Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	drivers/net/ethernet/emulex/benet/be_main.c
	net/core/sysctl_net_core.c
	net/ipv4/inet_diag.c

The be_main.c conflict resolution was really tricky.  The conflict
hunks generated by GIT were very unhelpful, to say the least.  It
split functions in half and moved them around, when the real actual
conflict only existed solely inside of one function, that being
be_map_pci_bars().

So instead, to resolve this, I checked out be_main.c from the top
of net-next, then I applied the be_main.c changes from 'net' since
the last time I merged.  And this worked beautifully.

The inet_diag.c and sysctl_net_core.c conflicts were simple
overlapping changes, and were easily to resolve.

Signed-off-by: David S. Miller <davem@davemloft.net>

107 files changed, 1822 insertions, 1030 deletions

diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 657964e8ab7e..37fb19047603 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -65,6 +65,7 @@ struct lpss_private_data;
 
 struct lpss_device_desc {
         unsigned int flags;
+        const char *clk_con_id;
         unsigned int prv_offset;
         size_t prv_size_override;
         void (*setup)(struct lpss_private_data *pdata);
@@ -140,6 +141,7 @@ static struct lpss_device_desc lpt_i2c_dev_desc = {
 
 static struct lpss_device_desc lpt_uart_dev_desc = {
         .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_LTR,
+        .clk_con_id = "baudclk",
         .prv_offset = 0x800,
         .setup = lpss_uart_setup,
 };
@@ -156,6 +158,7 @@ static struct lpss_device_desc byt_pwm_dev_desc = {
 
 static struct lpss_device_desc byt_uart_dev_desc = {
         .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
+        .clk_con_id = "baudclk",
         .prv_offset = 0x800,
         .setup = lpss_uart_setup,
 };
@@ -313,7 +316,7 @@ out:
                 return PTR_ERR(clk);
 
         pdata->clk = clk;
-        clk_register_clkdev(clk, NULL, devname);
+        clk_register_clkdev(clk, dev_desc->clk_con_id, devname);
         return 0;
 }
 
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index d453a2c98ad0..81751a49d8bf 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -307,7 +307,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
         if (pos == 0) {
                 memmove(blk + offset * map->cache_word_size,
                         blk, rbnode->blklen * map->cache_word_size);
-                bitmap_shift_right(present, present, offset, blklen);
+                bitmap_shift_left(present, present, offset, blklen);
         }
 
         /* update the rbnode block, its size and the base register */
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index f373c35f9e1d..da84f544c544 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -608,7 +608,8 @@ static int regcache_sync_block_single(struct regmap *map, void *block,
         for (i = start; i < end; i++) {
                 regtmp = block_base + (i * map->reg_stride);
 
-                if (!regcache_reg_present(cache_present, i))
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp))
                         continue;
 
                 val = regcache_get_val(map, block, i);
@@ -677,7 +678,8 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
         for (i = start; i < end; i++) {
                 regtmp = block_base + (i * map->reg_stride);
 
-                if (!regcache_reg_present(cache_present, i)) {
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp)) {
                         ret = regcache_sync_block_raw_flush(map, &data,
                                                             base, regtmp);
                         if (ret != 0)
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 6299a50a5960..a6c3f75b4b01 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -499,7 +499,8 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
                 goto err_alloc;
         }
 
-        ret = request_threaded_irq(irq, NULL, regmap_irq_thread, irq_flags,
+        ret = request_threaded_irq(irq, NULL, regmap_irq_thread,
+                                   irq_flags | IRQF_ONESHOT,
                                    chip->name, d);
         if (ret != 0) {
                 dev_err(map->dev, "Failed to request IRQ %d for %s: %d\n",
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index fae2dbbf5745..72d7028f779b 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -142,6 +142,7 @@ struct ports_device {
          * notification
          */
         struct work_struct control_work;
+        struct work_struct config_work;
 
         struct list_head ports;
 
@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_device *vdev)
 
         portdev = vdev->priv;
 
+        if (!use_multiport(portdev))
+                schedule_work(&portdev->config_work);
+}
+
+static void config_work_handler(struct work_struct *work)
+{
+        struct ports_device *portdev;
+
+        portdev = container_of(work, struct ports_device, control_work);
         if (!use_multiport(portdev)) {
+                struct virtio_device *vdev;
                 struct port *port;
                 u16 rows, cols;
 
+                vdev = portdev->vdev;
                 virtio_cread(vdev, struct virtio_console_config, cols, &cols);
                 virtio_cread(vdev, struct virtio_console_config, rows, &rows);
 
@@ -2040,12 +2052,14 @@ static int virtcons_probe(struct virtio_device *vdev)
 
         virtio_device_ready(portdev->vdev);
 
+        INIT_WORK(&portdev->config_work, &config_work_handler);
+        INIT_WORK(&portdev->control_work, &control_work_handler);
+
         if (multiport) {
                 unsigned int nr_added_bufs;
 
                 spin_lock_init(&portdev->c_ivq_lock);
                 spin_lock_init(&portdev->c_ovq_lock);
-                INIT_WORK(&portdev->control_work, &control_work_handler);
 
                 nr_added_bufs = fill_queue(portdev->c_ivq,
                                            &portdev->c_ivq_lock);
@@ -2113,6 +2127,8 @@ static void virtcons_remove(struct virtio_device *vdev)
         /* Finish up work that's lined up */
         if (use_multiport(portdev))
                 cancel_work_sync(&portdev->control_work);
+        else
+                cancel_work_sync(&portdev->config_work);
 
         list_for_each_entry_safe(port, port2, &portdev->ports, list)
                 unplug_port(port);
@@ -2164,6 +2180,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
 
         virtqueue_disable_cb(portdev->c_ivq);
         cancel_work_sync(&portdev->control_work);
+        cancel_work_sync(&portdev->config_work);
         /*
          * Once more: if control_work_handler() was running, it would
          * enable the cb as the last step.
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index db7f8bce7467..25006a8bb8e6 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -144,12 +144,6 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw,
                                    divider->flags);
 }
 
-/*
- * The reverse of DIV_ROUND_UP: The maximum number which
- * divided by m is r
- */
-#define MULT_ROUND_UP(r, m) ((r) * (m) + (m) - 1)
-
 static bool _is_valid_table_div(const struct clk_div_table *table,
                                                          unsigned int div)
 {
@@ -225,19 +219,24 @@ static int _div_round_closest(const struct clk_div_table *table,
                               unsigned long parent_rate, unsigned long rate,
                               unsigned long flags)
 {
-        int up, down, div;
+        int up, down;
+        unsigned long up_rate, down_rate;
 
-        up = down = div = DIV_ROUND_CLOSEST(parent_rate, rate);
+        up = DIV_ROUND_UP(parent_rate, rate);
+        down = parent_rate / rate;
 
         if (flags & CLK_DIVIDER_POWER_OF_TWO) {
-                up = __roundup_pow_of_two(div);
-                down = __rounddown_pow_of_two(div);
+                up = __roundup_pow_of_two(up);
+                down = __rounddown_pow_of_two(down);
         } else if (table) {
-                up = _round_up_table(table, div);
-                down = _round_down_table(table, div);
+                up = _round_up_table(table, up);
+                down = _round_down_table(table, down);
         }
 
-        return (up - div) <= (div - down) ? up : down;
+        up_rate = DIV_ROUND_UP(parent_rate, up);
+        down_rate = DIV_ROUND_UP(parent_rate, down);
+
+        return (rate - up_rate) <= (down_rate - rate) ? up : down;
 }
 
 static int _div_round(const struct clk_div_table *table,
@@ -313,7 +312,7 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
                         return i;
                 }
                 parent_rate = __clk_round_rate(__clk_get_parent(hw->clk),
-                                MULT_ROUND_UP(rate, i));
+                                               rate * i);
                 now = DIV_ROUND_UP(parent_rate, i);
                 if (_is_best_div(rate, now, best, flags)) {
                         bestdiv = i;
@@ -353,7 +352,7 @@ static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate,
                 bestdiv = readl(divider->reg) >> divider->shift;
                 bestdiv &= div_mask(divider->width);
                 bestdiv = _get_div(divider->table, bestdiv, divider->flags);
-                return bestdiv;
+                return DIV_ROUND_UP(*prate, bestdiv);
         }
 
         return divider_round_rate(hw, rate, prate, divider->table,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index eb0152961d3c..237f23f68bfc 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1350,7 +1350,6 @@ static unsigned long clk_core_get_rate(struct clk_core *clk)
 
         return rate;
 }
-EXPORT_SYMBOL_GPL(clk_core_get_rate);
 
 /**
  * clk_get_rate - return the rate of clk
@@ -2171,6 +2170,32 @@ int clk_get_phase(struct clk *clk)
 }
 
 /**
+ * clk_is_match - check if two clk's point to the same hardware clock
+ * @p: clk compared against q
+ * @q: clk compared against p
+ *
+ * Returns true if the two struct clk pointers both point to the same hardware
+ * clock node. Put differently, returns true if struct clk *p and struct clk *q
+ * share the same struct clk_core object.
+ *
+ * Returns false otherwise. Note that two NULL clks are treated as matching.
+ */
+bool clk_is_match(const struct clk *p, const struct clk *q)
+{
+        /* trivial case: identical struct clk's or both NULL */
+        if (p == q)
+                return true;
+
+        /* true if clk->core pointers match. Avoid derefing garbage */
+        if (!IS_ERR_OR_NULL(p) && !IS_ERR_OR_NULL(q))
+                if (p->core == q->core)
+                        return true;
+
+        return false;
+}
+EXPORT_SYMBOL_GPL(clk_is_match);
+
+/**
  * __clk_init - initialize the data structures in a struct clk
  * @dev:        device initializing this clk, placeholder for now
  * @clk:        clk being initialized
diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c
index b0b562b9ce0e..e60feffc10a1 100644
--- a/drivers/clk/qcom/gcc-msm8960.c
+++ b/drivers/clk/qcom/gcc-msm8960.c
@@ -48,6 +48,17 @@ static struct clk_pll pll3 = {
         },
 };
 
+static struct clk_regmap pll4_vote = {
+        .enable_reg = 0x34c0,
+        .enable_mask = BIT(4),
+        .hw.init = &(struct clk_init_data){
+                .name = "pll4_vote",
+                .parent_names = (const char *[]){ "pll4" },
+                .num_parents = 1,
+                .ops = &clk_pll_vote_ops,
+        },
+};
+
 static struct clk_pll pll8 = {
         .l_reg = 0x3144,
         .m_reg = 0x3148,
@@ -3023,6 +3034,7 @@ static struct clk_branch rpm_msg_ram_h_clk = {
 
 static struct clk_regmap *gcc_msm8960_clks[] = {
         [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
         [PLL8] = &pll8.clkr,
         [PLL8_VOTE] = &pll8_vote,
         [PLL14] = &pll14.clkr,
@@ -3247,6 +3259,7 @@ static const struct qcom_reset_map gcc_msm8960_resets[] = {
 
 static struct clk_regmap *gcc_apq8064_clks[] = {
         [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
         [PLL8] = &pll8.clkr,
         [PLL8_VOTE] = &pll8_vote,
         [PLL14] = &pll14.clkr,
diff --git a/drivers/clk/qcom/lcc-ipq806x.c b/drivers/clk/qcom/lcc-ipq806x.c
index 121ffde25dc3..c9ff27b4648b 100644
--- a/drivers/clk/qcom/lcc-ipq806x.c
+++ b/drivers/clk/qcom/lcc-ipq806x.c
@@ -462,7 +462,6 @@ static struct platform_driver lcc_ipq806x_driver = {
         .remove         = lcc_ipq806x_remove,
         .driver         = {
                 .name   = "lcc-ipq806x",
-                .owner  = THIS_MODULE,
                 .of_match_table = lcc_ipq806x_match_table,
         },
 };
diff --git a/drivers/clk/qcom/lcc-msm8960.c b/drivers/clk/qcom/lcc-msm8960.c
index a75a408cfccd..e2c863295f00 100644
--- a/drivers/clk/qcom/lcc-msm8960.c
+++ b/drivers/clk/qcom/lcc-msm8960.c
@@ -417,8 +417,8 @@ static struct clk_rcg slimbus_src = {
                 .mnctr_en_bit = 8,
                 .mnctr_reset_bit = 7,
                 .mnctr_mode_shift = 5,
-                .n_val_shift = 16,
-                .m_val_shift = 16,
+                .n_val_shift = 24,
+                .m_val_shift = 8,
                 .width = 8,
         },
         .p = {
@@ -547,7 +547,7 @@ static int lcc_msm8960_probe(struct platform_device *pdev)
                 return PTR_ERR(regmap);
 
         /* Use the correct frequency plan depending on speed of PLL4 */
-        val = regmap_read(regmap, 0x4, &val);
+        regmap_read(regmap, 0x4, &val);
         if (val == 0x12) {
                 slimbus_src.freq_tbl = clk_tbl_aif_osr_492;
                 mi2s_osr_src.freq_tbl = clk_tbl_aif_osr_492;
@@ -574,7 +574,6 @@ static struct platform_driver lcc_msm8960_driver = {
         .remove         = lcc_msm8960_remove,
         .driver         = {
                 .name   = "lcc-msm8960",
-                .owner  = THIS_MODULE,
                 .of_match_table = lcc_msm8960_match_table,
         },
 };
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 6ef89639a9f6..d21640634adf 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -84,7 +84,7 @@ static int ti_fapll_enable(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        v |= (1 << FAPLL_MAIN_PLLEN);
+        v |= FAPLL_MAIN_PLLEN;
         writel_relaxed(v, fd->base);
 
         return 0;
@@ -95,7 +95,7 @@ static void ti_fapll_disable(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        v &= ~(1 << FAPLL_MAIN_PLLEN);
+        v &= ~FAPLL_MAIN_PLLEN;
         writel_relaxed(v, fd->base);
 }
 
@@ -104,7 +104,7 @@ static int ti_fapll_is_enabled(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        return v & (1 << FAPLL_MAIN_PLLEN);
+        return v & FAPLL_MAIN_PLLEN;
 }
 
 static unsigned long ti_fapll_recalc_rate(struct clk_hw *hw,
diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
index bba62f9deefb..ec57ba2bbd87 100644
--- a/drivers/clocksource/time-efm32.c
+++ b/drivers/clocksource/time-efm32.c
@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
         clock_event_ddata.base = base;
         clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
 
-        setup_irq(irq, &efm32_clock_event_irq);
-
         clockevents_config_and_register(&clock_event_ddata.evtdev,
                                         DIV_ROUND_CLOSEST(rate, 1024),
                                         0xf, 0xffff);
 
+        setup_irq(irq, &efm32_clock_event_irq);
+
         return 0;
 
 err_get_irq:
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 02268448dc85..5dcbf90b8015 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -178,10 +178,6 @@ static void __init sun5i_timer_init(struct device_node *node)
 
         ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
 
-        ret = setup_irq(irq, &sun5i_timer_irq);
-        if (ret)
-                pr_warn("failed to setup irq %d\n", irq);
-
         /* Enable timer0 interrupt */
         val = readl(timer_base + TIMER_IRQ_EN_REG);
         writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
@@ -191,6 +187,10 @@ static void __init sun5i_timer_init(struct device_node *node)
 
         clockevents_config_and_register(&sun5i_clockevent, rate,
                                         TIMER_SYNC_TICKS, 0xffffffff);
+
+        ret = setup_irq(irq, &sun5i_timer_irq);
+        if (ret)
+                pr_warn("failed to setup irq %d\n", irq);
 }
 CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
                        sun5i_timer_init);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 6b6b07ff720b..f6d04c7b5115 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -43,9 +43,10 @@
 #include "drm_crtc_internal.h"
 #include "drm_internal.h"
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-                                                        struct drm_mode_fb_cmd2 *r,
-                                                        struct drm_file *file_priv);
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv);
 
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)                          \
@@ -2908,13 +2909,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
          */
         if (req->flags & DRM_MODE_CURSOR_BO) {
                 if (req->handle) {
-                        fb = add_framebuffer_internal(dev, &fbreq, file_priv);
+                        fb = internal_framebuffer_create(dev, &fbreq, file_priv);
                         if (IS_ERR(fb)) {
                                 DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
                                 return PTR_ERR(fb);
                         }
-
-                        drm_framebuffer_reference(fb);
                 } else {
                         fb = NULL;
                 }
@@ -3267,9 +3266,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
         return 0;
 }
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-                                                        struct drm_mode_fb_cmd2 *r,
-                                                        struct drm_file *file_priv)
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv)
 {
         struct drm_mode_config *config = &dev->mode_config;
         struct drm_framebuffer *fb;
@@ -3301,12 +3301,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
                 return fb;
         }
 
