_hook) {
                spin_lock_irqsave(&npinfo->rx_lock, flags);
                npinfo->rx_flags |= NETPOLL_RX_ENABLED;
                list_add_tail(&np->rx, &npinfo->rx_np);
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 3f1ec1586ae1..8d9d05edd2eb 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -10,6 +10,7 @@
 #include <net/secure_seq.h>
+#if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_INET)
 #define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4)
 static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned;
@@ -29,6 +30,7 @@ static void net_secret_init(void)
                cmpxchg(&net_secret[--i], 0, tmp);
        }
 }
+#endif
 #ifdef CONFIG_INET
 static u32 seq_scale(u32 seq)
diff --git a/net/core/sock.c b/net/core/sock.c
index 5b6beba494a3..0b39e7ae4383 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2319,6 +2319,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
        sk->sk_ll_usec          =       sysctl_net_busy_read;
 #endif
+        sk->sk_pacing_rate = ~0U;
        /*
         * Before updating sk_refcnt, we must commit prior changes to memory
         * (Documentation/RCU/rculist_nulls.txt for details)
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index c85e71e0c7ff..ff41b4d60d30 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -1372,6 +1372,8 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
        real_dev = dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
        if (!real_dev)
                return -ENODEV;
+        if (real_dev->type != ARPHRD_IEEE802154)
+                return -EINVAL;
        lowpan_dev_info(dev)->real_dev = real_dev;
        lowpan_dev_info(dev)->fragment_tag = 0;
@@ -1386,6 +1388,9 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
        entry->ldev = dev;
+        /* Set the lowpan harware address to the wpan hardware address. */
+        memcpy(dev->dev_addr, real_dev->dev_addr, IEEE802154_ADDR_LEN);
        mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
        INIT_LIST_HEAD(&entry->list);
        list_add_tail(&entry->list, &lowpan_devices);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 7bd8983dbfcf..96da9c77deca 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -287,7 +287,7 @@ begintw:
                        if (unlikely(!INET_TW_MATCH(sk, net, acookie,
                                                    saddr, daddr, ports,
                                                    dif))) {
-                                sock_put(sk);
+                                inet_twsk_put(inet_twsk(sk));
                                goto begintw;
                        }
                        goto out;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index a04d872c54f9..3982eabf61e1 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -772,15 +772,20 @@ static inline int ip_ufo_append_data(struct sock *sk,
                /* initialize protocol header pointer */
                skb->transport_header = skb->network_header + fragheaderlen;
-                skb->ip_summed = CHECKSUM_PARTIAL;
                skb->csum = 0;
-                /* specify the length of each IP datagram fragment */
-                skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
-                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                __skb_queue_tail(queue, skb);
+        } else if (skb_is_gso(skb)) {
+                goto append;
        }
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        /* specify the length of each IP datagram fragment */
+        skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
+        skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+append:
        return skb_append_datato_frags(sk, skb, getfrag, from,
                                       (length - transhdrlen));
 }
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index e805e7b3030e..6e87f853d033 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -125,8 +125,17 @@ static int vti_rcv(struct sk_buff *skb)
                                  iph->saddr, iph->daddr, 0);
        if (tunnel != NULL) {
                struct pcpu_tstats *tstats;
+                u32 oldmark = skb->mark;
+                int ret;
-                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                /* temporarily mark the skb with the tunnel o_key, to
+                 * only match policies with this mark.
+                 */
+                skb->mark = be32_to_cpu(tunnel->parms.o_key);
+                ret = xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb);
+                skb->mark = oldmark;
+                if (!ret)
                        return -1;
                tstats = this_cpu_ptr(tunnel->dev->tstats);
@@ -135,7 +144,6 @@ static int vti_rcv(struct sk_buff *skb)
                tstats->rx_bytes += skb->len;
                u64_stats_update_end(&tstats->syncp);
-                skb->mark = 0;
                secpath_reset(skb);
                skb->dev = tunnel->dev;
                return 1;
@@ -167,7 +175,7 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        memset(&fl4, 0, sizeof(fl4));
        flowi4_init_output(&fl4, tunnel->parms.link,
-                           be32_to_cpu(tunnel->parms.i_key), RT_TOS(tos),
+                           be32_to_cpu(tunnel->parms.o_key), RT_TOS(tos),
                           RT_SCOPE_UNIVERSE,
                           IPPROTO_IPIP, 0,
                           dst, tiph->saddr, 0, 0);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 85a4f21aac1a..59da7cde0724 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -271,6 +271,11 @@ unsigned int arpt_do_table(struct sk_buff *skb,
        local_bh_disable();
        addend = xt_write_recseq_begin();
        private = table->private;
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
        table_base = private->entries[smp_processor_id()];
        e = get_entry(table_base, private->hook_entry[hook]);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index d23118d95ff9..718dfbd30cbe 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -327,6 +327,11 @@ ipt_do_table(struct sk_buff *skb,
        addend = xt_write_recseq_begin();
        private = table->private;
        cpu        = smp_processor_id();
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
        table_base = private->entries[cpu];
        jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
        stackptr   = per_cpu_ptr(private->stackptr, cpu);
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index cbc22158af49..9cb993cd224b 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -220,6 +220,7 @@ static void ipt_ulog_packet(struct net *net,
        ub->qlen++;
        pm = nlmsg_data(nlh);
+        memset(pm, 0, sizeof(*pm));
        /* We might not have a timestamp, get one */
        if (skb->tstamp.tv64 == 0)
@@ -238,8 +239,6 @@ static void ipt_ulog_packet(struct net *net,
        }
        else if (loginfo->prefix[0] != '\0')
                strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
-        else
-                *(pm->prefix) = '\0';
        if (in && in->hard_header_len > 0 &&
            skb->mac_header != skb->network_header &&
@@ -251,13 +250,9 @@ static void ipt_ulog_packet(struct net *net,
        if (in)
                strncpy(pm->indev_name, in->name, sizeof(pm->indev_name));
-        else
-                pm->indev_name[0] = '\0';
        if (out)
                strncpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
-        else
-                pm->outdev_name[0] = '\0';
        /* copy_len <= skb->len, so can't fail. */
        if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 727f4365bcdf..6011615e810d 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2072,7 +2072,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
                                                              RT_SCOPE_LINK);
                        goto make_route;
                }
-                if (fl4->saddr) {
+                if (!fl4->saddr) {
                        if (ipv4_is_multicast(fl4->daddr))
                                fl4->saddr = inet_select_addr(dev_out, 0,
                                                              fl4->flowi4_scope);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 25a89eaa669d..068c8fb0d158 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1284,7 +1284,10 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                tp->lost_cnt_hint -= tcp_skb_pcount(prev);
        }
-        TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(prev)->tcp_flags;
+        TCP_SKB_CB(prev)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
+        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+                TCP_SKB_CB(prev)->end_seq++;
        if (skb == tcp_highest_sack(sk))
                tcp_advance_highest_sack(sk, skb);
@@ -2853,7 +2856,8 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
         * left edge of the send window.
         * See draft-ietf-tcplw-high-performance-00, section 3.3.
         */
-        if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
+        if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
+            flag & FLAG_ACKED)
                seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
        if (seq_rtt < 0)
@@ -2868,14 +2872,19 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
 }
 /* Compute time elapsed between (last) SYNACK and the ACK completing 3WHS. */
-static void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req)
+static void tcp_synack_rtt_meas(struct sock *sk, const u32 synack_stamp)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        s32 seq_rtt = -1;
-        if (tp->lsndtime && !tp->total_retrans)
+        if (synack_stamp && !tp->total_retrans)
-                seq_rtt = tcp_time_stamp - tp->lsndtime;
+                seq_rtt = tcp_time_stamp - synack_stamp;
-        tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
+        /* If the ACK acks both the SYNACK and the (Fast Open'd) data packets
+         * sent in SYN_RECV, SYNACK RTT is the smooth RTT computed in tcp_ack()
+         */
+        if (!tp->srtt)
+                tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
 }
 static void tcp_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
@@ -2978,6 +2987,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
        s32 seq_rtt = -1;
        s32 ca_seq_rtt = -1;
        ktime_t last_ackt = net_invalid_timestamp();
+        bool rtt_update;
        while ((skb = tcp_write_queue_head(sk)) && skb != tcp_send_head(sk)) {
                struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
@@ -3054,14 +3064,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
        if (skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                flag |= FLAG_SACK_RENEGING;
-        if (tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt) ||
+        rtt_update = tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt);
-            (flag & FLAG_ACKED))
-                tcp_rearm_rto(sk);
        if (flag & FLAG_ACKED) {
                const struct tcp_congestion_ops *ca_ops
                        = inet_csk(sk)->icsk_ca_ops;
+                tcp_rearm_rto(sk);
                if (unlikely(icsk->icsk_mtup.probe_size &&
                             !after(tp->mtu_probe.probe_seq_end, tp->snd_una))) {
                        tcp_mtup_probe_success(sk);
@@ -3100,6 +3109,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                        ca_ops->pkts_acked(sk, pkts_acked, rtt_us);
                }
+        } else if (skb && rtt_update && sack_rtt >= 0 &&
+                   sack_rtt > (s32)(now - TCP_SKB_CB(skb)->when)) {
+                /* Do not re-arm RTO if the sack RTT is measured from data sent
+                 * after when the head was last (re)transmitted. Otherwise the
+                 * timeout may continue to extend in loss recovery.
+                 */
+                tcp_rearm_rto(sk);
        }
 #if FASTRETRANS_DEBUG > 0
@@ -3288,7 +3304,7 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
                        tcp_init_cwnd_reduction(sk, true);
                        tcp_set_ca_state(sk, TCP_CA_CWR);
                        tcp_end_cwnd_reduction(sk);
-                        tcp_set_ca_state(sk, TCP_CA_Open);
+                        tcp_try_keep_open(sk);
                        NET_INC_STATS_BH(sock_net(sk),
                                         LINUX_MIB_TCPLOSSPROBERECOVERY);
                }
@@ -5584,6 +5600,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
        struct request_sock *req;
        int queued = 0;
        bool acceptable;
+        u32 synack_stamp;
        tp->rx_opt.saw_tstamp = 0;
@@ -5666,9 +5683,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 * so release it.
                 */
                if (req) {
+                        synack_stamp = tcp_rsk(req)->snt_synack;
                        tp->total_retrans = req->num_retrans;
                        reqsk_fastopen_remove(sk, req, false);
                } else {
+                        synack_stamp = tp->lsndtime;
                        /* Make sure socket is routed, for correct metrics. */
                        icsk->icsk_af_ops->rebuild_header(sk);
                        tcp_init_congestion_control(sk);
@@ -5691,7 +5710,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                tp->snd_una = TCP_SKB_CB(skb)->ack_seq;
                tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale;
                tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
-                tcp_synack_rtt_meas(sk, req);
+                tcp_synack_rtt_meas(sk, synack_stamp);
                if (tp->rx_opt.tstamp_ok)
                        tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
@@ -5709,6 +5728,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                } else
                        tcp_init_metrics(sk);
+                tcp_update_pacing_rate(sk);
                /* Prevent spurious tcp_cwnd_restart() on first data packet */
                tp->lsndtime = tcp_time_stamp;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 3a7525e6c086..533c58a5cfb7 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -18,6 +18,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
                                netdev_features_t features)
 {
        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int sum_truesize = 0;
        struct tcphdr *th;
        unsigned int thlen;
        unsigned int seq;
@@ -102,13 +103,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
                if (copy_destructor) {
                        skb->destructor = gso_skb->destructor;
                        skb->sk = gso_skb->sk;
-                        /* {tcp|sock}_wfree() use exact truesize accounting :
+                        sum_truesize += skb->truesize;
-                         * sum(skb->truesize) MUST be exactly be gso_skb->truesize
-                         * So we account mss bytes of 'true size' for each segment.
-                         * The last segment will contain the remaining.
-                         */
-                        skb->truesize = mss;
-                        gso_skb->truesize -= mss;
                }
                skb = skb->next;
                th = tcp_hdr(skb);
@@ -125,7 +120,9 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
        if (copy_destructor) {
                swap(gso_skb->sk, skb->sk);
                swap(gso_skb->destructor, skb->destructor);
-                swap(gso_skb->truesize, skb->truesize);
+                sum_truesize += skb->truesize;
+                atomic_add(sum_truesize - gso_skb->truesize,
+                           &skb->sk->sk_wmem_alloc);
        }
        delta = htonl(oldlen + (skb_tail_pointer(skb) -
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e6bb8256e59f..d46f2143305c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -637,6 +637,8 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
        unsigned int size = 0;
        unsigned int eff_sacks;
+        opts->options = 0;
 #ifdef CONFIG_TCP_MD5SIG
        *md5 = tp->af_specific->md5_lookup(sk, sk);
        if (unlikely(*md5)) {
@@ -984,8 +986,10 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                 unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk) ||
+        /* Make sure we own this skb before messing gso_size/gso_segs */
-            skb->ip_summed == CHECKSUM_NONE) {
+        WARN_ON_ONCE(skb_cloned(skb));
+        if (skb->len <= mss_now || skb->ip_summed == CHECKSUM_NONE) {
                /* Avoid the costly divide in the normal
                 * non-TSO case.
