Merge branch 'drm-intel-next' of git://people.freedesktop.org/~danvet/drm-intel into drm-next

drm-intel-next-2014-01-10:
- final bits for runtime D3 on Haswell from Paul (now enabled fully)
- parse the backlight modulation freq information in the VBT from Jani
  (but not yet used)
- more watermark improvements from Ville for ilk-ivb and bdw
- bugfixes for fastboot from Jesse
- watermark fix for i830M (but not yet everything)
- vlv vga hotplug w/a (Imre)
- piles of other small improvements, cleanups and fixes all over

Note that the pull request includes a backmerge of the last drm-fixes
pulled into Linus' tree - things where getting a bit too messy. So the
shortlog also contains a bunch of patches from Linus tree. Please yell if
you want me to frob it for you a bit.

* 'drm-intel-next' of git://people.freedesktop.org/~danvet/drm-intel: (609 commits)
  drm/i915/bdw: make sure south port interrupts are enabled properly v2
  drm/i915: Include more information in disabled hotplug interrupt warning
  drm/i915: Only complain about a rogue hotplug IRQ after disabling
  drm/i915: Only WARN about a stuck hotplug irq ONCE
  drm/i915: s/hotplugt_status_gen4/hotplug_status_g4x/

271 files changed, 2980 insertions, 2302 deletions

diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 5d9248526d78..4770de5707b9 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -348,7 +348,6 @@ source "drivers/acpi/apei/Kconfig"
 config ACPI_EXTLOG
         tristate "Extended Error Log support"
         depends on X86_MCE && X86_LOCAL_APIC
-        select EFI
         select UEFI_CPER
         default n
         help
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 8711e3797165..3c2e4aa529c4 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -207,7 +207,7 @@ static int acpi_ac_probe(struct platform_device *pdev)
                 goto end;
 
         result = acpi_install_notify_handler(ACPI_HANDLE(&pdev->dev),
-                        ACPI_DEVICE_NOTIFY, acpi_ac_notify_handler, ac);
+                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler, ac);
         if (result) {
                 power_supply_unregister(&ac->charger);
                 goto end;
@@ -255,7 +255,7 @@ static int acpi_ac_remove(struct platform_device *pdev)
                 return -EINVAL;
 
         acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev),
-                        ACPI_DEVICE_NOTIFY, acpi_ac_notify_handler);
+                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler);
 
         ac = platform_get_drvdata(pdev);
         if (ac->charger.dev)
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 6745fe137b9e..e60390597372 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -162,6 +162,7 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
         { "80860F14", (unsigned long)&byt_sdio_dev_desc },
         { "80860F41", (unsigned long)&byt_i2c_dev_desc },
         { "INT33B2", },
+        { "INT33FC", },
 
         { "INT3430", (unsigned long)&lpt_dev_desc },
         { "INT3431", (unsigned long)&lpt_dev_desc },
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index 786294bb682c..3650b2183227 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -2,7 +2,6 @@ config ACPI_APEI
         bool "ACPI Platform Error Interface (APEI)"
         select MISC_FILESYSTEMS
         select PSTORE
-        select EFI
         select UEFI_CPER
         depends on X86
         help
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 26311f23c824..cb1d557fc22c 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -942,6 +942,7 @@ static int erst_clearer(enum pstore_type_id type, u64 id, int count,
 static struct pstore_info erst_info = {
         .owner          = THIS_MODULE,
         .name           = "erst",
+        .flags          = PSTORE_FLAGS_FRAGILE,
         .open           = erst_open_pstore,
         .close          = erst_close_pstore,
         .read           = erst_reader,
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index fbf1aceda8b8..5876a49dfd38 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -62,6 +62,7 @@ MODULE_AUTHOR("Alexey Starikovskiy <astarikovskiy@suse.de>");
 MODULE_DESCRIPTION("ACPI Battery Driver");
 MODULE_LICENSE("GPL");
 
+static int battery_bix_broken_package;
 static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
@@ -416,7 +417,12 @@ static int acpi_battery_get_info(struct acpi_battery *battery)
                 ACPI_EXCEPTION((AE_INFO, status, "Evaluating %s", name));
                 return -ENODEV;
         }
-        if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags))
+
+        if (battery_bix_broken_package)
+                result = extract_package(battery, buffer.pointer,
+                                extended_info_offsets + 1,
+                                ARRAY_SIZE(extended_info_offsets) - 1);
+        else if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags))
                 result = extract_package(battery, buffer.pointer,
                                 extended_info_offsets,
                                 ARRAY_SIZE(extended_info_offsets));
@@ -754,6 +760,17 @@ static int battery_notify(struct notifier_block *nb,
         return 0;
 }
 
+static struct dmi_system_id bat_dmi_table[] = {
+        {
+                .ident = "NEC LZ750/LS",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-LZ750LS"),
+                },
+        },
+        {},
+};
+
 static int acpi_battery_add(struct acpi_device *device)
 {
         int result = 0;
@@ -846,6 +863,9 @@ static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
 {
         if (acpi_disabled)
                 return;
+
+        if (dmi_check_system(bat_dmi_table))
+                battery_bix_broken_package = 1;
         acpi_bus_register_driver(&acpi_battery_driver);
 }
 
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index bba9b72e25f8..0710004055c8 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -156,6 +156,16 @@ int acpi_bus_get_private_data(acpi_handle handle, void **data)
 }
 EXPORT_SYMBOL(acpi_bus_get_private_data);
 
+void acpi_bus_no_hotplug(acpi_handle handle)
+{
+        struct acpi_device *adev = NULL;
+
+        acpi_bus_get_device(handle, &adev);
+        if (adev)
+                adev->flags.no_hotplug = true;
+}
+EXPORT_SYMBOL_GPL(acpi_bus_no_hotplug);
+
 static void acpi_print_osc_error(acpi_handle handle,
         struct acpi_osc_context *context, char *error)
 {
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 14f1e9506338..e3a92a6da39a 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -427,6 +427,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },                  /* 88se9128 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9125),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9125 */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_MARVELL_EXT, 0x9178,
+                         PCI_VENDOR_ID_MARVELL_EXT, 0x9170),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9170 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
@@ -1238,15 +1241,6 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 return rc;
 
-        /* AHCI controllers often implement SFF compatible interface.
-         * Grab all PCI BARs just in case.
-         */
-        rc = pcim_iomap_regions_request_all(pdev, 1 << ahci_pci_bar, DRV_NAME);
-        if (rc == -EBUSY)
-                pcim_pin_device(pdev);
-        if (rc)
-                return rc;
-
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
             (pdev->device == 0x2652 || pdev->device == 0x2653)) {
                 u8 map;
@@ -1263,6 +1257,15 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         }
 
+        /* AHCI controllers often implement SFF compatible interface.
+         * Grab all PCI BARs just in case.
+         */
+        rc = pcim_iomap_regions_request_all(pdev, 1 << ahci_pci_bar, DRV_NAME);
+        if (rc == -EBUSY)
+                pcim_pin_device(pdev);
+        if (rc)
+                return rc;
+
         hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL);
         if (!hpriv)
                 return -ENOMEM;
diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
index ae2d73fe321e..3e23e9941dad 100644
--- a/drivers/ata/ahci_imx.c
+++ b/drivers/ata/ahci_imx.c
@@ -113,7 +113,7 @@ static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
         /*
          * set PHY Paremeters, two steps to configure the GPR13,
          * one write for rest of parameters, mask of first write
-         * is 0x07fffffd, and the other one write for setting
+         * is 0x07ffffff, and the other one write for setting
          * the mpll_clk_en.
          */
         regmap_update_bits(imxpriv->gpr, 0x34, IMX6Q_GPR13_SATA_RX_EQ_VAL_MASK
@@ -124,6 +124,7 @@ static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
                         | IMX6Q_GPR13_SATA_TX_ATTEN_MASK
                         | IMX6Q_GPR13_SATA_TX_BOOST_MASK
                         | IMX6Q_GPR13_SATA_TX_LVL_MASK
+                        | IMX6Q_GPR13_SATA_MPLL_CLK_EN
                         | IMX6Q_GPR13_SATA_TX_EDGE_RATE
                         , IMX6Q_GPR13_SATA_RX_EQ_VAL_3_0_DB
                         | IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA2M
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 75b93678bbcd..1393a5890ed5 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2149,9 +2149,16 @@ static int ata_dev_config_ncq(struct ata_device *dev,
                                     "failed to get NCQ Send/Recv Log Emask 0x%x\n",
                                     err_mask);
                 } else {
+                        u8 *cmds = dev->ncq_send_recv_cmds;
+
                         dev->flags |= ATA_DFLAG_NCQ_SEND_RECV;
-                        memcpy(dev->ncq_send_recv_cmds, ap->sector_buf,
-                                ATA_LOG_NCQ_SEND_RECV_SIZE);
+                        memcpy(cmds, ap->sector_buf, ATA_LOG_NCQ_SEND_RECV_SIZE);
+
+                        if (dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM) {
+                                ata_dev_dbg(dev, "disabling queued TRIM support\n");
+                                cmds[ATA_LOG_NCQ_SEND_RECV_DSM_OFFSET] &=
+                                        ~ATA_LOG_NCQ_SEND_RECV_DSM_TRIM;
+                        }
                 }
         }
 
@@ -4156,6 +4163,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "ST3320[68]13AS",     "SD1[5-9]",     ATA_HORKAGE_NONCQ |
                                                 ATA_HORKAGE_FIRMWARE_WARN },
 
+        /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+        { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+
         /* Blacklist entries taken from Silicon Image 3124/3132
            Windows driver .inf file - also several Linux problem reports */
         { "HTS541060G9SA00",    "MB3OC60D",     ATA_HORKAGE_NONCQ, },
@@ -4202,6 +4212,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "PIONEER DVD-RW  DVR-212D",   NULL,   ATA_HORKAGE_NOSETXFER },
         { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
 
+        /* devices that don't properly handle queued TRIM commands */
+        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+
         /* End Marker */
         { }
 };
@@ -6519,6 +6533,7 @@ static int __init ata_parse_force_one(char **cur,
                 { "norst",      .lflags         = ATA_LFLAG_NO_HRST | ATA_LFLAG_NO_SRST },
                 { "rstonce",    .lflags         = ATA_LFLAG_RST_ONCE },
                 { "atapi_dmadir", .horkage_on   = ATA_HORKAGE_ATAPI_DMADIR },
+                { "disable",    .horkage_on     = ATA_HORKAGE_DISABLE },
         };
         char *start = *cur, *p = *cur;
         char *id, *val, *endp;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index ab58556d347c..377eb889f555 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3872,6 +3872,27 @@ void ata_scsi_hotplug(struct work_struct *work)
                 return;
         }
 
+        /*
+         * XXX - UGLY HACK
+         *
+         * The block layer suspend/resume path is fundamentally broken due
+         * to freezable kthreads and workqueue and may deadlock if a block
+         * device gets removed while resume is in progress.  I don't know
+         * what the solution is short of removing freezable kthreads and
+         * workqueues altogether.
+         *
+         * The following is an ugly hack to avoid kicking off device
+         * removal while freezer is active.  This is a joke but does avoid
+         * this particular deadlock scenario.
+         *
+         * https://bugzilla.kernel.org/show_bug.cgi?id=62801
+         * http://marc.info/?l=linux-kernel&m=138695698516487
+         */
+#ifdef CONFIG_FREEZER
+        while (pm_freezing)
+                msleep(10);
+#endif
+
         DPRINTK("ENTER\n");
         mutex_lock(&ap->scsi_scan_mutex);
 
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index fe3ca0989b14..1ad2f62d34b9 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -83,6 +83,10 @@ static struct pci_driver sis_pci_driver = {
         .id_table               = sis_pci_tbl,
         .probe                  = sis_init_one,
         .remove                 = ata_pci_remove_one,
+#ifdef CONFIG_PM
+        .suspend                = ata_pci_device_suspend,
+        .resume                 = ata_pci_device_resume,
+#endif
 };
 
 static struct scsi_host_template sis_sht = {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index f370fc13aea5..83a598ebb65a 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -1,4 +1,5 @@
 #include <linux/module.h>
+
 #include <linux/moduleparam.h>
 #include <linux/sched.h>
 #include <linux/fs.h>
@@ -65,7 +66,7 @@ enum {
         NULL_Q_MQ               = 2,
 };
 
-static int submit_queues = 1;
+static int submit_queues;
 module_param(submit_queues, int, S_IRUGO);
 MODULE_PARM_DESC(submit_queues, "Number of submission queues");
 
@@ -101,9 +102,9 @@ static int hw_queue_depth = 64;
 module_param(hw_queue_depth, int, S_IRUGO);
 MODULE_PARM_DESC(hw_queue_depth, "Queue depth for each hardware queue. Default: 64");
 
-static bool use_per_node_hctx = true;
+static bool use_per_node_hctx = false;
 module_param(use_per_node_hctx, bool, S_IRUGO);
-MODULE_PARM_DESC(use_per_node_hctx, "Use per-node allocation for hardware context queues. Default: true");
+MODULE_PARM_DESC(use_per_node_hctx, "Use per-node allocation for hardware context queues. Default: false");
 
 static void put_tag(struct nullb_queue *nq, unsigned int tag)
 {
@@ -346,8 +347,37 @@ static int null_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *rq)
 
 static struct blk_mq_hw_ctx *null_alloc_hctx(struct blk_mq_reg *reg, unsigned int hctx_index)
 {
-        return kzalloc_node(sizeof(struct blk_mq_hw_ctx), GFP_KERNEL,
-                                hctx_index);
+        int b_size = DIV_ROUND_UP(reg->nr_hw_queues, nr_online_nodes);
+        int tip = (reg->nr_hw_queues % nr_online_nodes);
+        int node = 0, i, n;
+
+        /*
+         * Split submit queues evenly wrt to the number of nodes. If uneven,
+         * fill the first buckets with one extra, until the rest is filled with
+         * no extra.
+         */
+        for (i = 0, n = 1; i < hctx_index; i++, n++) {
+                if (n % b_size == 0) {
+                        n = 0;
+                        node++;
+
+                        tip--;
+                        if (!tip)
+                                b_size = reg->nr_hw_queues / nr_online_nodes;
+                }
+        }
+
+        /*
+         * A node might not be online, therefore map the relative node id to the
+         * real node id.
+         */
+        for_each_online_node(n) {
+                if (!node)
+                        break;
+                node--;
+        }
+
+        return kzalloc_node(sizeof(struct blk_mq_hw_ctx), GFP_KERNEL, n);
 }
 
 static void null_free_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_index)
@@ -355,16 +385,24 @@ static void null_free_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_index)
         kfree(hctx);
 }
 
+static void null_init_queue(struct nullb *nullb, struct nullb_queue *nq)
+{
+        BUG_ON(!nullb);
+        BUG_ON(!nq);
+
+        init_waitqueue_head(&nq->wait);
+        nq->queue_depth = nullb->queue_depth;
+}
+
 static int null_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
                           unsigned int index)
 {
         struct nullb *nullb = data;
         struct nullb_queue *nq = &nullb->queues[index];
 
-        init_waitqueue_head(&nq->wait);
-        nq->queue_depth = nullb->queue_depth;
-        nullb->nr_queues++;
         hctx->driver_data = nq;
+        null_init_queue(nullb, nq);
+        nullb->nr_queues++;
 
         return 0;
 }
@@ -387,10 +425,7 @@ static void null_del_dev(struct nullb *nullb)
         list_del_init(&nullb->list);
 
         del_gendisk(nullb->disk);
-        if (queue_mode == NULL_Q_MQ)
-                blk_mq_free_queue(nullb->q);
-        else
-                blk_cleanup_queue(nullb->q);
+        blk_cleanup_queue(nullb->q);
         put_disk(nullb->disk);
         kfree(nullb);
 }
@@ -417,13 +452,13 @@ static int setup_commands(struct nullb_queue *nq)
 
         nq->cmds = kzalloc(nq->queue_depth * sizeof(*cmd), GFP_KERNEL);
         if (!nq->cmds)
-                return 1;
+                return -ENOMEM;
 
         tag_size = ALIGN(nq->queue_depth, BITS_PER_LONG) / BITS_PER_LONG;
         nq->tag_map = kzalloc(tag_size * sizeof(unsigned long), GFP_KERNEL);
         if (!nq->tag_map) {
                 kfree(nq->cmds);
-                return 1;
+                return -ENOMEM;
         }
 
         for (i = 0; i < nq->queue_depth; i++) {
@@ -454,33 +489,37 @@ static void cleanup_queues(struct nullb *nullb)
 
 static int setup_queues(struct nullb *nullb)
 {
-        struct nullb_queue *nq;
-        int i;
-
-        nullb->queues = kzalloc(submit_queues * sizeof(*nq), GFP_KERNEL);
+        nullb->queues = kzalloc(submit_queues * sizeof(struct nullb_queue),
+                                                                GFP_KERNEL);
         if (!nullb->queues)
-                return 1;
+                return -ENOMEM;
 
         nullb->nr_queues = 0;
         nullb->queue_depth = hw_queue_depth;
 
-        if (queue_mode == NULL_Q_MQ)
-                return 0;
+        return 0;
+}
+
+static int init_driver_queues(struct nullb *nullb)
+{
+        struct nullb_queue *nq;
+        int i, ret = 0;
 
         for (i = 0; i < submit_queues; i++) {
                 nq = &nullb->queues[i];
-                init_waitqueue_head(&nq->wait);
-                nq->queue_depth = hw_queue_depth;
-                if (setup_commands(nq))
-                        break;
+
+                null_init_queue(nullb, nq);
+
+                ret = setup_commands(nq);
+                if (ret)
+                        goto err_queue;
                 nullb->nr_queues++;
         }
 
-        if (i == submit_queues)
-                return 0;
-
+        return 0;
+err_queue:
         cleanup_queues(nullb);
-        return 1;
+        return ret;
 }
 
 static int null_add_dev(void)
@@ -518,11 +557,13 @@ static int null_add_dev(void)
         } else if (queue_mode == NULL_Q_BIO) {
                 nullb->q = blk_alloc_queue_node(GFP_KERNEL, home_node);
                 blk_queue_make_request(nullb->q, null_queue_bio);
+                init_driver_queues(nullb);
         } else {
                 nullb->q = blk_init_queue_node(null_request_fn, &nullb->lock, home_node);
                 blk_queue_prep_rq(nullb->q, null_rq_prep_fn);
                 if (nullb->q)
                         blk_queue_softirq_done(nullb->q, null_softirq_done_fn);
+                init_driver_queues(nullb);
         }
 
         if (!nullb->q)
@@ -534,10 +575,7 @@ static int null_add_dev(void)
         disk = nullb->disk = alloc_disk_node(1, home_node);
         if (!disk) {
 queue_fail:
-                if (queue_mode == NULL_Q_MQ)
-                        blk_mq_free_queue(nullb->q);
-                else
-                        blk_cleanup_queue(nullb->q);
+                blk_cleanup_queue(nullb->q);
                 cleanup_queues(nullb);
 err:
                 kfree(nullb);
@@ -579,7 +617,13 @@ static int __init null_init(void)
         }
 #endif
 
-        if (submit_queues > nr_cpu_ids)
+        if (queue_mode == NULL_Q_MQ && use_per_node_hctx) {
+                if (submit_queues < nr_online_nodes) {
+                        pr_warn("null_blk: submit_queues param is set to %u.",
+                                                        nr_online_nodes);
+                        submit_queues = nr_online_nodes;
+                }
+        } else if (submit_queues > nr_cpu_ids)
                 submit_queues = nr_cpu_ids;
         else if (!submit_queues)
                 submit_queues = 1;
diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c
index 9199c93be926..eb6e1e0e8db2 100644
--- a/drivers/block/skd_main.c
+++ b/drivers/block/skd_main.c
@@ -5269,7 +5269,7 @@ const char *skd_skdev_state_to_str(enum skd_drvr_state state)
         }
 }
 
-const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
+static const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
 {
         switch (state) {
         case SKD_MSG_STATE_IDLE:
@@ -5281,7 +5281,7 @@ const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
         }
 }
 
-const char *skd_skreq_state_to_str(enum skd_req_state state)
+static const char *skd_skreq_state_to_str(enum skd_req_state state)
 {
         switch (state) {
         case SKD_REQ_STATE_IDLE:
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 6bfc1bb318f6..dceb85f8d9a8 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -87,6 +87,7 @@ static const struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x0CF3, 0xE004) },
         { USB_DEVICE(0x0CF3, 0xE005) },
         { USB_DEVICE(0x0930, 0x0219) },
+        { USB_DEVICE(0x0930, 0x0220) },
         { USB_DEVICE(0x0489, 0xe057) },
         { USB_DEVICE(0x13d3, 0x3393) },
         { USB_DEVICE(0x0489, 0xe04e) },
@@ -129,6 +130,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c0ff34f2d2df..3980fd18f6ea 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -154,6 +154,7 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
index 8e562dc65601..e1f3337a0cf9 100644
--- a/drivers/char/tpm/tpm_ppi.c
+++ b/drivers/char/tpm/tpm_ppi.c
@@ -27,15 +27,18 @@ static char *tpm_device_name = "TPM";
 static acpi_status ppi_callback(acpi_handle handle, u32 level, void *context,
                                 void **return_value)
 {
-        acpi_status status;
+        acpi_status status = AE_OK;
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-        status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
-        if (strstr(buffer.pointer, context) != NULL) {
-                *return_value = handle;
+
+        if (ACPI_SUCCESS(acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer))) {
+                if (strstr(buffer.pointer, context) != NULL) {
+                        *return_value = handle;
+                        status = AE_CTRL_TERMINATE;
+                }
                 kfree(buffer.pointer);
-                return AE_CTRL_TERMINATE;
         }
-        return AE_OK;
+
+        return status;
 }
 
 static inline void ppi_assign_params(union acpi_object params[4],
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index 8d3009e44fba..5543b7df8e16 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -87,7 +87,7 @@ static unsigned int _get_table_val(const struct clk_div_table *table,
         return 0;
 }
 
-static unsigned int _get_val(struct clk_divider *divider, u8 div)
+static unsigned int _get_val(struct clk_divider *divider, unsigned int div)
 {
         if (divider->flags & CLK_DIVIDER_ONE_BASED)
                 return div;
diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 7be41e676a64..00a3abe103a5 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -60,7 +60,7 @@ static int s2mps11_clk_prepare(struct clk_hw *hw)
         struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
         int ret;
 
-        ret = regmap_update_bits(s2mps11->iodev->regmap,
+        ret = regmap_update_bits(s2mps11->iodev->regmap_pmic,
                                 S2MPS11_REG_RTC_CTRL,
                                  s2mps11->mask, s2mps11->mask);
         if (!ret)
@@ -74,7 +74,7 @@ static void s2mps11_clk_unprepare(struct clk_hw *hw)
         struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
         int ret;
 
-        ret = regmap_update_bits(s2mps11->iodev->regmap, S2MPS11_REG_RTC_CTRL,
+        ret = regmap_update_bits(s2mps11->iodev->regmap_pmic, S2MPS11_REG_RTC_CTRL,
                            s2mps11->mask, ~s2mps11->mask);
 
         if (!ret)
@@ -174,7 +174,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
                 s2mps11_clk->hw.init = &s2mps11_clks_init[i];
                 s2mps11_clk->mask = 1 << i;
 
-                ret = regmap_read(s2mps11_clk->iodev->regmap,
+                ret = regmap_read(s2mps11_clk->iodev->regmap_pmic,
                                   S2MPS11_REG_RTC_CTRL, &val);
                 if (ret < 0)
                         goto err_reg;
diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c
index 39b40aaede2b..68e515d093d8 100644
--- a/drivers/clk/samsung/clk-exynos-audss.c
+++ b/drivers/clk/samsung/clk-exynos-audss.c
@@ -26,17 +26,17 @@ static struct clk_onecell_data clk_data;
 #define ASS_CLK_DIV 0x4
 #define ASS_CLK_GATE 0x8
 
+/* list of all parent clock list */
+static const char *mout_audss_p[] = { "fin_pll", "fout_epll" };
+static const char *mout_i2s_p[] = { "mout_audss", "cdclk0", "sclk_audio0" };
+
+#ifdef CONFIG_PM_SLEEP
 static unsigned long reg_save[][2] = {
         {ASS_CLK_SRC,  0},
         {ASS_CLK_DIV,  0},
         {ASS_CLK_GATE, 0},
 };
 
-/* list of all parent clock list */
-static const char *mout_audss_p[] = { "fin_pll", "fout_epll" };
-static const char *mout_i2s_p[] = { "mout_audss", "cdclk0", "sclk_audio0" };
-
-#ifdef CONFIG_PM_SLEEP
 static int exynos_audss_clk_suspend(void)
 {
         int i;
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index ad5ff50c5f28..1a7c1b929c69 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -39,7 +39,7 @@
 #define SRC_TOP1                0xc214
 #define SRC_CAM                 0xc220
 #define SRC_TV                  0xc224
-#define SRC_MFC                 0xcc28
+#define SRC_MFC                 0xc228
 #define SRC_G3D                 0xc22c
 #define E4210_SRC_IMAGE         0xc230
 #define SRC_LCD0                0xc234
diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c
index adf32343c9f9..e52359cf9b6f 100644
--- a/drivers/clk/samsung/clk-exynos5250.c
+++ b/drivers/clk/samsung/clk-exynos5250.c
@@ -25,6 +25,7 @@
 #define MPLL_LOCK               0x4000
 #define MPLL_CON0               0x4100
 #define SRC_CORE1               0x4204
+#define GATE_IP_ACP             0x8800
 #define CPLL_LOCK               0x10020
 #define EPLL_LOCK               0x10030
 #define VPLL_LOCK               0x10040
@@ -75,7 +76,6 @@
 #define SRC_CDREX               0x20200
 #define PLL_DIV2_SEL            0x20a24
 #define GATE_IP_DISP1           0x10928
-#define GATE_IP_ACP             0x10000
 
 /* list of PLLs to be registered */
 enum exynos5250_plls {
@@ -120,7 +120,8 @@ enum exynos5250_clks {
         spi2, i2s1, i2s2, pcm1, pcm2, pwm, spdif, ac97, hsi2c0, hsi2c1, hsi2c2,
         hsi2c3, chipid, sysreg, pmu, cmu_top, cmu_core, cmu_mem, tzpc0, tzpc1,
         tzpc2, tzpc3, tzpc4, tzpc5, tzpc6, tzpc7, tzpc8, tzpc9, hdmi_cec, mct,
-        wdt, rtc, tmu, fimd1, mie1, dsim0, dp, mixer, hdmi, g2d,
+        wdt, rtc, tmu, fimd1, mie1, dsim0, dp, mixer, hdmi, g2d, mdma0,
+        smmu_mdma0,
 
         /* mux clocks */
         mout_hdmi = 1024,
@@ -354,8 +355,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
         GATE(smmu_gscl2, "smmu_gscl2", "aclk266", GATE_IP_GSCL, 9, 0, 0),
         GATE(smmu_gscl3, "smmu_gscl3", "aclk266", GATE_IP_GSCL, 10, 0, 0),
         GATE(mfc, "mfc", "aclk333", GATE_IP_MFC, 0, 0, 0),
-        GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 1, 0, 0),
-        GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 2, 0, 0),
+        GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 2, 0, 0),
+        GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 1, 0, 0),
         GATE(rotator, "rotator", "aclk266", GATE_IP_GEN, 1, 0, 0),
         GATE(jpeg, "jpeg", "aclk166", GATE_IP_GEN, 2, 0, 0),
         GATE(mdma1, "mdma1", "aclk266", GATE_IP_GEN, 4, 0, 0),
@@ -406,7 +407,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
         GATE(hsi2c2, "hsi2c2", "aclk66", GATE_IP_PERIC, 30, 0, 0),
         GATE(hsi2c3, "hsi2c3", "aclk66", GATE_IP_PERIC, 31, 0, 0),
         GATE(chipid, "chipid", "aclk66", GATE_IP_PERIS, 0, 0, 0),
-        GATE(sysreg, "sysreg", "aclk66", GATE_IP_PERIS, 1, 0, 0),
+        GATE(sysreg, "sysreg", "aclk66",
+                        GATE_IP_PERIS, 1, CLK_IGNORE_UNUSED, 0),
         GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, CLK_IGNORE_UNUSED, 0),
         GATE(tzpc0, "tzpc0", "aclk66", GATE_IP_PERIS, 6, 0, 0),
         GATE(tzpc1, "tzpc1", "aclk66", GATE_IP_PERIS, 7, 0, 0),
@@ -492,6 +494,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
         GATE(mixer, "mixer", "mout_aclk200_disp1", GATE_IP_DISP1, 5, 0, 0),
         GATE(hdmi, "hdmi", "mout_aclk200_disp1", GATE_IP_DISP1, 6, 0, 0),
         GATE(g2d, "g2d", "aclk200", GATE_IP_ACP, 3, 0, 0),
+        GATE(mdma0, "mdma0", "aclk266", GATE_IP_ACP, 1, 0, 0),
+        GATE(smmu_mdma0, "smmu_mdma0", "aclk266", GATE_IP_ACP, 5, 0, 0),
 };
 
 static struct samsung_pll_rate_table vpll_24mhz_tbl[] __initdata = {
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 5c07a56962db..634c4d6dd45a 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -75,6 +75,7 @@ config CLKSRC_DBX500_PRCMU_SCHED_CLOCK
 config CLKSRC_EFM32
         bool "Clocksource for Energy Micro's EFM32 SoCs" if !ARCH_EFM32
         depends on OF && ARM && (ARCH_EFM32 || COMPILE_TEST)
+        select CLKSRC_MMIO
         default ARCH_EFM32
         help
           Support to use the timers of EFM32 SoCs as clock source and clock
diff --git a/drivers/clocksource/clksrc-of.c b/drivers/clocksource/clksrc-of.c
index 35639cf4e5a2..b9ddd9e3a2f5 100644
--- a/drivers/clocksource/clksrc-of.c
+++ b/drivers/clocksource/clksrc-of.c
@@ -35,6 +35,5 @@ void __init clocksource_of_init(void)
 
                 init_func = match->data;
                 init_func(np);
-                of_node_put(np);
         }
 }
diff --git a/drivers/clocksource/dw_apb_timer_of.c b/drivers/clocksource/dw_apb_timer_of.c
index 45ba8aecc729..2a2ea2717f3a 100644
--- a/drivers/clocksource/dw_apb_timer_of.c
+++ b/drivers/clocksource/dw_apb_timer_of.c
@@ -108,12 +108,11 @@ static void __init add_clocksource(struct device_node *source_timer)
 
 static u64 read_sched_clock(void)
 {
-        return __raw_readl(sched_io_base);
+        return ~__raw_readl(sched_io_base);
 }
 
 static const struct of_device_id sptimer_ids[] __initconst = {
         { .compatible = "picochip,pc3x2-rtc" },
-        { .compatible = "snps,dw-apb-timer-sp" },
         { /* Sentinel */ },
 };
 
@@ -151,4 +150,6 @@ static void __init dw_apb_timer_init(struct device_node *timer)
         num_called++;
 }
 CLOCKSOURCE_OF_DECLARE(pc3x2_timer, "picochip,pc3x2-timer", dw_apb_timer_init);
-CLOCKSOURCE_OF_DECLARE(apb_timer, "snps,dw-apb-timer-osc", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer_osc, "snps,dw-apb-timer-osc", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer_sp, "snps,dw-apb-timer-sp", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer, "snps,dw-apb-timer", dw_apb_timer_init);
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index 2fb4695a28d8..a4f6119aafd8 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -179,6 +179,9 @@ static void __init sun4i_timer_init(struct device_node *node)
         writel(TIMER_CTL_CLK_SRC(TIMER_CTL_CLK_SRC_OSC24M),
                timer_base + TIMER_CTL_REG(0));
 
+        /* Make sure timer is stopped before playing with interrupts */
+        sun4i_clkevt_time_stop(0);
+
         ret = setup_irq(irq, &sun4i_timer_irq);
         if (ret)
                 pr_warn("failed to setup irq %d\n", irq);
diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
index d8e47e502785..4e7f6802e840 100644
--- a/drivers/clocksource/time-armada-370-xp.c
+++ b/drivers/clocksource/time-armada-370-xp.c
@@ -256,11 +256,6 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
         ticks_per_jiffy = (timer_clk + HZ / 2) / HZ;
 
         /*
-         * Set scale and timer for sched_clock.
-         */
-        sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
-
-        /*
          * Setup free-running clocksource timer (interrupts
          * disabled).
          */
@@ -270,6 +265,11 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
         timer_ctrl_clrset(0, TIMER0_EN | TIMER0_RELOAD_EN |
                              TIMER0_DIV(TIMER_DIVIDER_SHIFT));
 
+        /*
+         * Set scale and timer for sched_clock.
+         */
+        sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
+
         clocksource_mmio_init(timer_base + TIMER0_VAL_OFF,
                               "armada_370_xp_clocksource",
                               timer_clk, 300, 32, clocksource_mmio_readl_down);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 02d534da22dd..8d19f7c06010 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -828,14 +828,17 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
         int ret = 0;
 
         memcpy(&new_policy, policy, sizeof(*policy));
+
+        /* Use the default policy if its valid. */
+        if (cpufreq_driver->setpolicy)
+                cpufreq_parse_governor(policy->governor->name,
+                                        &new_policy.policy, NULL);
+
         /* assure that the starting sequence is run in cpufreq_set_policy */
         policy->governor = NULL;
 
         /* set default policy */
         ret = cpufreq_set_policy(policy, &new_policy);
-        policy->user_policy.policy = policy->policy;
-        policy->user_policy.governor = policy->governor;
-
         if (ret) {
                 pr_debug("setting policy failed\n");
                 if (cpufreq_driver->exit)
@@ -845,8 +848,7 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
 
 #ifdef CONFIG_HOTPLUG_CPU
 static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
-                                  unsigned int cpu, struct device *dev,
-                                  bool frozen)
+                                  unsigned int cpu, struct device *dev)
 {
         int ret = 0;
         unsigned long flags;
@@ -877,11 +879,7 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
                 }
         }
 
-        /* Don't touch sysfs links during light-weight init */
-        if (!frozen)
-                ret = sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
-
-        return ret;
+        return sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
 }
 #endif
 
@@ -926,6 +924,27 @@ err_free_policy:
         return NULL;
 }
 
+static void cpufreq_policy_put_kobj(struct cpufreq_policy *policy)
+{
+        struct kobject *kobj;
+        struct completion *cmp;
+
+        down_read(&policy->rwsem);
+        kobj = &policy->kobj;
+        cmp = &policy->kobj_unregister;
+        up_read(&policy->rwsem);
+        kobject_put(kobj);
+
+        /*
+         * We need to make sure that the underlying kobj is
+         * actually not referenced anymore by anybody before we
+         * proceed with unloading.
+         */
+        pr_debug("waiting for dropping of refcount\n");
+        wait_for_completion(cmp);
+        pr_debug("wait complete\n");
+}
+
 static void cpufreq_policy_free(struct cpufreq_policy *policy)
 {
         free_cpumask_var(policy->related_cpus);
@@ -986,7 +1005,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
         list_for_each_entry(tpolicy, &cpufreq_policy_list, policy_list) {
                 if (cpumask_test_cpu(cpu, tpolicy->related_cpus)) {
                         read_unlock_irqrestore(&cpufreq_driver_lock, flags);
-                        ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev, frozen);
+                        ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev);
                         up_read(&cpufreq_rwsem);
                         return ret;
                 }
@@ -994,15 +1013,17 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
         read_unlock_irqrestore(&cpufreq_driver_lock, flags);
 #endif
 
-        if (frozen)
-                /* Restore the saved policy when doing light-weight init */
-                policy = cpufreq_policy_restore(cpu);
-        else
+        /*
+         * Restore the saved policy when doing light-weight init and fall back
+         * to the full init if that fails.
+         */
+        policy = frozen ? cpufreq_policy_restore(cpu) : NULL;
+        if (!policy) {
+                frozen = false;
                 policy = cpufreq_policy_alloc();
-
-        if (!policy)
-                goto nomem_out;
-
+                if (!policy)
+                        goto nomem_out;
+        }
 
         /*
          * In the resume path, since we restore a saved policy, the assignment
@@ -1047,8 +1068,10 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
          */
         cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
 
-        policy->user_policy.min = policy->min;
-        policy->user_policy.max = policy->max;
+        if (!frozen) {
+                policy->user_policy.min = policy->min;
+                policy->user_policy.max = policy->max;
+        }
 
         blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
                                      CPUFREQ_START, policy);
@@ -1079,6 +1102,11 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
 
         cpufreq_init_policy(policy);
 
+        if (!frozen) {
+                policy->user_policy.policy = policy->policy;
+                policy->user_policy.governor = policy->governor;
+        }
+
         kobject_uevent(&policy->kobj, KOBJ_ADD);
         up_read(&cpufreq_rwsem);
 
@@ -1096,7 +1124,13 @@ err_get_freq:
         if (cpufreq_driver->exit)
                 cpufreq_driver->exit(policy);
 err_set_policy_cpu:
+        if (frozen) {
+                /* Do not leave stale fallback data behind. */
+                per_cpu(cpufreq_cpu_data_fallback, cpu) = NULL;
+                cpufreq_policy_put_kobj(policy);
+        }
         cpufreq_policy_free(policy);
+
 nomem_out:
         up_read(&cpufreq_rwsem);
 
@@ -1118,7 +1152,7 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
 }
 
 static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
-                                           unsigned int old_cpu, bool frozen)
+                                           unsigned int old_cpu)
 {
         struct device *cpu_dev;
         int ret;
@@ -1126,10 +1160,6 @@ static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
         /* first sibling now owns the new sysfs dir */
         cpu_dev = get_cpu_device(cpumask_any_but(policy->cpus, old_cpu));
 
-        /* Don't touch sysfs files during light-weight tear-down */
-        if (frozen)
-                return cpu_dev->id;
-
         sysfs_remove_link(&cpu_dev->kobj, "cpufreq");
         ret = kobject_move(&policy->kobj, &cpu_dev->kobj);
         if (ret) {
@@ -1196,7 +1226,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
                 if (!frozen)
                         sysfs_remove_link(&dev->kobj, "cpufreq");
         } else if (cpus > 1) {
-                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu, frozen);
+                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu);
                 if (new_cpu >= 0) {
                         update_policy_cpu(policy, new_cpu);
 
@@ -1218,8 +1248,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
         int ret;
         unsigned long flags;
         struct cpufreq_policy *policy;
-        struct kobject *kobj;
-        struct completion *cmp;
 
         read_lock_irqsave(&cpufreq_driver_lock, flags);
         policy = per_cpu(cpufreq_cpu_data, cpu);
@@ -1249,22 +1277,8 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
                         }
                 }
 
-                if (!frozen) {
-                        down_read(&policy->rwsem);
-                        kobj = &policy->kobj;
-                        cmp = &policy->kobj_unregister;
-                        up_read(&policy->rwsem);
-                        kobject_put(kobj);
-
-                        /*
-                         * We need to make sure that the underlying kobj is
-                         * actually not referenced anymore by anybody before we
-                         * proceed with unloading.
-                         */
-                        pr_debug("waiting for dropping of refcount\n");
-                        wait_for_completion(cmp);
-                        pr_debug("wait complete\n");
-                }
+                if (!frozen)
+                        cpufreq_policy_put_kobj(policy);
 
                 /*
                  * Perform the ->exit() even during light-weight tear-down,
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 5f1cbae36961..d51f17ed691e 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -581,7 +581,8 @@ static void intel_pstate_timer_func(unsigned long __data)
 }
 
 #define ICPU(model, policy) \
-        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)&policy }
+        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_APERFMPERF,\
+                        (unsigned long)&policy }
 
 static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
         ICPU(0x2a, core_params),
@@ -614,6 +615,11 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
         cpu = all_cpu_data[cpunum];
 
         intel_pstate_get_cpu_pstates(cpu);
+        if (!cpu->pstate.current_pstate) {
+                all_cpu_data[cpunum] = NULL;
+                kfree(cpu);
+                return -ENODATA;
+        }
 
         cpu->cpu = cpunum;
 
diff --git a/drivers/cpuidle/cpuidle-calxeda.c b/drivers/cpuidle/cpuidle-calxeda.c
index 36795639df0d..6e51114057d0 100644
--- a/drivers/cpuidle/cpuidle-calxeda.c
+++ b/drivers/cpuidle/cpuidle-calxeda.c
@@ -65,7 +65,7 @@ static struct cpuidle_driver calxeda_idle_driver = {
         .state_count = 2,
 };
 
-static int __init calxeda_cpuidle_probe(struct platform_device *pdev)
+static int calxeda_cpuidle_probe(struct platform_device *pdev)
 {
         return cpuidle_register(&calxeda_idle_driver, NULL);
 }
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 9dd6e01eac33..f757a0f428bd 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1410,14 +1410,12 @@ static const struct platform_device_info ixp_dev_info __initdata = {
 static int __init ixp_module_init(void)
 {
         int num = ARRAY_SIZE(ixp4xx_algos);
-        int i, err ;
+        int i, err;
 
         pdev = platform_device_register_full(&ixp_dev_info);
         if (IS_ERR(pdev))
                 return PTR_ERR(pdev);
 
-        dev = &pdev->dev;
-
         spin_lock_init(&desc_lock);
         spin_lock_init(&emerg_lock);
 
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 446687cc2334..c823daaf9043 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -62,6 +62,7 @@ config INTEL_IOATDMA
         tristate "Intel I/OAT DMA support"
         depends on PCI && X86
         select DMA_ENGINE
+        select DMA_ENGINE_RAID
         select DCA
         help
           Enable support for the Intel(R) I/OAT DMA engine present
@@ -112,6 +113,7 @@ config MV_XOR
         bool "Marvell XOR engine support"
         depends on PLAT_ORION
         select DMA_ENGINE
+        select DMA_ENGINE_RAID
         select ASYNC_TX_ENABLE_CHANNEL_SWITCH
         ---help---
           Enable support for the Marvell XOR engine.
@@ -187,6 +189,7 @@ config AMCC_PPC440SPE_ADMA
         tristate "AMCC PPC440SPe ADMA support"
         depends on 440SPe || 440SP
         select DMA_ENGINE
+        select DMA_ENGINE_RAID
         select ARCH_HAS_ASYNC_TX_FIND_CHANNEL
         select ASYNC_TX_ENABLE_CHANNEL_SWITCH
         help
@@ -352,6 +355,7 @@ config NET_DMA
         bool "Network: TCP receive copy offload"
         depends on DMA_ENGINE && NET
         default (INTEL_IOATDMA || FSL_DMA)
+        depends on BROKEN
         help
           This enables the use of DMA engines in the network stack to
           offload receive copy-to-user operations, freeing CPU cycles.
@@ -377,4 +381,7 @@ config DMATEST
           Simple DMA test client. Say N unless you're debugging a
           DMA Device driver.
 
+config DMA_ENGINE_RAID
+        bool
+
 endif
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index f31d647acdfa..2787aba60c6b 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -347,10 +347,6 @@ static struct device *chan2dev(struct dma_chan *chan)
 {
         return &chan->dev->device;
 }
-static struct device *chan2parent(struct dma_chan *chan)
-{
-        return chan->dev->device.parent;
-}
 
 #if defined(VERBOSE_DEBUG)
 static void vdbg_dump_regs(struct at_dma_chan *atchan)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 24095ff8a93b..ed610b497518 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -967,7 +967,7 @@ struct dmaengine_unmap_pool {
 #define __UNMAP_POOL(x) { .size = x, .name = "dmaengine-unmap-" __stringify(x) }
 static struct dmaengine_unmap_pool unmap_pool[] = {
         __UNMAP_POOL(2),
-        #if IS_ENABLED(CONFIG_ASYNC_TX_DMA)
+        #if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
         __UNMAP_POOL(16),
         __UNMAP_POOL(128),
         __UNMAP_POOL(256),
@@ -1109,7 +1109,7 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
         dma_cookie_t cookie;
         unsigned long flags;
 
-        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOIO);
+        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOWAIT);
         if (!unmap)
                 return -ENOMEM;
 
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 20f9a3aaf926..9dfcaf5c1288 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -539,9 +539,9 @@ static int dmatest_func(void *data)
 
                 um->len = params->buf_size;
                 for (i = 0; i < src_cnt; i++) {
-                        unsigned long buf = (unsigned long) thread->srcs[i];
+                        void *buf = thread->srcs[i];
                         struct page *pg = virt_to_page(buf);
-                        unsigned pg_off = buf & ~PAGE_MASK;
+                        unsigned pg_off = (unsigned long) buf & ~PAGE_MASK;
 
                         um->addr[i] = dma_map_page(dev->dev, pg, pg_off,
                                                    um->len, DMA_TO_DEVICE);
@@ -559,9 +559,9 @@ static int dmatest_func(void *data)
                 /* map with DMA_BIDIRECTIONAL to force writeback/invalidate */
                 dsts = &um->addr[src_cnt];
                 for (i = 0; i < dst_cnt; i++) {
-                        unsigned long buf = (unsigned long) thread->dsts[i];
+                        void *buf = thread->dsts[i];
                         struct page *pg = virt_to_page(buf);
-                        unsigned pg_off = buf & ~PAGE_MASK;
+                        unsigned pg_off = (unsigned long) buf & ~PAGE_MASK;
 
                         dsts[i] = dma_map_page(dev->dev, pg, pg_off, um->len,
                                                DMA_BIDIRECTIONAL);
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 7086a16a55f2..f157c6f76b32 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -86,11 +86,6 @@ static void set_desc_cnt(struct fsldma_chan *chan,
         hw->count = CPU_TO_DMA(chan, count, 32);
 }
 
-static u32 get_desc_cnt(struct fsldma_chan *chan, struct fsl_desc_sw *desc)
-{
-        return DMA_TO_CPU(chan, desc->hw.count, 32);
-}
-
 static void set_desc_src(struct fsldma_chan *chan,
                          struct fsl_dma_ld_hw *hw, dma_addr_t src)
 {
@@ -101,16 +96,6 @@ static void set_desc_src(struct fsldma_chan *chan,
         hw->src_addr = CPU_TO_DMA(chan, snoop_bits | src, 64);
 }
 
-static dma_addr_t get_desc_src(struct fsldma_chan *chan,
-                               struct fsl_desc_sw *desc)
-{
-        u64 snoop_bits;
-
-        snoop_bits = ((chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
-                ? ((u64)FSL_DMA_SATR_SREADTYPE_SNOOP_READ << 32) : 0;
-        return DMA_TO_CPU(chan, desc->hw.src_addr, 64) & ~snoop_bits;
-}
-
 static void set_desc_dst(struct fsldma_chan *chan,
                          struct fsl_dma_ld_hw *hw, dma_addr_t dst)
 {
@@ -121,16 +106,6 @@ static void set_desc_dst(struct fsldma_chan *chan,
         hw->dst_addr = CPU_TO_DMA(chan, snoop_bits | dst, 64);
 }
 
-static dma_addr_t get_desc_dst(struct fsldma_chan *chan,
-                               struct fsl_desc_sw *desc)
-{
-        u64 snoop_bits;
-
-        snoop_bits = ((chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
-                ? ((u64)FSL_DMA_DATR_DWRITETYPE_SNOOP_WRITE << 32) : 0;
-        return DMA_TO_CPU(chan, desc->hw.dst_addr, 64) & ~snoop_bits;
-}
-
 static void set_desc_next(struct fsldma_chan *chan,
                           struct fsl_dma_ld_hw *hw, dma_addr_t next)
 {
@@ -408,7 +383,7 @@ static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
         struct fsl_desc_sw *desc = tx_to_fsl_desc(tx);
         struct fsl_desc_sw *child;
         unsigned long flags;
-        dma_cookie_t cookie;
+        dma_cookie_t cookie = -EINVAL;
 
         spin_lock_irqsave(&chan->desc_lock, flags);
 
@@ -854,10 +829,6 @@ static void fsldma_cleanup_descriptor(struct fsldma_chan *chan,
                                       struct fsl_desc_sw *desc)
 {
         struct dma_async_tx_descriptor *txd = &desc->async_tx;
-        struct device *dev = chan->common.device->dev;
-        dma_addr_t src = get_desc_src(chan, desc);
-        dma_addr_t dst = get_desc_dst(chan, desc);
-        u32 len = get_desc_cnt(chan, desc);
 
         /* Run the link descriptor callback function */
         if (txd->callback) {
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 1a49c777607c..87529181efcc 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -817,7 +817,15 @@ int ioat_dma_self_test(struct ioatdma_device *device)
         }
 
         dma_src = dma_map_single(dev, src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
+        if (dma_mapping_error(dev, dma_src)) {
+                dev_err(dev, "mapping src buffer failed\n");
+                goto free_resources;
+        }
         dma_dest = dma_map_single(dev, dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
+        if (dma_mapping_error(dev, dma_dest)) {
+                dev_err(dev, "mapping dest buffer failed\n");
+                goto unmap_src;
+        }
         flags = DMA_PREP_INTERRUPT;
         tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
                                                    IOAT_TEST_SIZE, flags);
@@ -855,8 +863,9 @@ int ioat_dma_self_test(struct ioatdma_device *device)
         }
 
 unmap_dma:
-        dma_unmap_single(dev, dma_src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
         dma_unmap_single(dev, dma_dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
+unmap_src:
+        dma_unmap_single(dev, dma_src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
 free_resources:
         dma->device_free_chan_resources(dma_chan);
 out:
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 7807f0ef4e20..53fb0c8365b0 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -54,12 +54,6 @@ static void mv_desc_init(struct mv_xor_desc_slot *desc, unsigned long flags)
         hw_desc->desc_command = (1 << 31);
 }
 
-static u32 mv_desc_get_dest_addr(struct mv_xor_desc_slot *desc)
-{
-        struct mv_xor_desc *hw_desc = desc->hw_desc;
-        return hw_desc->phy_dest_addr;
-}
-
 static void mv_desc_set_byte_count(struct mv_xor_desc_slot *desc,
                                    u32 byte_count)
 {
@@ -787,7 +781,6 @@ static void mv_xor_issue_pending(struct dma_chan *chan)
 /*
  * Perform a transaction to verify the HW works.
  */
-#define MV_XOR_TEST_SIZE 2000
 
 static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
 {
@@ -797,20 +790,21 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
         struct dma_chan *dma_chan;
         dma_cookie_t cookie;
         struct dma_async_tx_descriptor *tx;
+        struct dmaengine_unmap_data *unmap;
         int err = 0;
 
-        src = kmalloc(sizeof(u8) * MV_XOR_TEST_SIZE, GFP_KERNEL);
+        src = kmalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
         if (!src)
                 return -ENOMEM;
 
-        dest = kzalloc(sizeof(u8) * MV_XOR_TEST_SIZE, GFP_KERNEL);
+        dest = kzalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
         if (!dest) {
                 kfree(src);
                 return -ENOMEM;
         }
 
         /* Fill in src buffer */
-        for (i = 0; i < MV_XOR_TEST_SIZE; i++)
+        for (i = 0; i < PAGE_SIZE; i++)
                 ((u8 *) src)[i] = (u8)i;
 
         dma_chan = &mv_chan->dmachan;
@@ -819,14 +813,26 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
                 goto out;
         }
 
-        dest_dma = dma_map_single(dma_chan->device->dev, dest,
-                                  MV_XOR_TEST_SIZE, DMA_FROM_DEVICE);
+        unmap = dmaengine_get_unmap_data(dma_chan->device->dev, 2, GFP_KERNEL);
+        if (!unmap) {
+                err = -ENOMEM;
+                goto free_resources;
+        }
+
+        src_dma = dma_map_page(dma_chan->device->dev, virt_to_page(src), 0,
+                                 PAGE_SIZE, DMA_TO_DEVICE);
+        unmap->to_cnt = 1;
+        unmap->addr[0] = src_dma;
 
-        src_dma = dma_map_single(dma_chan->device->dev, src,
-                                 MV_XOR_TEST_SIZE, DMA_TO_DEVICE);
+        dest_dma = dma_map_page(dma_chan->device->dev, virt_to_page(dest), 0,
+                                  PAGE_SIZE, DMA_FROM_DEVICE);
+        unmap->from_cnt = 1;
+        unmap->addr[1] = dest_dma;
+
+        unmap->len = PAGE_SIZE;
 
         tx = mv_xor_prep_dma_memcpy(dma_chan, dest_dma, src_dma,
-                                    MV_XOR_TEST_SIZE, 0);
+                                    PAGE_SIZE, 0);
         cookie = mv_xor_tx_submit(tx);
         mv_xor_issue_pending(dma_chan);
         async_tx_ack(tx);
@@ -841,8 +847,8 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
         }
 
         dma_sync_single_for_cpu(dma_chan->device->dev, dest_dma,
-                                MV_XOR_TEST_SIZE, DMA_FROM_DEVICE);
-        if (memcmp(src, dest, MV_XOR_TEST_SIZE)) {
+                                PAGE_SIZE, DMA_FROM_DEVICE);
+        if (memcmp(src, dest, PAGE_SIZE)) {
                 dev_err(dma_chan->device->dev,
                         "Self-test copy failed compare, disabling\n");
                 err = -ENODEV;
@@ -850,6 +856,7 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
         }
 
 free_resources:
+        dmaengine_unmap_put(unmap);
         mv_xor_free_chan_resources(dma_chan);
 out:
         kfree(src);
@@ -867,13 +874,15 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
         dma_addr_t dma_srcs[MV_XOR_NUM_SRC_TEST];
         dma_addr_t dest_dma;
         struct dma_async_tx_descriptor *tx;
+        struct dmaengine_unmap_data *unmap;
         struct dma_chan *dma_chan;
         dma_cookie_t cookie;
         u8 cmp_byte = 0;
         u32 cmp_word;
         int err = 0;
+        int src_count = MV_XOR_NUM_SRC_TEST;
 
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
+        for (src_idx = 0; src_idx < src_count; src_idx++) {
                 xor_srcs[src_idx] = alloc_page(GFP_KERNEL);
                 if (!xor_srcs[src_idx]) {
                         while (src_idx--)
@@ -890,13 +899,13 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
         }
 
         /* Fill in src buffers */
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
+        for (src_idx = 0; src_idx < src_count; src_idx++) {
                 u8 *ptr = page_address(xor_srcs[src_idx]);
                 for (i = 0; i < PAGE_SIZE; i++)
                         ptr[i] = (1 << src_idx);
         }
 
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++)
+        for (src_idx = 0; src_idx < src_count; src_idx++)
                 cmp_byte ^= (u8) (1 << src_idx);
 
         cmp_word = (cmp_byte << 24) | (cmp_byte << 16) |
@@ -910,16 +919,29 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
                 goto out;
         }
 
+        unmap = dmaengine_get_unmap_data(dma_chan->device->dev, src_count + 1,
+                                         GFP_KERNEL);
+        if (!unmap) {
+                err = -ENOMEM;
+                goto free_resources;
+        }
+
         /* test xor */
-        dest_dma = dma_map_page(dma_chan->device->dev, dest, 0, PAGE_SIZE,
-                                DMA_FROM_DEVICE);
+        for (i = 0; i < src_count; i++) {
+                unmap->addr[i] = dma_map_page(dma_chan->device->dev, xor_srcs[i],
+                                              0, PAGE_SIZE, DMA_TO_DEVICE);
+                dma_srcs[i] = unmap->addr[i];
+                unmap->to_cnt++;
+        }
 
-        for (i = 0; i < MV_XOR_NUM_SRC_TEST; i++)
-                dma_srcs[i] = dma_map_page(dma_chan->device->dev, xor_srcs[i],
-                                           0, PAGE_SIZE, DMA_TO_DEVICE);
+        unmap->addr[src_count] = dma_map_page(dma_chan->device->dev, dest, 0, PAGE_SIZE,
+                                      DMA_FROM_DEVICE);
+        dest_dma = unmap->addr[src_count];
+        unmap->from_cnt = 1;
+        unmap->len = PAGE_SIZE;
 
         tx = mv_xor_prep_dma_xor(dma_chan, dest_dma, dma_srcs,
-                                 MV_XOR_NUM_SRC_TEST, PAGE_SIZE, 0);
+                                 src_count, PAGE_SIZE, 0);
 
         cookie = mv_xor_tx_submit(tx);
         mv_xor_issue_pending(dma_chan);
@@ -948,9 +970,10 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
         }
 
 free_resources:
+        dmaengine_unmap_put(unmap);
         mv_xor_free_chan_resources(dma_chan);
 out:
-        src_idx = MV_XOR_NUM_SRC_TEST;
+        src_idx = src_count;
         while (src_idx--)
                 __free_page(xor_srcs[src_idx]);
         __free_page(dest);
@@ -1176,6 +1199,7 @@ static int mv_xor_probe(struct platform_device *pdev)
                 int i = 0;
 
                 for_each_child_of_node(pdev->dev.of_node, np) {
+                        struct mv_xor_chan *chan;
                         dma_cap_mask_t cap_mask;
                         int irq;
 
@@ -1193,21 +1217,21 @@ static int mv_xor_probe(struct platform_device *pdev)
                                 goto err_channel_add;
                         }
 
-                        xordev->channels[i] =
-                                mv_xor_channel_add(xordev, pdev, i,
-                                                   cap_mask, irq);
-                        if (IS_ERR(xordev->channels[i])) {
-                                ret = PTR_ERR(xordev->channels[i]);
-                                xordev->channels[i] = NULL;
+                        chan = mv_xor_channel_add(xordev, pdev, i,
+                                                  cap_mask, irq);
+                        if (IS_ERR(chan)) {
+                                ret = PTR_ERR(chan);
                                 irq_dispose_mapping(irq);
                                 goto err_channel_add;
                         }
 
+                        xordev->channels[i] = chan;
                         i++;
                 }
         } else if (pdata && pdata->channels) {
                 for (i = 0; i < MV_XOR_MAX_CHANNELS; i++) {
                         struct mv_xor_channel_data *cd;
+                        struct mv_xor_chan *chan;
                         int irq;
 
                         cd = &pdata->channels[i];
@@ -1222,13 +1246,14 @@ static int mv_xor_probe(struct platform_device *pdev)
                                 goto err_channel_add;
                         }
 
-                        xordev->channels[i] =
-                                mv_xor_channel_add(xordev, pdev, i,
-                                                   cd->cap_mask, irq);
-                        if (IS_ERR(xordev->channels[i])) {
-                                ret = PTR_ERR(xordev->channels[i]);
+                        chan = mv_xor_channel_add(xordev, pdev, i,
+                                                  cd->cap_mask, irq);
+                        if (IS_ERR(chan)) {
+                                ret = PTR_ERR(chan);
                                 goto err_channel_add;
                         }
+
+                        xordev->channels[i] = chan;
                 }
         }
 
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index cdf0483b8f2d..536632f6479c 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2492,12 +2492,9 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
 
 static inline void _init_desc(struct dma_pl330_desc *desc)
 {
-        desc->pchan = NULL;
         desc->req.x = &desc->px;
         desc->req.token = desc;
         desc->rqcfg.swap = SWAP_NO;
-        desc->rqcfg.privileged = 0;
-        desc->rqcfg.insnaccess = 0;
         desc->rqcfg.scctl = SCCTRL0;
         desc->rqcfg.dcctl = DCCTRL0;
         desc->req.cfg = &desc->rqcfg;
@@ -2517,7 +2514,7 @@ static int add_desc(struct dma_pl330_dmac *pdmac, gfp_t flg, int count)
         if (!pdmac)
                 return 0;
 
-        desc = kmalloc(count * sizeof(*desc), flg);
+        desc = kcalloc(count, sizeof(*desc), flg);
         if (!desc)
                 return 0;
 
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index 8da48c6b2a38..8bba298535b0 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -533,29 +533,6 @@ static void ppc440spe_desc_init_memcpy(struct ppc440spe_adma_desc_slot *desc,
 }
 
 /**
- * ppc440spe_desc_init_memset - initialize the descriptor for MEMSET operation
- */
-static void ppc440spe_desc_init_memset(struct ppc440spe_adma_desc_slot *desc,
-                                        int value, unsigned long flags)
-{
-        struct dma_cdb *hw_desc = desc->hw_desc;
-
-        memset(desc->hw_desc, 0, sizeof(struct dma_cdb));
-        desc->hw_next = NULL;
-        desc->src_cnt = 1;
-        desc->dst_cnt = 1;
-
-        if (flags & DMA_PREP_INTERRUPT)
-                set_bit(PPC440SPE_DESC_INT, &desc->flags);
-        else
-                clear_bit(PPC440SPE_DESC_INT, &desc->flags);
-
-        hw_desc->sg1u = hw_desc->sg1l = cpu_to_le32((u32)value);
-        hw_desc->sg3u = hw_desc->sg3l = cpu_to_le32((u32)value);
-        hw_desc->opc = DMA_CDB_OPC_DFILL128;
-}
-
-/**
  * ppc440spe_desc_set_src_addr - set source address into the descriptor
  */
 static void ppc440spe_desc_set_src_addr(struct ppc440spe_adma_desc_slot *desc,
@@ -1504,8 +1481,6 @@ static dma_cookie_t ppc440spe_adma_run_tx_complete_actions(
                 struct ppc440spe_adma_chan *chan,
                 dma_cookie_t cookie)
 {
-        int i;
-
         BUG_ON(desc->async_tx.cookie < 0);
         if (desc->async_tx.cookie > 0) {
                 cookie = desc->async_tx.cookie;
@@ -3898,7 +3873,7 @@ static void ppc440spe_adma_init_capabilities(struct ppc440spe_adma_device *adev)
                         ppc440spe_adma_prep_dma_interrupt;
         }
         pr_info("%s: AMCC(R) PPC440SP(E) ADMA Engine: "
-          "( %s%s%s%s%s%s%s)\n",
+          "( %s%s%s%s%s%s)\n",
           dev_name(adev->dev),
           dma_has_cap(DMA_PQ, adev->common.cap_mask) ? "pq " : "",
           dma_has_cap(DMA_PQ_VAL, adev->common.cap_mask) ? "pq_val " : "",
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index bae6c29f5502..17686caf64d5 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -406,7 +406,6 @@ txx9dmac_descriptor_complete(struct txx9dmac_chan *dc,
         dma_async_tx_callback callback;
         void *param;
         struct dma_async_tx_descriptor *txd = &desc->txd;
-        struct txx9dmac_slave *ds = dc->chan.private;
 
         dev_vdbg(chan2dev(&dc->chan), "descriptor %u %p complete\n",
                  txd->cookie, desc);
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index b0bb056458a3..281029daf98c 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1623,7 +1623,6 @@ static struct scsi_host_template scsi_driver_template = {
         .cmd_per_lun            = 1,
         .can_queue              = 1,
         .sdev_attrs             = sbp2_scsi_sysfs_attrs,
-        .no_write_same          = 1,
 };
 
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/firmware/Makefile b/drivers/firmware/Makefile
index 299fad6b5867..5373dc5b6011 100644
--- a/drivers/firmware/Makefile
+++ b/drivers/firmware/Makefile
@@ -14,3 +14,4 @@ obj-$(CONFIG_FIRMWARE_MEMMAP)	+= memmap.o
 
 obj-$(CONFIG_GOOGLE_FIRMWARE)   += google/
 obj-$(CONFIG_EFI)               += efi/
+obj-$(CONFIG_UEFI_CPER)         += efi/
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index 3150aa4874e8..6aecbc86ec94 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -36,7 +36,7 @@ config EFI_VARS_PSTORE_DEFAULT_DISABLE
           backend for pstore by default. This setting can be overridden
           using the efivars module's pstore_disable parameter.
 