-        mutex_lock(&file_priv->fbs_lock);
-        r->fb_id = fb->base.id;
-        list_add(&fb->filp_head, &file_priv->fbs);
-        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-        mutex_unlock(&file_priv->fbs_lock);
-
         return fb;
 }
 
@@ -3328,15 +3322,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
 int drm_mode_addfb2(struct drm_device *dev,
                     void *data, struct drm_file *file_priv)
 {
+        struct drm_mode_fb_cmd2 *r = data;
         struct drm_framebuffer *fb;
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        fb = add_framebuffer_internal(dev, data, file_priv);
+        fb = internal_framebuffer_create(dev, r, file_priv);
         if (IS_ERR(fb))
                 return PTR_ERR(fb);
 
+        /* Transfer ownership to the filp for reaping on close */
+
+        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+        mutex_lock(&file_priv->fbs_lock);
+        r->fb_id = fb->base.id;
+        list_add(&fb->filp_head, &file_priv->fbs);
+        mutex_unlock(&file_priv->fbs_lock);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 9a5b68717ec8..379ab4555756 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -733,10 +733,14 @@ static bool check_txmsg_state(struct drm_dp_mst_topology_mgr *mgr,
                               struct drm_dp_sideband_msg_tx *txmsg)
 {
         bool ret;
-        mutex_lock(&mgr->qlock);
+
+        /*
+         * All updates to txmsg->state are protected by mgr->qlock, and the two
+         * cases we check here are terminal states. For those the barriers
+         * provided by the wake_up/wait_event pair are enough.
+         */
         ret = (txmsg->state == DRM_DP_SIDEBAND_TX_RX ||
                txmsg->state == DRM_DP_SIDEBAND_TX_TIMEOUT);
-        mutex_unlock(&mgr->qlock);
         return ret;
 }
 
@@ -1363,12 +1367,13 @@ static int process_single_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
         return 0;
 }
 
-/* must be called holding qlock */
 static void process_single_down_tx_qlock(struct drm_dp_mst_topology_mgr *mgr)
 {
         struct drm_dp_sideband_msg_tx *txmsg;
         int ret;
 
+        WARN_ON(!mutex_is_locked(&mgr->qlock));
+
         /* construct a chunk from the first msg in the tx_msg queue */
         if (list_empty(&mgr->tx_msg_downq)) {
                 mgr->tx_down_in_progress = false;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 7fc6f8bd4821..1134526286c8 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -403,7 +403,7 @@ static int check_free_hole(u64 start, u64 end, u64 size, unsigned alignment)
                 unsigned rem;
 
                 rem = do_div(tmp, alignment);
-                if (tmp)
+                if (rem)
                         start += alignment - rem;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index e5daad5f75fb..5b205863b659 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2936,9 +2936,9 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
         req = obj->last_read_req;
 
         /* Do this after OLR check to make sure we make forward progress polling
-         * on this IOCTL with a timeout <=0 (like busy ioctl)
+         * on this IOCTL with a timeout == 0 (like busy ioctl)
          */
-        if (args->timeout_ns <= 0) {
+        if (args->timeout_ns == 0) {
                 ret = -ETIME;
                 goto out;
         }
@@ -2948,7 +2948,8 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
         i915_gem_request_reference(req);
         mutex_unlock(&dev->struct_mutex);
 
-        ret = __i915_wait_request(req, reset_counter, true, &args->timeout_ns,
+        ret = __i915_wait_request(req, reset_counter, true,
+                                  args->timeout_ns > 0 ? &args->timeout_ns : NULL,
                                   file->driver_priv);
         mutex_lock(&dev->struct_mutex);
         i915_gem_request_unreference(req);
@@ -4792,6 +4793,9 @@ i915_gem_init_hw(struct drm_device *dev)
         if (INTEL_INFO(dev)->gen < 6 && !intel_enable_gtt())
                 return -EIO;
 
+        /* Double layer security blanket, see i915_gem_init() */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
+
         if (dev_priv->ellc_size)
                 I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
 
@@ -4824,7 +4828,7 @@ i915_gem_init_hw(struct drm_device *dev)
         for_each_ring(ring, dev_priv, i) {
                 ret = ring->init_hw(ring);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
         for (i = 0; i < NUM_L3_SLICES(dev); i++)
@@ -4841,9 +4845,11 @@ i915_gem_init_hw(struct drm_device *dev)
                 DRM_ERROR("Context enable failed %d\n", ret);
                 i915_gem_cleanup_ringbuffer(dev);
 
-                return ret;
+                goto out;
         }
 
+out:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
         return ret;
 }
 
@@ -4877,6 +4883,14 @@ int i915_gem_init(struct drm_device *dev)
                 dev_priv->gt.stop_ring = intel_logical_ring_stop;
         }
 
+        /* This is just a security blanket to placate dragons.
+         * On some systems, we very sporadically observe that the first TLBs
+         * used by the CS may be stale, despite us poking the TLB reset. If
+         * we hold the forcewake during initialisation these problems
+         * just magically go away.
+         */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
+
         ret = i915_gem_init_userptr(dev);
         if (ret)
                 goto out_unlock;
@@ -4903,6 +4917,7 @@ int i915_gem_init(struct drm_device *dev)
         }
 
 out_unlock:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
         mutex_unlock(&dev->struct_mutex);
 
         return ret;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e730789b53b7..9943c20a741d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9716,7 +9716,7 @@ void intel_check_page_flip(struct drm_device *dev, int pipe)
         struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
 
-        WARN_ON(!in_irq());
+        WARN_ON(!in_interrupt());
 
         if (crtc == NULL)
                 return;
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index c47a3baa53d5..4e8fb891d4ea 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -1048,8 +1048,14 @@ static void intel_uncore_fw_domains_init(struct drm_device *dev)
 
                 /* We need to init first for ECOBUS access and then
                  * determine later if we want to reinit, in case of MT access is
-                 * not working
+                 * not working. In this stage we don't know which flavour this
+                 * ivb is, so it is better to reset also the gen6 fw registers
+                 * before the ecobus check.
                  */
+
+                __raw_i915_write32(dev_priv, FORCEWAKE, 0);
+                __raw_posting_read(dev_priv, ECOBUS);
+
                 fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER,
                                FORCEWAKE_MT, FORCEWAKE_MT_ACK);
 
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index d13d1b5a859f..df09ca7c4889 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(struct radeon_fence *fence)
         return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
 }
 
+struct radeon_wait_cb {
+        struct fence_cb base;
+        struct task_struct *task;
+};
+
+static void
+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
+{
+        struct radeon_wait_cb *wait =
+                container_of(cb, struct radeon_wait_cb, base);
+
+        wake_up_process(wait->task);
+}
+
 static signed long radeon_fence_default_wait(struct fence *f, bool intr,
                                              signed long t)
 {
         struct radeon_fence *fence = to_radeon_fence(f);
         struct radeon_device *rdev = fence->rdev;
-        bool signaled;
+        struct radeon_wait_cb cb;
 
-        fence_enable_sw_signaling(&fence->base);
+        cb.task = current;
 
-        /*
-         * This function has to return -EDEADLK, but cannot hold
-         * exclusive_lock during the wait because some callers
-         * may already hold it. This means checking needs_reset without
-         * lock, and not fiddling with any gpu internals.
-         *
-         * The callback installed with fence_enable_sw_signaling will
-         * run before our wait_event_*timeout call, so we will see
-         * both the signaled fence and the changes to needs_reset.
-         */
+        if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
+                return t;
+
+        while (t > 0) {
+                if (intr)
+                        set_current_state(TASK_INTERRUPTIBLE);
+                else
+                        set_current_state(TASK_UNINTERRUPTIBLE);
+
+                /*
+                 * radeon_test_signaled must be called after
+                 * set_current_state to prevent a race with wake_up_process
+                 */
+                if (radeon_test_signaled(fence))
+                        break;
+
+                if (rdev->needs_reset) {
+                        t = -EDEADLK;
+                        break;
+                }
+
+                t = schedule_timeout(t);
+
+                if (t > 0 && intr && signal_pending(current))
+                        t = -ERESTARTSYS;
+        }
+
+        __set_current_state(TASK_RUNNING);
+        fence_remove_callback(f, &cb.base);
 
-        if (intr)
-                t = wait_event_interruptible_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-        else
-                t = wait_event_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-
-        if (t > 0 && !signaled)
-                return -EDEADLK;
         return t;
 }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index e088e5558da0..a7fb2735d4a9 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -7130,8 +7130,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
         WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
 
         if (!vclk || !dclk) {
-                /* keep the Bypass mode, put PLL to sleep */
-                WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+                /* keep the Bypass mode */
                 return 0;
         }
 
@@ -7147,8 +7146,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
         /* set VCO_MODE to 1 */
         WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
 
-        /* toggle UPLL_SLEEP to 1 then back to 0 */
-        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+        /* disable sleep mode */
         WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
 
         /* deassert UPLL_RESET */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 6c6b655defcf..e13b9cbc304e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_err1;
         }
 
-        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-                             (dev_priv->vram_size >> PAGE_SHIFT));
-        if (unlikely(ret != 0)) {
-                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-                goto out_err2;
-        }
-
-        dev_priv->has_gmr = true;
-        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-                                         VMW_PL_GMR) != 0) {
-                DRM_INFO("No GMR memory available. "
-                         "Graphics memory resources are very limited.\n");
-                dev_priv->has_gmr = false;
-        }
-
-        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-                dev_priv->has_mob = true;
-                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-                                   VMW_PL_MOB) != 0) {
-                        DRM_INFO("No MOB memory available. "
-                                 "3D will be disabled.\n");
-                        dev_priv->has_mob = false;
-                }
-        }
-
         dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
                                                dev_priv->mmio_size);
 
@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_no_fman;
         }
 
+
+        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+                             (dev_priv->vram_size >> PAGE_SHIFT));
+        if (unlikely(ret != 0)) {
+                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+                goto out_no_vram;
+        }
+
+        dev_priv->has_gmr = true;
+        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
+            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+                                         VMW_PL_GMR) != 0) {
+                DRM_INFO("No GMR memory available. "
+                         "Graphics memory resources are very limited.\n");
+                dev_priv->has_gmr = false;
+        }
+
+        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
+                dev_priv->has_mob = true;
+                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
+                                   VMW_PL_MOB) != 0) {
+                        DRM_INFO("No MOB memory available. "
+                                 "3D will be disabled.\n");
+                        dev_priv->has_mob = false;
+                }
+        }
+
         vmw_kms_save_vga(dev_priv);
 
         /* Start kms and overlay systems, needs fifo. */
@@ -838,6 +839,12 @@ out_no_fifo:
         vmw_kms_close(dev_priv);
 out_no_kms:
         vmw_kms_restore_vga(dev_priv);
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+out_no_vram:
         vmw_fence_manager_takedown(dev_priv->fman);
 out_no_fman:
         if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
@@ -853,12 +860,6 @@ out_err4:
         iounmap(dev_priv->mmio_virt);
 out_err3:
         arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-out_err2:
         (void)ttm_bo_device_release(&dev_priv->bdev);
 out_err1:
         vmw_ttm_global_release(dev_priv);
@@ -887,6 +888,13 @@ static int vmw_driver_unload(struct drm_device *dev)
         }
         vmw_kms_close(dev_priv);
         vmw_overlay_close(dev_priv);
+
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+
         vmw_fence_manager_takedown(dev_priv->fman);
         if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
                 drm_irq_uninstall(dev_priv->dev);
@@ -898,11 +906,6 @@ static int vmw_driver_unload(struct drm_device *dev)
         ttm_object_device_release(&dev_priv->tdev);
         iounmap(dev_priv->mmio_virt);
         arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
         (void)ttm_bo_device_release(&dev_priv->bdev);
         vmw_ttm_global_release(dev_priv);
 
@@ -1235,6 +1238,7 @@ static void vmw_remove(struct pci_dev *pdev)
 {
         struct drm_device *dev = pci_get_drvdata(pdev);
 
+        pci_disable_device(pdev);
         drm_put_dev(dev);
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 33176d05db35..654c8daeb5ab 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -890,7 +890,8 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
         ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use MOB buffer.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
         }
         bo = &vmw_bo->base;
 
@@ -914,7 +915,7 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
 
 out_no_reloc:
         vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
         return ret;
 }
 
@@ -951,7 +952,8 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
         ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use GMR region.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
         }
         bo = &vmw_bo->base;
 
@@ -974,7 +976,7 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
 
 out_no_reloc:
         vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
         return ret;
 }
 
@@ -2780,13 +2782,11 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
                                   NULL, arg->command_size, arg->throttle_us,
                                   (void __user *)(unsigned long)arg->fence_rep,
                                   NULL);
-
+        ttm_read_unlock(&dev_priv->reservation_sem);
         if (unlikely(ret != 0))
-                goto out_unlock;
+                return ret;
 
         vmw_kms_cursor_post_execbuf(dev_priv);
 
-out_unlock:
-        ttm_read_unlock(&dev_priv->reservation_sem);
-        return ret;
+        return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 8725b79e7847..07cda8cbbddb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
         int i;
         struct drm_mode_config *mode_config = &dev->mode_config;
 
-        ret = ttm_read_lock(&dev_priv->reservation_sem, true);
-        if (unlikely(ret != 0))
-                return ret;
-
         if (!arg->num_outputs) {
                 struct drm_vmw_rect def_rect = {0, 0, 800, 600};
                 vmw_du_update_layout(dev_priv, 1, &def_rect);
-                goto out_unlock;
+                return 0;
         }
 
         rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
         rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
                         GFP_KERNEL);
-        if (unlikely(!rects)) {
-                ret = -ENOMEM;
-                goto out_unlock;
-        }
+        if (unlikely(!rects))
+                return -ENOMEM;
 
         user_rects = (void __user *)(unsigned long)arg->rects;
         ret = copy_from_user(rects, user_rects, rects_size);
@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
 
 out_free:
         kfree(rects);
-out_unlock:
-        ttm_read_unlock(&dev_priv->reservation_sem);
         return ret;
 }
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 7c669c328c4c..56ce8c2b5530 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1959,6 +1959,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 204312bfab2c..9c4786759f16 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -586,6 +586,7 @@
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
 #define USB_DEVICE_ID_LOGITECH_T651     0xb00c
+#define USB_DEVICE_ID_LOGITECH_C077     0xc007
 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
@@ -898,6 +899,7 @@
 #define USB_VENDOR_ID_TIVO              0x150a
 #define USB_DEVICE_ID_TIVO_SLIDE_BT     0x1200
 #define USB_DEVICE_ID_TIVO_SLIDE        0x1201
+#define USB_DEVICE_ID_TIVO_SLIDE_PRO    0x1203
 
 #define USB_VENDOR_ID_TOPSEED           0x0766
 #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204
diff --git a/drivers/hid/hid-tivo.c b/drivers/hid/hid-tivo.c
index d790d8d71f7f..d98696927453 100644
--- a/drivers/hid/hid-tivo.c
+++ b/drivers/hid/hid-tivo.c
@@ -64,6 +64,7 @@ static const struct hid_device_id tivo_devices[] = {
         /* TiVo Slide Bluetooth remote, pairs with a Broadcom dongle */
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, tivo_devices);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 9be99a67bfe2..a82127753461 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -78,6 +78,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 046351cf17f3..bbe32d66e500 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -551,9 +551,13 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
            (features->type == CINTIQ && !(data[1] & 0x40)))
                 return 1;
 
-        if (features->quirks & WACOM_QUIRK_MULTI_INPUT)
+        if (wacom->shared) {
                 wacom->shared->stylus_in_proximity = true;
 
+                if (wacom->shared->touch_down)
+                        return 1;
+        }
+
         /* in Range while exiting */
         if (((data[1] & 0xfe) == 0x20) && wacom->reporting_data) {
                 input_report_key(input, BTN_TOUCH, 0);
@@ -1043,27 +1047,28 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
         struct input_dev *input = wacom->input;
         unsigned char *data = wacom->data;
         int i;
-        int current_num_contacts = 0;
+        int current_num_contacts = data[61];
         int contacts_to_send = 0;
         int num_contacts_left = 4; /* maximum contacts per packet */
         int byte_per_packet = WACOM_BYTES_PER_24HDT_PACKET;
         int y_offset = 2;
+        static int contact_with_no_pen_down_count = 0;
 
         if (wacom->features.type == WACOM_27QHDT) {
                 current_num_contacts = data[63];
                 num_contacts_left = 10;
                 byte_per_packet = WACOM_BYTES_PER_QHDTHID_PACKET;
                 y_offset = 0;
-        } else {
-                current_num_contacts = data[61];
         }
 
         /*
          * First packet resets the counter since only the first
          * packet in series will have non-zero current_num_contacts.
          */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                 wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
 
         contacts_to_send = min(num_contacts_left, wacom->num_contacts_left);
 