                 */
@@ -1065,9 +1069,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
        if (nsize < 0)
                nsize = 0;
-        if (skb_cloned(skb) &&
+        if (skb_unclone(skb, GFP_ATOMIC))
-            skb_is_nonlinear(skb) &&
-            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                return -ENOMEM;
        /* Get a new skb... force flag on. */
@@ -2342,6 +2344,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                int oldpcount = tcp_skb_pcount(skb);
                if (unlikely(oldpcount > 1)) {
+                        if (skb_unclone(skb, GFP_ATOMIC))
+                                return -ENOMEM;
                        tcp_init_tso_segs(sk, skb, cur_mss);
                        tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
                }
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 9a459be24af7..e1a63930a967 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -104,9 +104,14 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
        const struct iphdr *iph = ip_hdr(skb);
        u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
        struct flowi4 *fl4 = &fl->u.ip4;
+        int oif = 0;
+        if (skb_dst(skb))
+                oif = skb_dst(skb)->dev->ifindex;
        memset(fl4, 0, sizeof(struct flowi4));
        fl4->flowi4_mark = skb->mark;
+        fl4->flowi4_oif = reverse ? skb->skb_iif : oif;
        if (!ip_is_fragment(iph)) {
                switch (iph->protocol) {
@@ -235,7 +240,7 @@ static struct dst_ops xfrm4_dst_ops = {
        .destroy =              xfrm4_dst_destroy,
        .ifdown =               xfrm4_dst_ifdown,
        .local_out =            __ip_local_out,
-        .gc_thresh =            1024,
+        .gc_thresh =            32768,
 };
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 73784c3d4642..82e1da3a40b9 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -618,8 +618,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);
        struct xfrm_state *x;
-        if (type != ICMPV6_DEST_UNREACH &&
+        if (type != ICMPV6_PKT_TOOBIG &&
-            type != ICMPV6_PKT_TOOBIG &&
            type != NDISC_REDIRECT)
                return;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index d3618a78fcac..e67e63f9858d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -436,8 +436,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data + offset);
        struct xfrm_state *x;
-        if (type != ICMPV6_DEST_UNREACH &&
+        if (type != ICMPV6_PKT_TOOBIG &&
-            type != ICMPV6_PKT_TOOBIG &&
            type != NDISC_REDIRECT)
                return;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 32b4a1675d82..066640e0ba8e 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -116,7 +116,7 @@ begintw:
                        }
                        if (unlikely(!INET6_TW_MATCH(sk, net, saddr, daddr,
                                                     ports, dif))) {
-                                sock_put(sk);
+                                inet_twsk_put(inet_twsk(sk));
                                goto begintw;
                        }
                        goto out;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 7bb5446b9d73..bf4a9a084de5 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -976,6 +976,7 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
                if (t->parms.o_flags&GRE_SEQ)
                        addend += 4;
        }
+        t->hlen = addend;
        if (p->flags & IP6_TNL_F_CAP_XMIT) {
                int strict = (ipv6_addr_type(&p->raddr) &
@@ -1002,8 +1003,6 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
                }
                ip6_rt_put(rt);
        }
-        t->hlen = addend;
 }
 static int ip6gre_tnl_change(struct ip6_tnl *t,
@@ -1173,9 +1172,8 @@ done:
 static int ip6gre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 {
-        struct ip6_tnl *tunnel = netdev_priv(dev);
        if (new_mtu < 68 ||
-            new_mtu > 0xFFF8 - dev->hard_header_len - tunnel->hlen)
+            new_mtu > 0xFFF8 - dev->hard_header_len)
                return -EINVAL;
        dev->mtu = new_mtu;
        return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a54c45ce4a48..91fb4e8212f5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -105,7 +105,7 @@ static int ip6_finish_output2(struct sk_buff *skb)
        }
        rcu_read_lock_bh();
-        nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
+        nexthop = rt6_nexthop((struct rt6_info *)dst);
        neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
        if (unlikely(!neigh))
                neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
@@ -874,7 +874,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
         */
        rt = (struct rt6_info *) *dst;
        rcu_read_lock_bh();
-        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt, &fl6->daddr));
+        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
        err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
        rcu_read_unlock_bh();
@@ -1008,6 +1008,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
 {
        struct sk_buff *skb;
+        struct frag_hdr fhdr;
        int err;
        /* There is support for UDP large send offload by network
@@ -1015,8 +1016,6 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         * udp datagram
         */
        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
-                struct frag_hdr fhdr;
                skb = sock_alloc_send_skb(sk,
                        hh_len + fragheaderlen + transhdrlen + 20,
                        (flags & MSG_DONTWAIT), &err);
@@ -1036,20 +1035,24 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                skb->transport_header = skb->network_header + fragheaderlen;
                skb->protocol = htons(ETH_P_IPV6);
-                skb->ip_summed = CHECKSUM_PARTIAL;
                skb->csum = 0;
-                /* Specify the length of each IPv6 datagram fragment.
-                 * It has to be a multiple of 8.
-                 */
-                skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
-                                             sizeof(struct frag_hdr)) & ~7;
-                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
-                ipv6_select_ident(&fhdr, rt);
-                skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                __skb_queue_tail(&sk->sk_write_queue, skb);
+        } else if (skb_is_gso(skb)) {
+                goto append;
        }
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        /* Specify the length of each IPv6 datagram fragment.
+         * It has to be a multiple of 8.
+         */
+        skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
+                                     sizeof(struct frag_hdr)) & ~7;
+        skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+        ipv6_select_ident(&fhdr, rt);
+        skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
+append:
        return skb_append_datato_frags(sk, skb, getfrag, from,
                                       (length - transhdrlen));
 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a791552e0422..583b77e2f69b 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1430,9 +1430,17 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 static int
 ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if (new_mtu < IPV6_MIN_MTU) {
+        struct ip6_tnl *tnl = netdev_priv(dev);
-                return -EINVAL;
+        if (tnl->parms.proto == IPPROTO_IPIP) {
+                if (new_mtu < 68)
+                        return -EINVAL;
+        } else {
+                if (new_mtu < IPV6_MIN_MTU)
+                        return -EINVAL;
        }
+        if (new_mtu > 0xFFF8 - dev->hard_header_len)
+                return -EINVAL;
        dev->mtu = new_mtu;
        return 0;
 }
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 5636a912074a..ce507d9e1c90 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -64,8 +64,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                (struct ip_comp_hdr *)(skb->data + offset);
        struct xfrm_state *x;
-        if (type != ICMPV6_DEST_UNREACH &&
+        if (type != ICMPV6_PKT_TOOBIG &&
-            type != ICMPV6_PKT_TOOBIG &&
            type != NDISC_REDIRECT)
                return;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 44400c216dc6..710238f58aa9 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -349,6 +349,11 @@ ip6t_do_table(struct sk_buff *skb,
        local_bh_disable();
        addend = xt_write_recseq_begin();
        private = table->private;
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
        cpu        = smp_processor_id();
        table_base = private->entries[cpu];
        jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c979dd96d82a..04e17b3309fb 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -476,6 +476,24 @@ out:
 }
 #ifdef CONFIG_IPV6_ROUTER_PREF
+struct __rt6_probe_work {
+        struct work_struct work;
+        struct in6_addr target;
+        struct net_device *dev;
+};
+static void rt6_probe_deferred(struct work_struct *w)
+{
+        struct in6_addr mcaddr;
+        struct __rt6_probe_work *work =
+                container_of(w, struct __rt6_probe_work, work);
+        addrconf_addr_solict_mult(&work->target, &mcaddr);
+        ndisc_send_ns(work->dev, NULL, &work->target, &mcaddr, NULL);
+        dev_put(work->dev);
+        kfree(w);
+}
 static void rt6_probe(struct rt6_info *rt)
 {
        struct neighbour *neigh;
@@ -499,17 +517,23 @@ static void rt6_probe(struct rt6_info *rt)
        if (!neigh ||
            time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
-                struct in6_addr mcaddr;
+                struct __rt6_probe_work *work;
-                struct in6_addr *target;
+                work = kmalloc(sizeof(*work), GFP_ATOMIC);
-                if (neigh) {
+                if (neigh && work)
                        neigh->updated = jiffies;
+                if (neigh)
                        write_unlock(&neigh->lock);
-                }
-                target = (struct in6_addr *)&rt->rt6i_gateway;
+                if (work) {
-                addrconf_addr_solict_mult(target, &mcaddr);
+                        INIT_WORK(&work->work, rt6_probe_deferred);
-                ndisc_send_ns(rt->dst.dev, NULL, target, &mcaddr, NULL);
+                        work->target = rt->rt6i_gateway;
+                        dev_hold(rt->dst.dev);
+                        work->dev = rt->dst.dev;
+                        schedule_work(&work->work);
+                }
        } else {
 out:
                write_unlock(&neigh->lock);
@@ -851,7 +875,6 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
                        if (ort->rt6i_dst.plen != 128 &&
                            ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
                                rt->rt6i_flags |= RTF_ANYCAST;
-                        rt->rt6i_gateway = *daddr;
                }
                rt->rt6i_flags |= RTF_CACHE;
@@ -1064,10 +1087,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
        if (rt->rt6i_genid != rt_genid_ipv6(dev_net(rt->dst.dev)))
                return NULL;
-        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie))
-                return dst;
+                return NULL;
-        return NULL;
+        if (rt6_check_expired(rt))
+                return NULL;
+        return dst;
 }
 static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
@@ -1338,6 +1364,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
        rt->dst.flags |= DST_HOST;
        rt->dst.output  = ip6_output;
        atomic_set(&rt->dst.__refcnt, 1);
+        rt->rt6i_gateway  = fl6->daddr;
        rt->rt6i_dst.addr = fl6->daddr;
        rt->rt6i_dst.plen = 128;
        rt->rt6i_idev     = idev;
@@ -1873,7 +1900,10 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                        in6_dev_hold(rt->rt6i_idev);
                rt->dst.lastuse = jiffies;
-                rt->rt6i_gateway = ort->rt6i_gateway;
+                if (ort->rt6i_flags & RTF_GATEWAY)
+                        rt->rt6i_gateway = ort->rt6i_gateway;
+                else
+                        rt->rt6i_gateway = *dest;
                rt->rt6i_flags = ort->rt6i_flags;
                if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
                    (RTF_DEFAULT | RTF_ADDRCONF))
@@ -2160,6 +2190,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
        else
                rt->rt6i_flags |= RTF_LOCAL;
+        rt->rt6i_gateway  = *addr;
        rt->rt6i_dst.addr = *addr;
        rt->rt6i_dst.plen = 128;
        rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 72b7eaaf3ca0..18786098fd41 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1225,9 +1225,6 @@ do_udp_sendmsg:
        if (tclass < 0)
                tclass = np->tclass;
-        if (dontfrag < 0)
-                dontfrag = np->dontfrag;
        if (msg->msg_flags&MSG_CONFIRM)
                goto do_confirm;
 back_from_confirm:
@@ -1246,6 +1243,8 @@ back_from_confirm:
        up->pending = AF_INET6;
 do_append_data:
+        if (dontfrag < 0)
+                dontfrag = np->dontfrag;
        up->len += ulen;
        getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
        err = ip6_append_data(sk, getfrag, msg->msg_iov, ulen,
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 23ed03d786c8..5f8e128c512d 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -135,9 +135,14 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
        struct ipv6_opt_hdr *exthdr;
        const unsigned char *nh = skb_network_header(skb);
        u8 nexthdr = nh[IP6CB(skb)->nhoff];
+        int oif = 0;
+        if (skb_dst(skb))
+                oif = skb_dst(skb)->dev->ifindex;
        memset(fl6, 0, sizeof(struct flowi6));
        fl6->flowi6_mark = skb->mark;
+        fl6->flowi6_oif = reverse ? skb->skb_iif : oif;
        fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
        fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
@@ -284,7 +289,7 @@ static struct dst_ops xfrm6_dst_ops = {
        .destroy =              xfrm6_dst_destroy,
        .ifdown =               xfrm6_dst_ifdown,
        .local_out =            __ip6_local_out,
-        .gc_thresh =            1024,
+        .gc_thresh =            32768,
 };
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9d585370c5b4..911ef03bf8fb 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1098,7 +1098,8 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
        x->id.proto = proto;
        x->id.spi = sa->sadb_sa_spi;
-        x->props.replay_window = sa->sadb_sa_replay;
+        x->props.replay_window = min_t(unsigned int, sa->sadb_sa_replay,
+                                        (sizeof(x->replay.bitmap) * 8));
        if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN)
                x->props.flags |= XFRM_STATE_NOECN;
        if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index feae495a0a30..b076e8309bc2 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -115,6 +115,11 @@ struct l2tp_net {
 static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
+static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
+{
+        return sk->sk_user_data;
+}
 static inline struct l2tp_net *l2tp_pernet(struct net *net)
 {
        BUG_ON(!net);
@@ -504,7 +509,7 @@ static inline int l2tp_verify_udp_checksum(struct sock *sk,
                return 0;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (sk->sk_family == PF_INET6) {
+        if (sk->sk_family == PF_INET6 && !l2tp_tunnel(sk)->v4mapped) {
                if (!uh->check) {
                        LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n");
                        return 1;
@@ -1128,7 +1133,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
        /* Queue the packet to IP for output */
        skb->local_df = 1;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (skb->sk->sk_family == PF_INET6)
+        if (skb->sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                error = inet6_csk_xmit(skb, NULL);
        else
 #endif
@@ -1255,7 +1260,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                /* Calculate UDP checksum if configured to do so */
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6)
+                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                        l2tp_xmit_ipv6_csum(sk, skb, udp_len);
                else
 #endif
@@ -1304,10 +1309,9 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
 */
 static void l2tp_tunnel_destruct(struct sock *sk)
 {
-        struct l2tp_tunnel *tunnel;
+        struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
        struct l2tp_net *pn;
-        tunnel = sk->sk_user_data;
        if (tunnel == NULL)
                goto end;
@@ -1675,7 +1679,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
        }
        /* Check if this socket has already been prepped */
-        tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
+        tunnel = l2tp_tunnel(sk);
        if (tunnel != NULL) {
                /* This socket has already been prepped */
                err = -EBUSY;
@@ -1704,6 +1708,24 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
        if (cfg != NULL)
                tunnel->debug = cfg->debug;
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == PF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                if (ipv6_addr_v4mapped(&np->saddr) &&
+                    ipv6_addr_v4mapped(&np->daddr)) {
+                        struct inet_sock *inet = inet_sk(sk);
+                        tunnel->v4mapped = true;
+                        inet->inet_saddr = np->saddr.s6_addr32[3];
+                        inet->inet_rcv_saddr = np->rcv_saddr.s6_addr32[3];
+                        inet->inet_daddr = np->daddr.s6_addr32[3];
+                } else {
+                        tunnel->v4mapped = false;
+                }
+        }
+#endif
        /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
        tunnel->encap = encap;
        if (encap == L2TP_ENCAPTYPE_UDP) {
@@ -1712,7 +1734,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
                udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy;
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6)
+                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                        udpv6_encap_enable();
                else
 #endif
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 66a559b104b6..6f251cbc2ed7 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -194,6 +194,9 @@ struct l2tp_tunnel {
        struct sock             *sock;          /* Parent socket */
        int                     fd;             /* Parent fd, if tunnel socket
                                                 * was created by userspace */
+#if IS_ENABLED(CONFIG_IPV6)
+        bool                    v4mapped;
+#endif
        struct work_struct      del_work;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 5ebee2ded9e9..8c46b271064a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -353,7 +353,9 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                goto error_put_sess_tun;
        }
+        local_bh_disable();
        l2tp_xmit_skb(session, skb, session->hdr_len);
+        local_bh_enable();
        sock_put(ps->tunnel_sock);
        sock_put(sk);
@@ -422,7 +424,9 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        skb->data[0] = ppph[0];
        skb->data[1] = ppph[1];
+        local_bh_disable();
        l2tp_xmit_skb(session, skb, session->hdr_len);
+        local_bh_enable();
        sock_put(sk_tun);
        sock_put(sk);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 2e7855a1b10d..629dee7ec9bf 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3518,7 +3518,7 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
                return -EINVAL;
        }
        band = chanctx_conf->def.chan->band;
-        sta = sta_info_get(sdata, peer);
+        sta = sta_info_get_bss(sdata, peer);
        if (sta) {
                qos = test_sta_flag(sta, WLAN_STA_WME);
        } else {
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b6186517ec56..611abfcfb5eb 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -893,6 +893,8 @@ struct tpt_led_trigger {
 *      that the scan completed.