-config UEFI_CPER
-        def_bool n
-
 endmenu
+
+config UEFI_CPER
+        bool
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
index 9ba156d3c775..6c2a41ec21ba 100644
--- a/drivers/firmware/efi/Makefile
+++ b/drivers/firmware/efi/Makefile
@@ -1,7 +1,7 @@
 #
 # Makefile for linux kernel
 #
-obj-y                                   += efi.o vars.o
+obj-$(CONFIG_EFI)                       += efi.o vars.o
 obj-$(CONFIG_EFI_VARS)                  += efivars.o
 obj-$(CONFIG_EFI_VARS_PSTORE)           += efi-pstore.o
 obj-$(CONFIG_UEFI_CPER)                 += cper.o
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 743fd426f21b..4b9dc836dcf9 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -356,6 +356,7 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
 static struct pstore_info efi_pstore_info = {
         .owner          = THIS_MODULE,
         .name           = "efi",
+        .flags          = PSTORE_FLAGS_FRAGILE,
         .open           = efi_pstore_open,
         .close          = efi_pstore_close,
         .read           = efi_pstore_read,
diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
index 7b37300973db..2baf0ddf7e02 100644
--- a/drivers/gpio/gpio-msm-v2.c
+++ b/drivers/gpio/gpio-msm-v2.c
@@ -252,7 +252,7 @@ static void msm_gpio_irq_mask(struct irq_data *d)
 
         spin_lock_irqsave(&tlmm_lock, irq_flags);
         writel(TARGET_PROC_NONE, GPIO_INTR_CFG_SU(gpio));
-        clear_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
+        clear_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
         __clear_bit(gpio, msm_gpio.enabled_irqs);
         spin_unlock_irqrestore(&tlmm_lock, irq_flags);
 }
@@ -264,7 +264,7 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
 
         spin_lock_irqsave(&tlmm_lock, irq_flags);
         __set_bit(gpio, msm_gpio.enabled_irqs);
-        set_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
+        set_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
         writel(TARGET_PROC_SCORPION, GPIO_INTR_CFG_SU(gpio));
         spin_unlock_irqrestore(&tlmm_lock, irq_flags);
 }
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index fe088a30567a..8b7e719a68c3 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -169,7 +169,8 @@ static irqreturn_t gpio_rcar_irq_handler(int irq, void *dev_id)
         u32 pending;
         unsigned int offset, irqs_handled = 0;
 
-        while ((pending = gpio_rcar_read(p, INTDT))) {
+        while ((pending = gpio_rcar_read(p, INTDT) &
+                          gpio_rcar_read(p, INTMSK))) {
                 offset = __ffs(pending);
                 gpio_rcar_write(p, INTCLR, BIT(offset));
                 generic_handle_irq(irq_find_mapping(p->irq_domain, offset));
diff --git a/drivers/gpio/gpio-twl4030.c b/drivers/gpio/gpio-twl4030.c
index b97d6a6577b9..f9996899c1f2 100644
--- a/drivers/gpio/gpio-twl4030.c
+++ b/drivers/gpio/gpio-twl4030.c
@@ -300,7 +300,7 @@ static int twl_direction_in(struct gpio_chip *chip, unsigned offset)
         if (offset < TWL4030_GPIO_MAX)
                 ret = twl4030_set_gpio_direction(offset, 1);
         else
-                ret = -EINVAL;
+                ret = -EINVAL;  /* LED outputs can't be set as input */
 
         if (!ret)
                 priv->direction &= ~BIT(offset);
@@ -354,11 +354,20 @@ static void twl_set(struct gpio_chip *chip, unsigned offset, int value)
 static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
 {
         struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
-        int ret = -EINVAL;
+        int ret = 0;
 
         mutex_lock(&priv->mutex);
-        if (offset < TWL4030_GPIO_MAX)
+        if (offset < TWL4030_GPIO_MAX) {
                 ret = twl4030_set_gpio_direction(offset, 0);
+                if (ret) {
+                        mutex_unlock(&priv->mutex);
+                        return ret;
+                }
+        }
+
+        /*
+         *  LED gpios i.e. offset >= TWL4030_GPIO_MAX are always output
+         */
 
         priv->direction |= BIT(offset);
         mutex_unlock(&priv->mutex);
diff --git a/drivers/gpu/drm/armada/armada_drm.h b/drivers/gpu/drm/armada/armada_drm.h
index eef09ec9a5ff..a72cae03b99b 100644
--- a/drivers/gpu/drm/armada/armada_drm.h
+++ b/drivers/gpu/drm/armada/armada_drm.h
@@ -103,6 +103,7 @@ void armada_drm_queue_unref_work(struct drm_device *,
 extern const struct drm_mode_config_funcs armada_drm_mode_config_funcs;
 
 int armada_fbdev_init(struct drm_device *);
+void armada_fbdev_lastclose(struct drm_device *);
 void armada_fbdev_fini(struct drm_device *);
 
 int armada_overlay_plane_create(struct drm_device *, unsigned long);
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index 069f64533ac3..acf3a36c9ebc 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -322,6 +322,11 @@ static struct drm_ioctl_desc armada_ioctls[] = {
                 DRM_UNLOCKED),
 };
 
+static void armada_drm_lastclose(struct drm_device *dev)
+{
+        armada_fbdev_lastclose(dev);
+}
+
 static const struct file_operations armada_drm_fops = {
         .owner                  = THIS_MODULE,
         .llseek                 = no_llseek,
@@ -338,7 +343,7 @@ static struct drm_driver armada_drm_driver = {
         .open                   = NULL,
         .preclose               = NULL,
         .postclose              = NULL,
-        .lastclose              = NULL,
+        .lastclose              = armada_drm_lastclose,
         .unload                 = armada_drm_unload,
         .get_vblank_counter     = drm_vblank_count,
         .enable_vblank          = armada_drm_enable_vblank,
diff --git a/drivers/gpu/drm/armada/armada_fbdev.c b/drivers/gpu/drm/armada/armada_fbdev.c
index dd5ea77dac96..948cb14c561e 100644
--- a/drivers/gpu/drm/armada/armada_fbdev.c
+++ b/drivers/gpu/drm/armada/armada_fbdev.c
@@ -105,9 +105,9 @@ static int armada_fb_create(struct drm_fb_helper *fbh,
         drm_fb_helper_fill_fix(info, dfb->fb.pitches[0], dfb->fb.depth);
         drm_fb_helper_fill_var(info, fbh, sizes->fb_width, sizes->fb_height);
 
-        DRM_DEBUG_KMS("allocated %dx%d %dbpp fb: 0x%08x\n",
-                dfb->fb.width, dfb->fb.height,
-                dfb->fb.bits_per_pixel, obj->phys_addr);
+        DRM_DEBUG_KMS("allocated %dx%d %dbpp fb: 0x%08llx\n",
+                dfb->fb.width, dfb->fb.height, dfb->fb.bits_per_pixel,
+                (unsigned long long)obj->phys_addr);
 
         return 0;
 
@@ -177,6 +177,16 @@ int armada_fbdev_init(struct drm_device *dev)
         return ret;
 }
 
+void armada_fbdev_lastclose(struct drm_device *dev)
+{
+        struct armada_private *priv = dev->dev_private;
+
+        drm_modeset_lock_all(dev);
+        if (priv->fbdev)
+                drm_fb_helper_restore_fbdev_mode(priv->fbdev);
+        drm_modeset_unlock_all(dev);
+}
+
 void armada_fbdev_fini(struct drm_device *dev)
 {
         struct armada_private *priv = dev->dev_private;
@@ -192,11 +202,11 @@ void armada_fbdev_fini(struct drm_device *dev)
                         framebuffer_release(info);
                 }
 
+                drm_fb_helper_fini(fbh);
+
                 if (fbh->fb)
                         fbh->fb->funcs->destroy(fbh->fb);
 
-                drm_fb_helper_fini(fbh);
-
                 priv->fbdev = NULL;
         }
 }
diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c
index 9f2356bae7fd..887816f43476 100644
--- a/drivers/gpu/drm/armada/armada_gem.c
+++ b/drivers/gpu/drm/armada/armada_gem.c
@@ -172,8 +172,9 @@ armada_gem_linear_back(struct drm_device *dev, struct armada_gem_object *obj)
                 obj->dev_addr = obj->linear->start;
         }
 
-        DRM_DEBUG_DRIVER("obj %p phys %#x dev %#x\n",
-                         obj, obj->phys_addr, obj->dev_addr);
+        DRM_DEBUG_DRIVER("obj %p phys %#llx dev %#llx\n", obj,
+                         (unsigned long long)obj->phys_addr,
+                         (unsigned long long)obj->dev_addr);
 
         return 0;
 }
@@ -557,7 +558,6 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf)
                          * refcount on the gem object itself.
                          */
                         drm_gem_object_reference(obj);
-                        dma_buf_put(buf);
                         return obj;
                 }
         }
@@ -573,6 +573,7 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf)
         }
 
         dobj->obj.import_attach = attach;
+        get_dma_buf(buf);
 
         /*
          * Don't call dma_buf_map_attachment() here - it maps the
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 0a1e4a5f4234..8835dcddfac3 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -68,6 +68,8 @@
 #define EDID_QUIRK_DETAILED_SYNC_PP             (1 << 6)
 /* Force reduced-blanking timings for detailed modes */
 #define EDID_QUIRK_FORCE_REDUCED_BLANKING       (1 << 7)
+/* Force 8bpc */
+#define EDID_QUIRK_FORCE_8BPC                   (1 << 8)
 
 struct detailed_mode_closure {
         struct drm_connector *connector;
@@ -128,6 +130,9 @@ static struct edid_quirk {
 
         /* Medion MD 30217 PG */
         { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+
+        /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
+        { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
 };
 
 /*
@@ -3435,6 +3440,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
 
         drm_add_display_info(edid, &connector->display_info);
 
+        if (quirks & EDID_QUIRK_FORCE_8BPC)
+                connector->display_info.bpc = 8;
+
         return num_modes;
 }
 EXPORT_SYMBOL(drm_add_edid_modes);
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 85071a1c4547..b0733153dfd2 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1041,7 +1041,7 @@ void drm_mode_connector_list_update(struct drm_connector *connector)
                                 /* if equal delete the probed mode */
                                 mode->status = pmode->status;
                                 /* Merge type bits together */
-                                mode->type = pmode->type;
+                                mode->type |= pmode->type;
                                 list_del(&pmode->head);
                                 drm_mode_destroy(connector->dev, pmode);
                                 break;
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index a4a5c6ac110a..98a33c580ca1 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -564,11 +564,11 @@ err_unload:
         if (dev->driver->unload)
                 dev->driver->unload(dev);
 err_primary_node:
-        drm_put_minor(dev->primary);
+        drm_unplug_minor(dev->primary);
 err_render_node:
-        drm_put_minor(dev->render);
+        drm_unplug_minor(dev->render);
 err_control_node:
-        drm_put_minor(dev->control);
+        drm_unplug_minor(dev->control);
 out_unlock:
         mutex_unlock(&drm_global_mutex);
         return ret;
diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
index 41838eaa799c..da682cbcb806 100644
--- a/drivers/gpu/drm/i915/Makefile
+++ b/drivers/gpu/drm/i915/Makefile
@@ -4,7 +4,6 @@
 
 ccflags-y := -Iinclude/drm
 i915-y := i915_drv.o i915_dma.o i915_irq.o \
-          i915_debugfs.o \
           i915_gpu_error.o \
           i915_suspend.o \
           i915_gem.o \
@@ -55,6 +54,8 @@ i915-$(CONFIG_ACPI)	+= intel_acpi.o
 
 i915-$(CONFIG_DRM_I915_FBDEV) += intel_fbdev.o
 
+i915-$(CONFIG_DEBUG_FS) += i915_debugfs.o
+
 obj-$(CONFIG_DRM_I915)  += i915.o
 
 CFLAGS_i915_trace_points.o := -I$(src)
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 6badc1596ceb..b2b46c52294c 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -40,8 +40,6 @@
 #include <drm/i915_drm.h>
 #include "i915_drv.h"
 
-#if defined(CONFIG_DEBUG_FS)
-
 enum {
         ACTIVE_LIST,
         INACTIVE_LIST,
@@ -406,16 +404,26 @@ static int i915_gem_object_info(struct seq_file *m, void* data)
         seq_putc(m, '\n');
         list_for_each_entry_reverse(file, &dev->filelist, lhead) {
                 struct file_stats stats;
+                struct task_struct *task;
 
                 memset(&stats, 0, sizeof(stats));
                 idr_for_each(&file->object_idr, per_file_stats, &stats);
+                /*
+                 * Although we have a valid reference on file->pid, that does
+                 * not guarantee that the task_struct who called get_pid() is
+                 * still alive (e.g. get_pid(current) => fork() => exit()).
+                 * Therefore, we need to protect this ->comm access using RCU.
+                 */
+                rcu_read_lock();
+                task = pid_task(file->pid, PIDTYPE_PID);
                 seq_printf(m, "%s: %u objects, %zu bytes (%zu active, %zu inactive, %zu unbound)\n",
-                           get_pid_task(file->pid, PIDTYPE_PID)->comm,
+                           task ? task->comm : "<unknown>",
                            stats.count,
                            stats.total,
                            stats.active,
                            stats.inactive,
                            stats.unbound);
+                rcu_read_unlock();
         }
 
         mutex_unlock(&dev->struct_mutex);
@@ -1170,6 +1178,50 @@ static int ironlake_drpc_info(struct seq_file *m)
         return 0;
 }
 
+static int vlv_drpc_info(struct seq_file *m)
+{
+
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 rpmodectl1, rcctl1;
+        unsigned fw_rendercount = 0, fw_mediacount = 0;
+
+        rpmodectl1 = I915_READ(GEN6_RP_CONTROL);
+        rcctl1 = I915_READ(GEN6_RC_CONTROL);
+
+        seq_printf(m, "Video Turbo Mode: %s\n",
+                   yesno(rpmodectl1 & GEN6_RP_MEDIA_TURBO));
+        seq_printf(m, "Turbo enabled: %s\n",
+                   yesno(rpmodectl1 & GEN6_RP_ENABLE));
+        seq_printf(m, "HW control enabled: %s\n",
+                   yesno(rpmodectl1 & GEN6_RP_ENABLE));
+        seq_printf(m, "SW control enabled: %s\n",
+                   yesno((rpmodectl1 & GEN6_RP_MEDIA_MODE_MASK) ==
+                          GEN6_RP_MEDIA_SW_MODE));
+        seq_printf(m, "RC6 Enabled: %s\n",
+                   yesno(rcctl1 & (GEN7_RC_CTL_TO_MODE |
+                                        GEN6_RC_CTL_EI_MODE(1))));
+        seq_printf(m, "Render Power Well: %s\n",
+                        (I915_READ(VLV_GTLC_PW_STATUS) &
+                                VLV_GTLC_PW_RENDER_STATUS_MASK) ? "Up" : "Down");
+        seq_printf(m, "Media Power Well: %s\n",
+                        (I915_READ(VLV_GTLC_PW_STATUS) &
+                                VLV_GTLC_PW_MEDIA_STATUS_MASK) ? "Up" : "Down");
+
+        spin_lock_irq(&dev_priv->uncore.lock);
+        fw_rendercount = dev_priv->uncore.fw_rendercount;
+        fw_mediacount = dev_priv->uncore.fw_mediacount;
+        spin_unlock_irq(&dev_priv->uncore.lock);
+
+        seq_printf(m, "Forcewake Render Count = %u\n", fw_rendercount);
+        seq_printf(m, "Forcewake Media Count = %u\n", fw_mediacount);
+
+
+        return 0;
+}
+
+
 static int gen6_drpc_info(struct seq_file *m)
 {
 
@@ -1275,7 +1327,9 @@ static int i915_drpc_info(struct seq_file *m, void *unused)
         struct drm_info_node *node = (struct drm_info_node *) m->private;
         struct drm_device *dev = node->minor->dev;
 
-        if (IS_GEN6(dev) || IS_GEN7(dev))
+        if (IS_VALLEYVIEW(dev))
+                return vlv_drpc_info(m);
+        else if (IS_GEN6(dev) || IS_GEN7(dev))
                 return gen6_drpc_info(m);
         else
                 return ironlake_drpc_info(m);
@@ -1287,7 +1341,7 @@ static int i915_fbc_status(struct seq_file *m, void *unused)
         struct drm_device *dev = node->minor->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
 
-        if (!I915_HAS_FBC(dev)) {
+        if (!HAS_FBC(dev)) {
                 seq_puts(m, "FBC unsupported on this chipset\n");
                 return 0;
         }
@@ -1349,7 +1403,7 @@ static int i915_ips_status(struct seq_file *m, void *unused)
                 return 0;
         }
 
-        if (I915_READ(IPS_CTL) & IPS_ENABLE)
+        if (IS_BROADWELL(dev) || I915_READ(IPS_CTL) & IPS_ENABLE)
                 seq_puts(m, "enabled\n");
         else
                 seq_puts(m, "disabled\n");
@@ -2117,8 +2171,8 @@ static int i915_pipe_crc_create(struct dentry *root, struct drm_minor *minor,
         info->dev = dev;
         ent = debugfs_create_file(info->name, S_IRUGO, root, info,
                                   &i915_pipe_crc_fops);
-        if (IS_ERR(ent))
-                return PTR_ERR(ent);
+        if (!ent)
+                return -ENOMEM;
 
         return drm_add_fake_info_node(minor, ent, info);
 }
@@ -3133,8 +3187,8 @@ static int i915_forcewake_create(struct dentry *root, struct drm_minor *minor)
                                   S_IRUSR,
                                   root, dev,
                                   &i915_forcewake_fops);
-        if (IS_ERR(ent))
-                return PTR_ERR(ent);
+        if (!ent)
+                return -ENOMEM;
 
         return drm_add_fake_info_node(minor, ent, &i915_forcewake_fops);
 }
@@ -3151,8 +3205,8 @@ static int i915_debugfs_create(struct dentry *root,
                                   S_IRUGO | S_IWUSR,
                                   root, dev,
                                   fops);
-        if (IS_ERR(ent))
-                return PTR_ERR(ent);
+        if (!ent)
+                return -ENOMEM;
 
         return drm_add_fake_info_node(minor, ent, fops);
 }
@@ -3282,5 +3336,3 @@ void i915_debugfs_cleanup(struct drm_minor *minor)
                 drm_debugfs_remove_files(info_list, 1, minor);
         }
 }
-
-#endif /* CONFIG_DEBUG_FS */
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 750918c779c8..e177d021c444 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -85,6 +85,14 @@ void i915_update_dri1_breadcrumb(struct drm_device *dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_master_private *master_priv;
 
+        /*
+         * The dri breadcrumb update races against the drm master disappearing.
+         * Instead of trying to fix this (this is by far not the only ums issue)
+         * just don't do the update in kms mode.
+         */
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                return;
+
         if (dev->primary->master) {
                 master_priv = dev->primary->master->driver_priv;
                 if (master_priv->sarea_priv)
@@ -1405,7 +1413,7 @@ void i915_master_destroy(struct drm_device *dev, struct drm_master *master)
         master->driver_priv = NULL;
 }
 
-#ifdef CONFIG_DRM_I915_FBDEV
+#if IS_ENABLED(CONFIG_FB)
 static void i915_kick_out_firmware_fb(struct drm_i915_private *dev_priv)
 {
         struct apertures_struct *ap;
@@ -1496,16 +1504,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         spin_lock_init(&dev_priv->uncore.lock);
         spin_lock_init(&dev_priv->mm.object_stat_lock);
         mutex_init(&dev_priv->dpio_lock);
-        mutex_init(&dev_priv->rps.hw_lock);
         mutex_init(&dev_priv->modeset_restore_lock);
 
-        mutex_init(&dev_priv->pc8.lock);
-        dev_priv->pc8.requirements_met = false;
-        dev_priv->pc8.gpu_idle = false;
-        dev_priv->pc8.irqs_disabled = false;
-        dev_priv->pc8.enabled = false;
-        dev_priv->pc8.disable_count = 2; /* requirements_met + gpu_idle */
-        INIT_DELAYED_WORK(&dev_priv->pc8.enable_work, hsw_enable_pc8_work);
+        intel_pm_setup(dev);
 
         intel_display_crc_init(dev);
 
@@ -1609,7 +1610,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         }
 
         intel_irq_init(dev);
-        intel_pm_init(dev);
         intel_uncore_sanitize(dev);
 
         /* Try to make sure MCHBAR is enabled before poking at it */
@@ -1855,8 +1855,10 @@ void i915_driver_lastclose(struct drm_device * dev)
 
 void i915_driver_preclose(struct drm_device * dev, struct drm_file *file_priv)
 {
+        mutex_lock(&dev->struct_mutex);
         i915_gem_context_close(dev, file_priv);
         i915_gem_release(dev, file_priv);
+        mutex_unlock(&dev->struct_mutex);
 }
 
 void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 74516930de7a..43245b3fd2a2 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -480,12 +480,12 @@ check_next:
 bool i915_semaphore_is_enabled(struct drm_device *dev)
 {
         if (INTEL_INFO(dev)->gen < 6)
-                return 0;
+                return false;
 
         /* Until we get further testing... */
         if (IS_GEN8(dev)) {
                 WARN_ON(!i915_preliminary_hw_support);
-                return 0;
+                return false;
         }
 
         if (i915_semaphores >= 0)
@@ -497,7 +497,7 @@ bool i915_semaphore_is_enabled(struct drm_device *dev)
                 return false;
 #endif
 
-        return 1;
+        return true;
 }
 
 static int i915_drm_freeze(struct drm_device *dev)
@@ -657,6 +657,7 @@ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
                 intel_modeset_init_hw(dev);
 
                 drm_modeset_lock_all(dev);
+                drm_mode_config_reset(dev);
                 intel_modeset_setup_hw_state(dev, true);
                 drm_modeset_unlock_all(dev);
 
@@ -919,6 +920,9 @@ static int i915_runtime_suspend(struct device *device)
 
         DRM_DEBUG_KMS("Suspending device\n");
 
+        i915_gem_release_all_mmaps(dev_priv);
+
+        del_timer_sync(&dev_priv->gpu_error.hangcheck_timer);
         dev_priv->pm.suspended = true;
         intel_opregion_notify_adapter(dev, PCI_D3cold);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index ae2c80c1981b..ff6f870d6621 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1184,6 +1184,11 @@ struct intel_vbt_data {
         int edp_bpp;
         struct edp_power_seq edp_pps;
 
+        struct {
+                u16 pwm_freq_hz;
+                bool active_low_pwm;
+        } backlight;
+
         /* MIPI DSI */
         struct {
                 u16 panel_id;
@@ -1210,7 +1215,7 @@ struct intel_wm_level {
         uint32_t fbc_val;
 };
 
-struct hsw_wm_values {
+struct ilk_wm_values {
         uint32_t wm_pipe[3];
         uint32_t wm_lp[3];
         uint32_t wm_lp_spr[3];
@@ -1396,7 +1401,6 @@ typedef struct drm_i915_private {
 
         /* overlay */
         struct intel_overlay *overlay;
-        unsigned int sprite_scaling_enabled;
 
         /* backlight registers and fields in struct intel_panel */
         spinlock_t backlight_lock;
@@ -1517,7 +1521,7 @@ typedef struct drm_i915_private {
                 uint16_t cur_latency[5];
 
                 /* current hardware state */
-                struct hsw_wm_values hw;
+                struct ilk_wm_values hw;
         } wm;
 
         struct i915_package_c8 pc8;
@@ -1840,7 +1844,7 @@ struct drm_i915_file_private {
 
 #define HAS_FW_BLC(dev) (INTEL_INFO(dev)->gen > 2)
 #define HAS_PIPE_CXSR(dev) (INTEL_INFO(dev)->has_pipe_cxsr)
-#define I915_HAS_FBC(dev) (INTEL_INFO(dev)->has_fbc)
+#define HAS_FBC(dev) (INTEL_INFO(dev)->has_fbc)
 
 #define HAS_IPS(dev)            (IS_ULT(dev) || IS_BROADWELL(dev))
 
@@ -1848,7 +1852,7 @@ struct drm_i915_file_private {
 #define HAS_FPGA_DBG_UNCLAIMED(dev)     (INTEL_INFO(dev)->has_fpga_dbg)
 #define HAS_PSR(dev)            (IS_HASWELL(dev) || IS_BROADWELL(dev))
 #define HAS_PC8(dev)            (IS_HASWELL(dev)) /* XXX HSW:ULX */
-#define HAS_RUNTIME_PM(dev)     false
+#define HAS_RUNTIME_PM(dev)     (IS_HASWELL(dev))
 
 #define INTEL_PCH_DEVICE_ID_MASK                0xff00
 #define INTEL_PCH_IBX_DEVICE_ID_TYPE            0x3b00
@@ -1933,9 +1937,7 @@ void i915_queue_hangcheck(struct drm_device *dev);
 void i915_handle_error(struct drm_device *dev, bool wedged);
 
 extern void intel_irq_init(struct drm_device *dev);
-extern void intel_pm_init(struct drm_device *dev);
 extern void intel_hpd_init(struct drm_device *dev);
-extern void intel_pm_init(struct drm_device *dev);
 
 extern void intel_uncore_sanitize(struct drm_device *dev);
 extern void intel_uncore_early_sanitize(struct drm_device *dev);
@@ -2015,6 +2017,7 @@ void i915_gem_object_unpin(struct drm_i915_gem_object *obj);
 int __must_check i915_vma_unbind(struct i915_vma *vma);
 int __must_check i915_gem_object_ggtt_unbind(struct drm_i915_gem_object *obj);
 int i915_gem_object_put_pages(struct drm_i915_gem_object *obj);
+void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv);
 void i915_gem_release_mmap(struct drm_i915_gem_object *obj);
 void i915_gem_lastclose(struct drm_device *dev);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 2be904c704e9..32636a470367 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1465,6 +1465,22 @@ out:
         return ret;
 }
 
+void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv)
+{
+        struct i915_vma *vma;
+
+        /*
+         * Only the global gtt is relevant for gtt memory mappings, so restrict
+         * list traversal to objects bound into the global address space. Note
+         * that the active list should be empty, but better safe than sorry.
+         */
+        WARN_ON(!list_empty(&dev_priv->gtt.base.active_list));
+        list_for_each_entry(vma, &dev_priv->gtt.base.active_list, mm_list)
+                i915_gem_release_mmap(vma->obj);
+        list_for_each_entry(vma, &dev_priv->gtt.base.inactive_list, mm_list)
+                i915_gem_release_mmap(vma->obj);
+}
+
 /**
  * i915_gem_release_mmap - remove physical page mappings
  * @obj: obj in question
@@ -2354,15 +2370,24 @@ static void i915_gem_free_request(struct drm_i915_gem_request *request)
         kfree(request);
 }
 
-static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
-                                      struct intel_ring_buffer *ring)
+static void i915_gem_reset_ring_status(struct drm_i915_private *dev_priv,
+                                       struct intel_ring_buffer *ring)
 {
-        u32 completed_seqno;
-        u32 acthd;
+        u32 completed_seqno = ring->get_seqno(ring, false);
+        u32 acthd = intel_ring_get_active_head(ring);
+        struct drm_i915_gem_request *request;
+
+        list_for_each_entry(request, &ring->request_list, list) {
+                if (i915_seqno_passed(completed_seqno, request->seqno))
+                        continue;
 
-        acthd = intel_ring_get_active_head(ring);
-        completed_seqno = ring->get_seqno(ring, false);
+                i915_set_reset_status(ring, request, acthd);
+        }
+}
 
+static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
+                                        struct intel_ring_buffer *ring)
+{
         while (!list_empty(&ring->request_list)) {
                 struct drm_i915_gem_request *request;
 
@@ -2370,9 +2395,6 @@ static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
                                            struct drm_i915_gem_request,
                                            list);
 
-                if (request->seqno > completed_seqno)
-                        i915_set_reset_status(ring, request, acthd);
-
                 i915_gem_free_request(request);
         }
 
@@ -2414,8 +2436,16 @@ void i915_gem_reset(struct drm_device *dev)
         struct intel_ring_buffer *ring;
         int i;
 
+        /*
+         * Before we free the objects from the requests, we need to inspect
+         * them for finding the guilty party. As the requests only borrow
+         * their reference to the objects, the inspection must be done first.
+         */
+        for_each_ring(ring, dev_priv, i)
+                i915_gem_reset_ring_status(dev_priv, ring);
+
         for_each_ring(ring, dev_priv, i)
-                i915_gem_reset_ring_lists(dev_priv, ring);
+                i915_gem_reset_ring_cleanup(dev_priv, ring);
 
         i915_gem_cleanup_ringbuffer(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 41877045a1a0..e08acaba5402 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -345,10 +345,8 @@ void i915_gem_context_close(struct drm_device *dev, struct drm_file *file)
 {
         struct drm_i915_file_private *file_priv = file->driver_priv;
 
-        mutex_lock(&dev->struct_mutex);
         idr_for_each(&file_priv->context_idr, context_idr_cleanup, NULL);
         idr_destroy(&file_priv->context_idr);
-        mutex_unlock(&dev->struct_mutex);
 }
 
 static struct i915_hw_context *
@@ -421,11 +419,21 @@ static int do_switch(struct i915_hw_context *to)
         if (ret)
                 return ret;
 
-        /* Clear this page out of any CPU caches for coherent swap-in/out. Note
+        /*
+         * Pin can switch back to the default context if we end up calling into
+         * evict_everything - as a last ditch gtt defrag effort that also
+         * switches to the default context. Hence we need to reload from here.
+         */
+        from = ring->last_context;
+
+        /*
+         * Clear this page out of any CPU caches for coherent swap-in/out. Note
          * that thanks to write = false in this call and us not setting any gpu
          * write domains when putting a context object onto the active list
          * (when switching away from it), this won't block.
-         * XXX: We need a real interface to do this instead of trickery. */
+         *
+         * XXX: We need a real interface to do this instead of trickery.
+         */
         ret = i915_gem_object_set_to_gtt_domain(to->obj, false);
         if (ret) {
                 i915_gem_object_unpin(to->obj);
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index b7376533633d..8f3adc7d0dc8 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -88,6 +88,7 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
         } else
                 drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
 
+search_again:
         /* First see if there is a large enough contiguous idle region... */
         list_for_each_entry(vma, &vm->inactive_list, mm_list) {
                 if (mark_free(vma, &unwind_list))
@@ -115,10 +116,17 @@ none:
                 list_del_init(&vma->exec_list);
         }
 
-        /* We expect the caller to unpin, evict all and try again, or give up.
-         * So calling i915_gem_evict_vm() is unnecessary.
+        /* Can we unpin some objects such as idle hw contents,
+         * or pending flips?
          */
-        return -ENOSPC;
+        ret = nonblocking ? -ENOSPC : i915_gpu_idle(dev);
+        if (ret)
+                return ret;
+
+        /* Only idle the GPU and repeat the search once */
+        i915_gem_retire_requests(dev);
+        nonblocking = true;
+        goto search_again;
 
 found:
         /* drm_mm doesn't allow any other other operations while
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 87652fafeb49..8d795626a25e 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -93,7 +93,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
 {
         struct drm_i915_gem_object *obj;
         struct list_head objects;
-        int i, ret = 0;
+        int i, ret;
 
         INIT_LIST_HEAD(&objects);
         spin_lock(&file->table_lock);
@@ -106,7 +106,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
                         DRM_DEBUG("Invalid object handle %d at index %d\n",
                                    exec[i].handle, i);
                         ret = -ENOENT;
-                        goto out;
+                        goto err;
                 }
 
                 if (!list_empty(&obj->obj_exec_link)) {
@@ -114,7 +114,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
                         DRM_DEBUG("Object %p [handle %d, index %d] appears more than once in object list\n",
                                    obj, exec[i].handle, i);
                         ret = -EINVAL;
-                        goto out;
+                        goto err;
                 }
 
                 drm_gem_object_reference(&obj->base);
@@ -123,9 +123,13 @@ eb_lookup_vmas(struct eb_vmas *eb,
         spin_unlock(&file->table_lock);
 
         i = 0;
-        list_for_each_entry(obj, &objects, obj_exec_link) {
+        while (!list_empty(&objects)) {
                 struct i915_vma *vma;
 
+                obj = list_first_entry(&objects,
+                                       struct drm_i915_gem_object,
+                                       obj_exec_link);
+
                 /*
                  * NOTE: We can leak any vmas created here when something fails
                  * later on. But that's no issue since vma_unbind can deal with
@@ -138,10 +142,12 @@ eb_lookup_vmas(struct eb_vmas *eb,
                 if (IS_ERR(vma)) {
                         DRM_DEBUG("Failed to lookup VMA\n");
                         ret = PTR_ERR(vma);
-                        goto out;
+                        goto err;
                 }
 
+                /* Transfer ownership from the objects list to the vmas list. */
                 list_add_tail(&vma->exec_list, &eb->vmas);
+                list_del_init(&obj->obj_exec_link);
 
                 vma->exec_entry = &exec[i];
                 if (eb->and < 0) {
@@ -155,16 +161,22 @@ eb_lookup_vmas(struct eb_vmas *eb,
                 ++i;
         }
 
+        return 0;
+
 
-out:
+err:
         while (!list_empty(&objects)) {
                 obj = list_first_entry(&objects,
                                        struct drm_i915_gem_object,
                                        obj_exec_link);
                 list_del_init(&obj->obj_exec_link);
-                if (ret)
-                        drm_gem_object_unreference(&obj->base);
+                drm_gem_object_unreference(&obj->base);
         }
+        /*
+         * Objects already transfered to the vmas list will be unreferenced by
+         * eb_destroy.
+         */
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index a54eaabb3a3e..6c3a6e60aeac 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -299,23 +299,23 @@ static void gen8_ppgtt_insert_entries(struct i915_address_space *vm,
         unsigned act_pte = first_entry % GEN8_PTES_PER_PAGE;
         struct sg_page_iter sg_iter;
 
-        pt_vaddr = kmap_atomic(&ppgtt->gen8_pt_pages[act_pt]);
+        pt_vaddr = NULL;
         for_each_sg_page(pages->sgl, &sg_iter, pages->nents, 0) {
-                dma_addr_t page_addr;
+                if (pt_vaddr == NULL)
+                        pt_vaddr = kmap_atomic(&ppgtt->gen8_pt_pages[act_pt]);
 
-                page_addr = sg_dma_address(sg_iter.sg) +
-                                (sg_iter.sg_pgoffset << PAGE_SHIFT);
-                pt_vaddr[act_pte] = gen8_pte_encode(page_addr, cache_level,
-                                                    true);
+                pt_vaddr[act_pte] =
+                        gen8_pte_encode(sg_page_iter_dma_address(&sg_iter),
+                                        cache_level, true);
                 if (++act_pte == GEN8_PTES_PER_PAGE) {
                         kunmap_atomic(pt_vaddr);
+                        pt_vaddr = NULL;
                         act_pt++;
-                        pt_vaddr = kmap_atomic(&ppgtt->gen8_pt_pages[act_pt]);
                         act_pte = 0;
-
                 }
         }
-        kunmap_atomic(pt_vaddr);
+        if (pt_vaddr)
+                kunmap_atomic(pt_vaddr);
 }
 
 static void gen8_ppgtt_cleanup(struct i915_address_space *vm)
@@ -583,21 +583,23 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
         unsigned act_pte = first_entry % I915_PPGTT_PT_ENTRIES;
         struct sg_page_iter sg_iter;
 
-        pt_vaddr = kmap_atomic(ppgtt->pt_pages[act_pt]);
+        pt_vaddr = NULL;
         for_each_sg_page(pages->sgl, &sg_iter, pages->nents, 0) {
-                dma_addr_t page_addr;
+                if (pt_vaddr == NULL)
+                        pt_vaddr = kmap_atomic(ppgtt->pt_pages[act_pt]);
 
-                page_addr = sg_page_iter_dma_address(&sg_iter);
-                pt_vaddr[act_pte] = vm->pte_encode(page_addr, cache_level, true);
+                pt_vaddr[act_pte] =
+                        vm->pte_encode(sg_page_iter_dma_address(&sg_iter),
+                                       cache_level, true);
                 if (++act_pte == I915_PPGTT_PT_ENTRIES) {
                         kunmap_atomic(pt_vaddr);
+                        pt_vaddr = NULL;
                         act_pt++;
-                        pt_vaddr = kmap_atomic(ppgtt->pt_pages[act_pt]);
                         act_pte = 0;
-
                 }
         }
-        kunmap_atomic(pt_vaddr);
+        if (pt_vaddr)
+                kunmap_atomic(pt_vaddr);
 }
 
 static void gen6_ppgtt_cleanup(struct i915_address_space *vm)
@@ -918,14 +920,12 @@ static void gen8_ggtt_insert_entries(struct i915_address_space *vm,
                 WARN_ON(readq(&gtt_entries[i-1])
                         != gen8_pte_encode(addr, level, true));
 
-#if 0 /* TODO: Still needed on GEN8? */
         /* This next bit makes the above posting read even more important. We
          * want to flush the TLBs only after we're certain all the PTE updates
          * have finished.
          */
         I915_WRITE(GFX_FLSH_CNTL_GEN6, GFX_FLSH_CNTL_EN);
         POSTING_READ(GFX_FLSH_CNTL_GEN6);
-#endif
 }
 
 /*
@@ -1440,6 +1440,9 @@ static int i915_gmch_probe(struct drm_device *dev,
         dev_priv->gtt.base.clear_range = i915_ggtt_clear_range;
         dev_priv->gtt.base.insert_entries = i915_ggtt_insert_entries;
 
+        if (unlikely(dev_priv->gtt.do_idle_maps))
+                DRM_INFO("applying Ironlake quirks for intel_iommu\n");
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index d284d892ed94..fed87ec17211 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -420,6 +420,7 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_device *dev,
 
         list_add_tail(&obj->global_list, &dev_priv->mm.bound_list);
         list_add_tail(&vma->mm_list, &ggtt->inactive_list);
+        i915_gem_object_pin_pages(obj);
 
         return obj;
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 1d44c793bdf4..6d11e253218a 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -62,7 +62,7 @@ static const u32 hpd_mask_i915[] = {
         [HPD_PORT_D] = PORTD_HOTPLUG_INT_EN
 };
 
-static const u32 hpd_status_gen4[] = {
+static const u32 hpd_status_g4x[] = {
         [HPD_CRT] = CRT_HOTPLUG_INT_STATUS,
         [HPD_SDVO_B] = SDVOB_HOTPLUG_INT_STATUS_G4X,
         [HPD_SDVO_C] = SDVOC_HOTPLUG_INT_STATUS_G4X,
@@ -1233,9 +1233,10 @@ static inline void intel_hpd_irq_handler(struct drm_device *dev,
         spin_lock(&dev_priv->irq_lock);
         for (i = 1; i < HPD_NUM_PINS; i++) {
 
-                WARN(((hpd[i] & hotplug_trigger) &&
-                      dev_priv->hpd_stats[i].hpd_mark != HPD_ENABLED),
-                     "Received HPD interrupt although disabled\n");
+                WARN_ONCE(hpd[i] & hotplug_trigger &&
+                          dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED,
+                          "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
+                          hotplug_trigger, i, hpd[i]);
 
                 if (!(hpd[i] & hotplug_trigger) ||
                     dev_priv->hpd_stats[i].hpd_mark != HPD_ENABLED)
@@ -2714,6 +2715,8 @@ static void gen8_irq_preinstall(struct drm_device *dev)
 #undef GEN8_IRQ_INIT_NDX
 
         POSTING_READ(GEN8_PCU_IIR);
+
+        ibx_irq_preinstall(dev);
 }
 
 static void ibx_hpd_irq_setup(struct drm_device *dev)
@@ -3220,7 +3223,7 @@ static irqreturn_t i8xx_irq_handler(int irq, void *arg)
 
                 for_each_pipe(pipe) {
                         int plane = pipe;
-                        if (IS_MOBILE(dev))
+                        if (HAS_FBC(dev))
                                 plane = !plane;
 
                         if (pipe_stats[pipe] & PIPE_VBLANK_INTERRUPT_STATUS &&
@@ -3421,7 +3424,7 @@ static irqreturn_t i915_irq_handler(int irq, void *arg)
 
                 for_each_pipe(pipe) {
                         int plane = pipe;
-                        if (IS_MOBILE(dev))
+                        if (HAS_FBC(dev))
                                 plane = !plane;
 
                         if (pipe_stats[pipe] & PIPE_VBLANK_INTERRUPT_STATUS &&
@@ -3658,7 +3661,7 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
                                   hotplug_status);
 
                         intel_hpd_irq_handler(dev, hotplug_trigger,
-                                              IS_G4X(dev) ? hpd_status_gen4 : hpd_status_i915);
+                                              IS_G4X(dev) ? hpd_status_g4x : hpd_status_i915);
 
                         if (IS_G4X(dev) &&
                             (hotplug_status & DP_AUX_CHANNEL_MASK_INT_STATUS_G4X))
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index f1eece4a63d5..76126e0ae609 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -193,10 +193,13 @@
 #define   MI_SCENE_COUNT        (1 << 3) /* just increment scene count */
 #define   MI_END_SCENE          (1 << 4) /* flush binner and incr scene count */
 #define   MI_INVALIDATE_ISP     (1 << 5) /* invalidate indirect state pointers */
+#define MI_REPORT_HEAD          MI_INSTR(0x07, 0)
+#define MI_ARB_ON_OFF           MI_INSTR(0x08, 0)
+#define   MI_ARB_ENABLE                 (1<<0)
+#define   MI_ARB_DISABLE                (0<<0)
 #define MI_BATCH_BUFFER_END     MI_INSTR(0x0a, 0)
 #define MI_SUSPEND_FLUSH        MI_INSTR(0x0b, 0)
 #define   MI_SUSPEND_FLUSH_EN   (1<<0)
-#define MI_REPORT_HEAD          MI_INSTR(0x07, 0)
 #define MI_OVERLAY_FLIP         MI_INSTR(0x11, 0)
 #define   MI_OVERLAY_CONTINUE   (0x0<<21)
 #define   MI_OVERLAY_ON         (0x1<<21)
@@ -212,10 +215,24 @@
 #define   MI_DISPLAY_FLIP_IVB_SPRITE_B (3 << 19)
 #define   MI_DISPLAY_FLIP_IVB_PLANE_C  (4 << 19)
 #define   MI_DISPLAY_FLIP_IVB_SPRITE_C (5 << 19)
-#define MI_ARB_ON_OFF           MI_INSTR(0x08, 0)
-#define   MI_ARB_ENABLE                 (1<<0)
-#define   MI_ARB_DISABLE                (0<<0)
-
+#define MI_SEMAPHORE_MBOX       MI_INSTR(0x16, 1) /* gen6+ */
+#define   MI_SEMAPHORE_GLOBAL_GTT    (1<<22)
+#define   MI_SEMAPHORE_UPDATE       (1<<21)
+#define   MI_SEMAPHORE_COMPARE      (1<<20)
+#define   MI_SEMAPHORE_REGISTER     (1<<18)
+#define   MI_SEMAPHORE_SYNC_VR      (0<<16) /* RCS  wait for VCS  (RVSYNC) */
+#define   MI_SEMAPHORE_SYNC_VER     (1<<16) /* RCS  wait for VECS (RVESYNC) */
+#define   MI_SEMAPHORE_SYNC_BR      (2<<16) /* RCS  wait for BCS  (RBSYNC) */
+#define   MI_SEMAPHORE_SYNC_BV      (0<<16) /* VCS  wait for BCS  (VBSYNC) */
+#define   MI_SEMAPHORE_SYNC_VEV     (1<<16) /* VCS  wait for VECS (VVESYNC) */
+#define   MI_SEMAPHORE_SYNC_RV      (2<<16) /* VCS  wait for RCS  (VRSYNC) */
+#define   MI_SEMAPHORE_SYNC_RB      (0<<16) /* BCS  wait for RCS  (BRSYNC) */
+#define   MI_SEMAPHORE_SYNC_VEB     (1<<16) /* BCS  wait for VECS (BVESYNC) */
+#define   MI_SEMAPHORE_SYNC_VB      (2<<16) /* BCS  wait for VCS  (BVSYNC) */
+#define   MI_SEMAPHORE_SYNC_BVE     (0<<16) /* VECS wait for BCS  (VEBSYNC) */
+#define   MI_SEMAPHORE_SYNC_VVE     (1<<16) /* VECS wait for VCS  (VEVSYNC) */
+#define   MI_SEMAPHORE_SYNC_RVE     (2<<16) /* VECS wait for RCS  (VERSYNC) */
+#define   MI_SEMAPHORE_SYNC_INVALID  (3<<16)
 #define MI_SET_CONTEXT          MI_INSTR(0x18, 0)
 #define   MI_MM_SPACE_GTT               (1<<8)
 #define   MI_MM_SPACE_PHYSICAL          (0<<8)
@@ -235,7 +252,7 @@
  */
 #define MI_LOAD_REGISTER_IMM(x) MI_INSTR(0x22, 2*x-1)
 #define MI_STORE_REGISTER_MEM(x) MI_INSTR(0x24, 2*x-1)
-#define  MI_SRM_LRM_GLOBAL_GTT          (1<<22)
+#define   MI_SRM_LRM_GLOBAL_GTT         (1<<22)
 #define MI_FLUSH_DW             MI_INSTR(0x26, 1) /* for GEN6 */
 #define   MI_FLUSH_DW_STORE_INDEX       (1<<21)
 #define   MI_INVALIDATE_TLB             (1<<18)
@@ -246,30 +263,13 @@
 #define MI_BATCH_BUFFER         MI_INSTR(0x30, 1)
 #define   MI_BATCH_NON_SECURE           (1)
 /* for snb/ivb/vlv this also means "batch in ppgtt" when ppgtt is enabled. */
-#define   MI_BATCH_NON_SECURE_I965      (1<<8)
+#define   MI_BATCH_NON_SECURE_I965      (1<<8)
 #define   MI_BATCH_PPGTT_HSW            (1<<8)
-#define   MI_BATCH_NON_SECURE_HSW       (1<<13)
+#define   MI_BATCH_NON_SECURE_HSW       (1<<13)
 #define MI_BATCH_BUFFER_START   MI_INSTR(0x31, 0)
 #define   MI_BATCH_GTT              (2<<6) /* aliased with (1<<7) on gen4 */
 #define MI_BATCH_BUFFER_START_GEN8      MI_INSTR(0x31, 1)
-#define MI_SEMAPHORE_MBOX       MI_INSTR(0x16, 1) /* gen6+ */
-#define  MI_SEMAPHORE_GLOBAL_GTT    (1<<22)
-#define  MI_SEMAPHORE_UPDATE        (1<<21)
-#define  MI_SEMAPHORE_COMPARE       (1<<20)
-#define  MI_SEMAPHORE_REGISTER      (1<<18)
-#define  MI_SEMAPHORE_SYNC_VR       (0<<16) /* RCS  wait for VCS  (RVSYNC) */
-#define  MI_SEMAPHORE_SYNC_VER      (1<<16) /* RCS  wait for VECS (RVESYNC) */
-#define  MI_SEMAPHORE_SYNC_BR       (2<<16) /* RCS  wait for BCS  (RBSYNC) */
-#define  MI_SEMAPHORE_SYNC_BV       (0<<16) /* VCS  wait for BCS  (VBSYNC) */
-#define  MI_SEMAPHORE_SYNC_VEV      (1<<16) /* VCS  wait for VECS (VVESYNC) */
-#define  MI_SEMAPHORE_SYNC_RV       (2<<16) /* VCS  wait for RCS  (VRSYNC) */
-#define  MI_SEMAPHORE_SYNC_RB       (0<<16) /* BCS  wait for RCS  (BRSYNC) */
-#define  MI_SEMAPHORE_SYNC_VEB      (1<<16) /* BCS  wait for VECS (BVESYNC) */
-#define  MI_SEMAPHORE_SYNC_VB       (2<<16) /* BCS  wait for VCS  (BVSYNC) */
-#define  MI_SEMAPHORE_SYNC_BVE      (0<<16) /* VECS wait for BCS  (VEBSYNC) */
-#define  MI_SEMAPHORE_SYNC_VVE      (1<<16) /* VECS wait for VCS  (VEVSYNC) */
-#define  MI_SEMAPHORE_SYNC_RVE      (2<<16) /* VECS wait for RCS  (VERSYNC) */
-#define  MI_SEMAPHORE_SYNC_INVALID  (3<<16)
+
 
 #define MI_PREDICATE_RESULT_2   (0x2214)
 #define  LOWER_SLICE_ENABLED    (1<<0)
@@ -3430,42 +3430,6 @@
 /* the unit of memory self-refresh latency time is 0.5us */
 #define  ILK_SRLT_MASK          0x3f
 
-/* define the fifo size on Ironlake */
-#define ILK_DISPLAY_FIFO        128
-#define ILK_DISPLAY_MAXWM       64
-#define ILK_DISPLAY_DFTWM       8
-#define ILK_CURSOR_FIFO         32
-#define ILK_CURSOR_MAXWM        16
-#define ILK_CURSOR_DFTWM        8
-
-#define ILK_DISPLAY_SR_FIFO     512
-#define ILK_DISPLAY_MAX_SRWM    0x1ff
-#define ILK_DISPLAY_DFT_SRWM    0x3f
-#define ILK_CURSOR_SR_FIFO      64
-#define ILK_CURSOR_MAX_SRWM     0x3f
-#define ILK_CURSOR_DFT_SRWM     8
-
-#define ILK_FIFO_LINE_SIZE      64
-
-/* define the WM info on Sandybridge */
-#define SNB_DISPLAY_FIFO        128
-#define SNB_DISPLAY_MAXWM       0x7f    /* bit 16:22 */
-#define SNB_DISPLAY_DFTWM       8
-#define SNB_CURSOR_FIFO         32
-#define SNB_CURSOR_MAXWM        0x1f    /* bit 4:0 */
-#define SNB_CURSOR_DFTWM        8
-
-#define SNB_DISPLAY_SR_FIFO     512
-#define SNB_DISPLAY_MAX_SRWM    0x1ff   /* bit 16:8 */
-#define SNB_DISPLAY_DFT_SRWM    0x3f
-#define SNB_CURSOR_SR_FIFO      64
-#define SNB_CURSOR_MAX_SRWM     0x3f    /* bit 5:0 */
-#define SNB_CURSOR_DFT_SRWM     8
-
-#define SNB_FBC_MAX_SRWM        0xf     /* bit 23:20 */
-
-#define SNB_FIFO_LINE_SIZE      64
-
 
 /* the address where we get all kinds of latency value */
 #define SSKPD                   0x5d10
@@ -4148,6 +4112,8 @@
 #define DISP_ARB_CTL    0x45000
 #define  DISP_TILE_SURFACE_SWIZZLING    (1<<13)
 #define  DISP_FBC_WM_DIS                (1<<15)
+#define DISP_ARB_CTL2   0x45004
+#define  DISP_DATA_PARTITION_5_6        (1<<6)
 #define GEN7_MSG_CTL    0x45010
 #define  WAIT_FOR_PCH_RESET_ACK         (1<<1)
 #define  WAIT_FOR_PCH_FLR_ACK           (1<<0)
@@ -4856,6 +4822,8 @@
 #define  FORCEWAKE_ACK                          0x130090
 #define  VLV_GTLC_WAKE_CTRL                     0x130090
 #define  VLV_GTLC_PW_STATUS                     0x130094
+#define VLV_GTLC_PW_RENDER_STATUS_MASK          0x80
+#define VLV_GTLC_PW_MEDIA_STATUS_MASK           0x20
 #define  FORCEWAKE_MT                           0xa188 /* multi-threaded */
 #define   FORCEWAKE_KERNEL                      0x1
 #define   FORCEWAKE_USER                        0x2
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 6b8fef7fb3bb..8150fdc08d49 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -237,7 +237,7 @@ static void i915_save_display(struct drm_device *dev)
         }
 
         /* Only regfile.save FBC state on the platform that supports FBC */
-        if (I915_HAS_FBC(dev)) {
+        if (HAS_FBC(dev)) {
                 if (HAS_PCH_SPLIT(dev)) {
                         dev_priv->regfile.saveDPFC_CB_BASE = I915_READ(ILK_DPFC_CB_BASE);
                 } else if (IS_GM45(dev)) {
@@ -300,7 +300,7 @@ static void i915_restore_display(struct drm_device *dev)
 
         /* only restore FBC info on the platform that supports FBC*/
         intel_disable_fbc(dev);
-        if (I915_HAS_FBC(dev)) {
+        if (HAS_FBC(dev)) {
                 if (HAS_PCH_SPLIT(dev)) {
                         I915_WRITE(ILK_DPFC_CB_BASE, dev_priv->regfile.saveDPFC_CB_BASE);
                 } else if (IS_GM45(dev)) {
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index f88e5079a3f5..f22041973f3a 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -281,6 +281,34 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv,
         }
 }
 
+static void
+parse_lfp_backlight(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
+{
+        const struct bdb_lfp_backlight_data *backlight_data;
+        const struct bdb_lfp_backlight_data_entry *entry;
+
+        backlight_data = find_section(bdb, BDB_LVDS_BACKLIGHT);
+        if (!backlight_data)
+                return;
+
+        if (backlight_data->entry_size != sizeof(backlight_data->data[0])) {
+                DRM_DEBUG_KMS("Unsupported backlight data entry size %u\n",
+                              backlight_data->entry_size);
+                return;
+        }
+
+        entry = &backlight_data->data[panel_type];
+
+        dev_priv->vbt.backlight.pwm_freq_hz = entry->pwm_freq_hz;
+        dev_priv->vbt.backlight.active_low_pwm = entry->active_low_pwm;
+        DRM_DEBUG_KMS("VBT backlight PWM modulation frequency %u Hz, "
+                      "active %s, min brightness %u, level %u\n",
+                      dev_priv->vbt.backlight.pwm_freq_hz,
+                      dev_priv->vbt.backlight.active_low_pwm ? "low" : "high",
+                      entry->min_brightness,
+                      backlight_data->level[panel_type]);
+}
+
 /* Try to find sdvo panel data */
 static void
 parse_sdvo_panel_data(struct drm_i915_private *dev_priv,
@@ -894,6 +922,7 @@ intel_parse_bios(struct drm_device *dev)
         parse_general_features(dev_priv, bdb);
         parse_general_definitions(dev_priv, bdb);
         parse_lfp_panel_data(dev_priv, bdb);
+        parse_lfp_backlight(dev_priv, bdb);
         parse_sdvo_panel_data(dev_priv, bdb);
         parse_sdvo_device_mapping(dev_priv, bdb);
         parse_device_mapping(dev_priv, bdb);
diff --git a/drivers/gpu/drm/i915/intel_bios.h b/drivers/gpu/drm/i915/intel_bios.h
index 81ed58cb7b31..282de5e9f39d 100644
--- a/drivers/gpu/drm/i915/intel_bios.h
+++ b/drivers/gpu/drm/i915/intel_bios.h
@@ -373,6 +373,22 @@ struct bdb_lvds_lfp_data {
         struct bdb_lvds_lfp_data_entry data[16];
 } __packed;
 