@@ -1096,15 +1101,16 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
                                 input_report_abs(input, ABS_MT_WIDTH_MINOR, min(w, h));
                                 input_report_abs(input, ABS_MT_ORIENTATION, w > h);
                         }
+                        contact_with_no_pen_down_count++;
                 }
         }
         input_mt_report_pointer_emulation(input, true);
 
         wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left <= 0)
+        if (wacom->num_contacts_left <= 0) {
                 wacom->num_contacts_left = 0;
-
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
+        }
         return 1;
 }
 
@@ -1116,6 +1122,7 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
         int current_num_contacts = data[2];
         int contacts_to_send = 0;
         int x_offset = 0;
+        static int contact_with_no_pen_down_count = 0;
 
         /* MTTPC does not support Height and Width */
         if (wacom->features.type == MTTPC || wacom->features.type == MTTPC_B)
@@ -1125,8 +1132,10 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
          * First packet resets the counter since only the first
          * packet in series will have non-zero current_num_contacts.
          */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                 wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
 
         /* There are at most 5 contacts per packet */
         contacts_to_send = min(5, wacom->num_contacts_left);
@@ -1147,15 +1156,16 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
                         int y = get_unaligned_le16(&data[offset + x_offset + 9]);
                         input_report_abs(input, ABS_MT_POSITION_X, x);
                         input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                 }
         }
         input_mt_report_pointer_emulation(input, true);
 
         wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left < 0)
+        if (wacom->num_contacts_left <= 0) {
                 wacom->num_contacts_left = 0;
-
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
+        }
         return 1;
 }
 
@@ -1193,29 +1203,25 @@ static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 {
         unsigned char *data = wacom->data;
         struct input_dev *input = wacom->input;
-        bool prox;
+        bool prox = !wacom->shared->stylus_in_proximity;
         int x = 0, y = 0;
 
         if (wacom->features.touch_max > 1 || len > WACOM_PKGLEN_TPC2FG)
                 return 0;
 
-        if (!wacom->shared->stylus_in_proximity) {
-                if (len == WACOM_PKGLEN_TPC1FG) {
-                        prox = data[0] & 0x01;
-                        x = get_unaligned_le16(&data[1]);
-                        y = get_unaligned_le16(&data[3]);
-                } else if (len == WACOM_PKGLEN_TPC1FG_B) {
-                        prox = data[2] & 0x01;
-                        x = get_unaligned_le16(&data[3]);
-                        y = get_unaligned_le16(&data[5]);
-                } else {
-                        prox = data[1] & 0x01;
-                        x = le16_to_cpup((__le16 *)&data[2]);
-                        y = le16_to_cpup((__le16 *)&data[4]);
-                }
-        } else
-                /* force touch out when pen is in prox */
-                prox = 0;
+        if (len == WACOM_PKGLEN_TPC1FG) {
+                prox = prox && (data[0] & 0x01);
+                x = get_unaligned_le16(&data[1]);
+                y = get_unaligned_le16(&data[3]);
+        } else if (len == WACOM_PKGLEN_TPC1FG_B) {
+                prox = prox && (data[2] & 0x01);
+                x = get_unaligned_le16(&data[3]);
+                y = get_unaligned_le16(&data[5]);
+        } else {
+                prox = prox && (data[1] & 0x01);
+                x = le16_to_cpup((__le16 *)&data[2]);
+                y = le16_to_cpup((__le16 *)&data[4]);
+        }
 
         if (prox) {
                 input_report_abs(input, ABS_X, x);
@@ -1613,6 +1619,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
         struct input_dev *pad_input = wacom->pad_input;
         unsigned char *data = wacom->data;
         int i;
+        int contact_with_no_pen_down_count = 0;
 
         if (data[0] != 0x02)
             return 0;
@@ -1640,6 +1647,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
                         }
                         input_report_abs(input, ABS_MT_POSITION_X, x);
                         input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                 }
         }
 
@@ -1649,11 +1657,12 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
         input_report_key(pad_input, BTN_FORWARD, (data[1] & 0x04) != 0);
         input_report_key(pad_input, BTN_BACK, (data[1] & 0x02) != 0);
         input_report_key(pad_input, BTN_RIGHT, (data[1] & 0x01) != 0);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
 
         return 1;
 }
 
-static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
+static int wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data, int last_touch_count)
 {
         struct wacom_features *features = &wacom->features;
         struct input_dev *input = wacom->input;
@@ -1661,7 +1670,7 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
         int slot = input_mt_get_slot_by_key(input, data[0]);
 
         if (slot < 0)
-                return;
+                return 0;
 
         touch = touch && !wacom->shared->stylus_in_proximity;
 
@@ -1693,7 +1702,9 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
                 input_report_abs(input, ABS_MT_POSITION_Y, y);
                 input_report_abs(input, ABS_MT_TOUCH_MAJOR, width);
                 input_report_abs(input, ABS_MT_TOUCH_MINOR, height);
+                last_touch_count++;
         }
+        return last_touch_count;
 }
 
 static void wacom_bpt3_button_msg(struct wacom_wac *wacom, unsigned char *data)
@@ -1718,6 +1729,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
         unsigned char *data = wacom->data;
         int count = data[1] & 0x07;
         int i;
+        int contact_with_no_pen_down_count = 0;
 
         if (data[0] != 0x02)
             return 0;
@@ -1728,12 +1740,15 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
                 int msg_id = data[offset];
 
                 if (msg_id >= 2 && msg_id <= 17)
-                        wacom_bpt3_touch_msg(wacom, data + offset);
+                        contact_with_no_pen_down_count = 
+                            wacom_bpt3_touch_msg(wacom, data + offset,
+                                                 contact_with_no_pen_down_count);
                 else if (msg_id == 128)
                         wacom_bpt3_button_msg(wacom, data + offset);
 
         }
         input_mt_report_pointer_emulation(input, true);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
 
         return 1;
 }
@@ -1759,6 +1774,9 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
                 return 0;
         }
 
+        if (wacom->shared->touch_down)
+                return 0;
+
         prox = (data[1] & 0x20) == 0x20;
 
         /*
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 210cf4874cb7..edf274cabe81 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -679,9 +679,6 @@ static int i2c_device_remove(struct device *dev)
                 status = driver->remove(client);
         }
 
-        if (dev->of_node)
-                irq_dispose_mapping(client->irq);
-
         dev_pm_domain_detach(&client->dev, true);
         return status;
 }
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 1793aea4a7d2..6eb738ca6d2f 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -1793,11 +1793,11 @@ static void idetape_setup(ide_drive_t *drive, idetape_tape_t *tape, int minor)
         tape->best_dsc_rw_freq = clamp_t(unsigned long, t, IDETAPE_DSC_RW_MIN,
                                          IDETAPE_DSC_RW_MAX);
         printk(KERN_INFO "ide-tape: %s <-> %s: %dKBps, %d*%dkB buffer, "
-                "%lums tDSC%s\n",
+                "%ums tDSC%s\n",
                 drive->name, tape->name, *(u16 *)&tape->caps[14],
                 (*(u16 *)&tape->caps[16] * 512) / tape->buffer_size,
                 tape->buffer_size / 1024,
-                tape->best_dsc_rw_freq * 1000 / HZ,
+                jiffies_to_msecs(tape->best_dsc_rw_freq),
                 (drive->dev_flags & IDE_DFLAG_USING_DMA) ? ", DMA" : "");
 
         ide_proc_register_driver(drive, tape->driver);
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index c7619716c31d..59040265e361 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -64,6 +64,14 @@ enum {
 #define GUID_TBL_BLK_NUM_ENTRIES 8
 #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
 
+/* Counters should be saturate once they reach their maximum value */
+#define ASSIGN_32BIT_COUNTER(counter, value) do {\
+        if ((value) > U32_MAX)                   \
+                counter = cpu_to_be32(U32_MAX); \
+        else                                     \
+                counter = cpu_to_be32(value);    \
+} while (0)
+
 struct mlx4_mad_rcv_buf {
         struct ib_grh grh;
         u8 payload[256];
@@ -806,10 +814,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
 static void edit_counter(struct mlx4_counter *cnt,
                                         struct ib_pma_portcounters *pma_cnt)
 {
-        pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
-        pma_cnt->port_rcv_data  = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
-        pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
-        pma_cnt->port_rcv_packets  = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
+                             (be64_to_cpu(cnt->tx_bytes) >> 2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
+                             (be64_to_cpu(cnt->rx_bytes) >> 2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
+                             be64_to_cpu(cnt->tx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
+                             be64_to_cpu(cnt->rx_frames));
 }
 
 static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ac6e2b710ea6..b972c0b41799 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2697,8 +2697,12 @@ static void handle_bonded_port_state_event(struct work_struct *work)
         spin_lock_bh(&ibdev->iboe.lock);
         for (i = 0; i < MLX4_MAX_PORTS; ++i) {
                 struct net_device *curr_netdev = ibdev->iboe.netdevs[i];
+                enum ib_port_state curr_port_state;
 
-                enum ib_port_state curr_port_state =
+                if (!curr_netdev)
+                        continue;
+
+                curr_port_state =
                         (netif_running(curr_netdev) &&
                          netif_carrier_ok(curr_netdev)) ?
                         IB_PORT_ACTIVE : IB_PORT_DOWN;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index f2cceb6493a0..dda605836546 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -67,9 +67,6 @@
 #define X_MAX_POSITIVE 8176
 #define Y_MAX_POSITIVE 8176
 
-/* maximum ABS_MT_POSITION displacement (in mm) */
-#define DMAX 10
-
 /*****************************************************************************
  *      Stuff we need even when we do not want native Synaptics support
  ****************************************************************************/
@@ -123,32 +120,41 @@ void synaptics_reset(struct psmouse *psmouse)
 
 static bool cr48_profile_sensor;
 
+#define ANY_BOARD_ID 0
 struct min_max_quirk {
         const char * const *pnp_ids;
+        struct {
+                unsigned long int min, max;
+        } board_id;
         int x_min, x_max, y_min, y_max;
 };
 
 static const struct min_max_quirk min_max_pnpid_table[] = {
         {
                 (const char * const []){"LEN0033", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1024, 5052, 2258, 4832
         },
         {
-                (const char * const []){"LEN0035", "LEN0042", NULL},
+                (const char * const []){"LEN0042", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1232, 5710, 1156, 4696
         },
         {
                 (const char * const []){"LEN0034", "LEN0036", "LEN0037",
                                         "LEN0039", "LEN2002", "LEN2004",
                                         NULL},
+                {ANY_BOARD_ID, 2961},
                 1024, 5112, 2024, 4832
         },
         {
                 (const char * const []){"LEN2001", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1024, 5022, 2508, 4832
         },
         {
                 (const char * const []){"LEN2006", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1264, 5675, 1171, 4688
         },
         { }
@@ -175,9 +181,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0041",
         "LEN0042", /* Yoga */
         "LEN0045",
-        "LEN0046",
         "LEN0047",
-        "LEN0048",
         "LEN0049",
         "LEN2000",
         "LEN2001", /* Edge E431 */
@@ -235,18 +239,39 @@ static int synaptics_model_id(struct psmouse *psmouse)
         return 0;
 }
 
+static int synaptics_more_extended_queries(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        unsigned char buf[3];
+
+        if (synaptics_send_cmd(psmouse, SYN_QUE_MEXT_CAPAB_10, buf))
+                return -1;
+
+        priv->ext_cap_10 = (buf[0]<<16) | (buf[1]<<8) | buf[2];
+
+        return 0;
+}
+
 /*
- * Read the board id from the touchpad
+ * Read the board id and the "More Extended Queries" from the touchpad
  * The board id is encoded in the "QUERY MODES" response
  */
-static int synaptics_board_id(struct psmouse *psmouse)
+static int synaptics_query_modes(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         unsigned char bid[3];
 
+        /* firmwares prior 7.5 have no board_id encoded */
+        if (SYN_ID_FULL(priv->identity) < 0x705)
+                return 0;
+
         if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
                 return -1;
         priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
+
+        if (SYN_MEXT_CAP_BIT(bid[0]))
+                return synaptics_more_extended_queries(psmouse);
+
         return 0;
 }
 
@@ -346,7 +371,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         unsigned char resp[3];
-        int i;
 
         if (SYN_ID_MAJOR(priv->identity) < 4)
                 return 0;
@@ -358,17 +382,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
                 }
         }
 
-        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
-                if (psmouse_matches_pnp_id(psmouse,
-                                           min_max_pnpid_table[i].pnp_ids)) {
-                        priv->x_min = min_max_pnpid_table[i].x_min;
-                        priv->x_max = min_max_pnpid_table[i].x_max;
-                        priv->y_min = min_max_pnpid_table[i].y_min;
-                        priv->y_max = min_max_pnpid_table[i].y_max;
-                        return 0;
-                }
-        }
-
         if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
             SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
@@ -377,23 +390,69 @@ static int synaptics_resolution(struct psmouse *psmouse)
                 } else {
                         priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                         priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried max coordinates: x [..%d], y [..%d]\n",
+                                     priv->x_max, priv->y_max);
                 }
         }
 
-        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
-            SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
+        if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
+            (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
+             /*
+              * Firmware v8.1 does not report proper number of extended
+              * capabilities, but has been proven to report correct min
+              * coordinates.
+              */
+             SYN_ID_FULL(priv->identity) == 0x801)) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
                         psmouse_warn(psmouse,
                                      "device claims to have min coordinates query, but I'm not able to read it.\n");
                 } else {
                         priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                         priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried min coordinates: x [%d..], y [%d..]\n",
+                                     priv->x_min, priv->y_min);
                 }
         }
 
         return 0;
 }
 
+/*
+ * Apply quirk(s) if the hardware matches
+ */
+
+static void synaptics_apply_quirks(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        int i;
+
+        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+                if (!psmouse_matches_pnp_id(psmouse,
+                                            min_max_pnpid_table[i].pnp_ids))
+                        continue;
+
+                if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
+                    priv->board_id < min_max_pnpid_table[i].board_id.min)
+                        continue;
+
+                if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
+                    priv->board_id > min_max_pnpid_table[i].board_id.max)
+                        continue;
+
+                priv->x_min = min_max_pnpid_table[i].x_min;
+                priv->x_max = min_max_pnpid_table[i].x_max;
+                priv->y_min = min_max_pnpid_table[i].y_min;
+                priv->y_max = min_max_pnpid_table[i].y_max;
+                psmouse_info(psmouse,
+                             "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
+                             priv->x_min, priv->x_max,
+                             priv->y_min, priv->y_max);
+                break;
+        }
+}
+
 static int synaptics_query_hardware(struct psmouse *psmouse)
 {
         if (synaptics_identify(psmouse))
@@ -402,13 +461,15 @@ static int synaptics_query_hardware(struct psmouse *psmouse)
                 return -1;
         if (synaptics_firmware_id(psmouse))
                 return -1;
-        if (synaptics_board_id(psmouse))
+        if (synaptics_query_modes(psmouse))
                 return -1;
         if (synaptics_capability(psmouse))
                 return -1;
         if (synaptics_resolution(psmouse))
                 return -1;
 
+        synaptics_apply_quirks(psmouse);
+
         return 0;
 }
 
@@ -516,18 +577,22 @@ static int synaptics_is_pt_packet(unsigned char *buf)
         return (buf[0] & 0xFC) == 0x84 && (buf[3] & 0xCC) == 0xC4;
 }
 
-static void synaptics_pass_pt_packet(struct serio *ptport, unsigned char *packet)
+static void synaptics_pass_pt_packet(struct psmouse *psmouse,
+                                     struct serio *ptport,
+                                     unsigned char *packet)
 {
+        struct synaptics_data *priv = psmouse->private;
         struct psmouse *child = serio_get_drvdata(ptport);
 
         if (child && child->state == PSMOUSE_ACTIVATED) {
-                serio_interrupt(ptport, packet[1], 0);
+                serio_interrupt(ptport, packet[1] | priv->pt_buttons, 0);
                 serio_interrupt(ptport, packet[4], 0);
                 serio_interrupt(ptport, packet[5], 0);
                 if (child->pktsize == 4)
                         serio_interrupt(ptport, packet[2], 0);
-        } else
+        } else {
                 serio_interrupt(ptport, packet[1], 0);
+        }
 }
 
 static void synaptics_pt_activate(struct psmouse *psmouse)
@@ -605,6 +670,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
         }
 }
 
+static void synaptics_parse_ext_buttons(const unsigned char buf[],
+                                        struct synaptics_data *priv,
+                                        struct synaptics_hw_state *hw)
+{
+        unsigned int ext_bits =
+                (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
+
+        hw->ext_buttons = buf[4] & ext_mask;
+        hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
+}
+
 static bool is_forcepad;
 
 static int synaptics_parse_hw_state(const unsigned char buf[],
@@ -691,28 +768,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
                         hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
                 }
 