 * @SCAN_ABORTED: Set for our scan work function when the driver reported
 *      a scan complete for an aborted scan.
+ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being
+ *      cancelled.
 */
 enum {
        SCAN_SW_SCANNING,
@@ -900,6 +902,7 @@ enum {
        SCAN_ONCHANNEL_SCANNING,
        SCAN_COMPLETED,
        SCAN_ABORTED,
+        SCAN_HW_CANCELLED,
 };
 /**
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index acd1f71adc03..0c2a29484c07 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -394,6 +394,8 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                if (started)
                        ieee80211_start_next_roc(local);
+                else if (list_empty(&local->roc_list))
+                        ieee80211_run_deferred_scan(local);
        }
 out_unlock:
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 54395d7583ba..674eac1f996c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3056,6 +3056,9 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
        case NL80211_IFTYPE_ADHOC:
                if (!bssid)
                        return 0;
+                if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
+                    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
+                        return 0;
                if (ieee80211_is_beacon(hdr->frame_control)) {
                        return 1;
                } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 08afe74b98f4..d2d17a449224 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -238,6 +238,9 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
        enum ieee80211_band band;
        int i, ielen, n_chans;
+        if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
+                return false;
        do {
                if (local->hw_scan_band == IEEE80211_NUM_BANDS)
                        return false;
@@ -940,7 +943,23 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
        if (!local->scan_req)
                goto out;
+        /*
+         * We have a scan running and the driver already reported completion,
+         * but the worker hasn't run yet or is stuck on the mutex - mark it as
+         * cancelled.
+         */
+        if (test_bit(SCAN_HW_SCANNING, &local->scanning) &&
+            test_bit(SCAN_COMPLETED, &local->scanning)) {
+                set_bit(SCAN_HW_CANCELLED, &local->scanning);
+                goto out;
+        }
        if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
+                /*
+                 * Make sure that __ieee80211_scan_completed doesn't trigger a
+                 * scan on another band.
+                 */
+                set_bit(SCAN_HW_CANCELLED, &local->scanning);
                if (local->ops->cancel_hw_scan)
                        drv_cancel_hw_scan(local,
                                rcu_dereference_protected(local->scan_sdata,
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 368837fe3b80..78dc2e99027e 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
        struct ieee80211_local *local = sta->local;
        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                sta->last_rx = jiffies;
        if (ieee80211_is_data_qos(mgmt->frame_control)) {
                struct ieee80211_hdr *hdr = (void *) skb->data;
                u8 *qc = ieee80211_get_qos_ctl(hdr);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3456c0486b48..70b5a05c0a4e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1120,7 +1120,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                tx->sta = rcu_dereference(sdata->u.vlan.sta);
                if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                        return TX_DROP;
-        } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+        } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
+                                  IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
                   tx->sdata->control_port_protocol == tx->skb->protocol) {
                tx->sta = sta_info_get_bss(sdata, hdr->addr1);
        }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index e1b34a18b243..69e4ef5348a0 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2103,7 +2103,7 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_supported_band *sband;
-        int rate, skip, shift;
+        int rate, shift;
        u8 i, exrates, *pos;
        u32 basic_rates = sdata->vif.bss_conf.basic_rates;
        u32 rate_flags;
@@ -2131,14 +2131,11 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
                pos = skb_put(skb, exrates + 2);
                *pos++ = WLAN_EID_EXT_SUPP_RATES;
                *pos++ = exrates;
-                skip = 0;
                for (i = 8; i < sband->n_bitrates; i++) {
                        u8 basic = 0;
                        if ((rate_flags & sband->bitrates[i].flags)
                            != rate_flags)
                                continue;
-                        if (skip++ < 8)
-                                continue;
                        if (need_basic && basic_rates & BIT(i))
                                basic = 0x80;
                        rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
@@ -2241,6 +2238,10 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
        }
        rate = cfg80211_calculate_bitrate(&ri);
+        if (WARN_ONCE(!rate,
+                      "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n",
+                      status->flag, status->rate_idx, status->vht_nss))
+                return 0;
        /* rewind from end of MPDU */
        if (status->flag & RX_FLAG_MACTIME_END)
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index bdebd03bc8cd..70866d192efc 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -778,8 +778,8 @@ static int callforward_do_filter(const union nf_inet_addr *src,
                                   flowi6_to_flowi(&fl1), false)) {
                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
                                           flowi6_to_flowi(&fl2), false)) {
-                                if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
+                                if (ipv6_addr_equal(rt6_nexthop(rt1),
-                                            sizeof(rt1->rt6i_gateway)) &&
+                                                    rt6_nexthop(rt2)) &&
                                    rt1->dst.dev == rt2->dst.dev)
                                        ret = 1;
                                dst_release(&rt2->dst);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8b03028cca69..227aa11e8409 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -845,8 +845,13 @@ xt_replace_table(struct xt_table *table,
                return NULL;
        }
-        table->private = newinfo;
        newinfo->initial_entries = private->initial_entries;
+        /*
+         * Ensure contents of newinfo are visible before assigning to
+         * private.
+         */
+        smp_wmb();
+        table->private = newinfo;
        /*
         * Even though table entries have now been swapped, other CPU's
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index 1e2fae32f81b..ed00fef58996 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -147,6 +147,7 @@ nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
 {
        const struct xt_NFQ_info_v3 *info = par->targinfo;
        u32 queue = info->queuenum;
+        int ret;
        if (info->queues_total > 1) {
                if (info->flags & NFQ_FLAG_CPU_FANOUT) {
@@ -157,7 +158,11 @@ nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
                        queue = nfqueue_hash(skb, par);
        }
-        return NF_QUEUE_NR(queue);
+        ret = NF_QUEUE_NR(queue);
+        if (info->flags & NFQ_FLAG_BYPASS)
+                ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
+        return ret;
 }
 static struct xt_target nfqueue_tg_reg[] __read_mostly = {
diff --git a/net/openvswitch/dp_notify.c b/net/openvswitch/dp_notify.c
index c3235675f359..5c2dab276109 100644
--- a/net/openvswitch/dp_notify.c
+++ b/net/openvswitch/dp_notify.c
@@ -65,8 +65,7 @@ void ovs_dp_notify_wq(struct work_struct *work)
                                        continue;
                                netdev_vport = netdev_vport_priv(vport);
-                                if (netdev_vport->dev->reg_state == NETREG_UNREGISTERED ||
+                                if (!(netdev_vport->dev->priv_flags & IFF_OVS_DATAPATH))
-                                    netdev_vport->dev->reg_state == NETREG_UNREGISTERING)
                                        dp_detach_port_notify(vport);
                        }
                }
@@ -88,6 +87,10 @@ static int dp_device_event(struct notifier_block *unused, unsigned long event,
                return NOTIFY_DONE;
        if (event == NETDEV_UNREGISTER) {
+                /* upper_dev_unlink and decrement promisc immediately */
+                ovs_netdev_detach_dev(vport);
+                /* schedule vport destroy, dev_put and genl notification */
                ovs_net = net_generic(dev_net(dev), ovs_net_id);
                queue_work(system_wq, &ovs_net->dp_notify_work);
        }
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 09d93c13cfd6..d21f77d875ba 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -150,15 +150,25 @@ static void free_port_rcu(struct rcu_head *rcu)
        ovs_vport_free(vport_from_priv(netdev_vport));
 }
-static void netdev_destroy(struct vport *vport)
+void ovs_netdev_detach_dev(struct vport *vport)
 {
        struct netdev_vport *netdev_vport = netdev_vport_priv(vport);
-        rtnl_lock();
+        ASSERT_RTNL();
        netdev_vport->dev->priv_flags &= ~IFF_OVS_DATAPATH;
        netdev_rx_handler_unregister(netdev_vport->dev);
-        netdev_upper_dev_unlink(netdev_vport->dev, get_dpdev(vport->dp));
+        netdev_upper_dev_unlink(netdev_vport->dev,
+                                netdev_master_upper_dev_get(netdev_vport->dev));
        dev_set_promiscuity(netdev_vport->dev, -1);
+}
+static void netdev_destroy(struct vport *vport)
+{
+        struct netdev_vport *netdev_vport = netdev_vport_priv(vport);
+        rtnl_lock();
+        if (netdev_vport->dev->priv_flags & IFF_OVS_DATAPATH)
+                ovs_netdev_detach_dev(vport);
        rtnl_unlock();
        call_rcu(&netdev_vport->rcu, free_port_rcu);
diff --git a/net/openvswitch/vport-netdev.h b/net/openvswitch/vport-netdev.h
index dd298b5c5cdb..8df01c1127e5 100644
--- a/net/openvswitch/vport-netdev.h
+++ b/net/openvswitch/vport-netdev.h
@@ -39,5 +39,6 @@ netdev_vport_priv(const struct vport *vport)
 }
 const char *ovs_netdev_get_name(const struct vport *);
+void ovs_netdev_detach_dev(struct vport *);
 #endif /* vport_netdev.h */
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index a2fef8b10b96..fdc041c57853 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -255,6 +255,7 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
                                     f->socket_hash != sk->sk_hash)) {
                                f->credit = q->initial_quantum;
                                f->socket_hash = sk->sk_hash;
+                                f->time_next_packet = 0ULL;
                        }
                        return f;
                }
@@ -472,20 +473,16 @@ begin:
        if (f->credit > 0 || !q->rate_enable)
                goto out;
-        if (skb->sk && skb->sk->sk_state != TCP_TIME_WAIT) {
+        rate = q->flow_max_rate;
-                rate = skb->sk->sk_pacing_rate ?: q->flow_default_rate;
+        if (skb->sk && skb->sk->sk_state != TCP_TIME_WAIT)
+                rate = min(skb->sk->sk_pacing_rate, rate);
-                rate = min(rate, q->flow_max_rate);
+        if (rate != ~0U) {
-        } else {
-                rate = q->flow_max_rate;
-                if (rate == ~0U)
-                        goto out;
-        }
-        if (rate) {
                u32 plen = max(qdisc_pkt_len(skb), q->quantum);
                u64 len = (u64)plen * NSEC_PER_SEC;
-                do_div(len, rate);
+                if (likely(rate))
+                        do_div(len, rate);
                /* Since socket rate can change later,
                 * clamp the delay to 125 ms.