+struct bdb_lfp_backlight_data_entry {
+        u8 type:2;
+        u8 active_low_pwm:1;
+        u8 obsolete1:5;
+        u16 pwm_freq_hz;
+        u8 min_brightness;
+        u8 obsolete2;
+        u8 obsolete3;
+} __packed;
+
+struct bdb_lfp_backlight_data {
+        u8 entry_size;
+        struct bdb_lfp_backlight_data_entry data[16];
+        u8 level[16];
+} __packed;
+
 struct aimdb_header {
         char signature[16];
         char oem_device[20];
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index d7d2683b89df..e06b9e017d6b 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1136,12 +1136,18 @@ void intel_ddi_setup_hw_pll_state(struct drm_device *dev)
         enum pipe pipe;
         struct intel_crtc *intel_crtc;
 
+        dev_priv->ddi_plls.spll_refcount = 0;
+        dev_priv->ddi_plls.wrpll1_refcount = 0;
+        dev_priv->ddi_plls.wrpll2_refcount = 0;
+
         for_each_pipe(pipe) {
                 intel_crtc =
                         to_intel_crtc(dev_priv->pipe_to_crtc_mapping[pipe]);
 
-                if (!intel_crtc->active)
+                if (!intel_crtc->active) {
+                        intel_crtc->ddi_pll_sel = PORT_CLK_SEL_NONE;
                         continue;
+                }
 
                 intel_crtc->ddi_pll_sel = intel_ddi_get_crtc_pll(dev_priv,
                                                                  pipe);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 72a83fabb105..e77d4b8856a7 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1211,15 +1211,12 @@ static void assert_sprites_disabled(struct drm_i915_private *dev_priv,
         }
 }
 
-static void assert_pch_refclk_enabled(struct drm_i915_private *dev_priv)
+static void ibx_assert_pch_refclk_enabled(struct drm_i915_private *dev_priv)
 {
         u32 val;
         bool enabled;
 
-        if (HAS_PCH_LPT(dev_priv->dev)) {
-                DRM_DEBUG_DRIVER("LPT does not has PCH refclk, skipping check\n");
-                return;
-        }
+        WARN_ON(!(HAS_PCH_IBX(dev_priv->dev) || HAS_PCH_CPT(dev_priv->dev)));
 
         val = I915_READ(PCH_DREF_CONTROL);
         enabled = !!(val & (DREF_SSC_SOURCE_MASK | DREF_NONSPREAD_SOURCE_MASK |
@@ -1367,11 +1364,24 @@ static void intel_init_dpio(struct drm_device *dev)
         if (!IS_VALLEYVIEW(dev))
                 return;
 
-        /* Enable the CRI clock source so we can get at the display */
+        DPIO_PHY_IOSF_PORT(DPIO_PHY0) = IOSF_PORT_DPIO;
+}
+
+static void intel_reset_dpio(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        if (!IS_VALLEYVIEW(dev))
+                return;
+
+        /*
+         * Enable the CRI clock source so we can get at the display and the
+         * reference clock for VGA hotplug / manual detection.
+         */
         I915_WRITE(DPLL(PIPE_B), I915_READ(DPLL(PIPE_B)) |
+                   DPLL_REFA_CLK_ENABLE_VLV |
                    DPLL_INTEGRATED_CRI_CLK_VLV);
 
-        DPIO_PHY_IOSF_PORT(DPIO_PHY0) = IOSF_PORT_DPIO;
         /*
          * From VLV2A0_DP_eDP_DPIO_driver_vbios_notes_10.docx -
          *  6.  De-assert cmn_reset/side_reset. Same as VLV X0.
@@ -1498,9 +1508,12 @@ static void vlv_disable_pll(struct drm_i915_private *dev_priv, enum pipe pipe)
         /* Make sure the pipe isn't still relying on us */
         assert_pipe_disabled(dev_priv, pipe);
 
-        /* Leave integrated clock source enabled */
+        /*
+         * Leave integrated clock source and reference clock enabled for pipe B.
+         * The latter is needed for VGA hotplug / manual detection.
+         */
         if (pipe == PIPE_B)
-                val = DPLL_INTEGRATED_CRI_CLK_VLV;
+                val = DPLL_INTEGRATED_CRI_CLK_VLV | DPLL_REFA_CLK_ENABLE_VLV;
         I915_WRITE(DPLL(pipe), val);
         POSTING_READ(DPLL(pipe));
 }
@@ -2373,6 +2386,8 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
                         I915_WRITE(PF_WIN_POS(intel_crtc->pipe), 0);
                         I915_WRITE(PF_WIN_SZ(intel_crtc->pipe), 0);
                 }
+                intel_crtc->config.pipe_src_w = adjusted_mode->crtc_hdisplay;
+                intel_crtc->config.pipe_src_h = adjusted_mode->crtc_vdisplay;
         }
 
         ret = dev_priv->display.update_plane(crtc, fb, x, y);
@@ -3422,9 +3437,8 @@ void hsw_enable_ips(struct intel_crtc *crtc)
                 mutex_unlock(&dev_priv->rps.hw_lock);
                 /* Quoting Art Runyan: "its not safe to expect any particular
                  * value in IPS_CTL bit 31 after enabling IPS through the
-                 * mailbox." Therefore we need to defer waiting on the state
-                 * change.
-                 * TODO: need to fix this for state checker
+                 * mailbox." Moreover, the mailbox may return a bogus state,
+                 * so we need to just enable it and continue on.
                  */
         } else {
                 I915_WRITE(IPS_CTL, IPS_ENABLE);
@@ -3451,9 +3465,10 @@ void hsw_disable_ips(struct intel_crtc *crtc)
                 mutex_lock(&dev_priv->rps.hw_lock);
                 WARN_ON(sandybridge_pcode_write(dev_priv, DISPLAY_IPS_CONTROL, 0));
                 mutex_unlock(&dev_priv->rps.hw_lock);
-        } else
+        } else {
                 I915_WRITE(IPS_CTL, 0);
-        POSTING_READ(IPS_CTL);
+                POSTING_READ(IPS_CTL);
+        }
 
         /* We need to wait for a vblank before we can disable the plane. */
         intel_wait_for_vblank(dev, crtc->pipe);
@@ -3488,7 +3503,7 @@ static void intel_crtc_load_lut(struct drm_crtc *crtc)
         /* Workaround : Do not read or write the pipe palette/gamma data while
          * GAMMA_MODE is configured for split gamma and IPS_CTL has IPS enabled.
          */
-        if (intel_crtc->config.ips_enabled &&
+        if (IS_HASWELL(dev) && intel_crtc->config.ips_enabled &&
             ((I915_READ(GAMMA_MODE(pipe)) & GAMMA_MODE_MODE_MASK) ==
              GAMMA_MODE_MODE_SPLIT)) {
                 hsw_disable_ips(intel_crtc);
@@ -4975,7 +4990,11 @@ static void vlv_update_pll(struct intel_crtc *crtc)
 
         vlv_dpio_write(dev_priv, pipe, VLV_PLL_DW11(pipe), 0x87871000);
 
-        /* Enable DPIO clock input */
+        /*
+         * Enable DPIO clock input. We should never disable the reference
+         * clock for pipe B, since VGA hotplug / manual detection depends
+         * on it.
+         */
         dpll = DPLL_EXT_BUFFER_ENABLE_VLV | DPLL_REFA_CLK_ENABLE_VLV |
                 DPLL_VGA_MODE_DIS | DPLL_INTEGRATED_CLOCK_VLV;
         /* We should never disable this, set it here for state tracking */
@@ -5420,6 +5439,9 @@ static void i9xx_get_pfit_config(struct intel_crtc *crtc,
         struct drm_i915_private *dev_priv = dev->dev_private;
         uint32_t tmp;
 
+        if (INTEL_INFO(dev)->gen <= 3 && (IS_I830(dev) || !IS_MOBILE(dev)))
+                return;
+
         tmp = I915_READ(PFIT_CONTROL);
         if (!(tmp & PFIT_ENABLE))
                 return;
@@ -6995,8 +7017,9 @@ static bool haswell_get_pipe_config(struct intel_crtc *crtc,
         if (intel_display_power_enabled(dev, pfit_domain))
                 ironlake_get_pfit_config(crtc, pipe_config);
 
-        pipe_config->ips_enabled = hsw_crtc_supports_ips(crtc) &&
-                                   (I915_READ(IPS_CTL) & IPS_ENABLE);
+        if (IS_HASWELL(dev))
+                pipe_config->ips_enabled = hsw_crtc_supports_ips(crtc) &&
+                        (I915_READ(IPS_CTL) & IPS_ENABLE);
 
         pipe_config->pixel_multiplier = 1;
 
@@ -7951,7 +7974,7 @@ static void i9xx_crtc_clock_get(struct intel_crtc *crtc,
                 else
                         i9xx_clock(refclk, &clock);
         } else {
-                u32 lvds = I915_READ(LVDS);
+                u32 lvds = IS_I830(dev) ? 0 : I915_READ(LVDS);
                 bool is_lvds = (pipe == 1) && (lvds & LVDS_PORT_EN);
 
                 if (is_lvds) {
@@ -9326,7 +9349,9 @@ intel_pipe_config_compare(struct drm_device *dev,
                 PIPE_CONF_CHECK_I(pch_pfit.size);
         }
 
-        PIPE_CONF_CHECK_I(ips_enabled);
+        /* BDW+ don't expose a synchronous way to read the state */
+        if (IS_HASWELL(dev))
+                PIPE_CONF_CHECK_I(ips_enabled);
 
         PIPE_CONF_CHECK_I(double_wide);
 
@@ -9339,7 +9364,7 @@ intel_pipe_config_compare(struct drm_device *dev,
         if (IS_G4X(dev) || INTEL_INFO(dev)->gen >= 5)
                 PIPE_CONF_CHECK_I(pipe_bpp);
 
-        if (!IS_HASWELL(dev)) {
+        if (!HAS_DDI(dev)) {
                 PIPE_CONF_CHECK_CLOCK_FUZZY(adjusted_mode.crtc_clock);
                 PIPE_CONF_CHECK_CLOCK_FUZZY(port_clock);
         }
@@ -9913,17 +9938,21 @@ intel_modeset_stage_output_state(struct drm_device *dev,
         /* Check for any encoders that needs to be disabled. */
         list_for_each_entry(encoder, &dev->mode_config.encoder_list,
                             base.head) {
+                int num_connectors = 0;
                 list_for_each_entry(connector,
                                     &dev->mode_config.connector_list,
                                     base.head) {
                         if (connector->new_encoder == encoder) {
                                 WARN_ON(!connector->new_encoder->new_crtc);
-
-                                goto next_encoder;
+                                num_connectors++;
                         }
                 }
-                encoder->new_crtc = NULL;
-next_encoder:
+
+                if (num_connectors == 0)
+                        encoder->new_crtc = NULL;
+                else if (num_connectors > 1)
+                        return -EINVAL;
+
                 /* Only now check for crtc changes so we don't miss encoders
                  * that will be disabled. */
                 if (&encoder->new_crtc->base != encoder->base.crtc) {
@@ -9994,6 +10023,16 @@ static int intel_crtc_set_config(struct drm_mode_set *set)
 
                 ret = intel_pipe_set_base(set->crtc,
                                           set->x, set->y, set->fb);
+                /*
+                 * In the fastboot case this may be our only check of the
+                 * state after boot.  It would be better to only do it on
+                 * the first update, but we don't have a nice way of doing that
+                 * (and really, set_config isn't used much for high freq page
+                 * flipping, so increasing its cost here shouldn't be a big
+                 * deal).
+                 */
+                if (i915_fastboot && ret == 0)
+                        intel_modeset_check_state(set->crtc->dev);
         }
 
         if (ret) {
@@ -10054,7 +10093,7 @@ static void ibx_pch_dpll_enable(struct drm_i915_private *dev_priv,
                                 struct intel_shared_dpll *pll)
 {
         /* PCH refclock must be enabled first */
-        assert_pch_refclk_enabled(dev_priv);
+        ibx_assert_pch_refclk_enabled(dev_priv);
 
         I915_WRITE(PCH_DPLL(pll->id), pll->hw_state.dpll);
 
@@ -10122,8 +10161,6 @@ static void intel_shared_dpll_init(struct drm_device *dev)
                 dev_priv->num_shared_dpll = 0;
 
         BUG_ON(dev_priv->num_shared_dpll > I915_NUM_PLLS);
-        DRM_DEBUG_KMS("%i shared PLLs initialized\n",
-                      dev_priv->num_shared_dpll);
 }
 
 static void intel_crtc_init(struct drm_device *dev, int pipe)
@@ -10151,7 +10188,7 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
          */
         intel_crtc->pipe = pipe;
         intel_crtc->plane = pipe;
-        if (IS_MOBILE(dev) && INTEL_INFO(dev)->gen < 4) {
+        if (HAS_FBC(dev) && INTEL_INFO(dev)->gen < 4) {
                 DRM_DEBUG_KMS("swapping pipes & planes for FBC\n");
                 intel_crtc->plane = !pipe;
         }
@@ -10240,6 +10277,28 @@ static bool has_edp_a(struct drm_device *dev)
         return true;
 }
 
+const char *intel_output_name(int output)
+{
+        static const char *names[] = {
+                [INTEL_OUTPUT_UNUSED] = "Unused",
+                [INTEL_OUTPUT_ANALOG] = "Analog",
+                [INTEL_OUTPUT_DVO] = "DVO",
+                [INTEL_OUTPUT_SDVO] = "SDVO",
+                [INTEL_OUTPUT_LVDS] = "LVDS",
+                [INTEL_OUTPUT_TVOUT] = "TV",
+                [INTEL_OUTPUT_HDMI] = "HDMI",
+                [INTEL_OUTPUT_DISPLAYPORT] = "DisplayPort",
+                [INTEL_OUTPUT_EDP] = "eDP",
+                [INTEL_OUTPUT_DSI] = "DSI",
+                [INTEL_OUTPUT_UNKNOWN] = "Unknown",
+        };
+
+        if (output < 0 || output >= ARRAY_SIZE(names) || !names[output])
+                return "Invalid";
+
+        return names[output];
+}
+
 static void intel_setup_outputs(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -10757,11 +10816,20 @@ static struct intel_quirk intel_quirks[] = {
         /* Sony Vaio Y cannot use SSC on LVDS */
         { 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
 
-        /*
-         * All GM45 Acer (and its brands eMachines and Packard Bell) laptops
-         * seem to use inverted backlight PWM.
-         */
-        { 0x2a42, 0x1025, PCI_ANY_ID, quirk_invert_brightness },
+        /* Acer Aspire 5734Z must invert backlight brightness */
+        { 0x2a42, 0x1025, 0x0459, quirk_invert_brightness },
+
+        /* Acer/eMachines G725 */
+        { 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
+
+        /* Acer/eMachines e725 */
+        { 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
+
+        /* Acer/Packard Bell NCL20 */
+        { 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
+
+        /* Acer Aspire 4736Z */
+        { 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
@@ -10809,7 +10877,7 @@ void intel_modeset_init_hw(struct drm_device *dev)
 
         intel_init_clock_gating(dev);
 
-        intel_init_dpio(dev);
+        intel_reset_dpio(dev);
 
         mutex_lock(&dev->struct_mutex);
         intel_enable_gt_powersave(dev);
@@ -10871,6 +10939,9 @@ void intel_modeset_init(struct drm_device *dev)
                 }
         }
 
+        intel_init_dpio(dev);
+        intel_reset_dpio(dev);
+
         intel_cpu_pll_init(dev);
         intel_shared_dpll_init(dev);
 
@@ -11218,7 +11289,7 @@ void intel_modeset_setup_hw_state(struct drm_device *dev,
                 pll->on = false;
         }
 
-        if (IS_HASWELL(dev))
+        if (HAS_PCH_SPLIT(dev))
                 ilk_wm_get_hw_state(dev);
 
         if (force_restore) {
@@ -11240,8 +11311,6 @@ void intel_modeset_setup_hw_state(struct drm_device *dev,
         }
 
         intel_modeset_check_state(dev);
-
-        drm_mode_config_reset(dev);
 }
 
 void intel_modeset_gem_init(struct drm_device *dev)
@@ -11250,7 +11319,10 @@ void intel_modeset_gem_init(struct drm_device *dev)
 
         intel_setup_overlay(dev);
 
+        mutex_lock(&dev->mode_config.mutex);
+        drm_mode_config_reset(dev);
         intel_modeset_setup_hw_state(dev, false);
+        mutex_unlock(&dev->mode_config.mutex);
 }
 
 void intel_modeset_cleanup(struct drm_device *dev)
@@ -11328,14 +11400,15 @@ void intel_connector_attach_encoder(struct intel_connector *connector,
 int intel_modeset_vga_set_state(struct drm_device *dev, bool state)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
+        unsigned reg = INTEL_INFO(dev)->gen >= 6 ? SNB_GMCH_CTRL : INTEL_GMCH_CTRL;
         u16 gmch_ctrl;
 
-        pci_read_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, &gmch_ctrl);
+        pci_read_config_word(dev_priv->bridge_dev, reg, &gmch_ctrl);
         if (state)
                 gmch_ctrl &= ~INTEL_GMCH_VGA_DISABLE;
         else
                 gmch_ctrl |= INTEL_GMCH_VGA_DISABLE;
-        pci_write_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, gmch_ctrl);
+        pci_write_config_word(dev_priv->bridge_dev, reg, gmch_ctrl);
         return 0;
 }
 
@@ -11445,7 +11518,8 @@ intel_display_capture_error_state(struct drm_device *dev)
                 enum transcoder cpu_transcoder = transcoders[i];
 
                 error->transcoder[i].power_domain_on =
-                        intel_display_power_enabled_sw(dev, POWER_DOMAIN_PIPE(i));
+                        intel_display_power_enabled_sw(dev,
+                                POWER_DOMAIN_TRANSCODER(cpu_transcoder));
                 if (!error->transcoder[i].power_domain_on)
                         continue;
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index ea00068cced2..8754db9e3d52 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -65,8 +65,8 @@
 #define wait_for_atomic_us(COND, US) _wait_for((COND), \
                                                DIV_ROUND_UP((US), 1000), 0)
 
-#define KHz(x) (1000*x)
-#define MHz(x) KHz(1000*x)
+#define KHz(x) (1000 * (x))
+#define MHz(x) KHz(1000 * (x))
 
 /*
  * Display related stuff
@@ -625,6 +625,7 @@ void intel_ddi_get_config(struct intel_encoder *encoder,
 
 
 /* intel_display.c */
+const char *intel_output_name(int output);
 int intel_pch_rawclk(struct drm_device *dev);
 void intel_mark_busy(struct drm_device *dev);
 void intel_mark_fb_busy(struct drm_i915_gem_object *obj,
@@ -838,6 +839,7 @@ void intel_update_sprite_watermarks(struct drm_plane *plane,
                                     uint32_t sprite_width, int pixel_size,
                                     bool enabled, bool scaled);
 void intel_init_pm(struct drm_device *dev);
+void intel_pm_setup(struct drm_device *dev);
 bool intel_fbc_enabled(struct drm_device *dev);
 void intel_update_fbc(struct drm_device *dev);
 void intel_gpu_ips_init(struct drm_i915_private *dev_priv);
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 284c3eb066f6..39eac9937a4a 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -328,8 +328,6 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state)
         fb_set_suspend(info, state);
 }
 
-MODULE_LICENSE("GPL and additional rights");
-
 void intel_fbdev_output_poll_changed(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index a98a990fbab3..a759ecdb7a6e 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -1005,7 +1005,7 @@ static int intel_panel_fitter_pipe(struct drm_device *dev)
         u32  pfit_control;
 
         /* i830 doesn't have a panel fitter */
-        if (IS_I830(dev))
+        if (INTEL_INFO(dev)->gen <= 3 && (IS_I830(dev) || !IS_MOBILE(dev)))
                 return -1;
 
         pfit_control = I915_READ(PFIT_CONTROL);
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 04b28f906f9e..d77cc81900f9 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -461,7 +461,7 @@ void intel_update_fbc(struct drm_device *dev)
         const struct drm_display_mode *adjusted_mode;
         unsigned int max_width, max_height;
 
-        if (!I915_HAS_FBC(dev)) {
+        if (!HAS_FBC(dev)) {
                 set_no_fbc_reason(dev_priv, FBC_UNSUPPORTED);
                 return;
         }
@@ -824,7 +824,7 @@ static int i9xx_get_fifo_size(struct drm_device *dev, int plane)
         return size;
 }
 
-static int i85x_get_fifo_size(struct drm_device *dev, int plane)
+static int i830_get_fifo_size(struct drm_device *dev, int plane)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         uint32_t dsparb = I915_READ(DSPARB);
@@ -857,21 +857,6 @@ static int i845_get_fifo_size(struct drm_device *dev, int plane)
         return size;
 }
 
-static int i830_get_fifo_size(struct drm_device *dev, int plane)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t dsparb = I915_READ(DSPARB);
-        int size;
-
-        size = dsparb & 0x7f;
-        size >>= 1; /* Convert to cachelines */
-
-        DRM_DEBUG_KMS("FIFO size - (0x%08x) %s: %d\n", dsparb,
-                      plane ? "B" : "A", size);
-
-        return size;
-}
-
 /* Pineview has different values for various configs */
 static const struct intel_watermark_params pineview_display_wm = {
         PINEVIEW_DISPLAY_FIFO,
@@ -950,14 +935,14 @@ static const struct intel_watermark_params i915_wm_info = {
         2,
         I915_FIFO_LINE_SIZE
 };
-static const struct intel_watermark_params i855_wm_info = {
+static const struct intel_watermark_params i830_wm_info = {
         I855GM_FIFO_SIZE,
         I915_MAX_WM,
         1,
         2,
         I830_FIFO_LINE_SIZE
 };
-static const struct intel_watermark_params i830_wm_info = {
+static const struct intel_watermark_params i845_wm_info = {
         I830_FIFO_SIZE,
         I915_MAX_WM,
         1,
@@ -965,65 +950,6 @@ static const struct intel_watermark_params i830_wm_info = {
         I830_FIFO_LINE_SIZE
 };
 
-static const struct intel_watermark_params ironlake_display_wm_info = {
-        ILK_DISPLAY_FIFO,
-        ILK_DISPLAY_MAXWM,
-        ILK_DISPLAY_DFTWM,
-        2,
-        ILK_FIFO_LINE_SIZE
-};
-static const struct intel_watermark_params ironlake_cursor_wm_info = {
-        ILK_CURSOR_FIFO,
-        ILK_CURSOR_MAXWM,
-        ILK_CURSOR_DFTWM,
-        2,
-        ILK_FIFO_LINE_SIZE
-};
-static const struct intel_watermark_params ironlake_display_srwm_info = {
-        ILK_DISPLAY_SR_FIFO,
-        ILK_DISPLAY_MAX_SRWM,
-        ILK_DISPLAY_DFT_SRWM,
-        2,
-        ILK_FIFO_LINE_SIZE
-};
-static const struct intel_watermark_params ironlake_cursor_srwm_info = {
-        ILK_CURSOR_SR_FIFO,
-        ILK_CURSOR_MAX_SRWM,
-        ILK_CURSOR_DFT_SRWM,
-        2,
-        ILK_FIFO_LINE_SIZE
-};
-
-static const struct intel_watermark_params sandybridge_display_wm_info = {
-        SNB_DISPLAY_FIFO,
-        SNB_DISPLAY_MAXWM,
-        SNB_DISPLAY_DFTWM,
-        2,
-        SNB_FIFO_LINE_SIZE
-};
-static const struct intel_watermark_params sandybridge_cursor_wm_info = {
-        SNB_CURSOR_FIFO,
-        SNB_CURSOR_MAXWM,
-        SNB_CURSOR_DFTWM,
-        2,
-        SNB_FIFO_LINE_SIZE
-};
-static const struct intel_watermark_params sandybridge_display_srwm_info = {
-        SNB_DISPLAY_SR_FIFO,
-        SNB_DISPLAY_MAX_SRWM,
-        SNB_DISPLAY_DFT_SRWM,
-        2,
-        SNB_FIFO_LINE_SIZE
-};
-static const struct intel_watermark_params sandybridge_cursor_srwm_info = {
-        SNB_CURSOR_SR_FIFO,
-        SNB_CURSOR_MAX_SRWM,
-        SNB_CURSOR_DFT_SRWM,
-        2,
-        SNB_FIFO_LINE_SIZE
-};
-
-
 /**
  * intel_calculate_wm - calculate watermark level
  * @clock_in_khz: pixel clock
@@ -1574,7 +1500,7 @@ static void i9xx_update_wm(struct drm_crtc *unused_crtc)
         else if (!IS_GEN2(dev))
                 wm_info = &i915_wm_info;
         else
-                wm_info = &i855_wm_info;
+                wm_info = &i830_wm_info;
 
         fifo_size = dev_priv->display.get_fifo_size(dev, 0);
         crtc = intel_get_crtc_for_plane(dev, 0);
@@ -1622,7 +1548,7 @@ static void i9xx_update_wm(struct drm_crtc *unused_crtc)
         if (IS_I945G(dev) || IS_I945GM(dev))
                 I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN_MASK | 0);
         else if (IS_I915GM(dev))
-                I915_WRITE(INSTPM, I915_READ(INSTPM) & ~INSTPM_SELF_EN);
+                I915_WRITE(INSTPM, _MASKED_BIT_DISABLE(INSTPM_SELF_EN));
 
         /* Calc sr entries for one plane configs */
         if (HAS_FW_BLC(dev) && enabled) {
@@ -1674,14 +1600,14 @@ static void i9xx_update_wm(struct drm_crtc *unused_crtc)
                                 I915_WRITE(FW_BLC_SELF,
                                            FW_BLC_SELF_EN_MASK | FW_BLC_SELF_EN);
                         else if (IS_I915GM(dev))
-                                I915_WRITE(INSTPM, I915_READ(INSTPM) | INSTPM_SELF_EN);
+                                I915_WRITE(INSTPM, _MASKED_BIT_ENABLE(INSTPM_SELF_EN));
                         DRM_DEBUG_KMS("memory self refresh enabled\n");
                 } else
                         DRM_DEBUG_KMS("memory self refresh disabled\n");
         }
 }
 
-static void i830_update_wm(struct drm_crtc *unused_crtc)
+static void i845_update_wm(struct drm_crtc *unused_crtc)
 {
         struct drm_device *dev = unused_crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1696,7 +1622,7 @@ static void i830_update_wm(struct drm_crtc *unused_crtc)
 
         adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
         planea_wm = intel_calculate_wm(adjusted_mode->crtc_clock,
-                                       &i830_wm_info,
+                                       &i845_wm_info,
                                        dev_priv->display.get_fifo_size(dev, 0),
                                        4, latency_ns);
         fwater_lo = I915_READ(FW_BLC) & ~0xfff;
@@ -1707,423 +1633,6 @@ static void i830_update_wm(struct drm_crtc *unused_crtc)
         I915_WRITE(FW_BLC, fwater_lo);
 }
 
-/*
- * Check the wm result.
- *
- * If any calculated watermark values is larger than the maximum value that
- * can be programmed into the associated watermark register, that watermark
- * must be disabled.
- */
-static bool ironlake_check_srwm(struct drm_device *dev, int level,
-                                int fbc_wm, int display_wm, int cursor_wm,
-                                const struct intel_watermark_params *display,
-                                const struct intel_watermark_params *cursor)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-
-        DRM_DEBUG_KMS("watermark %d: display plane %d, fbc lines %d,"
-                      " cursor %d\n", level, display_wm, fbc_wm, cursor_wm);
-
-        if (fbc_wm > SNB_FBC_MAX_SRWM) {
-                DRM_DEBUG_KMS("fbc watermark(%d) is too large(%d), disabling wm%d+\n",
-                              fbc_wm, SNB_FBC_MAX_SRWM, level);
-
-                /* fbc has it's own way to disable FBC WM */
-                I915_WRITE(DISP_ARB_CTL,
-                           I915_READ(DISP_ARB_CTL) | DISP_FBC_WM_DIS);
-                return false;
-        } else if (INTEL_INFO(dev)->gen >= 6) {
-                /* enable FBC WM (except on ILK, where it must remain off) */
-                I915_WRITE(DISP_ARB_CTL,
-                           I915_READ(DISP_ARB_CTL) & ~DISP_FBC_WM_DIS);
-        }
-
-        if (display_wm > display->max_wm) {
-                DRM_DEBUG_KMS("display watermark(%d) is too large(%d), disabling wm%d+\n",
-                              display_wm, SNB_DISPLAY_MAX_SRWM, level);
-                return false;
-        }
-
-        if (cursor_wm > cursor->max_wm) {
-                DRM_DEBUG_KMS("cursor watermark(%d) is too large(%d), disabling wm%d+\n",
-                              cursor_wm, SNB_CURSOR_MAX_SRWM, level);
-                return false;
-        }
-
-        if (!(fbc_wm || display_wm || cursor_wm)) {
-                DRM_DEBUG_KMS("latency %d is 0, disabling wm%d+\n", level, level);
-                return false;
-        }
-
-        return true;
-}
-
-/*
- * Compute watermark values of WM[1-3],
- */
-static bool ironlake_compute_srwm(struct drm_device *dev, int level, int plane,
-                                  int latency_ns,
-                                  const struct intel_watermark_params *display,
-                                  const struct intel_watermark_params *cursor,
-                                  int *fbc_wm, int *display_wm, int *cursor_wm)
-{
-        struct drm_crtc *crtc;
-        const struct drm_display_mode *adjusted_mode;
-        unsigned long line_time_us;
-        int hdisplay, htotal, pixel_size, clock;
-        int line_count, line_size;
-        int small, large;
-        int entries;
-
-        if (!latency_ns) {
-                *fbc_wm = *display_wm = *cursor_wm = 0;
-                return false;
-        }
-
-        crtc = intel_get_crtc_for_plane(dev, plane);
-        adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
-        clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->crtc_htotal;
-        hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
-        pixel_size = crtc->fb->bits_per_pixel / 8;
-
-        line_time_us = (htotal * 1000) / clock;
-        line_count = (latency_ns / line_time_us + 1000) / 1000;
-        line_size = hdisplay * pixel_size;
-
-        /* Use the minimum of the small and large buffer method for primary */
-        small = ((clock * pixel_size / 1000) * latency_ns) / 1000;
-        large = line_count * line_size;
-
-        entries = DIV_ROUND_UP(min(small, large), display->cacheline_size);
-        *display_wm = entries + display->guard_size;
-
-        /*
-         * Spec says:
-         * FBC WM = ((Final Primary WM * 64) / number of bytes per line) + 2
-         */
-        *fbc_wm = DIV_ROUND_UP(*display_wm * 64, line_size) + 2;
-
-        /* calculate the self-refresh watermark for display cursor */
-        entries = line_count * pixel_size * 64;
-        entries = DIV_ROUND_UP(entries, cursor->cacheline_size);
-        *cursor_wm = entries + cursor->guard_size;
-
-        return ironlake_check_srwm(dev, level,
-                                   *fbc_wm, *display_wm, *cursor_wm,
-                                   display, cursor);
-}
-
-static void ironlake_update_wm(struct drm_crtc *crtc)
-{
-        struct drm_device *dev = crtc->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int fbc_wm, plane_wm, cursor_wm;
-        unsigned int enabled;
-
-        enabled = 0;
-        if (g4x_compute_wm0(dev, PIPE_A,
-                            &ironlake_display_wm_info,
-                            dev_priv->wm.pri_latency[0] * 100,
-                            &ironlake_cursor_wm_info,
-                            dev_priv->wm.cur_latency[0] * 100,
-                            &plane_wm, &cursor_wm)) {
-                I915_WRITE(WM0_PIPEA_ILK,
-                           (plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm);
-                DRM_DEBUG_KMS("FIFO watermarks For pipe A -"
-                              " plane %d, " "cursor: %d\n",
-                              plane_wm, cursor_wm);
-                enabled |= 1 << PIPE_A;
-        }
-
-        if (g4x_compute_wm0(dev, PIPE_B,
-                            &ironlake_display_wm_info,
-                            dev_priv->wm.pri_latency[0] * 100,
-                            &ironlake_cursor_wm_info,
-                            dev_priv->wm.cur_latency[0] * 100,
-                            &plane_wm, &cursor_wm)) {
-                I915_WRITE(WM0_PIPEB_ILK,
-                           (plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm);
-                DRM_DEBUG_KMS("FIFO watermarks For pipe B -"
-                              " plane %d, cursor: %d\n",
-                              plane_wm, cursor_wm);
-                enabled |= 1 << PIPE_B;
-        }
-
-        /*
-         * Calculate and update the self-refresh watermark only when one
-         * display plane is used.
-         */
-        I915_WRITE(WM3_LP_ILK, 0);
-        I915_WRITE(WM2_LP_ILK, 0);
-        I915_WRITE(WM1_LP_ILK, 0);
-
-        if (!single_plane_enabled(enabled))
-                return;
-        enabled = ffs(enabled) - 1;
-
-        /* WM1 */
-        if (!ironlake_compute_srwm(dev, 1, enabled,
-                                   dev_priv->wm.pri_latency[1] * 500,
-                                   &ironlake_display_srwm_info,
-                                   &ironlake_cursor_srwm_info,
-                                   &fbc_wm, &plane_wm, &cursor_wm))
-                return;
-
-        I915_WRITE(WM1_LP_ILK,
-                   WM1_LP_SR_EN |
-                   (dev_priv->wm.pri_latency[1] << WM1_LP_LATENCY_SHIFT) |
-                   (fbc_wm << WM1_LP_FBC_SHIFT) |
-                   (plane_wm << WM1_LP_SR_SHIFT) |
-                   cursor_wm);
-
-        /* WM2 */
-        if (!ironlake_compute_srwm(dev, 2, enabled,
-                                   dev_priv->wm.pri_latency[2] * 500,
-                                   &ironlake_display_srwm_info,
-                                   &ironlake_cursor_srwm_info,
-                                   &fbc_wm, &plane_wm, &cursor_wm))
-                return;
-
-        I915_WRITE(WM2_LP_ILK,
-                   WM2_LP_EN |
-                   (dev_priv->wm.pri_latency[2] << WM1_LP_LATENCY_SHIFT) |
-                   (fbc_wm << WM1_LP_FBC_SHIFT) |
-                   (plane_wm << WM1_LP_SR_SHIFT) |
-                   cursor_wm);
-
-        /*
-         * WM3 is unsupported on ILK, probably because we don't have latency
-         * data for that power state
-         */
-}
-
-static void sandybridge_update_wm(struct drm_crtc *crtc)
-{
-        struct drm_device *dev = crtc->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int latency = dev_priv->wm.pri_latency[0] * 100;        /* In unit 0.1us */
-        u32 val;
-        int fbc_wm, plane_wm, cursor_wm;
-        unsigned int enabled;
-
-        enabled = 0;
-        if (g4x_compute_wm0(dev, PIPE_A,
-                            &sandybridge_display_wm_info, latency,
-                            &sandybridge_cursor_wm_info, latency,
-                            &plane_wm, &cursor_wm)) {
-                val = I915_READ(WM0_PIPEA_ILK);
-                val &= ~(WM0_PIPE_PLANE_MASK | WM0_PIPE_CURSOR_MASK);
-                I915_WRITE(WM0_PIPEA_ILK, val |
-                           ((plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm));
-                DRM_DEBUG_KMS("FIFO watermarks For pipe A -"
-                              " plane %d, " "cursor: %d\n",
-                              plane_wm, cursor_wm);
-                enabled |= 1 << PIPE_A;
-        }
-
-        if (g4x_compute_wm0(dev, PIPE_B,
-                            &sandybridge_display_wm_info, latency,
-                            &sandybridge_cursor_wm_info, latency,
-                            &plane_wm, &cursor_wm)) {
-                val = I915_READ(WM0_PIPEB_ILK);
-                val &= ~(WM0_PIPE_PLANE_MASK | WM0_PIPE_CURSOR_MASK);
-                I915_WRITE(WM0_PIPEB_ILK, val |
-                           ((plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm));
-                DRM_DEBUG_KMS("FIFO watermarks For pipe B -"
-                              " plane %d, cursor: %d\n",
-                              plane_wm, cursor_wm);
-                enabled |= 1 << PIPE_B;
-        }
-
-        /*
-         * Calculate and update the self-refresh watermark only when one
-         * display plane is used.
-         *
-         * SNB support 3 levels of watermark.
-         *
-         * WM1/WM2/WM2 watermarks have to be enabled in the ascending order,
-         * and disabled in the descending order
-         *
-         */
-        I915_WRITE(WM3_LP_ILK, 0);
-        I915_WRITE(WM2_LP_ILK, 0);
-        I915_WRITE(WM1_LP_ILK, 0);
-
-        if (!single_plane_enabled(enabled) ||
-            dev_priv->sprite_scaling_enabled)
-                return;
-        enabled = ffs(enabled) - 1;
-
-        /* WM1 */
-        if (!ironlake_compute_srwm(dev, 1, enabled,
-                                   dev_priv->wm.pri_latency[1] * 500,
-                                   &sandybridge_display_srwm_info,
-                                   &sandybridge_cursor_srwm_info,
-                                   &fbc_wm, &plane_wm, &cursor_wm))
-                return;
-
-        I915_WRITE(WM1_LP_ILK,
-                   WM1_LP_SR_EN |
-                   (dev_priv->wm.pri_latency[1] << WM1_LP_LATENCY_SHIFT) |
-                   (fbc_wm << WM1_LP_FBC_SHIFT) |
-                   (plane_wm << WM1_LP_SR_SHIFT) |
-                   cursor_wm);
-
-        /* WM2 */
-        if (!ironlake_compute_srwm(dev, 2, enabled,
-                                   dev_priv->wm.pri_latency[2] * 500,
-                                   &sandybridge_display_srwm_info,
-                                   &sandybridge_cursor_srwm_info,
-                                   &fbc_wm, &plane_wm, &cursor_wm))
-                return;
-
-        I915_WRITE(WM2_LP_ILK,
-                   WM2_LP_EN |
-                   (dev_priv->wm.pri_latency[2] << WM1_LP_LATENCY_SHIFT) |
-                   (fbc_wm << WM1_LP_FBC_SHIFT) |
-                   (plane_wm << WM1_LP_SR_SHIFT) |
-                   cursor_wm);
-
-        /* WM3 */
-        if (!ironlake_compute_srwm(dev, 3, enabled,
-                                   dev_priv->wm.pri_latency[3] * 500,
-                                   &sandybridge_display_srwm_info,
-                                   &sandybridge_cursor_srwm_info,
-                                   &fbc_wm, &plane_wm, &cursor_wm))
-                return;
-
-        I915_WRITE(WM3_LP_ILK,
-                   WM3_LP_EN |
-                   (dev_priv->wm.pri_latency[3] << WM1_LP_LATENCY_SHIFT) |
-                   (fbc_wm << WM1_LP_FBC_SHIFT) |
-                   (plane_wm << WM1_LP_SR_SHIFT) |
-                   cursor_wm);
-}
-
-static void ivybridge_update_wm(struct drm_crtc *crtc)
-{
-        struct drm_device *dev = crtc->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int latency = dev_priv->wm.pri_latency[0] * 100;        /* In unit 0.1us */
-        u32 val;
-        int fbc_wm, plane_wm, cursor_wm;
-        int ignore_fbc_wm, ignore_plane_wm, ignore_cursor_wm;
-        unsigned int enabled;
-
-        enabled = 0;
-        if (g4x_compute_wm0(dev, PIPE_A,
-                            &sandybridge_display_wm_info, latency,
-                            &sandybridge_cursor_wm_info, latency,
-                            &plane_wm, &cursor_wm)) {
-                val = I915_READ(WM0_PIPEA_ILK);
-                val &= ~(WM0_PIPE_PLANE_MASK | WM0_PIPE_CURSOR_MASK);
-                I915_WRITE(WM0_PIPEA_ILK, val |
-                           ((plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm));
-                DRM_DEBUG_KMS("FIFO watermarks For pipe A -"
-                              " plane %d, " "cursor: %d\n",
-                              plane_wm, cursor_wm);
-                enabled |= 1 << PIPE_A;
-        }
-
-        if (g4x_compute_wm0(dev, PIPE_B,
-                            &sandybridge_display_wm_info, latency,
-                            &sandybridge_cursor_wm_info, latency,
-                            &plane_wm, &cursor_wm)) {
-                val = I915_READ(WM0_PIPEB_ILK);
-                val &= ~(WM0_PIPE_PLANE_MASK | WM0_PIPE_CURSOR_MASK);
-                I915_WRITE(WM0_PIPEB_ILK, val |
-                           ((plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm));
-                DRM_DEBUG_KMS("FIFO watermarks For pipe B -"
-                              " plane %d, cursor: %d\n",
-                              plane_wm, cursor_wm);
-                enabled |= 1 << PIPE_B;
-        }
-
-        if (g4x_compute_wm0(dev, PIPE_C,
-                            &sandybridge_display_wm_info, latency,
-                            &sandybridge_cursor_wm_info, latency,
-                            &plane_wm, &cursor_wm)) {
-                val = I915_READ(WM0_PIPEC_IVB);
-                val &= ~(WM0_PIPE_PLANE_MASK | WM0_PIPE_CURSOR_MASK);
-                I915_WRITE(WM0_PIPEC_IVB, val |
-                           ((plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm));
-                DRM_DEBUG_KMS("FIFO watermarks For pipe C -"
-                              " plane %d, cursor: %d\n",
-                              plane_wm, cursor_wm);
-                enabled |= 1 << PIPE_C;
-        }
-
-        /*
-         * Calculate and update the self-refresh watermark only when one
-         * display plane is used.
-         *
-         * SNB support 3 levels of watermark.
-         *
-         * WM1/WM2/WM2 watermarks have to be enabled in the ascending order,
-         * and disabled in the descending order
-         *
-         */
-        I915_WRITE(WM3_LP_ILK, 0);
-        I915_WRITE(WM2_LP_ILK, 0);
-        I915_WRITE(WM1_LP_ILK, 0);
-
-        if (!single_plane_enabled(enabled) ||
-            dev_priv->sprite_scaling_enabled)
-                return;
-        enabled = ffs(enabled) - 1;
-
-        /* WM1 */
-        if (!ironlake_compute_srwm(dev, 1, enabled,
-                                   dev_priv->wm.pri_latency[1] * 500,
-                                   &sandybridge_display_srwm_info,
-                                   &sandybridge_cursor_srwm_info,
-                                   &fbc_wm, &plane_wm, &cursor_wm))
-                return;
-
-        I915_WRITE(WM1_LP_ILK,
-                   WM1_LP_SR_EN |
-                   (dev_priv->wm.pri_latency[1] << WM1_LP_LATENCY_SHIFT) |
-                   (fbc_wm << WM1_LP_FBC_SHIFT) |
-                   (plane_wm << WM1_LP_SR_SHIFT) |
-                   cursor_wm);
-
-        /* WM2 */
-        if (!ironlake_compute_srwm(dev, 2, enabled,
-                                   dev_priv->wm.pri_latency[2] * 500,
-                                   &sandybridge_display_srwm_info,
-                                   &sandybridge_cursor_srwm_info,
-                                   &fbc_wm, &plane_wm, &cursor_wm))
-                return;
-
-        I915_WRITE(WM2_LP_ILK,
-                   WM2_LP_EN |
-                   (dev_priv->wm.pri_latency[2] << WM1_LP_LATENCY_SHIFT) |
-                   (fbc_wm << WM1_LP_FBC_SHIFT) |
-                   (plane_wm << WM1_LP_SR_SHIFT) |
-                   cursor_wm);
-
-        /* WM3, note we have to correct the cursor latency */
-        if (!ironlake_compute_srwm(dev, 3, enabled,
-                                   dev_priv->wm.pri_latency[3] * 500,
-                                   &sandybridge_display_srwm_info,
-                                   &sandybridge_cursor_srwm_info,
-                                   &fbc_wm, &plane_wm, &ignore_cursor_wm) ||
-            !ironlake_compute_srwm(dev, 3, enabled,
-                                   dev_priv->wm.cur_latency[3] * 500,
-                                   &sandybridge_display_srwm_info,
-                                   &sandybridge_cursor_srwm_info,
-                                   &ignore_fbc_wm, &ignore_plane_wm, &cursor_wm))
-                return;
-
-        I915_WRITE(WM3_LP_ILK,
-                   WM3_LP_EN |
-                   (dev_priv->wm.pri_latency[3] << WM1_LP_LATENCY_SHIFT) |
-                   (fbc_wm << WM1_LP_FBC_SHIFT) |
-                   (plane_wm << WM1_LP_SR_SHIFT) |
-                   cursor_wm);
-}
-
 static uint32_t ilk_pipe_pixel_rate(struct drm_device *dev,
                                     struct drm_crtc *crtc)
 {
@@ -2192,7 +1701,7 @@ static uint32_t ilk_wm_fbc(uint32_t pri_val, uint32_t horiz_pixels,
         return DIV_ROUND_UP(pri_val * 64, horiz_pixels * bytes_per_pixel) + 2;
 }
 
-struct hsw_pipe_wm_parameters {
+struct ilk_pipe_wm_parameters {
         bool active;
         uint32_t pipe_htotal;
         uint32_t pixel_rate;
@@ -2201,7 +1710,7 @@ struct hsw_pipe_wm_parameters {
         struct intel_plane_wm_parameters cur;
 };
 
-struct hsw_wm_maximums {
+struct ilk_wm_maximums {
         uint16_t pri;
         uint16_t spr;
         uint16_t cur;
@@ -2219,7 +1728,7 @@ struct intel_wm_config {
  * For both WM_PIPE and WM_LP.
  * mem_value must be in 0.1us units.
  */
-static uint32_t ilk_compute_pri_wm(const struct hsw_pipe_wm_parameters *params,
+static uint32_t ilk_compute_pri_wm(const struct ilk_pipe_wm_parameters *params,
                                    uint32_t mem_value,
                                    bool is_lp)
 {
@@ -2248,7 +1757,7 @@ static uint32_t ilk_compute_pri_wm(const struct hsw_pipe_wm_parameters *params,
  * For both WM_PIPE and WM_LP.
  * mem_value must be in 0.1us units.
  */
-static uint32_t ilk_compute_spr_wm(const struct hsw_pipe_wm_parameters *params,
+static uint32_t ilk_compute_spr_wm(const struct ilk_pipe_wm_parameters *params,
                                    uint32_t mem_value)
 {
         uint32_t method1, method2;
@@ -2271,7 +1780,7 @@ static uint32_t ilk_compute_spr_wm(const struct hsw_pipe_wm_parameters *params,
  * For both WM_PIPE and WM_LP.
  * mem_value must be in 0.1us units.
  */
-static uint32_t ilk_compute_cur_wm(const struct hsw_pipe_wm_parameters *params,
+static uint32_t ilk_compute_cur_wm(const struct ilk_pipe_wm_parameters *params,
                                    uint32_t mem_value)
 {
         if (!params->active || !params->cur.enabled)
@@ -2285,7 +1794,7 @@ static uint32_t ilk_compute_cur_wm(const struct hsw_pipe_wm_parameters *params,
 }
 
 /* Only for WM_LP. */
-static uint32_t ilk_compute_fbc_wm(const struct hsw_pipe_wm_parameters *params,
+static uint32_t ilk_compute_fbc_wm(const struct ilk_pipe_wm_parameters *params,
                                    uint32_t pri_val)
 {
         if (!params->active || !params->pri.enabled)
@@ -2390,7 +1899,7 @@ static void ilk_compute_wm_maximums(struct drm_device *dev,
                                     int level,
                                     const struct intel_wm_config *config,
                                     enum intel_ddb_partitioning ddb_partitioning,
-                                    struct hsw_wm_maximums *max)
+                                    struct ilk_wm_maximums *max)
 {
         max->pri = ilk_plane_wm_max(dev, level, config, ddb_partitioning, false);
         max->spr = ilk_plane_wm_max(dev, level, config, ddb_partitioning, true);
@@ -2399,7 +1908,7 @@ static void ilk_compute_wm_maximums(struct drm_device *dev,
 }
 
 static bool ilk_validate_wm_level(int level,
-                                  const struct hsw_wm_maximums *max,
+                                  const struct ilk_wm_maximums *max,
                                   struct intel_wm_level *result)
 {
         bool ret;
@@ -2441,7 +1950,7 @@ static bool ilk_validate_wm_level(int level,
 
 static void ilk_compute_wm_level(struct drm_i915_private *dev_priv,
                                  int level,
-                                 const struct hsw_pipe_wm_parameters *p,
+                                 const struct ilk_pipe_wm_parameters *p,
                                  struct intel_wm_level *result)
 {
         uint16_t pri_latency = dev_priv->wm.pri_latency[level];
@@ -2489,7 +1998,7 @@ static void intel_read_wm_latency(struct drm_device *dev, uint16_t wm[5])
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
-        if (IS_HASWELL(dev)) {
+        if (IS_HASWELL(dev) || IS_BROADWELL(dev)) {
                 uint64_t sskpd = I915_READ64(MCH_SSKPD);
 
                 wm[0] = (sskpd >> 56) & 0xFF;
@@ -2537,7 +2046,7 @@ static void intel_fixup_cur_wm_latency(struct drm_device *dev, uint16_t wm[5])
 static int ilk_wm_max_level(const struct drm_device *dev)
 {
         /* how many WM levels are we expecting */
-        if (IS_HASWELL(dev))
+        if (IS_HASWELL(dev) || IS_BROADWELL(dev))
                 return 4;
         else if (INTEL_INFO(dev)->gen >= 6)
                 return 3;
@@ -2589,8 +2098,8 @@ static void intel_setup_wm_latency(struct drm_device *dev)
         intel_print_wm_latency(dev, "Cursor", dev_priv->wm.cur_latency);
 }
 
-static void hsw_compute_wm_parameters(struct drm_crtc *crtc,
-                                      struct hsw_pipe_wm_parameters *p,
+static void ilk_compute_wm_parameters(struct drm_crtc *crtc,
+                                      struct ilk_pipe_wm_parameters *p,
                                       struct intel_wm_config *config)
 {
         struct drm_device *dev = crtc->dev;
@@ -2600,7 +2109,7 @@ static void hsw_compute_wm_parameters(struct drm_crtc *crtc,
 
         p->active = intel_crtc_active(crtc);
         if (p->active) {
-                p->pipe_htotal = intel_crtc->config.adjusted_mode.htotal;
+                p->pipe_htotal = intel_crtc->config.adjusted_mode.crtc_htotal;
                 p->pixel_rate = ilk_pipe_pixel_rate(dev, crtc);
                 p->pri.bytes_per_pixel = crtc->fb->bits_per_pixel / 8;
                 p->cur.bytes_per_pixel = 4;
@@ -2627,7 +2136,7 @@ static void hsw_compute_wm_parameters(struct drm_crtc *crtc,
 
 /* Compute new watermarks for the pipe */
 static bool intel_compute_pipe_wm(struct drm_crtc *crtc,
-                                  const struct hsw_pipe_wm_parameters *params,
+                                  const struct ilk_pipe_wm_parameters *params,
                                   struct intel_pipe_wm *pipe_wm)
 {
         struct drm_device *dev = crtc->dev;
@@ -2639,16 +2148,25 @@ static bool intel_compute_pipe_wm(struct drm_crtc *crtc,
                 .sprites_enabled = params->spr.enabled,
                 .sprites_scaled = params->spr.scaled,
         };
-        struct hsw_wm_maximums max;
+        struct ilk_wm_maximums max;
 
         /* LP0 watermarks always use 1/2 DDB partitioning */
         ilk_compute_wm_maximums(dev, 0, &config, INTEL_DDB_PART_1_2, &max);
 
+        /* ILK/SNB: LP2+ watermarks only w/o sprites */
+        if (INTEL_INFO(dev)->gen <= 6 && params->spr.enabled)
+                max_level = 1;
+
+        /* ILK/SNB/IVB: LP1+ watermarks only w/o scaling */
+        if (params->spr.scaled)
+                max_level = 0;
+
         for (level = 0; level <= max_level; level++)
                 ilk_compute_wm_level(dev_priv, level, params,
                                      &pipe_wm->wm[level]);
 
-        pipe_wm->linetime = hsw_compute_linetime_wm(dev, crtc);
+        if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+                pipe_wm->linetime = hsw_compute_linetime_wm(dev, crtc);
 
         /* At least LP0 must be valid */
         return ilk_validate_wm_level(0, &max, &pipe_wm->wm[0]);
@@ -2683,12 +2201,19 @@ static void ilk_merge_wm_level(struct drm_device *dev,
  * Merge all low power watermarks for all active pipes.
  */
 static void ilk_wm_merge(struct drm_device *dev,
-                         const struct hsw_wm_maximums *max,
+                         const struct intel_wm_config *config,
+                         const struct ilk_wm_maximums *max,
                          struct intel_pipe_wm *merged)
 {
         int level, max_level = ilk_wm_max_level(dev);
 
-        merged->fbc_wm_enabled = true;
+        /* ILK/SNB/IVB: LP1+ watermarks only w/ single pipe */
+        if ((INTEL_INFO(dev)->gen <= 6 || IS_IVYBRIDGE(dev)) &&
+            config->num_pipes_active > 1)
+                return;
+
+        /* ILK: FBC WM must be disabled always */
+        merged->fbc_wm_enabled = INTEL_INFO(dev)->gen >= 6;
 
         /* merge each WM1+ level */
         for (level = 1; level <= max_level; level++) {
@@ -2708,6 +2233,20 @@ static void ilk_wm_merge(struct drm_device *dev,
                         wm->fbc_val = 0;
                 }
         }
+
+        /* ILK: LP2+ must be disabled when FBC WM is disabled but FBC enabled */
+        /*
+         * FIXME this is racy. FBC might get enabled later.
+         * What we should check here is whether FBC can be
+         * enabled sometime later.
+         */
+        if (IS_GEN5(dev) && !merged->fbc_wm_enabled && intel_fbc_enabled(dev)) {
+                for (level = 2; level <= max_level; level++) {
+                        struct intel_wm_level *wm = &merged->wm[level];
+
+                        wm->enable = false;
+                }
+        }
 }
 
 static int ilk_wm_lp_to_level(int wm_lp, const struct intel_pipe_wm *pipe_wm)
@@ -2716,10 +2255,21 @@ static int ilk_wm_lp_to_level(int wm_lp, const struct intel_pipe_wm *pipe_wm)
         return wm_lp + (wm_lp >= 2 && pipe_wm->wm[4].enable);
 }
 
-static void hsw_compute_wm_results(struct drm_device *dev,
+/* The value we need to program into the WM_LPx latency field */
+static unsigned int ilk_wm_lp_latency(struct drm_device *dev, int level)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+                return 2 * level;
+        else
+                return dev_priv->wm.pri_latency[level];
+}
+
+static void ilk_compute_wm_results(struct drm_device *dev,
                                    const struct intel_pipe_wm *merged,
                                    enum intel_ddb_partitioning partitioning,
-                                   struct hsw_wm_values *results)
+                                   struct ilk_wm_values *results)
 {
         struct intel_crtc *intel_crtc;
         int level, wm_lp;
@@ -2738,7 +2288,7 @@ static void hsw_compute_wm_results(struct drm_device *dev,
                         break;
 
                 results->wm_lp[wm_lp - 1] = WM3_LP_EN |
-                        ((level * 2) << WM1_LP_LATENCY_SHIFT) |
+                        (ilk_wm_lp_latency(dev, level) << WM1_LP_LATENCY_SHIFT) |
                         (r->pri_val << WM1_LP_SR_SHIFT) |
                         r->cur_val;
 
@@ -2749,7 +2299,11 @@ static void hsw_compute_wm_results(struct drm_device *dev,
                         results->wm_lp[wm_lp - 1] |=
                                 r->fbc_val << WM1_LP_FBC_SHIFT;
 
-                results->wm_lp_spr[wm_lp - 1] = r->spr_val;
+                if (INTEL_INFO(dev)->gen <= 6 && r->spr_val) {
+                        WARN_ON(wm_lp != 1);
+                        results->wm_lp_spr[wm_lp - 1] = WM1S_LP_EN | r->spr_val;
+                } else
+                        results->wm_lp_spr[wm_lp - 1] = r->spr_val;
         }
 
         /* LP0 register values */
@@ -2772,7 +2326,7 @@ static void hsw_compute_wm_results(struct drm_device *dev,
 
 /* Find the result with the highest level enabled. Check for enable_fbc_wm in
  * case both are at the same level. Prefer r1 in case they're the same. */
-static struct intel_pipe_wm *hsw_find_best_result(struct drm_device *dev,
+static struct intel_pipe_wm *ilk_find_best_result(struct drm_device *dev,
                                                   struct intel_pipe_wm *r1,
                                                   struct intel_pipe_wm *r2)
 {
@@ -2807,8 +2361,8 @@ static struct intel_pipe_wm *hsw_find_best_result(struct drm_device *dev,
 #define WM_DIRTY_DDB (1 << 25)
 
 static unsigned int ilk_compute_wm_dirty(struct drm_device *dev,
-                                         const struct hsw_wm_values *old,
-                                         const struct hsw_wm_values *new)
+                                         const struct ilk_wm_values *old,
+                                         const struct ilk_wm_values *new)
 {
         unsigned int dirty = 0;
         enum pipe pipe;
@@ -2858,27 +2412,53 @@ static unsigned int ilk_compute_wm_dirty(struct drm_device *dev,
         return dirty;
 }
 
+static bool _ilk_disable_lp_wm(struct drm_i915_private *dev_priv,
+                               unsigned int dirty)
+{
+        struct ilk_wm_values *previous = &dev_priv->wm.hw;
+        bool changed = false;
+
+        if (dirty & WM_DIRTY_LP(3) && previous->wm_lp[2] & WM1_LP_SR_EN) {
+                previous->wm_lp[2] &= ~WM1_LP_SR_EN;
+                I915_WRITE(WM3_LP_ILK, previous->wm_lp[2]);
+                changed = true;
+        }
+        if (dirty & WM_DIRTY_LP(2) && previous->wm_lp[1] & WM1_LP_SR_EN) {
+                previous->wm_lp[1] &= ~WM1_LP_SR_EN;
+                I915_WRITE(WM2_LP_ILK, previous->wm_lp[1]);
+                changed = true;
+        }
+        if (dirty & WM_DIRTY_LP(1) && previous->wm_lp[0] & WM1_LP_SR_EN) {
+                previous->wm_lp[0] &= ~WM1_LP_SR_EN;
+                I915_WRITE(WM1_LP_ILK, previous->wm_lp[0]);
+                changed = true;
+        }
+
+        /*
+         * Don't touch WM1S_LP_EN here.
+         * Doing so could cause underruns.
+         */
+
+        return changed;
+}
+
 /*
  * The spec says we shouldn't write when we don't need, because every write
  * causes WMs to be re-evaluated, expending some power.
  */
-static void hsw_write_wm_values(struct drm_i915_private *dev_priv,
-                                struct hsw_wm_values *results)
+static void ilk_write_wm_values(struct drm_i915_private *dev_priv,
+                                struct ilk_wm_values *results)
 {
-        struct hsw_wm_values *previous = &dev_priv->wm.hw;
+        struct drm_device *dev = dev_priv->dev;
+        struct ilk_wm_values *previous = &dev_priv->wm.hw;
         unsigned int dirty;
         uint32_t val;
 