-                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
                     ((buf[0] ^ buf[3]) & 0x02)) {
-                        switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
-                        default:
-                                /*
-                                 * if nExtBtn is greater than 8 it should be
-                                 * considered invalid and treated as 0
-                                 */
-                                break;
-                        case 8:
-                                hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
-                        case 6:
-                                hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
-                        case 4:
-                                hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
-                        case 2:
-                                hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
-                        }
+                        synaptics_parse_ext_buttons(buf, priv, hw);
                 }
         } else {
                 hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
@@ -774,12 +832,54 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
         }
 }
 
+static void synaptics_report_ext_buttons(struct psmouse *psmouse,
+                                         const struct synaptics_hw_state *hw)
+{
+        struct input_dev *dev = psmouse->dev;
+        struct synaptics_data *priv = psmouse->private;
+        int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        char buf[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+        int i;
+
+        if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
+                return;
+
+        /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
+        if (SYN_ID_FULL(priv->identity) == 0x801 &&
+            !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
+                return;
+
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10)) {
+                for (i = 0; i < ext_bits; i++) {
+                        input_report_key(dev, BTN_0 + 2 * i,
+                                hw->ext_buttons & (1 << i));
+                        input_report_key(dev, BTN_1 + 2 * i,
+                                hw->ext_buttons & (1 << (i + ext_bits)));
+                }
+                return;
+        }
+
+        /*
+         * This generation of touchpads has the trackstick buttons
+         * physically wired to the touchpad. Re-route them through
+         * the pass-through interface.
+         */
+        if (!priv->pt_port)
+                return;
+
+        /* The trackstick expects at most 3 buttons */
+        priv->pt_buttons = SYN_CAP_EXT_BUTTON_STICK_L(hw->ext_buttons)      |
+                           SYN_CAP_EXT_BUTTON_STICK_R(hw->ext_buttons) << 1 |
+                           SYN_CAP_EXT_BUTTON_STICK_M(hw->ext_buttons) << 2;
+
+        synaptics_pass_pt_packet(psmouse, priv->pt_port, buf);
+}
+
 static void synaptics_report_buttons(struct psmouse *psmouse,
                                      const struct synaptics_hw_state *hw)
 {
         struct input_dev *dev = psmouse->dev;
         struct synaptics_data *priv = psmouse->private;
-        int i;
 
         input_report_key(dev, BTN_LEFT, hw->left);
         input_report_key(dev, BTN_RIGHT, hw->right);
@@ -792,8 +892,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
                 input_report_key(dev, BTN_BACK, hw->down);
         }
 
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
-                input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
+        synaptics_report_ext_buttons(psmouse, hw);
 }
 
 static void synaptics_report_mt_data(struct psmouse *psmouse,
@@ -813,7 +912,7 @@ static void synaptics_report_mt_data(struct psmouse *psmouse,
                 pos[i].y = synaptics_invert_y(hw[i]->y);
         }
 
-        input_mt_assign_slots(dev, slot, pos, nsemi, DMAX * priv->x_res);
+        input_mt_assign_slots(dev, slot, pos, nsemi, 0);
 
         for (i = 0; i < nsemi; i++) {
                 input_mt_slot(dev, slot[i]);
@@ -1014,7 +1113,8 @@ static psmouse_ret_t synaptics_process_byte(struct psmouse *psmouse)
                 if (SYN_CAP_PASS_THROUGH(priv->capabilities) &&
                     synaptics_is_pt_packet(psmouse->packet)) {
                         if (priv->pt_port)
-                                synaptics_pass_pt_packet(priv->pt_port, psmouse->packet);
+                                synaptics_pass_pt_packet(psmouse, priv->pt_port,
+                                                         psmouse->packet);
                 } else
                         synaptics_process_packet(psmouse);
 
@@ -1116,8 +1216,9 @@ static void set_input_params(struct psmouse *psmouse,
                 __set_bit(BTN_BACK, dev->keybit);
         }
 
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
-                __set_bit(BTN_0 + i, dev->keybit);
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
+                for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+                        __set_bit(BTN_0 + i, dev->keybit);
 
         __clear_bit(EV_REL, dev->evbit);
         __clear_bit(REL_X, dev->relbit);
@@ -1125,7 +1226,8 @@ static void set_input_params(struct psmouse *psmouse,
 
         if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                 __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
-                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
+                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
+                    !SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
                         __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
                 /* Clickpads report only left button */
                 __clear_bit(BTN_RIGHT, dev->keybit);
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index aedc3299b14e..ee4bd0d12b26 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -22,6 +22,7 @@
 #define SYN_QUE_EXT_CAPAB_0C            0x0c
 #define SYN_QUE_EXT_MAX_COORDS          0x0d
 #define SYN_QUE_EXT_MIN_COORDS          0x0f
+#define SYN_QUE_MEXT_CAPAB_10           0x10
 
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -53,6 +54,7 @@
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_MEXT_CAP_BIT(m)             ((m) & (1 << 1))
 
 /*
  * The following describes response for the 0x0c query.
@@ -89,6 +91,30 @@
 #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
 #define SYN_CAP_IMAGE_SENSOR(ex0c)      ((ex0c) & 0x000800)
 
+/*
+ * The following descibes response for the 0x10 query.
+ *
+ * byte mask    name                    meaning
+ * ---- ----    -------                 ------------
+ * 1    0x01    ext buttons are stick   buttons exported in the extended
+ *                                      capability are actually meant to be used
+ *                                      by the tracktick (pass-through).
+ * 1    0x02    SecurePad               the touchpad is a SecurePad, so it
+ *                                      contains a built-in fingerprint reader.
+ * 1    0xe0    more ext count          how many more extented queries are
+ *                                      available after this one.
+ * 2    0xff    SecurePad width         the width of the SecurePad fingerprint
+ *                                      reader.
+ * 3    0xff    SecurePad height        the height of the SecurePad fingerprint
+ *                                      reader.
+ */
+#define SYN_CAP_EXT_BUTTONS_STICK(ex10) ((ex10) & 0x010000)
+#define SYN_CAP_SECUREPAD(ex10)         ((ex10) & 0x020000)
+
+#define SYN_CAP_EXT_BUTTON_STICK_L(eb)  (!!((eb) & 0x01))
+#define SYN_CAP_EXT_BUTTON_STICK_M(eb)  (!!((eb) & 0x02))
+#define SYN_CAP_EXT_BUTTON_STICK_R(eb)  (!!((eb) & 0x04))
+
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
 #define SYN_MODE_RATE(m)                ((m) & (1 << 6))
@@ -143,6 +169,7 @@ struct synaptics_data {
         unsigned long int capabilities;         /* Capabilities */
         unsigned long int ext_cap;              /* Extended Capabilities */
         unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
+        unsigned long int ext_cap_10;           /* Ext Caps from 0x10 query */
         unsigned long int identity;             /* Identification */
         unsigned int x_res, y_res;              /* X/Y resolution in units/mm */
         unsigned int x_max, y_max;              /* Max coordinates (from FW) */
@@ -156,6 +183,7 @@ struct synaptics_data {
         bool disable_gesture;                   /* disable gestures */
 
         struct serio *pt_port;                  /* Pass-through serio port */
+        unsigned char pt_buttons;               /* Pass-through buttons */
 
         /*
          * Last received Advanced Gesture Mode (AGM) packet. An AGM packet
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index baa0d9786f50..1ae4e547b419 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -23,6 +23,7 @@ config IOMMU_IO_PGTABLE
 config IOMMU_IO_PGTABLE_LPAE
         bool "ARMv7/v8 Long Descriptor Format"
         select IOMMU_IO_PGTABLE
+        depends on ARM || ARM64 || COMPILE_TEST
         help
           Enable support for the ARM long descriptor pagetable format.
           This allocator supports 4K/2M/1G, 16K/32M and 64K/512M page
@@ -63,6 +64,7 @@ config MSM_IOMMU
         bool "MSM IOMMU Support"
         depends on ARM
         depends on ARCH_MSM8X60 || ARCH_MSM8960 || COMPILE_TEST
+        depends on BROKEN
         select IOMMU_API
         help
           Support for the IOMMUs found on certain Qualcomm SOCs.
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index 7ce52737c7a1..dc14fec4ede1 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -1186,8 +1186,15 @@ static const struct iommu_ops exynos_iommu_ops = {
 
 static int __init exynos_iommu_init(void)
 {
+        struct device_node *np;
         int ret;
 
+        np = of_find_matching_node(NULL, sysmmu_of_match);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
+
         lv2table_kmem_cache = kmem_cache_create("exynos-iommu-lv2table",
                                 LV2TABLE_SIZE, LV2TABLE_SIZE, 0, NULL);
         if (!lv2table_kmem_cache) {
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index 5a500edf00cc..b610a8dee238 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -56,7 +56,8 @@
         ((((d)->levels - ((l) - ARM_LPAE_START_LVL(d) + 1))             \
           * (d)->bits_per_level) + (d)->pg_shift)
 
-#define ARM_LPAE_PAGES_PER_PGD(d)       ((d)->pgd_size >> (d)->pg_shift)
+#define ARM_LPAE_PAGES_PER_PGD(d)                                       \
+        DIV_ROUND_UP((d)->pgd_size, 1UL << (d)->pg_shift)
 
 /*
  * Calculate the index at level l used to map virtual address a using the
@@ -66,7 +67,7 @@
         ((l) == ARM_LPAE_START_LVL(d) ? ilog2(ARM_LPAE_PAGES_PER_PGD(d)) : 0)
 
 #define ARM_LPAE_LVL_IDX(a,l,d)                                         \
-        (((a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                             \
+        (((u64)(a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                        \
          ((1 << ((d)->bits_per_level + ARM_LPAE_PGD_IDX(l,d))) - 1))
 
 /* Calculate the block/page mapping size at level l for pagetable in d. */
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index f59f857b702e..a4ba851825c2 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1376,6 +1376,13 @@ static int __init omap_iommu_init(void)
         struct kmem_cache *p;
         const unsigned long flags = SLAB_HWCACHE_ALIGN;
         size_t align = 1 << 10; /* L2 pagetable alignement */
+        struct device_node *np;
+
+        np = of_find_matching_node(NULL, omap_iommu_of_match);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
 
         p = kmem_cache_create("iopte_cache", IOPTE_TABLE_SIZE, align, flags,
                               iopte_cachep_ctor);
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 6a8b1ec4a48a..9f74fddcd304 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1015,8 +1015,15 @@ static struct platform_driver rk_iommu_driver = {
 
 static int __init rk_iommu_init(void)
 {
+        struct device_node *np;
         int ret;
 
+        np = of_find_matching_node(NULL, rk_iommu_dt_ids);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
+
         ret = bus_set_iommu(&platform_bus_type, &rk_iommu_ops);
         if (ret)
                 return ret;
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 463c235acbdc..4387dae14e45 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -69,6 +69,7 @@ static void __iomem *per_cpu_int_base;
 static void __iomem *main_int_base;
 static struct irq_domain *armada_370_xp_mpic_domain;
 static u32 doorbell_mask_reg;
+static int parent_irq;
 #ifdef CONFIG_PCI_MSI
 static struct irq_domain *armada_370_xp_msi_domain;
 static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
@@ -356,6 +357,7 @@ static int armada_xp_mpic_secondary_init(struct notifier_block *nfb,
 {
         if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
                 armada_xp_mpic_smp_cpu_init();
+
         return NOTIFY_OK;
 }
 
@@ -364,6 +366,20 @@ static struct notifier_block armada_370_xp_mpic_cpu_notifier = {
         .priority = 100,
 };
 
+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
+                                        unsigned long action, void *hcpu)
+{
+        if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
+                enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block mpic_cascaded_cpu_notifier = {
+        .notifier_call = mpic_cascaded_secondary_init,
+        .priority = 100,
+};
+
 #endif /* CONFIG_SMP */
 
 static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
@@ -539,7 +555,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                                              struct device_node *parent)
 {
         struct resource main_int_res, per_cpu_int_res;
-        int parent_irq, nr_irqs, i;
+        int nr_irqs, i;
         u32 control;
 
         BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@@ -587,6 +603,9 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                 register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
 #endif
         } else {
+#ifdef CONFIG_SMP
+                register_cpu_notifier(&mpic_cascaded_cpu_notifier);
+#endif
                 irq_set_chained_handler(parent_irq,
                                         armada_370_xp_mpic_handle_cascade_irq);
         }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d8996bdf0f61..596b0a9eee99 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -416,13 +416,14 @@ static void its_send_single_command(struct its_node *its,
 {
         struct its_cmd_block *cmd, *sync_cmd, *next_cmd;
         struct its_collection *sync_col;
+        unsigned long flags;
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
 
         cmd = its_allocate_entry(its);
         if (!cmd) {             /* We're soooooo screewed... */
                 pr_err_ratelimited("ITS can't allocate, dropping command\n");
-                raw_spin_unlock(&its->lock);
+                raw_spin_unlock_irqrestore(&its->lock, flags);
                 return;
         }
         sync_col = builder(cmd, desc);
@@ -442,7 +443,7 @@ static void its_send_single_command(struct its_node *its,
 
 post:
         next_cmd = its_post_commands(its);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         its_wait_for_range_completion(its, cmd, next_cmd);
 }
@@ -799,21 +800,43 @@ static int its_alloc_tables(struct its_node *its)
 {
         int err;
         int i;
-        int psz = PAGE_SIZE;
+        int psz = SZ_64K;
         u64 shr = GITS_BASER_InnerShareable;
 
         for (i = 0; i < GITS_BASER_NR_REGS; i++) {
                 u64 val = readq_relaxed(its->base + GITS_BASER + i * 8);
                 u64 type = GITS_BASER_TYPE(val);
                 u64 entry_size = GITS_BASER_ENTRY_SIZE(val);
+                int order = get_order(psz);
+                int alloc_size;
                 u64 tmp;
                 void *base;
 
                 if (type == GITS_BASER_TYPE_NONE)
                         continue;
 
-                /* We're lazy and only allocate a single page for now */
-                base = (void *)get_zeroed_page(GFP_KERNEL);
+                /*
+                 * Allocate as many entries as required to fit the
+                 * range of device IDs that the ITS can grok... The ID
+                 * space being incredibly sparse, this results in a
+                 * massive waste of memory.
+                 *
+                 * For other tables, only allocate a single page.
+                 */
+                if (type == GITS_BASER_TYPE_DEVICE) {
+                        u64 typer = readq_relaxed(its->base + GITS_TYPER);
+                        u32 ids = GITS_TYPER_DEVBITS(typer);
+
+                        order = get_order((1UL << ids) * entry_size);
+                        if (order >= MAX_ORDER) {
+                                order = MAX_ORDER - 1;
+                                pr_warn("%s: Device Table too large, reduce its page order to %u\n",
+                                        its->msi_chip.of_node->full_name, order);
+                        }
+                }
+
+                alloc_size = (1 << order) * PAGE_SIZE;
+                base = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
                 if (!base) {
                         err = -ENOMEM;
                         goto out_free;
@@ -841,7 +864,7 @@ retry_baser:
                         break;
                 }
 
-                val |= (PAGE_SIZE / psz) - 1;
+                val |= (alloc_size / psz) - 1;
 
                 writeq_relaxed(val, its->base + GITS_BASER + i * 8);
                 tmp = readq_relaxed(its->base + GITS_BASER + i * 8);
@@ -882,7 +905,7 @@ retry_baser:
                 }
 
                 pr_info("ITS: allocated %d %s @%lx (psz %dK, shr %d)\n",
-                        (int)(PAGE_SIZE / entry_size),
+                        (int)(alloc_size / entry_size),
                         its_base_type_string[type],
                         (unsigned long)virt_to_phys(base),
                         psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT);
@@ -1020,8 +1043,9 @@ static void its_cpu_init_collection(void)
 static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
 {
         struct its_device *its_dev = NULL, *tmp;
+        unsigned long flags;
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
 
         list_for_each_entry(tmp, &its->its_device_list, entry) {
                 if (tmp->device_id == dev_id) {
@@ -1030,7 +1054,7 @@ static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
                 }
         }
 