                 * TODO: maybe segment the too big skb, as in commit
@@ -656,7 +653,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                q->quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
        if (tb[TCA_FQ_INITIAL_QUANTUM])
-                q->quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
+                q->initial_quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
        if (tb[TCA_FQ_FLOW_DEFAULT_RATE])
                q->flow_default_rate = nla_get_u32(tb[TCA_FQ_FLOW_DEFAULT_RATE]);
@@ -735,12 +732,14 @@ static int fq_dump(struct Qdisc *sch, struct sk_buff *skb)
        if (opts == NULL)
                goto nla_put_failure;
+        /* TCA_FQ_FLOW_DEFAULT_RATE is not used anymore,
+         * do not bother giving its value
+         */
        if (nla_put_u32(skb, TCA_FQ_PLIMIT, sch->limit) ||
            nla_put_u32(skb, TCA_FQ_FLOW_PLIMIT, q->flow_plimit) ||
            nla_put_u32(skb, TCA_FQ_QUANTUM, q->quantum) ||
            nla_put_u32(skb, TCA_FQ_INITIAL_QUANTUM, q->initial_quantum) ||
            nla_put_u32(skb, TCA_FQ_RATE_ENABLE, q->rate_enable) ||
-            nla_put_u32(skb, TCA_FQ_FLOW_DEFAULT_RATE, q->flow_default_rate) ||
            nla_put_u32(skb, TCA_FQ_FLOW_MAX_RATE, q->flow_max_rate) ||
            nla_put_u32(skb, TCA_FQ_BUCKETS_LOG, q->fq_trees_log))
                goto nla_put_failure;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a6d788d45216..b87e83d07478 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -358,6 +358,21 @@ static psched_time_t packet_len_2_sched_time(unsigned int len, struct netem_sche
        return PSCHED_NS2TICKS(ticks);
 }
+static void tfifo_reset(struct Qdisc *sch)
+{
+        struct netem_sched_data *q = qdisc_priv(sch);
+        struct rb_node *p;
+        while ((p = rb_first(&q->t_root))) {
+                struct sk_buff *skb = netem_rb_to_skb(p);
+                rb_erase(p, &q->t_root);
+                skb->next = NULL;
+                skb->prev = NULL;
+                kfree_skb(skb);
+        }
+}
 static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
 {
        struct netem_sched_data *q = qdisc_priv(sch);
@@ -520,6 +535,7 @@ static unsigned int netem_drop(struct Qdisc *sch)
                        skb->next = NULL;
                        skb->prev = NULL;
                        len = qdisc_pkt_len(skb);
+                        sch->qstats.backlog -= len;
                        kfree_skb(skb);
                }
        }
@@ -609,6 +625,7 @@ static void netem_reset(struct Qdisc *sch)
        struct netem_sched_data *q = qdisc_priv(sch);
        qdisc_reset_queue(sch);
+        tfifo_reset(sch);
        if (q->qdisc)
                qdisc_reset(q->qdisc);
        qdisc_watchdog_cancel(&q->watchdog);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index e7b2d4fe2b6a..96a55910262c 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -279,7 +279,9 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                sctp_v6_to_addr(&dst_saddr, &fl6->saddr, htons(bp->port));
                rcu_read_lock();
                list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                        if (!laddr->valid || (laddr->state != SCTP_ADDR_SRC))
+                        if (!laddr->valid || laddr->state == SCTP_ADDR_DEL ||
+                            (laddr->state != SCTP_ADDR_SRC &&
+                             !asoc->src_out_of_asoc_ok))
                                continue;
                        /* Do not compare against v4 addrs */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 0ac3a65daccb..319137340d15 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -536,7 +536,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
         */
        if (!sctp_checksum_disable) {
-                if (!(dst->dev->features & NETIF_F_SCTP_CSUM)) {
+                if (!(dst->dev->features & NETIF_F_SCTP_CSUM) ||
+                    (dst_xfrm(dst) != NULL) || packet->ipfragok) {
                        __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
                        /* 3) Put the resultant value into the checksum field in the
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 666c66842799..1a6eef39ab2f 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -860,7 +860,6 @@ static void sctp_cmd_delete_tcb(sctp_cmd_seq_t *cmds,
            (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
                return;
-        BUG_ON(asoc->peer.primary_path == NULL);
        sctp_unhash_established(asoc);
        sctp_association_free(asoc);
 }
diff --git a/net/socket.c b/net/socket.c
index ebed4b68f768..c226aceee65b 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1964,6 +1964,16 @@ struct used_address {
        unsigned int name_len;
 };
+static int copy_msghdr_from_user(struct msghdr *kmsg,
+                                 struct msghdr __user *umsg)
+{
+        if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
+                return -EFAULT;
+        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+                return -EINVAL;
+        return 0;
+}
 static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
                         struct msghdr *msg_sys, unsigned int flags,
                         struct used_address *used_address)
@@ -1982,8 +1992,11 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
        if (MSG_CMSG_COMPAT & flags) {
                if (get_compat_msghdr(msg_sys, msg_compat))
                        return -EFAULT;
-        } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
+        } else {
-                return -EFAULT;
+                err = copy_msghdr_from_user(msg_sys, msg);
+                if (err)
+                        return err;
+        }
        if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                err = -EMSGSIZE;
@@ -2191,8 +2204,11 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
        if (MSG_CMSG_COMPAT & flags) {
                if (get_compat_msghdr(msg_sys, msg_compat))
                        return -EFAULT;
-        } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
+        } else {
-                return -EFAULT;
+                err = copy_msghdr_from_user(msg_sys, msg);
+                if (err)
+                        return err;
+        }
        if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                err = -EMSGSIZE;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 86de99ad2976..c1f403bed683 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1246,6 +1246,15 @@ static int unix_socketpair(struct socket *socka, struct socket *sockb)
        return 0;
 }
+static void unix_sock_inherit_flags(const struct socket *old,
+                                    struct socket *new)
+{
+        if (test_bit(SOCK_PASSCRED, &old->flags))
+                set_bit(SOCK_PASSCRED, &new->flags);
+        if (test_bit(SOCK_PASSSEC, &old->flags))
+                set_bit(SOCK_PASSSEC, &new->flags);
+}
 static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
 {
        struct sock *sk = sock->sk;
@@ -1280,6 +1289,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
        /* attach accepted sock to socket */
        unix_state_lock(tsk);
        newsock->state = SS_CONNECTED;
+        unix_sock_inherit_flags(sock, newsock);
        sock_graft(tsk, newsock);
        unix_state_unlock(tsk);
        return 0;
diff --git a/net/unix/diag.c b/net/unix/diag.c
index d591091603bf..86fa0f3b2caf 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -124,6 +124,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
        rep->udiag_family = AF_UNIX;
        rep->udiag_type = sk->sk_type;
        rep->udiag_state = sk->sk_state;
+        rep->pad = 0;
        rep->udiag_ino = sk_ino;
        sock_diag_save_cookie(sk, rep->udiag_cookie);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 67153964aad2..aff959e5a1b3 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -566,18 +566,13 @@ int wiphy_register(struct wiphy *wiphy)
        /* check and set up bitrates */
        ieee80211_set_bitrate_flags(wiphy);
+        rtnl_lock();
        res = device_add(&rdev->wiphy.dev);
-        if (res)
-                return res;
-        res = rfkill_register(rdev->rfkill);
        if (res) {
-                device_del(&rdev->wiphy.dev);
+                rtnl_unlock();
                return res;
        }
-        rtnl_lock();
        /* set up regulatory info */
        wiphy_regulatory_register(wiphy);
@@ -606,6 +601,15 @@ int wiphy_register(struct wiphy *wiphy)
        rdev->wiphy.registered = true;
        rtnl_unlock();
+        res = rfkill_register(rdev->rfkill);
+        if (res) {
+                rfkill_destroy(rdev->rfkill);
+                rdev->rfkill = NULL;
+                wiphy_unregister(&rdev->wiphy);
+                return res;
+        }
        return 0;
 }
 EXPORT_SYMBOL(wiphy_register);
@@ -640,7 +644,8 @@ void wiphy_unregister(struct wiphy *wiphy)
                rtnl_unlock();
                __count == 0; }));
-        rfkill_unregister(rdev->rfkill);
+        if (rdev->rfkill)
+                rfkill_unregister(rdev->rfkill);
        rtnl_lock();
        rdev->wiphy.registered = false;
@@ -953,8 +958,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
        case NETDEV_PRE_UP:
                if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
                        return notifier_from_errno(-EOPNOTSUPP);
-                if (rfkill_blocked(rdev->rfkill))
-                        return notifier_from_errno(-ERFKILL);
                ret = cfg80211_can_add_interface(rdev, wdev->iftype);
                if (ret)
                        return notifier_from_errno(ret);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 9ad43c619c54..3159e9c284c5 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -411,6 +411,9 @@ static inline int
 cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
                           enum nl80211_iftype iftype)
 {
+        if (rfkill_blocked(rdev->rfkill))
+                return -ERFKILL;
        return cfg80211_can_change_interface(rdev, NULL, iftype);
 }
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 39bff7d36768..403fe29c024d 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -263,6 +263,8 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                if (chan->flags & IEEE80211_CHAN_DISABLED)
                                        continue;
                                wdev->wext.ibss.chandef.chan = chan;
+                                wdev->wext.ibss.chandef.center_freq1 =
+                                        chan->center_freq;
                                break;
                        }
@@ -347,6 +349,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
        if (chan) {
                wdev->wext.ibss.chandef.chan = chan;
                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                wdev->wext.ibss.chandef.center_freq1 = freq;
                wdev->wext.ibss.channel_fixed = true;
        } else {
                /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index af8d84a4a5b2..626dc3b5fd8d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2421,7 +2421,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                change = true;
        }
-        if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                return -EOPNOTSUPP;
@@ -2483,7 +2483,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                                  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                  &flags);
-        if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                return -EOPNOTSUPP;
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index 7d604c06c3dc..a271c27fac77 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init(
        struct ieee80211_radiotap_header *radiotap_header,
        int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
+        /* check the radiotap header can actually be present */
+        if (max_length < sizeof(struct ieee80211_radiotap_header))
+                return -EINVAL;
        /* Linux only supports version 0 radiotap format */
        if (radiotap_header->it_version)
                return -EINVAL;
@@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init(
                         */
                        if ((unsigned long)iterator->_arg -
-                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_rtheader +
+                            sizeof(uint32_t) >
                            (unsigned long)iterator->_max_length)
                                return -EINVAL;
                }
diff --git a/net/x25/Kconfig b/net/x25/Kconfig
index c959312c45e3..e2fa133f9fba 100644
--- a/net/x25/Kconfig
+++ b/net/x25/Kconfig
@@ -16,8 +16,8 @@ config X25
          if you want that) and the lower level data link layer protocol LAPB
          (say Y to "LAPB Data Link Driver" below if you want that).
-          You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
+          You can read more about X.25 at <http://www.sangoma.com/tutorials/x25/> and
-          <http://www.cisco.com/univercd/cc/td/doc/product/software/ios11/cbook/cx25.htm>.
+          <http://docwiki.cisco.com/wiki/X.25>.
          Information about X.25 for Linux is contained in the files
          <file:Documentation/networking/x25.txt> and
          <file:Documentation/networking/x25-iface.txt>.