-        dirty = ilk_compute_wm_dirty(dev_priv->dev, previous, results);
+        dirty = ilk_compute_wm_dirty(dev, previous, results);
         if (!dirty)
                 return;
 
-        if (dirty & WM_DIRTY_LP(3) && previous->wm_lp[2] != 0)
-                I915_WRITE(WM3_LP_ILK, 0);
-        if (dirty & WM_DIRTY_LP(2) && previous->wm_lp[1] != 0)
-                I915_WRITE(WM2_LP_ILK, 0);
-        if (dirty & WM_DIRTY_LP(1) && previous->wm_lp[0] != 0)
-                I915_WRITE(WM1_LP_ILK, 0);
+        _ilk_disable_lp_wm(dev_priv, dirty);
 
         if (dirty & WM_DIRTY_PIPE(PIPE_A))
                 I915_WRITE(WM0_PIPEA_ILK, results->wm_pipe[0]);
@@ -2895,12 +2475,21 @@ static void hsw_write_wm_values(struct drm_i915_private *dev_priv,
                 I915_WRITE(PIPE_WM_LINETIME(PIPE_C), results->wm_linetime[2]);
 
         if (dirty & WM_DIRTY_DDB) {
-                val = I915_READ(WM_MISC);
-                if (results->partitioning == INTEL_DDB_PART_1_2)
-                        val &= ~WM_MISC_DATA_PARTITION_5_6;
-                else
-                        val |= WM_MISC_DATA_PARTITION_5_6;
-                I915_WRITE(WM_MISC, val);
+                if (IS_HASWELL(dev) || IS_BROADWELL(dev)) {
+                        val = I915_READ(WM_MISC);
+                        if (results->partitioning == INTEL_DDB_PART_1_2)
+                                val &= ~WM_MISC_DATA_PARTITION_5_6;
+                        else
+                                val |= WM_MISC_DATA_PARTITION_5_6;
+                        I915_WRITE(WM_MISC, val);
+                } else {
+                        val = I915_READ(DISP_ARB_CTL2);
+                        if (results->partitioning == INTEL_DDB_PART_1_2)
+                                val &= ~DISP_DATA_PARTITION_5_6;
+                        else
+                                val |= DISP_DATA_PARTITION_5_6;
+                        I915_WRITE(DISP_ARB_CTL2, val);
+                }
         }
 
         if (dirty & WM_DIRTY_FBC) {
@@ -2912,37 +2501,48 @@ static void hsw_write_wm_values(struct drm_i915_private *dev_priv,
                 I915_WRITE(DISP_ARB_CTL, val);
         }
 
-        if (dirty & WM_DIRTY_LP(1) && previous->wm_lp_spr[0] != results->wm_lp_spr[0])
+        if (dirty & WM_DIRTY_LP(1) &&
+            previous->wm_lp_spr[0] != results->wm_lp_spr[0])
                 I915_WRITE(WM1S_LP_ILK, results->wm_lp_spr[0]);
-        if (dirty & WM_DIRTY_LP(2) && previous->wm_lp_spr[1] != results->wm_lp_spr[1])
-                I915_WRITE(WM2S_LP_IVB, results->wm_lp_spr[1]);
-        if (dirty & WM_DIRTY_LP(3) && previous->wm_lp_spr[2] != results->wm_lp_spr[2])
-                I915_WRITE(WM3S_LP_IVB, results->wm_lp_spr[2]);
 
-        if (dirty & WM_DIRTY_LP(1) && results->wm_lp[0] != 0)
+        if (INTEL_INFO(dev)->gen >= 7) {
+                if (dirty & WM_DIRTY_LP(2) && previous->wm_lp_spr[1] != results->wm_lp_spr[1])
+                        I915_WRITE(WM2S_LP_IVB, results->wm_lp_spr[1]);
+                if (dirty & WM_DIRTY_LP(3) && previous->wm_lp_spr[2] != results->wm_lp_spr[2])
+                        I915_WRITE(WM3S_LP_IVB, results->wm_lp_spr[2]);
+        }
+
+        if (dirty & WM_DIRTY_LP(1) && previous->wm_lp[0] != results->wm_lp[0])
                 I915_WRITE(WM1_LP_ILK, results->wm_lp[0]);
-        if (dirty & WM_DIRTY_LP(2) && results->wm_lp[1] != 0)
+        if (dirty & WM_DIRTY_LP(2) && previous->wm_lp[1] != results->wm_lp[1])
                 I915_WRITE(WM2_LP_ILK, results->wm_lp[1]);
-        if (dirty & WM_DIRTY_LP(3) && results->wm_lp[2] != 0)
+        if (dirty & WM_DIRTY_LP(3) && previous->wm_lp[2] != results->wm_lp[2])
                 I915_WRITE(WM3_LP_ILK, results->wm_lp[2]);
 
         dev_priv->wm.hw = *results;
 }
 
-static void haswell_update_wm(struct drm_crtc *crtc)
+static bool ilk_disable_lp_wm(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        return _ilk_disable_lp_wm(dev_priv, WM_DIRTY_LP_ALL);
+}
+
+static void ilk_update_wm(struct drm_crtc *crtc)
 {
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct hsw_wm_maximums max;
-        struct hsw_pipe_wm_parameters params = {};
-        struct hsw_wm_values results = {};
+        struct ilk_wm_maximums max;
+        struct ilk_pipe_wm_parameters params = {};
+        struct ilk_wm_values results = {};
         enum intel_ddb_partitioning partitioning;
         struct intel_pipe_wm pipe_wm = {};
         struct intel_pipe_wm lp_wm_1_2 = {}, lp_wm_5_6 = {}, *best_lp_wm;
         struct intel_wm_config config = {};
 
-        hsw_compute_wm_parameters(crtc, &params, &config);
+        ilk_compute_wm_parameters(crtc, &params, &config);
 
         intel_compute_pipe_wm(crtc, &params, &pipe_wm);
 
@@ -2952,15 +2552,15 @@ static void haswell_update_wm(struct drm_crtc *crtc)
         intel_crtc->wm.active = pipe_wm;
 
         ilk_compute_wm_maximums(dev, 1, &config, INTEL_DDB_PART_1_2, &max);
-        ilk_wm_merge(dev, &max, &lp_wm_1_2);
+        ilk_wm_merge(dev, &config, &max, &lp_wm_1_2);
 
         /* 5/6 split only in single pipe config on IVB+ */
         if (INTEL_INFO(dev)->gen >= 7 &&
             config.num_pipes_active == 1 && config.sprites_enabled) {
                 ilk_compute_wm_maximums(dev, 1, &config, INTEL_DDB_PART_5_6, &max);
-                ilk_wm_merge(dev, &max, &lp_wm_5_6);
+                ilk_wm_merge(dev, &config, &max, &lp_wm_5_6);
 
-                best_lp_wm = hsw_find_best_result(dev, &lp_wm_1_2, &lp_wm_5_6);
+                best_lp_wm = ilk_find_best_result(dev, &lp_wm_1_2, &lp_wm_5_6);
         } else {
                 best_lp_wm = &lp_wm_1_2;
         }
@@ -2968,16 +2568,17 @@ static void haswell_update_wm(struct drm_crtc *crtc)
         partitioning = (best_lp_wm == &lp_wm_1_2) ?
                        INTEL_DDB_PART_1_2 : INTEL_DDB_PART_5_6;
 
-        hsw_compute_wm_results(dev, best_lp_wm, partitioning, &results);
+        ilk_compute_wm_results(dev, best_lp_wm, partitioning, &results);
 
-        hsw_write_wm_values(dev_priv, &results);
+        ilk_write_wm_values(dev_priv, &results);
 }
 
-static void haswell_update_sprite_wm(struct drm_plane *plane,
+static void ilk_update_sprite_wm(struct drm_plane *plane,
                                      struct drm_crtc *crtc,
                                      uint32_t sprite_width, int pixel_size,
                                      bool enabled, bool scaled)
 {
+        struct drm_device *dev = plane->dev;
         struct intel_plane *intel_plane = to_intel_plane(plane);
 
         intel_plane->wm.enabled = enabled;
@@ -2985,176 +2586,24 @@ static void haswell_update_sprite_wm(struct drm_plane *plane,
         intel_plane->wm.horiz_pixels = sprite_width;
         intel_plane->wm.bytes_per_pixel = pixel_size;
 
-        haswell_update_wm(crtc);
-}
-
-static bool
-sandybridge_compute_sprite_wm(struct drm_device *dev, int plane,
-                              uint32_t sprite_width, int pixel_size,
-                              const struct intel_watermark_params *display,
-                              int display_latency_ns, int *sprite_wm)
-{
-        struct drm_crtc *crtc;
-        int clock;
-        int entries, tlb_miss;
-
-        crtc = intel_get_crtc_for_plane(dev, plane);
-        if (!intel_crtc_active(crtc)) {
-                *sprite_wm = display->guard_size;
-                return false;
-        }
-
-        clock = to_intel_crtc(crtc)->config.adjusted_mode.crtc_clock;
-
-        /* Use the small buffer method to calculate the sprite watermark */
-        entries = ((clock * pixel_size / 1000) * display_latency_ns) / 1000;
-        tlb_miss = display->fifo_size*display->cacheline_size -
-                sprite_width * 8;
-        if (tlb_miss > 0)
-                entries += tlb_miss;
-        entries = DIV_ROUND_UP(entries, display->cacheline_size);
-        *sprite_wm = entries + display->guard_size;
-        if (*sprite_wm > (int)display->max_wm)
-                *sprite_wm = display->max_wm;
-
-        return true;
-}
-
-static bool
-sandybridge_compute_sprite_srwm(struct drm_device *dev, int plane,
-                                uint32_t sprite_width, int pixel_size,
-                                const struct intel_watermark_params *display,
-                                int latency_ns, int *sprite_wm)
-{
-        struct drm_crtc *crtc;
-        unsigned long line_time_us;
-        int clock;
-        int line_count, line_size;
-        int small, large;
-        int entries;
-
-        if (!latency_ns) {
-                *sprite_wm = 0;
-                return false;
-        }
-
-        crtc = intel_get_crtc_for_plane(dev, plane);
-        clock = to_intel_crtc(crtc)->config.adjusted_mode.crtc_clock;
-        if (!clock) {
-                *sprite_wm = 0;
-                return false;
-        }
-
-        line_time_us = (sprite_width * 1000) / clock;
-        if (!line_time_us) {
-                *sprite_wm = 0;
-                return false;
-        }
-
-        line_count = (latency_ns / line_time_us + 1000) / 1000;
-        line_size = sprite_width * pixel_size;
-
-        /* Use the minimum of the small and large buffer method for primary */
-        small = ((clock * pixel_size / 1000) * latency_ns) / 1000;
-        large = line_count * line_size;
-
-        entries = DIV_ROUND_UP(min(small, large), display->cacheline_size);
-        *sprite_wm = entries + display->guard_size;
+        /*
+         * IVB workaround: must disable low power watermarks for at least
+         * one frame before enabling scaling.  LP watermarks can be re-enabled
+         * when scaling is disabled.
+         *
+         * WaCxSRDisabledForSpriteScaling:ivb
+         */
+        if (IS_IVYBRIDGE(dev) && scaled && ilk_disable_lp_wm(dev))
+                intel_wait_for_vblank(dev, intel_plane->pipe);
 
-        return *sprite_wm > 0x3ff ? false : true;
-}
-
-static void sandybridge_update_sprite_wm(struct drm_plane *plane,
-                                         struct drm_crtc *crtc,
-                                         uint32_t sprite_width, int pixel_size,
-                                         bool enabled, bool scaled)
-{
-        struct drm_device *dev = plane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int pipe = to_intel_plane(plane)->pipe;
-        int latency = dev_priv->wm.spr_latency[0] * 100;        /* In unit 0.1us */
-        u32 val;
-        int sprite_wm, reg;
-        int ret;
-
-        if (!enabled)
-                return;
-
-        switch (pipe) {
-        case 0:
-                reg = WM0_PIPEA_ILK;
-                break;
-        case 1:
-                reg = WM0_PIPEB_ILK;
-                break;
-        case 2:
-                reg = WM0_PIPEC_IVB;
-                break;
-        default:
-                return; /* bad pipe */
-        }
-
-        ret = sandybridge_compute_sprite_wm(dev, pipe, sprite_width, pixel_size,
-                                            &sandybridge_display_wm_info,
-                                            latency, &sprite_wm);
-        if (!ret) {
-                DRM_DEBUG_KMS("failed to compute sprite wm for pipe %c\n",
-                              pipe_name(pipe));
-                return;
-        }
-
-        val = I915_READ(reg);
-        val &= ~WM0_PIPE_SPRITE_MASK;
-        I915_WRITE(reg, val | (sprite_wm << WM0_PIPE_SPRITE_SHIFT));
-        DRM_DEBUG_KMS("sprite watermarks For pipe %c - %d\n", pipe_name(pipe), sprite_wm);
-
-
-        ret = sandybridge_compute_sprite_srwm(dev, pipe, sprite_width,
-                                              pixel_size,
-                                              &sandybridge_display_srwm_info,
-                                              dev_priv->wm.spr_latency[1] * 500,
-                                              &sprite_wm);
-        if (!ret) {
-                DRM_DEBUG_KMS("failed to compute sprite lp1 wm on pipe %c\n",
-                              pipe_name(pipe));
-                return;
-        }
-        I915_WRITE(WM1S_LP_ILK, sprite_wm);
-
-        /* Only IVB has two more LP watermarks for sprite */
-        if (!IS_IVYBRIDGE(dev))
-                return;
-
-        ret = sandybridge_compute_sprite_srwm(dev, pipe, sprite_width,
-                                              pixel_size,
-                                              &sandybridge_display_srwm_info,
-                                              dev_priv->wm.spr_latency[2] * 500,
-                                              &sprite_wm);
-        if (!ret) {
-                DRM_DEBUG_KMS("failed to compute sprite lp2 wm on pipe %c\n",
-                              pipe_name(pipe));
-                return;
-        }
-        I915_WRITE(WM2S_LP_IVB, sprite_wm);
-
-        ret = sandybridge_compute_sprite_srwm(dev, pipe, sprite_width,
-                                              pixel_size,
-                                              &sandybridge_display_srwm_info,
-                                              dev_priv->wm.spr_latency[3] * 500,
-                                              &sprite_wm);
-        if (!ret) {
-                DRM_DEBUG_KMS("failed to compute sprite lp3 wm on pipe %c\n",
-                              pipe_name(pipe));
-                return;
-        }
-        I915_WRITE(WM3S_LP_IVB, sprite_wm);
+        ilk_update_wm(crtc);
 }
 
 static void ilk_pipe_wm_get_hw_state(struct drm_crtc *crtc)
 {
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct hsw_wm_values *hw = &dev_priv->wm.hw;
+        struct ilk_wm_values *hw = &dev_priv->wm.hw;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct intel_pipe_wm *active = &intel_crtc->wm.active;
         enum pipe pipe = intel_crtc->pipe;
@@ -3165,7 +2614,8 @@ static void ilk_pipe_wm_get_hw_state(struct drm_crtc *crtc)
         };
 
         hw->wm_pipe[pipe] = I915_READ(wm0_pipe_reg[pipe]);
-        hw->wm_linetime[pipe] = I915_READ(PIPE_WM_LINETIME(pipe));
+        if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+                hw->wm_linetime[pipe] = I915_READ(PIPE_WM_LINETIME(pipe));
 
         if (intel_crtc_active(crtc)) {
                 u32 tmp = hw->wm_pipe[pipe];
@@ -3197,7 +2647,7 @@ static void ilk_pipe_wm_get_hw_state(struct drm_crtc *crtc)
 void ilk_wm_get_hw_state(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct hsw_wm_values *hw = &dev_priv->wm.hw;
+        struct ilk_wm_values *hw = &dev_priv->wm.hw;
         struct drm_crtc *crtc;
 
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
@@ -3211,8 +2661,12 @@ void ilk_wm_get_hw_state(struct drm_device *dev)
         hw->wm_lp_spr[1] = I915_READ(WM2S_LP_IVB);
         hw->wm_lp_spr[2] = I915_READ(WM3S_LP_IVB);
 
-        hw->partitioning = (I915_READ(WM_MISC) & WM_MISC_DATA_PARTITION_5_6) ?
-                INTEL_DDB_PART_5_6 : INTEL_DDB_PART_1_2;
+        if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+                hw->partitioning = (I915_READ(WM_MISC) & WM_MISC_DATA_PARTITION_5_6) ?
+                        INTEL_DDB_PART_5_6 : INTEL_DDB_PART_1_2;
+        else if (IS_IVYBRIDGE(dev))
+                hw->partitioning = (I915_READ(DISP_ARB_CTL2) & DISP_DATA_PARTITION_5_6) ?
+                        INTEL_DDB_PART_5_6 : INTEL_DDB_PART_1_2;
 
         hw->enable_fbc_wm =
                 !(I915_READ(DISP_ARB_CTL) & DISP_FBC_WM_DIS);
@@ -3583,9 +3037,11 @@ void gen6_set_rps(struct drm_device *dev, u8 val)
 
 void gen6_rps_idle(struct drm_i915_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+
         mutex_lock(&dev_priv->rps.hw_lock);
         if (dev_priv->rps.enabled) {
-                if (dev_priv->info->is_valleyview)
+                if (IS_VALLEYVIEW(dev))
                         valleyview_set_rps(dev_priv->dev, dev_priv->rps.min_delay);
                 else
                         gen6_set_rps(dev_priv->dev, dev_priv->rps.min_delay);
@@ -3596,9 +3052,11 @@ void gen6_rps_idle(struct drm_i915_private *dev_priv)
 
 void gen6_rps_boost(struct drm_i915_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+
         mutex_lock(&dev_priv->rps.hw_lock);
         if (dev_priv->rps.enabled) {
-                if (dev_priv->info->is_valleyview)
+                if (IS_VALLEYVIEW(dev))
                         valleyview_set_rps(dev_priv->dev, dev_priv->rps.max_delay);
                 else
                         gen6_set_rps(dev_priv->dev, dev_priv->rps.max_delay);
@@ -4972,6 +4430,20 @@ static void g4x_disable_trickle_feed(struct drm_device *dev)
         }
 }
 
+static void ilk_init_lp_watermarks(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        I915_WRITE(WM3_LP_ILK, I915_READ(WM3_LP_ILK) & ~WM1_LP_SR_EN);
+        I915_WRITE(WM2_LP_ILK, I915_READ(WM2_LP_ILK) & ~WM1_LP_SR_EN);
+        I915_WRITE(WM1_LP_ILK, I915_READ(WM1_LP_ILK) & ~WM1_LP_SR_EN);
+
+        /*
+         * Don't touch WM1S_LP_EN here.
+         * Doing so could cause underruns.
+         */
+}
+
 static void ironlake_init_clock_gating(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -5005,9 +4477,8 @@ static void ironlake_init_clock_gating(struct drm_device *dev)
         I915_WRITE(DISP_ARB_CTL,
                    (I915_READ(DISP_ARB_CTL) |
                     DISP_FBC_WM_DIS));
-        I915_WRITE(WM3_LP_ILK, 0);
-        I915_WRITE(WM2_LP_ILK, 0);
-        I915_WRITE(WM1_LP_ILK, 0);
+
+        ilk_init_lp_watermarks(dev);
 
         /*
          * Based on the document from hardware guys the following bits
@@ -5114,9 +4585,7 @@ static void gen6_init_clock_gating(struct drm_device *dev)
                 I915_WRITE(GEN6_GT_MODE,
                            _MASKED_BIT_ENABLE(GEN6_TD_FOUR_ROW_DISPATCH_DISABLE));
 
-        I915_WRITE(WM3_LP_ILK, 0);
-        I915_WRITE(WM2_LP_ILK, 0);
-        I915_WRITE(WM1_LP_ILK, 0);
+        ilk_init_lp_watermarks(dev);
 
         I915_WRITE(CACHE_MODE_0,
                    _MASKED_BIT_DISABLE(CM0_STC_EVICT_DISABLE_LRA_SNB));
@@ -5290,9 +4759,7 @@ static void haswell_init_clock_gating(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
-        I915_WRITE(WM3_LP_ILK, 0);
-        I915_WRITE(WM2_LP_ILK, 0);
-        I915_WRITE(WM1_LP_ILK, 0);
+        ilk_init_lp_watermarks(dev);
 
         /* According to the spec, bit 13 (RCZUNIT) must be set on IVB.
          * This implements the WaDisableRCZUnitClockGating:hsw workaround.
@@ -5341,9 +4808,7 @@ static void ivybridge_init_clock_gating(struct drm_device *dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         uint32_t snpcr;
 
-        I915_WRITE(WM3_LP_ILK, 0);
-        I915_WRITE(WM2_LP_ILK, 0);
-        I915_WRITE(WM1_LP_ILK, 0);
+        ilk_init_lp_watermarks(dev);
 
         I915_WRITE(ILK_DSPCLK_GATE_D, ILK_VRHUNIT_CLOCK_GATE_DISABLE);
 
@@ -6062,7 +5527,7 @@ void intel_init_pm(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
-        if (I915_HAS_FBC(dev)) {
+        if (HAS_FBC(dev)) {
                 if (INTEL_INFO(dev)->gen >= 7) {
                         dev_priv->display.fbc_enabled = ironlake_fbc_enabled;
                         dev_priv->display.enable_fbc = gen7_enable_fbc;
@@ -6095,58 +5560,27 @@ void intel_init_pm(struct drm_device *dev)
         if (HAS_PCH_SPLIT(dev)) {
                 intel_setup_wm_latency(dev);
 
-                if (IS_GEN5(dev)) {
-                        if (dev_priv->wm.pri_latency[1] &&
-                            dev_priv->wm.spr_latency[1] &&
-                            dev_priv->wm.cur_latency[1])
-                                dev_priv->display.update_wm = ironlake_update_wm;
-                        else {
-                                DRM_DEBUG_KMS("Failed to get proper latency. "
-                                              "Disable CxSR\n");
-                                dev_priv->display.update_wm = NULL;
-                        }
+                if ((IS_GEN5(dev) && dev_priv->wm.pri_latency[1] &&
+                     dev_priv->wm.spr_latency[1] && dev_priv->wm.cur_latency[1]) ||
+                    (!IS_GEN5(dev) && dev_priv->wm.pri_latency[0] &&
+                     dev_priv->wm.spr_latency[0] && dev_priv->wm.cur_latency[0])) {
+                        dev_priv->display.update_wm = ilk_update_wm;
+                        dev_priv->display.update_sprite_wm = ilk_update_sprite_wm;
+                } else {
+                        DRM_DEBUG_KMS("Failed to read display plane latency. "
+                                      "Disable CxSR\n");
+                }
+
+                if (IS_GEN5(dev))
                         dev_priv->display.init_clock_gating = ironlake_init_clock_gating;
-                } else if (IS_GEN6(dev)) {
-                        if (dev_priv->wm.pri_latency[0] &&
-                            dev_priv->wm.spr_latency[0] &&
-                            dev_priv->wm.cur_latency[0]) {
-                                dev_priv->display.update_wm = sandybridge_update_wm;
-                                dev_priv->display.update_sprite_wm = sandybridge_update_sprite_wm;
-                        } else {
-                                DRM_DEBUG_KMS("Failed to read display plane latency. "
-                                              "Disable CxSR\n");
-                                dev_priv->display.update_wm = NULL;
-                        }
+                else if (IS_GEN6(dev))
                         dev_priv->display.init_clock_gating = gen6_init_clock_gating;
-                } else if (IS_IVYBRIDGE(dev)) {
-                        if (dev_priv->wm.pri_latency[0] &&
-                            dev_priv->wm.spr_latency[0] &&
-                            dev_priv->wm.cur_latency[0]) {
-                                dev_priv->display.update_wm = ivybridge_update_wm;
-                                dev_priv->display.update_sprite_wm = sandybridge_update_sprite_wm;
-                        } else {
-                                DRM_DEBUG_KMS("Failed to read display plane latency. "
-                                              "Disable CxSR\n");
-                                dev_priv->display.update_wm = NULL;
-                        }
+                else if (IS_IVYBRIDGE(dev))
                         dev_priv->display.init_clock_gating = ivybridge_init_clock_gating;
-                } else if (IS_HASWELL(dev)) {
-                        if (dev_priv->wm.pri_latency[0] &&
-                            dev_priv->wm.spr_latency[0] &&
-                            dev_priv->wm.cur_latency[0]) {
-                                dev_priv->display.update_wm = haswell_update_wm;
-                                dev_priv->display.update_sprite_wm =
-                                        haswell_update_sprite_wm;
-                        } else {
-                                DRM_DEBUG_KMS("Failed to read display plane latency. "
-                                              "Disable CxSR\n");
-                                dev_priv->display.update_wm = NULL;
-                        }
+                else if (IS_HASWELL(dev))
                         dev_priv->display.init_clock_gating = haswell_init_clock_gating;
-                } else if (INTEL_INFO(dev)->gen == 8) {
+                else if (INTEL_INFO(dev)->gen == 8)
                         dev_priv->display.init_clock_gating = gen8_init_clock_gating;
-                } else
-                        dev_priv->display.update_wm = NULL;
         } else if (IS_VALLEYVIEW(dev)) {
                 dev_priv->display.update_wm = valleyview_update_wm;
                 dev_priv->display.init_clock_gating =
@@ -6180,21 +5614,21 @@ void intel_init_pm(struct drm_device *dev)
                 dev_priv->display.update_wm = i9xx_update_wm;
                 dev_priv->display.get_fifo_size = i9xx_get_fifo_size;
                 dev_priv->display.init_clock_gating = gen3_init_clock_gating;
-        } else if (IS_I865G(dev)) {
-                dev_priv->display.update_wm = i830_update_wm;
-                dev_priv->display.init_clock_gating = i85x_init_clock_gating;
-                dev_priv->display.get_fifo_size = i830_get_fifo_size;
-        } else if (IS_I85X(dev)) {
-                dev_priv->display.update_wm = i9xx_update_wm;
-                dev_priv->display.get_fifo_size = i85x_get_fifo_size;
-                dev_priv->display.init_clock_gating = i85x_init_clock_gating;
-        } else {
-                dev_priv->display.update_wm = i830_update_wm;
-                dev_priv->display.init_clock_gating = i830_init_clock_gating;
-                if (IS_845G(dev))
+        } else if (IS_GEN2(dev)) {
+                if (INTEL_INFO(dev)->num_pipes == 1) {
+                        dev_priv->display.update_wm = i845_update_wm;
                         dev_priv->display.get_fifo_size = i845_get_fifo_size;
-                else
+                } else {
+                        dev_priv->display.update_wm = i9xx_update_wm;
                         dev_priv->display.get_fifo_size = i830_get_fifo_size;
+                }
+
+                if (IS_I85X(dev) || IS_I865G(dev))
+                        dev_priv->display.init_clock_gating = i85x_init_clock_gating;
+                else
+                        dev_priv->display.init_clock_gating = i830_init_clock_gating;
+        } else {
+                DRM_ERROR("unexpected fall-through in intel_init_pm\n");
         }
 }
 
@@ -6289,10 +5723,19 @@ int vlv_freq_opcode(struct drm_i915_private *dev_priv, int val)
         return DIV_ROUND_CLOSEST(4 * mul * val, dev_priv->mem_freq) + 0xbd - 6;
 }
 
-void intel_pm_init(struct drm_device *dev)
+void intel_pm_setup(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
+        mutex_init(&dev_priv->rps.hw_lock);
+
+        mutex_init(&dev_priv->pc8.lock);
+        dev_priv->pc8.requirements_met = false;
+        dev_priv->pc8.gpu_idle = false;
+        dev_priv->pc8.irqs_disabled = false;
+        dev_priv->pc8.enabled = false;
+        dev_priv->pc8.disable_count = 2; /* requirements_met + gpu_idle */
+        INIT_DELAYED_WORK(&dev_priv->pc8.enable_work, hsw_enable_pc8_work);
         INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                           intel_gen6_powersave_work);
 }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index e05a0216cd9b..8fcb32a02cb4 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -663,14 +663,15 @@ gen6_add_request(struct intel_ring_buffer *ring)
         struct drm_device *dev = ring->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_ring_buffer *useless;
-        int i, ret;
+        int i, ret, num_dwords = 4;
 
-        ret = intel_ring_begin(ring, ((I915_NUM_RINGS-1) *
-                                      MBOX_UPDATE_DWORDS) +
-                                      4);
+        if (i915_semaphore_is_enabled(dev))
+                num_dwords += ((I915_NUM_RINGS-1) * MBOX_UPDATE_DWORDS);
+#undef MBOX_UPDATE_DWORDS
+
+        ret = intel_ring_begin(ring, num_dwords);
         if (ret)
                 return ret;
-#undef MBOX_UPDATE_DWORDS
 
         for_each_ring(useless, dev_priv, i) {
                 u32 mbox_reg = ring->signal_mbox[i];
@@ -1606,8 +1607,8 @@ intel_ring_alloc_seqno(struct intel_ring_buffer *ring)
         return i915_gem_get_seqno(ring->dev, &ring->outstanding_lazy_seqno);
 }
 
-static int __intel_ring_begin(struct intel_ring_buffer *ring,
-                              int bytes)
+static int __intel_ring_prepare(struct intel_ring_buffer *ring,
+                                int bytes)
 {
         int ret;
 
@@ -1623,7 +1624,6 @@ static int __intel_ring_begin(struct intel_ring_buffer *ring,
                         return ret;
         }
 
-        ring->space -= bytes;
         return 0;
 }
 
@@ -1638,12 +1638,17 @@ int intel_ring_begin(struct intel_ring_buffer *ring,
         if (ret)
                 return ret;
 
+        ret = __intel_ring_prepare(ring, num_dwords * sizeof(uint32_t));
+        if (ret)
+                return ret;
+
         /* Preallocate the olr before touching the ring */
         ret = intel_ring_alloc_seqno(ring);
         if (ret)
                 return ret;
 
-        return __intel_ring_begin(ring, num_dwords * sizeof(uint32_t));
+        ring->space -= num_dwords * sizeof(uint32_t);
+        return 0;
 }
 
 void intel_ring_init_seqno(struct intel_ring_buffer *ring, u32 seqno)
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 90a3f6db8288..fe4de89c374c 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -230,7 +230,6 @@ ivb_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
         u32 sprctl, sprscale = 0;
         unsigned long sprsurf_offset, linear_offset;
         int pixel_size = drm_format_plane_cpp(fb->pixel_format, 0);
-        bool scaling_was_enabled = dev_priv->sprite_scaling_enabled;
 
         sprctl = I915_READ(SPRCTL(pipe));
 
@@ -291,21 +290,8 @@ ivb_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
         crtc_w--;
         crtc_h--;
 
-        /*
-         * IVB workaround: must disable low power watermarks for at least
-         * one frame before enabling scaling.  LP watermarks can be re-enabled
-         * when scaling is disabled.
-         */
-        if (crtc_w != src_w || crtc_h != src_h) {
-                dev_priv->sprite_scaling_enabled |= 1 << pipe;
-
-                if (!scaling_was_enabled) {
-                        intel_update_watermarks(crtc);
-                        intel_wait_for_vblank(dev, pipe);
-                }
+        if (crtc_w != src_w || crtc_h != src_h)
                 sprscale = SPRITE_SCALE_ENABLE | (src_w << 16) | src_h;
-        } else
-                dev_priv->sprite_scaling_enabled &= ~(1 << pipe);
 
         I915_WRITE(SPRSTRIDE(pipe), fb->pitches[0]);
         I915_WRITE(SPRPOS(pipe), (crtc_y << 16) | crtc_x);
@@ -332,10 +318,6 @@ ivb_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
         I915_MODIFY_DISPBASE(SPRSURF(pipe),
                              i915_gem_obj_ggtt_offset(obj) + sprsurf_offset);
         POSTING_READ(SPRSURF(pipe));
-
-        /* potentially re-enable LP watermarks */
-        if (scaling_was_enabled && !dev_priv->sprite_scaling_enabled)
-                intel_update_watermarks(crtc);
 }
 
 static void
@@ -345,7 +327,6 @@ ivb_disable_plane(struct drm_plane *plane, struct drm_crtc *crtc)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_plane *intel_plane = to_intel_plane(plane);
         int pipe = intel_plane->pipe;
-        bool scaling_was_enabled = dev_priv->sprite_scaling_enabled;
 
         I915_WRITE(SPRCTL(pipe), I915_READ(SPRCTL(pipe)) & ~SPRITE_ENABLE);
         /* Can't leave the scaler enabled... */
@@ -355,13 +336,13 @@ ivb_disable_plane(struct drm_plane *plane, struct drm_crtc *crtc)
         I915_MODIFY_DISPBASE(SPRSURF(pipe), 0);
         POSTING_READ(SPRSURF(pipe));
 
-        dev_priv->sprite_scaling_enabled &= ~(1 << pipe);
+        /*
+         * Avoid underruns when disabling the sprite.
+         * FIXME remove once watermark updates are done properly.
+         */
+        intel_wait_for_vblank(dev, pipe);
 
         intel_update_sprite_watermarks(plane, crtc, 0, 0, false, false);
-
-        /* potentially re-enable LP watermarks */
-        if (scaling_was_enabled && !dev_priv->sprite_scaling_enabled)
-                intel_update_watermarks(crtc);
 }
 
 static int
@@ -488,7 +469,7 @@ ilk_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
         crtc_h--;
 
         dvsscale = 0;
-        if (IS_GEN5(dev) || crtc_w != src_w || crtc_h != src_h)
+        if (crtc_w != src_w || crtc_h != src_h)
                 dvsscale = DVS_SCALE_ENABLE | (src_w << 16) | src_h;
 
         I915_WRITE(DVSSTRIDE(pipe), fb->pitches[0]);
@@ -528,6 +509,12 @@ ilk_disable_plane(struct drm_plane *plane, struct drm_crtc *crtc)
         I915_MODIFY_DISPBASE(DVSSURF(pipe), 0);
         POSTING_READ(DVSSURF(pipe));
 
+        /*
+         * Avoid underruns when disabling the sprite.
+         * FIXME remove once watermark updates are done properly.
+         */
+        intel_wait_for_vblank(dev, pipe);
+
         intel_update_sprite_watermarks(plane, crtc, 0, 0, false, false);
 }
 
@@ -661,6 +648,15 @@ format_is_yuv(uint32_t format)
         }
 }
 
+static bool colorkey_enabled(struct intel_plane *intel_plane)
+{
+        struct drm_intel_sprite_colorkey key;
+
+        intel_plane->get_colorkey(&intel_plane->base, &key);
+
+        return key.flags != I915_SET_COLORKEY_NONE;
+}
+
 static int
 intel_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
                    struct drm_framebuffer *fb, int crtc_x, int crtc_y,
@@ -846,7 +842,7 @@ intel_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
          * If the sprite is completely covering the primary plane,
          * we can disable the primary and save power.
          */
-        disable_primary = drm_rect_equals(&dst, &clip);
+        disable_primary = drm_rect_equals(&dst, &clip) && !colorkey_enabled(intel_plane);
         WARN_ON(disable_primary && !visible && intel_crtc->active);
 
         mutex_lock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/nouveau/core/core/subdev.c b/drivers/gpu/drm/nouveau/core/core/subdev.c
index 48f06378d3f9..2ea5568b6cf5 100644
--- a/drivers/gpu/drm/nouveau/core/core/subdev.c
+++ b/drivers/gpu/drm/nouveau/core/core/subdev.c
@@ -104,11 +104,8 @@ nouveau_subdev_create_(struct nouveau_object *parent,
 
         if (parent) {
                 struct nouveau_device *device = nv_device(parent);
-                int subidx = nv_hclass(subdev) & 0xff;
-
                 subdev->debug = nouveau_dbgopt(device->dbgopt, subname);
                 subdev->mmio  = nv_subdev(device)->mmio;
-                device->subdev[subidx] = *pobject;
         }
 
         return 0;
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/base.c b/drivers/gpu/drm/nouveau/core/engine/device/base.c
index 9135b25a29d0..dd01c6c435d6 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/base.c
@@ -268,6 +268,8 @@ nouveau_devobj_ctor(struct nouveau_object *parent,
                 if (ret)
                         return ret;
 
+                device->subdev[i] = devobj->subdev[i];
+
                 /* note: can't init *any* subdevs until devinit has been run
                  * due to not knowing exactly what the vbios init tables will
                  * mess with.  devinit also can't be run until all of its
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
index 8d06eef2b9ee..dbc5e33de94f 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
@@ -161,7 +161,7 @@ nvc0_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nva3_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] = &nvc0_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nvc3_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nvc0_mc_oclass;
                 device->oclass[NVDEV_SUBDEV_BUS    ] =  nvc0_bus_oclass;
                 device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                 device->oclass[NVDEV_SUBDEV_FB     ] =  nvc0_fb_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
index 434bb4b0fa2e..5c8a63dc506a 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
@@ -334,7 +334,7 @@ nvc0_graph_mthd(struct nvc0_graph_priv *priv, struct nvc0_graph_mthd *mthds)
         while ((mthd = &mthds[i++]) && (init = mthd->init)) {
                 u32  addr = 0x80000000 | mthd->oclass;
                 for (data = 0; init->count; init++) {
-                        if (data != init->data) {
+                        if (init == mthd->init || data != init->data) {
                                 nv_wr32(priv, 0x40448c, init->data);
                                 data = init->data;
                         }
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/fb.h b/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
index 8541aa382ff2..d89dbdf39b0d 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
@@ -75,6 +75,11 @@ struct nouveau_fb {
 static inline struct nouveau_fb *
 nouveau_fb(void *obj)
 {
+        /* fbram uses this before device subdev pointer is valid */
+        if (nv_iclass(obj, NV_SUBDEV_CLASS) &&
+            nv_subidx(obj) == NVDEV_SUBDEV_FB)
+                return obj;
+
         return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_FB];
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h b/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
index 9fa5da723871..7f50a858b16f 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
@@ -73,7 +73,7 @@ struct nouveau_i2c {
         int (*identify)(struct nouveau_i2c *, int index,
                         const char *what, struct nouveau_i2c_board_info *,
                         bool (*match)(struct nouveau_i2c_port *,
-                                      struct i2c_board_info *));
+                                      struct i2c_board_info *, void *), void *);
         struct list_head ports;
 };
 
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/instmem.h b/drivers/gpu/drm/nouveau/core/include/subdev/instmem.h
index ec7a54e91a08..4aca33887aaa 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/instmem.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/instmem.h
@@ -50,6 +50,13 @@ struct nouveau_instmem {
 static inline struct nouveau_instmem *
 nouveau_instmem(void *obj)
 {
+        /* nv04/nv40 impls need to create objects in their constructor,
+         * which is before the subdev pointer is valid
+         */
+        if (nv_iclass(obj, NV_SUBDEV_CLASS) &&
+            nv_subidx(obj) == NVDEV_SUBDEV_INSTMEM)
+                return obj;
+
         return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_INSTMEM];
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
index 420908cb82b6..df1b1b423093 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
@@ -365,13 +365,13 @@ static u16
 init_script(struct nouveau_bios *bios, int index)
 {
         struct nvbios_init init = { .bios = bios };
-        u16 data;
+        u16 bmp_ver = bmp_version(bios), data;
 
-        if (bmp_version(bios) && bmp_version(bios) < 0x0510) {
-                if (index > 1)
+        if (bmp_ver && bmp_ver < 0x0510) {
+                if (index > 1 || bmp_ver < 0x0100)
                         return 0x0000;
 
-                data = bios->bmp_offset + (bios->version.major < 2 ? 14 : 18);
+                data = bios->bmp_offset + (bmp_ver < 0x0200 ? 14 : 18);
                 return nv_ro16(bios, data + (index * 2));
         }
 
@@ -1294,7 +1294,11 @@ init_jump(struct nvbios_init *init)
         u16 offset = nv_ro16(bios, init->offset + 1);
 
         trace("JUMP\t0x%04x\n", offset);
-        init->offset = offset;
+
+        if (init_exec(init))
+                init->offset = offset;
+        else
+                init->offset += 3;
 }
 
 /**
diff --git a/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
index 041fd5edaebf..c33c03d2f4af 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
@@ -197,7 +197,7 @@ static int
 nouveau_i2c_identify(struct nouveau_i2c *i2c, int index, const char *what,
                      struct nouveau_i2c_board_info *info,
                      bool (*match)(struct nouveau_i2c_port *,
-                                   struct i2c_board_info *))
+                                   struct i2c_board_info *, void *), void *data)
 {
         struct nouveau_i2c_port *port = nouveau_i2c_find(i2c, index);
         int i;
@@ -221,7 +221,7 @@ nouveau_i2c_identify(struct nouveau_i2c *i2c, int index, const char *what,
                 }
 
                 if (nv_probe_i2c(port, info[i].dev.addr) &&
-                    (!match || match(port, &info[i].dev))) {
+                    (!match || match(port, &info[i].dev, data))) {
                         nv_info(i2c, "detected %s: %s\n", what,
                                 info[i].dev.type);
                         return i;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c b/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
index e44ed7b93c6d..7610fc5f8fa2 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
@@ -29,9 +29,9 @@
 
 static bool
 probe_monitoring_device(struct nouveau_i2c_port *i2c,
-                        struct i2c_board_info *info)
+                        struct i2c_board_info *info, void *data)
 {
-        struct nouveau_therm_priv *priv = (void *)nouveau_therm(i2c);
+        struct nouveau_therm_priv *priv = data;
         struct nvbios_therm_sensor *sensor = &priv->bios_sensor;
         struct i2c_client *client;
 
@@ -96,7 +96,7 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
                 };
 
                 i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
-                                  board, probe_monitoring_device);
+                              board, probe_monitoring_device, therm);
                 if (priv->ic)
                         return;
         }
@@ -108,7 +108,7 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
                 };
 
                 i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
-                                  board, probe_monitoring_device);
+                              board, probe_monitoring_device, therm);
                 if (priv->ic)
                         return;
         }
@@ -117,5 +117,5 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
            device. Let's try our static list.
          */
         i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
-                      nv_board_infos, probe_monitoring_device);
+                      nv_board_infos, probe_monitoring_device, therm);
 }
diff --git a/drivers/gpu/drm/nouveau/dispnv04/dfp.c b/drivers/gpu/drm/nouveau/dispnv04/dfp.c
index 936a71c59080..7fdc51e2a571 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/dfp.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/dfp.c
@@ -643,7 +643,7 @@ static void nv04_tmds_slave_init(struct drm_encoder *encoder)
             get_tmds_slave(encoder))
                 return;
 
-        type = i2c->identify(i2c, 2, "TMDS transmitter", info, NULL);
+        type = i2c->identify(i2c, 2, "TMDS transmitter", info, NULL, NULL);
         if (type < 0)
                 return;
 
diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv04.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv04.c
index cc4b208ce546..244822df8ffc 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv04.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv04.c
@@ -59,7 +59,7 @@ int nv04_tv_identify(struct drm_device *dev, int i2c_index)
         struct nouveau_i2c *i2c = nouveau_i2c(drm->device);
 
         return i2c->identify(i2c, i2c_index, "TV encoder",
-                             nv04_tv_encoder_info, NULL);
+                             nv04_tv_encoder_info, NULL, NULL);
 }
 
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 6828d81ed7b9..900fae01793e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -447,6 +447,8 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
         if (ret)
                 goto done;
 
+        info->offset = ntfy->node->offset;
+
 done:
         if (ret)
                 nouveau_abi16_ntfy_fini(chan, ntfy);
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 95c740454049..ba0183fb84f3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -51,6 +51,7 @@ static struct nouveau_dsm_priv {
         bool dsm_detected;
         bool optimus_detected;
         acpi_handle dhandle;
+        acpi_handle other_handle;
         acpi_handle rom_handle;
 } nouveau_dsm_priv;
 
@@ -260,9 +261,10 @@ static int nouveau_dsm_pci_probe(struct pci_dev *pdev)
         if (!dhandle)
                 return false;
 
-        if (!acpi_has_method(dhandle, "_DSM"))
+        if (!acpi_has_method(dhandle, "_DSM")) {
+                nouveau_dsm_priv.other_handle = dhandle;
                 return false;
-
+        }
         if (nouveau_test_dsm(dhandle, nouveau_dsm, NOUVEAU_DSM_POWER))
                 retval |= NOUVEAU_DSM_HAS_MUX;
 
@@ -338,6 +340,16 @@ static bool nouveau_dsm_detect(void)
                 printk(KERN_INFO "VGA switcheroo: detected DSM switching method %s handle\n",
                         acpi_method_name);
                 nouveau_dsm_priv.dsm_detected = true;
+                /*
+                 * On some systems hotplug events are generated for the device
+                 * being switched off when _DSM is executed.  They cause ACPI
+                 * hotplug to trigger and attempt to remove the device from
+                 * the system, which causes it to break down.  Prevent that from
+                 * happening by setting the no_hotplug flag for the involved
+                 * ACPI device objects.
+                 */
+                acpi_bus_no_hotplug(nouveau_dsm_priv.dhandle);
+                acpi_bus_no_hotplug(nouveau_dsm_priv.other_handle);
                 ret = true;
         }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 29c3efdfc7dd..25ea82f8def3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -610,7 +610,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
         ret = nouveau_fence_sync(fence, chan);
         nouveau_fence_unref(&fence);
         if (ret)
-                return ret;
+                goto fail_free;
 
         if (new_bo != old_bo) {
                 ret = nouveau_bo_pin(new_bo, TTM_PL_FLAG_VRAM);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 7a3759f1c41a..98a22e6e27a1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -858,6 +858,12 @@ static int nouveau_pmops_runtime_suspend(struct device *dev)
         if (nouveau_runtime_pm == 0)
                 return -EINVAL;
 
+        /* are we optimus enabled? */
+        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
+                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+                return -EINVAL;
+        }
+
         nv_debug_level(SILENT);
         drm_kms_helper_poll_disable(drm_dev);
         vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_OFF);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 80a20120e625..0b9621c9aeea 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1143,31 +1143,53 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
         }
 
         if (tiling_flags & RADEON_TILING_MACRO) {
-                if (rdev->family >= CHIP_BONAIRE)
-                        tmp = rdev->config.cik.tile_config;
-                else if (rdev->family >= CHIP_TAHITI)
-                        tmp = rdev->config.si.tile_config;
-                else if (rdev->family >= CHIP_CAYMAN)
-                        tmp = rdev->config.cayman.tile_config;
-                else
-                        tmp = rdev->config.evergreen.tile_config;
+                evergreen_tiling_fields(tiling_flags, &bankw, &bankh, &mtaspect, &tile_split);
 
-                switch ((tmp & 0xf0) >> 4) {
-                case 0: /* 4 banks */
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_4_BANK);
-                        break;
-                case 1: /* 8 banks */
-                default:
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_8_BANK);
-                        break;
-                case 2: /* 16 banks */
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_16_BANK);
-                        break;
+                /* Set NUM_BANKS. */
+                if (rdev->family >= CHIP_BONAIRE) {
+                        unsigned tileb, index, num_banks, tile_split_bytes;
+
+                        /* Calculate the macrotile mode index. */
+                        tile_split_bytes = 64 << tile_split;
+                        tileb = 8 * 8 * target_fb->bits_per_pixel / 8;
+                        tileb = min(tile_split_bytes, tileb);
+
+                        for (index = 0; tileb > 64; index++) {
+                                tileb >>= 1;
+                        }
+
+                        if (index >= 16) {
+                                DRM_ERROR("Wrong screen bpp (%u) or tile split (%u)\n",
+                                          target_fb->bits_per_pixel, tile_split);
+                                return -EINVAL;
+                        }
+
+                        num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
+                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(num_banks);
+                } else {
+                        /* SI and older. */
+                        if (rdev->family >= CHIP_TAHITI)
+                                tmp = rdev->config.si.tile_config;
+                        else if (rdev->family >= CHIP_CAYMAN)
+                                tmp = rdev->config.cayman.tile_config;
+                        else
+                                tmp = rdev->config.evergreen.tile_config;
+
+                        switch ((tmp & 0xf0) >> 4) {
+                        case 0: /* 4 banks */
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_4_BANK);
+                                break;
+                        case 1: /* 8 banks */
+                        default:
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_8_BANK);
+                                break;
+                        case 2: /* 16 banks */
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_16_BANK);
+                                break;
+                        }
                 }
 
                 fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_2D_TILED_THIN1);
-
-                evergreen_tiling_fields(tiling_flags, &bankw, &bankh, &mtaspect, &tile_split);
                 fb_format |= EVERGREEN_GRPH_TILE_SPLIT(tile_split);
                 fb_format |= EVERGREEN_GRPH_BANK_WIDTH(bankw);
                 fb_format |= EVERGREEN_GRPH_BANK_HEIGHT(bankh);
@@ -1180,23 +1202,18 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                 fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_1D_TILED_THIN1);
 
         if (rdev->family >= CHIP_BONAIRE) {
-                u32 num_pipe_configs = rdev->config.cik.max_tile_pipes;
-                u32 num_rb = rdev->config.cik.max_backends_per_se;
-                if (num_pipe_configs > 8)
-                        num_pipe_configs = 8;
-                if (num_pipe_configs == 8)
-                        fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P8_32x32_16x16);
-                else if (num_pipe_configs == 4) {
-                        if (num_rb == 4)
-                                fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P4_16x16);
-                        else if (num_rb < 4)
-                                fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P4_8x16);
-                } else if (num_pipe_configs == 2)
-                        fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P2);
+                /* Read the pipe config from the 2D TILED SCANOUT mode.
+                 * It should be the same for the other modes too, but not all
+                 * modes set the pipe config field. */
+                u32 pipe_config = (rdev->config.cik.tile_mode_array[10] >> 6) & 0x1f;
+
+                fb_format |= CIK_GRPH_PIPE_CONFIG(pipe_config);
         } else if ((rdev->family == CHIP_TAHITI) ||
                    (rdev->family == CHIP_PITCAIRN))
                 fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P8_32x32_8x16);
-        else if (rdev->family == CHIP_VERDE)
+        else if ((rdev->family == CHIP_VERDE) ||
+                 (rdev->family == CHIP_OLAND) ||
+                 (rdev->family == CHIP_HAINAN)) /* for completeness.  HAINAN has no display hw */
                 fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P4_8x16);
 
         switch (radeon_crtc->crtc_id) {
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 9e50dd5d0e42..e7f6334138a1 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3057,7 +3057,7 @@ static u32 cik_create_bitmask(u32 bit_width)
  * Returns the disabled RB bitmask.
  */
 static u32 cik_get_rb_disabled(struct radeon_device *rdev,
-                              u32 max_rb_num, u32 se_num,
+                              u32 max_rb_num_per_se,
                               u32 sh_per_se)
 {
         u32 data, mask;
@@ -3071,7 +3071,7 @@ static u32 cik_get_rb_disabled(struct radeon_device *rdev,
 
         data >>= BACKEND_DISABLE_SHIFT;
 
-        mask = cik_create_bitmask(max_rb_num / se_num / sh_per_se);
+        mask = cik_create_bitmask(max_rb_num_per_se / sh_per_se);
 
         return data & mask;
 }
@@ -3088,7 +3088,7 @@ static u32 cik_get_rb_disabled(struct radeon_device *rdev,
  */
 static void cik_setup_rb(struct radeon_device *rdev,
                          u32 se_num, u32 sh_per_se,
-                         u32 max_rb_num)
+                         u32 max_rb_num_per_se)
 {
         int i, j;
         u32 data, mask;
@@ -3098,7 +3098,7 @@ static void cik_setup_rb(struct radeon_device *rdev,
         for (i = 0; i < se_num; i++) {
                 for (j = 0; j < sh_per_se; j++) {
                         cik_select_se_sh(rdev, i, j);
-                        data = cik_get_rb_disabled(rdev, max_rb_num, se_num, sh_per_se);
+                        data = cik_get_rb_disabled(rdev, max_rb_num_per_se, sh_per_se);
                         if (rdev->family == CHIP_HAWAII)
                                 disabled_rbs |= data << ((i * sh_per_se + j) * HAWAII_RB_BITMAP_WIDTH_PER_SH);
                         else
@@ -3108,12 +3108,14 @@ static void cik_setup_rb(struct radeon_device *rdev,
         cik_select_se_sh(rdev, 0xffffffff, 0xffffffff);
 
         mask = 1;
-        for (i = 0; i < max_rb_num; i++) {
+        for (i = 0; i < max_rb_num_per_se * se_num; i++) {
                 if (!(disabled_rbs & mask))
                         enabled_rbs |= mask;
                 mask <<= 1;
         }
 
+        rdev->config.cik.backend_enable_mask = enabled_rbs;
+
         for (i = 0; i < se_num; i++) {
                 cik_select_se_sh(rdev, i, 0xffffffff);
                 data = 0;
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index f0f9e1089409..af520d4d362b 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -527,7 +527,7 @@ int cik_copy_dma(struct radeon_device *rdev,
                 radeon_ring_write(ring, 0); /* src/dst endian swap */
                 radeon_ring_write(ring, src_offset & 0xffffffff);
                 radeon_ring_write(ring, upper_32_bits(src_offset) & 0xffffffff);
-                radeon_ring_write(ring, dst_offset & 0xfffffffc);
+                radeon_ring_write(ring, dst_offset & 0xffffffff);
                 radeon_ring_write(ring, upper_32_bits(dst_offset) & 0xffffffff);
                 src_offset += cur_size_in_bytes;
                 dst_offset += cur_size_in_bytes;
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index de86493cbc44..713a5d359901 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -174,7 +174,7 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         }
 
         sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                 DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
                 return;
         }
@@ -235,7 +235,7 @@ void dce6_afmt_write_sad_regs(struct drm_encoder *encoder)
         }
 
         sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                 DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
                 return;
         }
@@ -308,7 +308,9 @@ int dce6_audio_init(struct radeon_device *rdev)
         rdev->audio.enabled = true;
 
         if (ASIC_IS_DCE8(rdev))
-                rdev->audio.num_pins = 7;
+                rdev->audio.num_pins = 6;
+        else if (ASIC_IS_DCE61(rdev))
+                rdev->audio.num_pins = 4;
         else
                 rdev->audio.num_pins = 6;
 
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index aa695c4feb3d..0c6d5cef4cf1 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -118,7 +118,7 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         }
 
         sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                 DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
                 return;
         }
@@ -173,7 +173,7 @@ static void evergreen_hdmi_write_sad_regs(struct drm_encoder *encoder)
         }
 
         sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                 DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
                 return;
         }
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 9f11a55962b5..af45b23675ee 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -896,6 +896,10 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                     (rdev->pdev->device == 0x999C)) {
                         rdev->config.cayman.max_simds_per_se = 6;
                         rdev->config.cayman.max_backends_per_se = 2;
+                        rdev->config.cayman.max_hw_contexts = 8;
+                        rdev->config.cayman.sx_max_export_size = 256;
+                        rdev->config.cayman.sx_max_export_pos_size = 64;
+                        rdev->config.cayman.sx_max_export_smx_size = 192;
                 } else if ((rdev->pdev->device == 0x9903) ||
                            (rdev->pdev->device == 0x9904) ||
                            (rdev->pdev->device == 0x990A) ||
@@ -906,6 +910,10 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                            (rdev->pdev->device == 0x999D)) {
                         rdev->config.cayman.max_simds_per_se = 4;
                         rdev->config.cayman.max_backends_per_se = 2;
+                        rdev->config.cayman.max_hw_contexts = 8;
+                        rdev->config.cayman.sx_max_export_size = 256;
+                        rdev->config.cayman.sx_max_export_pos_size = 64;
+                        rdev->config.cayman.sx_max_export_smx_size = 192;
                 } else if ((rdev->pdev->device == 0x9919) ||
                            (rdev->pdev->device == 0x9990) ||
                            (rdev->pdev->device == 0x9991) ||
@@ -916,9 +924,17 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                            (rdev->pdev->device == 0x99A0)) {
                         rdev->config.cayman.max_simds_per_se = 3;
                         rdev->config.cayman.max_backends_per_se = 1;
+                        rdev->config.cayman.max_hw_contexts = 4;
+                        rdev->config.cayman.sx_max_export_size = 128;
+                        rdev->config.cayman.sx_max_export_pos_size = 32;
+                        rdev->config.cayman.sx_max_export_smx_size = 96;
                 } else {
                         rdev->config.cayman.max_simds_per_se = 2;
                         rdev->config.cayman.max_backends_per_se = 1;
+                        rdev->config.cayman.max_hw_contexts = 4;
+                        rdev->config.cayman.sx_max_export_size = 128;
+                        rdev->config.cayman.sx_max_export_pos_size = 32;
+                        rdev->config.cayman.sx_max_export_smx_size = 96;
                 }
                 rdev->config.cayman.max_texture_channel_caches = 2;
                 rdev->config.cayman.max_gprs = 256;
@@ -926,10 +942,6 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                 rdev->config.cayman.max_gs_threads = 32;
                 rdev->config.cayman.max_stack_entries = 512;
                 rdev->config.cayman.sx_num_of_sets = 8;
-                rdev->config.cayman.sx_max_export_size = 256;
-                rdev->config.cayman.sx_max_export_pos_size = 64;
-                rdev->config.cayman.sx_max_export_smx_size = 192;
-                rdev->config.cayman.max_hw_contexts = 8;
                 rdev->config.cayman.sq_num_cf_insts = 2;
 
                 rdev->config.cayman.sc_prim_fifo_size = 0x40;
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 746c0c6c269b..c5519ca4bbc4 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1949,7 +1949,7 @@ struct si_asic {
         unsigned sc_earlyz_tile_fifo_size;
 
         unsigned num_tile_pipes;
-        unsigned num_backends_per_se;
+        unsigned backend_enable_mask;
         unsigned backend_disable_mask_per_asic;
         unsigned backend_map;
         unsigned num_texture_channel_caches;
@@ -1979,7 +1979,7 @@ struct cik_asic {
         unsigned sc_earlyz_tile_fifo_size;
 
         unsigned num_tile_pipes;
-        unsigned num_backends_per_se;
+        unsigned backend_enable_mask;
         unsigned backend_disable_mask_per_asic;
         unsigned backend_map;
         unsigned num_texture_channel_caches;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index f55879dd11c6..f74db43346fd 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -2030,7 +2030,7 @@ static struct radeon_asic ci_asic = {
                 .hdmi_setmode = &evergreen_hdmi_setmode,
         },
         .copy = {
-                .blit = NULL,
+                .blit = &cik_copy_cpdma,
                 .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .dma = &cik_copy_dma,
                 .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
@@ -2132,7 +2132,7 @@ static struct radeon_asic kv_asic = {
                 .hdmi_setmode = &evergreen_hdmi_setmode,
         },
         .copy = {
-                .blit = NULL,
+                .blit = &cik_copy_cpdma,
                 .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .dma = &cik_copy_dma,
                 .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 9d302eaeea15..485848f889f5 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -33,6 +33,7 @@ static struct radeon_atpx_priv {
         bool atpx_detected;
         /* handle for device - and atpx */
         acpi_handle dhandle;
+        acpi_handle other_handle;
         struct radeon_atpx atpx;
 } radeon_atpx_priv;
 