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         return its_dev;
 }
@@ -1040,6 +1064,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 {
         struct its_device *dev;
         unsigned long *lpi_map;
+        unsigned long flags;
         void *itt;
         int lpi_base;
         int nr_lpis;
@@ -1056,7 +1081,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         nr_ites = max(2UL, roundup_pow_of_two(nvecs));
         sz = nr_ites * its->ite_size;
         sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
-        itt = kmalloc(sz, GFP_KERNEL);
+        itt = kzalloc(sz, GFP_KERNEL);
         lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
 
         if (!dev || !itt || !lpi_map) {
@@ -1075,9 +1100,9 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         dev->device_id = dev_id;
         INIT_LIST_HEAD(&dev->entry);
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
         list_add(&dev->entry, &its->its_device_list);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         /* Bind the device to the first possible CPU */
         cpu = cpumask_first(cpu_online_mask);
@@ -1091,9 +1116,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 
 static void its_free_device(struct its_device *its_dev)
 {
-        raw_spin_lock(&its_dev->its->lock);
+        unsigned long flags;
+
+        raw_spin_lock_irqsave(&its_dev->its->lock, flags);
         list_del(&its_dev->entry);
-        raw_spin_unlock(&its_dev->its->lock);
+        raw_spin_unlock_irqrestore(&its_dev->its->lock, flags);
         kfree(its_dev->itt);
         kfree(its_dev);
 }
@@ -1112,31 +1139,69 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
         return 0;
 }
 
+struct its_pci_alias {
+        struct pci_dev  *pdev;
+        u32             dev_id;
+        u32             count;
+};
+
+static int its_pci_msi_vec_count(struct pci_dev *pdev)
+{
+        int msi, msix;
+
+        msi = max(pci_msi_vec_count(pdev), 0);
+        msix = max(pci_msix_vec_count(pdev), 0);
+
+        return max(msi, msix);
+}
+
+static int its_get_pci_alias(struct pci_dev *pdev, u16 alias, void *data)
+{
+        struct its_pci_alias *dev_alias = data;
+
+        dev_alias->dev_id = alias;
+        if (pdev != dev_alias->pdev)
+                dev_alias->count += its_pci_msi_vec_count(dev_alias->pdev);
+
+        return 0;
+}
+
 static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                            int nvec, msi_alloc_info_t *info)
 {
         struct pci_dev *pdev;
         struct its_node *its;
-        u32 dev_id;
         struct its_device *its_dev;
+        struct its_pci_alias dev_alias;
 
         if (!dev_is_pci(dev))
                 return -EINVAL;
 
         pdev = to_pci_dev(dev);
-        dev_id = PCI_DEVID(pdev->bus->number, pdev->devfn);
+        dev_alias.pdev = pdev;
+        dev_alias.count = nvec;
+
+        pci_for_each_dma_alias(pdev, its_get_pci_alias, &dev_alias);
         its = domain->parent->host_data;
 
-        its_dev = its_find_device(its, dev_id);
-        if (WARN_ON(its_dev))
-                return -EINVAL;
+        its_dev = its_find_device(its, dev_alias.dev_id);
+        if (its_dev) {
+                /*
+                 * We already have seen this ID, probably through
+                 * another alias (PCI bridge of some sort). No need to
+                 * create the device.
+                 */
+                dev_dbg(dev, "Reusing ITT for devID %x\n", dev_alias.dev_id);
+                goto out;
+        }
 
-        its_dev = its_create_device(its, dev_id, nvec);
+        its_dev = its_create_device(its, dev_alias.dev_id, dev_alias.count);
         if (!its_dev)
                 return -ENOMEM;
 
-        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n", nvec, ilog2(nvec));
-
+        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n",
+                dev_alias.count, ilog2(dev_alias.count));
+out:
         info->scratchpad[0].ptr = its_dev;
         info->scratchpad[1].ptr = dev;
         return 0;
@@ -1255,6 +1320,34 @@ static const struct irq_domain_ops its_domain_ops = {
         .deactivate             = its_irq_domain_deactivate,
 };
 
+static int its_force_quiescent(void __iomem *base)
+{
+        u32 count = 1000000;    /* 1s */
+        u32 val;
+
+        val = readl_relaxed(base + GITS_CTLR);
+        if (val & GITS_CTLR_QUIESCENT)
+                return 0;
+
+        /* Disable the generation of all interrupts to this ITS */
+        val &= ~GITS_CTLR_ENABLE;
+        writel_relaxed(val, base + GITS_CTLR);
+
+        /* Poll GITS_CTLR and wait until ITS becomes quiescent */
+        while (1) {
+                val = readl_relaxed(base + GITS_CTLR);
+                if (val & GITS_CTLR_QUIESCENT)
+                        return 0;
+
+                count--;
+                if (!count)
+                        return -EBUSY;
+
+                cpu_relax();
+                udelay(1);
+        }
+}
+
 static int its_probe(struct device_node *node, struct irq_domain *parent)
 {
         struct resource res;
@@ -1283,6 +1376,13 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
                 goto out_unmap;
         }
 
+        err = its_force_quiescent(its_base);
+        if (err) {
+                pr_warn("%s: failed to quiesce, giving up\n",
+                        node->full_name);
+                goto out_unmap;
+        }
+
         pr_info("ITS: %s\n", node->full_name);
 
         its = kzalloc(sizeof(*its), GFP_KERNEL);
@@ -1323,7 +1423,7 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
         writeq_relaxed(baser, its->base + GITS_CBASER);
         tmp = readq_relaxed(its->base + GITS_CBASER);
         writeq_relaxed(0, its->base + GITS_CWRITER);
-        writel_relaxed(1, its->base + GITS_CTLR);
+        writel_relaxed(GITS_CTLR_ENABLE, its->base + GITS_CTLR);
 
         if ((tmp ^ baser) & GITS_BASER_SHAREABILITY_MASK) {
                 pr_info("ITS: using cache flushing for cmd queue\n");
@@ -1382,12 +1482,11 @@ static bool gic_rdists_supports_plpis(void)
 
 int its_cpu_init(void)
 {
-        if (!gic_rdists_supports_plpis()) {
-                pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
-                return -ENXIO;
-        }
-
         if (!list_empty(&its_nodes)) {
+                if (!gic_rdists_supports_plpis()) {
+                        pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
+                        return -ENXIO;
+                }
                 its_cpu_init_lpis();
                 its_cpu_init_collection();
         }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 1c6dea2fbc34..fd8850def1b8 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -466,7 +466,7 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
                 tlist |= 1 << (mpidr & 0xf);
 
                 cpu = cpumask_next(cpu, mask);
-                if (cpu == nr_cpu_ids)
+                if (cpu >= nr_cpu_ids)
                         goto out;
 
                 mpidr = cpu_logical_map(cpu);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 4634cf7d0ec3..471e1cdc1933 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -154,23 +154,25 @@ static inline unsigned int gic_irq(struct irq_data *d)
 static void gic_mask_irq(struct irq_data *d)
 {
         u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_CLEAR + (gic_irq(d) / 32) * 4);
         if (gic_arch_extn.irq_mask)
                 gic_arch_extn.irq_mask(d);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 
 static void gic_unmask_irq(struct irq_data *d)
 {
         u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         if (gic_arch_extn.irq_unmask)
                 gic_arch_extn.irq_unmask(d);
         writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_SET + (gic_irq(d) / 32) * 4);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 
 static void gic_eoi_irq(struct irq_data *d)
@@ -188,6 +190,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
 {
         void __iomem *base = gic_dist_base(d);
         unsigned int gicirq = gic_irq(d);
+        unsigned long flags;
         int ret;
 
         /* Interrupt configuration for SGIs can't be changed */
@@ -199,14 +202,14 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
                             type != IRQ_TYPE_EDGE_RISING)
                 return -EINVAL;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
 
         if (gic_arch_extn.irq_set_type)
                 gic_arch_extn.irq_set_type(d, type);
 
         ret = gic_configure_irq(gicirq, type, base, NULL);
 
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 
         return ret;
 }
@@ -227,6 +230,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
         void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
         unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
         u32 val, mask, bit;
+        unsigned long flags;
 
         if (!force)
                 cpu = cpumask_any_and(mask_val, cpu_online_mask);
@@ -236,12 +240,12 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
         if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
                 return -EINVAL;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         mask = 0xff << shift;
         bit = gic_cpu_map[cpu] << shift;
         val = readl_relaxed(reg) & ~mask;
         writel_relaxed(val | bit, reg);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 
         return IRQ_SET_MASK_OK;
 }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 6a7447c304ac..358a574d9e8b 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1609,7 +1609,7 @@ icn_setup(char *line)
         if (ints[0] > 1)
                 membase = (unsigned long)ints[2];
         if (str && *str) {
-                strcpy(sid, str);
+                strlcpy(sid, str, sizeof(sid));
                 icn_id = sid;
                 if ((p = strchr(sid, ','))) {
                         *p++ = 0;
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index e9f1d8d84613..c53f14a7ce54 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -124,7 +124,7 @@ int mmc_pwrseq_simple_alloc(struct mmc_host *host, struct device *dev)
                     PTR_ERR(pwrseq->reset_gpios[i]) != -ENOSYS) {
                         ret = PTR_ERR(pwrseq->reset_gpios[i]);
 
-                        while (--i)
+                        while (i--)
                                 gpiod_put(pwrseq->reset_gpios[i]);
 
                         goto clk_put;
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 5b76a173cd95..5897d8d8fa5a 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -526,6 +526,7 @@ config MTD_NAND_SUNXI
 
 config MTD_NAND_HISI504
         tristate "Support for NAND controller on Hisilicon SoC Hip04"
+        depends on HAS_DMA
         help
           Enables support for NAND controller on Hisilicon SoC Hip04.
 
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 96b0b1d27df1..10b1f7a4fe50 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
         nand_writel(info, NDCR, ndcr | int_mask);
 }
 
+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
+{
+        if (info->ecc_bch) {
+                int timeout;
+
+                /*
+                 * According to the datasheet, when reading from NDDB
+                 * with BCH enabled, after each 32 bytes reads, we
+                 * have to make sure that the NDSR.RDDREQ bit is set.
+                 *
+                 * Drain the FIFO 8 32 bits reads at a time, and skip
+                 * the polling on the last read.
+                 */
+                while (len > 8) {
+                        __raw_readsl(info->mmio_base + NDDB, data, 8);
+
+                        for (timeout = 0;
+                             !(nand_readl(info, NDSR) & NDSR_RDDREQ);
+                             timeout++) {
+                                if (timeout >= 5) {
+                                        dev_err(&info->pdev->dev,
+                                                "Timeout on RDDREQ while draining the FIFO\n");
+                                        return;
+                                }
+
+                                mdelay(1);
+                        }
+
+                        data += 32;
+                        len -= 8;
+                }
+        }
+
+        __raw_readsl(info->mmio_base + NDDB, data, len);
+}
+
 static void handle_data_pio(struct pxa3xx_nand_info *info)
 {
         unsigned int do_bytes = min(info->data_size, info->chunk_size);
@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
                                       DIV_ROUND_UP(info->oob_size, 4));
                 break;
         case STATE_PIO_READING:
-                __raw_readsl(info->mmio_base + NDDB,
-                             info->data_buff + info->data_buff_pos,
-                             DIV_ROUND_UP(do_bytes, 4));
+                drain_fifo(info,
+                           info->data_buff + info->data_buff_pos,
+                           DIV_ROUND_UP(do_bytes, 4));
 
                 if (info->oob_size > 0)
-                        __raw_readsl(info->mmio_base + NDDB,
-                                     info->oob_buff + info->oob_buff_pos,
-                                     DIV_ROUND_UP(info->oob_size, 4));
+                        drain_fifo(info,
+                                   info->oob_buff + info->oob_buff_pos,
+                                   DIV_ROUND_UP(info->oob_size, 4));
                 break;
         default:
                 dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
@@ -1572,6 +1608,8 @@ static int alloc_nand_resource(struct platform_device *pdev)
         int ret, irq, cs;
 
         pdata = dev_get_platdata(&pdev->dev);
+        if (pdata->num_cs <= 0)
+                return -ENODEV;
         info = devm_kzalloc(&pdev->dev, sizeof(*info) + (sizeof(*mtd) +
                             sizeof(*host)) * pdata->num_cs, GFP_KERNEL);
         if (!info)
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index 98d73aab52fe..58808f651452 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -131,7 +131,7 @@ config CAN_RCAR
 
 config CAN_XILINXCAN
         tristate "Xilinx CAN"
-        depends on ARCH_ZYNQ || MICROBLAZE || COMPILE_TEST
+        depends on ARCH_ZYNQ || ARM64 || MICROBLAZE || COMPILE_TEST
         depends on COMMON_CLK && HAS_IOMEM
         ---help---
           Xilinx CAN driver. This driver supports both soft AXI CAN IP and
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index a316fa4b91ab..e97a08ce0b90 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -14,6 +14,7 @@
  * Copyright (C) 2015 Valeo S.A.
  */
 
+#include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
@@ -467,10 +468,11 @@ struct kvaser_usb {
 struct kvaser_usb_net_priv {
         struct can_priv can;
 
-        atomic_t active_tx_urbs;
-        struct usb_anchor tx_submitted;
+        spinlock_t tx_contexts_lock;
+        int active_tx_contexts;
         struct kvaser_usb_tx_urb_context tx_contexts[MAX_TX_URBS];
 
+        struct usb_anchor tx_submitted;
         struct completion start_comp, stop_comp;
 
         struct kvaser_usb *dev;
@@ -694,6 +696,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
         struct kvaser_usb_net_priv *priv;
         struct sk_buff *skb;
         struct can_frame *cf;
+        unsigned long flags;
         u8 channel, tid;
 
         channel = msg->u.tx_acknowledge_header.channel;
@@ -737,12 +740,15 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
 
         stats->tx_packets++;
         stats->tx_bytes += context->dlc;
-        can_get_echo_skb(priv->netdev, context->echo_index);
 
-        context->echo_index = MAX_TX_URBS;
-        atomic_dec(&priv->active_tx_urbs);
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
 
+        can_get_echo_skb(priv->netdev, context->echo_index);
+        context->echo_index = MAX_TX_URBS;
+        --priv->active_tx_contexts;
         netif_wake_queue(priv->netdev);
+
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 }
 
 static void kvaser_usb_simple_msg_callback(struct urb *urb)
@@ -803,17 +809,6 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
         return 0;
 }
 
-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
-{
-        int i;
-
-        usb_kill_anchored_urbs(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-
-        for (i = 0; i < MAX_TX_URBS; i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
-}
-
 static void kvaser_usb_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
                                                  const struct kvaser_usb_error_summary *es,
                                                  struct can_frame *cf)
@@ -1515,6 +1510,24 @@ error:
         return err;
 }
 
+static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
+{
+        int i;
+
+        priv->active_tx_contexts = 0;
+        for (i = 0; i < MAX_TX_URBS; i++)
+                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
+}
+
+/* This method might sleep. Do not call it in the atomic context
+ * of URB completions.
+ */
+static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+{
+        usb_kill_anchored_urbs(&priv->tx_submitted);
+        kvaser_usb_reset_tx_urb_contexts(priv);
+}
+
 static void kvaser_usb_unlink_all_urbs(struct kvaser_usb *dev)
 {
         int i;
@@ -1634,6 +1647,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         struct kvaser_msg *msg;
         int i, err, ret = NETDEV_TX_OK;
         u8 *msg_tx_can_flags = NULL;            /* GCC */
+        unsigned long flags;
 
         if (can_dropped_invalid_skb(netdev, skb))
                 return NETDEV_TX_OK;
@@ -1687,12 +1701,21 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         if (cf->can_id & CAN_RTR_FLAG)
                 *msg_tx_can_flags |= MSG_FLAG_REMOTE_FRAME;
 
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
         for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++) {
                 if (priv->tx_contexts[i].echo_index == MAX_TX_URBS) {
                         context = &priv->tx_contexts[i];
+
+                        context->echo_index = i;
+                        can_put_echo_skb(skb, netdev, context->echo_index);
+                        ++priv->active_tx_contexts;
+                        if (priv->active_tx_contexts >= MAX_TX_URBS)
+                                netif_stop_queue(netdev);
+
                         break;
                 }
         }
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 
         /* This should never happen; it implies a flow control bug */
         if (!context) {
@@ -1704,7 +1727,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         }
 
         context->priv = priv;
-        context->echo_index = i;
         context->dlc = cf->can_dlc;
 
         msg->u.tx_can.tid = context->echo_index;
@@ -1716,18 +1738,17 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                           kvaser_usb_write_bulk_callback, context);
         usb_anchor_urb(urb, &priv->tx_submitted);
 