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index 2906d520eea7..3be02b680268 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -141,14 +141,14 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
        const int plen = skb->len;
        int dlen = IPCOMP_SCRATCH_SIZE;
        u8 *start = skb->data;
-        const int cpu = get_cpu();
+        struct crypto_comp *tfm;
-        u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
+        u8 *scratch;
-        struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
        int err;
        local_bh_disable();
+        scratch = *this_cpu_ptr(ipcomp_scratches);
+        tfm = *this_cpu_ptr(ipcd->tfms);
        err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-        local_bh_enable();
        if (err)
                goto out;
@@ -158,13 +158,13 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
        }
        memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
-        put_cpu();
+        local_bh_enable();
        pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
        return 0;
 out:
-        put_cpu();
+        local_bh_enable();
        return err;
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index ed38d5d81f9e..76e1873811d4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -334,7 +334,8 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
        atomic_inc(&policy->genid);
-        del_timer(&policy->polq.hold_timer);
+        if (del_timer(&policy->polq.hold_timer))
+                xfrm_pol_put(policy);
        xfrm_queue_purge(&policy->polq.hold_queue);
        if (del_timer(&policy->timer))
@@ -589,7 +590,8 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
        spin_lock_bh(&pq->hold_queue.lock);
        skb_queue_splice_init(&pq->hold_queue, &list);
-        del_timer(&pq->hold_timer);
+        if (del_timer(&pq->hold_timer))
+                xfrm_pol_put(old);
        spin_unlock_bh(&pq->hold_queue.lock);
        if (skb_queue_empty(&list))
@@ -600,7 +602,8 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
        spin_lock_bh(&pq->hold_queue.lock);
        skb_queue_splice(&list, &pq->hold_queue);
        pq->timeout = XFRM_QUEUE_TMO_MIN;
-        mod_timer(&pq->hold_timer, jiffies);
+        if (!mod_timer(&pq->hold_timer, jiffies))
+                xfrm_pol_hold(new);
        spin_unlock_bh(&pq->hold_queue.lock);
 }
@@ -1769,6 +1772,10 @@ static void xfrm_policy_queue_process(unsigned long arg)
        spin_lock(&pq->hold_queue.lock);
        skb = skb_peek(&pq->hold_queue);
+        if (!skb) {
+                spin_unlock(&pq->hold_queue.lock);
+                goto out;
+        }
        dst = skb_dst(skb);
        sk = skb->sk;
        xfrm_decode_session(skb, &fl, dst->ops->family);
@@ -1787,8 +1794,9 @@ static void xfrm_policy_queue_process(unsigned long arg)
                        goto purge_queue;
                pq->timeout = pq->timeout << 1;
-                mod_timer(&pq->hold_timer, jiffies + pq->timeout);
+                if (!mod_timer(&pq->hold_timer, jiffies + pq->timeout))
-                return;
+                        xfrm_pol_hold(pol);
+        goto out;
        }
        dst_release(dst);
@@ -1819,11 +1827,14 @@ static void xfrm_policy_queue_process(unsigned long arg)
                err = dst_output(skb);
        }
+out:
+        xfrm_pol_put(pol);
        return;
 purge_queue:
        pq->timeout = 0;
        xfrm_queue_purge(&pq->hold_queue);
+        xfrm_pol_put(pol);
 }
 static int xdst_queue_output(struct sk_buff *skb)
@@ -1831,7 +1842,8 @@ static int xdst_queue_output(struct sk_buff *skb)
        unsigned long sched_next;
        struct dst_entry *dst = skb_dst(skb);
        struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
-        struct xfrm_policy_queue *pq = &xdst->pols[0]->polq;
+        struct xfrm_policy *pol = xdst->pols[0];
+        struct xfrm_policy_queue *pq = &pol->polq;
        if (pq->hold_queue.qlen > XFRM_MAX_QUEUE_LEN) {
                kfree_skb(skb);
@@ -1850,10 +1862,12 @@ static int xdst_queue_output(struct sk_buff *skb)
        if (del_timer(&pq->hold_timer)) {
                if (time_before(pq->hold_timer.expires, sched_next))
                        sched_next = pq->hold_timer.expires;
+                xfrm_pol_put(pol);
        }
        __skb_queue_tail(&pq->hold_queue, skb);
-        mod_timer(&pq->hold_timer, sched_next);
+        if (!mod_timer(&pq->hold_timer, sched_next))
+                xfrm_pol_hold(pol);
        spin_unlock_bh(&pq->hold_queue.lock);
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 8dafe6d3c6e4..dab57daae408 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -61,9 +61,9 @@ static void xfrm_replay_notify(struct xfrm_state *x, int event)
        switch (event) {
        case XFRM_REPLAY_UPDATE:
-                if (x->replay_maxdiff &&
+                if (!x->replay_maxdiff ||
-                    (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
+                    ((x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
-                    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
+                    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))) {
                        if (x->xflags & XFRM_TIME_DEFER)
                                event = XFRM_REPLAY_TIMEOUT;
                        else
@@ -129,8 +129,7 @@ static int xfrm_replay_check(struct xfrm_state *x,
                return 0;
        diff = x->replay.seq - seq;
-        if (diff >= min_t(unsigned int, x->props.replay_window,
+        if (diff >= x->props.replay_window) {
-                          sizeof(x->replay.bitmap) * 8)) {
                x->stats.replay_window++;
                goto err;
        }
@@ -302,9 +301,10 @@ static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
        switch (event) {
        case XFRM_REPLAY_UPDATE:
-                if (x->replay_maxdiff &&
+                if (!x->replay_maxdiff ||
-                    (replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
+                    ((replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
-                    (replay_esn->oseq - preplay_esn->oseq < x->replay_maxdiff)) {
+                    (replay_esn->oseq - preplay_esn->oseq
+                     < x->replay_maxdiff))) {
                        if (x->xflags & XFRM_TIME_DEFER)
                                event = XFRM_REPLAY_TIMEOUT;
                        else
@@ -353,28 +353,30 @@ static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
        switch (event) {
        case XFRM_REPLAY_UPDATE:
-                if (!x->replay_maxdiff)
+                if (x->replay_maxdiff) {
-                        break;
+                        if (replay_esn->seq_hi == preplay_esn->seq_hi)
+                                seq_diff = replay_esn->seq - preplay_esn->seq;
-                if (replay_esn->seq_hi == preplay_esn->seq_hi)
+                        else
-                        seq_diff = replay_esn->seq - preplay_esn->seq;
+                                seq_diff = ~preplay_esn->seq + replay_esn->seq
-                else
+                                           + 1;
-                        seq_diff = ~preplay_esn->seq + replay_esn->seq + 1;
-                if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
-                        oseq_diff = replay_esn->oseq - preplay_esn->oseq;
-                else
-                        oseq_diff = ~preplay_esn->oseq + replay_esn->oseq + 1;
-                if (seq_diff < x->replay_maxdiff &&
-                    oseq_diff < x->replay_maxdiff) {
-                        if (x->xflags & XFRM_TIME_DEFER)
+                        if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
-                                event = XFRM_REPLAY_TIMEOUT;
+                                oseq_diff = replay_esn->oseq
+                                            - preplay_esn->oseq;
                        else
-                                return;
+                                oseq_diff = ~preplay_esn->oseq
+                                            + replay_esn->oseq + 1;
+                        if (seq_diff >= x->replay_maxdiff ||
+                            oseq_diff >= x->replay_maxdiff)
+                                break;
                }
+                if (x->xflags & XFRM_TIME_DEFER)
+                        event = XFRM_REPLAY_TIMEOUT;
+                else
+                        return;
                break;
        case XFRM_REPLAY_TIMEOUT:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 3f565e495ac6..f964d4c00ffb 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -446,7 +446,8 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
        memcpy(&x->sel, &p->sel, sizeof(x->sel));
        memcpy(&x->lft, &p->lft, sizeof(x->lft));
        x->props.mode = p->mode;
-        x->props.replay_window = p->replay_window;
+        x->props.replay_window = min_t(unsigned int, p->replay_window,
+                                        sizeof(x->replay.bitmap) * 8);
        x->props.reqid = p->reqid;
        x->props.family = p->family;
        memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
@@ -1856,7 +1857,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
        if (x->km.state != XFRM_STATE_VALID)
                goto out;
-        err = xfrm_replay_verify_len(x->replay_esn, rp);
+        err = xfrm_replay_verify_len(x->replay_esn, re);
        if (err)
                goto out;
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 487ac6f37ca2..9a11f9f799f4 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -55,6 +55,7 @@ static struct sym_entry *table;
 static unsigned int table_size, table_cnt;
 static int all_symbols = 0;
 static char symbol_prefix_char = '\0';
+static unsigned long long kernel_start_addr = 0;
 int token_profit[0x10000];
@@ -65,7 +66,10 @@ unsigned char best_table_len[256];
 static void usage(void)
 {
-        fprintf(stderr, "Usage: kallsyms [--all-symbols] [--symbol-prefix=<prefix char>] < in.map > out.S\n");
+        fprintf(stderr, "Usage: kallsyms [--all-symbols] "
+                        "[--symbol-prefix=<prefix char>] "
+                        "[--page-offset=<CONFIG_PAGE_OFFSET>] "
+                        "< in.map > out.S\n");
        exit(1);
 }
@@ -194,6 +198,9 @@ static int symbol_valid(struct sym_entry *s)
        int i;
        int offset = 1;
+        if (s->addr < kernel_start_addr)
+                return 0;
        /* skip prefix char */
        if (symbol_prefix_char && *(s->sym + 1) == symbol_prefix_char)
                offset++;
@@ -646,6 +653,9 @@ int main(int argc, char **argv)
                                if ((*p == '"' && *(p+2) == '"') || (*p == '\'' && *(p+2) == '\''))
                                        p++;
                                symbol_prefix_char = *p;
+                        } else if (strncmp(argv[i], "--page-offset=", 14) == 0) {
+                                const char *p = &argv[i][14];
+                                kernel_start_addr = strtoull(p, NULL, 16);
                        } else
                                usage();
                }
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 014994936b1c..32b10f53d0b4 100644
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -82,6 +82,8 @@ kallsyms()
                kallsymopt="${kallsymopt} --all-symbols"
        fi
+        kallsymopt="${kallsymopt} --page-offset=$CONFIG_PAGE_OFFSET"
        local aflags="${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL}               \
                      ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS}"
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 17f45e8aa89c..e1e9e0c999fe 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -49,6 +49,8 @@ static struct snd_pcm *snd_pcm_get(struct snd_card *card, int device)
        struct snd_pcm *pcm;
        list_for_each_entry(pcm, &snd_pcm_devices, list) {
+                if (pcm->internal)
+                        continue;
                if (pcm->card == card && pcm->device == device)
                        return pcm;
        }
@@ -60,6 +62,8 @@ static int snd_pcm_next(struct snd_card *card, int device)
        struct snd_pcm *pcm;
        list_for_each_entry(pcm, &snd_pcm_devices, list) {
+                if (pcm->internal)
+                        continue;
                if (pcm->card == card && pcm->device > device)
                        return pcm->device;
                else if (pcm->card->number > card->number)
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 5b6c4e3c92ca..748c6a941963 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -4864,8 +4864,8 @@ static void hda_power_work(struct work_struct *work)
        spin_unlock(&codec->power_lock);
        state = hda_call_codec_suspend(codec, true);
-        codec->pm_down_notified = 0;
+        if (!codec->pm_down_notified &&
-        if (!bus->power_keep_link_on && (state & AC_PWRST_CLK_STOP_OK)) {
+            !bus->power_keep_link_on && (state & AC_PWRST_CLK_STOP_OK)) {
                codec->pm_down_notified = 1;
                hda_call_pm_notify(bus, false);
        }
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 26ad4f0aade3..b7c89dff7066 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -4475,9 +4475,11 @@ int snd_hda_gen_build_controls(struct hda_codec *codec)
                                            true, &spec->vmaster_mute.sw_kctl);
                if (err < 0)
                        return err;
-                if (spec->vmaster_mute.hook)
+                if (spec->vmaster_mute.hook) {
                        snd_hda_add_vmaster_hook(codec, &spec->vmaster_mute,
                                                 spec->vmaster_mute_enum);
+                        snd_hda_sync_vmaster_hook(&spec->vmaster_mute);