@@ -451,9 +452,10 @@ static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
                 return false;
 
         status = acpi_get_handle(dhandle, "ATPX", &atpx_handle);
-        if (ACPI_FAILURE(status))
+        if (ACPI_FAILURE(status)) {
+                radeon_atpx_priv.other_handle = dhandle;
                 return false;
-
+        }
         radeon_atpx_priv.dhandle = dhandle;
         radeon_atpx_priv.atpx.handle = atpx_handle;
         return true;
@@ -530,6 +532,16 @@ static bool radeon_atpx_detect(void)
                 printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
                        acpi_method_name);
                 radeon_atpx_priv.atpx_detected = true;
+                /*
+                 * On some systems hotplug events are generated for the device
+                 * being switched off when ATPX is executed.  They cause ACPI
+                 * hotplug to trigger and attempt to remove the device from
+                 * the system, which causes it to break down.  Prevent that from
+                 * happening by setting the no_hotplug flag for the involved
+                 * ACPI device objects.
+                 */
+                acpi_bus_no_hotplug(radeon_atpx_priv.dhandle);
+                acpi_bus_no_hotplug(radeon_atpx_priv.other_handle);
                 return true;
         }
         return false;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index e91d548063ef..67fadcf4590f 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -77,9 +77,10 @@
  *   2.33.0 - Add SI tiling mode array query
  *   2.34.0 - Add CIK tiling mode array query
  *   2.35.0 - Add CIK macrotile mode array query
+ *   2.36.0 - Fix CIK DCE tiling setup
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        35
+#define KMS_DRIVER_MINOR        36
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
@@ -512,15 +513,6 @@ static const struct file_operations radeon_driver_kms_fops = {
 #endif
 };
 
-
-static void
-radeon_pci_shutdown(struct pci_dev *pdev)
-{
-        struct drm_device *dev = pci_get_drvdata(pdev);
-
-        radeon_driver_unload_kms(dev);
-}
-
 static struct drm_driver kms_driver = {
         .driver_features =
             DRIVER_USE_AGP |
@@ -590,7 +582,6 @@ static struct pci_driver radeon_kms_pci_driver = {
         .probe = radeon_pci_probe,
         .remove = radeon_pci_remove,
         .driver.pm = &radeon_pm_ops,
-        .shutdown = radeon_pci_shutdown,
 };
 
 static int __init radeon_init(void)
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index c44574e248d1..5bf50cec017e 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -461,6 +461,15 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file
         case RADEON_INFO_SI_CP_DMA_COMPUTE:
                 *value = 1;
                 break;
+        case RADEON_INFO_SI_BACKEND_ENABLED_MASK:
+                if (rdev->family >= CHIP_BONAIRE) {
+                        *value = rdev->config.cik.backend_enable_mask;
+                } else if (rdev->family >= CHIP_TAHITI) {
+                        *value = rdev->config.si.backend_enable_mask;
+                } else {
+                        DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
+                }
+                break;
         default:
                 DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 373d088bac66..b9c0529b4a2e 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -473,7 +473,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                 return -EINVAL;
         }
 
-        if ((start >> 28) != (end >> 28)) {
+        if ((start >> 28) != ((end - 1) >> 28)) {
                 DRM_ERROR("reloc %LX-%LX crossing 256MB boundary!\n",
                           start, end);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index e461b45f29a9..35950738bd5e 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -162,6 +162,16 @@ static void rs690_mc_init(struct radeon_device *rdev)
         base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
         base = G_000100_MC_FB_START(base) << 16;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+        /* Some boards seem to be configured for 128MB of sideport memory,
+         * but really only have 64MB.  Just skip the sideport and use
+         * UMA memory.
+         */
+        if (rdev->mc.igp_sideport_enabled &&
+            (rdev->mc.real_vram_size == (384 * 1024 * 1024))) {
+                base += 128 * 1024 * 1024;
+                rdev->mc.real_vram_size -= 128 * 1024 * 1024;
+                rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
+        }
 
         /* Use K8 direct mapping for fast fb access. */ 
         rdev->fastfb_working = false;
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 4aaeb118a3ff..b95267846ff2 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2335,6 +2335,12 @@ void rv770_get_engine_memory_ss(struct radeon_device *rdev)
         pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
                                                        ASIC_INTERNAL_MEMORY_SS, 0);
 
+        /* disable ss, causes hangs on some cayman boards */
+        if (rdev->family == CHIP_CAYMAN) {
+                pi->sclk_ss = false;
+                pi->mclk_ss = false;
+        }
+
         if (pi->sclk_ss || pi->mclk_ss)
                 pi->dynamic_ss = true;
         else
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 626163ef483d..22d3517ed6ad 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2813,7 +2813,7 @@ static void si_setup_spi(struct radeon_device *rdev,
 }
 
 static u32 si_get_rb_disabled(struct radeon_device *rdev,
-                              u32 max_rb_num, u32 se_num,
+                              u32 max_rb_num_per_se,
                               u32 sh_per_se)
 {
         u32 data, mask;
@@ -2827,14 +2827,14 @@ static u32 si_get_rb_disabled(struct radeon_device *rdev,
 
         data >>= BACKEND_DISABLE_SHIFT;
 
-        mask = si_create_bitmask(max_rb_num / se_num / sh_per_se);
+        mask = si_create_bitmask(max_rb_num_per_se / sh_per_se);
 
         return data & mask;
 }
 
 static void si_setup_rb(struct radeon_device *rdev,
                         u32 se_num, u32 sh_per_se,
-                        u32 max_rb_num)
+                        u32 max_rb_num_per_se)
 {
         int i, j;
         u32 data, mask;
@@ -2844,19 +2844,21 @@ static void si_setup_rb(struct radeon_device *rdev,
         for (i = 0; i < se_num; i++) {
                 for (j = 0; j < sh_per_se; j++) {
                         si_select_se_sh(rdev, i, j);
-                        data = si_get_rb_disabled(rdev, max_rb_num, se_num, sh_per_se);
+                        data = si_get_rb_disabled(rdev, max_rb_num_per_se, sh_per_se);
                         disabled_rbs |= data << ((i * sh_per_se + j) * TAHITI_RB_BITMAP_WIDTH_PER_SH);
                 }
         }
         si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
 
         mask = 1;
-        for (i = 0; i < max_rb_num; i++) {
+        for (i = 0; i < max_rb_num_per_se * se_num; i++) {
                 if (!(disabled_rbs & mask))
                         enabled_rbs |= mask;
                 mask <<= 1;
         }
 
+        rdev->config.si.backend_enable_mask = enabled_rbs;
+
         for (i = 0; i < se_num; i++) {
                 si_select_se_sh(rdev, i, 0xffffffff);
                 data = 0;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 145f54f17b85..1df856f78568 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -353,7 +353,8 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
          * Don't move nonexistent data. Clear destination instead.
          */
         if (old_iomap == NULL &&
-            (ttm == NULL || ttm->state == tt_unpopulated)) {
+            (ttm == NULL || (ttm->state == tt_unpopulated &&
+                             !(ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)))) {
                 memset_io(new_iomap, 0, new_mem->num_pages*PAGE_SIZE);
                 goto out2;
         }
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index cfcdf5b5440a..801231c9ae48 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -178,9 +178,9 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         }
 
         page_offset = ((address - vma->vm_start) >> PAGE_SHIFT) +
-            drm_vma_node_start(&bo->vma_node) - vma->vm_pgoff;
-        page_last = vma_pages(vma) +
-            drm_vma_node_start(&bo->vma_node) - vma->vm_pgoff;
+                vma->vm_pgoff - drm_vma_node_start(&bo->vma_node);
+        page_last = vma_pages(vma) + vma->vm_pgoff -
+                drm_vma_node_start(&bo->vma_node);
 
         if (unlikely(page_offset >= bo->num_pages)) {
                 retval = VM_FAULT_SIGBUS;
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 92d1206482a6..797ed29a36ea 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -123,7 +123,7 @@ static struct cpuidle_state *cpuidle_state_table;
  * which is also the index into the MWAIT hint array.
  * Thus C0 is a dummy.
  */
-static struct cpuidle_state nehalem_cstates[] __initdata = {
+static struct cpuidle_state nehalem_cstates[] = {
         {
                 .name = "C1-NHM",
                 .desc = "MWAIT 0x00",
@@ -156,7 +156,7 @@ static struct cpuidle_state nehalem_cstates[] __initdata = {
                 .enter = NULL }
 };
 
-static struct cpuidle_state snb_cstates[] __initdata = {
+static struct cpuidle_state snb_cstates[] = {
         {
                 .name = "C1-SNB",
                 .desc = "MWAIT 0x00",
@@ -196,7 +196,7 @@ static struct cpuidle_state snb_cstates[] __initdata = {
                 .enter = NULL }
 };
 
-static struct cpuidle_state ivb_cstates[] __initdata = {
+static struct cpuidle_state ivb_cstates[] = {
         {
                 .name = "C1-IVB",
                 .desc = "MWAIT 0x00",
@@ -236,7 +236,7 @@ static struct cpuidle_state ivb_cstates[] __initdata = {
                 .enter = NULL }
 };
 
-static struct cpuidle_state hsw_cstates[] __initdata = {
+static struct cpuidle_state hsw_cstates[] = {
         {
                 .name = "C1-HSW",
                 .desc = "MWAIT 0x00",
@@ -297,7 +297,7 @@ static struct cpuidle_state hsw_cstates[] __initdata = {
                 .enter = NULL }
 };
 
-static struct cpuidle_state atom_cstates[] __initdata = {
+static struct cpuidle_state atom_cstates[] = {
         {
                 .name = "C1E-ATM",
                 .desc = "MWAIT 0x00",
@@ -329,7 +329,7 @@ static struct cpuidle_state atom_cstates[] __initdata = {
         {
                 .enter = NULL }
 };
-static struct cpuidle_state avn_cstates[] __initdata = {
+static struct cpuidle_state avn_cstates[] = {
         {
                 .name = "C1-AVN",
                 .desc = "MWAIT 0x00",
@@ -344,6 +344,8 @@ static struct cpuidle_state avn_cstates[] __initdata = {
                 .exit_latency = 15,
                 .target_residency = 45,
                 .enter = &intel_idle },
+        {
+                .enter = NULL }
 };
 
 /**
@@ -377,6 +379,9 @@ static int intel_idle(struct cpuidle_device *dev,
 
         if (!current_set_polling_and_test()) {
 
+                if (this_cpu_has(X86_FEATURE_CLFLUSH_MONITOR))
+                        clflush((void *)&current_thread_info()->flags);
+
                 __monitor((void *)&current_thread_info()->flags, 0, 0);
                 smp_mb();
                 if (!need_resched())
diff --git a/drivers/iio/adc/ad7887.c b/drivers/iio/adc/ad7887.c
index acb7f90359a3..749a6cadab8b 100644
--- a/drivers/iio/adc/ad7887.c
+++ b/drivers/iio/adc/ad7887.c
@@ -200,7 +200,13 @@ static const struct ad7887_chip_info ad7887_chip_info_tbl[] = {
                         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                         .address = 1,
                         .scan_index = 1,
-                        .scan_type = IIO_ST('u', 12, 16, 0),
+                        .scan_type = {
+                                .sign = 'u',
+                                .realbits = 12,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                        },
                 },
                 .channel[1] = {
                         .type = IIO_VOLTAGE,
@@ -210,7 +216,13 @@ static const struct ad7887_chip_info ad7887_chip_info_tbl[] = {
                         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                         .address = 0,
                         .scan_index = 0,
-                        .scan_type = IIO_ST('u', 12, 16, 0),
+                        .scan_type = {
+                                .sign = 'u',
+                                .realbits = 12,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                        },
                 },
                 .channel[2] = IIO_CHAN_SOFT_TIMESTAMP(2),
                 .int_vref_mv = 2500,
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index 3fb7757a1028..368660dfe135 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -651,7 +651,12 @@ static const struct iio_chan_spec adis16448_channels[] = {
                 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = ADIS16448_BARO_OUT,
                 .scan_index = ADIS16400_SCAN_BARO,
-                .scan_type = IIO_ST('s', 16, 16, 0),
+                .scan_type = {
+                        .sign = 's',
+                        .realbits = 16,
+                        .storagebits = 16,
+                        .endianness = IIO_BE,
+                },
         },
         ADIS16400_TEMP_CHAN(ADIS16448_TEMP_OUT, 12),
         IIO_CHAN_SOFT_TIMESTAMP(11)
diff --git a/drivers/iio/light/cm36651.c b/drivers/iio/light/cm36651.c
index 21df57130018..0922e39b0ea9 100644
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -387,7 +387,7 @@ static int cm36651_read_int_time(struct cm36651_data *cm36651,
                 return -EINVAL;
         }
 
-        return IIO_VAL_INT_PLUS_MICRO;
+        return IIO_VAL_INT;
 }
 
 static int cm36651_write_int_time(struct cm36651_data *cm36651,
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index c47c2034ca71..0717940ec3b5 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -181,9 +181,16 @@ static void add_ref(struct iw_cm_id *cm_id)
 static void rem_ref(struct iw_cm_id *cm_id)
 {
         struct iwcm_id_private *cm_id_priv;
+        int cb_destroy;
+
         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
-        if (iwcm_deref_id(cm_id_priv) &&
-            test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags)) {
+
+        /*
+         * Test bit before deref in case the cm_id gets freed on another
+         * thread.
+         */
+        cb_destroy = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
+        if (iwcm_deref_id(cm_id_priv) && cb_destroy) {
                 BUG_ON(!list_empty(&cm_id_priv->work_list));
                 free_cm_id(cm_id_priv);
         }
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index bdc842e9faef..a283274a5a09 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -49,12 +49,20 @@
 
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
         do {                                                            \
-                (udata)->inbuf  = (void __user *) (ibuf);               \
+                (udata)->inbuf  = (const void __user *) (ibuf);         \
                 (udata)->outbuf = (void __user *) (obuf);               \
                 (udata)->inlen  = (ilen);                               \
                 (udata)->outlen = (olen);                               \
         } while (0)
 
+#define INIT_UDATA_BUF_OR_NULL(udata, ibuf, obuf, ilen, olen)                   \
+        do {                                                                    \
+                (udata)->inbuf  = (ilen) ? (const void __user *) (ibuf) : NULL; \
+                (udata)->outbuf = (olen) ? (void __user *) (obuf) : NULL;       \
+                (udata)->inlen  = (ilen);                                       \
+                (udata)->outlen = (olen);                                       \
+        } while (0)
+
 /*
  * Our lifetime rules for these structs are the following:
  *
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 65f6e7dc380c..f1cc83855af6 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2593,6 +2593,9 @@ out_put:
 static int kern_spec_to_ib_spec(struct ib_uverbs_flow_spec *kern_spec,
                                 union ib_flow_spec *ib_spec)
 {
+        if (kern_spec->reserved)
+                return -EINVAL;
+
         ib_spec->type = kern_spec->type;
 
         switch (ib_spec->type) {
@@ -2646,6 +2649,9 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
         void *ib_spec;
         int i;
 
+        if (ucore->inlen < sizeof(cmd))
+                return -EINVAL;
+
         if (ucore->outlen < sizeof(resp))
                 return -ENOSPC;
 
@@ -2671,6 +2677,10 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
             (cmd.flow_attr.num_of_specs * sizeof(struct ib_uverbs_flow_spec)))
                 return -EINVAL;
 
+        if (cmd.flow_attr.reserved[0] ||
+            cmd.flow_attr.reserved[1])
+                return -EINVAL;
+
         if (cmd.flow_attr.num_of_specs) {
                 kern_flow_attr = kmalloc(sizeof(*kern_flow_attr) + cmd.flow_attr.size,
                                          GFP_KERNEL);
@@ -2731,6 +2741,7 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
         if (cmd.flow_attr.size || (i != flow_attr->num_of_specs)) {
                 pr_warn("create flow failed, flow %d: %d bytes left from uverb cmd\n",
                         i, cmd.flow_attr.size);
+                err = -EINVAL;
                 goto err_free;
         }
         flow_id = ib_create_flow(qp, flow_attr, IB_FLOW_DOMAIN_USER);
@@ -2791,10 +2802,16 @@ int ib_uverbs_ex_destroy_flow(struct ib_uverbs_file *file,
         struct ib_uobject               *uobj;
         int                             ret;
 
+        if (ucore->inlen < sizeof(cmd))
+                return -EINVAL;
+
         ret = ib_copy_from_udata(&cmd, ucore, sizeof(cmd));
         if (ret)
                 return ret;
 
+        if (cmd.comp_mask)
+                return -EINVAL;
+
         uobj = idr_write_uobj(&ib_uverbs_rule_idr, cmd.flow_handle,
                               file->ucontext);
         if (!uobj)
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 34386943ebcf..08219fb3338b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -668,25 +668,30 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                 if ((hdr.in_words + ex_hdr.provider_in_words) * 8 != count)
                         return -EINVAL;
 
+                if (ex_hdr.cmd_hdr_reserved)
+                        return -EINVAL;
+
                 if (ex_hdr.response) {
                         if (!hdr.out_words && !ex_hdr.provider_out_words)
                                 return -EINVAL;
+
+                        if (!access_ok(VERIFY_WRITE,
+                                       (void __user *) (unsigned long) ex_hdr.response,
+                                       (hdr.out_words + ex_hdr.provider_out_words) * 8))
+                                return -EFAULT;
                 } else {
                         if (hdr.out_words || ex_hdr.provider_out_words)
                                 return -EINVAL;
                 }
 
-                INIT_UDATA(&ucore,
-                           (hdr.in_words) ? buf : 0,
-                           (unsigned long)ex_hdr.response,
-                           hdr.in_words * 8,
-                           hdr.out_words * 8);
-
-                INIT_UDATA(&uhw,
-                           (ex_hdr.provider_in_words) ? buf + ucore.inlen : 0,
-                           (ex_hdr.provider_out_words) ? (unsigned long)ex_hdr.response + ucore.outlen : 0,
-                           ex_hdr.provider_in_words * 8,
-                           ex_hdr.provider_out_words * 8);
+                INIT_UDATA_BUF_OR_NULL(&ucore, buf, (unsigned long) ex_hdr.response,
+                                       hdr.in_words * 8, hdr.out_words * 8);
+
+                INIT_UDATA_BUF_OR_NULL(&uhw,
+                                       buf + ucore.inlen,
+                                       (unsigned long) ex_hdr.response + ucore.outlen,
+                                       ex_hdr.provider_in_words * 8,
+                                       ex_hdr.provider_out_words * 8);
 
                 err = uverbs_ex_cmd_table[command](file,
                                                    &ucore,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 12fef76c791c..45126879ad28 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -524,50 +524,6 @@ static int send_abort(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
         return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
 }
 
-#define VLAN_NONE 0xfff
-#define FILTER_SEL_VLAN_NONE 0xffff
-#define FILTER_SEL_WIDTH_P_FC (3+1) /* port uses 3 bits, FCoE one bit */
-#define FILTER_SEL_WIDTH_VIN_P_FC \
-        (6 + 7 + FILTER_SEL_WIDTH_P_FC) /* 6 bits are unused, VF uses 7 bits*/
-#define FILTER_SEL_WIDTH_TAG_P_FC \
-        (3 + FILTER_SEL_WIDTH_VIN_P_FC) /* PF uses 3 bits */
-#define FILTER_SEL_WIDTH_VLD_TAG_P_FC (1 + FILTER_SEL_WIDTH_TAG_P_FC)
-
-static unsigned int select_ntuple(struct c4iw_dev *dev, struct dst_entry *dst,
-                                  struct l2t_entry *l2t)
-{
-        unsigned int ntuple = 0;
-        u32 viid;
-
-        switch (dev->rdev.lldi.filt_mode) {
-
-        /* default filter mode */
-        case HW_TPL_FR_MT_PR_IV_P_FC:
-                if (l2t->vlan == VLAN_NONE)
-                        ntuple |= FILTER_SEL_VLAN_NONE << FILTER_SEL_WIDTH_P_FC;
-                else {
-                        ntuple |= l2t->vlan << FILTER_SEL_WIDTH_P_FC;
-                        ntuple |= 1 << FILTER_SEL_WIDTH_TAG_P_FC;
-                }
-                ntuple |= l2t->lport << S_PORT | IPPROTO_TCP <<
-                          FILTER_SEL_WIDTH_VLD_TAG_P_FC;
-                break;
-        case HW_TPL_FR_MT_PR_OV_P_FC: {
-                viid = cxgb4_port_viid(l2t->neigh->dev);
-
-                ntuple |= FW_VIID_VIN_GET(viid) << FILTER_SEL_WIDTH_P_FC;
-                ntuple |= FW_VIID_PFN_GET(viid) << FILTER_SEL_WIDTH_VIN_P_FC;
-                ntuple |= FW_VIID_VIVLD_GET(viid) << FILTER_SEL_WIDTH_TAG_P_FC;
-                ntuple |= l2t->lport << S_PORT | IPPROTO_TCP <<
-                          FILTER_SEL_WIDTH_VLD_TAG_P_FC;
-                break;
-        }
-        default:
-                break;
-        }
-        return ntuple;
-}
-
 static int send_connect(struct c4iw_ep *ep)
 {
         struct cpl_act_open_req *req;
@@ -641,8 +597,9 @@ static int send_connect(struct c4iw_ep *ep)
                         req->local_ip = la->sin_addr.s_addr;
                         req->peer_ip = ra->sin_addr.s_addr;
                         req->opt0 = cpu_to_be64(opt0);
-                        req->params = cpu_to_be32(select_ntuple(ep->com.dev,
-                                                ep->dst, ep->l2t));
+                        req->params = cpu_to_be32(cxgb4_select_ntuple(
+                                                ep->com.dev->rdev.lldi.ports[0],
+                                                ep->l2t));
                         req->opt2 = cpu_to_be32(opt2);
                 } else {
                         req6 = (struct cpl_act_open_req6 *)skb_put(skb, wrlen);
@@ -662,9 +619,9 @@ static int send_connect(struct c4iw_ep *ep)
                         req6->peer_ip_lo = *((__be64 *)
                                                 (ra6->sin6_addr.s6_addr + 8));
                         req6->opt0 = cpu_to_be64(opt0);
-                        req6->params = cpu_to_be32(
-                                        select_ntuple(ep->com.dev, ep->dst,
-                                                      ep->l2t));
+                        req6->params = cpu_to_be32(cxgb4_select_ntuple(
+                                                ep->com.dev->rdev.lldi.ports[0],
+                                                ep->l2t));
                         req6->opt2 = cpu_to_be32(opt2);
                 }
         } else {
@@ -681,8 +638,9 @@ static int send_connect(struct c4iw_ep *ep)
                         t5_req->peer_ip = ra->sin_addr.s_addr;
                         t5_req->opt0 = cpu_to_be64(opt0);
                         t5_req->params = cpu_to_be64(V_FILTER_TUPLE(
-                                                select_ntuple(ep->com.dev,
-                                                ep->dst, ep->l2t)));
+                                                     cxgb4_select_ntuple(
+                                             ep->com.dev->rdev.lldi.ports[0],
+                                             ep->l2t)));
                         t5_req->opt2 = cpu_to_be32(opt2);
                 } else {
                         t5_req6 = (struct cpl_t5_act_open_req6 *)
@@ -703,7 +661,9 @@ static int send_connect(struct c4iw_ep *ep)
                                                 (ra6->sin6_addr.s6_addr + 8));
                         t5_req6->opt0 = cpu_to_be64(opt0);
                         t5_req6->params = (__force __be64)cpu_to_be32(
-                                select_ntuple(ep->com.dev, ep->dst, ep->l2t));
+                                                        cxgb4_select_ntuple(
+                                                ep->com.dev->rdev.lldi.ports[0],
+                                                ep->l2t));
                         t5_req6->opt2 = cpu_to_be32(opt2);
                 }
         }
@@ -1630,7 +1590,8 @@ static void send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid)
         memset(req, 0, sizeof(*req));
         req->op_compl = htonl(V_WR_OP(FW_OFLD_CONNECTION_WR));
         req->len16_pkd = htonl(FW_WR_LEN16(DIV_ROUND_UP(sizeof(*req), 16)));
-        req->le.filter = cpu_to_be32(select_ntuple(ep->com.dev, ep->dst,
+        req->le.filter = cpu_to_be32(cxgb4_select_ntuple(
+                                     ep->com.dev->rdev.lldi.ports[0],
                                      ep->l2t));
         sin = (struct sockaddr_in *)&ep->com.local_addr;
         req->le.lport = sin->sin_port;
@@ -2938,7 +2899,8 @@ int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
         /*
          * Allocate a server TID.
          */
-        if (dev->rdev.lldi.enable_fw_ofld_conn)
+        if (dev->rdev.lldi.enable_fw_ofld_conn &&
+            ep->com.local_addr.ss_family == AF_INET)
                 ep->stid = cxgb4_alloc_sftid(dev->rdev.lldi.tids,
                                              cm_id->local_addr.ss_family, ep);
         else
@@ -3323,9 +3285,7 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
         /*
          * Calculate the server tid from filter hit index from cpl_rx_pkt.
          */
-        stid = (__force int) cpu_to_be32((__force u32) rss->hash_val)
-                                          - dev->rdev.lldi.tids->sftid_base
-                                          + dev->rdev.lldi.tids->nstids;
+        stid = (__force int) cpu_to_be32((__force u32) rss->hash_val);
 
         lep = (struct c4iw_ep *)lookup_stid(dev->rdev.lldi.tids, stid);
         if (!lep) {
@@ -3397,7 +3357,9 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
         window = (__force u16) htons((__force u16)tcph->window);
 
         /* Calcuate filter portion for LE region. */
-        filter = (__force unsigned int) cpu_to_be32(select_ntuple(dev, dst, e));
+        filter = (__force unsigned int) cpu_to_be32(cxgb4_select_ntuple(
+                                                    dev->rdev.lldi.ports[0],
+                                                    e));
 
         /*
          * Synthesize the cpl_pass_accept_req. We have everything except the
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 4cb8eb24497c..84e45006451c 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -173,7 +173,7 @@ static int _c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len,
         return ret;
 }
 
-int _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
+static int _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
 {
         u32 remain = len;
         u32 dmalen;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
index c29b5c838833..cdc7df4fdb8a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
@@ -31,6 +31,7 @@
  */
 
 #include <linux/netdevice.h>
+#include <linux/if_arp.h>      /* For ARPHRD_xxx */
 #include <linux/module.h>
 #include <net/rtnetlink.h>
 #include "ipoib.h"
@@ -103,7 +104,7 @@ static int ipoib_new_child_link(struct net *src_net, struct net_device *dev,
                 return -EINVAL;
 
         pdev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
-        if (!pdev)
+        if (!pdev || pdev->type != ARPHRD_INFINIBAND)
                 return -ENODEV;
 
         ppriv = netdev_priv(pdev);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 6be57c38638d..9804fca6bf06 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -207,7 +207,9 @@ isert_free_rx_descriptors(struct isert_conn *isert_conn)
         isert_conn->conn_rx_descs = NULL;
 }
 
+static void isert_cq_tx_work(struct work_struct *);
 static void isert_cq_tx_callback(struct ib_cq *, void *);
+static void isert_cq_rx_work(struct work_struct *);
 static void isert_cq_rx_callback(struct ib_cq *, void *);
 
 static int
@@ -259,26 +261,36 @@ isert_create_device_ib_res(struct isert_device *device)
                 cq_desc[i].device = device;
                 cq_desc[i].cq_index = i;
 
+                INIT_WORK(&cq_desc[i].cq_rx_work, isert_cq_rx_work);
                 device->dev_rx_cq[i] = ib_create_cq(device->ib_device,
                                                 isert_cq_rx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
                                                 ISER_MAX_RX_CQ_LEN, i);
-                if (IS_ERR(device->dev_rx_cq[i]))
+                if (IS_ERR(device->dev_rx_cq[i])) {
+                        ret = PTR_ERR(device->dev_rx_cq[i]);
+                        device->dev_rx_cq[i] = NULL;
                         goto out_cq;
+                }
 
+                INIT_WORK(&cq_desc[i].cq_tx_work, isert_cq_tx_work);
                 device->dev_tx_cq[i] = ib_create_cq(device->ib_device,
                                                 isert_cq_tx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
                                                 ISER_MAX_TX_CQ_LEN, i);
-                if (IS_ERR(device->dev_tx_cq[i]))
+                if (IS_ERR(device->dev_tx_cq[i])) {
+                        ret = PTR_ERR(device->dev_tx_cq[i]);
+                        device->dev_tx_cq[i] = NULL;
                         goto out_cq;
+                }
 
-                if (ib_req_notify_cq(device->dev_rx_cq[i], IB_CQ_NEXT_COMP))
+                ret = ib_req_notify_cq(device->dev_rx_cq[i], IB_CQ_NEXT_COMP);
+                if (ret)
                         goto out_cq;
 
-                if (ib_req_notify_cq(device->dev_tx_cq[i], IB_CQ_NEXT_COMP))
+                ret = ib_req_notify_cq(device->dev_tx_cq[i], IB_CQ_NEXT_COMP);
+                if (ret)
                         goto out_cq;
         }
 
@@ -1724,7 +1736,6 @@ isert_cq_tx_callback(struct ib_cq *cq, void *context)
 {
         struct isert_cq_desc *cq_desc = (struct isert_cq_desc *)context;
 
-        INIT_WORK(&cq_desc->cq_tx_work, isert_cq_tx_work);
         queue_work(isert_comp_wq, &cq_desc->cq_tx_work);
 }
 
@@ -1768,7 +1779,6 @@ isert_cq_rx_callback(struct ib_cq *cq, void *context)
 {
         struct isert_cq_desc *cq_desc = (struct isert_cq_desc *)context;
 
-        INIT_WORK(&cq_desc->cq_rx_work, isert_cq_rx_work);
         queue_work(isert_rx_wq, &cq_desc->cq_rx_work);
 }
 
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 846ccdd905b1..d2965e4b3224 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1871,6 +1871,10 @@ void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int
                 break;
 
         case EV_ABS:
+                input_alloc_absinfo(dev);
+                if (!dev->absinfo)
+                        return;
+
                 __set_bit(code, dev->absbit);
                 break;
 
diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index 75762d6ff3ba..aa127ba392a4 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -455,7 +455,18 @@ static void zforce_complete(struct zforce_ts *ts, int cmd, int result)
         }
 }
 
-static irqreturn_t zforce_interrupt(int irq, void *dev_id)
+static irqreturn_t zforce_irq(int irq, void *dev_id)
+{
+        struct zforce_ts *ts = dev_id;
+        struct i2c_client *client = ts->client;
+
+        if (ts->suspended && device_may_wakeup(&client->dev))
+                pm_wakeup_event(&client->dev, 500);
+
+        return IRQ_WAKE_THREAD;
+}
+
+static irqreturn_t zforce_irq_thread(int irq, void *dev_id)
 {
         struct zforce_ts *ts = dev_id;
         struct i2c_client *client = ts->client;
@@ -465,12 +476,10 @@ static irqreturn_t zforce_interrupt(int irq, void *dev_id)
         u8 *payload;
 
         /*
-         * When suspended, emit a wakeup signal if necessary and return.
+         * When still suspended, return.
          * Due to the level-interrupt we will get re-triggered later.
          */
         if (ts->suspended) {
-                if (device_may_wakeup(&client->dev))
-                        pm_wakeup_event(&client->dev, 500);
                 msleep(20);
                 return IRQ_HANDLED;
         }
@@ -763,8 +772,8 @@ static int zforce_probe(struct i2c_client *client,
          * Therefore we can trigger the interrupt anytime it is low and do
          * not need to limit it to the interrupt edge.
          */
-        ret = devm_request_threaded_irq(&client->dev, client->irq, NULL,
-                                        zforce_interrupt,
+        ret = devm_request_threaded_irq(&client->dev, client->irq,
+                                        zforce_irq, zforce_irq_thread,
                                         IRQF_TRIGGER_LOW | IRQF_ONESHOT,
                                         input_dev->name, ts);
         if (ret) {
diff --git a/drivers/irqchip/irq-renesas-intc-irqpin.c b/drivers/irqchip/irq-renesas-intc-irqpin.c
index 82cec63a9011..3ee78f02e5d7 100644
--- a/drivers/irqchip/irq-renesas-intc-irqpin.c
+++ b/drivers/irqchip/irq-renesas-intc-irqpin.c
@@ -149,8 +149,9 @@ static void intc_irqpin_read_modify_write(struct intc_irqpin_priv *p,
 static void intc_irqpin_mask_unmask_prio(struct intc_irqpin_priv *p,
                                          int irq, int do_mask)
 {
-        int bitfield_width = 4; /* PRIO assumed to have fixed bitfield width */
-        int shift = (7 - irq) * bitfield_width; /* PRIO assumed to be 32-bit */
+        /* The PRIO register is assumed to be 32-bit with fixed 4-bit fields. */
+        int bitfield_width = 4;
+        int shift = 32 - (irq + 1) * bitfield_width;
 
         intc_irqpin_read_modify_write(p, INTC_IRQPIN_REG_PRIO,
                                       shift, bitfield_width,
@@ -159,8 +160,9 @@ static void intc_irqpin_mask_unmask_prio(struct intc_irqpin_priv *p,
 
 static int intc_irqpin_set_sense(struct intc_irqpin_priv *p, int irq, int value)
 {
+        /* The SENSE register is assumed to be 32-bit. */
         int bitfield_width = p->config.sense_bitfield_width;
-        int shift = (7 - irq) * bitfield_width; /* SENSE assumed to be 32-bit */
+        int shift = 32 - (irq + 1) * bitfield_width;
 
         dev_dbg(&p->pdev->dev, "sense irq = %d, mode = %d\n", irq, value);
 
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 497bd026c237..4a4825528188 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -1643,10 +1643,6 @@ setup_hfcpci(struct IsdnCard *card)
         int i;
         struct pci_dev *tmp_hfcpci = NULL;
 
-#ifdef __BIG_ENDIAN
-#error "not running on big endian machines now"
-#endif
-
         strcpy(tmp, hfcpci_revision);
         printk(KERN_INFO "HiSax: HFC-PCI driver Rev. %s\n", HiSax_getrev(tmp));
 
diff --git a/drivers/isdn/hisax/telespci.c b/drivers/isdn/hisax/telespci.c
index f6ab63aa6995..33eeb4602c7e 100644
--- a/drivers/isdn/hisax/telespci.c
+++ b/drivers/isdn/hisax/telespci.c
@@ -290,10 +290,6 @@ int setup_telespci(struct IsdnCard *card)
         struct IsdnCardState *cs = card->cs;
         char tmp[64];
 
-#ifdef __BIG_ENDIAN
-#error "not running on big endian machines now"
-#endif
-
         strcpy(tmp, telespci_revision);
         printk(KERN_INFO "HiSax: Teles/PCI driver Rev. %s\n", HiSax_getrev(tmp));
         if (cs->typ != ISDN_CTYPE_TELESPCI)
diff --git a/drivers/leds/leds-lp5521.c b/drivers/leds/leds-lp5521.c
index 05188351711d..a97263e902ff 100644
--- a/drivers/leds/leds-lp5521.c
+++ b/drivers/leds/leds-lp5521.c
@@ -244,18 +244,12 @@ static int lp5521_update_program_memory(struct lp55xx_chip *chip,
         if (i % 2)
                 goto err;
 
-        mutex_lock(&chip->lock);
-
         for (i = 0; i < LP5521_PROGRAM_LENGTH; i++) {
                 ret = lp55xx_write(chip, addr[idx] + i, pattern[i]);
-                if (ret) {
-                        mutex_unlock(&chip->lock);
+                if (ret)
                         return -EINVAL;
-                }
         }
 
-        mutex_unlock(&chip->lock);
-
         return size;
 
 err:
@@ -427,15 +421,17 @@ static ssize_t store_engine_load(struct device *dev,
 {
         struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev));
         struct lp55xx_chip *chip = led->chip;
+        int ret;
 
         mutex_lock(&chip->lock);
 
         chip->engine_idx = nr;
         lp5521_load_engine(chip);
+        ret = lp5521_update_program_memory(chip, buf, len);
 
         mutex_unlock(&chip->lock);
 
-        return lp5521_update_program_memory(chip, buf, len);
+        return ret;
 }
 store_load(1)
 store_load(2)
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index 6b553d9f4266..fd9ab5f61441 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -337,18 +337,12 @@ static int lp5523_update_program_memory(struct lp55xx_chip *chip,
         if (i % 2)
                 goto err;
 
-        mutex_lock(&chip->lock);
-
         for (i = 0; i < LP5523_PROGRAM_LENGTH; i++) {
                 ret = lp55xx_write(chip, LP5523_REG_PROG_MEM + i, pattern[i]);
-                if (ret) {
-                        mutex_unlock(&chip->lock);
+                if (ret)
                         return -EINVAL;
-                }
         }
 
-        mutex_unlock(&chip->lock);
-
         return size;
 
 err:
@@ -548,15 +542,17 @@ static ssize_t store_engine_load(struct device *dev,
 {
         struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev));
         struct lp55xx_chip *chip = led->chip;
+        int ret;
 
         mutex_lock(&chip->lock);
 
         chip->engine_idx = nr;
         lp5523_load_engine_and_select_page(chip);
+        ret = lp5523_update_program_memory(chip, buf, len);
 
         mutex_unlock(&chip->lock);
 
-        return lp5523_update_program_memory(chip, buf, len);
+        return ret;
 }
 store_load(1)
 store_load(2)
diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
index 2b46bf1d7e40..4c9852d92b0a 100644
--- a/drivers/md/bcache/alloc.c
+++ b/drivers/md/bcache/alloc.c
@@ -421,9 +421,11 @@ out:
 
         if (watermark <= WATERMARK_METADATA) {
                 SET_GC_MARK(b, GC_MARK_METADATA);
+                SET_GC_MOVE(b, 0);
                 b->prio = BTREE_PRIO;
         } else {
                 SET_GC_MARK(b, GC_MARK_RECLAIMABLE);
+                SET_GC_MOVE(b, 0);
                 b->prio = INITIAL_PRIO;
         }
 
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 4beb55a0ff30..754f43177483 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -197,7 +197,7 @@ struct bucket {
         uint8_t         disk_gen;
         uint8_t         last_gc; /* Most out of date gen in the btree */
         uint8_t         gc_gen;
-        uint16_t        gc_mark;
+        uint16_t        gc_mark; /* Bitfield used by GC. See below for field */
 };
 
 /*
@@ -209,7 +209,8 @@ BITMASK(GC_MARK,	 struct bucket, gc_mark, 0, 2);
 #define GC_MARK_RECLAIMABLE     0
 #define GC_MARK_DIRTY           1
 #define GC_MARK_METADATA        2
-BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 14);
+BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 13);
+BITMASK(GC_MOVE, struct bucket, gc_mark, 15, 1);
 
 #include "journal.h"
 #include "stats.h"
@@ -372,14 +373,14 @@ struct cached_dev {
         unsigned char           writeback_percent;
         unsigned                writeback_delay;
 
-        int                     writeback_rate_change;
-        int64_t                 writeback_rate_derivative;
         uint64_t                writeback_rate_target;
+        int64_t                 writeback_rate_proportional;
+        int64_t                 writeback_rate_derivative;
+        int64_t                 writeback_rate_change;
 
         unsigned                writeback_rate_update_seconds;
         unsigned                writeback_rate_d_term;
         unsigned                writeback_rate_p_term_inverse;
-        unsigned                writeback_rate_d_smooth;
 };
 
 enum alloc_watermarks {
@@ -445,7 +446,6 @@ struct cache {
          * call prio_write() to keep gens from wrapping.
          */
         uint8_t                 need_save_prio;
-        unsigned                gc_move_threshold;
 
         /*
          * If nonzero, we know we aren't going to find any buckets to invalidate
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 5e2765aadce1..31bb53fcc67a 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1561,6 +1561,28 @@ size_t bch_btree_gc_finish(struct cache_set *c)
                 SET_GC_MARK(PTR_BUCKET(c, &c->uuid_bucket, i),
                             GC_MARK_METADATA);
 
+        /* don't reclaim buckets to which writeback keys point */
+        rcu_read_lock();
+        for (i = 0; i < c->nr_uuids; i++) {
+                struct bcache_device *d = c->devices[i];
+                struct cached_dev *dc;
+                struct keybuf_key *w, *n;
+                unsigned j;
+
+                if (!d || UUID_FLASH_ONLY(&c->uuids[i]))
+                        continue;
+                dc = container_of(d, struct cached_dev, disk);
+
+                spin_lock(&dc->writeback_keys.lock);
+                rbtree_postorder_for_each_entry_safe(w, n,
+                                        &dc->writeback_keys.keys, node)
+                        for (j = 0; j < KEY_PTRS(&w->key); j++)
+                                SET_GC_MARK(PTR_BUCKET(c, &w->key, j),
+                                            GC_MARK_DIRTY);
+                spin_unlock(&dc->writeback_keys.lock);
+        }
+        rcu_read_unlock();
+
         for_each_cache(ca, c, i) {
                 uint64_t *i;
 
@@ -1817,7 +1839,8 @@ static bool fix_overlapping_extents(struct btree *b, struct bkey *insert,
                         if (KEY_START(k) > KEY_START(insert) + sectors_found)
                                 goto check_failed;
 
-                        if (KEY_PTRS(replace_key) != KEY_PTRS(k))
+                        if (KEY_PTRS(k) != KEY_PTRS(replace_key) ||
+                            KEY_DIRTY(k) != KEY_DIRTY(replace_key))
                                 goto check_failed;
 
                         /* skip past gen */
@@ -2217,7 +2240,7 @@ struct btree_insert_op {
         struct bkey     *replace_key;
 };
 
-int btree_insert_fn(struct btree_op *b_op, struct btree *b)
+static int btree_insert_fn(struct btree_op *b_op, struct btree *b)
 {
         struct btree_insert_op *op = container_of(b_op,
                                         struct btree_insert_op, op);
diff --git a/drivers/md/bcache/movinggc.c b/drivers/md/bcache/movinggc.c
index 7c1275e66025..f2f0998c4a91 100644
--- a/drivers/md/bcache/movinggc.c
+++ b/drivers/md/bcache/movinggc.c
@@ -25,10 +25,9 @@ static bool moving_pred(struct keybuf *buf, struct bkey *k)
         unsigned i;
 
         for (i = 0; i < KEY_PTRS(k); i++) {
-                struct cache *ca = PTR_CACHE(c, k, i);
                 struct bucket *g = PTR_BUCKET(c, k, i);
 
-                if (GC_SECTORS_USED(g) < ca->gc_move_threshold)
+                if (GC_MOVE(g))
                         return true;
         }
 
@@ -65,11 +64,16 @@ static void write_moving_finish(struct closure *cl)
 
 static void read_moving_endio(struct bio *bio, int error)
 {
+        struct bbio *b = container_of(bio, struct bbio, bio);
         struct moving_io *io = container_of(bio->bi_private,
                                             struct moving_io, cl);
 
         if (error)
                 io->op.error = error;
+        else if (!KEY_DIRTY(&b->key) &&
+                 ptr_stale(io->op.c, &b->key, 0)) {
+                io->op.error = -EINTR;
+        }
 
         bch_bbio_endio(io->op.c, bio, error, "reading data to move");
 }
@@ -141,6 +145,11 @@ static void read_moving(struct cache_set *c)
                 if (!w)
                         break;
 
+                if (ptr_stale(c, &w->key, 0)) {
+                        bch_keybuf_del(&c->moving_gc_keys, w);
+                        continue;
+                }
+
                 io = kzalloc(sizeof(struct moving_io) + sizeof(struct bio_vec)
                              * DIV_ROUND_UP(KEY_SIZE(&w->key), PAGE_SECTORS),
                              GFP_KERNEL);
@@ -184,7 +193,8 @@ static bool bucket_cmp(struct bucket *l, struct bucket *r)
 
 static unsigned bucket_heap_top(struct cache *ca)
 {
-        return GC_SECTORS_USED(heap_peek(&ca->heap));
+        struct bucket *b;
+        return (b = heap_peek(&ca->heap)) ? GC_SECTORS_USED(b) : 0;
 }
 
 void bch_moving_gc(struct cache_set *c)
@@ -226,9 +236,8 @@ void bch_moving_gc(struct cache_set *c)
                         sectors_to_move -= GC_SECTORS_USED(b);
                 }
 
-                ca->gc_move_threshold = bucket_heap_top(ca);
-
-                pr_debug("threshold %u", ca->gc_move_threshold);
+                while (heap_pop(&ca->heap, b, bucket_cmp))
+                        SET_GC_MOVE(b, 1);
         }
 
         mutex_unlock(&c->bucket_lock);
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index dec15cd2d797..c57bfa071a57 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1676,7 +1676,7 @@ err:
 static bool can_attach_cache(struct cache *ca, struct cache_set *c)
 {
         return ca->sb.block_size        == c->sb.block_size &&
-                ca->sb.bucket_size      == c->sb.block_size &&
+                ca->sb.bucket_size      == c->sb.bucket_size &&
                 ca->sb.nr_in_set        == c->sb.nr_in_set;
 }
 
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 80d4c2bee18a..a1f85612f0b3 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -83,7 +83,6 @@ rw_attribute(writeback_rate);
 rw_attribute(writeback_rate_update_seconds);
 rw_attribute(writeback_rate_d_term);
 rw_attribute(writeback_rate_p_term_inverse);
-rw_attribute(writeback_rate_d_smooth);
 read_attribute(writeback_rate_debug);
 
 read_attribute(stripe_size);
@@ -129,31 +128,41 @@ SHOW(__bch_cached_dev)
         var_printf(writeback_running,   "%i");
         var_print(writeback_delay);
         var_print(writeback_percent);
-        sysfs_print(writeback_rate,     dc->writeback_rate.rate);
+        sysfs_hprint(writeback_rate,    dc->writeback_rate.rate << 9);
 
         var_print(writeback_rate_update_seconds);
         var_print(writeback_rate_d_term);
         var_print(writeback_rate_p_term_inverse);
-        var_print(writeback_rate_d_smooth);
 
         if (attr == &sysfs_writeback_rate_debug) {
+                char rate[20];
                 char dirty[20];
-                char derivative[20];
                 char target[20];
-                bch_hprint(dirty,
-                           bcache_dev_sectors_dirty(&dc->disk) << 9);
-                bch_hprint(derivative,  dc->writeback_rate_derivative << 9);
+                char proportional[20];
+                char derivative[20];
+                char change[20];
+                s64 next_io;
+
+                bch_hprint(rate,        dc->writeback_rate.rate << 9);
+                bch_hprint(dirty,       bcache_dev_sectors_dirty(&dc->disk) << 9);
                 bch_hprint(target,      dc->writeback_rate_target << 9);
+                bch_hprint(proportional,dc->writeback_rate_proportional << 9);
+                bch_hprint(derivative,  dc->writeback_rate_derivative << 9);
+                bch_hprint(change,      dc->writeback_rate_change << 9);
+
+                next_io = div64_s64(dc->writeback_rate.next - local_clock(),
+                                    NSEC_PER_MSEC);
 
                 return sprintf(buf,
-                               "rate:\t\t%u\n"
-                               "change:\t\t%i\n"
+                               "rate:\t\t%s/sec\n"
                                "dirty:\t\t%s\n"
+                               "target:\t\t%s\n"
+                               "proportional:\t%s\n"
                                "derivative:\t%s\n"
-                               "target:\t\t%s\n",
-                               dc->writeback_rate.rate,
-                               dc->writeback_rate_change,
-                               dirty, derivative, target);
+                               "change:\t\t%s/sec\n"
+                               "next io:\t%llims\n",
+                               rate, dirty, target, proportional,
+                               derivative, change, next_io);
         }
 
         sysfs_hprint(dirty_data,
@@ -189,6 +198,7 @@ STORE(__cached_dev)
         struct kobj_uevent_env *env;
 
 #define d_strtoul(var)          sysfs_strtoul(var, dc->var)
+#define d_strtoul_nonzero(var)  sysfs_strtoul_clamp(var, dc->var, 1, INT_MAX)
 #define d_strtoi_h(var)         sysfs_hatoi(var, dc->var)
 
         sysfs_strtoul(data_csum,        dc->disk.data_csum);
@@ -197,16 +207,15 @@ STORE(__cached_dev)
         d_strtoul(writeback_metadata);
         d_strtoul(writeback_running);
         d_strtoul(writeback_delay);
-        sysfs_strtoul_clamp(writeback_rate,
-                            dc->writeback_rate.rate, 1, 1000000);
+
         sysfs_strtoul_clamp(writeback_percent, dc->writeback_percent, 0, 40);
 
-        d_strtoul(writeback_rate_update_seconds);
+        sysfs_strtoul_clamp(writeback_rate,
+                            dc->writeback_rate.rate, 1, INT_MAX);
+
+        d_strtoul_nonzero(writeback_rate_update_seconds);
         d_strtoul(writeback_rate_d_term);
-        d_strtoul(writeback_rate_p_term_inverse);
-        sysfs_strtoul_clamp(writeback_rate_p_term_inverse,
-                            dc->writeback_rate_p_term_inverse, 1, INT_MAX);
-        d_strtoul(writeback_rate_d_smooth);
+        d_strtoul_nonzero(writeback_rate_p_term_inverse);
 
         d_strtoi_h(sequential_cutoff);
         d_strtoi_h(readahead);
@@ -313,7 +322,6 @@ static struct attribute *bch_cached_dev_files[] = {
         &sysfs_writeback_rate_update_seconds,
         &sysfs_writeback_rate_d_term,
         &sysfs_writeback_rate_p_term_inverse,
-        &sysfs_writeback_rate_d_smooth,
         &sysfs_writeback_rate_debug,
         &sysfs_dirty_data,
         &sysfs_stripe_size,
diff --git a/drivers/md/bcache/util.c b/drivers/md/bcache/util.c
index 462214eeacbe..bb37618e7664 100644
--- a/drivers/md/bcache/util.c
+++ b/drivers/md/bcache/util.c
@@ -209,7 +209,13 @@ uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done)
 {
         uint64_t now = local_clock();
 
-        d->next += div_u64(done, d->rate);
+        d->next += div_u64(done * NSEC_PER_SEC, d->rate);
+
+        if (time_before64(now + NSEC_PER_SEC, d->next))
+                d->next = now + NSEC_PER_SEC;
+
+        if (time_after64(now - NSEC_PER_SEC * 2, d->next))
+                d->next = now - NSEC_PER_SEC * 2;
 
         return time_after64(d->next, now)
                 ? div_u64(d->next - now, NSEC_PER_SEC / HZ)
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index 362c4b3f8b4a..1030c6020e98 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -110,7 +110,7 @@ do {									\
         _r;                                                             \
 })
 
-#define heap_peek(h)    ((h)->size ? (h)->data[0] : NULL)
+#define heap_peek(h)    ((h)->used ? (h)->data[0] : NULL)
 
 #define heap_full(h)    ((h)->used == (h)->size)
 
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 99053b1251be..6c44fe059c27 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -30,38 +30,40 @@ static void __update_writeback_rate(struct cached_dev *dc)
 
         /* PD controller */
 
-        int change = 0;
-        int64_t error;
         int64_t dirty = bcache_dev_sectors_dirty(&dc->disk);
         int64_t derivative = dirty - dc->disk.sectors_dirty_last;
+        int64_t proportional = dirty - target;
+        int64_t change;
 
         dc->disk.sectors_dirty_last = dirty;
 
-        derivative *= dc->writeback_rate_d_term;
-        derivative = clamp(derivative, -dirty, dirty);
+        /* Scale to sectors per second */
 
-        derivative = ewma_add(dc->disk.sectors_dirty_derivative, derivative,
-                              dc->writeback_rate_d_smooth, 0);
+        proportional *= dc->writeback_rate_update_seconds;
+        proportional = div_s64(proportional, dc->writeback_rate_p_term_inverse);
 
-        /* Avoid divide by zero */
-        if (!target)
-                goto out;
+        derivative = div_s64(derivative, dc->writeback_rate_update_seconds);
 
-        error = div64_s64((dirty + derivative - target) << 8, target);
+        derivative = ewma_add(dc->disk.sectors_dirty_derivative, derivative,
+                              (dc->writeback_rate_d_term /
+                               dc->writeback_rate_update_seconds) ?: 1, 0);
+
+        derivative *= dc->writeback_rate_d_term;
+        derivative = div_s64(derivative, dc->writeback_rate_p_term_inverse);
 
-        change = div_s64((dc->writeback_rate.rate * error) >> 8,
-                         dc->writeback_rate_p_term_inverse);
+        change = proportional + derivative;
 
         /* Don't increase writeback rate if the device isn't keeping up */
         if (change > 0 &&
             time_after64(local_clock(),
-                         dc->writeback_rate.next + 10 * NSEC_PER_MSEC))
+                         dc->writeback_rate.next + NSEC_PER_MSEC))
                 change = 0;
 
         dc->writeback_rate.rate =
-                clamp_t(int64_t, dc->writeback_rate.rate + change,
+                clamp_t(int64_t, (int64_t) dc->writeback_rate.rate + change,
                         1, NSEC_PER_MSEC);
-out:
+
+        dc->writeback_rate_proportional = proportional;
         dc->writeback_rate_derivative = derivative;
         dc->writeback_rate_change = change;
         dc->writeback_rate_target = target;
@@ -87,15 +89,11 @@ static void update_writeback_rate(struct work_struct *work)
 
 static unsigned writeback_delay(struct cached_dev *dc, unsigned sectors)
 {
-        uint64_t ret;
-
         if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) ||
             !dc->writeback_percent)
                 return 0;
 
-        ret = bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
-
-        return min_t(uint64_t, ret, HZ);
+        return bch_next_delay(&dc->writeback_rate, sectors);
 }
 
 struct dirty_io {
@@ -241,7 +239,7 @@ static void read_dirty(struct cached_dev *dc)
                 if (KEY_START(&w->key) != dc->last_read ||
                     jiffies_to_msecs(delay) > 50)
                         while (!kthread_should_stop() && delay)
-                                delay = schedule_timeout_interruptible(delay);
+                                delay = schedule_timeout_uninterruptible(delay);
 
                 dc->last_read   = KEY_OFFSET(&w->key);
 
@@ -438,7 +436,7 @@ static int bch_writeback_thread(void *arg)
                         while (delay &&
                                !kthread_should_stop() &&
                                !test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags))
-                                delay = schedule_timeout_interruptible(delay);
+                                delay = schedule_timeout_uninterruptible(delay);
                 }
         }
 
@@ -476,6 +474,8 @@ void bch_sectors_dirty_init(struct cached_dev *dc)
 
         bch_btree_map_keys(&op.op, dc->disk.c, &KEY(op.inode, 0, 0),
                            sectors_dirty_init_fn, 0);
+
+        dc->disk.sectors_dirty_last = bcache_dev_sectors_dirty(&dc->disk);
 }
 
 int bch_cached_dev_writeback_init(struct cached_dev *dc)
@@ -490,18 +490,15 @@ int bch_cached_dev_writeback_init(struct cached_dev *dc)
         dc->writeback_delay             = 30;
         dc->writeback_rate.rate         = 1024;
 
-        dc->writeback_rate_update_seconds = 30;
-        dc->writeback_rate_d_term       = 16;
-        dc->writeback_rate_p_term_inverse = 64;
-        dc->writeback_rate_d_smooth     = 8;
+        dc->writeback_rate_update_seconds = 5;
+        dc->writeback_rate_d_term       = 30;
+        dc->writeback_rate_p_term_inverse = 6000;
 
         dc->writeback_thread = kthread_create(bch_writeback_thread, dc,
                                               "bcache_writeback");
         if (IS_ERR(dc->writeback_thread))
                 return PTR_ERR(dc->writeback_thread);
 
-        set_task_state(dc->writeback_thread, TASK_INTERRUPTIBLE);
-
         INIT_DELAYED_WORK(&dc->writeback_rate_update, update_writeback_rate);
         schedule_delayed_work(&dc->writeback_rate_update,
                               dc->writeback_rate_update_seconds * HZ);
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index 11e20afbdcac..705698fd2c7e 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -1228,8 +1228,14 @@ static void rtsx_pci_remove(struct pci_dev *pcidev)
 
         pcr->remove_pci = true;
 
-        cancel_delayed_work(&pcr->carddet_work);
-        cancel_delayed_work(&pcr->idle_work);
+        /* Disable interrupts at the pcr level */
+        spin_lock_irq(&pcr->lock);
+        rtsx_pci_writel(pcr, RTSX_BIER, 0);
+        pcr->bier = 0;
+        spin_unlock_irq(&pcr->lock);
+
+        cancel_delayed_work_sync(&pcr->carddet_work);
+        cancel_delayed_work_sync(&pcr->idle_work);
 
         mfd_remove_devices(&pcidev->dev);
 
diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
index d210d131fef2..0f55589a56b8 100644
--- a/drivers/mtd/maps/pxa2xx-flash.c
+++ b/drivers/mtd/maps/pxa2xx-flash.c
@@ -73,7 +73,7 @@ static int pxa2xx_flash_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
         info->map.cached =
-                ioremap_cached(info->map.phys, info->map.size);
+                ioremap_cache(info->map.phys, info->map.size);
         if (!info->map.cached)
                 printk(KERN_WARNING "Failed to ioremap cached %s\n",
                        info->map.name);
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 187b1b7772ef..4ced59436558 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2201,20 +2201,25 @@ void bond_3ad_adapter_speed_changed(struct slave *slave)
 
         port = &(SLAVE_AD_INFO(slave).port);
 
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
         if (!port->slave) {
                 pr_warning("Warning: %s: speed changed for uninitialized port on %s\n",
                            slave->bond->dev->name, slave->dev->name);
                 return;
         }
 
+        __get_state_machine_lock(port);
+
         port->actor_admin_port_key &= ~AD_SPEED_KEY_BITS;
         port->actor_oper_port_key = port->actor_admin_port_key |=
                 (__get_link_speed(port) << 1);
         pr_debug("Port %d changed speed\n", port->actor_port_number);
-        // there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+        /* there is no need to reselect a new aggregator, just signal the
+         * state machines to reinitialize
+         */
         port->sm_vars |= AD_PORT_BEGIN;
+
+        __release_state_machine_lock(port);
 }
 
 /**
@@ -2229,20 +2234,25 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave)
 
         port = &(SLAVE_AD_INFO(slave).port);
 
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
         if (!port->slave) {
                 pr_warning("%s: Warning: duplex changed for uninitialized port on %s\n",
                            slave->bond->dev->name, slave->dev->name);
                 return;
         }
 
+        __get_state_machine_lock(port);
+
         port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
         port->actor_oper_port_key = port->actor_admin_port_key |=
                 __get_duplex(port);
         pr_debug("Port %d changed duplex\n", port->actor_port_number);
-        // there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+        /* there is no need to reselect a new aggregator, just signal the
+         * state machines to reinitialize
+         */
         port->sm_vars |= AD_PORT_BEGIN;
+
+        __release_state_machine_lock(port);
 }
 
 /**
@@ -2258,15 +2268,21 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
 
         port = &(SLAVE_AD_INFO(slave).port);
 
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
         if (!port->slave) {
                 pr_warning("Warning: %s: link status changed for uninitialized port on %s\n",
                            slave->bond->dev->name, slave->dev->name);
                 return;
         }
 