-        can_put_echo_skb(skb, netdev, context->echo_index);
-
-        atomic_inc(&priv->active_tx_urbs);
-
-        if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
-                netif_stop_queue(netdev);
-
         err = usb_submit_urb(urb, GFP_ATOMIC);
         if (unlikely(err)) {
+                spin_lock_irqsave(&priv->tx_contexts_lock, flags);
+
                 can_free_echo_skb(netdev, context->echo_index);
+                context->echo_index = MAX_TX_URBS;
+                --priv->active_tx_contexts;
+                netif_wake_queue(netdev);
+
+                spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 
-                atomic_dec(&priv->active_tx_urbs);
                 usb_unanchor_urb(urb);
 
                 stats->tx_dropped++;
@@ -1854,7 +1875,7 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
         struct kvaser_usb *dev = usb_get_intfdata(intf);
         struct net_device *netdev;
         struct kvaser_usb_net_priv *priv;
-        int i, err;
+        int err;
 
         err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
         if (err)
@@ -1868,19 +1889,17 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
 
         priv = netdev_priv(netdev);
 
+        init_usb_anchor(&priv->tx_submitted);
         init_completion(&priv->start_comp);
         init_completion(&priv->stop_comp);
 
-        init_usb_anchor(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-
-        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
-
         priv->dev = dev;
         priv->netdev = netdev;
         priv->channel = channel;
 
+        spin_lock_init(&priv->tx_contexts_lock);
+        kvaser_usb_reset_tx_urb_contexts(priv);
+
         priv->can.state = CAN_STATE_STOPPED;
         priv->can.clock.freq = CAN_USB_CLOCK;
         priv->can.bittiming_const = &kvaser_usb_bittiming_const;
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 8eb37e0194b5..bc8b04f42882 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 {
         struct pcnet32_private *lp;
         int i, media;
-        int fdx, mii, fset, dxsuflo;
+        int fdx, mii, fset, dxsuflo, sram;
         int chip_version;
         char *chipname;
         struct net_device *dev;
@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
         }
 
         /* initialize variables */
-        fdx = mii = fset = dxsuflo = 0;
+        fdx = mii = fset = dxsuflo = sram = 0;
         chip_version = (chip_version >> 12) & 0xffff;
 
         switch (chip_version) {
@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 chipname = "PCnet/FAST III 79C973";     /* PCI */
                 fdx = 1;
                 mii = 1;
+                sram = 1;
                 break;
         case 0x2626:
                 chipname = "PCnet/Home 79C978"; /* PCI */
@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 chipname = "PCnet/FAST III 79C975";     /* PCI */
                 fdx = 1;
                 mii = 1;
+                sram = 1;
                 break;
         case 0x2628:
                 chipname = "PCnet/PRO 79C976";
@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 dxsuflo = 1;
         }
 
+        /*
+         * The Am79C973/Am79C975 controllers come with 12K of SRAM
+         * which we can use for the Tx/Rx buffers but most importantly,
+         * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
+         * Tx fifo underflows.
+         */
+        if (sram) {
+                /*
+                 * The SRAM is being configured in two steps. First we
+                 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
+                 * to the datasheet, each bit corresponds to a 512-byte
+                 * page so we can have at most 24 pages. The SRAM_SIZE
+                 * holds the value of the upper 8 bits of the 16-bit SRAM size.
+                 * The low 8-bits start at 0x00 and end at 0xff. So the
+                 * address range is from 0x0000 up to 0x17ff. Therefore,
+                 * the SRAM_SIZE is set to 0x17. The next step is to set
+                 * the BCR26:SRAM_BND midway through so the Tx and Rx
+                 * buffers can share the SRAM equally.
+                 */
+                a->write_bcr(ioaddr, 25, 0x17);
+                a->write_bcr(ioaddr, 26, 0xc);
+                /* And finally enable the NOUFLO bit */
+                a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
+        }
+
         dev = alloc_etherdev(sizeof(*lp));
         if (!dev) {
                 ret = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 2ee12b54239b..9677431c582a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12769,7 +12769,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                 NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 |
                 NETIF_F_RXCSUM | NETIF_F_LRO | NETIF_F_GRO |
                 NETIF_F_RXHASH | NETIF_F_HW_VLAN_CTAG_TX;
-        if (!CHIP_IS_E1x(bp)) {
+        if (!chip_is_e1x) {
                 dev->hw_features |= NETIF_F_GSO_GRE | NETIF_F_GSO_UDP_TUNNEL |
                                     NETIF_F_GSO_IPIP | NETIF_F_GSO_SIT;
                 dev->hw_enc_features =
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 1498d078c319..afbe1682ff48 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -1120,7 +1120,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
                 }
 
                 /* Installed successfully, update the cached header too. */
-                memcpy(card_fw, fs_fw, sizeof(*card_fw));
+                *card_fw = *fs_fw;
                 card_fw_usable = 1;
                 *reset = 0;     /* already reset as part of load_fw */
         }
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index 3b42556f7f8d..ed41559bae77 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -589,7 +589,7 @@ static void tulip_tx_timeout(struct net_device *dev)
                                (unsigned int)tp->rx_ring[i].buffer1,
                                (unsigned int)tp->rx_ring[i].buffer2,
                                buf[0], buf[1], buf[2]);
-                        for (j = 0; buf[j] != 0xee && j < 1600; j++)
+                        for (j = 0; ((j < 1600) && buf[j] != 0xee); j++)
                                 if (j < 100)
                                         pr_cont(" %02x", buf[j]);
                         pr_cont(" j=%d\n", j);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 996bbc6a244f..eb39673ed6a6 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -362,6 +362,7 @@ struct be_vf_cfg {
         u16 vlan_tag;
         u32 tx_rate;
         u32 plink_tracking;
+        u32 privileges;
 };
 
 enum vf_state {
@@ -468,6 +469,7 @@ struct be_adapter {
 
         u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
         u8 __iomem *db;         /* Door Bell */
+        u8 __iomem *pcicfg;     /* On SH,BEx only. Shadow of PCI config space */
 
         struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
         struct be_dma_mem mbox_mem;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index dc278391a391..fb140faeafb1 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1849,15 +1849,11 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 {
         int num_eqs, i = 0;
 
-        if (lancer_chip(adapter) && num > 8) {
-                while (num) {
-                        num_eqs = min(num, 8);
-                        __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
-                        i += num_eqs;
-                        num -= num_eqs;
-                }
-        } else {
-                __be_cmd_modify_eqd(adapter, set_eqd, num);
+        while (num) {
+                num_eqs = min(num, 8);
+                __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
+                i += num_eqs;
+                num -= num_eqs;
         }
 
         return 0;
@@ -1865,7 +1861,7 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num)
+                       u32 num, u32 domain)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_vlan_config *req;
@@ -1883,6 +1879,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
         be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                                OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req),
                                wrb, NULL);
+        req->hdr.domain = domain;
 
         req->interface_id = if_id;
         req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 53e903f37247..1ec22300e254 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -2266,7 +2266,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
 int be_cmd_get_fw_ver(struct be_adapter *adapter);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num);
+                       u32 num, u32 domain);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 5652b005947f..d8df78b6554d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1261,7 +1261,7 @@ static int be_vid_config(struct be_adapter *adapter)
         for_each_set_bit(i, adapter->vids, VLAN_N_VID)
                 vids[num++] = cpu_to_le16(i);
 
-        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num);
+        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num, 0);
         if (status) {
                 dev_err(dev, "Setting HW VLAN filtering failed\n");
                 /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -1470,11 +1470,67 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
         return 0;
 }
 
+static int be_set_vf_tvt(struct be_adapter *adapter, int vf, u16 vlan)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        u16 vids[BE_NUM_VLANS_SUPPORTED];
+        int vf_if_id = vf_cfg->if_handle;
+        int status;
+
+        /* Enable Transparent VLAN Tagging */
+        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1, vf_if_id, 0);
+        if (status)
+                return status;
+
+        /* Clear pre-programmed VLAN filters on VF if any, if TVT is enabled */
+        vids[0] = 0;
+        status = be_cmd_vlan_config(adapter, vf_if_id, vids, 1, vf + 1);
+        if (!status)
+                dev_info(&adapter->pdev->dev,
+                         "Cleared guest VLANs on VF%d", vf);
+
+        /* After TVT is enabled, disallow VFs to program VLAN filters */
+        if (vf_cfg->privileges & BE_PRIV_FILTMGMT) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges &
+                                                  ~BE_PRIV_FILTMGMT, vf + 1);
+                if (!status)
+                        vf_cfg->privileges &= ~BE_PRIV_FILTMGMT;
+        }
+        return 0;
+}
+
+static int be_clear_vf_tvt(struct be_adapter *adapter, int vf)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        struct device *dev = &adapter->pdev->dev;
+        int status;
+
+        /* Reset Transparent VLAN Tagging. */
+        status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID, vf + 1,
+                                       vf_cfg->if_handle, 0);
+        if (status)
+                return status;
+
+        /* Allow VFs to program VLAN filtering */
+        if (!(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges |
+                                                  BE_PRIV_FILTMGMT, vf + 1);
+                if (!status) {
+                        vf_cfg->privileges |= BE_PRIV_FILTMGMT;
+                        dev_info(dev, "VF%d: FILTMGMT priv enabled", vf);
+                }
+        }
+
+        dev_info(dev,
+                 "Disable/re-enable i/f in VM to clear Transparent VLAN tag");
+        return 0;
+}
+
 static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
         struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
-        int status = 0;
+        int status;
 
         if (!sriov_enabled(adapter))
                 return -EPERM;
@@ -1484,24 +1540,19 @@ static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 
         if (vlan || qos) {
                 vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan)
-                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                                       vf_cfg->if_handle, 0);
+                status = be_set_vf_tvt(adapter, vf, vlan);
         } else {
-                /* Reset Transparent Vlan Tagging. */
-                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
-                                               vf + 1, vf_cfg->if_handle, 0);
+                status = be_clear_vf_tvt(adapter, vf);
         }
 
         if (status) {
                 dev_err(&adapter->pdev->dev,
-                        "VLAN %d config on VF %d failed : %#x\n", vlan,
-                        vf, status);
+                        "VLAN %d config on VF %d failed : %#x\n", vlan, vf,
+                        status);
                 return be_cmd_status(status);
         }
 
         vf_cfg->vlan_tag = vlan;
-
         return 0;
 }
 
@@ -2868,14 +2919,12 @@ void be_detect_error(struct be_adapter *adapter)
                         }
                 }
         } else {
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_LOW, &ue_lo);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HIGH, &ue_hi);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_LOW_MASK, &ue_lo_mask);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HI_MASK, &ue_hi_mask);
+                ue_lo = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_LOW);
+                ue_hi = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_HIGH);
+                ue_lo_mask = ioread32(adapter->pcicfg +
+                                      PCICFG_UE_STATUS_LOW_MASK);
+                ue_hi_mask = ioread32(adapter->pcicfg +
+                                      PCICFG_UE_STATUS_HI_MASK);
 
                 ue_lo = (ue_lo & ~ue_lo_mask);
                 ue_hi = (ue_hi & ~ue_hi_mask);
@@ -3480,7 +3529,6 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
                         u32 cap_flags, u32 vf)
 {
         u32 en_flags;
-        int status;
 
         en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                    BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |
@@ -3488,10 +3536,7 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
 
         en_flags &= cap_flags;
 
-        status = be_cmd_if_create(adapter, cap_flags, en_flags,
-                                  if_handle, vf);
-
-        return status;
+        return be_cmd_if_create(adapter, cap_flags, en_flags, if_handle, vf);
 }
 
 static int be_vfs_if_create(struct be_adapter *adapter)
@@ -3510,8 +3555,13 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                         status = be_cmd_get_profile_config(adapter, &res,
                                                            RESOURCE_LIMITS,
                                                            vf + 1);
-                        if (!status)
+                        if (!status) {
                                 cap_flags = res.if_cap_flags;
+                                /* Prevent VFs from enabling VLAN promiscuous
+                                 * mode
+                                 */
+                                cap_flags &= ~BE_IF_FLAGS_VLAN_PROMISCUOUS;
+                        }
                 }
 
                 status = be_if_create(adapter, &vf_cfg->if_handle,
@@ -3545,7 +3595,6 @@ static int be_vf_setup(struct be_adapter *adapter)
         struct device *dev = &adapter->pdev->dev;
         struct be_vf_cfg *vf_cfg;
         int status, old_vfs, vf;
-        u32 privileges;
 
         old_vfs = pci_num_vf(adapter->pdev);
 
@@ -3575,15 +3624,18 @@ static int be_vf_setup(struct be_adapter *adapter)
 
         for_all_vfs(adapter, vf_cfg, vf) {
                 /* Allow VFs to programs MAC/VLAN filters */
-                status = be_cmd_get_fn_privileges(adapter, &privileges, vf + 1);
-                if (!status && !(privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_get_fn_privileges(adapter, &vf_cfg->privileges,
+                                                  vf + 1);
+                if (!status && !(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
                         status = be_cmd_set_fn_privileges(adapter,
-                                                          privileges |
+                                                          vf_cfg->privileges |
                                                           BE_PRIV_FILTMGMT,
                                                           vf + 1);
-                        if (!status)
+                        if (!status) {
+                                vf_cfg->privileges |= BE_PRIV_FILTMGMT;
                                 dev_info(dev, "VF%d has FILTMGMT privilege\n",
                                          vf);
+                        }
                 }
 
                 /* Allow full available bandwidth */
@@ -5154,6 +5206,7 @@ static int be_roce_map_pci_bars(struct be_adapter *adapter)
 
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
+        struct pci_dev *pdev = adapter->pdev;
         u8 __iomem *addr;
         u32 sli_intf;
 
@@ -5163,21 +5216,33 @@ static int be_map_pci_bars(struct be_adapter *adapter)
         adapter->virtfn = (sli_intf & SLI_INTF_FT_MASK) ? 1 : 0;
 
         if (BEx_chip(adapter) && be_physfn(adapter)) {
-                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                adapter->csr = pci_iomap(pdev, 2, 0);
                 if (!adapter->csr)
                         return -ENOMEM;
         }
 
-        addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
+        addr = pci_iomap(pdev, db_bar(adapter), 0);
         if (!addr)
                 goto pci_map_err;
         adapter->db = addr;
 
+        if (skyhawk_chip(adapter) || BEx_chip(adapter)) {
+                if (be_physfn(adapter)) {
+                        /* PCICFG is the 2nd BAR in BE2 */
+                        addr = pci_iomap(pdev, BE2_chip(adapter) ? 1 : 0, 0);
+                        if (!addr)
+                                goto pci_map_err;
+                        adapter->pcicfg = addr;
+                } else {
+                        adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+                }
+        }
+
         be_roce_map_pci_bars(adapter);
         return 0;
 
 pci_map_err:
-        dev_err(&adapter->pdev->dev, "Error in mapping PCI BARs\n");
+        dev_err(&pdev->dev, "Error in mapping PCI BARs\n");
         be_unmap_pci_bars(adapter);
         return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 99492b7e3713..78e1ce09b1ab 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1189,13 +1189,12 @@ static void
 fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
 {
         struct  fec_enet_private *fep;
-        struct bufdesc *bdp, *bdp_t;
+        struct bufdesc *bdp;
         unsigned short status;
         struct  sk_buff *skb;
         struct fec_enet_priv_tx_q *txq;
         struct netdev_queue *nq;
         int     index = 0;
-        int     i, bdnum;
         int     entries_free;
 
         fep = netdev_priv(ndev);
@@ -1216,29 +1215,18 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
                 if (bdp == txq->cur_tx)
                         break;
 
-                bdp_t = bdp;
-                bdnum = 1;
-                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                skb = txq->tx_skbuff[index];
-                while (!skb) {
-                        bdp_t = fec_enet_get_nextdesc(bdp_t, fep, queue_id);
-                        index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                        skb = txq->tx_skbuff[index];
-                        bdnum++;
-                }
-                if (skb_shinfo(skb)->nr_frags &&
-                    (status = bdp_t->cbd_sc) & BD_ENET_TX_READY)
-                        break;
+                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp, fep);
 
-                for (i = 0; i < bdnum; i++) {
-                        if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
-                                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                                 bdp->cbd_datlen, DMA_TO_DEVICE);
-                        bdp->cbd_bufaddr = 0;
-                        if (i < bdnum - 1)
-                                bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
-                }
+                skb = txq->tx_skbuff[index];
                 txq->tx_skbuff[index] = NULL;
+                if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
+                        dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
+                                        bdp->cbd_datlen, DMA_TO_DEVICE);
+                bdp->cbd_bufaddr = 0;
+                if (!skb) {
+                        bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
+                        continue;
+                }
 
                 /* Check for errors. */
                 if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
@@ -1479,8 +1467,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
 
                         vlan_packet_rcvd = true;
 
-                        skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
-                                                       data, (2 * ETH_ALEN));
+                        memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
                         skb_pull(skb, VLAN_HLEN);
                 }
 
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 072426a72745..cd7675ac5bf9 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1136,6 +1136,8 @@ restart_poll:
         ibmveth_replenish_task(adapter);
 
         if (frames_processed < budget) {
+                napi_complete(napi);
+
                 /* We think we are done - reenable interrupts,
                  * then check once more to make sure we are done.
                  */
@@ -1144,8 +1146,6 @@ restart_poll:
 