+                }
        }
        free_kctls(spec); /* no longer needed */
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 0cbdd87dde6d..2aa2f579b4d6 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -968,6 +968,15 @@ static void ad1884_fixup_hp_eapd(struct hda_codec *codec,
        }
 }
+static void ad1884_fixup_thinkpad(struct hda_codec *codec,
+                                  const struct hda_fixup *fix, int action)
+{
+        struct ad198x_spec *spec = codec->spec;
+        if (action == HDA_FIXUP_ACT_PRE_PROBE)
+                spec->gen.keep_eapd_on = 1;
+}
 /* set magic COEFs for dmic */
 static const struct hda_verb ad1884_dmic_init_verbs[] = {
        {0x01, AC_VERB_SET_COEF_INDEX, 0x13f7},
@@ -979,6 +988,7 @@ enum {
        AD1884_FIXUP_AMP_OVERRIDE,
        AD1884_FIXUP_HP_EAPD,
        AD1884_FIXUP_DMIC_COEF,
+        AD1884_FIXUP_THINKPAD,
        AD1884_FIXUP_HP_TOUCHSMART,
 };
@@ -997,6 +1007,12 @@ static const struct hda_fixup ad1884_fixups[] = {
                .type = HDA_FIXUP_VERBS,
                .v.verbs = ad1884_dmic_init_verbs,
        },
+        [AD1884_FIXUP_THINKPAD] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = ad1884_fixup_thinkpad,
+                .chained = true,
+                .chain_id = AD1884_FIXUP_DMIC_COEF,
+        },
        [AD1884_FIXUP_HP_TOUCHSMART] = {
                .type = HDA_FIXUP_VERBS,
                .v.verbs = ad1884_dmic_init_verbs,
@@ -1008,7 +1024,7 @@ static const struct hda_fixup ad1884_fixups[] = {
 static const struct snd_pci_quirk ad1884_fixup_tbl[] = {
        SND_PCI_QUIRK(0x103c, 0x2a82, "HP Touchsmart", AD1884_FIXUP_HP_TOUCHSMART),
        SND_PCI_QUIRK_VENDOR(0x103c, "HP", AD1884_FIXUP_HP_EAPD),
-        SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo Thinkpad", AD1884_FIXUP_DMIC_COEF),
+        SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo Thinkpad", AD1884_FIXUP_THINKPAD),
        {}
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index bf313bea7085..8ad554312b69 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4623,6 +4623,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
        SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4),
+        SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_ASUS_MODE4),
        SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
        SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2),
        SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index 651ce0923675..c91eba504f92 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -270,7 +270,7 @@ MODULE_DEVICE_TABLE(of, pcm1681_dt_ids);
 static const struct regmap_config pcm1681_regmap = {
        .reg_bits               = 8,
        .val_bits               = 8,
-        .max_register           = ARRAY_SIZE(pcm1681_reg_defaults) + 1,
+        .max_register           = 0x13,
        .reg_defaults           = pcm1681_reg_defaults,
        .num_reg_defaults       = ARRAY_SIZE(pcm1681_reg_defaults),
        .writeable_reg          = pcm1681_writeable_reg,
diff --git a/sound/soc/codecs/pcm1792a.c b/sound/soc/codecs/pcm1792a.c
index 2a8eccf64c76..7613181123fe 100644
--- a/sound/soc/codecs/pcm1792a.c
+++ b/sound/soc/codecs/pcm1792a.c
@@ -188,7 +188,7 @@ MODULE_DEVICE_TABLE(of, pcm1792a_of_match);
 static const struct regmap_config pcm1792a_regmap = {
        .reg_bits               = 8,
        .val_bits               = 8,
-        .max_register           = 24,
+        .max_register           = 23,
        .reg_defaults           = pcm1792a_reg_defaults,
        .num_reg_defaults       = ARRAY_SIZE(pcm1792a_reg_defaults),
        .writeable_reg          = pcm1792a_writeable_reg,
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 6e3f269243e0..64ad84d8a306 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -674,6 +674,8 @@ static const struct snd_soc_dapm_route intercon[] = {
        /* Left Input */
        {"Left Line1L Mux", "single-ended", "LINE1L"},
        {"Left Line1L Mux", "differential", "LINE1L"},
+        {"Left Line1R Mux", "single-ended", "LINE1R"},
+        {"Left Line1R Mux", "differential", "LINE1R"},
        {"Left Line2L Mux", "single-ended", "LINE2L"},
        {"Left Line2L Mux", "differential", "LINE2L"},
@@ -690,6 +692,8 @@ static const struct snd_soc_dapm_route intercon[] = {
        /* Right Input */
        {"Right Line1R Mux", "single-ended", "LINE1R"},
        {"Right Line1R Mux", "differential", "LINE1R"},
+        {"Right Line1L Mux", "single-ended", "LINE1L"},
+        {"Right Line1L Mux", "differential", "LINE1L"},
        {"Right Line2R Mux", "single-ended", "LINE2R"},
        {"Right Line2R Mux", "differential", "LINE2R"},
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index 8b50e5958de5..01daf655e20b 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -530,6 +530,7 @@ static int hp_supply_event(struct snd_soc_dapm_widget *w,
                                hubs->hp_startup_mode);
                        break;
                }
+                break;
        case SND_SOC_DAPM_PRE_PMD:
                snd_soc_update_bits(codec, WM8993_CHARGE_PUMP_1,
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index c6b743978d5e..6b81d0ce2c44 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -936,7 +936,7 @@ static int fsl_ssi_probe(struct platform_device *pdev)
        ssi_private->ssi_phys = res.start;
        ssi_private->irq = irq_of_parse_and_map(np, 0);
-        if (ssi_private->irq == NO_IRQ) {
+        if (ssi_private->irq == 0) {
                dev_err(&pdev->dev, "no irq for node %s\n", np->full_name);
                return -ENXIO;
        }
diff --git a/sound/soc/fsl/imx-mc13783.c b/sound/soc/fsl/imx-mc13783.c
index a3d60d4bea4c..a2fd7321b5a9 100644
--- a/sound/soc/fsl/imx-mc13783.c
+++ b/sound/soc/fsl/imx-mc13783.c
@@ -112,7 +112,7 @@ static int imx_mc13783_probe(struct platform_device *pdev)
                return ret;
        }
-        if (machine_is_mx31_3ds()) {
+        if (machine_is_mx31_3ds() || machine_is_mx31moboard()) {
                imx_audmux_v2_configure_port(MX31_AUDMUX_PORT4_SSI_PINS_4,
                        IMX_AUDMUX_V2_PTCR_SYN,
                        IMX_AUDMUX_V2_PDCR_RXDSEL(MX31_AUDMUX_PORT1_SSI0) |
diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
index f58bcd85c07f..57d6941676ff 100644
--- a/sound/soc/fsl/imx-ssi.c
+++ b/sound/soc/fsl/imx-ssi.c
@@ -600,19 +600,17 @@ static int imx_ssi_probe(struct platform_device *pdev)
        ssi->fiq_params.dma_params_rx = &ssi->dma_params_rx;
        ssi->fiq_params.dma_params_tx = &ssi->dma_params_tx;
-        ret = imx_pcm_fiq_init(pdev, &ssi->fiq_params);
+        ssi->fiq_init = imx_pcm_fiq_init(pdev, &ssi->fiq_params);
-        if (ret)
+        ssi->dma_init = imx_pcm_dma_init(pdev);
-                goto failed_pcm_fiq;
-        ret = imx_pcm_dma_init(pdev);
+        if (ssi->fiq_init && ssi->dma_init) {
-        if (ret)
+                ret = ssi->fiq_init;
-                goto failed_pcm_dma;
+                goto failed_pcm;
+        }
        return 0;
-failed_pcm_dma:
+failed_pcm:
-        imx_pcm_fiq_exit(pdev);
-failed_pcm_fiq:
        snd_soc_unregister_component(&pdev->dev);
 failed_register:
        release_mem_region(res->start, resource_size(res));
@@ -628,8 +626,11 @@ static int imx_ssi_remove(struct platform_device *pdev)
        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        struct imx_ssi *ssi = platform_get_drvdata(pdev);
-        imx_pcm_dma_exit(pdev);
+        if (!ssi->dma_init)
-        imx_pcm_fiq_exit(pdev);
+                imx_pcm_dma_exit(pdev);
+        if (!ssi->fiq_init)
+                imx_pcm_fiq_exit(pdev);
        snd_soc_unregister_component(&pdev->dev);
diff --git a/sound/soc/fsl/imx-ssi.h b/sound/soc/fsl/imx-ssi.h
index fb1616ba8c59..560c40fc9ebb 100644
--- a/sound/soc/fsl/imx-ssi.h
+++ b/sound/soc/fsl/imx-ssi.h
@@ -211,6 +211,8 @@ struct imx_ssi {
        struct imx_dma_data filter_data_rx;
        struct imx_pcm_fiq_params fiq_params;
+        int fiq_init;
+        int dma_init;
        int enabled;
 };
diff --git a/sound/soc/omap/Kconfig b/sound/soc/omap/Kconfig
index daa78a0095fa..4a07f7179690 100644
--- a/sound/soc/omap/Kconfig
+++ b/sound/soc/omap/Kconfig
@@ -1,6 +1,6 @@
 config SND_OMAP_SOC
        tristate "SoC Audio for the Texas Instruments OMAP chips"
-        depends on (ARCH_OMAP && DMA_OMAP) || (ARCH_ARM && COMPILE_TEST)
+        depends on (ARCH_OMAP && DMA_OMAP) || (ARM && COMPILE_TEST)
        select SND_DMAENGINE_PCM
 config SND_OMAP_SOC_DMIC
@@ -26,7 +26,7 @@ config SND_OMAP_SOC_N810
 config SND_OMAP_SOC_RX51
        tristate "SoC Audio support for Nokia RX-51"
-        depends on SND_OMAP_SOC && ARCH_ARM && (MACH_NOKIA_RX51 || COMPILE_TEST)
+        depends on SND_OMAP_SOC && ARM && (MACH_NOKIA_RX51 || COMPILE_TEST)
        select SND_OMAP_SOC_MCBSP
        select SND_SOC_TLV320AIC3X
        select SND_SOC_TPA6130A2
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 9cc6986a8cfb..5dd87f4c919e 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -220,8 +220,8 @@ int rsnd_gen_path_exit(struct rsnd_priv *priv,
 void __iomem *rsnd_gen_reg_get(struct rsnd_priv *priv,
                               struct rsnd_mod *mod,
                               enum rsnd_reg reg);
-#define rsnd_is_gen1(s)         ((s)->info->flags & RSND_GEN1)
+#define rsnd_is_gen1(s)         (((s)->info->flags & RSND_GEN_MASK) == RSND_GEN1)
-#define rsnd_is_gen2(s)         ((s)->info->flags & RSND_GEN2)
+#define rsnd_is_gen2(s)         (((s)->info->flags & RSND_GEN_MASK) == RSND_GEN2)
 /*
 *      R-Car ADG
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index c17c14c394df..b2949aed1ac2 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1949,7 +1949,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                                w->active ? "active" : "inactive");
        list_for_each_entry(p, &w->sources, list_sink) {
-                if (p->connected && !p->connected(w, p->sink))
+                if (p->connected && !p->connected(w, p->source))
                        continue;
                if (p->connect)
@@ -3495,6 +3495,7 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm,
                if (!w) {
                        dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
                                dai->driver->playback.stream_name);
+                        return -ENOMEM;
                }
                w->priv = dai;
@@ -3513,6 +3514,7 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm,
                if (!w) {
                        dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
                                dai->driver->capture.stream_name);
+                        return -ENOMEM;
                }
                w->priv = dai;
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index e297b74471b8..ca0d3d9f4bac 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -90,8 +90,20 @@ OPTIONS
        Number of mmap data pages. Must be a power of two.
 -g::
+        Enables call-graph (stack chain/backtrace) recording.
 --call-graph::
-        Do call-graph (stack chain/backtrace) recording.
+        Setup and enable call-graph (stack chain/backtrace) recording,
+        implies -g.
+        Allows specifying "fp" (frame pointer) or "dwarf"
+        (DWARF's CFI - Call Frame Information) as the method to collect
+        the information used to show the call graphs.
+        In some systems, where binaries are build with gcc
+        --fomit-frame-pointer, using the "fp" method will produce bogus
+        call graphs, using "dwarf", if available (perf tools linked to
+        the libunwind library) should be used instead.
 -q::
 --quiet::
diff --git a/tools/perf/Documentation/perf-top.txt b/tools/perf/Documentation/perf-top.txt
index 58d6598a9686..6a118e71d003 100644
--- a/tools/perf/Documentation/perf-top.txt
+++ b/tools/perf/Documentation/perf-top.txt
@@ -140,20 +140,12 @@ Default is to monitor all CPUS.
 --asm-raw::
        Show raw instruction encoding of assembly instructions.
-G [type,min,order]::
+-G::
+        Enables call-graph (stack chain/backtrace) recording.
 --call-graph::
-        Display call chains using type, min percent threshold and order.
+        Setup and enable call-graph (stack chain/backtrace) recording,
-        type can be either:
+        implies -G.
-        - flat: single column, linear exposure of call chains.
-        - graph: use a graph tree, displaying absolute overhead rates.
-        - fractal: like graph, but displays relative rates. Each branch of
-                 the tree is considered as a new profiled object.
-        order can be either:
-        - callee: callee based call graph.
-        - caller: inverted caller based call graph.
-        Default: fractal,0.5,callee.
 --ignore-callees=<regex>::
        Ignore callees of the function(s) matching the given regex.
diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
index 935d52216c89..fbc2888d6495 100644
--- a/tools/perf/builtin-kvm.c
+++ b/tools/perf/builtin-kvm.c
@@ -888,11 +888,18 @@ static s64 perf_kvm__mmap_read_idx(struct perf_kvm_stat *kvm, int idx,
        while ((event = perf_evlist__mmap_read(kvm->evlist, idx)) != NULL) {
                err = perf_evlist__parse_sample(kvm->evlist, event, &sample);
                if (err) {
+                        perf_evlist__mmap_consume(kvm->evlist, idx);
                        pr_err("Failed to parse sample\n");
                        return -1;
                }
                err = perf_session_queue_event(kvm->session, event, &sample, 0);
+                /*
+                 * FIXME: Here we can't consume the event, as perf_session_queue_event will
+                 *        point to it, and it'll get possibly overwritten by the kernel.