-        // on link down we are zeroing duplex and speed since some of the adaptors(ce1000.lan) report full duplex/speed instead of N/A(duplex) / 0(speed)
-        // on link up we are forcing recheck on the duplex and speed since some of he adaptors(ce1000.lan) report
+        __get_state_machine_lock(port);
+        /* on link down we are zeroing duplex and speed since
+         * some of the adaptors(ce1000.lan) report full duplex/speed
+         * instead of N/A(duplex) / 0(speed).
+         *
+         * on link up we are forcing recheck on the duplex and speed since
+         * some of he adaptors(ce1000.lan) report.
+         */
         if (link == BOND_LINK_UP) {
                 port->is_enabled = true;
                 port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
@@ -2282,10 +2298,15 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
                 port->actor_oper_port_key = (port->actor_admin_port_key &=
                                              ~AD_SPEED_KEY_BITS);
         }
-        //BOND_PRINT_DBG(("Port %d changed link status to %s", port->actor_port_number, ((link == BOND_LINK_UP)?"UP":"DOWN")));
-        // there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+        pr_debug("Port %d changed link status to %s",
+                port->actor_port_number,
+                (link == BOND_LINK_UP) ? "UP" : "DOWN");
+        /* there is no need to reselect a new aggregator, just signal the
+         * state machines to reinitialize
+         */
         port->sm_vars |= AD_PORT_BEGIN;
+
+        __release_state_machine_lock(port);
 }
 
 /*
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 398e299ee1bd..4b8c58b0ec24 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3732,7 +3732,8 @@ static inline int bond_slave_override(struct bonding *bond,
 }
 
 
-static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb,
+                             void *accel_priv)
 {
         /*
          * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 5f9a7ad9b964..8aeec0b4601a 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -625,6 +625,7 @@ static int ems_usb_start(struct ems_usb *dev)
                         usb_unanchor_urb(urb);
                         usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,
                                           urb->transfer_dma);
+                        usb_free_urb(urb);
                         break;
                 }
 
@@ -798,8 +799,8 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
          * allowed (MAX_TX_URBS).
          */
         if (!context) {
-                usb_unanchor_urb(urb);
                 usb_free_coherent(dev->udev, size, buf, urb->transfer_dma);
+                usb_free_urb(urb);
 
                 netdev_warn(netdev, "couldn't find free context\n");
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 8ee9d1556e6e..263dd921edc4 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -927,6 +927,9 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
         /* set LED in default state (end of init phase) */
         pcan_usb_pro_set_led(dev, 0, 1);
 
+        kfree(bi);
+        kfree(fi);
+
         return 0;
 
  err_out:
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index b2ffad1304d2..248baf6273fb 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -565,6 +565,8 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
         /* Make sure pointer to data buffer is set */
         wmb();
 
+        skb_tx_timestamp(skb);
+
         *info = cpu_to_le32(FOR_EMAC | FIRST_OR_LAST_MASK | len);
 
         /* Increment index to point to the next BD */
@@ -579,8 +581,6 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
 
         arc_reg_set(priv, R_STATUS, TXPL_MASK);
 
-        skb_tx_timestamp(skb);
-
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index a36a760ada28..29801750f239 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -145,9 +145,11 @@ static void atl1c_reset_pcie(struct atl1c_hw *hw, u32 flag)
          * Mask some pcie error bits
          */
         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
-        pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &data);
-        data &= ~(PCI_ERR_UNC_DLP | PCI_ERR_UNC_FCP);
-        pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, data);
+        if (pos) {
+                pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &data);
+                data &= ~(PCI_ERR_UNC_DLP | PCI_ERR_UNC_FCP);
+                pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, data);
+        }
         /* clear error status */
         pcie_capability_write_word(pdev, PCI_EXP_DEVSTA,
                         PCI_EXP_DEVSTA_NFED |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index a1f66e2c9a86..ec6119089b82 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -520,10 +520,12 @@ struct bnx2x_fastpath {
 #define BNX2X_FP_STATE_IDLE                   0
 #define BNX2X_FP_STATE_NAPI             (1 << 0)    /* NAPI owns this FP */
 #define BNX2X_FP_STATE_POLL             (1 << 1)    /* poll owns this FP */
-#define BNX2X_FP_STATE_NAPI_YIELD       (1 << 2)    /* NAPI yielded this FP */
-#define BNX2X_FP_STATE_POLL_YIELD       (1 << 3)    /* poll yielded this FP */
+#define BNX2X_FP_STATE_DISABLED         (1 << 2)
+#define BNX2X_FP_STATE_NAPI_YIELD       (1 << 3)    /* NAPI yielded this FP */
+#define BNX2X_FP_STATE_POLL_YIELD       (1 << 4)    /* poll yielded this FP */
+#define BNX2X_FP_OWNED  (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
 #define BNX2X_FP_YIELD  (BNX2X_FP_STATE_NAPI_YIELD | BNX2X_FP_STATE_POLL_YIELD)
-#define BNX2X_FP_LOCKED (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
+#define BNX2X_FP_LOCKED (BNX2X_FP_OWNED | BNX2X_FP_STATE_DISABLED)
 #define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
         /* protect state */
         spinlock_t lock;
@@ -613,7 +615,7 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
 {
         bool rc = true;
 
-        spin_lock(&fp->lock);
+        spin_lock_bh(&fp->lock);
         if (fp->state & BNX2X_FP_LOCKED) {
                 WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
                 fp->state |= BNX2X_FP_STATE_NAPI_YIELD;
@@ -622,7 +624,7 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
                 /* we don't care if someone yielded */
                 fp->state = BNX2X_FP_STATE_NAPI;
         }
-        spin_unlock(&fp->lock);
+        spin_unlock_bh(&fp->lock);
         return rc;
 }
 
@@ -631,14 +633,16 @@ static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
 {
         bool rc = false;
 
-        spin_lock(&fp->lock);
+        spin_lock_bh(&fp->lock);
         WARN_ON(fp->state &
                 (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_NAPI_YIELD));
 
         if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
                 rc = true;
-        fp->state = BNX2X_FP_STATE_IDLE;
-        spin_unlock(&fp->lock);
+
+        /* state ==> idle, unless currently disabled */
+        fp->state &= BNX2X_FP_STATE_DISABLED;
+        spin_unlock_bh(&fp->lock);
         return rc;
 }
 
@@ -669,7 +673,9 @@ static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
 
         if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
                 rc = true;
-        fp->state = BNX2X_FP_STATE_IDLE;
+
+        /* state ==> idle, unless currently disabled */
+        fp->state &= BNX2X_FP_STATE_DISABLED;
         spin_unlock_bh(&fp->lock);
         return rc;
 }
@@ -677,9 +683,23 @@ static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
 /* true if a socket is polling, even if it did not get the lock */
 static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
-        WARN_ON(!(fp->state & BNX2X_FP_LOCKED));
+        WARN_ON(!(fp->state & BNX2X_FP_OWNED));
         return fp->state & BNX2X_FP_USER_PEND;
 }
+
+/* false if fp is currently owned */
+static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+{
+        int rc = true;
+
+        spin_lock_bh(&fp->lock);
+        if (fp->state & BNX2X_FP_OWNED)
+                rc = false;
+        fp->state |= BNX2X_FP_STATE_DISABLED;
+        spin_unlock_bh(&fp->lock);
+
+        return rc;
+}
 #else
 static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
 {
@@ -709,6 +729,10 @@ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
         return false;
 }
+static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+{
+        return true;
+}
 #endif /* CONFIG_NET_RX_BUSY_POLL */
 
 /* Use 2500 as a mini-jumbo MTU for FCoE */
@@ -1250,7 +1274,10 @@ struct bnx2x_slowpath {
          * Therefore, if they would have been defined in the same union,
          * data can get corrupted.
          */
-        struct afex_vif_list_ramrod_data func_afex_rdata;
+        union {
+                struct afex_vif_list_ramrod_data        viflist_data;
+                struct function_update_data             func_update;
+        } func_afex_rdata;
 
         /* used by dmae command executer */
         struct dmae_command             dmae[MAX_DMAE_C];
@@ -2499,4 +2526,6 @@ void bnx2x_set_local_cmng(struct bnx2x *bp);
 #define MCPR_SCRATCH_BASE(bp) \
         (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
 
+#define E1H_MAX_MF_SB_COUNT (HC_SB_MAX_SB_E1X/(E1HVN_MAX * PORT_MAX))
+
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ec96130533cc..bf811565ee24 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -160,6 +160,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
         struct sk_buff *skb = tx_buf->skb;
         u16 bd_idx = TX_BD(tx_buf->first_bd), new_cons;
         int nbd;
+        u16 split_bd_len = 0;
 
         /* prefetch skb end pointer to speedup dev_kfree_skb() */
         prefetch(&skb->end);
@@ -167,10 +168,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
         DP(NETIF_MSG_TX_DONE, "fp[%d]: pkt_idx %d  buff @(%p)->skb %p\n",
            txdata->txq_index, idx, tx_buf, skb);
 
-        /* unmap first bd */
         tx_start_bd = &txdata->tx_desc_ring[bd_idx].start_bd;
-        dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
-                         BD_UNMAP_LEN(tx_start_bd), DMA_TO_DEVICE);
 
         nbd = le16_to_cpu(tx_start_bd->nbd) - 1;
 #ifdef BNX2X_STOP_ON_ERROR
@@ -188,12 +186,19 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
         --nbd;
         bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
 
-        /* ...and the TSO split header bd since they have no mapping */
+        /* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
         if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
+                tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
+                split_bd_len = BD_UNMAP_LEN(tx_data_bd);
                 --nbd;
                 bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
         }
 
+        /* unmap first bd */
+        dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
+                         BD_UNMAP_LEN(tx_start_bd) + split_bd_len,
+                         DMA_TO_DEVICE);
+
         /* now free frags */
         while (nbd > 0) {
 
@@ -1790,26 +1795,22 @@ static void bnx2x_napi_disable_cnic(struct bnx2x *bp)
 {
         int i;
 
-        local_bh_disable();
         for_each_rx_queue_cnic(bp, i) {
                 napi_disable(&bnx2x_fp(bp, i, napi));
-                while (!bnx2x_fp_lock_napi(&bp->fp[i]))
-                        mdelay(1);
+                while (!bnx2x_fp_ll_disable(&bp->fp[i]))
+                        usleep_range(1000, 2000);
         }
-        local_bh_enable();
 }
 
 static void bnx2x_napi_disable(struct bnx2x *bp)
 {
         int i;
 
-        local_bh_disable();
         for_each_eth_queue(bp, i) {
                 napi_disable(&bnx2x_fp(bp, i, napi));
-                while (!bnx2x_fp_lock_napi(&bp->fp[i]))
-                        mdelay(1);
+                while (!bnx2x_fp_ll_disable(&bp->fp[i]))
+                        usleep_range(1000, 2000);
         }
-        local_bh_enable();
 }
 
 void bnx2x_netif_start(struct bnx2x *bp)
@@ -1832,7 +1833,8 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
                 bnx2x_napi_disable_cnic(bp);
 }
 
-u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
+u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+                       void *accel_priv)
 {
         struct bnx2x *bp = netdev_priv(dev);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index da8fcaa74495..41f3ca5ad972 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -524,7 +524,8 @@ int bnx2x_set_vf_mac(struct net_device *dev, int queue, u8 *mac);
 int bnx2x_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos);
 
 /* select_queue callback */
-u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb);
+u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+                       void *accel_priv);
 
 static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
                                         struct bnx2x_fastpath *fp,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 20dcc02431ca..11fc79585491 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -3865,6 +3865,19 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
 
                 bnx2x_warpcore_enable_AN_KR2(phy, params, vars);
         } else {
+                /* Enable Auto-Detect to support 1G over CL37 as well */
+                bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                                 MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X1, 0x10);
+
+                /* Force cl48 sync_status LOW to avoid getting stuck in CL73
+                 * parallel-detect loop when CL73 and CL37 are enabled.
+                 */
+                CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
+                                  MDIO_AER_BLOCK_AER_REG, 0);
+                bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                                 MDIO_WC_REG_RXB_ANA_RX_CONTROL_PCI, 0x0800);
+                bnx2x_set_aer_mmd(params, phy);
+
                 bnx2x_disable_kr2(params, vars, phy);
         }
 
@@ -8120,17 +8133,20 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                                 *edc_mode = EDC_MODE_ACTIVE_DAC;
                         else
                                 check_limiting_mode = 1;
-                } else if (copper_module_type &
-                        SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
+                } else {
+                        *edc_mode = EDC_MODE_PASSIVE_DAC;
+                        /* Even in case PASSIVE_DAC indication is not set,
+                         * treat it as a passive DAC cable, since some cables
+                         * don't have this indication.
+                         */
+                        if (copper_module_type &
+                            SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
                                 DP(NETIF_MSG_LINK,
                                    "Passive Copper cable detected\n");
-                                *edc_mode =
-                                      EDC_MODE_PASSIVE_DAC;
-                } else {
-                        DP(NETIF_MSG_LINK,
-                           "Unknown copper-cable-type 0x%x !!!\n",
-                           copper_module_type);
-                        return -EINVAL;
+                        } else {
+                                DP(NETIF_MSG_LINK,
+                                   "Unknown copper-cable-type\n");
+                        }
                 }
                 break;
         }
@@ -10825,9 +10841,9 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
                            (1<<11));
 
         if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
-                        (phy->req_line_speed == SPEED_1000)) {
+             (phy->speed_cap_mask &
+              PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
+            (phy->req_line_speed == SPEED_1000)) {
                 an_1000_val |= (1<<8);
                 autoneg_val |= (1<<9 | 1<<12);
                 if (phy->req_duplex == DUPLEX_FULL)
@@ -10843,30 +10859,32 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
                         0x09,
                         &an_1000_val);
 
-        /* Set 100 speed advertisement */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
-                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF)))) {
-                an_10_100_val |= (1<<7);
-                /* Enable autoneg and restart autoneg for legacy speeds */
-                autoneg_val |= (1<<9 | 1<<12);
-
-                if (phy->req_duplex == DUPLEX_FULL)
-                        an_10_100_val |= (1<<8);
-                DP(NETIF_MSG_LINK, "Advertising 100M\n");
-        }
-
-        /* Set 10 speed advertisement */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
-                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)))) {
-                an_10_100_val |= (1<<5);
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
+        /* Advertise 10/100 link speed */
+        if (phy->req_line_speed == SPEED_AUTO_NEG) {
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF) {
+                        an_10_100_val |= (1<<5);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-HD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) {
                         an_10_100_val |= (1<<6);
-                DP(NETIF_MSG_LINK, "Advertising 10M\n");
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-FD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF) {
+                        an_10_100_val |= (1<<7);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-HD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL) {
+                        an_10_100_val |= (1<<8);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-FD\n");
+                }
         }
 
         /* Only 10/100 are allowed to work in FORCE mode */
@@ -13342,6 +13360,10 @@ static u8 bnx2x_analyze_link_error(struct link_params *params,
         DP(NETIF_MSG_LINK, "Link changed:[%x %x]->%x\n", vars->link_up,
            old_status, status);
 
+        /* Do not touch the link in case physical link down */
+        if ((vars->phy_flags & PHY_PHYSICAL_LINK_FLAG) == 0)
+                return 1;
+
         /* a. Update shmem->link_status accordingly
          * b. Update link_vars->link_up
          */
@@ -13550,7 +13572,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
          */
         not_kr2_device = (((base_page & 0x8000) == 0) ||
                           (((base_page & 0x8000) &&
-                            ((next_page & 0xe0) == 0x2))));
+                            ((next_page & 0xe0) == 0x20))));
 
         /* In case KR2 is already disabled, check if we need to re-enable it */
         if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 814d0eca9b33..8b3107b2fcc1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -11447,9 +11447,9 @@ static int bnx2x_get_hwinfo(struct bnx2x *bp)
                 }
         }
 
-        /* adjust igu_sb_cnt to MF for E1x */
-        if (CHIP_IS_E1x(bp) && IS_MF(bp))
-                bp->igu_sb_cnt /= E1HVN_MAX;
+        /* adjust igu_sb_cnt to MF for E1H */
+        if (CHIP_IS_E1H(bp) && IS_MF(bp))
+                bp->igu_sb_cnt = min_t(u8, bp->igu_sb_cnt, E1H_MAX_MF_SB_COUNT);
 
         /* port info */
         bnx2x_get_port_hwinfo(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index 3efbb35267c8..14ffb6e56e59 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -7179,6 +7179,7 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_WC_REG_RX1_PCI_CTRL                        0x80ca
 #define MDIO_WC_REG_RX2_PCI_CTRL                        0x80da
 #define MDIO_WC_REG_RX3_PCI_CTRL                        0x80ea
+#define MDIO_WC_REG_RXB_ANA_RX_CONTROL_PCI              0x80fa
 #define MDIO_WC_REG_XGXSBLK2_UNICORE_MODE_10G           0x8104
 #define MDIO_WC_REG_XGXS_STATUS3                        0x8129
 #define MDIO_WC_REG_PAR_DET_10G_STATUS                  0x8130
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 32c92abf5094..18438a504d57 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -2038,6 +2038,7 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
         struct bnx2x_vlan_mac_ramrod_params p;
         struct bnx2x_exe_queue_obj *exeq = &o->exe_queue;
         struct bnx2x_exeq_elem *exeq_pos, *exeq_pos_n;
+        unsigned long flags;
         int read_lock;
         int rc = 0;
 
@@ -2046,8 +2047,9 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
         spin_lock_bh(&exeq->lock);
 
         list_for_each_entry_safe(exeq_pos, exeq_pos_n, &exeq->exe_queue, link) {
-                if (exeq_pos->cmd_data.vlan_mac.vlan_mac_flags ==
-                    *vlan_mac_flags) {
+                flags = exeq_pos->cmd_data.vlan_mac.vlan_mac_flags;
+                if (BNX2X_VLAN_MAC_CMP_FLAGS(flags) ==
+                    BNX2X_VLAN_MAC_CMP_FLAGS(*vlan_mac_flags)) {
                         rc = exeq->remove(bp, exeq->owner, exeq_pos);
                         if (rc) {
                                 BNX2X_ERR("Failed to remove command\n");
@@ -2080,7 +2082,9 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
                 return read_lock;
 
         list_for_each_entry(pos, &o->head, link) {
-                if (pos->vlan_mac_flags == *vlan_mac_flags) {
+                flags = pos->vlan_mac_flags;
+                if (BNX2X_VLAN_MAC_CMP_FLAGS(flags) ==
+                    BNX2X_VLAN_MAC_CMP_FLAGS(*vlan_mac_flags)) {
                         p.user_req.vlan_mac_flags = pos->vlan_mac_flags;
                         memcpy(&p.user_req.u, &pos->u, sizeof(pos->u));
                         rc = bnx2x_config_vlan_mac(bp, &p);
@@ -4382,8 +4386,11 @@ int bnx2x_config_rss(struct bnx2x *bp,
         struct bnx2x_raw_obj *r = &o->raw;
 
         /* Do nothing if only driver cleanup was requested */
-        if (test_bit(RAMROD_DRV_CLR_ONLY, &p->ramrod_flags))
+        if (test_bit(RAMROD_DRV_CLR_ONLY, &p->ramrod_flags)) {
+                DP(BNX2X_MSG_SP, "Not configuring RSS ramrod_flags=%lx\n",
+                   p->ramrod_flags);
                 return 0;
+        }
 
         r->set_pending(r);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
index 658f4e33abf9..6a53c15c85a3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
@@ -266,6 +266,13 @@ enum {
         BNX2X_DONT_CONSUME_CAM_CREDIT,
         BNX2X_DONT_CONSUME_CAM_CREDIT_DEST,
 };
+/* When looking for matching filters, some flags are not interesting */
+#define BNX2X_VLAN_MAC_CMP_MASK (1 << BNX2X_UC_LIST_MAC | \
+                                 1 << BNX2X_ETH_MAC | \
+                                 1 << BNX2X_ISCSI_ETH_MAC | \
+                                 1 << BNX2X_NETQ_ETH_MAC)
+#define BNX2X_VLAN_MAC_CMP_FLAGS(flags) \
+        ((flags) & BNX2X_VLAN_MAC_CMP_MASK)
 
 struct bnx2x_vlan_mac_ramrod_params {
         /* Object to run the command from */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 2e46c28fc601..e7845e5be1c7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1209,6 +1209,11 @@ static void bnx2x_vfop_rxmode(struct bnx2x *bp, struct bnx2x_virtf *vf)
                 /* next state */
                 vfop->state = BNX2X_VFOP_RXMODE_DONE;
 
+                /* record the accept flags in vfdb so hypervisor can modify them
+                 * if necessary
+                 */
+                bnx2x_vfq(vf, ramrod->cl_id - vf->igu_base_id, accept_flags) =
+                        ramrod->rx_accept_flags;
                 vfop->rc = bnx2x_config_rx_mode(bp, ramrod);
                 bnx2x_vfop_finalize(vf, vfop->rc, VFOP_DONE);
 op_err:
@@ -1224,39 +1229,43 @@ op_pending:
         return;
 }
 
+static void bnx2x_vf_prep_rx_mode(struct bnx2x *bp, u8 qid,
+                                  struct bnx2x_rx_mode_ramrod_params *ramrod,
+                                  struct bnx2x_virtf *vf,
+                                  unsigned long accept_flags)
+{
+        struct bnx2x_vf_queue *vfq = vfq_get(vf, qid);
+
+        memset(ramrod, 0, sizeof(*ramrod));
+        ramrod->cid = vfq->cid;
+        ramrod->cl_id = vfq_cl_id(vf, vfq);
+        ramrod->rx_mode_obj = &bp->rx_mode_obj;
+        ramrod->func_id = FW_VF_HANDLE(vf->abs_vfid);
+        ramrod->rx_accept_flags = accept_flags;
+        ramrod->tx_accept_flags = accept_flags;
+        ramrod->pstate = &vf->filter_state;
+        ramrod->state = BNX2X_FILTER_RX_MODE_PENDING;
+
+        set_bit(BNX2X_FILTER_RX_MODE_PENDING, &vf->filter_state);
+        set_bit(RAMROD_RX, &ramrod->ramrod_flags);
+        set_bit(RAMROD_TX, &ramrod->ramrod_flags);
+
+        ramrod->rdata = bnx2x_vf_sp(bp, vf, rx_mode_rdata.e2);
+        ramrod->rdata_mapping = bnx2x_vf_sp_map(bp, vf, rx_mode_rdata.e2);
+}
+
 int bnx2x_vfop_rxmode_cmd(struct bnx2x *bp,
                           struct bnx2x_virtf *vf,
                           struct bnx2x_vfop_cmd *cmd,
                           int qid, unsigned long accept_flags)
 {
-        struct bnx2x_vf_queue *vfq = vfq_get(vf, qid);
         struct bnx2x_vfop *vfop = bnx2x_vfop_add(bp, vf);
 
         if (vfop) {
                 struct bnx2x_rx_mode_ramrod_params *ramrod =
                         &vf->op_params.rx_mode;
 
-                memset(ramrod, 0, sizeof(*ramrod));
-
-                /* Prepare ramrod parameters */
-                ramrod->cid = vfq->cid;
-                ramrod->cl_id = vfq_cl_id(vf, vfq);
-                ramrod->rx_mode_obj = &bp->rx_mode_obj;
-                ramrod->func_id = FW_VF_HANDLE(vf->abs_vfid);
-
-                ramrod->rx_accept_flags = accept_flags;
-                ramrod->tx_accept_flags = accept_flags;
-                ramrod->pstate = &vf->filter_state;
-                ramrod->state = BNX2X_FILTER_RX_MODE_PENDING;
-
-                set_bit(BNX2X_FILTER_RX_MODE_PENDING, &vf->filter_state);
-                set_bit(RAMROD_RX, &ramrod->ramrod_flags);
-                set_bit(RAMROD_TX, &ramrod->ramrod_flags);
-
-                ramrod->rdata =
-                        bnx2x_vf_sp(bp, vf, rx_mode_rdata.e2);
-                ramrod->rdata_mapping =
-                        bnx2x_vf_sp_map(bp, vf, rx_mode_rdata.e2);
+                bnx2x_vf_prep_rx_mode(bp, qid, ramrod, vf, accept_flags);
 
                 bnx2x_vfop_opset(BNX2X_VFOP_RXMODE_CONFIG,
                                  bnx2x_vfop_rxmode, cmd->done);
@@ -3202,13 +3211,16 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                 bnx2x_iov_static_resc(bp, vf);
         }
 
-        /* prepare msix vectors in VF configuration space */
+        /* prepare msix vectors in VF configuration space - the value in the
+         * PCI configuration space should be the index of the last entry,
+         * namely one less than the actual size of the table
+         */
         for (vf_idx = first_vf; vf_idx < first_vf + req_vfs; vf_idx++) {
                 bnx2x_pretend_func(bp, HW_VF_HANDLE(bp, vf_idx));
                 REG_WR(bp, PCICFG_OFFSET + GRC_CONFIG_REG_VF_MSIX_CONTROL,
-                       num_vf_queues);
+                       num_vf_queues - 1);
                 DP(BNX2X_MSG_IOV, "set msix vec num in VF %d cfg space to %d\n",
-                   vf_idx, num_vf_queues);
+                   vf_idx, num_vf_queues - 1);
         }
         bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
 
@@ -3436,10 +3448,18 @@ out:
 
 int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
 {
+        struct bnx2x_queue_state_params q_params = {NULL};
+        struct bnx2x_vlan_mac_ramrod_params ramrod_param;
+        struct bnx2x_queue_update_params *update_params;
+        struct pf_vf_bulletin_content *bulletin = NULL;
+        struct bnx2x_rx_mode_ramrod_params rx_ramrod;
         struct bnx2x *bp = netdev_priv(dev);
-        int rc, q_logical_state;
+        struct bnx2x_vlan_mac_obj *vlan_obj;
+        unsigned long vlan_mac_flags = 0;
+        unsigned long ramrod_flags = 0;
         struct bnx2x_virtf *vf = NULL;
-        struct pf_vf_bulletin_content *bulletin = NULL;
+        unsigned long accept_flags;
+        int rc;
 
         /* sanity and init */
         rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
@@ -3457,104 +3477,118 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
         /* update PF's copy of the VF's bulletin. No point in posting the vlan
          * to the VF since it doesn't have anything to do with it. But it useful
          * to store it here in case the VF is not up yet and we can only
-         * configure the vlan later when it does.
+         * configure the vlan later when it does. Treat vlan id 0 as remove the
+         * Host tag.
          */
-        bulletin->valid_bitmap |= 1 << VLAN_VALID;
+        if (vlan > 0)
+                bulletin->valid_bitmap |= 1 << VLAN_VALID;
+        else
+                bulletin->valid_bitmap &= ~(1 << VLAN_VALID);
         bulletin->vlan = vlan;
 
         /* is vf initialized and queue set up? */
-        q_logical_state =
-                bnx2x_get_q_logical_state(bp, &bnx2x_leading_vfq(vf, sp_obj));
-        if (vf->state == VF_ENABLED &&
-            q_logical_state == BNX2X_Q_LOGICAL_STATE_ACTIVE) {
-                /* configure the vlan in device on this vf's queue */
-                unsigned long ramrod_flags = 0;
-                unsigned long vlan_mac_flags = 0;
-                struct bnx2x_vlan_mac_obj *vlan_obj =
-                        &bnx2x_leading_vfq(vf, vlan_obj);
-                struct bnx2x_vlan_mac_ramrod_params ramrod_param;
-                struct bnx2x_queue_state_params q_params = {NULL};
-                struct bnx2x_queue_update_params *update_params;
+        if (vf->state != VF_ENABLED ||
+            bnx2x_get_q_logical_state(bp, &bnx2x_leading_vfq(vf, sp_obj)) !=
+            BNX2X_Q_LOGICAL_STATE_ACTIVE)
+                return rc;
 
-                rc = validate_vlan_mac(bp, &bnx2x_leading_vfq(vf, mac_obj));
-                if (rc)
-                        return rc;
-                memset(&ramrod_param, 0, sizeof(ramrod_param));
+        /* configure the vlan in device on this vf's queue */
+        vlan_obj = &bnx2x_leading_vfq(vf, vlan_obj);
+        rc = validate_vlan_mac(bp, &bnx2x_leading_vfq(vf, mac_obj));
+        if (rc)
+                return rc;
 
-                /* must lock vfpf channel to protect against vf flows */
-                bnx2x_lock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
+        /* must lock vfpf channel to protect against vf flows */
+        bnx2x_lock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
 
-                /* remove existing vlans */
-                __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
-                rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_mac_flags,
-                                          &ramrod_flags);
-                if (rc) {
-                        BNX2X_ERR("failed to delete vlans\n");
-                        rc = -EINVAL;
-                        goto out;
-                }
+        /* remove existing vlans */
+        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+        rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_mac_flags,
+                                  &ramrod_flags);
+        if (rc) {
+                BNX2X_ERR("failed to delete vlans\n");
+                rc = -EINVAL;
+                goto out;
+        }
+
+        /* need to remove/add the VF's accept_any_vlan bit */
+        accept_flags = bnx2x_leading_vfq(vf, accept_flags);
+        if (vlan)
+                clear_bit(BNX2X_ACCEPT_ANY_VLAN, &accept_flags);
+        else
+                set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept_flags);
+
+        bnx2x_vf_prep_rx_mode(bp, LEADING_IDX, &rx_ramrod, vf,
+                              accept_flags);
+        bnx2x_leading_vfq(vf, accept_flags) = accept_flags;
+        bnx2x_config_rx_mode(bp, &rx_ramrod);
+
+        /* configure the new vlan to device */
+        memset(&ramrod_param, 0, sizeof(ramrod_param));
+        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+        ramrod_param.vlan_mac_obj = vlan_obj;
+        ramrod_param.ramrod_flags = ramrod_flags;
+        set_bit(BNX2X_DONT_CONSUME_CAM_CREDIT,
+                &ramrod_param.user_req.vlan_mac_flags);
+        ramrod_param.user_req.u.vlan.vlan = vlan;
+        ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
+        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
+        if (rc) {
+                BNX2X_ERR("failed to configure vlan\n");
+                rc =  -EINVAL;
+                goto out;
+        }
 
-                /* send queue update ramrod to configure default vlan and silent
-                 * vlan removal
+        /* send queue update ramrod to configure default vlan and silent
+         * vlan removal
+         */
+        __set_bit(RAMROD_COMP_WAIT, &q_params.ramrod_flags);
+        q_params.cmd = BNX2X_Q_CMD_UPDATE;
+        q_params.q_obj = &bnx2x_leading_vfq(vf, sp_obj);
+        update_params = &q_params.params.update;
+        __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN_CHNG,
+                  &update_params->update_flags);
+        __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM_CHNG,
+                  &update_params->update_flags);
+        if (vlan == 0) {
+                /* if vlan is 0 then we want to leave the VF traffic
+                 * untagged, and leave the incoming traffic untouched
+                 * (i.e. do not remove any vlan tags).
                  */
-                __set_bit(RAMROD_COMP_WAIT, &q_params.ramrod_flags);
-                q_params.cmd = BNX2X_Q_CMD_UPDATE;
-                q_params.q_obj = &bnx2x_leading_vfq(vf, sp_obj);
-                update_params = &q_params.params.update;
-                __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN_CHNG,
+                __clear_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
+                            &update_params->update_flags);
+                __clear_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
+                            &update_params->update_flags);
+        } else {
+                /* configure default vlan to vf queue and set silent
+                 * vlan removal (the vf remains unaware of this vlan).
+                 */
+                __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
                           &update_params->update_flags);
-                __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM_CHNG,
+                __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
                           &update_params->update_flags);
+                update_params->def_vlan = vlan;
+                update_params->silent_removal_value =
+                        vlan & VLAN_VID_MASK;
+                update_params->silent_removal_mask = VLAN_VID_MASK;
+        }
 
-                if (vlan == 0) {
-                        /* if vlan is 0 then we want to leave the VF traffic
-                         * untagged, and leave the incoming traffic untouched
-                         * (i.e. do not remove any vlan tags).
-                         */
-                        __clear_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
-                                    &update_params->update_flags);
-                        __clear_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                                    &update_params->update_flags);
-                } else {
-                        /* configure the new vlan to device */
-                        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
-                        ramrod_param.vlan_mac_obj = vlan_obj;
-                        ramrod_param.ramrod_flags = ramrod_flags;
-                        ramrod_param.user_req.u.vlan.vlan = vlan;
-                        ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
-                        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
-                        if (rc) {
-                                BNX2X_ERR("failed to configure vlan\n");
-                                rc =  -EINVAL;
-                                goto out;
-                        }
-
-                        /* configure default vlan to vf queue and set silent
-                         * vlan removal (the vf remains unaware of this vlan).
-                         */
-                        update_params = &q_params.params.update;
-                        __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
-                                  &update_params->update_flags);
-                        __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                                  &update_params->update_flags);
-                        update_params->def_vlan = vlan;
-                }
+        /* Update the Queue state */
+        rc = bnx2x_queue_state_change(bp, &q_params);
+        if (rc) {
+                BNX2X_ERR("Failed to configure default VLAN\n");
+                goto out;
+        }
 
-                /* Update the Queue state */
-                rc = bnx2x_queue_state_change(bp, &q_params);
-                if (rc) {
-                        BNX2X_ERR("Failed to configure default VLAN\n");
-                        goto out;
-                }
 
-                /* clear the flag indicating that this VF needs its vlan
-                 * (will only be set if the HV configured the Vlan before vf was
-                 * up and we were called because the VF came up later
-                 */
+        /* clear the flag indicating that this VF needs its vlan
+         * (will only be set if the HV configured the Vlan before vf was
+         * up and we were called because the VF came up later
+         */
 out:
-                vf->cfg_flags &= ~VF_CFG_VLAN;
-                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
-        }
+        vf->cfg_flags &= ~VF_CFG_VLAN;
+        bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
+
         return rc;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 1ff6a9366629..8c213fa52174 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -74,6 +74,7 @@ struct bnx2x_vf_queue {
         /* VLANs object */
         struct bnx2x_vlan_mac_obj       vlan_obj;
         atomic_t vlan_count;            /* 0 means vlan-0 is set  ~ untagged */
+        unsigned long accept_flags;     /* last accept flags configured */
 
         /* Queue Slow-path State object */
         struct bnx2x_queue_sp_obj       sp_obj;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index efa8a151d789..0756d7dabdd5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -208,7 +208,7 @@ static int bnx2x_get_vf_id(struct bnx2x *bp, u32 *vf_id)
                 return -EINVAL;
         }
 
-        BNX2X_ERR("valid ME register value: 0x%08x\n", me_reg);
+        DP(BNX2X_MSG_IOV, "valid ME register value: 0x%08x\n", me_reg);
 
         *vf_id = (me_reg & ME_REG_VF_NUM_MASK) >> ME_REG_VF_NUM_SHIFT;
 
@@ -1598,6 +1598,8 @@ static void bnx2x_vfop_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
 
                 if (msg->flags & VFPF_SET_Q_FILTERS_RX_MASK_CHANGED) {
                         unsigned long accept = 0;
+                        struct pf_vf_bulletin_content *bulletin =
+                                BP_VF_BULLETIN(bp, vf->index);
 
                         /* covert VF-PF if mask to bnx2x accept flags */
                         if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_MATCHED_UNICAST)
@@ -1617,9 +1619,11 @@ static void bnx2x_vfop_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                                 __set_bit(BNX2X_ACCEPT_BROADCAST, &accept);
 
                         /* A packet arriving the vf's mac should be accepted
-                         * with any vlan
+                         * with any vlan, unless a vlan has already been
+                         * configured.
                          */
-                        __set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept);
+                        if (!(bulletin->valid_bitmap & (1 << VLAN_VALID)))
+                                __set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept);
 
                         /* set rx-mode */
                         rc = bnx2x_vfop_rxmode_cmd(bp, vf, &cmd,
@@ -1710,6 +1714,21 @@ static void bnx2x_vf_mbx_set_q_filters(struct bnx2x *bp,
                         goto response;
                 }
         }
+        /* if vlan was set by hypervisor we don't allow guest to config vlan */
+        if (bulletin->valid_bitmap & 1 << VLAN_VALID) {
+                int i;
+
+                /* search for vlan filters */
+                for (i = 0; i < filters->n_mac_vlan_filters; i++) {
+                        if (filters->filters[i].flags &
+                            VFPF_Q_FILTER_VLAN_TAG_VALID) {
+                                BNX2X_ERR("VF[%d] attempted to configure vlan but one was already set by Hypervisor. Aborting request\n",
+                                          vf->abs_vfid);
+                                vf->op_rc = -EPERM;
+                                goto response;
+                        }
+                }
+        }
 
         /* verify vf_qid */
         if (filters->vf_qid > vf_rxq_count(vf))
@@ -1805,6 +1824,9 @@ static void bnx2x_vf_mbx_update_rss(struct bnx2x *bp, struct bnx2x_virtf *vf,
         vf_op_params->rss_result_mask = rss_tlv->rss_result_mask;
 
         /* flags handled individually for backward/forward compatability */
+        vf_op_params->rss_flags = 0;
+        vf_op_params->ramrod_flags = 0;
+
         if (rss_tlv->rss_flags & VFPF_RSS_MODE_DISABLED)
                 __set_bit(BNX2X_RSS_MODE_DISABLED, &vf_op_params->rss_flags);
         if (rss_tlv->rss_flags & VFPF_RSS_MODE_REGULAR)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index f3dd93b4aeaa..15a66e4b1f57 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7622,7 +7622,7 @@ static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
 {
         u32 base = (u32) mapping & 0xffffffff;
 
-        return (base > 0xffffdcc0) && (base + len + 8 < base);
+        return base + len + 8 < base;
 }
 
 /* Test for TSO DMA buffers that cross into regions which are within MSS bytes
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 6c9308850453..56e0415f8cdf 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -228,6 +228,25 @@ struct tp_params {
 
         uint32_t dack_re;            /* DACK timer resolution */
         unsigned short tx_modq[NCHAN];  /* channel to modulation queue map */
+
+        u32 vlan_pri_map;               /* cached TP_VLAN_PRI_MAP */
+        u32 ingress_config;             /* cached TP_INGRESS_CONFIG */
+
+        /* TP_VLAN_PRI_MAP Compressed Filter Tuple field offsets.  This is a
+         * subset of the set of fields which may be present in the Compressed
+         * Filter Tuple portion of filters and TCP TCB connections.  The
+         * fields which are present are controlled by the TP_VLAN_PRI_MAP.
+         * Since a variable number of fields may or may not be present, their
+         * shifted field positions within the Compressed Filter Tuple may
+         * vary, or not even be present if the field isn't selected in
+         * TP_VLAN_PRI_MAP.  Since some of these fields are needed in various
+         * places we store their offsets here, or a -1 if the field isn't
+         * present.
+         */
+        int vlan_shift;
+        int vnic_shift;
+        int port_shift;
+        int protocol_shift;
 };
 
 struct vpd_params {
@@ -926,6 +945,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
                const u8 *fw_data, unsigned int fw_size,
                struct fw_hdr *card_fw, enum dev_state state, int *reset);
 int t4_prep_adapter(struct adapter *adapter);
+int t4_init_tp_params(struct adapter *adap);
+int t4_filter_field_shift(const struct adapter *adap, int filter_sel);
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf);
 void t4_fatal_err(struct adapter *adapter);
 int t4_config_rss_range(struct adapter *adapter, int mbox, unsigned int viid,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index d6b12e035a7d..fff02ed1295e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2986,7 +2986,14 @@ int cxgb4_alloc_stid(struct tid_info *t, int family, void *data)
         if (stid >= 0) {
                 t->stid_tab[stid].data = data;
                 stid += t->stid_base;
-                t->stids_in_use++;
+                /* IPv6 requires max of 520 bits or 16 cells in TCAM
+                 * This is equivalent to 4 TIDs. With CLIP enabled it
+                 * needs 2 TIDs.
+                 */
+                if (family == PF_INET)
+                        t->stids_in_use++;
+                else
+                        t->stids_in_use += 4;
         }
         spin_unlock_bh(&t->stid_lock);
         return stid;
@@ -3012,7 +3019,8 @@ int cxgb4_alloc_sftid(struct tid_info *t, int family, void *data)
         }
         if (stid >= 0) {
                 t->stid_tab[stid].data = data;
-                stid += t->stid_base;
+                stid -= t->nstids;
+                stid += t->sftid_base;
                 t->stids_in_use++;
         }
         spin_unlock_bh(&t->stid_lock);
@@ -3024,14 +3032,24 @@ EXPORT_SYMBOL(cxgb4_alloc_sftid);
  */
 void cxgb4_free_stid(struct tid_info *t, unsigned int stid, int family)
 {
-        stid -= t->stid_base;
+        /* Is it a server filter TID? */
+        if (t->nsftids && (stid >= t->sftid_base)) {
+                stid -= t->sftid_base;
+                stid += t->nstids;
+        } else {
+                stid -= t->stid_base;
+        }
+
         spin_lock_bh(&t->stid_lock);
         if (family == PF_INET)
                 __clear_bit(stid, t->stid_bmap);
         else
                 bitmap_release_region(t->stid_bmap, stid, 2);
         t->stid_tab[stid].data = NULL;
-        t->stids_in_use--;
+        if (family == PF_INET)
+                t->stids_in_use--;
+        else
+                t->stids_in_use -= 4;
         spin_unlock_bh(&t->stid_lock);
 }
 EXPORT_SYMBOL(cxgb4_free_stid);
@@ -3134,6 +3152,7 @@ static int tid_init(struct tid_info *t)
         size_t size;
         unsigned int stid_bmap_size;
         unsigned int natids = t->natids;
+        struct adapter *adap = container_of(t, struct adapter, tids);
 
         stid_bmap_size = BITS_TO_LONGS(t->nstids + t->nsftids);
         size = t->ntids * sizeof(*t->tid_tab) +
@@ -3167,6 +3186,11 @@ static int tid_init(struct tid_info *t)
                 t->afree = t->atid_tab;
         }
         bitmap_zero(t->stid_bmap, t->nstids + t->nsftids);
+        /* Reserve stid 0 for T4/T5 adapters */
+        if (!t->stid_base &&
+            (is_t4(adap->params.chip) || is_t5(adap->params.chip)))
+                __set_bit(0, t->stid_bmap);
+
         return 0;
 }
 
@@ -3731,7 +3755,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
         lli.ucq_density = 1 << QUEUESPERPAGEPF0_GET(
                         t4_read_reg(adap, SGE_INGRESS_QUEUES_PER_PAGE_PF) >>
                         (adap->fn * 4));
-        lli.filt_mode = adap->filter_mode;
+        lli.filt_mode = adap->params.tp.vlan_pri_map;
         /* MODQ_REQ_MAP sets queues 0-3 to chan 0-3 */
         for (i = 0; i < NCHAN; i++)
                 lli.tx_modq[i] = i;
@@ -4179,7 +4203,7 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
         adap = netdev2adap(dev);
 
         /* Adjust stid to correct filter index */
-        stid -= adap->tids.nstids;
+        stid -= adap->tids.sftid_base;
         stid += adap->tids.nftids;
 
         /* Check to make sure the filter requested is writable ...
@@ -4205,12 +4229,17 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
                         f->fs.val.lip[i] = val[i];
                         f->fs.mask.lip[i] = ~0;
                 }
-                if (adap->filter_mode & F_PORT) {
+                if (adap->params.tp.vlan_pri_map & F_PORT) {
                         f->fs.val.iport = port;
                         f->fs.mask.iport = mask;
                 }
         }
 
+        if (adap->params.tp.vlan_pri_map & F_PROTOCOL) {
+                f->fs.val.proto = IPPROTO_TCP;
+                f->fs.mask.proto = ~0;
+        }
+
         f->fs.dirsteer = 1;
         f->fs.iq = queue;
         /* Mark filter as locked */
@@ -4237,7 +4266,7 @@ int cxgb4_remove_server_filter(const struct net_device *dev, unsigned int stid,
         adap = netdev2adap(dev);
 
         /* Adjust stid to correct filter index */
-        stid -= adap->tids.nstids;
+        stid -= adap->tids.sftid_base;
         stid += adap->tids.nftids;
 
         f = &adap->tids.ftid_tab[stid];
@@ -5092,7 +5121,7 @@ static int adap_init0(struct adapter *adap)
         enum dev_state state;
         u32 params[7], val[7];
         struct fw_caps_config_cmd caps_cmd;
-        int reset = 1, j;
+        int reset = 1;
 
         /*
          * Contact FW, advertising Master capability (and potentially forcing
@@ -5434,21 +5463,11 @@ static int adap_init0(struct adapter *adap)
         /*
          * These are finalized by FW initialization, load their values now.
          */
-        v = t4_read_reg(adap, TP_TIMER_RESOLUTION);
-        adap->params.tp.tre = TIMERRESOLUTION_GET(v);
-        adap->params.tp.dack_re = DELAYEDACKRESOLUTION_GET(v);
         t4_read_mtu_tbl(adap, adap->params.mtus, NULL);
         t4_load_mtus(adap, adap->params.mtus, adap->params.a_wnd,
                      adap->params.b_wnd);
 
-        /* MODQ_REQ_MAP defaults to setting queues 0-3 to chan 0-3 */
-        for (j = 0; j < NCHAN; j++)
-                adap->params.tp.tx_modq[j] = j;
-
-        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
-                         &adap->filter_mode, 1,
-                         TP_VLAN_PRI_MAP);
-
+        t4_init_tp_params(adap);
         adap->flags |= FW_OK;
         return 0;
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
index 6f21f2451c30..4dd0a82533e4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
@@ -131,7 +131,14 @@ static inline void *lookup_atid(const struct tid_info *t, unsigned int atid)
 
 static inline void *lookup_stid(const struct tid_info *t, unsigned int stid)
 {
-        stid -= t->stid_base;
+        /* Is it a server filter TID? */
+        if (t->nsftids && (stid >= t->sftid_base)) {
+                stid -= t->sftid_base;
+                stid += t->nstids;
+        } else {
+                stid -= t->stid_base;
+        }
+
         return stid < (t->nstids + t->nsftids) ? t->stid_tab[stid].data : NULL;
 }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
index 29878098101e..cb05be905def 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
@@ -45,6 +45,7 @@
 #include "l2t.h"
 #include "t4_msg.h"
 #include "t4fw_api.h"
+#include "t4_regs.h"
 
 #define VLAN_NONE 0xfff
 
@@ -411,6 +412,40 @@ done:
 }
 EXPORT_SYMBOL(cxgb4_l2t_get);
 
+u64 cxgb4_select_ntuple(struct net_device *dev,
+                        const struct l2t_entry *l2t)
+{
+        struct adapter *adap = netdev2adap(dev);
+        struct tp_params *tp = &adap->params.tp;
+        u64 ntuple = 0;
+
+        /* Initialize each of the fields which we care about which are present
+         * in the Compressed Filter Tuple.
+         */
+        if (tp->vlan_shift >= 0 && l2t->vlan != VLAN_NONE)
+                ntuple |= (F_FT_VLAN_VLD | l2t->vlan) << tp->vlan_shift;
+
+        if (tp->port_shift >= 0)
+                ntuple |= (u64)l2t->lport << tp->port_shift;
+
+        if (tp->protocol_shift >= 0)
+                ntuple |= (u64)IPPROTO_TCP << tp->protocol_shift;
+
+        if (tp->vnic_shift >= 0) {
+                u32 viid = cxgb4_port_viid(dev);
+                u32 vf = FW_VIID_VIN_GET(viid);
+                u32 pf = FW_VIID_PFN_GET(viid);
+                u32 vld = FW_VIID_VIVLD_GET(viid);
+
+                ntuple |= (u64)(V_FT_VNID_ID_VF(vf) |
+                                V_FT_VNID_ID_PF(pf) |
+                                V_FT_VNID_ID_VLD(vld)) << tp->vnic_shift;
+        }
+
+        return ntuple;
+}
+EXPORT_SYMBOL(cxgb4_select_ntuple);
+
 /*
  * Called when address resolution fails for an L2T entry to handle packets
  * on the arpq head.  If a packet specifies a failure handler it is invoked,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.h b/drivers/net/ethernet/chelsio/cxgb4/l2t.h
index 108c0f1fce1c..85eb5c71358d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.h
@@ -98,7 +98,8 @@ int cxgb4_l2t_send(struct net_device *dev, struct sk_buff *skb,
 struct l2t_entry *cxgb4_l2t_get(struct l2t_data *d, struct neighbour *neigh,
                                 const struct net_device *physdev,
                                 unsigned int priority);
-
+u64 cxgb4_select_ntuple(struct net_device *dev,
+                        const struct l2t_entry *l2t);
 void t4_l2t_update(struct adapter *adap, struct neighbour *neigh);
 struct l2t_entry *t4_l2t_alloc_switching(struct l2t_data *d);
 int t4_l2t_set_switching(struct adapter *adap, struct l2t_entry *e, u16 vlan,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index cc380c36e1a8..cc3511a5cd0c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2581,7 +2581,7 @@ static int t4_sge_init_soft(struct adapter *adap)
         #undef READ_FL_BUF
 
         if (fl_small_pg != PAGE_SIZE ||
-            (fl_large_pg != 0 && (fl_large_pg <= fl_small_pg ||
+            (fl_large_pg != 0 && (fl_large_pg < fl_small_pg ||
                                   (fl_large_pg & (fl_large_pg-1)) != 0))) {
                 dev_err(adap->pdev_dev, "bad SGE FL page buffer sizes [%d, %d]\n",
                         fl_small_pg, fl_large_pg);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 74a6fce5a15a..e1413eacdbd2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3808,6 +3808,109 @@ int t4_prep_adapter(struct adapter *adapter)
         return 0;
 }
 
+/**
+ *      t4_init_tp_params - initialize adap->params.tp
+ *      @adap: the adapter
+ *
+ *      Initialize various fields of the adapter's TP Parameters structure.
+ */
+int t4_init_tp_params(struct adapter *adap)
+{
+        int chan;
+        u32 v;
+
+        v = t4_read_reg(adap, TP_TIMER_RESOLUTION);
+        adap->params.tp.tre = TIMERRESOLUTION_GET(v);
+        adap->params.tp.dack_re = DELAYEDACKRESOLUTION_GET(v);
+
+        /* MODQ_REQ_MAP defaults to setting queues 0-3 to chan 0-3 */
+        for (chan = 0; chan < NCHAN; chan++)
+                adap->params.tp.tx_modq[chan] = chan;
+
+        /* Cache the adapter's Compressed Filter Mode and global Incress
+         * Configuration.
+         */
+        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
+                         &adap->params.tp.vlan_pri_map, 1,
+                         TP_VLAN_PRI_MAP);
+        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
+                         &adap->params.tp.ingress_config, 1,
+                         TP_INGRESS_CONFIG);
+
+        /* Now that we have TP_VLAN_PRI_MAP cached, we can calculate the field
+         * shift positions of several elements of the Compressed Filter Tuple
+         * for this adapter which we need frequently ...
+         */
+        adap->params.tp.vlan_shift = t4_filter_field_shift(adap, F_VLAN);
+        adap->params.tp.vnic_shift = t4_filter_field_shift(adap, F_VNIC_ID);
+        adap->params.tp.port_shift = t4_filter_field_shift(adap, F_PORT);
+        adap->params.tp.protocol_shift = t4_filter_field_shift(adap,
+                                                               F_PROTOCOL);
+
+        /* If TP_INGRESS_CONFIG.VNID == 0, then TP_VLAN_PRI_MAP.VNIC_ID
+         * represents the presense of an Outer VLAN instead of a VNIC ID.
+         */
+        if ((adap->params.tp.ingress_config & F_VNIC) == 0)
+                adap->params.tp.vnic_shift = -1;
+
+        return 0;
+}
+
+/**
+ *      t4_filter_field_shift - calculate filter field shift
+ *      @adap: the adapter
+ *      @filter_sel: the desired field (from TP_VLAN_PRI_MAP bits)
+ *
+ *      Return the shift position of a filter field within the Compressed
+ *      Filter Tuple.  The filter field is specified via its selection bit
+ *      within TP_VLAN_PRI_MAL (filter mode).  E.g. F_VLAN.
+ */
+int t4_filter_field_shift(const struct adapter *adap, int filter_sel)
+{
+        unsigned int filter_mode = adap->params.tp.vlan_pri_map;
+        unsigned int sel;
+        int field_shift;
+
+        if ((filter_mode & filter_sel) == 0)
+                return -1;
+
+        for (sel = 1, field_shift = 0; sel < filter_sel; sel <<= 1) {
+                switch (filter_mode & sel) {
+                case F_FCOE:
+                        field_shift += W_FT_FCOE;
+                        break;
+                case F_PORT:
+                        field_shift += W_FT_PORT;
+                        break;
+                case F_VNIC_ID:
+                        field_shift += W_FT_VNIC_ID;
+                        break;
+                case F_VLAN:
+                        field_shift += W_FT_VLAN;
+                        break;
+                case F_TOS:
+                        field_shift += W_FT_TOS;
+                        break;
+                case F_PROTOCOL:
+                        field_shift += W_FT_PROTOCOL;
+                        break;
+                case F_ETHERTYPE:
+                        field_shift += W_FT_ETHERTYPE;
+                        break;
+                case F_MACMATCH:
+                        field_shift += W_FT_MACMATCH;
+                        break;
+                case F_MPSHITTYPE:
+                        field_shift += W_FT_MPSHITTYPE;
+                        break;
+                case F_FRAGMENTATION:
+                        field_shift += W_FT_FRAGMENTATION;
+                        break;
+                }
+        }
+        return field_shift;
+}
+
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
 {
         u8 addr[6];
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index 0a8205d69d2c..4082522d8140 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -1171,10 +1171,50 @@
 
 #define A_TP_TX_SCHED_PCMD 0x25
 
+#define S_VNIC    11
+#define V_VNIC(x) ((x) << S_VNIC)
+#define F_VNIC    V_VNIC(1U)
+
+#define S_FRAGMENTATION    9
+#define V_FRAGMENTATION(x) ((x) << S_FRAGMENTATION)
+#define F_FRAGMENTATION    V_FRAGMENTATION(1U)
+
+#define S_MPSHITTYPE    8
+#define V_MPSHITTYPE(x) ((x) << S_MPSHITTYPE)
+#define F_MPSHITTYPE    V_MPSHITTYPE(1U)
+
+#define S_MACMATCH    7
+#define V_MACMATCH(x) ((x) << S_MACMATCH)
+#define F_MACMATCH    V_MACMATCH(1U)
+
+#define S_ETHERTYPE    6
+#define V_ETHERTYPE(x) ((x) << S_ETHERTYPE)
+#define F_ETHERTYPE    V_ETHERTYPE(1U)
+
+#define S_PROTOCOL    5
+#define V_PROTOCOL(x) ((x) << S_PROTOCOL)
+#define F_PROTOCOL    V_PROTOCOL(1U)
+
+#define S_TOS    4
+#define V_TOS(x) ((x) << S_TOS)
+#define F_TOS    V_TOS(1U)
+
+#define S_VLAN    3
+#define V_VLAN(x) ((x) << S_VLAN)
+#define F_VLAN    V_VLAN(1U)
+
+#define S_VNIC_ID    2
+#define V_VNIC_ID(x) ((x) << S_VNIC_ID)
+#define F_VNIC_ID    V_VNIC_ID(1U)
+
 #define S_PORT    1
 #define V_PORT(x) ((x) << S_PORT)
 #define F_PORT    V_PORT(1U)
 
+#define S_FCOE    0
+#define V_FCOE(x) ((x) << S_FCOE)
+#define F_FCOE    V_FCOE(1U)
+
 #define NUM_MPS_CLS_SRAM_L_INSTANCES 336
 #define NUM_MPS_T5_CLS_SRAM_L_INSTANCES 512
 
@@ -1213,4 +1253,37 @@
 #define V_CHIPID(x) ((x) << S_CHIPID)
 #define G_CHIPID(x) (((x) >> S_CHIPID) & M_CHIPID)
 
+/* TP_VLAN_PRI_MAP controls which subset of fields will be present in the
+ * Compressed Filter Tuple for LE filters.  Each bit set in TP_VLAN_PRI_MAP
+ * selects for a particular field being present.  These fields, when present
+ * in the Compressed Filter Tuple, have the following widths in bits.
+ */
+#define W_FT_FCOE                       1
+#define W_FT_PORT                       3
+#define W_FT_VNIC_ID                    17
+#define W_FT_VLAN                       17
+#define W_FT_TOS                        8
+#define W_FT_PROTOCOL                   8
+#define W_FT_ETHERTYPE                  16
+#define W_FT_MACMATCH                   9
+#define W_FT_MPSHITTYPE                 3
+#define W_FT_FRAGMENTATION              1
+
+/* Some of the Compressed Filter Tuple fields have internal structure.  These
+ * bit shifts/masks describe those structures.  All shifts are relative to the
+ * base position of the fields within the Compressed Filter Tuple
+ */
+#define S_FT_VLAN_VLD                   16
+#define V_FT_VLAN_VLD(x)                ((x) << S_FT_VLAN_VLD)
+#define F_FT_VLAN_VLD                   V_FT_VLAN_VLD(1U)
+
+#define S_FT_VNID_ID_VF                 0
+#define V_FT_VNID_ID_VF(x)              ((x) << S_FT_VNID_ID_VF)
+
+#define S_FT_VNID_ID_PF                 7
+#define V_FT_VNID_ID_PF(x)              ((x) << S_FT_VNID_ID_PF)
+
+#define S_FT_VNID_ID_VLD                16
+#define V_FT_VNID_ID_VLD(x)             ((x) << S_FT_VNID_ID_VLD)
+
 #endif /* __T4_REGS_H */
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 5878df619b53..4ccaf9af6fc9 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -104,6 +104,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define BE3_MAX_RSS_QS          16
 #define BE3_MAX_TX_QS           16
 #define BE3_MAX_EVT_QS          16
+#define BE3_SRIOV_MAX_EVT_QS    8
 
 #define MAX_RX_QS               32
 #define MAX_EVT_QS              32
@@ -480,7 +481,7 @@ struct be_adapter {
         struct list_head entry;
 
         u32 flash_status;
-        struct completion flash_compl;
+        struct completion et_cmd_compl;
 
         struct be_resources res;        /* resources available for the func */
         u16 num_vfs;                    /* Number of VFs provisioned by PF */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index e0e8bc1ef14c..94c35c8d799d 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -141,11 +141,17 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
                 subsystem = resp_hdr->subsystem;
         }
 
+        if (opcode == OPCODE_LOWLEVEL_LOOPBACK_TEST &&
+            subsystem == CMD_SUBSYSTEM_LOWLEVEL) {
+                complete(&adapter->et_cmd_compl);
+                return 0;
+        }
+
         if (((opcode == OPCODE_COMMON_WRITE_FLASHROM) ||
              (opcode == OPCODE_COMMON_WRITE_OBJECT)) &&
             (subsystem == CMD_SUBSYSTEM_COMMON)) {
                 adapter->flash_status = compl_status;
-                complete(&adapter->flash_compl);
+                complete(&adapter->et_cmd_compl);
         }
 
         if (compl_status == MCC_STATUS_SUCCESS) {
@@ -2017,6 +2023,9 @@ int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
                         0x3ea83c02, 0x4a110304};
         int status;
 
+        if (!(be_if_cap_flags(adapter) & BE_IF_FLAGS_RSS))
+                return 0;
+
         if (mutex_lock_interruptible(&adapter->mbox_lock))
                 return -1;
 
@@ -2160,7 +2169,7 @@ int lancer_cmd_write_object(struct be_adapter *adapter, struct be_dma_mem *cmd,
         be_mcc_notify(adapter);
         spin_unlock_bh(&adapter->mcc_lock);
 