                 BUG_ON(lpar_rc != H_SUCCESS);
 
-                napi_complete(napi);
-
                 if (ibmveth_rxq_pending_buffer(adapter) &&
                     napi_reschedule(napi)) {
                         lpar_rc = h_vio_signal(adapter->vdev->unit_address,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 763ba2641d5c..a8339e98ad24 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1698,8 +1698,6 @@ int mlx4_en_start_port(struct net_device *dev)
         /* Schedule multicast task to populate multicast list */
         queue_work(mdev->workqueue, &priv->rx_mode_task);
 
-        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
-
 #ifdef CONFIG_MLX4_EN_VXLAN
         if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 vxlan_get_rx_port(dev);
@@ -2882,6 +2880,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                 queue_delayed_work(mdev->workqueue, &priv->service_task,
                                    SERVICE_TASK_DELAY);
 
+        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
+
         return 0;
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 94553b501c76..8ad241bbcf25 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -453,7 +453,7 @@ struct mlx4_en_port_stats {
         unsigned long rx_chksum_none;
         unsigned long rx_chksum_complete;
         unsigned long tx_chksum_offload;
-#define NUM_PORT_STATS          9
+#define NUM_PORT_STATS          10
 };
 
 struct mlx4_en_perf_stats {
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 5d093dc0f5f5..8678e39aba08 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2248,10 +2248,9 @@ static int smc_drv_probe(struct platform_device *pdev)
         const struct of_device_id *match = NULL;
         struct smc_local *lp;
         struct net_device *ndev;
-        struct resource *res;
+        struct resource *res, *ires;
         unsigned int __iomem *addr;
         unsigned long irq_flags = SMC_IRQ_FLAGS;
-        unsigned long irq_resflags;
         int ret;
 
         ndev = alloc_etherdev(sizeof(struct smc_local));
@@ -2343,19 +2342,16 @@ static int smc_drv_probe(struct platform_device *pdev)
                 goto out_free_netdev;
         }
 
-        ndev->irq = platform_get_irq(pdev, 0);
-        if (ndev->irq <= 0) {
+        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!ires) {
                 ret = -ENODEV;
                 goto out_release_io;
         }
-        /*
-         * If this platform does not specify any special irqflags, or if
-         * the resource supplies a trigger, override the irqflags with
-         * the trigger flags from the resource.
-         */
-        irq_resflags = irqd_get_trigger_type(irq_get_irq_data(ndev->irq));
-        if (irq_flags == -1 || irq_resflags & IRQF_TRIGGER_MASK)
-                irq_flags = irq_resflags & IRQF_TRIGGER_MASK;
+
+        ndev->irq = ires->start;
+
+        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
+                irq_flags = ires->flags & IRQF_TRIGGER_MASK;
 
         ret = smc_request_attrib(pdev, ndev);
         if (ret)
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index f5498c26b3c7..8b282d0b169c 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -498,9 +498,9 @@ static int w5100_napi_poll(struct napi_struct *napi, int budget)
         }
 
         if (rx_count < budget) {
+                napi_complete(napi);
                 w5100_write(priv, W5100_IMR, IR_S0);
                 mmiowb();
-                napi_complete(napi);
         }
 
         return rx_count;
diff --git a/drivers/net/ethernet/wiznet/w5300.c b/drivers/net/ethernet/wiznet/w5300.c
index ca0c631ed628..8da7b930ff59 100644
--- a/drivers/net/ethernet/wiznet/w5300.c
+++ b/drivers/net/ethernet/wiznet/w5300.c
@@ -418,9 +418,9 @@ static int w5300_napi_poll(struct napi_struct *napi, int budget)
         }
 
         if (rx_count < budget) {
+                napi_complete(napi);
                 w5300_write(priv, W5300_IMR, IR_S0);
                 mmiowb();
-                napi_complete(napi);
         }
 
         return rx_count;
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index 3eed708a6182..fe48f4c51373 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -300,9 +300,18 @@ static const struct driver_info	cx82310_info = {
         .tx_fixup       = cx82310_tx_fixup,
 };
 
+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
+        .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+                       USB_DEVICE_ID_MATCH_DEV_INFO, \
+        .idVendor = (vend), \
+        .idProduct = (prod), \
+        .bDeviceClass = (cl), \
+        .bDeviceSubClass = (sc), \
+        .bDeviceProtocol = (pr)
+
 static const struct usb_device_id products[] = {
         {
-                USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
+                USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
                 .driver_info = (unsigned long) &cx82310_info
         },
         { },
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f1ff3666f090..59b0e9754ae3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1448,8 +1448,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
 {
         int i;
 
-        for (i = 0; i < vi->max_queue_pairs; i++)
+        for (i = 0; i < vi->max_queue_pairs; i++) {
+                napi_hash_del(&vi->rq[i].napi);
                 netif_napi_del(&vi->rq[i].napi);
+        }
 
         kfree(vi->rq);
         kfree(vi->sq);
@@ -1948,11 +1950,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
         cancel_delayed_work_sync(&vi->refill);
 
         if (netif_running(vi->dev)) {
-                for (i = 0; i < vi->max_queue_pairs; i++) {
+                for (i = 0; i < vi->max_queue_pairs; i++)
                         napi_disable(&vi->rq[i].napi);
-                        napi_hash_del(&vi->rq[i].napi);
-                        netif_napi_del(&vi->rq[i].napi);
-                }
         }
 
         remove_vq_common(vi);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index e75e4b2e6031..94603ee742ea 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1203,7 +1203,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                         goto drop;
 
                 flags &= ~VXLAN_HF_RCO;
-                vni &= VXLAN_VID_MASK;
+                vni &= VXLAN_VNI_MASK;
         }
 
         /* For backwards compatibility, only allow reserved fields to be
@@ -1224,7 +1224,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                 flags &= ~VXLAN_GBP_USED_BITS;
         }
 
-        if (flags || (vni & ~VXLAN_VID_MASK)) {
+        if (flags || vni & ~VXLAN_VNI_MASK) {
                 /* If there are any unprocessed flags remaining treat
                  * this as a malformed packet. This behavior diverges from
                  * VXLAN RFC (RFC7348) which stipulates that bits in reserved
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index ac99798570e8..ea4843be773c 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5370,6 +5370,7 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
         case 0x432a: /* BCM4321 */
         case 0x432d: /* BCM4322 */
         case 0x4352: /* BCM43222 */
+        case 0x435a: /* BCM43228 */
         case 0x4333: /* BCM4331 */
         case 0x43a2: /* BCM4360 */
         case 0x43b3: /* BCM4352 */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 50cdf7090198..8eff2753abad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
         void *dcmd_buf = NULL, *wr_pointer;
         u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
 
-        brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
-                  cmdhdr->len);
+        if (len < sizeof(*cmdhdr)) {
+                brcmf_err("vendor command too short: %d\n", len);
+                return -EINVAL;
+        }
 
         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
         ifp = vif->ifp;
 
-        len -= sizeof(struct brcmf_vndr_dcmd_hdr);
+        brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
+
+        if (cmdhdr->offset > len) {
+                brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
+                return -EINVAL;
+        }
+
+        len -= cmdhdr->offset;
         ret_len = cmdhdr->len;
         if (ret_len > 0 || len > 0) {
                 if (len > BRCMF_DCMD_MAXLEN) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index c3817fae16c0..06f6cc08f451 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -95,7 +95,8 @@ static const struct iwl_eeprom_params iwl1000_eeprom_params = {
         .nvm_calib_ver = EEPROM_1000_TX_POWER_VERSION,  \
         .base_params = &iwl1000_base_params,                    \
         .eeprom_params = &iwl1000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl1000_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
@@ -121,7 +122,8 @@ const struct iwl_cfg iwl1000_bg_cfg = {
         .base_params = &iwl1000_base_params,                    \
         .eeprom_params = &iwl1000_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl100_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 100 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 21e5d0843a62..890b95f497d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -123,7 +123,9 @@ static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,          \
         .base_params = &iwl2000_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
 
 const struct iwl_cfg iwl2000_2bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 2200 BGN",
@@ -149,7 +151,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
         .base_params = &iwl2030_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl2030_2bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
@@ -170,7 +173,8 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
         .base_params = &iwl2000_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl105_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 105 BGN",
@@ -197,7 +201,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
         .base_params = &iwl2030_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl135_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 135 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 332bbede39e5..724194e23414 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -93,7 +93,8 @@ static const struct iwl_eeprom_params iwl5000_eeprom_params = {
         .nvm_calib_ver = EEPROM_5000_TX_POWER_VERSION,  \
         .base_params = &iwl5000_base_params,                    \
         .eeprom_params = &iwl5000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl5300_agn_cfg = {
         .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
@@ -158,7 +159,8 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .base_params = &iwl5000_base_params,                    \
         .eeprom_params = &iwl5000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl5150_agn_cfg = {
         .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 8f2c3c8c6b84..21b2630763dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -145,7 +145,8 @@ static const struct iwl_eeprom_params iwl6000_eeprom_params = {
         .nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6005_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6205 AGN",
@@ -199,7 +200,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
         .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6030_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
@@ -235,7 +237,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
         .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6035_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
@@ -290,7 +293,8 @@ const struct iwl_cfg iwl130_bg_cfg = {
         .nvm_calib_ver = EEPROM_6000_TX_POWER_VERSION,  \
         .base_params = &iwl6000_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6000i_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
@@ -322,7 +326,8 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
         .base_params = &iwl6050_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6050_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
@@ -347,7 +352,8 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
         .base_params = &iwl6050_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6150_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index ce99572a982d..638ec0945009 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -793,7 +793,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         if (!vif->bss_conf.assoc)
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
-        if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+        if (mvmvif->phy_ctxt &&
+            IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
                                mvmvif->phy_ctxt->id))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index 9717ee61928c..05d31713ed38 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -832,7 +832,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         if (!vif->bss_conf.assoc)
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
-        if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+        if (mvmvif->phy_ctxt &&
+            data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
         IWL_DEBUG_COEX(data->mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 204255423d99..7396b52262b5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -402,7 +402,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
 
-                if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER)
+                if ((mvm->fw->ucode_capa.capa[0] &
+                     IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
+                    (mvm->fw->ucode_capa.api[0] &
+                     IWL_UCODE_TLV_API_LQ_SS_PARAMS))
                         hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
         }
@@ -2271,7 +2274,19 @@ static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
-        iwl_mvm_cancel_scan(mvm);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a hw_scan when it's already stopped.  This can
+         * happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_scan_completed() and the userspace called
+         * cancel scan scan before ieee80211_scan_work() could run.
+         * To handle that, simply return if the scan is not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if ((mvm->scan_status == IWL_MVM_SCAN_OS) ||
+            (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN))
+                iwl_mvm_cancel_scan(mvm);
 
         mutex_unlock(&mvm->mutex);
 }
@@ -2609,12 +2624,29 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
         int ret;
 
         mutex_lock(&mvm->mutex);
+
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a sched_scan when it's already stopped.  This
+         * can happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_sched_scan_stopped() and the userspace called
+         * stop sched scan scan before ieee80211_sched_scan_stopped_work()
+         * could run.  To handle this, simply return if the scan is
+         * not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
+            !(mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
+                mutex_unlock(&mvm->mutex);
+                return 0;
+        }
+
         ret = iwl_mvm_scan_offload_stop(mvm, false);
         mutex_unlock(&mvm->mutex);
         iwl_mvm_wait_for_async_handlers(mvm);
 
         return ret;
-
 }
 
 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index f0946b5dd7c8..a75bb150ea27 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -587,8 +587,10 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
                 return 0;
 
-        if (iwl_mvm_is_radio_killed(mvm))
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ret = 0;
                 goto out;
+        }
 
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
                                    scan_done_notif,
@@ -600,16 +602,14 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                 IWL_DEBUG_SCAN(mvm, "Send stop %sscan failed %d\n",
                                sched ? "offloaded " : "", ret);
                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
-                return ret;
+                goto out;
         }
 
         IWL_DEBUG_SCAN(mvm, "Successfully sent stop %sscan\n",
                        sched ? "offloaded " : "");
 
         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
-        if (ret)
-                return ret;
-
+out:
         /*
          * Clear the scan status so the next scan requests will succeed. This
          * also ensures the Rx handler doesn't do anything, as the scan was
@@ -619,7 +619,6 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_OS)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 
-out:
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
         if (notify) {
@@ -629,7 +628,7 @@ out:
                         ieee80211_scan_completed(mvm->hw, true);
         }
 
-        return 0;
+        return ret;
 }
 
 static void iwl_mvm_unified_scan_fill_tx_cmd(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 54fafbf9a711..f8d6f306dd76 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -750,8 +750,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
          * request
          */
         list_for_each_entry(te_data, &mvm->time_event_list, list) {
-                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
-                    te_data->running) {
+                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                         mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
                         is_p2p = true;
                         goto remove_te;
@@ -766,10 +765,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
          * request
          */
         list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
-                if (te_data->running) {
-                        mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
-                        goto remove_te;
-                }
+                mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+                goto remove_te;
         }
 
 remove_te:
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 1d4677460711..074f716020aa 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1386,8 +1386,11 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                 }
 
                 return true;
-        } else if (0x86DD == ether_type) {
-                return true;
+        } else if (ETH_P_IPV6 == ether_type) {
+                /* TODO: Handle any IPv6 cases that need special handling.
+                 * For now, always return false
+                 */
+                goto end;
         }
 
 end:
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 2c25e8e1a91e..b8c471813f4c 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -96,6 +96,7 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 static void make_tx_response(struct xenvif_queue *queue,
                              struct xen_netif_tx_request *txp,
                              s8       st);
+static void push_tx_responses(struct xenvif_queue *queue);
 
 static inline int tx_work_todo(struct xenvif_queue *queue);
 
@@ -655,15 +656,10 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
         unsigned long flags;
 
         do {
-                int notify;
-
                 spin_lock_irqsave(&queue->response_lock, flags);
                 make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
-                RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+                push_tx_responses(queue);
                 spin_unlock_irqrestore(&queue->response_lock, flags);
-                if (notify)
-                        notify_remote_via_irq(queue->tx_irq);
-
                 if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&queue->tx, cons++);
@@ -1655,7 +1651,6 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 {
         struct pending_tx_info *pending_tx_info;
         pending_ring_idx_t index;
-        int notify;
         unsigned long flags;
 
         pending_tx_info = &queue->pending_tx_info[pending_idx];
@@ -1671,12 +1666,9 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
         index = pending_index(queue->pending_prod++);
         queue->pending_ring[index] = pending_idx;
 
-        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        push_tx_responses(queue);
 
         spin_unlock_irqrestore(&queue->response_lock, flags);
-
-        if (notify)
-                notify_remote_via_irq(queue->tx_irq);
 }
 
 
@@ -1697,6 +1689,15 @@ static void make_tx_response(struct xenvif_queue *queue,
         queue->tx.rsp_prod_pvt = ++i;
 }
 
+static void push_tx_responses(struct xenvif_queue *queue)
+{
+        int notify;
+
+        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        if (notify)
+                notify_remote_via_irq(queue->tx_irq);
+}
+
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                              u16      id,
                                              s8       st,
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 38d1c51f58b1..7bcaeec876c0 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -84,8 +84,7 @@ config OF_RESOLVE
         bool
 
 config OF_OVERLAY
-        bool
-        depends on OF
+        bool "Device Tree overlays"
         select OF_DYNAMIC
         select OF_RESOLVE
 
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 0a8aeb8523fe..adb8764861c0 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -714,16 +714,17 @@ static struct device_node *__of_find_node_by_path(struct device_node *parent,
                                                 const char *path)
 {
         struct device_node *child;
-        int len = strchrnul(path, '/') - path;
-        int term;
+        int len;
+        const char *end;
 
+        end = strchr(path, ':');
+        if (!end)
+                end = strchrnul(path, '/');
+
+        len = end - path;
         if (!len)
                 return NULL;
 
-        term = strchrnul(path, ':') - path;
-        if (term < len)
-                len = term;
-
         __for_each_child_of_node(parent, child) {
                 const char *name = strrchr(child->full_name, '/');
                 if (WARN(!name, "malformed device_node %s\n", child->full_name))
@@ -768,8 +769,12 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
 
         /* The path could begin with an alias */
         if (*path != '/') {
-                char *p = strchrnul(path, '/');
-                int len = separator ? separator - path : p - path;
+                int len;
+                const char *p = separator;
+
+                if (!p)
+                        p = strchrnul(path, '/');
+                len = p - path;
 