+                 */
+                perf_evlist__mmap_consume(kvm->evlist, idx);
                if (err) {
                        pr_err("Failed to enqueue sample: %d\n", err);
                        return -1;
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index a41ac41546c9..d04651484640 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -712,21 +712,12 @@ static int get_stack_size(char *str, unsigned long *_size)
 }
 #endif /* LIBUNWIND_SUPPORT */
-int record_parse_callchain_opt(const struct option *opt,
+int record_parse_callchain(const char *arg, struct perf_record_opts *opts)
-                               const char *arg, int unset)
 {
-        struct perf_record_opts *opts = opt->value;
        char *tok, *name, *saveptr = NULL;
        char *buf;
        int ret = -1;
-        /* --no-call-graph */
-        if (unset)
-                return 0;
-        /* We specified default option if none is provided. */
-        BUG_ON(!arg);
        /* We need buffer that we know we can write to. */
        buf = malloc(strlen(arg) + 1);
        if (!buf)
@@ -764,13 +755,9 @@ int record_parse_callchain_opt(const struct option *opt,
                                ret = get_stack_size(tok, &size);
                                opts->stack_dump_size = size;
                        }
-                        if (!ret)
-                                pr_debug("callchain: stack dump size %d\n",
-                                         opts->stack_dump_size);
 #endif /* LIBUNWIND_SUPPORT */
                } else {
-                        pr_err("callchain: Unknown -g option "
+                        pr_err("callchain: Unknown --call-graph option "
                               "value: %s\n", arg);
                        break;
                }
@@ -778,13 +765,52 @@ int record_parse_callchain_opt(const struct option *opt,
        } while (0);
        free(buf);
+        return ret;
+}
+static void callchain_debug(struct perf_record_opts *opts)
+{
+        pr_debug("callchain: type %d\n", opts->call_graph);
+        if (opts->call_graph == CALLCHAIN_DWARF)
+                pr_debug("callchain: stack dump size %d\n",
+                         opts->stack_dump_size);
+}
+int record_parse_callchain_opt(const struct option *opt,
+                               const char *arg,
+                               int unset)
+{
+        struct perf_record_opts *opts = opt->value;
+        int ret;
+        /* --no-call-graph */
+        if (unset) {
+                opts->call_graph = CALLCHAIN_NONE;
+                pr_debug("callchain: disabled\n");
+                return 0;
+        }
+        ret = record_parse_callchain(arg, opts);
        if (!ret)
-                pr_debug("callchain: type %d\n", opts->call_graph);
+                callchain_debug(opts);
        return ret;
 }
+int record_callchain_opt(const struct option *opt,
+                         const char *arg __maybe_unused,
+                         int unset __maybe_unused)
+{
+        struct perf_record_opts *opts = opt->value;
+        if (opts->call_graph == CALLCHAIN_NONE)
+                opts->call_graph = CALLCHAIN_FP;
+        callchain_debug(opts);
+        return 0;
+}
 static const char * const record_usage[] = {
        "perf record [<options>] [<command>]",
        "perf record [<options>] -- <command> [<options>]",
@@ -813,12 +839,12 @@ static struct perf_record record = {
        },
 };
-#define CALLCHAIN_HELP "do call-graph (stack chain/backtrace) recording: "
+#define CALLCHAIN_HELP "setup and enables call-graph (stack chain/backtrace) recording: "
 #ifdef LIBUNWIND_SUPPORT
-const char record_callchain_help[] = CALLCHAIN_HELP "[fp] dwarf";
+const char record_callchain_help[] = CALLCHAIN_HELP "fp dwarf";
 #else
-const char record_callchain_help[] = CALLCHAIN_HELP "[fp]";
+const char record_callchain_help[] = CALLCHAIN_HELP "fp";
 #endif
 /*
@@ -858,9 +884,12 @@ const struct option record_options[] = {
                     "number of mmap data pages"),
        OPT_BOOLEAN(0, "group", &record.opts.group,
                    "put the counters into a counter group"),
-        OPT_CALLBACK_DEFAULT('g', "call-graph", &record.opts,
+        OPT_CALLBACK_NOOPT('g', NULL, &record.opts,
-                             "mode[,dump_size]", record_callchain_help,
+                           NULL, "enables call-graph recording" ,
-                             &record_parse_callchain_opt, "fp"),
+                           &record_callchain_opt),
+        OPT_CALLBACK(0, "call-graph", &record.opts,
+                     "mode[,dump_size]", record_callchain_help,
+                     &record_parse_callchain_opt),
        OPT_INCR('v', "verbose", &verbose,
                    "be more verbose (show counter open errors, etc)"),
        OPT_BOOLEAN('q', "quiet", &quiet, "don't print any message"),
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 212214162bb2..5a11f13e56f9 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -810,7 +810,7 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                ret = perf_evlist__parse_sample(top->evlist, event, &sample);
                if (ret) {
                        pr_err("Can't parse sample, err = %d\n", ret);
-                        continue;
+                        goto next_event;
                }
                evsel = perf_evlist__id2evsel(session->evlist, sample.id);
@@ -825,13 +825,13 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                case PERF_RECORD_MISC_USER:
                        ++top->us_samples;
                        if (top->hide_user_symbols)
-                                continue;
+                                goto next_event;
                        machine = &session->machines.host;
                        break;
                case PERF_RECORD_MISC_KERNEL:
                        ++top->kernel_samples;
                        if (top->hide_kernel_symbols)
-                                continue;
+                                goto next_event;
                        machine = &session->machines.host;
                        break;
                case PERF_RECORD_MISC_GUEST_KERNEL:
@@ -847,7 +847,7 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                         */
                        /* Fall thru */
                default:
-                        continue;
+                        goto next_event;
                }
@@ -859,6 +859,8 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                        machine__process_event(machine, event);
                } else
                        ++session->stats.nr_unknown_events;
+next_event:
+                perf_evlist__mmap_consume(top->evlist, idx);
        }
 }
@@ -1016,16 +1018,16 @@ out_delete:
 }
 static int
-parse_callchain_opt(const struct option *opt, const char *arg, int unset)
+callchain_opt(const struct option *opt, const char *arg, int unset)
 {
-        /*
-         * --no-call-graph
-         */
-        if (unset)
-                return 0;
        symbol_conf.use_callchain = true;
+        return record_callchain_opt(opt, arg, unset);
+}
+static int
+parse_callchain_opt(const struct option *opt, const char *arg, int unset)
+{
+        symbol_conf.use_callchain = true;
        return record_parse_callchain_opt(opt, arg, unset);
 }
@@ -1106,9 +1108,12 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused)
                   "sort by key(s): pid, comm, dso, symbol, parent, weight, local_weight"),
        OPT_BOOLEAN('n', "show-nr-samples", &symbol_conf.show_nr_samples,
                    "Show a column with the number of samples"),
-        OPT_CALLBACK_DEFAULT('G', "call-graph", &top.record_opts,
+        OPT_CALLBACK_NOOPT('G', NULL, &top.record_opts,
-                             "mode[,dump_size]", record_callchain_help,
+                           NULL, "enables call-graph recording",
-                             &parse_callchain_opt, "fp"),
+                           &callchain_opt),
+        OPT_CALLBACK(0, "call-graph", &top.record_opts,
+                     "mode[,dump_size]", record_callchain_help,
+                     &parse_callchain_opt),
        OPT_CALLBACK(0, "ignore-callees", NULL, "regex",
                   "ignore callees of these functions in call graphs",
                   report_parse_ignore_callees_opt),
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 71aa3e35406b..99c8d9ad6729 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -987,7 +987,7 @@ again:
                        err = perf_evlist__parse_sample(evlist, event, &sample);
                        if (err) {
                                fprintf(trace->output, "Can't parse sample, err = %d, skipping...\n", err);
-                                continue;
+                                goto next_event;
                        }
                        if (trace->base_time == 0)
@@ -1001,18 +1001,20 @@ again:
                        evsel = perf_evlist__id2evsel(evlist, sample.id);
                        if (evsel == NULL) {
                                fprintf(trace->output, "Unknown tp ID %" PRIu64 ", skipping...\n", sample.id);
-                                continue;
+                                goto next_event;
                        }
                        if (sample.raw_data == NULL) {
                                fprintf(trace->output, "%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n",
                                       perf_evsel__name(evsel), sample.tid,
                                       sample.cpu, sample.raw_size);
-                                continue;
+                                goto next_event;
                        }
                        handler = evsel->handler.func;
                        handler(trace, evsel, &sample);
+next_event:
+                        perf_evlist__mmap_consume(evlist, i);
                        if (done)
                                goto out_unmap_evlist;
diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
index 6fb781d5586c..e3fedfa2906e 100644
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -290,6 +290,7 @@ static int process_events(struct machine *machine, struct perf_evlist *evlist,
        for (i = 0; i < evlist->nr_mmaps; i++) {
                while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
                        ret = process_event(machine, evlist, event, state);
+                        perf_evlist__mmap_consume(evlist, i);
                        if (ret < 0)
                                return ret;
                }
diff --git a/tools/perf/tests/keep-tracking.c b/tools/perf/tests/keep-tracking.c
index d444ea2c47d9..376c35608534 100644
--- a/tools/perf/tests/keep-tracking.c
+++ b/tools/perf/tests/keep-tracking.c
@@ -36,6 +36,7 @@ static int find_comm(struct perf_evlist *evlist, const char *comm)
                            (pid_t)event->comm.tid == getpid() &&
                            strcmp(event->comm.comm, comm) == 0)
                                found += 1;
+                        perf_evlist__mmap_consume(evlist, i);
                }
        }
        return found;
diff --git a/tools/perf/tests/mmap-basic.c b/tools/perf/tests/mmap-basic.c
index c4185b9aeb80..a7232c204eb9 100644
--- a/tools/perf/tests/mmap-basic.c
+++ b/tools/perf/tests/mmap-basic.c
@@ -122,6 +122,7 @@ int test__basic_mmap(void)
                        goto out_munmap;
                }
                nr_events[evsel->idx]++;
+                perf_evlist__mmap_consume(evlist, 0);
        }
        err = 0;
diff --git a/tools/perf/tests/open-syscall-tp-fields.c b/tools/perf/tests/open-syscall-tp-fields.c
index fc5b9fca8b47..524b221b829b 100644
--- a/tools/perf/tests/open-syscall-tp-fields.c
+++ b/tools/perf/tests/open-syscall-tp-fields.c
@@ -77,8 +77,10 @@ int test__syscall_open_tp_fields(void)
                                ++nr_events;
-                                if (type != PERF_RECORD_SAMPLE)
+                                if (type != PERF_RECORD_SAMPLE) {
+                                        perf_evlist__mmap_consume(evlist, i);
                                        continue;
+                                }
                                err = perf_evsel__parse_sample(evsel, event, &sample);
                                if (err) {
diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
index b8a7056519ac..7923b06ffc91 100644
--- a/tools/perf/tests/perf-record.c
+++ b/tools/perf/tests/perf-record.c
@@ -263,6 +263,8 @@ int test__PERF_RECORD(void)
                                                 type);
                                        ++errs;
                                }
+                                perf_evlist__mmap_consume(evlist, i);
                        }
                }
diff --git a/tools/perf/tests/perf-time-to-tsc.c b/tools/perf/tests/perf-time-to-tsc.c
index 0ab61b1f408e..4ca1b938f6a6 100644
--- a/tools/perf/tests/perf-time-to-tsc.c
+++ b/tools/perf/tests/perf-time-to-tsc.c
@@ -122,7 +122,7 @@ int test__perf_time_to_tsc(void)
                        if (event->header.type != PERF_RECORD_COMM ||
                            (pid_t)event->comm.pid != getpid() ||
                            (pid_t)event->comm.tid != getpid())
-                                continue;
+                                goto next_event;
                        if (strcmp(event->comm.comm, comm1) == 0) {
                                CHECK__(perf_evsel__parse_sample(evsel, event,
@@ -134,6 +134,8 @@ int test__perf_time_to_tsc(void)
                                                                 &sample));
                                comm2_time = sample.time;
                        }
+next_event:
+                        perf_evlist__mmap_consume(evlist, i);
                }
        }
diff --git a/tools/perf/tests/sw-clock.c b/tools/perf/tests/sw-clock.c
index 2e41e2d32ccc..6e2b44ec0749 100644
--- a/tools/perf/tests/sw-clock.c
+++ b/tools/perf/tests/sw-clock.c
@@ -78,7 +78,7 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
                struct perf_sample sample;
                if (event->header.type != PERF_RECORD_SAMPLE)
-                        continue;
+                        goto next_event;
                err = perf_evlist__parse_sample(evlist, event, &sample);
                if (err < 0) {
@@ -88,6 +88,8 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
                total_periods += sample.period;
                nr_samples++;
+next_event:
+                perf_evlist__mmap_consume(evlist, 0);
        }
        if ((u64) nr_samples == total_periods) {
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index 28fe5894b061..a3e64876e940 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -96,10 +96,10 @@ int test__task_exit(void)
 retry:
        while ((event = perf_evlist__mmap_read(evlist, 0)) != NULL) {
-                if (event->header.type != PERF_RECORD_EXIT)
+                if (event->header.type == PERF_RECORD_EXIT)
-                        continue;
+                        nr_exit++;
-                nr_exit++;
+                perf_evlist__mmap_consume(evlist, 0);
        }
        if (!exited || !nr_exit) {
diff --git a/tools/perf/ui/stdio/hist.c b/tools/perf/ui/stdio/hist.c
index 194e2f42ff5d..6c152686e837 100644
--- a/tools/perf/ui/stdio/hist.c
+++ b/tools/perf/ui/stdio/hist.c
@@ -315,8 +315,7 @@ static inline void advance_hpp(struct perf_hpp *hpp, int inc)
 }
 static int hist_entry__period_snprintf(struct perf_hpp *hpp,
-                                       struct hist_entry *he,
+                                       struct hist_entry *he)
-                                       bool color)
 {
        const char *sep = symbol_conf.field_sep;
        struct perf_hpp_fmt *fmt;
@@ -338,7 +337,7 @@ static int hist_entry__period_snprintf(struct perf_hpp *hpp,
                } else
                        first = false;
-                if (color && fmt->color)
+                if (perf_hpp__use_color() && fmt->color)
                        ret = fmt->color(fmt, hpp, he);
                else
                        ret = fmt->entry(fmt, hpp, he);
@@ -358,12 +357,11 @@ static int hist_entry__fprintf(struct hist_entry *he, size_t size,
                .buf            = bf,
                .size           = size,
        };
-        bool color = !symbol_conf.field_sep;
        if (size == 0 || size > bfsz)
                size = hpp.size = bfsz;
-        ret = hist_entry__period_snprintf(&hpp, he, color);
+        ret = hist_entry__period_snprintf(&hpp, he);
        hist_entry__sort_snprintf(he, bf + ret, size - ret, hists);
        ret = fprintf(fp, "%s\n", bf);
@@ -482,6 +480,7 @@ size_t hists__fprintf(struct hists *hists, bool show_header, int max_rows,
 print_entries:
        linesz = hists__sort_list_width(hists) + 3 + 1;
+        linesz += perf_hpp__color_overhead();
        line = malloc(linesz);
        if (line == NULL) {
                ret = -1;
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 2b585bc308cf..9e99060408ae 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -147,6 +147,9 @@ static inline void callchain_cursor_advance(struct callchain_cursor *cursor)
 struct option;
+int record_parse_callchain(const char *arg, struct perf_record_opts *opts);
 int record_parse_callchain_opt(const struct option *opt, const char *arg, int unset);
+int record_callchain_opt(const struct option *opt, const char *arg, int unset);
 extern const char record_callchain_help[];
 #endif  /* __PERF_CALLCHAIN_H */
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 9b393e7dca6f..49096ea58a15 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -187,7 +187,7 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                return -1;
        }
-        event->header.type = PERF_RECORD_MMAP2;
+        event->header.type = PERF_RECORD_MMAP;
        /*
         * Just like the kernel, see __perf_event_mmap in kernel/perf_event.c
         */
@@ -198,7 +198,6 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                char prot[5];
                char execname[PATH_MAX];
                char anonstr[] = "//anon";
-                unsigned int ino;
                size_t size;
                ssize_t n;
@@ -209,15 +208,12 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                strcpy(execname, "");
                /* 00400000-0040c000 r-xp 00000000 fd:01 41038  /bin/cat */
-                n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %s\n",
+                n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %*x:%*x %*u %s\n",
-                       &event->mmap2.start, &event->mmap2.len, prot,
+                       &event->mmap.start, &event->mmap.len, prot,
-                       &event->mmap2.pgoff, &event->mmap2.maj,
+                       &event->mmap.pgoff,
-                       &event->mmap2.min,
+                       execname);
-                       &ino, execname);
-                event->mmap2.ino = (u64)ino;
-                if (n != 8)
+                if (n != 5)
                        continue;
                if (prot[2] != 'x')
@@ -227,15 +223,15 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                        strcpy(execname, anonstr);
                size = strlen(execname) + 1;
-                memcpy(event->mmap2.filename, execname, size);
+                memcpy(event->mmap.filename, execname, size);
                size = PERF_ALIGN(size, sizeof(u64));
-                event->mmap2.len -= event->mmap.start;
+                event->mmap.len -= event->mmap.start;
-                event->mmap2.header.size = (sizeof(event->mmap2) -
+                event->mmap.header.size = (sizeof(event->mmap) -
-                                        (sizeof(event->mmap2.filename) - size));
+                                        (sizeof(event->mmap.filename) - size));
-                memset(event->mmap2.filename + size, 0, machine->id_hdr_size);
+                memset(event->mmap.filename + size, 0, machine->id_hdr_size);
-                event->mmap2.header.size += machine->id_hdr_size;
+                event->mmap.header.size += machine->id_hdr_size;
-                event->mmap2.pid = tgid;
+                event->mmap.pid = tgid;
-                event->mmap2.tid = pid;
+                event->mmap.tid = pid;
                if (process(tool, event, &synth_sample, machine) != 0) {
                        rc = -1;
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index f9f77bee0b1b..e584cd30b0f2 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -545,12 +545,19 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
        md->prev = old;
-        if (!evlist->overwrite)
-                perf_mmap__write_tail(md, old);
        return event;
 }
+void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx)
+{
+        if (!evlist->overwrite) {
+                struct perf_mmap *md = &evlist->mmap[idx];
+                unsigned int old = md->prev;
+                perf_mmap__write_tail(md, old);
+        }
+}
 static void __perf_evlist__munmap(struct perf_evlist *evlist, int idx)
 {
        if (evlist->mmap[idx].base != NULL) {
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 880d7139d2fb..206d09339306 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -89,6 +89,8 @@ struct perf_sample_id *perf_evlist__id2sid(struct perf_evlist *evlist, u64 id);
 union perf_event *perf_evlist__mmap_read(struct perf_evlist *self, int idx);
+void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx);
 int perf_evlist__open(struct perf_evlist *evlist);
 void perf_evlist__close(struct perf_evlist *evlist);
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 0ce9febf1ba0..9f1ef9bee2d0 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -678,7 +678,6 @@ void perf_evsel__config(struct perf_evsel *evsel,
                attr->sample_type       |= PERF_SAMPLE_WEIGHT;
        attr->mmap  = track;
-        attr->mmap2 = track && !perf_missing_features.mmap2;
        attr->comm  = track;
        /*
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index 1329b6b6ffe6..ce8dc61ce2c3 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -5,6 +5,7 @@
 #include <pthread.h>
 #include "callchain.h"
 #include "header.h"
+#include "color.h"
 extern struct callchain_param callchain_param;
@@ -175,6 +176,18 @@ void perf_hpp__init(void);
 void perf_hpp__column_register(struct perf_hpp_fmt *format);
 void perf_hpp__column_enable(unsigned col);
+static inline size_t perf_hpp__use_color(void)
+{
+        return !symbol_conf.field_sep;
+}
+static inline size_t perf_hpp__color_overhead(void)
+{
+        return perf_hpp__use_color() ?
+               (COLOR_MAXLEN + sizeof(PERF_COLOR_RESET)) * PERF_HPP__MAX_INDEX
+               : 0;
+}
 struct perf_evlist;
 struct hist_browser_timer {
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index c09e0a9fdf4c..f0692737ebf1 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -1357,10 +1357,10 @@ int debuginfo__find_probe_point(struct debuginfo *self, unsigned long addr,
                        goto post;
                }
+                fname = dwarf_decl_file(&spdie);
                if (addr == (unsigned long)baseaddr) {
                        /* Function entry - Relative line number is 0 */
                        lineno = baseline;
-                        fname = dwarf_decl_file(&spdie);
                        goto post;
                }
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 71b5412bbbb9..2ac4bc92bb1f 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -822,6 +822,8 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
                PyObject *pyevent = pyrf_event__new(event);
                struct pyrf_event *pevent = (struct pyrf_event *)pyevent;
+                perf_evlist__mmap_consume(evlist, cpu);
                if (pyevent == NULL)
                        return PyErr_NoMemory();
diff --git a/tools/perf/util/scripting-engines/trace-event-perl.c b/tools/perf/util/scripting-engines/trace-event-perl.c
index a85e4ae5f3ac..c0c9795c4f02 100644
--- a/tools/perf/util/scripting-engines/trace-event-perl.c
+++ b/tools/perf/util/scripting-engines/trace-event-perl.c
@@ -282,7 +282,7 @@ static void perl_process_tracepoint(union perf_event *perf_event __maybe_unused,
        event = find_cache_event(evsel);
        if (!event)
-                die("ug! no event found for type %" PRIu64, evsel->attr.config);
+                die("ug! no event found for type %" PRIu64, (u64)evsel->attr.config);
        pid = raw_field_value(event, "common_pid", data);
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index cc75a3cef388..95d91a0b23af 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -56,6 +56,17 @@ static void handler_call_die(const char *handler_name)
        Py_FatalError("problem in Python trace event handler");
 }
+/*
+ * Insert val into into the dictionary and decrement the reference counter.
+ * This is necessary for dictionaries since PyDict_SetItemString() does not 
+ * steal a reference, as opposed to PyTuple_SetItem().
+ */
+static void pydict_set_item_string_decref(PyObject *dict, const char *key, PyObject *val)
+{
+        PyDict_SetItemString(dict, key, val);
+        Py_DECREF(val);
+}
 static void define_value(enum print_arg_type field_type,
                         const char *ev_name,
                         const char *field_name,
@@ -279,11 +290,11 @@ static void python_process_tracepoint(union perf_event *perf_event
                PyTuple_SetItem(t, n++, PyInt_FromLong(pid));
                PyTuple_SetItem(t, n++, PyString_FromString(comm));
        } else {
-                PyDict_SetItemString(dict, "common_cpu", PyInt_FromLong(cpu));
+                pydict_set_item_string_decref(dict, "common_cpu", PyInt_FromLong(cpu));
-                PyDict_SetItemString(dict, "common_s", PyInt_FromLong(s));
+                pydict_set_item_string_decref(dict, "common_s", PyInt_FromLong(s));
-                PyDict_SetItemString(dict, "common_ns", PyInt_FromLong(ns));
+                pydict_set_item_string_decref(dict, "common_ns", PyInt_FromLong(ns));
-                PyDict_SetItemString(dict, "common_pid", PyInt_FromLong(pid));
+                pydict_set_item_string_decref(dict, "common_pid", PyInt_FromLong(pid));
-                PyDict_SetItemString(dict, "common_comm", PyString_FromString(comm));
+                pydict_set_item_string_decref(dict, "common_comm", PyString_FromString(comm));
        }
        for (field = event->format.fields; field; field = field->next) {
                if (field->flags & FIELD_IS_STRING) {
@@ -313,7 +324,7 @@ static void python_process_tracepoint(union perf_event *perf_event
                if (handler)
                        PyTuple_SetItem(t, n++, obj);
                else
-                        PyDict_SetItemString(dict, field->name, obj);
+                        pydict_set_item_string_decref(dict, field->name, obj);
        }
        if (!handler)
@@ -370,21 +381,21 @@ static void python_process_general_event(union perf_event *perf_event
        if (!handler || !PyCallable_Check(handler))
                goto exit;
-        PyDict_SetItemString(dict, "ev_name", PyString_FromString(perf_evsel__name(evsel)));
+        pydict_set_item_string_decref(dict, "ev_name", PyString_FromString(perf_evsel__name(evsel)));
-        PyDict_SetItemString(dict, "attr", PyString_FromStringAndSize(
+        pydict_set_item_string_decref(dict, "attr", PyString_FromStringAndSize(
                        (const char *)&evsel->attr, sizeof(evsel->attr)));
-        PyDict_SetItemString(dict, "sample", PyString_FromStringAndSize(
+        pydict_set_item_string_decref(dict, "sample", PyString_FromStringAndSize(
                        (const char *)sample, sizeof(*sample)));
-        PyDict_SetItemString(dict, "raw_buf", PyString_FromStringAndSize(
+        pydict_set_item_string_decref(dict, "raw_buf", PyString_FromStringAndSize(
                        (const char *)sample->raw_data, sample->raw_size));
-        PyDict_SetItemString(dict, "comm",
+        pydict_set_item_string_decref(dict, "comm",
                        PyString_FromString(thread->comm));
        if (al->map) {
-                PyDict_SetItemString(dict, "dso",
+                pydict_set_item_string_decref(dict, "dso",
                        PyString_FromString(al->map->dso->name));
        }
        if (al->sym) {
-                PyDict_SetItemString(dict, "symbol",
+                pydict_set_item_string_decref(dict, "symbol",
                        PyString_FromString(al->sym->name));
        }
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a9dd682cf5e3..1cf9ccb01013 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3091,7 +3091,7 @@ static const struct file_operations *stat_fops[] = {
 static int kvm_init_debug(void)
 {
-        int r = -EFAULT;
+        int r = -EEXIST;
        struct kvm_stats_debugfs_item *p;
        kvm_debugfs_dir = debugfs_create_dir("kvm", NULL);