-        if (!wait_for_completion_timeout(&adapter->flash_compl,
+        if (!wait_for_completion_timeout(&adapter->et_cmd_compl,
                                          msecs_to_jiffies(60000)))
                 status = -1;
         else
@@ -2255,8 +2264,8 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
         be_mcc_notify(adapter);
         spin_unlock_bh(&adapter->mcc_lock);
 
-        if (!wait_for_completion_timeout(&adapter->flash_compl,
-                        msecs_to_jiffies(40000)))
+        if (!wait_for_completion_timeout(&adapter->et_cmd_compl,
+                                         msecs_to_jiffies(40000)))
                 status = -1;
         else
                 status = adapter->flash_status;
@@ -2367,6 +2376,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_loopback_test *req;
+        struct be_cmd_resp_loopback_test *resp;
         int status;
 
         spin_lock_bh(&adapter->mcc_lock);
@@ -2381,8 +2391,8 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 
         be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
                         OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req), wrb, NULL);
-        req->hdr.timeout = cpu_to_le32(4);
 
+        req->hdr.timeout = cpu_to_le32(15);
         req->pattern = cpu_to_le64(pattern);
         req->src_port = cpu_to_le32(port_num);
         req->dest_port = cpu_to_le32(port_num);
@@ -2390,12 +2400,15 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
         req->num_pkts = cpu_to_le32(num_pkts);
         req->loopback_type = cpu_to_le32(loopback_type);
 
-        status = be_mcc_notify_wait(adapter);
-        if (!status) {
-                struct be_cmd_resp_loopback_test *resp = embedded_payload(wrb);
-                status = le32_to_cpu(resp->status);
-        }
+        be_mcc_notify(adapter);
+
+        spin_unlock_bh(&adapter->mcc_lock);
 
+        wait_for_completion(&adapter->et_cmd_compl);
+        resp = embedded_payload(wrb);
+        status = le32_to_cpu(resp->status);
+
+        return status;
 err:
         spin_unlock_bh(&adapter->mcc_lock);
         return status;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 0fde69d5cb6a..bf40fdaecfa3 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2744,13 +2744,16 @@ static int be_rx_qs_create(struct be_adapter *adapter)
                 if (!BEx_chip(adapter))
                         adapter->rss_flags |= RSS_ENABLE_UDP_IPV4 |
                                                 RSS_ENABLE_UDP_IPV6;
+        } else {
+                /* Disable RSS, if only default RX Q is created */
+                adapter->rss_flags = RSS_ENABLE_NONE;
+        }
 
-                rc = be_cmd_rss_config(adapter, rsstable, adapter->rss_flags,
-                                       128);
-                if (rc) {
-                        adapter->rss_flags = 0;
-                        return rc;
-                }
+        rc = be_cmd_rss_config(adapter, rsstable, adapter->rss_flags,
+                               128);
+        if (rc) {
+                adapter->rss_flags = RSS_ENABLE_NONE;
+                return rc;
         }
 
         /* First time posting */
@@ -3124,11 +3127,11 @@ static void BEx_get_resources(struct be_adapter *adapter,
 {
         struct pci_dev *pdev = adapter->pdev;
         bool use_sriov = false;
+        int max_vfs;
 
-        if (BE3_chip(adapter) && sriov_want(adapter)) {
-                int max_vfs;
+        max_vfs = pci_sriov_get_totalvfs(pdev);
 
-                max_vfs = pci_sriov_get_totalvfs(pdev);
+        if (BE3_chip(adapter) && sriov_want(adapter)) {
                 res->max_vfs = max_vfs > 0 ? min(MAX_VFS, max_vfs) : 0;
                 use_sriov = res->max_vfs;
         }
@@ -3159,7 +3162,11 @@ static void BEx_get_resources(struct be_adapter *adapter,
                                            BE3_MAX_RSS_QS : BE2_MAX_RSS_QS;
         res->max_rx_qs = res->max_rss_qs + 1;
 
-        res->max_evt_qs = be_physfn(adapter) ? BE3_MAX_EVT_QS : 1;
+        if (be_physfn(adapter))
+                res->max_evt_qs = (max_vfs > 0) ?
+                                        BE3_SRIOV_MAX_EVT_QS : BE3_MAX_EVT_QS;
+        else
+                res->max_evt_qs = 1;
 
         res->if_cap_flags = BE_IF_CAP_FLAGS_WANT;
         if (!(adapter->function_caps & BE_FUNCTION_CAPS_RSS))
@@ -4205,7 +4212,7 @@ static int be_ctrl_init(struct be_adapter *adapter)
         spin_lock_init(&adapter->mcc_lock);
         spin_lock_init(&adapter->mcc_cq_lock);
 
-        init_completion(&adapter->flash_compl);
+        init_completion(&adapter->et_cmd_compl);
         pci_save_state(adapter->pdev);
         return 0;
 
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index e7c8b749c5a5..50bb71c663e2 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -428,6 +428,8 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         /* If this was the last BD in the ring, start at the beginning again. */
         bdp = fec_enet_get_nextdesc(bdp, fep);
 
+        skb_tx_timestamp(skb);
+
         fep->cur_tx = bdp;
 
         if (fep->cur_tx == fep->dirty_tx)
@@ -436,8 +438,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         /* Trigger transmission start */
         writel(0, fep->hwp + FEC_X_DES_ACTIVE);
 
-        skb_tx_timestamp(skb);
-
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/ethernet/intel/e1000e/80003es2lan.c b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
index 895450e9bb3c..ff2d806eaef7 100644
--- a/drivers/net/ethernet/intel/e1000e/80003es2lan.c
+++ b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
@@ -718,8 +718,11 @@ static s32 e1000_reset_hw_80003es2lan(struct e1000_hw *hw)
         e1000_release_phy_80003es2lan(hw);
 
         /* Disable IBIST slave mode (far-end loopback) */
-        e1000_read_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
-                                        &kum_reg_data);
+        ret_val =
+            e1000_read_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+                                            &kum_reg_data);
+        if (ret_val)
+                return ret_val;
         kum_reg_data |= E1000_KMRNCTRLSTA_IBIST_DISABLE;
         e1000_write_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
                                          kum_reg_data);
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 8d3945ab7334..c30d41d6e426 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6174,7 +6174,7 @@ static int __e1000_resume(struct pci_dev *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
 static int e1000_suspend(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -6193,7 +6193,7 @@ static int e1000_resume(struct device *dev)
 
         return __e1000_resume(pdev);
 }
-#endif /* CONFIG_PM_SLEEP */
+#endif /* CONFIG_PM */
 
 #ifdef CONFIG_PM_RUNTIME
 static int e1000_runtime_suspend(struct device *dev)
diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
index da2be59505c0..20e71f4ca426 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -1757,19 +1757,23 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
                  * it across the board.
                  */
                 ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
-                if (ret_val)
+                if (ret_val) {
                         /* If the first read fails, another entity may have
                          * ownership of the resources, wait and try again to
                          * see if they have relinquished the resources yet.
                          */
-                        udelay(usec_interval);
+                        if (usec_interval >= 1000)
+                                msleep(usec_interval / 1000);
+                        else
+                                udelay(usec_interval);
+                }
                 ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
                 if (ret_val)
                         break;
                 if (phy_status & BMSR_LSTATUS)
                         break;
                 if (usec_interval >= 1000)
-                        mdelay(usec_interval / 1000);
+                        msleep(usec_interval / 1000);
                 else
                         udelay(usec_interval);
         }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index cc06854296a3..5bcc870f8367 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6827,12 +6827,20 @@ static inline int ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, u16 size)
         return __ixgbe_maybe_stop_tx(tx_ring, size);
 }
 
-#ifdef IXGBE_FCOE
-static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
+                              void *accel_priv)
 {
+        struct ixgbe_fwd_adapter *fwd_adapter = accel_priv;
+#ifdef IXGBE_FCOE
         struct ixgbe_adapter *adapter;
         struct ixgbe_ring_feature *f;
         int txq;
+#endif
+
+        if (fwd_adapter)
+                return skb->queue_mapping + fwd_adapter->tx_base_queue;
+
+#ifdef IXGBE_FCOE
 
         /*
          * only execute the code below if protocol is FCoE
@@ -6858,9 +6866,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
                 txq -= f->indices;
 
         return txq + f->offset;
+#else
+        return __netdev_pick_tx(dev, skb);
+#endif
 }
 
-#endif
 netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
                           struct ixgbe_adapter *adapter,
                           struct ixgbe_ring *tx_ring)
@@ -7629,27 +7639,11 @@ static void ixgbe_fwd_del(struct net_device *pdev, void *priv)
         kfree(fwd_adapter);
 }
 
-static netdev_tx_t ixgbe_fwd_xmit(struct sk_buff *skb,
-                                  struct net_device *dev,
-                                  void *priv)
-{
-        struct ixgbe_fwd_adapter *fwd_adapter = priv;
-        unsigned int queue;
-        struct ixgbe_ring *tx_ring;
-
-        queue = skb->queue_mapping + fwd_adapter->tx_base_queue;
-        tx_ring = fwd_adapter->real_adapter->tx_ring[queue];
-
-        return __ixgbe_xmit_frame(skb, dev, tx_ring);
-}
-
 static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_open               = ixgbe_open,
         .ndo_stop               = ixgbe_close,
         .ndo_start_xmit         = ixgbe_xmit_frame,
-#ifdef IXGBE_FCOE
         .ndo_select_queue       = ixgbe_select_queue,
-#endif
         .ndo_set_rx_mode        = ixgbe_set_rx_mode,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = ixgbe_set_mac,
@@ -7689,7 +7683,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_bridge_getlink     = ixgbe_ndo_bridge_getlink,
         .ndo_dfwd_add_station   = ixgbe_fwd_add,
         .ndo_dfwd_del_station   = ixgbe_fwd_del,
-        .ndo_dfwd_start_xmit    = ixgbe_fwd_xmit,
 };
 
 /**
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index d6f0c0d8cf11..72084f70adbb 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -291,7 +291,9 @@ static int ixgbe_pci_sriov_disable(struct pci_dev *dev)
 {
         struct ixgbe_adapter *adapter = pci_get_drvdata(dev);
         int err;
+#ifdef CONFIG_PCI_IOV
         u32 current_flags = adapter->flags;
+#endif
 
         err = ixgbe_disable_sriov(adapter);
 
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 6a6c1f76d8e0..ec94a20d7099 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -619,7 +619,8 @@ ltq_etop_set_multicast_list(struct net_device *dev)
 }
 
 static u16
-ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb)
+ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      void *accel_priv)
 {
         /* we are currently only using the first queue */
         return 0;
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index 7354960b583b..c4eeb69a5bee 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -92,6 +92,12 @@ static int orion_mdio_wait_ready(struct mii_bus *bus)
                         if (time_is_before_jiffies(end))
                                 ++timedout;
                 } else {
+                        /* wait_event_timeout does not guarantee a delay of at
+                         * least one whole jiffie, so timeout must be no less
+                         * than two.
+                         */
+                        if (timeout < 2)
+                                timeout = 2;
                         wait_event_timeout(dev->smi_busy_wait,
                                            orion_mdio_smi_is_done(dev),
                                            timeout);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index f54ebd5a1702..a7fcd593b2db 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -592,7 +592,8 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, struct sk_buff *sk
         }
 }
 
-u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb)
+u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
+                         void *accel_priv)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         u16 rings_p_up = priv->num_tx_rings_p_up;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index f3758de59c05..d5758adceaa2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -714,7 +714,8 @@ int mlx4_en_set_cq_moder(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 int mlx4_en_arm_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 
 void mlx4_en_tx_irq(struct mlx4_cq *mcq);
-u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb);
+u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
+                         void *accel_priv);
 netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev);
 
 int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 7692dfd4f262..cc68657f0536 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -1604,13 +1604,13 @@ netxen_process_lro(struct netxen_adapter *adapter,
         u32 seq_number;
         u8 vhdr_len = 0;
 
-        if (unlikely(ring > adapter->max_rds_rings))
+        if (unlikely(ring >= adapter->max_rds_rings))
                 return NULL;
 
         rds_ring = &recv_ctx->rds_rings[ring];
 
         index = netxen_get_lro_sts_refhandle(sts_data0);
-        if (unlikely(index > rds_ring->num_desc))
+        if (unlikely(index >= rds_ring->num_desc))
                 return NULL;
 
         buffer = &rds_ring->rx_buf_arr[index];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 631ea0ac1cd8..f2a7c7166e24 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -487,6 +487,7 @@ struct qlcnic_hardware_context {
         struct qlcnic_mailbox *mailbox;
         u8 extend_lb_time;
         u8 phys_port_id[ETH_ALEN];
+        u8 lb_mode;
 };
 
 struct qlcnic_adapter_stats {
@@ -578,6 +579,8 @@ struct qlcnic_host_tx_ring {
         dma_addr_t phys_addr;
         dma_addr_t hw_cons_phys_addr;
         struct netdev_queue *txq;
+        /* Lock to protect Tx descriptors cleanup */
+        spinlock_t tx_clean_lock;
 } ____cacheline_internodealigned_in_smp;
 
 /*
@@ -808,6 +811,7 @@ struct qlcnic_mac_list_s {
 
 #define QLCNIC_ILB_MODE         0x1
 #define QLCNIC_ELB_MODE         0x2
+#define QLCNIC_LB_MODE_MASK     0x3
 
 #define QLCNIC_LINKEVENT        0x1
 #define QLCNIC_LB_RESPONSE      0x2
@@ -1093,7 +1097,6 @@ struct qlcnic_adapter {
         struct qlcnic_filter_hash rx_fhash;
         struct list_head vf_mc_list;
 
-        spinlock_t tx_clean_lock;
         spinlock_t mac_learn_lock;
         /* spinlock for catching rcv filters for eswitch traffic */
         spinlock_t rx_mac_learn_lock;
@@ -1708,6 +1711,7 @@ int qlcnic_83xx_init_mailbox_work(struct qlcnic_adapter *);
 void qlcnic_83xx_detach_mailbox_work(struct qlcnic_adapter *);
 void qlcnic_83xx_reinit_mbx_work(struct qlcnic_mailbox *mbx);
 void qlcnic_83xx_free_mailbox(struct qlcnic_mailbox *mbx);
+void qlcnic_update_stats(struct qlcnic_adapter *);
 
 /* Adapter hardware abstraction */
 struct qlcnic_hardware_ops {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index b1cb0ffb15c7..f776f99f7915 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -447,8 +447,9 @@ irqreturn_t qlcnic_83xx_intr(int irq, void *data)
 
         qlcnic_83xx_poll_process_aen(adapter);
 
-        if (ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
-                ahw->diag_cnt++;
+        if (ahw->diag_test) {
+                if (ahw->diag_test == QLCNIC_INTERRUPT_TEST)
+                        ahw->diag_cnt++;
                 qlcnic_83xx_enable_legacy_msix_mbx_intr(adapter);
                 return IRQ_HANDLED;
         }
@@ -1345,11 +1346,6 @@ static int qlcnic_83xx_diag_alloc_res(struct net_device *netdev, int test,
         }
 
         if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                /* disable and free mailbox interrupt */
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        qlcnic_83xx_enable_mbx_poll(adapter);
-                        qlcnic_83xx_free_mbx_intr(adapter);
-                }
                 adapter->ahw->loopback_state = 0;
                 adapter->ahw->hw_ops->setup_link_event(adapter, 1);
         }
@@ -1363,33 +1359,20 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_host_sds_ring *sds_ring;
-        int ring, err;
+        int ring;
 
         clear_bit(__QLCNIC_DEV_UP, &adapter->state);
         if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                 for (ring = 0; ring < adapter->drv_sds_rings; ring++) {
                         sds_ring = &adapter->recv_ctx->sds_rings[ring];
-                        qlcnic_83xx_disable_intr(adapter, sds_ring);
-                        if (!(adapter->flags & QLCNIC_MSIX_ENABLED))
-                                qlcnic_83xx_enable_mbx_poll(adapter);
+                        if (adapter->flags & QLCNIC_MSIX_ENABLED)
+                                qlcnic_83xx_disable_intr(adapter, sds_ring);
                 }
         }
 
         qlcnic_fw_destroy_ctx(adapter);
         qlcnic_detach(adapter);
 
-        if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        err = qlcnic_83xx_setup_mbx_intr(adapter);
-                        qlcnic_83xx_disable_mbx_poll(adapter);
-                        if (err) {
-                                dev_err(&adapter->pdev->dev,
-                                        "%s: failed to setup mbx interrupt\n",
-                                        __func__);
-                                goto out;
-                        }
-                }
-        }
         adapter->ahw->diag_test = 0;
         adapter->drv_sds_rings = drv_sds_rings;
 
@@ -1399,9 +1382,6 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
         if (netif_running(netdev))
                 __qlcnic_up(adapter, netdev);
 
-        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST &&
-            !(adapter->flags & QLCNIC_MSIX_ENABLED))
-                qlcnic_83xx_disable_mbx_poll(adapter);
 out:
         netif_device_attach(netdev);
 }
@@ -1704,12 +1684,6 @@ int qlcnic_83xx_loopback_test(struct net_device *netdev, u8 mode)
                 }
         } while ((adapter->ahw->linkup && ahw->has_link_events) != 1);
 
-        /* Make sure carrier is off and queue is stopped during loopback */
-        if (netif_running(netdev)) {
-                netif_carrier_off(netdev);
-                netif_tx_stop_all_queues(netdev);
-        }
-
         ret = qlcnic_do_lb_test(adapter, mode);
 
         qlcnic_83xx_clear_lb_mode(adapter, mode);
@@ -2141,6 +2115,7 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
         ahw->link_autoneg = MSB(MSW(data[3]));
         ahw->module_type = MSB(LSW(data[3]));
         ahw->has_link_events = 1;
+        ahw->lb_mode = data[4] & QLCNIC_LB_MODE_MASK;
         qlcnic_advert_link_change(adapter, link_status);
 }
 
@@ -3754,6 +3729,19 @@ static void qlcnic_83xx_decode_mbx_rsp(struct qlcnic_adapter *adapter,
         return;
 }
 
+static inline void qlcnic_dump_mailbox_registers(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 offset;
+
+        offset = QLCRDX(ahw, QLCNIC_DEF_INT_MASK);
+        dev_info(&adapter->pdev->dev, "Mbx interrupt mask=0x%x, Mbx interrupt enable=0x%x, Host mbx control=0x%x, Fw mbx control=0x%x",
+                 readl(ahw->pci_base0 + offset),
+                 QLCRDX(ahw, QLCNIC_MBX_INTR_ENBL),
+                 QLCRDX(ahw, QLCNIC_HOST_MBX_CTRL),
+                 QLCRDX(ahw, QLCNIC_FW_MBX_CTRL));
+}
+
 static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
 {
         struct qlcnic_mailbox *mbx = container_of(work, struct qlcnic_mailbox,
@@ -3798,6 +3786,8 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
                                 __func__, cmd->cmd_op, cmd->type, ahw->pci_func,
                                 ahw->op_mode);
                         clear_bit(QLC_83XX_MBX_READY, &mbx->status);
+                        qlcnic_dump_mailbox_registers(adapter);
+                        qlcnic_83xx_get_mbx_data(adapter, cmd);
                         qlcnic_dump_mbx(adapter, cmd);
                         qlcnic_83xx_idc_request_reset(adapter,
                                                       QLCNIC_FORCE_FW_DUMP_KEY);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 4cae6caa6bfa..a6a33508e401 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -662,4 +662,5 @@ pci_ers_result_t qlcnic_83xx_io_error_detected(struct pci_dev *,
                                                pci_channel_state_t);
 pci_ers_result_t qlcnic_83xx_io_slot_reset(struct pci_dev *);
 void qlcnic_83xx_io_resume(struct pci_dev *);
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *);
 #endif
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 89208e5b25d6..918e18ddf038 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -740,6 +740,7 @@ static int qlcnic_83xx_idc_unknown_state(struct qlcnic_adapter *adapter)
         adapter->ahw->idc.err_code = -EIO;
         dev_err(&adapter->pdev->dev,
                 "%s: Device in unknown state\n", __func__);
+        clear_bit(__QLCNIC_RESETTING, &adapter->state);
         return 0;
 }
 
@@ -818,7 +819,6 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
         struct qlcnic_hardware_context *ahw = adapter->ahw;
         struct qlcnic_mailbox *mbx = ahw->mailbox;
         int ret = 0;
-        u32 owner;
         u32 val;
 
         /* Perform NIC configuration based ready state entry actions */
@@ -848,9 +848,9 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
                         set_bit(__QLCNIC_RESETTING, &adapter->state);
                         qlcnic_83xx_idc_enter_need_reset_state(adapter, 1);
                 }  else {
-                        owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
-                        if (ahw->pci_func == owner)
-                                qlcnic_dump_fw(adapter);
+                        netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                                    __func__);
+                        qlcnic_83xx_idc_enter_failed_state(adapter, 1);
                 }
                 return -EIO;
         }
@@ -948,13 +948,26 @@ static int qlcnic_83xx_idc_need_quiesce_state(struct qlcnic_adapter *adapter)
         return 0;
 }
 
-static int qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
+static void qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
 {
-        dev_err(&adapter->pdev->dev, "%s: please restart!!\n", __func__);
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 val, owner;
+
+        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                if (ahw->pci_func == owner) {
+                        qlcnic_83xx_stop_hw(adapter);
+                        qlcnic_dump_fw(adapter);
+                }
+        }
+
+        netdev_warn(adapter->netdev, "%s: Reboot will be required to recover the adapter!!\n",
+                    __func__);
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
-        adapter->ahw->idc.err_code = -EIO;
+        ahw->idc.err_code = -EIO;
 
-        return 0;
+        return;
 }
 
 static int qlcnic_83xx_idc_quiesce_state(struct qlcnic_adapter *adapter)
@@ -1063,12 +1076,6 @@ void qlcnic_83xx_idc_poll_dev_state(struct work_struct *work)
         adapter->ahw->idc.prev_state = adapter->ahw->idc.curr_state;
         qlcnic_83xx_periodic_tasks(adapter);
 
-        /* Do not reschedule if firmaware is in hanged state and auto
-         * recovery is disabled
-         */
-        if ((adapter->flags & QLCNIC_FW_HANG) && !qlcnic_auto_fw_reset)
-                return;
-
         /* Re-schedule the function */
         if (test_bit(QLC_83XX_MODULE_LOADED, &adapter->ahw->idc.status))
                 qlcnic_schedule_work(adapter, qlcnic_83xx_idc_poll_dev_state,
@@ -1219,10 +1226,10 @@ void qlcnic_83xx_idc_request_reset(struct qlcnic_adapter *adapter, u32 key)
         }
 
         val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
-        if ((val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) ||
-            !qlcnic_auto_fw_reset) {
-                dev_err(&adapter->pdev->dev,
-                        "%s:failed, device in non reset mode\n", __func__);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                            __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 0);
                 qlcnic_83xx_unlock_driver(adapter);
                 return;
         }
@@ -1254,24 +1261,24 @@ static int qlcnic_83xx_copy_bootloader(struct qlcnic_adapter *adapter)
         if (size & 0xF)
                 size = (size + 16) & ~0xF;
 
-        p_cache = kzalloc(size, GFP_KERNEL);
+        p_cache = vzalloc(size);
         if (p_cache == NULL)
                 return -ENOMEM;
 
         ret = qlcnic_83xx_lockless_flash_read32(adapter, src, p_cache,
                                                 size / sizeof(u32));
         if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                 return ret;
         }
         /* 16 byte write to MS memory */
         ret = qlcnic_83xx_ms_mem_write128(adapter, dest, (u32 *)p_cache,
                                           size / 16);
         if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                 return ret;
         }
-        kfree(p_cache);
+        vfree(p_cache);
 
         return ret;
 }
@@ -1939,7 +1946,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
         p_dev->ahw->reset.seq_index = index;
 }
 
-static void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
 {
         p_dev->ahw->reset.seq_index = 0;
 
@@ -1994,6 +2001,14 @@ static int qlcnic_83xx_restart_hw(struct qlcnic_adapter *adapter)
         val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
         if (!(val & QLC_83XX_IDC_GRACEFULL_RESET))
                 qlcnic_dump_fw(adapter);
+
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                            __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 1);
+                return err;
+        }
+
         qlcnic_83xx_init_hw(adapter);
 
         if (qlcnic_83xx_copy_bootloader(adapter))
@@ -2073,8 +2088,8 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
                 ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                 adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
                 ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
-                adapter->max_sds_rings = ahw->max_rx_ques;
-                adapter->max_tx_rings = ahw->max_tx_ques;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
+                adapter->max_tx_rings = QLCNIC_MAX_TX_RINGS;
         } else {
                 return -EIO;
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index b36c02fafcfd..6b08194aa0d4 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -167,27 +167,35 @@ static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
 
 #define QLCNIC_TEST_LEN ARRAY_SIZE(qlcnic_gstrings_test)
 
-static inline int qlcnic_82xx_statistics(void)
+static inline int qlcnic_82xx_statistics(struct qlcnic_adapter *adapter)
 {
-        return ARRAY_SIZE(qlcnic_device_gstrings_stats) +
-               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings);
+        return ARRAY_SIZE(qlcnic_gstrings_stats) +
+               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings) +
+               QLCNIC_TX_STATS_LEN * adapter->drv_tx_rings;
 }
 
-static inline int qlcnic_83xx_statistics(void)
+static inline int qlcnic_83xx_statistics(struct qlcnic_adapter *adapter)
 {
-        return ARRAY_SIZE(qlcnic_83xx_tx_stats_strings) +
+        return ARRAY_SIZE(qlcnic_gstrings_stats) +
+               ARRAY_SIZE(qlcnic_83xx_tx_stats_strings) +
                ARRAY_SIZE(qlcnic_83xx_mac_stats_strings) +
-               ARRAY_SIZE(qlcnic_83xx_rx_stats_strings);
+               ARRAY_SIZE(qlcnic_83xx_rx_stats_strings) +
+               QLCNIC_TX_STATS_LEN * adapter->drv_tx_rings;
 }
 
 static int qlcnic_dev_statistics_len(struct qlcnic_adapter *adapter)
 {
-        if (qlcnic_82xx_check(adapter))
-                return qlcnic_82xx_statistics();
-        else if (qlcnic_83xx_check(adapter))
-                return qlcnic_83xx_statistics();
-        else
-                return -1;
+        int len = -1;
+
+        if (qlcnic_82xx_check(adapter)) {
+                len = qlcnic_82xx_statistics(adapter);
+                if (adapter->flags & QLCNIC_ESWITCH_ENABLED)
+                        len += ARRAY_SIZE(qlcnic_device_gstrings_stats);
+        } else if (qlcnic_83xx_check(adapter)) {
+                len = qlcnic_83xx_statistics(adapter);
+        }
+
+        return len;
 }
 
 #define QLCNIC_TX_INTR_NOT_CONFIGURED   0X78563412
@@ -667,30 +675,25 @@ qlcnic_set_ringparam(struct net_device *dev,
 static int qlcnic_validate_ring_count(struct qlcnic_adapter *adapter,
                                       u8 rx_ring, u8 tx_ring)
 {
+        if (rx_ring == 0 || tx_ring == 0)
+                return -EINVAL;
+
         if (rx_ring != 0) {
                 if (rx_ring > adapter->max_sds_rings) {
-                        netdev_err(adapter->netdev, "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
+                        netdev_err(adapter->netdev,
+                                   "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
                                    rx_ring, adapter->max_sds_rings);
                         return -EINVAL;
                 }
         }
 
          if (tx_ring != 0) {
-                if (qlcnic_82xx_check(adapter) &&
-                    (tx_ring > adapter->max_tx_rings)) {
+                if (tx_ring > adapter->max_tx_rings) {
                         netdev_err(adapter->netdev,
                                    "Invalid ring count, Tx ring count %d should not be greater than max %d driver Tx rings.\n",
                                    tx_ring, adapter->max_tx_rings);
                         return -EINVAL;
                 }
-
-                if (qlcnic_83xx_check(adapter) &&
-                    (tx_ring > QLCNIC_SINGLE_RING)) {
-                        netdev_err(adapter->netdev,
-                                   "Invalid ring count, Tx ring count %d should not be greater than %d driver Tx rings.\n",
-                                   tx_ring, QLCNIC_SINGLE_RING);
-                         return -EINVAL;
-                }
         }
 
         return 0;
@@ -925,18 +928,13 @@ static int qlcnic_eeprom_test(struct net_device *dev)
 
 static int qlcnic_get_sset_count(struct net_device *dev, int sset)
 {
-        int len;
 
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         switch (sset) {
         case ETH_SS_TEST:
                 return QLCNIC_TEST_LEN;
         case ETH_SS_STATS:
-                len = qlcnic_dev_statistics_len(adapter) + QLCNIC_STATS_LEN;
-                if ((adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
-                    qlcnic_83xx_check(adapter))
-                        return len;
-                return qlcnic_82xx_statistics();
+                return qlcnic_dev_statistics_len(adapter);
         default:
                 return -EOPNOTSUPP;
         }
@@ -948,6 +946,7 @@ static int qlcnic_irq_test(struct net_device *netdev)
         struct qlcnic_hardware_context *ahw = adapter->ahw;
         struct qlcnic_cmd_args cmd;
         int ret, drv_sds_rings = adapter->drv_sds_rings;
+        int drv_tx_rings = adapter->drv_tx_rings;
 
         if (qlcnic_83xx_check(adapter))
                 return qlcnic_83xx_interrupt_test(netdev);
@@ -980,6 +979,7 @@ free_diag_res:
 
 clear_diag_irq:
         adapter->drv_sds_rings = drv_sds_rings;
+        adapter->drv_tx_rings = drv_tx_rings;
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
 
         return ret;
@@ -1270,7 +1270,7 @@ static u64 *qlcnic_fill_stats(u64 *data, void *stats, int type)
         return data;
 }
 
-static void qlcnic_update_stats(struct qlcnic_adapter *adapter)
+void qlcnic_update_stats(struct qlcnic_adapter *adapter)
 {
         struct qlcnic_host_tx_ring *tx_ring;
         int ring;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index e9c21e5d0ca9..c4262c23ed7c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -134,6 +134,8 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter,
         struct qlcnic_skb_frag *buffrag;
         int i, j;
 
+        spin_lock(&tx_ring->tx_clean_lock);
+
         cmd_buf = tx_ring->cmd_buf_arr;
         for (i = 0; i < tx_ring->num_desc; i++) {
                 buffrag = cmd_buf->frag_array;
@@ -157,6 +159,8 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter,
                 }
                 cmd_buf++;
         }
+
+        spin_unlock(&tx_ring->tx_clean_lock);
 }
 
 void qlcnic_free_sw_resources(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 0149c9495347..ad1531ae3aa8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -687,17 +687,15 @@ void qlcnic_advert_link_change(struct qlcnic_adapter *adapter, int linkup)
         if (adapter->ahw->linkup && !linkup) {
                 netdev_info(netdev, "NIC Link is down\n");
                 adapter->ahw->linkup = 0;
-                if (netif_running(netdev)) {
-                        netif_carrier_off(netdev);
-                        netif_tx_stop_all_queues(netdev);
-                }
+                netif_carrier_off(netdev);
         } else if (!adapter->ahw->linkup && linkup) {
+                /* Do not advertise Link up if the port is in loopback mode */
+                if (qlcnic_83xx_check(adapter) && adapter->ahw->lb_mode)
+                        return;
+
                 netdev_info(netdev, "NIC Link is up\n");
                 adapter->ahw->linkup = 1;
-                if (netif_running(netdev)) {
-                        netif_carrier_on(netdev);
-                        netif_wake_queue(netdev);
-                }
+                netif_carrier_on(netdev);
         }
 }
 
@@ -784,7 +782,7 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
         struct net_device *netdev = adapter->netdev;
         struct qlcnic_skb_frag *frag;
 
-        if (!spin_trylock(&adapter->tx_clean_lock))
+        if (!spin_trylock(&tx_ring->tx_clean_lock))
                 return 1;
 
         sw_consumer = tx_ring->sw_consumer;
@@ -813,8 +811,9 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
                         break;
         }
 
+        tx_ring->sw_consumer = sw_consumer;
+
         if (count && netif_running(netdev)) {
-                tx_ring->sw_consumer = sw_consumer;
                 smp_mb();
                 if (netif_tx_queue_stopped(tx_ring->txq) &&
                     netif_carrier_ok(netdev)) {
@@ -840,7 +839,8 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
          */
         hw_consumer = le32_to_cpu(*(tx_ring->hw_consumer));
         done = (sw_consumer == hw_consumer);
-        spin_unlock(&adapter->tx_clean_lock);
+
+        spin_unlock(&tx_ring->tx_clean_lock);
 
         return done;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 05c1eef8df13..550791b8fbae 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1178,6 +1178,7 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
         } else {
                 adapter->ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                 adapter->max_tx_rings = QLCNIC_MAX_HW_TX_RINGS;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
                 adapter->flags &= ~QLCNIC_ESWITCH_ENABLED;
         }
 
@@ -1755,7 +1756,6 @@ void __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
         if (qlcnic_sriov_vf_check(adapter))
                 qlcnic_sriov_cleanup_async_list(&adapter->ahw->sriov->bc);
         smp_mb();
-        spin_lock(&adapter->tx_clean_lock);
         netif_carrier_off(netdev);
         adapter->ahw->linkup = 0;
         netif_tx_disable(netdev);
@@ -1776,7 +1776,6 @@ void __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
 
         for (ring = 0; ring < adapter->drv_tx_rings; ring++)
                 qlcnic_release_tx_buffers(adapter, &adapter->tx_ring[ring]);
-        spin_unlock(&adapter->tx_clean_lock);
 }
 
 /* Usage: During suspend and firmware recovery module */
@@ -1940,7 +1939,6 @@ int qlcnic_diag_alloc_res(struct net_device *netdev, int test)
         qlcnic_detach(adapter);
 
         adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
-        adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
         adapter->ahw->diag_test = test;
         adapter->ahw->linkup = 0;
 
@@ -2172,6 +2170,7 @@ int qlcnic_alloc_tx_rings(struct qlcnic_adapter *adapter,
                 }
                 memset(cmd_buf_arr, 0, TX_BUFF_RINGSIZE(tx_ring));
                 tx_ring->cmd_buf_arr = cmd_buf_arr;
+                spin_lock_init(&tx_ring->tx_clean_lock);
         }
 
         if (qlcnic_83xx_check(adapter) ||
@@ -2299,7 +2298,6 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         rwlock_init(&adapter->ahw->crb_lock);
         mutex_init(&adapter->ahw->mem_lock);
 
-        spin_lock_init(&adapter->tx_clean_lock);
         INIT_LIST_HEAD(&adapter->mac_list);
 
         qlcnic_register_dcb(adapter);
@@ -2782,6 +2780,9 @@ static struct net_device_stats *qlcnic_get_stats(struct net_device *netdev)
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct net_device_stats *stats = &netdev->stats;
 
+        if (test_bit(__QLCNIC_DEV_UP, &adapter->state))
+                qlcnic_update_stats(adapter);
+
         stats->rx_packets = adapter->stats.rx_pkts + adapter->stats.lro_pkts;
         stats->tx_packets = adapter->stats.xmitfinished;
         stats->rx_bytes = adapter->stats.rxbytes + adapter->stats.lrobytes;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 686f460b1502..024f8161d2fe 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -75,7 +75,6 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
         num_vfs = sriov->num_vfs;
         max = num_vfs + 1;
         info->bit_offsets = 0xffff;
-        info->max_tx_ques = res->num_tx_queues / max;
         info->max_rx_mcast_mac_filters = res->num_rx_mcast_mac_filters;
         num_vf_macs = QLCNIC_SRIOV_VF_MAX_MAC;
 
@@ -86,6 +85,7 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
                 info->max_tx_mac_filters = temp;
                 info->min_tx_bw = 0;
                 info->max_tx_bw = MAX_BW;
+                info->max_tx_ques = res->num_tx_queues - sriov->num_vfs;
         } else {
                 id = qlcnic_sriov_func_to_index(adapter, func);
                 if (id < 0)
@@ -95,6 +95,7 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
                 info->max_tx_bw = vp->max_tx_bw;
                 info->max_rx_ucast_mac_filters = num_vf_macs;
                 info->max_tx_mac_filters = num_vf_macs;
+                info->max_tx_ques = QLCNIC_SINGLE_RING;
         }
 
         info->max_rx_ip_addr = res->num_destip / max;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8a7a23a84ac5..797b56a0efc4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -622,17 +622,15 @@ static int stmmac_init_ptp(struct stmmac_priv *priv)
         if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
                 return -EOPNOTSUPP;
 
-        if (netif_msg_hw(priv)) {
-                if (priv->dma_cap.time_stamp) {
-                        pr_debug("IEEE 1588-2002 Time Stamp supported\n");
-                        priv->adv_ts = 0;
-                }
-                if (priv->dma_cap.atime_stamp && priv->extend_desc) {
-                        pr_debug
-                            ("IEEE 1588-2008 Advanced Time Stamp supported\n");
-                        priv->adv_ts = 1;
-                }
-        }
+        priv->adv_ts = 0;
+        if (priv->dma_cap.atime_stamp && priv->extend_desc)
+                priv->adv_ts = 1;
+
+        if (netif_msg_hw(priv) && priv->dma_cap.time_stamp)
+                pr_debug("IEEE 1588-2002 Time Stamp supported\n");
+
+        if (netif_msg_hw(priv) && priv->adv_ts)
+                pr_debug("IEEE 1588-2008 Advanced Time Stamp supported\n");
 
         priv->hw->ptp = &stmmac_ptp;
         priv->hwts_tx_en = 0;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index b8b0eeed0f92..7680581ebe12 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -56,7 +56,7 @@ static int stmmac_adjust_freq(struct ptp_clock_info *ptp, s32 ppb)
 
         priv->hw->ptp->config_addend(priv->ioaddr, addend);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->ptp_lock, flags);
 
         return 0;
 }
@@ -91,7 +91,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
 
         priv->hw->ptp->adjust_systime(priv->ioaddr, sec, nsec, neg_adj);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->ptp_lock, flags);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 5120d9ce1dd4..5330fd298705 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -740,6 +740,8 @@ static void _cpsw_adjust_link(struct cpsw_slave *slave,
                 /* set speed_in input in case RMII mode is used in 100Mbps */
                 if (phy->speed == 100)
                         mac_control |= BIT(15);
+                else if (phy->speed == 10)
+                        mac_control |= BIT(18); /* In Band mode */
 
                 *link = true;
         } else {
@@ -2106,7 +2108,7 @@ static int cpsw_probe(struct platform_device *pdev)
         while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                 for (i = res->start; i <= res->end; i++) {
                         if (devm_request_irq(&pdev->dev, i, cpsw_interrupt, 0,
-                                             dev_name(priv->dev), priv)) {
+                                             dev_name(&pdev->dev), priv)) {
                                 dev_err(priv->dev, "error attaching irq\n");
                                 goto clean_ale_ret;
                         }
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 628b736e5ae7..0e9fb3301b11 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2080,7 +2080,8 @@ static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
 }
 
 /* Return subqueue id on this core (one per core). */
-static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb,
+                                 void *accel_priv)
 {
         return smp_processor_id();
 }
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 3169252613fa..5d78c1d08abd 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case HDLCDRVCTL_CALIBRATE:
                 if(!capable(CAP_SYS_RAWIO))
                         return -EPERM;
+                if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+                        return -EINVAL;
                 s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
                 return 0;
 
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 1971411574db..61dd2447e1bb 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 break;
 
         case SIOCYAMGCFG:
+                memset(&yi, 0, sizeof(yi));
                 yi.cfg.mask = 0xffffffff;
                 yi.cfg.iobase = yp->iobase;
                 yi.cfg.irq = yp->irq;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 524f713f6017..71baeb3ed905 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -261,9 +261,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
         struct sk_buff *skb;
 
         net = ((struct netvsc_device *)hv_get_drvdata(device_obj))->ndev;
-        if (!net) {
-                netdev_err(net, "got receive callback but net device"
-                        " not initialized yet\n");
+        if (!net || net->reg_state != NETREG_REGISTERED) {
                 packet->status = NVSP_STAT_FAIL;
                 return 0;
         }
@@ -327,7 +325,6 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
                 return -EINVAL;
 
         nvdev->start_remove = true;
-        cancel_delayed_work_sync(&ndevctx->dwork);
         cancel_work_sync(&ndevctx->work);
         netif_tx_disable(ndev);
         rndis_filter_device_remove(hdev);
@@ -436,19 +433,11 @@ static int netvsc_probe(struct hv_device *dev,
         SET_ETHTOOL_OPS(net, &ethtool_ops);
         SET_NETDEV_DEV(net, &dev->device);
 
-        ret = register_netdev(net);
-        if (ret != 0) {
-                pr_err("Unable to register netdev.\n");
-                free_netdev(net);
-                goto out;
-        }
-
         /* Notify the netvsc driver of the new device */
         device_info.ring_size = ring_size;
         ret = rndis_filter_device_add(dev, &device_info);
         if (ret != 0) {
                 netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
-                unregister_netdev(net);
                 free_netdev(net);
                 hv_set_drvdata(dev, NULL);
                 return ret;
@@ -457,7 +446,13 @@ static int netvsc_probe(struct hv_device *dev,
 
         netif_carrier_on(net);
 
-out:
+        ret = register_netdev(net);
+        if (ret != 0) {
+                pr_err("Unable to register netdev.\n");
+                rndis_filter_device_remove(dev);
+                free_netdev(net);
+        }
+
         return ret;
 }
 
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index acf93798dc67..bc8faaec33f5 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -299,7 +299,7 @@ netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
 
         if (vlan->fwd_priv) {
                 skb->dev = vlan->lowerdev;
-                ret = dev_hard_start_xmit(skb, skb->dev, NULL, vlan->fwd_priv);
+                ret = dev_queue_xmit_accel(skb, vlan->fwd_priv);
         } else {
                 ret = macvlan_queue_xmit(skb, dev);
         }
@@ -338,6 +338,8 @@ static const struct header_ops macvlan_hard_header_ops = {
         .cache_update   = eth_header_cache_update,
 };
 
+static struct rtnl_link_ops macvlan_link_ops;
+
 static int macvlan_open(struct net_device *dev)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
@@ -353,7 +355,8 @@ static int macvlan_open(struct net_device *dev)
                 goto hash_add;
         }
 
-        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD) {
+        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD &&
+            dev->rtnl_link_ops == &macvlan_link_ops) {
                 vlan->fwd_priv =
                       lowerdev->netdev_ops->ndo_dfwd_add_station(lowerdev, dev);
 
@@ -362,10 +365,8 @@ static int macvlan_open(struct net_device *dev)
                  */
                 if (IS_ERR_OR_NULL(vlan->fwd_priv)) {
                         vlan->fwd_priv = NULL;
-                } else {
-                        dev->features &= ~NETIF_F_LLTX;
+                } else
                         return 0;
-                }
         }
 
         err = -EBUSY;
@@ -690,8 +691,18 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
                                               netdev_features_t features)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
+        netdev_features_t mask;
+
+        features |= NETIF_F_ALL_FOR_ALL;
+        features &= (vlan->set_features | ~MACVLAN_FEATURES);
+        mask = features;
+
+        features = netdev_increment_features(vlan->lowerdev->features,
+                                             features,
+                                             mask);
+        features |= NETIF_F_LLTX;
 
-        return features & (vlan->set_features | ~MACVLAN_FEATURES);
+        return features;
 }
 
 static const struct ethtool_ops macvlan_ethtool_ops = {
@@ -1019,9 +1030,8 @@ static int macvlan_device_event(struct notifier_block *unused,
                 break;
         case NETDEV_FEAT_CHANGE:
                 list_for_each_entry(vlan, &port->vlans, list) {
-                        vlan->dev->features = dev->features & MACVLAN_FEATURES;
                         vlan->dev->gso_max_size = dev->gso_max_size;
-                        netdev_features_change(vlan->dev);
+                        netdev_update_features(vlan->dev);
                 }
                 break;
         case NETDEV_UNREGISTER:
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 36c6994436b7..98434b84f041 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -565,10 +565,8 @@ int phy_start_interrupts(struct phy_device *phydev)
         int err = 0;
 
         atomic_set(&phydev->irq_disable, 0);
-        if (request_irq(phydev->irq, phy_interrupt,
-                                IRQF_SHARED,
-                                "phy_interrupt",
-                                phydev) < 0) {
+        if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
+                        phydev) < 0) {
                 pr_warn("%s: Can't get IRQ %d (PHY)\n",
                         phydev->bus->name, phydev->irq);
                 phydev->irq = PHY_POLL;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 736050d6b451..b75ae5bde673 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1647,7 +1647,8 @@ static netdev_tx_t team_xmit(struct sk_buff *skb, struct net_device *dev)
         return NETDEV_TX_OK;
 }
 
-static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb,
+                             void *accel_priv)
 {
         /*
          * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7c8343a4f918..ecec8029c5e8 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -348,7 +348,8 @@ unlock:
  * different rxq no. here. If we could not get rxhash, then we would
  * hope the rxq no. may help here.
  */
-static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
         struct tun_struct *tun = netdev_priv(dev);
         struct tun_flow_entry *e;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 85e4a01670f0..47b0f732b0b1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -276,12 +276,12 @@ config USB_NET_CDC_MBIM
           module will be called cdc_mbim.
 
 config USB_NET_DM9601
-        tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
+        tristate "Davicom DM96xx based USB 10/100 ethernet devices"
         depends on USB_USBNET
         select CRC32
         help
-          This option adds support for Davicom DM9601 based USB 1.1
-          10/100 Ethernet adapters.
+          This option adds support for Davicom DM9601/DM9620/DM9621A
+          based USB 10/100 Ethernet adapters.
 
 config USB_NET_SR9700
         tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index c6867f926cff..14aa48fa8d7e 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -1,5 +1,5 @@
 /*
- * Davicom DM9601 USB 1.1 10/100Mbps ethernet devices
+ * Davicom DM96xx USB 10/100Mbps ethernet devices
  *
  * Peter Korsgaard <jacmet@sunsite.dk>
  *
@@ -364,7 +364,12 @@ static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->net->ethtool_ops = &dm9601_ethtool_ops;
         dev->net->hard_header_len += DM_TX_OVERHEAD;
         dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
-        dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD;
+
+        /* dm9620/21a require room for 4 byte padding, even in dm9601
+         * mode, so we need +1 to be able to receive full size
+         * ethernet frames.
+         */
+        dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD + 1;
 
         dev->mii.dev = dev->net;
         dev->mii.mdio_read = dm9601_mdio_read;
@@ -468,7 +473,7 @@ static int dm9601_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                                        gfp_t flags)
 {
-        int len;
+        int len, pad;
 
         /* format:
            b1: packet length low
@@ -476,12 +481,23 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
            b3..n: packet data
         */
 
-        len = skb->len;
+        len = skb->len + DM_TX_OVERHEAD;
+
+        /* workaround for dm962x errata with tx fifo getting out of
+         * sync if a USB bulk transfer retry happens right after a
+         * packet with odd / maxpacket length by adding up to 3 bytes
+         * padding.
+         */
+        while ((len & 1) || !(len % dev->maxpacket))
+                len++;
 
-        if (skb_headroom(skb) < DM_TX_OVERHEAD) {
+        len -= DM_TX_OVERHEAD; /* hw header doesn't count as part of length */
+        pad = len - skb->len;
+
+        if (skb_headroom(skb) < DM_TX_OVERHEAD || skb_tailroom(skb) < pad) {
                 struct sk_buff *skb2;
 
-                skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, 0, flags);
+                skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, pad, flags);
                 dev_kfree_skb_any(skb);
                 skb = skb2;
                 if (!skb)
@@ -490,10 +506,10 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 
         __skb_push(skb, DM_TX_OVERHEAD);
 
-        /* usbnet adds padding if length is a multiple of packet size
-           if so, adjust length value in header */
-        if ((skb->len % dev->maxpacket) == 0)
-                len++;
+        if (pad) {
+                memset(skb->data + skb->len, 0, pad);
+                __skb_put(skb, pad);
+        }
 
         skb->data[0] = len;
         skb->data[1] = len >> 8;
@@ -543,7 +559,7 @@ static int dm9601_link_reset(struct usbnet *dev)
 }
 
 static const struct driver_info dm9601_info = {
-        .description    = "Davicom DM9601 USB Ethernet",
+        .description    = "Davicom DM96xx USB 10/100 Ethernet",
         .flags          = FLAG_ETHER | FLAG_LINK_INTR,
         .bind           = dm9601_bind,
         .rx_fixup       = dm9601_rx_fixup,
@@ -594,6 +610,10 @@ static const struct usb_device_id products[] = {
          USB_DEVICE(0x0a46, 0x9620),    /* DM9620 USB to Fast Ethernet Adapter */
          .driver_info = (unsigned long)&dm9601_info,
          },
+        {
+         USB_DEVICE(0x0a46, 0x9621),    /* DM9621A USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
         {},                     // END
 };
 
@@ -612,5 +632,5 @@ static struct usb_driver dm9601_driver = {
 module_usb_driver(dm9601_driver);
 
 MODULE_AUTHOR("Peter Korsgaard <jacmet@sunsite.dk>");
-MODULE_DESCRIPTION("Davicom DM9601 USB 1.1 ethernet devices");
+MODULE_DESCRIPTION("Davicom DM96xx USB 10/100 ethernet devices");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 86292e6aaf49..1a482344b3f5 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -185,7 +185,6 @@ enum rx_ctrl_state{
 #define BM_REQUEST_TYPE (0xa1)
 #define B_NOTIFICATION  (0x20)
 #define W_VALUE         (0x0)
-#define W_INDEX         (0x2)
 #define W_LENGTH        (0x2)
 
 #define B_OVERRUN       (0x1<<6)
@@ -1487,6 +1486,7 @@ static void tiocmget_intr_callback(struct urb *urb)
         struct uart_icount *icount;
         struct hso_serial_state_notification *serial_state_notification;
         struct usb_device *usb;
+        int if_num;
 
         /* Sanity checks */
         if (!serial)
@@ -1495,15 +1495,24 @@ static void tiocmget_intr_callback(struct urb *urb)
                 handle_usb_error(status, __func__, serial->parent);
                 return;
         }
+
+        /* tiocmget is only supported on HSO_PORT_MODEM */
         tiocmget = serial->tiocmget;
         if (!tiocmget)
                 return;
+        BUG_ON((serial->parent->port_spec & HSO_PORT_MASK) != HSO_PORT_MODEM);
+
         usb = serial->parent->usb;
+        if_num = serial->parent->interface->altsetting->desc.bInterfaceNumber;
+
+        /* wIndex should be the USB interface number of the port to which the
+         * notification applies, which should always be the Modem port.
+         */
         serial_state_notification = &tiocmget->serial_state_notification;
         if (serial_state_notification->bmRequestType != BM_REQUEST_TYPE ||
             serial_state_notification->bNotification != B_NOTIFICATION ||
             le16_to_cpu(serial_state_notification->wValue) != W_VALUE ||
-            le16_to_cpu(serial_state_notification->wIndex) != W_INDEX ||
+            le16_to_cpu(serial_state_notification->wIndex) != if_num ||
             le16_to_cpu(serial_state_notification->wLength) != W_LENGTH) {
                 dev_warn(&usb->dev,
                          "hso received invalid serial state notification\n");
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index 03832d3780aa..f54637828574 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -117,7 +117,6 @@ enum {
 struct mcs7830_data {
         u8 multi_filter[8];
         u8 config;
-        u8 link_counter;
 };
 
 static const char driver_name[] = "MOSCHIP usb-ethernet driver";
@@ -561,26 +560,16 @@ static void mcs7830_status(struct usbnet *dev, struct urb *urb)
 {
         u8 *buf = urb->transfer_buffer;
         bool link, link_changed;
-        struct mcs7830_data *data = mcs7830_get_data(dev);
 
         if (urb->actual_length < 16)
                 return;
 
-        link = !(buf[1] & 0x20);
+        link = !(buf[1] == 0x20);
         link_changed = netif_carrier_ok(dev->net) != link;
         if (link_changed) {
-                data->link_counter++;
-                /*
-                   track link state 20 times to guard against erroneous
-                   link state changes reported sometimes by the chip
-                 */
-                if (data->link_counter > 20) {
-                        data->link_counter = 0;
-                        usbnet_link_change(dev, link, 0);
-                        netdev_dbg(dev->net, "Link Status is: %d\n", link);
-                }
-        } else
-                data->link_counter = 0;
+                usbnet_link_change(dev, link, 0);
+                netdev_dbg(dev->net, "Link Status is: %d\n", link);
+        }
 }
 
 static const struct driver_info moschip_info = {
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d208f8604981..5d776447d9c3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1797,16 +1797,17 @@ static int virtnet_restore(struct virtio_device *vdev)
         if (err)
                 return err;
 
-        if (netif_running(vi->dev))
+        if (netif_running(vi->dev)) {
+                for (i = 0; i < vi->curr_queue_pairs; i++)
+                        if (!try_fill_recv(&vi->rq[i], GFP_KERNEL))
+                                schedule_delayed_work(&vi->refill, 0);
+
                 for (i = 0; i < vi->max_queue_pairs; i++)
                         virtnet_napi_enable(&vi->rq[i]);
+        }
 
         netif_device_attach(vi->dev);
 
-        for (i = 0; i < vi->curr_queue_pairs; i++)
-                if (!try_fill_recv(&vi->rq[i], GFP_KERNEL))
-                        schedule_delayed_work(&vi->refill, 0);
-
         mutex_lock(&vi->config_lock);
         vi->config_enable = true;
         mutex_unlock(&vi->config_lock);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 249e01c5600c..ed384fee76ac 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2440,7 +2440,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
                 /* update header length based on lower device */
                 dev->hard_header_len = lowerdev->hard_header_len +
                                        (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
-        }
+        } else if (use_ipv6)
+                vxlan->flags |= VXLAN_F_IPV6;
 
         if (data[IFLA_VXLAN_TOS])
                 vxlan->tos  = nla_get_u8(data[IFLA_VXLAN_TOS]);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index 8d78253c26ce..a366d6b4626f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                                 mask2 |= ATH9K_INT_CST;
                         if (isr2 & AR_ISR_S2_TSFOOR)
                                 mask2 |= ATH9K_INT_TSFOOR;
+
+                        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                                REG_WRITE(ah, AR_ISR_S2, isr2);
+                                isr &= ~AR_ISR_BCNMISC;
+                        }
                 }
 
-                isr = REG_READ(ah, AR_ISR_RAC);
+                if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)
+                        isr = REG_READ(ah, AR_ISR_RAC);
+
                 if (isr == 0xffffffff) {
                         *masked = 0;
                         return false;
@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
 
                         *masked |= ATH9K_INT_TX;
 
-                        s0_s = REG_READ(ah, AR_ISR_S0_S);
+                        if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
+                                s0_s = REG_READ(ah, AR_ISR_S0_S);
+                                s1_s = REG_READ(ah, AR_ISR_S1_S);
+                        } else {
+                                s0_s = REG_READ(ah, AR_ISR_S0);
+                                REG_WRITE(ah, AR_ISR_S0, s0_s);
+                                s1_s = REG_READ(ah, AR_ISR_S1);
+                                REG_WRITE(ah, AR_ISR_S1, s1_s);
+
+                                isr &= ~(AR_ISR_TXOK |
+                                         AR_ISR_TXDESC |
+                                         AR_ISR_TXERR |
+                                         AR_ISR_TXEOL);
+                        }
+
                         ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK);
                         ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC);
-
-                        s1_s = REG_READ(ah, AR_ISR_S1_S);
                         ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR);
                         ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL);
                 }
@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                 *masked |= mask2;
         }
 
-        if (AR_SREV_9100(ah))
-                return true;
-
-        if (isr & AR_ISR_GENTMR) {
+        if (!AR_SREV_9100(ah) && (isr & AR_ISR_GENTMR)) {
                 u32 s5_s;
 
-                s5_s = REG_READ(ah, AR_ISR_S5_S);
+                if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
+                        s5_s = REG_READ(ah, AR_ISR_S5_S);
+                } else {
+                        s5_s = REG_READ(ah, AR_ISR_S5);
+                }
+
                 ah->intr_gen_timer_trigger =
                                 MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
 
@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                 if ((s5_s & AR_ISR_S5_TIM_TIMER) &&
                     !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
                         *masked |= ATH9K_INT_TIM_TIMER;
+
+                if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                        REG_WRITE(ah, AR_ISR_S5, s5_s);
+                        isr &= ~AR_ISR_GENTMR;
+                }
         }
 
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                REG_WRITE(ah, AR_ISR, isr);
+                REG_READ(ah, AR_ISR);
+        }
+
+        if (AR_SREV_9100(ah))
+                return true;
+
         if (sync_cause) {
                 ath9k_debug_sync_cause(common, sync_cause);
                 fatal_int =
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 9a2657fdd9cc..608d739d1378 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -127,21 +127,26 @@ static void ath9k_htc_bssid_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         struct ath9k_vif_iter_data *iter_data = data;
         int i;
 
-        for (i = 0; i < ETH_ALEN; i++)
-                iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+        if (iter_data->hw_macaddr != NULL) {
+                for (i = 0; i < ETH_ALEN; i++)
+                        iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+        } else {
+                iter_data->hw_macaddr = mac;
+        }
 }
 
-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
+static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv,
                                      struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
         struct ath9k_vif_iter_data iter_data;
 
         /*
-         * Use the hardware MAC address as reference, the hardware uses it
-         * together with the BSSID mask when matching addresses.
+         * Pick the MAC address of the first interface as the new hardware
+         * MAC address. The hardware will use it together with the BSSID mask
+         * when matching addresses.
          */
-        iter_data.hw_macaddr = common->macaddr;
+        iter_data.hw_macaddr = NULL;
         memset(&iter_data.mask, 0xff, ETH_ALEN);
 
         if (vif)
@@ -153,6 +158,10 @@ static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
                 ath9k_htc_bssid_iter, &iter_data);
 
         memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
+
+        if (iter_data.hw_macaddr)
+                memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
+
         ath_hw_setbssidmask(common);
 }
 
@@ -1063,7 +1072,7 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
                 goto out;
         }
 
-        ath9k_htc_set_bssid_mask(priv, vif);
+        ath9k_htc_set_mac_bssid_mask(priv, vif);
 
         priv->vif_slot |= (1 << avp->index);
         priv->nvifs++;
@@ -1128,7 +1137,7 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
 
         ath9k_htc_set_opmode(priv);
 
-        ath9k_htc_set_bssid_mask(priv, vif);
+        ath9k_htc_set_mac_bssid_mask(priv, vif);
 
         /*
          * Stop ANI only if there are no associated station interfaces.
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 74f452c7b166..21aa09e0e825 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -965,8 +965,9 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
         struct ath_common *common = ath9k_hw_common(ah);
 
         /*
-         * Use the hardware MAC address as reference, the hardware uses it
-         * together with the BSSID mask when matching addresses.
+         * Pick the MAC address of the first interface as the new hardware
+         * MAC address. The hardware will use it together with the BSSID mask
+         * when matching addresses.
          */
         memset(iter_data, 0, sizeof(*iter_data));
         memset(&iter_data->mask, 0xff, ETH_ALEN);
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 86605027c41d..e6272546395a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -357,21 +357,27 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x5012, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x500A, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5420, iwl7265_2n_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5090, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5190, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index c72438bb2faf..a1b32ee9594a 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2011,7 +2011,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
            (hwsim_flags & HWSIM_TX_STAT_ACK)) {
                 if (skb->len >= 16) {
                         hdr = (struct ieee80211_hdr *) skb->data;
-                        mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
+                        mac80211_hwsim_monitor_ack(data2->channel,
                                                    hdr->addr2);
                 }
                 txi->flags |= IEEE80211_TX_STAT_ACK;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 78e8a6666cc6..8bb8988c435c 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -746,7 +746,8 @@ static struct net_device_stats *mwifiex_get_stats(struct net_device *dev)
 }
 
 static u16
-mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb)
+mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb,
+                                void *accel_priv)
 {
         skb->priority = cfg80211_classify8021d(skb);
         return mwifiex_1d_to_wmm_queue[skb->priority];
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 0f494444bcd1..5a53195d016b 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -740,6 +740,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
         };
         int index = rtlpci->rx_ring[rx_queue_idx].idx;
 
+        if (rtlpci->driver_is_goingto_unload)
+                return;
         /*RX NORMAL PKT */
         while (count--) {
                 /*rx descriptor */
@@ -1636,6 +1638,7 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
          */
         set_hal_stop(rtlhal);
 
+        rtlpci->driver_is_goingto_unload = true;
         rtlpriv->cfg->ops->disable_interrupt(hw);
         cancel_work_sync(&rtlpriv->works.lps_change_work);
 
@@ -1653,7 +1656,6 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
         ppsc->rfchange_inprogress = true;
         spin_unlock_irqrestore(&rtlpriv->locks.rf_ps_lock, flags);
 
-        rtlpci->driver_is_goingto_unload = true;
         rtlpriv->cfg->ops->hw_disable(hw);
         /* some things are not needed if firmware not available */
         if (!rtlpriv->max_fw_size)
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 08ae01b41c83..c47794b9d42f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -101,6 +101,13 @@ struct xenvif_rx_meta {
 
 #define MAX_PENDING_REQS 256
 
+/* It's possible for an skb to have a maximal number of frags
+ * but still be less than MAX_BUFFER_OFFSET in size. Thus the
+ * worst-case number of copy operations is MAX_SKB_FRAGS per
+ * ring slot.
+ */
+#define MAX_GRANT_COPY_OPS (MAX_SKB_FRAGS * XEN_NETIF_RX_RING_SIZE)
+
 struct xenvif {
         /* Unique identifier for this interface. */
         domid_t          domid;
@@ -143,13 +150,13 @@ struct xenvif {
          */
         RING_IDX rx_req_cons_peek;
 
-        /* Given MAX_BUFFER_OFFSET of 4096 the worst case is that each
-         * head/fragment page uses 2 copy operations because it
-         * straddles two buffers in the frontend.
-         */
-        struct gnttab_copy grant_copy_op[2*XEN_NETIF_RX_RING_SIZE];
-        struct xenvif_rx_meta meta[2*XEN_NETIF_RX_RING_SIZE];
+        /* This array is allocated seperately as it is large */
+        struct gnttab_copy *grant_copy_op;
 
+        /* We create one meta structure per ring request we consume, so
+         * the maximum number is the same as the ring size.
+         */
+        struct xenvif_rx_meta meta[XEN_NETIF_RX_RING_SIZE];
 
         u8               fe_dev_addr[6];
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 870f1fa58370..fff8cddfed81 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -34,6 +34,7 @@
 #include <linux/ethtool.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_vlan.h>
+#include <linux/vmalloc.h>
 
 #include <xen/events.h>
 #include <asm/xen/hypercall.h>
@@ -307,6 +308,15 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         SET_NETDEV_DEV(dev, parent);
 
         vif = netdev_priv(dev);
+
+        vif->grant_copy_op = vmalloc(sizeof(struct gnttab_copy) *
+                                     MAX_GRANT_COPY_OPS);
+        if (vif->grant_copy_op == NULL) {
+                pr_warn("Could not allocate grant copy space for %s\n", name);
+                free_netdev(dev);
+                return ERR_PTR(-ENOMEM);
+        }
+
         vif->domid  = domid;
         vif->handle = handle;
         vif->can_sg = 1;
@@ -487,6 +497,7 @@ void xenvif_free(struct xenvif *vif)
 
         unregister_netdev(vif->dev);
 
+        vfree(vif->grant_copy_op);
         free_netdev(vif->dev);
 
         module_put(THIS_MODULE);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e884ee1fe7ed..78425554a537 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -608,7 +608,7 @@ void xenvif_rx_action(struct xenvif *vif)
         if (!npo.copy_prod)
                 return;
 
-        BUG_ON(npo.copy_prod > ARRAY_SIZE(vif->grant_copy_op));
+        BUG_ON(npo.copy_prod > MAX_GRANT_COPY_OPS);
         gnttab_batch_copy(vif->grant_copy_op, npo.copy_prod);
 
         while ((skb = __skb_dequeue(&rxq)) != NULL) {
@@ -1197,6 +1197,9 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
 
         err = -EPROTO;
 
+        if (fragment)
+                goto out;
+
         switch (ip_hdr(skb)->protocol) {
         case IPPROTO_TCP:
                 err = maybe_pull_tail(skb,
@@ -1206,8 +1209,10 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                         goto out;
 
                 if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
                         goto out;
+                }
 
                 if (recalculate_partial_csum)
                         tcp_hdr(skb)->check =
@@ -1224,8 +1229,10 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                         goto out;
 
                 if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check)))
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
                         goto out;
+                }
 
                 if (recalculate_partial_csum)
                         udp_hdr(skb)->check =
@@ -1347,8 +1354,10 @@ static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                         goto out;
 
                 if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
                         goto out;
+                }
 
                 if (recalculate_partial_csum)
                         tcp_hdr(skb)->check =
@@ -1365,8 +1374,10 @@ static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                         goto out;
 
                 if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check)))
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
                         goto out;
+                }
 
                 if (recalculate_partial_csum)
                         udp_hdr(skb)->check =
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index de6f8990246f..c6973f101a3e 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -20,7 +20,7 @@ config OF_SELFTEST
         depends on OF_IRQ
         help
           This option builds in test cases for the device tree infrastructure
-          that are executed one at boot time, and the results dumped to the
+          that are executed once at boot time, and the results dumped to the
           console.
 
           If unsure, say N here, but this option is safe to enable.
diff --git a/drivers/of/address.c b/drivers/of/address.c
index 4b9317bdb81c..d3dd41c840f1 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -69,14 +69,6 @@ static u64 of_bus_default_map(__be32 *addr, const __be32 *range,
                  (unsigned long long)cp, (unsigned long long)s,
                  (unsigned long long)da);
 
-        /*
-         * If the number of address cells is larger than 2 we assume the
-         * mapping doesn't specify a physical address. Rather, the address
-         * specifies an identifier that must match exactly.
-         */
-        if (na > 2 && memcmp(range, addr, na * 4) != 0)
-                return OF_BAD_ADDR;
-
         if (da < cp || da >= (cp + s))
                 return OF_BAD_ADDR;
         return da - cp;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 2fa024b97c43..758b4f8b30b7 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -922,8 +922,16 @@ void __init unflatten_device_tree(void)
  */
 void __init unflatten_and_copy_device_tree(void)
 {
-        int size = __be32_to_cpu(initial_boot_params->totalsize);
-        void *dt = early_init_dt_alloc_memory_arch(size,
+        int size;
+        void *dt;
+
+        if (!initial_boot_params) {
+                pr_warn("No valid device tree found, continuing without\n");
+                return;
+        }
+
+        size = __be32_to_cpu(initial_boot_params->totalsize);
+        dt = early_init_dt_alloc_memory_arch(size,
                 __alignof__(struct boot_param_header));
 
         if (dt) {
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 786b0b47fae4..27212402c532 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -165,7 +165,6 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
                 if (of_get_property(ipar, "interrupt-controller", NULL) !=
                                 NULL) {
                         pr_debug(" -> got it !\n");
-                        of_node_put(old);
                         return 0;
                 }
 
@@ -250,8 +249,7 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
                  * Successfully parsed an interrrupt-map translation; copy new
                  * interrupt specifier into the out_irq structure
                  */
-                of_node_put(out_irq->np);
-                out_irq->np = of_node_get(newpar);
+                out_irq->np = newpar;
 
                 match_array = imap - newaddrsize - newintsize;
                 for (i = 0; i < newintsize; i++)
@@ -268,7 +266,6 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
         }
  fail:
         of_node_put(ipar);
-        of_node_put(out_irq->np);
         of_node_put(newpar);
 
         return -EINVAL;
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 1cf605f67673..e86439283a5d 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -279,7 +279,9 @@ static acpi_status register_slot(acpi_handle handle, u32 lvl, void *data,
 
         status = acpi_evaluate_integer(handle, "_ADR", NULL, &adr);
         if (ACPI_FAILURE(status)) {
-                acpi_handle_warn(handle, "can't evaluate _ADR (%#x)\n", status);
+                if (status != AE_NOT_FOUND)
+                        acpi_handle_warn(handle,
+                                "can't evaluate _ADR (%#x)\n", status);
                 return AE_OK;
         }
 
@@ -643,6 +645,24 @@ static void disable_slot(struct acpiphp_slot *slot)
         slot->flags &= (~SLOT_ENABLED);
 }
 
+static bool acpiphp_no_hotplug(acpi_handle handle)
+{
+        struct acpi_device *adev = NULL;
+
+        acpi_bus_get_device(handle, &adev);
+        return adev && adev->flags.no_hotplug;
+}
+
+static bool slot_no_hotplug(struct acpiphp_slot *slot)
+{
+        struct acpiphp_func *func;
+
+        list_for_each_entry(func, &slot->funcs, sibling)
+                if (acpiphp_no_hotplug(func_to_handle(func)))
+                        return true;
+
+        return false;
+}
 
 /**
  * get_slot_status - get ACPI slot status
@@ -701,7 +721,8 @@ static void trim_stale_devices(struct pci_dev *dev)
                 unsigned long long sta;
 
                 status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
-                alive = ACPI_SUCCESS(status) && sta == ACPI_STA_ALL;
+                alive = (ACPI_SUCCESS(status) && sta == ACPI_STA_ALL)
+                        || acpiphp_no_hotplug(handle);
         }
         if (!alive) {
                 u32 v;
@@ -741,8 +762,9 @@ static void acpiphp_check_bridge(struct acpiphp_bridge *bridge)
                 struct pci_dev *dev, *tmp;
 
                 mutex_lock(&slot->crit_sect);
-                /* wake up all functions */
-                if (get_slot_status(slot) == ACPI_STA_ALL) {
+                if (slot_no_hotplug(slot)) {
+                        ; /* do nothing */
+                } else if (get_slot_status(slot) == ACPI_STA_ALL) {
                         /* remove stale devices if any */
                         list_for_each_entry_safe(dev, tmp, &bus->devices,
                                                  bus_list)
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 577074efbe62..f7ebdba14bde 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -330,29 +330,32 @@ static int acpi_pci_find_device(struct device *dev, acpi_handle *handle)
 static void pci_acpi_setup(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        acpi_handle handle = ACPI_HANDLE(dev);
-        struct acpi_device *adev;
+        struct acpi_device *adev = ACPI_COMPANION(dev);
 
-        if (acpi_bus_get_device(handle, &adev) || !adev->wakeup.flags.valid)
+        if (!adev)
+                return;
+
+        pci_acpi_add_pm_notifier(adev, pci_dev);
+        if (!adev->wakeup.flags.valid)
                 return;
 
         device_set_wakeup_capable(dev, true);
         acpi_pci_sleep_wake(pci_dev, false);
-
-        pci_acpi_add_pm_notifier(adev, pci_dev);
         if (adev->wakeup.flags.run_wake)
                 device_set_run_wake(dev, true);
 }
 
 static void pci_acpi_cleanup(struct device *dev)
 {
-        acpi_handle handle = ACPI_HANDLE(dev);
-        struct acpi_device *adev;
+        struct acpi_device *adev = ACPI_COMPANION(dev);
+
+        if (!adev)
+                return;
 
-        if (!acpi_bus_get_device(handle, &adev) && adev->wakeup.flags.valid) {
+        pci_acpi_remove_pm_notifier(adev);
+        if (adev->wakeup.flags.valid) {
                 device_set_wakeup_capable(dev, false);
                 device_set_run_wake(dev, false);
-                pci_acpi_remove_pm_notifier(adev);
         }
 }
 
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index a344f3d52361..330ef2d06567 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -24,8 +24,8 @@ config PHY_EXYNOS_MIPI_VIDEO
 config OMAP_USB2
         tristate "OMAP USB2 PHY Driver"
         depends on ARCH_OMAP2PLUS
+        depends on USB_PHY
         select GENERIC_PHY
-        select USB_PHY
         select OMAP_CONTROL_USB
         help
           Enable this to support the transceiver that is part of SOC. This
@@ -36,8 +36,8 @@ config OMAP_USB2
 config TWL4030_USB
         tristate "TWL4030 USB Transceiver Driver"
         depends on TWL4030_CORE && REGULATOR_TWL4030 && USB_MUSB_OMAP2PLUS
+        depends on USB_PHY
         select GENERIC_PHY
-        select USB_PHY
         help
           Enable this to support the USB OTG transceiver on TWL4030
           family chips (including the TWL5030 and TPS659x0 devices).
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 03cf8fb81554..58e0e9739028 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -437,23 +437,18 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
         int id;
         struct phy *phy;
 
-        if (!dev) {
-                dev_WARN(dev, "no device provided for PHY\n");
-                ret = -EINVAL;
-                goto err0;
-        }
+        if (WARN_ON(!dev))
+                return ERR_PTR(-EINVAL);
 
         phy = kzalloc(sizeof(*phy), GFP_KERNEL);
-        if (!phy) {
-                ret = -ENOMEM;
-                goto err0;
-        }
+        if (!phy)
+                return ERR_PTR(-ENOMEM);
 
         id = ida_simple_get(&phy_ida, 0, 0, GFP_KERNEL);
         if (id < 0) {
                 dev_err(dev, "unable to get id\n");
                 ret = id;
-                goto err0;
+                goto free_phy;
         }
 
         device_initialize(&phy->dev);
@@ -468,11 +463,11 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
 
         ret = dev_set_name(&phy->dev, "phy-%s.%d", dev_name(dev), id);
         if (ret)
-                goto err1;
+                goto put_dev;
 
         ret = device_add(&phy->dev);
         if (ret)
-                goto err1;
+                goto put_dev;
 
         if (pm_runtime_enabled(dev)) {
                 pm_runtime_enable(&phy->dev);
@@ -481,12 +476,11 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
 
         return phy;
 
-err1:
-        ida_remove(&phy_ida, phy->id);
+put_dev:
         put_device(&phy->dev);
+        ida_remove(&phy_ida, phy->id);
+free_phy:
         kfree(phy);
-
-err0:
         return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(phy_create);
diff --git a/drivers/pinctrl/pinctrl-baytrail.c b/drivers/pinctrl/pinctrl-baytrail.c
index 2832576d8b12..114f5ef4b73a 100644
--- a/drivers/pinctrl/pinctrl-baytrail.c
+++ b/drivers/pinctrl/pinctrl-baytrail.c
@@ -512,6 +512,7 @@ static const struct dev_pm_ops byt_gpio_pm_ops = {
 
 static const struct acpi_device_id byt_gpio_acpi_match[] = {
         { "INT33B2", 0 },
+        { "INT33FC", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(acpi, byt_gpio_acpi_match);
diff --git a/drivers/pinctrl/sh-pfc/sh_pfc.h b/drivers/pinctrl/sh-pfc/sh_pfc.h
index 11bd0d970a52..e2142956a8e5 100644
--- a/drivers/pinctrl/sh-pfc/sh_pfc.h
+++ b/drivers/pinctrl/sh-pfc/sh_pfc.h
@@ -254,7 +254,7 @@ struct sh_pfc_soc_info {
 #define PINMUX_GPIO(_pin)                                               \
         [GPIO_##_pin] = {                                               \
                 .pin = (u16)-1,                                         \
-                .name = __stringify(name),                              \
+                .name = __stringify(GPIO_##_pin),                       \
                 .enum_id = _pin##_DATA,                                 \
         }
 
diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig
index 5e2054afe840..85ad58c6da17 100644
--- a/drivers/power/Kconfig
+++ b/drivers/power/Kconfig
@@ -196,6 +196,7 @@ config BATTERY_MAX17040
 config BATTERY_MAX17042
         tristate "Maxim MAX17042/17047/17050/8997/8966 Fuel Gauge"
         depends on I2C
+        select REGMAP_I2C
         help
           MAX17042 is fuel-gauge systems for lithium-ion (Li+) batteries
           in handheld and portable equipment. The MAX17042 is configured
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 00e667296360..557af943b2f5 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -511,6 +511,10 @@ int power_supply_register(struct device *parent, struct power_supply *psy)
         dev_set_drvdata(dev, psy);
         psy->dev = dev;
 
+        rc = dev_set_name(dev, "%s", psy->name);
+        if (rc)
+                goto dev_set_name_failed;
+
         INIT_WORK(&psy->changed_work, power_supply_changed_work);
 
         rc = power_supply_check_supplies(psy);
@@ -524,10 +528,6 @@ int power_supply_register(struct device *parent, struct power_supply *psy)
         if (rc)
                 goto wakeup_init_failed;
 
-        rc = kobject_set_name(&dev->kobj, "%s", psy->name);
-        if (rc)
-                goto kobject_set_name_failed;
-
         rc = device_add(dev);
         if (rc)
                 goto device_add_failed;
@@ -553,11 +553,11 @@ create_triggers_failed:
 register_cooler_failed:
         psy_unregister_thermal(psy);
 register_thermal_failed:
-wakeup_init_failed:
         device_del(dev);
-kobject_set_name_failed:
 device_add_failed:
+wakeup_init_failed:
 check_supplies_failed:
+dev_set_name_failed:
         put_device(dev);
 success:
         return rc;
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index 2a786c504460..3c6768378a94 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -833,6 +833,11 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
         return 0;
 }
 
+static const struct x86_cpu_id energy_unit_quirk_ids[] = {
+        { X86_VENDOR_INTEL, 6, 0x37},/* VLV */
+        {}
+};
+
 static int rapl_check_unit(struct rapl_package *rp, int cpu)
 {
         u64 msr_val;
@@ -853,8 +858,11 @@ static int rapl_check_unit(struct rapl_package *rp, int cpu)
          * time unit: 1/time_unit_divisor Seconds
          */
         value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit_divisor = 1 << value;
-
+        /* some CPUs have different way to calculate energy unit */
+        if (x86_match_cpu(energy_unit_quirk_ids))
+                rp->energy_unit_divisor = 1000000 / (1 << value);
+        else
+                rp->energy_unit_divisor = 1 << value;
 
         value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
         rp->power_unit_divisor = 1 << value;
@@ -941,6 +949,7 @@ static void package_power_limit_irq_restore(int package_id)
 static const struct x86_cpu_id rapl_ids[] = {
         { X86_VENDOR_INTEL, 6, 0x2a},/* SNB */
         { X86_VENDOR_INTEL, 6, 0x2d},/* SNB EP */
+        { X86_VENDOR_INTEL, 6, 0x37},/* VLV */
         { X86_VENDOR_INTEL, 6, 0x3a},/* IVB */
         { X86_VENDOR_INTEL, 6, 0x45},/* HSW */
         /* TODO: Add more CPU IDs after testing */
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 333677d68d0e..9e61922d8230 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -438,7 +438,7 @@ common_reg:
         platform_set_drvdata(pdev, s2mps11);
 
         config.dev = &pdev->dev;
-        config.regmap = iodev->regmap;
+        config.regmap = iodev->regmap_pmic;
         config.driver_data = s2mps11;
         for (i = 0; i < S2MPS11_REGULATOR_MAX; i++) {
                 if (!reg_np) {
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 3f4ca4e09a4c..34629ea913d4 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -942,7 +942,7 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
                 return rc;
         }
 
-        tp->screen = tty3270_alloc_screen(tp->view.cols, tp->view.rows);
+        tp->screen = tty3270_alloc_screen(tp->view.rows, tp->view.cols);
         if (IS_ERR(tp->screen)) {
                 rc = PTR_ERR(tp->screen);
                 raw3270_put_view(&tp->view);
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 596480022b0a..38a1257e76e1 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -471,7 +471,7 @@ static void qlt_schedule_sess_for_deletion(struct qla_tgt_sess *sess,
                 schedule_delayed_work(&tgt->sess_del_work, 0);
         else
                 schedule_delayed_work(&tgt->sess_del_work,
-                    jiffies - sess->expires);
+                    sess->expires - jiffies);
 }
 
 /* ha->hardware_lock supposed to be held on entry */
@@ -550,13 +550,14 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
         struct scsi_qla_host *vha = tgt->vha;
         struct qla_hw_data *ha = vha->hw;
         struct qla_tgt_sess *sess;
-        unsigned long flags;
+        unsigned long flags, elapsed;
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
         while (!list_empty(&tgt->del_sess_list)) {
                 sess = list_entry(tgt->del_sess_list.next, typeof(*sess),
                     del_list_entry);
-                if (time_after_eq(jiffies, sess->expires)) {
+                elapsed = jiffies;
+                if (time_after_eq(elapsed, sess->expires)) {
                         qlt_undelete_sess(sess);
 
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf004,
@@ -566,7 +567,7 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
                         ha->tgt.tgt_ops->put_sess(sess);
                 } else {
                         schedule_delayed_work(&tgt->sess_del_work,
-                            jiffies - sess->expires);
+                            sess->expires - elapsed);
                         break;
                 }
         }
@@ -4290,6 +4291,7 @@ int qlt_lport_register(struct qla_tgt_func_tmpl *qla_tgt_ops, u64 wwpn,
                 if (rc != 0) {
                         ha->tgt.tgt_ops = NULL;
                         ha->tgt.target_lport_ptr = NULL;
+                        scsi_host_put(host);
                 }
                 mutex_unlock(&qla_tgt_mutex);
                 return rc;
diff --git a/drivers/staging/bcm/Bcmnet.c b/drivers/staging/bcm/Bcmnet.c
index 53fee2f9a498..8dfdd2732bdc 100644
--- a/drivers/staging/bcm/Bcmnet.c
+++ b/drivers/staging/bcm/Bcmnet.c
@@ -39,7 +39,8 @@ static INT bcm_close(struct net_device *dev)
         return 0;
 }
 
-static u16 bcm_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 bcm_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
         return ClassifyPacket(netdev_priv(dev), skb);
 }
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index 8f02bf66e20b..4964d2a2fc7d 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -446,7 +446,7 @@ int comedi_load_firmware(struct comedi_device *dev,
                 release_firmware(fw);
         }
 
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 EXPORT_SYMBOL_GPL(comedi_load_firmware);
 
diff --git a/drivers/staging/comedi/drivers/8255_pci.c b/drivers/staging/comedi/drivers/8255_pci.c
index 432e3f9c3301..c55f234b29e6 100644
--- a/drivers/staging/comedi/drivers/8255_pci.c
+++ b/drivers/staging/comedi/drivers/8255_pci.c
@@ -63,7 +63,8 @@ enum pci_8255_boardid {
         BOARD_ADLINK_PCI7296,
         BOARD_CB_PCIDIO24,
         BOARD_CB_PCIDIO24H,
-        BOARD_CB_PCIDIO48H,
+        BOARD_CB_PCIDIO48H_OLD,
+        BOARD_CB_PCIDIO48H_NEW,
         BOARD_CB_PCIDIO96H,
         BOARD_NI_PCIDIO96,
         BOARD_NI_PCIDIO96B,
@@ -106,11 +107,16 @@ static const struct pci_8255_boardinfo pci_8255_boards[] = {
                 .dio_badr       = 2,
                 .n_8255         = 1,
         },
-        [BOARD_CB_PCIDIO48H] = {
+        [BOARD_CB_PCIDIO48H_OLD] = {
                 .name           = "cb_pci-dio48h",
                 .dio_badr       = 1,
                 .n_8255         = 2,
         },
+        [BOARD_CB_PCIDIO48H_NEW] = {
+                .name           = "cb_pci-dio48h",
+                .dio_badr       = 2,
+                .n_8255         = 2,
+        },
         [BOARD_CB_PCIDIO96H] = {
                 .name           = "cb_pci-dio96h",
                 .dio_badr       = 2,
@@ -263,7 +269,10 @@ static DEFINE_PCI_DEVICE_TABLE(pci_8255_pci_table) = {
         { PCI_VDEVICE(ADLINK, 0x7296), BOARD_ADLINK_PCI7296 },
         { PCI_VDEVICE(CB, 0x0028), BOARD_CB_PCIDIO24 },
         { PCI_VDEVICE(CB, 0x0014), BOARD_CB_PCIDIO24H },
-        { PCI_VDEVICE(CB, 0x000b), BOARD_CB_PCIDIO48H },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, 0x0000, 0x0000),
+          .driver_data = BOARD_CB_PCIDIO48H_OLD },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, PCI_VENDOR_ID_CB, 0x000b),
+          .driver_data = BOARD_CB_PCIDIO48H_NEW },
         { PCI_VDEVICE(CB, 0x0017), BOARD_CB_PCIDIO96H },
         { PCI_VDEVICE(NI, 0x0160), BOARD_NI_PCIDIO96 },
         { PCI_VDEVICE(NI, 0x1630), BOARD_NI_PCIDIO96B },
diff --git a/drivers/staging/iio/magnetometer/hmc5843.c b/drivers/staging/iio/magnetometer/hmc5843.c
index 99421f90d189..0485d7f39867 100644
--- a/drivers/staging/iio/magnetometer/hmc5843.c
+++ b/drivers/staging/iio/magnetometer/hmc5843.c
@@ -451,7 +451,12 @@ done:
                 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE) |  \
                         BIT(IIO_CHAN_INFO_SAMP_FREQ),                   \
                 .scan_index = idx,                                      \
-                .scan_type = IIO_ST('s', 16, 16, IIO_BE),               \
+                .scan_type = {                                          \
+                        .sign = 's',                                    \
+                        .realbits = 16,                                 \
+                        .storagebits = 16,                              \
+                        .endianness = IIO_BE,                           \
+                },                                                      \
         }
 
 static const struct iio_chan_spec hmc5843_channels[] = {
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 0507b662ae40..09ef5fb8bae6 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -88,8 +88,9 @@ static int imx_drm_driver_unload(struct drm_device *drm)
 
         imx_drm_device_put();
 
-        drm_mode_config_cleanup(imxdrm->drm);
+        drm_vblank_cleanup(imxdrm->drm);
         drm_kms_helper_poll_fini(imxdrm->drm);
+        drm_mode_config_cleanup(imxdrm->drm);
 
         return 0;
 }
@@ -199,8 +200,8 @@ static void imx_drm_driver_preclose(struct drm_device *drm,
         if (!file->is_master)
                 return;
 
-        for (i = 0; i < 4; i++)
-                imx_drm_disable_vblank(drm , i);
+        for (i = 0; i < MAX_CRTC; i++)
+                imx_drm_disable_vblank(drm, i);
 }
 
 static const struct file_operations imx_drm_driver_fops = {
@@ -376,8 +377,6 @@ static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
         struct imx_drm_device *imxdrm = __imx_drm_device();
         int ret;
 
-        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
-                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
         ret = drm_mode_crtc_set_gamma_size(imx_drm_crtc->crtc, 256);
         if (ret)
                 return ret;
@@ -385,6 +384,9 @@ static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
         drm_crtc_helper_add(imx_drm_crtc->crtc,
                         imx_drm_crtc->imx_drm_helper_funcs.crtc_helper_funcs);
 
+        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
+                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
+
         drm_mode_group_reinit(imxdrm->drm);
 
         return 0;
@@ -428,11 +430,11 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
         ret = drm_mode_group_init_legacy_group(imxdrm->drm,
                         &imxdrm->drm->primary->mode_group);
         if (ret)
-                goto err_init;
+                goto err_kms;
 
         ret = drm_vblank_init(imxdrm->drm, MAX_CRTC);
         if (ret)
-                goto err_init;
+                goto err_kms;
 
         /*
          * with vblank_disable_allowed = true, vblank interrupt will be disabled
@@ -441,14 +443,20 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
          */
         imxdrm->drm->vblank_disable_allowed = true;
 
-        if (!imx_drm_device_get())
+        if (!imx_drm_device_get()) {
                 ret = -EINVAL;
+                goto err_vblank;
+        }
 
         platform_set_drvdata(drm->platformdev, drm);
+        mutex_unlock(&imxdrm->mutex);
+        return 0;
 
-        ret = 0;
-
-err_init:
+err_vblank:
+        drm_vblank_cleanup(drm);
+err_kms:
+        drm_kms_helper_poll_fini(drm);
+        drm_mode_config_cleanup(drm);
         mutex_unlock(&imxdrm->mutex);
 
         return ret;
@@ -494,6 +502,15 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
 
         mutex_lock(&imxdrm->mutex);
 
+        /*
+         * The vblank arrays are dimensioned by MAX_CRTC - we can't
+         * pass IDs greater than this to those functions.
+         */
+        if (imxdrm->pipes >= MAX_CRTC) {
+                ret = -EINVAL;
+                goto err_busy;
+        }
+
         if (imxdrm->drm->open_count) {
                 ret = -EBUSY;
                 goto err_busy;
@@ -530,6 +547,7 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
         return 0;
 
 err_register:
+        list_del(&imx_drm_crtc->list);
         kfree(imx_drm_crtc);
 err_alloc:
 err_busy:
diff --git a/drivers/staging/imx-drm/imx-tve.c b/drivers/staging/imx-drm/imx-tve.c
index 680f4c8fa081..2c44fef8d58b 100644
--- a/drivers/staging/imx-drm/imx-tve.c
+++ b/drivers/staging/imx-drm/imx-tve.c
@@ -114,7 +114,6 @@ struct imx_tve {
         struct drm_encoder encoder;
         struct imx_drm_encoder *imx_drm_encoder;
         struct device *dev;
-        spinlock_t enable_lock; /* serializes tve_enable/disable */
         spinlock_t lock;        /* register lock */
         bool enabled;
         int mode;
@@ -146,10 +145,8 @@ __releases(&tve->lock)
 
 static void tve_enable(struct imx_tve *tve)
 {
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&tve->enable_lock, flags);
         if (!tve->enabled) {
                 tve->enabled = true;
                 clk_prepare_enable(tve->clk);
@@ -169,23 +166,18 @@ static void tve_enable(struct imx_tve *tve)
                              TVE_CD_SM_IEN |
                              TVE_CD_LM_IEN |
                              TVE_CD_MON_END_IEN);
-
-        spin_unlock_irqrestore(&tve->enable_lock, flags);
 }
 
 static void tve_disable(struct imx_tve *tve)
 {
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&tve->enable_lock, flags);
         if (tve->enabled) {
                 tve->enabled = false;
                 ret = regmap_update_bits(tve->regmap, TVE_COM_CONF_REG,
                                          TVE_IPU_CLK_EN | TVE_EN, 0);
                 clk_disable_unprepare(tve->clk);
         }
-        spin_unlock_irqrestore(&tve->enable_lock, flags);
 }
 
 static int tve_setup_tvout(struct imx_tve *tve)
@@ -601,7 +593,6 @@ static int imx_tve_probe(struct platform_device *pdev)
 
         tve->dev = &pdev->dev;
         spin_lock_init(&tve->lock);
-        spin_lock_init(&tve->enable_lock);
 
         ddc_node = of_parse_phandle(np, "ddc", 0);
         if (ddc_node) {
diff --git a/drivers/staging/imx-drm/ipu-v3/ipu-common.c b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
index 7a22ce619ed2..97ca6924dbb3 100644
--- a/drivers/staging/imx-drm/ipu-v3/ipu-common.c
+++ b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
@@ -996,35 +996,35 @@ static const struct ipu_platform_reg client_reg[] = {
         },
 };
 
+static DEFINE_MUTEX(ipu_client_id_mutex);
 static int ipu_client_id;
 
-static int ipu_add_subdevice_pdata(struct device *dev,
-                const struct ipu_platform_reg *reg)
-{
-        struct platform_device *pdev;
-
-        pdev = platform_device_register_data(dev, reg->name, ipu_client_id++,
-                        &reg->pdata, sizeof(struct ipu_platform_reg));
-
-        return PTR_ERR_OR_ZERO(pdev);
-}
-
 static int ipu_add_client_devices(struct ipu_soc *ipu)
 {
-        int ret;
-        int i;
+        struct device *dev = ipu->dev;
+        unsigned i;
+        int id, ret;
+
+        mutex_lock(&ipu_client_id_mutex);
+        id = ipu_client_id;
+        ipu_client_id += ARRAY_SIZE(client_reg);
+        mutex_unlock(&ipu_client_id_mutex);
 
         for (i = 0; i < ARRAY_SIZE(client_reg); i++) {
                 const struct ipu_platform_reg *reg = &client_reg[i];
-                ret = ipu_add_subdevice_pdata(ipu->dev, reg);
-                if (ret)
+                struct platform_device *pdev;
+
+                pdev = platform_device_register_data(dev, reg->name,
+                        id++, &reg->pdata, sizeof(reg->pdata));
+
+                if (IS_ERR(pdev))
                         goto err_register;
         }
 
         return 0;
 
 err_register:
-        platform_device_unregister_children(to_platform_device(ipu->dev));
+        platform_device_unregister_children(to_platform_device(dev));
 
         return ret;
 }
diff --git a/drivers/staging/netlogic/xlr_net.c b/drivers/staging/netlogic/xlr_net.c
index 235d2b1ec593..eedffed17e39 100644
--- a/drivers/staging/netlogic/xlr_net.c
+++ b/drivers/staging/netlogic/xlr_net.c
@@ -306,7 +306,8 @@ static netdev_tx_t xlr_net_start_xmit(struct sk_buff *skb,
         return NETDEV_TX_OK;
 }
 
-static u16 xlr_net_select_queue(struct net_device *ndev, struct sk_buff *skb)
+static u16 xlr_net_select_queue(struct net_device *ndev, struct sk_buff *skb,
+                                void *accel_priv)
 {
         return (u16)smp_processor_id();
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/os_intfs.c b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
index 17659bb04bef..dd69e344e409 100644
--- a/drivers/staging/rtl8188eu/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
@@ -652,7 +652,8 @@ static unsigned int rtw_classify8021d(struct sk_buff *skb)
         return dscp >> 5;
 }
 
-static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
         struct adapter  *padapter = rtw_netdev_priv(dev);
         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index d70e9119e906..00867190413c 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -465,6 +465,7 @@ int iscsit_del_np(struct iscsi_np *np)
                  */
                 send_sig(SIGINT, np->np_thread, 1);
                 kthread_stop(np->np_thread);
+                np->np_thread = NULL;
         }
 
         np->np_transport->iscsit_free_np(np);
@@ -823,24 +824,22 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         if (((hdr->flags & ISCSI_FLAG_CMD_READ) ||
              (hdr->flags & ISCSI_FLAG_CMD_WRITE)) && !hdr->data_length) {
                 /*
-                 * Vmware ESX v3.0 uses a modified Cisco Initiator (v3.4.2)
-                 * that adds support for RESERVE/RELEASE.  There is a bug
-                 * add with this new functionality that sets R/W bits when
-                 * neither CDB carries any READ or WRITE datapayloads.
+                 * From RFC-3720 Section 10.3.1:
+                 *
+                 * "Either or both of R and W MAY be 1 when either the
+                 *  Expected Data Transfer Length and/or Bidirectional Read
+                 *  Expected Data Transfer Length are 0"
+                 *
+                 * For this case, go ahead and clear the unnecssary bits
+                 * to avoid any confusion with ->data_direction.
                  */
-                if ((hdr->cdb[0] == 0x16) || (hdr->cdb[0] == 0x17)) {
-                        hdr->flags &= ~ISCSI_FLAG_CMD_READ;
-                        hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
-                        goto done;
-                }
+                hdr->flags &= ~ISCSI_FLAG_CMD_READ;
+                hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
 
-                pr_err("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
+                pr_warn("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
                         " set when Expected Data Transfer Length is 0 for"
-                        " CDB: 0x%02x. Bad iSCSI Initiator.\n", hdr->cdb[0]);
-                return iscsit_add_reject_cmd(cmd,
-                                             ISCSI_REASON_BOOKMARK_INVALID, buf);
+                        " CDB: 0x%02x, Fixing up flags\n", hdr->cdb[0]);
         }
-done:
 
         if (!(hdr->flags & ISCSI_FLAG_CMD_READ) &&
             !(hdr->flags & ISCSI_FLAG_CMD_WRITE) && (hdr->data_length != 0)) {
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index e3318edb233d..1c0088fe9e99 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -474,7 +474,8 @@ static ssize_t __iscsi_##prefix##_store_##name(				\
                                                                         \
         if (!capable(CAP_SYS_ADMIN))                                    \
                 return -EPERM;                                          \
-                                                                        \
+        if (count >= sizeof(auth->name))                                \
+                return -EINVAL;                                         \
         snprintf(auth->name, sizeof(auth->name), "%s", page);           \
         if (!strncmp("NULL", auth->name, 4))                            \
                 auth->naf_flags &= ~flags;                              \
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 4eb93b2b6473..e29279e6b577 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1403,11 +1403,6 @@ old_sess_out:
 
 out:
         stop = kthread_should_stop();
-        if (!stop && signal_pending(current)) {
-                spin_lock_bh(&np->np_thread_lock);
-                stop = (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN);
-                spin_unlock_bh(&np->np_thread_lock);
-        }
         /* Wait for another socket.. */
         if (!stop)
                 return 1;
@@ -1415,7 +1410,6 @@ exit:
         iscsi_stop_login_thread_timer(np);
         spin_lock_bh(&np->np_thread_lock);
         np->np_thread_state = ISCSI_NP_THREAD_EXIT;
-        np->np_thread = NULL;
         spin_unlock_bh(&np->np_thread_lock);
 
         return 0;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 207b340498a3..d06de84b069b 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1106,6 +1106,11 @@ int se_dev_set_block_size(struct se_device *dev, u32 block_size)
         dev->dev_attrib.block_size = block_size;
         pr_debug("dev[%p]: SE Device block_size changed to %u\n",
                         dev, block_size);
+
+        if (dev->dev_attrib.max_bytes_per_io)
+                dev->dev_attrib.hw_max_sectors =
+                        dev->dev_attrib.max_bytes_per_io / block_size;
+
         return 0;
 }
 
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 0e34cda3271e..78241a53b555 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -66,9 +66,8 @@ static int fd_attach_hba(struct se_hba *hba, u32 host_id)
         pr_debug("CORE_HBA[%d] - TCM FILEIO HBA Driver %s on Generic"
                 " Target Core Stack %s\n", hba->hba_id, FD_VERSION,
                 TARGET_CORE_MOD_VERSION);
-        pr_debug("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic"
-                " MaxSectors: %u\n",
-                hba->hba_id, fd_host->fd_host_id, FD_MAX_SECTORS);
+        pr_debug("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic\n",
+                hba->hba_id, fd_host->fd_host_id);
 
         return 0;
 }
@@ -220,7 +219,8 @@ static int fd_configure_device(struct se_device *dev)
         }
 
         dev->dev_attrib.hw_block_size = fd_dev->fd_block_size;
-        dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
+        dev->dev_attrib.max_bytes_per_io = FD_MAX_BYTES;
+        dev->dev_attrib.hw_max_sectors = FD_MAX_BYTES / fd_dev->fd_block_size;
         dev->dev_attrib.hw_queue_depth = FD_MAX_DEVICE_QUEUE_DEPTH;
 
         if (fd_dev->fbd_flags & FDBD_HAS_BUFFERED_IO_WCE) {
diff --git a/drivers/target/target_core_file.h b/drivers/target/target_core_file.h
index 37ffc5bd2399..d7772c167685 100644
--- a/drivers/target/target_core_file.h
+++ b/drivers/target/target_core_file.h
@@ -7,7 +7,10 @@
 #define FD_DEVICE_QUEUE_DEPTH   32
 #define FD_MAX_DEVICE_QUEUE_DEPTH 128
 #define FD_BLOCKSIZE            512
-#define FD_MAX_SECTORS          2048
+/*
+ * Limited by the number of iovecs (2048) per vfs_[writev,readv] call
+ */
+#define FD_MAX_BYTES            8388608
 
 #define RRF_EMULATE_CDB         0x01
 #define RRF_GOT_LBA             0x02
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index f697f8baec54..2a573de19a9f 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -278,7 +278,6 @@ struct se_node_acl *core_tpg_check_initiator_node_acl(
         snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
         acl->se_tpg = tpg;
         acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX);
-        spin_lock_init(&acl->stats_lock);
         acl->dynamic_node_acl = 1;
 
         tpg->se_tpg_tfo->set_default_node_attributes(acl);
@@ -406,7 +405,6 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
         snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
         acl->se_tpg = tpg;
         acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX);
-        spin_lock_init(&acl->stats_lock);
 
         tpg->se_tpg_tfo->set_default_node_attributes(acl);
 
@@ -658,15 +656,9 @@ static int core_tpg_setup_virtual_lun0(struct se_portal_group *se_tpg)
         spin_lock_init(&lun->lun_sep_lock);
         init_completion(&lun->lun_ref_comp);
 
-        ret = percpu_ref_init(&lun->lun_ref, core_tpg_lun_ref_release);
-        if (ret < 0)
-                return ret;
-
         ret = core_tpg_post_addlun(se_tpg, lun, lun_access, dev);
-        if (ret < 0) {
-                percpu_ref_cancel_init(&lun->lun_ref);
+        if (ret < 0)
                 return ret;
-        }
 
         return 0;
 }
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 268b62768f2b..34aacaaae14a 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -93,6 +93,7 @@ struct n_tty_data {
         size_t canon_head;
         size_t echo_head;
         size_t echo_commit;
+        size_t echo_mark;
         DECLARE_BITMAP(char_map, 256);
 
         /* private to n_tty_receive_overrun (single-threaded) */
@@ -336,6 +337,7 @@ static void reset_buffer_flags(struct n_tty_data *ldata)
 {
         ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
         ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
+        ldata->echo_mark = 0;
         ldata->line_start = 0;
 
         ldata->erasing = 0;
@@ -787,6 +789,7 @@ static void commit_echoes(struct tty_struct *tty)
         size_t head;
 
         head = ldata->echo_head;
+        ldata->echo_mark = head;
         old = ldata->echo_commit - ldata->echo_tail;
 
         /* Process committed echoes if the accumulated # of bytes
@@ -811,10 +814,11 @@ static void process_echoes(struct tty_struct *tty)
         size_t echoed;
 
         if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
-            ldata->echo_commit == ldata->echo_tail)
+            ldata->echo_mark == ldata->echo_tail)
                 return;
 
         mutex_lock(&ldata->output_lock);
+        ldata->echo_commit = ldata->echo_mark;
         echoed = __process_echoes(tty);
         mutex_unlock(&ldata->output_lock);
 
@@ -822,6 +826,7 @@ static void process_echoes(struct tty_struct *tty)
                 tty->ops->flush_chars(tty);
 }
 
+/* NB: echo_mark and echo_head should be equivalent here */
 static void flush_echoes(struct tty_struct *tty)
 {
         struct n_tty_data *ldata = tty->disc_data;
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 4658e3e0ec42..06525f10e364 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -96,7 +96,8 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
         if (offset == UART_LCR) {
                 int tries = 1000;
                 while (tries--) {
-                        if (value == p->serial_in(p, UART_LCR))
+                        unsigned int lcr = p->serial_in(p, UART_LCR);
+                        if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
                                 return;
                         dw8250_force_idle(p);
                         writeb(value, p->membase + (UART_LCR << p->regshift));
@@ -132,7 +133,8 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
         if (offset == UART_LCR) {
                 int tries = 1000;
                 while (tries--) {
-                        if (value == p->serial_in(p, UART_LCR))
+                        unsigned int lcr = p->serial_in(p, UART_LCR);
+                        if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
                                 return;
                         dw8250_force_idle(p);
                         writel(value, p->membase + (UART_LCR << p->regshift));
@@ -455,6 +457,8 @@ MODULE_DEVICE_TABLE(of, dw8250_of_match);
 static const struct acpi_device_id dw8250_acpi_match[] = {
         { "INT33C4", 0 },
         { "INT33C5", 0 },
+        { "INT3434", 0 },
+        { "INT3435", 0 },
         { "80860F0A", 0 },
         { },
 };
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index e46e9f3f19b9..f619ad5b5eae 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -240,6 +240,7 @@ static irqreturn_t xuartps_isr(int irq, void *dev_id)
                                         continue;
                         }
 
+#ifdef SUPPORT_SYSRQ
                         /*
                          * uart_handle_sysrq_char() doesn't work if
                          * spinlocked, for some reason
@@ -253,6 +254,7 @@ static irqreturn_t xuartps_isr(int irq, void *dev_id)
                                 }
                                 spin_lock(&port->lock);
                         }
+#endif
 
                         port->icount.rx++;
 
diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
index 22fad8ad5ac2..d8a55e87877f 100644
--- a/drivers/tty/tty_ldsem.c
+++ b/drivers/tty/tty_ldsem.c
@@ -86,11 +86,21 @@ static inline long ldsem_atomic_update(long delta, struct ld_semaphore *sem)
         return atomic_long_add_return(delta, (atomic_long_t *)&sem->count);
 }
 
+/*
+ * ldsem_cmpxchg() updates @*old with the last-known sem->count value.
+ * Returns 1 if count was successfully changed; @*old will have @new value.
+ * Returns 0 if count was not changed; @*old will have most recent sem->count
+ */
 static inline int ldsem_cmpxchg(long *old, long new, struct ld_semaphore *sem)
 {
-        long tmp = *old;
-        *old = atomic_long_cmpxchg(&sem->count, *old, new);
-        return *old == tmp;
+        long tmp = atomic_long_cmpxchg(&sem->count, *old, new);
+        if (tmp == *old) {
+                *old = new;
+                return 1;
+        } else {
+                *old = tmp;
+                return 0;
+        }
 }
 
 /*
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 5d8981c5235e..6e73f8cd60e5 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -642,6 +642,10 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                         : CI_ROLE_GADGET;
         }
 
+        /* only update vbus status for peripheral */
+        if (ci->role == CI_ROLE_GADGET)
+                ci_handle_vbus_change(ci);
+
         ret = ci_role_start(ci, ci->role);
         if (ret) {
                 dev_err(dev, "can't start %s role\n", ci_role(ci)->name);
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 59e6020ea753..526cd77563d8 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -88,7 +88,8 @@ static int host_start(struct ci_hdrc *ci)
         return ret;
 
 disable_reg:
-        regulator_disable(ci->platdata->reg_vbus);
+        if (ci->platdata->reg_vbus)
+                regulator_disable(ci->platdata->reg_vbus);
 
 put_hcd:
         usb_put_hcd(hcd);
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index b34c81969cba..69d20fbb38a2 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1795,9 +1795,6 @@ static int udc_start(struct ci_hdrc *ci)
         pm_runtime_no_callbacks(&ci->gadget.dev);
         pm_runtime_enable(&ci->gadget.dev);
 
-        /* Update ci->vbus_active */
-        ci_handle_vbus_change(ci);
-
         return retval;
 
 destroy_eps:
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 4d387596f3f0..0b23a8639311 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -854,13 +854,11 @@ static int wdm_manage_power(struct usb_interface *intf, int on)
 {
         /* need autopm_get/put here to ensure the usbcore sees the new value */
         int rv = usb_autopm_get_interface(intf);
-        if (rv < 0)
-                goto err;
 
         intf->needs_remote_wakeup = on;
-        usb_autopm_put_interface(intf);
-err:
-        return rv;
+        if (!rv)
+                usb_autopm_put_interface(intf);
+        return 0;
 }
 
 static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 74f9cf02da07..a49217ae3533 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -455,9 +455,6 @@ static int dwc3_probe(struct platform_device *pdev)
         if (IS_ERR(regs))
                 return PTR_ERR(regs);
 
-        usb_phy_set_suspend(dwc->usb2_phy, 0);
-        usb_phy_set_suspend(dwc->usb3_phy, 0);
-
         spin_lock_init(&dwc->lock);
         platform_set_drvdata(pdev, dwc);
 
@@ -488,6 +485,9 @@ static int dwc3_probe(struct platform_device *pdev)
                 goto err0;
         }
 
+        usb_phy_set_suspend(dwc->usb2_phy, 0);
+        usb_phy_set_suspend(dwc->usb3_phy, 0);
+
         ret = dwc3_event_buffers_setup(dwc);
         if (ret) {
                 dev_err(dwc->dev, "failed to setup event buffers\n");
@@ -569,6 +569,8 @@ err2:
         dwc3_event_buffers_cleanup(dwc);
 
 err1:
+        usb_phy_set_suspend(dwc->usb2_phy, 1);
+        usb_phy_set_suspend(dwc->usb3_phy, 1);
         dwc3_core_exit(dwc);
 
 err0:
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 418444ebb1b8..8c356af79409 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -136,23 +136,27 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
         struct ohci_hcd *ohci;
         int retval;
         struct usb_hcd *hcd = NULL;
-
-        if (pdev->num_resources != 2) {
-                pr_debug("hcd probe: invalid num_resources");
-                return -ENODEV;
+        struct device *dev = &pdev->dev;
+        struct resource *res;
+        int irq;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_dbg(dev, "hcd probe: missing memory resource\n");
+                return -ENXIO;
         }
 
-        if ((pdev->resource[0].flags != IORESOURCE_MEM)
-                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
-                pr_debug("hcd probe: invalid resource type\n");
-                return -ENODEV;
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_dbg(dev, "hcd probe: missing irq resource\n");
+                return irq;
         }
 
         hcd = usb_create_hcd(driver, &pdev->dev, "at91");
         if (!hcd)
                 return -ENOMEM;
-        hcd->rsrc_start = pdev->resource[0].start;
-        hcd->rsrc_len = resource_size(&pdev->resource[0]);
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
 
         if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
                 pr_debug("request_mem_region failed\n");
@@ -199,7 +203,7 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
         ohci->num_ports = board->ports;
         at91_start_hc(pdev);
 
-        retval = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_SHARED);
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
         if (retval == 0)
                 return retval;
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index b8dffd59eb25..73f5208714a4 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -128,7 +128,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                  * any other sleep) on Haswell machines with LPT and LPT-LP
                  * with the new Intel BIOS
                  */
-                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+                /* Limit the quirk to only known vendors, as this triggers
+                 * yet another BIOS bug on some other machines
+                 * https://bugzilla.kernel.org/show_bug.cgi?id=66171
+                 */
+                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
+                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
         }
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                         pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 08e2f39027ec..2b41c636a52a 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -19,8 +19,9 @@ config AB8500_USB
           in host mode, low speed.
 
 config FSL_USB2_OTG
-        bool "Freescale USB OTG Transceiver Driver"
+        tristate "Freescale USB OTG Transceiver Driver"
         depends on USB_EHCI_FSL && USB_FSL_USB2 && PM_RUNTIME
+        depends on USB
         select USB_OTG
         select USB_PHY
         help
@@ -29,6 +30,7 @@ config FSL_USB2_OTG
 config ISP1301_OMAP
         tristate "Philips ISP1301 with OMAP OTG"
         depends on I2C && ARCH_OMAP_OTG
+        depends on USB
         select USB_PHY
         help
           If you say yes here you get support for the Philips ISP1301
diff --git a/drivers/usb/phy/phy-tegra-usb.c b/drivers/usb/phy/phy-tegra-usb.c
index 82232acf1ab6..bbe4f8e6e8d7 100644
--- a/drivers/usb/phy/phy-tegra-usb.c
+++ b/drivers/usb/phy/phy-tegra-usb.c
@@ -876,7 +876,7 @@ static int utmi_phy_probe(struct tegra_usb_phy *tegra_phy,
 
         tegra_phy->pad_regs = devm_ioremap(&pdev->dev, res->start,
                 resource_size(res));
-        if (!tegra_phy->regs) {
+        if (!tegra_phy->pad_regs) {
                 dev_err(&pdev->dev, "Failed to remap UTMI Pad regs\n");
                 return -ENOMEM;
         }
diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 30e8a61552d4..bad57ce77ba5 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -127,7 +127,8 @@ static inline int twl6030_writeb(struct twl6030_usb *twl, u8 module,
 
 static inline u8 twl6030_readb(struct twl6030_usb *twl, u8 module, u8 address)
 {
-        u8 data, ret = 0;
+        u8 data;
+        int ret;
 
         ret = twl_i2c_read_u8(module, &data, address);
         if (ret >= 0)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 496b7e39d5be..cc7a24154490 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb);
 #define ZTE_PRODUCT_MF628                       0x0015
 #define ZTE_PRODUCT_MF626                       0x0031
 #define ZTE_PRODUCT_MC2718                      0xffe8
+#define ZTE_PRODUCT_AC2726                      0xfff1
 
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -1453,6 +1454,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
 
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
diff --git a/drivers/usb/serial/zte_ev.c b/drivers/usb/serial/zte_ev.c
index fca4c752a4ed..eae2c873b39f 100644
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -281,8 +281,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x19d2, 0xfffd) },
         { USB_DEVICE(0x19d2, 0xfffc) },
         { USB_DEVICE(0x19d2, 0xfffb) },
-        /* AC2726, AC8710_V3 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfff1, 0xff, 0xff, 0xff) },
+        /* AC8710_V3 */
         { USB_DEVICE(0x19d2, 0xfff6) },
         { USB_DEVICE(0x19d2, 0xfff7) },
         { USB_DEVICE(0x19d2, 0xfff8) },
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index c444654fc33f..5c4a95b516cf 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -285,7 +285,7 @@ static void update_balloon_size(struct virtio_balloon *vb)
 {
         __le32 actual = cpu_to_le32(vb->num_pages);
 
-        virtio_cwrite(vb->vdev, struct virtio_balloon_config, num_pages,
+        virtio_cwrite(vb->vdev, struct virtio_balloon_config, actual,
                       &actual);
 }
 
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 55ea73f7c70b..4c02e2b94103 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -350,17 +350,19 @@ static enum bp_state increase_reservation(unsigned long nr_pages)
 
                 pfn = page_to_pfn(page);
 
-                set_phys_to_machine(pfn, frame_list[i]);
-
 #ifdef CONFIG_XEN_HAVE_PVMMU
-                /* Link back into the page tables if not highmem. */
-                if (xen_pv_domain() && !PageHighMem(page)) {
-                        int ret;
-                        ret = HYPERVISOR_update_va_mapping(
-                                (unsigned long)__va(pfn << PAGE_SHIFT),
-                                mfn_pte(frame_list[i], PAGE_KERNEL),
-                                0);
-                        BUG_ON(ret);
+                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+                        set_phys_to_machine(pfn, frame_list[i]);
+
+                        /* Link back into the page tables if not highmem. */
+                        if (!PageHighMem(page)) {
+                                int ret;
+                                ret = HYPERVISOR_update_va_mapping(
+                                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                                mfn_pte(frame_list[i], PAGE_KERNEL),
+                                                0);
+                                BUG_ON(ret);
+                        }
                 }
 #endif
 
@@ -378,7 +380,6 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
         enum bp_state state = BP_DONE;
         unsigned long  pfn, i;
         struct page   *page;
-        struct page   *scratch_page;
         int ret;
         struct xen_memory_reservation reservation = {
                 .address_bits = 0,
@@ -411,27 +412,29 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 
                 scrub_page(page);
 
+#ifdef CONFIG_XEN_HAVE_PVMMU
                 /*
                  * Ballooned out frames are effectively replaced with
                  * a scratch frame.  Ensure direct mappings and the
                  * p2m are consistent.
                  */
-                scratch_page = get_balloon_scratch_page();
-#ifdef CONFIG_XEN_HAVE_PVMMU
-                if (xen_pv_domain() && !PageHighMem(page)) {
-                        ret = HYPERVISOR_update_va_mapping(
-                                (unsigned long)__va(pfn << PAGE_SHIFT),
-                                pfn_pte(page_to_pfn(scratch_page),
-                                        PAGE_KERNEL_RO), 0);
-                        BUG_ON(ret);
-                }
-#endif
                 if (!xen_feature(XENFEAT_auto_translated_physmap)) {
                         unsigned long p;
+                        struct page   *scratch_page = get_balloon_scratch_page();
+
+                        if (!PageHighMem(page)) {
+                                ret = HYPERVISOR_update_va_mapping(
+                                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                                pfn_pte(page_to_pfn(scratch_page),
+                                                        PAGE_KERNEL_RO), 0);
+                                BUG_ON(ret);
+                        }
                         p = page_to_pfn(scratch_page);
                         __set_phys_to_machine(pfn, pfn_to_mfn(p));
+
+                        put_balloon_scratch_page();
                 }
-                put_balloon_scratch_page();
+#endif
 
                 balloon_append(pfn_to_page(pfn));
         }
@@ -627,15 +630,17 @@ static int __init balloon_init(void)
         if (!xen_domain())
                 return -ENODEV;
 
-        for_each_online_cpu(cpu)
-        {
-                per_cpu(balloon_scratch_page, cpu) = alloc_page(GFP_KERNEL);
-                if (per_cpu(balloon_scratch_page, cpu) == NULL) {
-                        pr_warn("Failed to allocate balloon_scratch_page for cpu %d\n", cpu);
-                        return -ENOMEM;
+        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+                for_each_online_cpu(cpu)
+                {
+                        per_cpu(balloon_scratch_page, cpu) = alloc_page(GFP_KERNEL);
+                        if (per_cpu(balloon_scratch_page, cpu) == NULL) {
+                                pr_warn("Failed to allocate balloon_scratch_page for cpu %d\n", cpu);
+                                return -ENOMEM;
+                        }
                 }
+                register_cpu_notifier(&balloon_cpu_notifier);
         }
-        register_cpu_notifier(&balloon_cpu_notifier);
 
         pr_info("Initialising balloon driver\n");
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 028387192b60..aa846a48f400 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1176,7 +1176,8 @@ static int gnttab_setup(void)
                 gnttab_shared.addr = xen_remap(xen_hvm_resume_frames,
                                                 PAGE_SIZE * max_nr_gframes);
                 if (gnttab_shared.addr == NULL) {
-                        pr_warn("Failed to ioremap gnttab share frames!\n");
+                        pr_warn("Failed to ioremap gnttab share frames (addr=0x%08lx)!\n",
+                                        xen_hvm_resume_frames);
                         return -ENOMEM;
                 }
         }
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 8e74590fa1bb..569a13b9e856 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -533,12 +533,17 @@ static void privcmd_close(struct vm_area_struct *vma)
 {
         struct page **pages = vma->vm_private_data;
         int numpgs = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        int rc;
 
         if (!xen_feature(XENFEAT_auto_translated_physmap) || !numpgs || !pages)
                 return;
 
-        xen_unmap_domain_mfn_range(vma, numpgs, pages);
-        free_xenballooned_pages(numpgs, pages);
+        rc = xen_unmap_domain_mfn_range(vma, numpgs, pages);
+        if (rc == 0)
+                free_xenballooned_pages(numpgs, pages);
+        else
+                pr_crit("unable to unmap MFN range: leaking %d pages. rc=%d\n",
+                        numpgs, rc);
         kfree(pages);
 }