                 /* of_aliases must not be NULL */
                 if (!of_aliases)
@@ -794,6 +799,8 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
                 path++; /* Increment past '/' delimiter */
                 np = __of_find_node_by_path(np, path);
                 path = strchrnul(path, '/');
+                if (separator && separator < path)
+                        break;
         }
         raw_spin_unlock_irqrestore(&devtree_lock, flags);
         return np;
@@ -1886,8 +1893,10 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
                         name = of_get_property(of_chosen, "linux,stdout-path", NULL);
                 if (IS_ENABLED(CONFIG_PPC) && !name)
                         name = of_get_property(of_aliases, "stdout", NULL);
-                if (name)
+                if (name) {
                         of_stdout = of_find_node_opts_by_path(name, &of_stdout_options);
+                        add_preferred_console("stdout-path", 0, NULL);
+                }
         }
 
         if (!of_aliases)
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 352b4f28f82c..dee9270ba547 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -19,6 +19,7 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/idr.h>
 
 #include "of_private.h"
 
@@ -85,7 +86,7 @@ static int of_overlay_apply_single_device_node(struct of_overlay *ov,
                 struct device_node *target, struct device_node *child)
 {
         const char *cname;
-        struct device_node *tchild, *grandchild;
+        struct device_node *tchild;
         int ret = 0;
 
         cname = kbasename(child->full_name);
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 0cf9a236d438..aba8946cac46 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -92,6 +92,11 @@ static void __init of_selftest_find_node_by_name(void)
                  "option path test failed\n");
         of_node_put(np);
 
+        np = of_find_node_opts_by_path("/testcase-data:test/option", &options);
+        selftest(np && !strcmp("test/option", options),
+                 "option path test, subcase #1 failed\n");
+        of_node_put(np);
+
         np = of_find_node_opts_by_path("/testcase-data:testoption", NULL);
         selftest(np, "NULL option path test failed\n");
         of_node_put(np);
@@ -102,6 +107,12 @@ static void __init of_selftest_find_node_by_name(void)
                  "option alias path test failed\n");
         of_node_put(np);
 
+        np = of_find_node_opts_by_path("testcase-alias:test/alias/option",
+                                       &options);
+        selftest(np && !strcmp("test/alias/option", options),
+                 "option alias path test, subcase #1 failed\n");
+        of_node_put(np);
+
         np = of_find_node_opts_by_path("testcase-alias:testaliasoption", NULL);
         selftest(np, "NULL option alias path test failed\n");
         of_node_put(np);
@@ -378,9 +389,9 @@ static void __init of_selftest_property_string(void)
         rc = of_property_match_string(np, "phandle-list-names", "first");
         selftest(rc == 0, "first expected:0 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "second");
-        selftest(rc == 1, "second expected:0 got:%i\n", rc);
+        selftest(rc == 1, "second expected:1 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "third");
-        selftest(rc == 2, "third expected:0 got:%i\n", rc);
+        selftest(rc == 2, "third expected:2 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "fourth");
         selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
         rc = of_property_match_string(np, "missing-property", "blah");
@@ -478,7 +489,6 @@ static void __init of_selftest_changeset(void)
         struct device_node *n1, *n2, *n21, *nremove, *parent, *np;
         struct of_changeset chgset;
 
-        of_changeset_init(&chgset);
         n1 = __of_node_dup(NULL, "/testcase-data/changeset/n1");
         selftest(n1, "testcase setup failure\n");
         n2 = __of_node_dup(NULL, "/testcase-data/changeset/n2");
@@ -979,7 +989,7 @@ static int of_path_platform_device_exists(const char *path)
         return pdev != NULL;
 }
 
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
 
 /* get the i2c client device instantiated at the path */
 static struct i2c_client *of_path_to_i2c_client(const char *path)
@@ -1445,7 +1455,7 @@ static void of_selftest_overlay_11(void)
                 return;
 }
 
-#if IS_ENABLED(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
+#if IS_BUILTIN(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
 
 struct selftest_i2c_bus_data {
         struct platform_device  *pdev;
@@ -1584,7 +1594,7 @@ static struct i2c_driver selftest_i2c_dev_driver = {
         .id_table = selftest_i2c_dev_id,
 };
 
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
 
 struct selftest_i2c_mux_data {
         int nchans;
@@ -1695,7 +1705,7 @@ static int of_selftest_overlay_i2c_init(void)
                         "could not register selftest i2c bus driver\n"))
                 return ret;
 
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
         ret = i2c_add_driver(&selftest_i2c_mux_driver);
         if (selftest(ret == 0,
                         "could not register selftest i2c mux driver\n"))
@@ -1707,7 +1717,7 @@ static int of_selftest_overlay_i2c_init(void)
 
 static void of_selftest_overlay_i2c_cleanup(void)
 {
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
         i2c_del_driver(&selftest_i2c_mux_driver);
 #endif
         platform_driver_unregister(&selftest_i2c_bus_driver);
@@ -1814,7 +1824,7 @@ static void __init of_selftest_overlay(void)
         of_selftest_overlay_10();
         of_selftest_overlay_11();
 
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
         if (selftest(of_selftest_overlay_i2c_init() == 0, "i2c init failed\n"))
                 goto out;
 
diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
index aab55474dd0d..ee082c0366ec 100644
--- a/drivers/pci/host/pci-xgene.c
+++ b/drivers/pci/host/pci-xgene.c
@@ -127,7 +127,7 @@ static bool xgene_pcie_hide_rc_bars(struct pci_bus *bus, int offset)
         return false;
 }
 
-static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
+static void __iomem *xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                               int offset)
 {
         struct xgene_pcie_port *port = bus->sysdata;
@@ -137,7 +137,7 @@ static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                 return NULL;
 
         xgene_pcie_set_rtdid_reg(bus, devfn);
-        return xgene_pcie_get_cfg_base(bus);
+        return xgene_pcie_get_cfg_base(bus) + offset;
 }
 
 static struct pci_ops xgene_pcie_ops = {
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index aa012fb3834b..312f23a8429c 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -521,7 +521,8 @@ static ssize_t driver_override_store(struct device *dev,
         struct pci_dev *pdev = to_pci_dev(dev);
         char *driver_override, *old = pdev->driver_override, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -549,7 +550,7 @@ static ssize_t driver_override_show(struct device *dev,
 {
         struct pci_dev *pdev = to_pci_dev(dev);
 
-        return sprintf(buf, "%s\n", pdev->driver_override);
+        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
 }
 static DEVICE_ATTR_RW(driver_override);
 
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 5afe03e28b91..2062c224e32f 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -66,6 +66,10 @@
 #define BYT_DIR_MASK            (BIT(1) | BIT(2))
 #define BYT_TRIG_MASK           (BIT(26) | BIT(25) | BIT(24))
 
+#define BYT_CONF0_RESTORE_MASK  (BYT_DIRECT_IRQ_EN | BYT_TRIG_MASK | \
+                                 BYT_PIN_MUX)
+#define BYT_VAL_RESTORE_MASK    (BYT_DIR_MASK | BYT_LEVEL)
+
 #define BYT_NGPIO_SCORE         102
 #define BYT_NGPIO_NCORE         28
 #define BYT_NGPIO_SUS           44
@@ -134,12 +138,18 @@ static struct pinctrl_gpio_range byt_ranges[] = {
         },
 };
 
+struct byt_gpio_pin_context {
+        u32 conf0;
+        u32 val;
+};
+
 struct byt_gpio {
         struct gpio_chip                chip;
         struct platform_device          *pdev;
         spinlock_t                      lock;
         void __iomem                    *reg_base;
         struct pinctrl_gpio_range       *range;
+        struct byt_gpio_pin_context     *saved_context;
 };
 
 #define to_byt_gpio(c)  container_of(c, struct byt_gpio, chip)
@@ -158,40 +168,62 @@ static void __iomem *byt_gpio_reg(struct gpio_chip *chip, unsigned offset,
         return vg->reg_base + reg_offset + reg;
 }
 
-static bool is_special_pin(struct byt_gpio *vg, unsigned offset)
+static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned offset)
+{
+        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        unsigned long flags;
+        u32 value;
+
+        spin_lock_irqsave(&vg->lock, flags);
+        value = readl(reg);
+        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+        writel(value, reg);
+        spin_unlock_irqrestore(&vg->lock, flags);
+}
+
+static u32 byt_get_gpio_mux(struct byt_gpio *vg, unsigned offset)
 {
         /* SCORE pin 92-93 */
         if (!strcmp(vg->range->name, BYT_SCORE_ACPI_UID) &&
                 offset >= 92 && offset <= 93)
-                return true;
+                return 1;
 
         /* SUS pin 11-21 */
         if (!strcmp(vg->range->name, BYT_SUS_ACPI_UID) &&
                 offset >= 11 && offset <= 21)
-                return true;
+                return 1;
 
-        return false;
+        return 0;
 }
 
 static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 {
         struct byt_gpio *vg = to_byt_gpio(chip);
         void __iomem *reg = byt_gpio_reg(chip, offset, BYT_CONF0_REG);
-        u32 value;
-        bool special;
+        u32 value, gpio_mux;
 
         /*
          * In most cases, func pin mux 000 means GPIO function.
          * But, some pins may have func pin mux 001 represents
-         * GPIO function. Only allow user to export pin with
-         * func pin mux preset as GPIO function by BIOS/FW.
+         * GPIO function.
+         *
+         * Because there are devices out there where some pins were not
+         * configured correctly we allow changing the mux value from
+         * request (but print out warning about that).
          */
         value = readl(reg) & BYT_PIN_MUX;
-        special = is_special_pin(vg, offset);
-        if ((special && value != 1) || (!special && value)) {
-                dev_err(&vg->pdev->dev,
-                        "pin %u cannot be used as GPIO.\n", offset);
-                return -EINVAL;
+        gpio_mux = byt_get_gpio_mux(vg, offset);
+        if (WARN_ON(gpio_mux != value)) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&vg->lock, flags);
+                value = readl(reg) & ~BYT_PIN_MUX;
+                value |= gpio_mux;
+                writel(value, reg);
+                spin_unlock_irqrestore(&vg->lock, flags);
+
+                dev_warn(&vg->pdev->dev,
+                         "pin %u forcibly re-configured as GPIO\n", offset);
         }
 
         pm_runtime_get(&vg->pdev->dev);
@@ -202,14 +234,8 @@ static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 static void byt_gpio_free(struct gpio_chip *chip, unsigned offset)
 {
         struct byt_gpio *vg = to_byt_gpio(chip);
-        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
-        u32 value;
-
-        /* clear interrupt triggering */
-        value = readl(reg);
-        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
-        writel(value, reg);
 
+        byt_gpio_clear_triggering(vg, offset);
         pm_runtime_put(&vg->pdev->dev);
 }
 
@@ -236,23 +262,13 @@ static int byt_irq_type(struct irq_data *d, unsigned type)
         value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
                    BYT_TRIG_LVL);
 
-        switch (type) {
-        case IRQ_TYPE_LEVEL_HIGH:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_RISING:
-                value |= BYT_TRIG_POS;
-                break;
-        case IRQ_TYPE_LEVEL_LOW:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_FALLING:
-                value |= BYT_TRIG_NEG;
-                break;
-        case IRQ_TYPE_EDGE_BOTH:
-                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
-                break;
-        }
         writel(value, reg);
 
+        if (type & IRQ_TYPE_EDGE_BOTH)
+                __irq_set_handler_locked(d->irq, handle_edge_irq);
+        else if (type & IRQ_TYPE_LEVEL_MASK)
+                __irq_set_handler_locked(d->irq, handle_level_irq);
+
         spin_unlock_irqrestore(&vg->lock, flags);
 
         return 0;
@@ -410,58 +426,80 @@ static void byt_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct byt_gpio *vg = to_byt_gpio(irq_desc_get_handler_data(desc));
         struct irq_chip *chip = irq_data_get_irq_chip(data);
-        u32 base, pin, mask;
+        u32 base, pin;
         void __iomem *reg;
-        u32 pending;
+        unsigned long pending;
         unsigned virq;
-        int looplimit = 0;
 
         /* check from GPIO controller which pin triggered the interrupt */
         for (base = 0; base < vg->chip.ngpio; base += 32) {
-
                 reg = byt_gpio_reg(&vg->chip, base, BYT_INT_STAT_REG);
-
-                while ((pending = readl(reg))) {
-                        pin = __ffs(pending);
-                        mask = BIT(pin);
-                        /* Clear before handling so we can't lose an edge */
-                        writel(mask, reg);
-
+                pending = readl(reg);
+                for_each_set_bit(pin, &pending, 32) {
                         virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
                         generic_handle_irq(virq);
-
-                        /* In case bios or user sets triggering incorretly a pin
-                         * might remain in "interrupt triggered" state.
-                         */
-                        if (looplimit++ > 32) {
-                                dev_err(&vg->pdev->dev,
-                                        "Gpio %d interrupt flood, disabling\n",
-                                        base + pin);
-
-                                reg = byt_gpio_reg(&vg->chip, base + pin,
-                                                   BYT_CONF0_REG);
-                                mask = readl(reg);
-                                mask &= ~(BYT_TRIG_NEG | BYT_TRIG_POS |
-                                          BYT_TRIG_LVL);
-                                writel(mask, reg);
-                                mask = readl(reg); /* flush */
-                                break;
-                        }
                 }
         }
         chip->irq_eoi(data);
 }
 
+static void byt_irq_ack(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        void __iomem *reg;
+
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_INT_STAT_REG);
+        writel(BIT(offset % 32), reg);
+}
+
 static void byt_irq_unmask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        unsigned long flags;
+        void __iomem *reg;
+        u32 value;
+
+        spin_lock_irqsave(&vg->lock, flags);
+
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        value = readl(reg);
+
+        switch (irqd_get_trigger_type(d)) {
+        case IRQ_TYPE_LEVEL_HIGH:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_RISING:
+                value |= BYT_TRIG_POS;
+                break;
+        case IRQ_TYPE_LEVEL_LOW:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_FALLING:
+                value |= BYT_TRIG_NEG;
+                break;
+        case IRQ_TYPE_EDGE_BOTH:
+                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
+                break;
+        }
+
+        writel(value, reg);
+
+        spin_unlock_irqrestore(&vg->lock, flags);
 }
 
 static void byt_irq_mask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+
+        byt_gpio_clear_triggering(vg, irqd_to_hwirq(d));
 }
 
 static struct irq_chip byt_irqchip = {
         .name = "BYT-GPIO",
+        .irq_ack = byt_irq_ack,
         .irq_mask = byt_irq_mask,
         .irq_unmask = byt_irq_unmask,
         .irq_set_type = byt_irq_type,
@@ -472,6 +510,21 @@ static void byt_gpio_irq_init_hw(struct byt_gpio *vg)
 {
         void __iomem *reg;
         u32 base, value;
+        int i;
+
+        /*
+         * Clear interrupt triggers for all pins that are GPIOs and
+         * do not use direct IRQ mode. This will prevent spurious
+         * interrupts from misconfigured pins.
+         */
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                value = readl(byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG));
+                if ((value & BYT_PIN_MUX) == byt_get_gpio_mux(vg, i) &&
+                    !(value & BYT_DIRECT_IRQ_EN)) {
+                        byt_gpio_clear_triggering(vg, i);
+                        dev_dbg(&vg->pdev->dev, "disabling GPIO %d\n", i);
+                }
+        }
 
         /* clear interrupt status trigger registers */
         for (base = 0; base < vg->chip.ngpio; base += 32) {
@@ -541,6 +594,11 @@ static int byt_gpio_probe(struct platform_device *pdev)
         gc->can_sleep = false;
         gc->dev = dev;
 
+#ifdef CONFIG_PM_SLEEP
+        vg->saved_context = devm_kcalloc(&pdev->dev, gc->ngpio,
+                                       sizeof(*vg->saved_context), GFP_KERNEL);
+#endif
+
         ret = gpiochip_add(gc);
         if (ret) {
                 dev_err(&pdev->dev, "failed adding byt-gpio chip\n");
@@ -569,6 +627,69 @@ static int byt_gpio_probe(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int byt_gpio_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg) & BYT_CONF0_RESTORE_MASK;
+                vg->saved_context[i].conf0 = value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg) & BYT_VAL_RESTORE_MASK;
+                vg->saved_context[i].val = value;
+        }
+
+        return 0;
+}
+
+static int byt_gpio_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg);
+                if ((value & BYT_CONF0_RESTORE_MASK) !=
+                     vg->saved_context[i].conf0) {
+                        value &= ~BYT_CONF0_RESTORE_MASK;
+                        value |= vg->saved_context[i].conf0;
+                        writel(value, reg);
+                        dev_info(dev, "restored pin %d conf0 %#08x", i, value);
+                }
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg);
+                if ((value & BYT_VAL_RESTORE_MASK) !=
+                     vg->saved_context[i].val) {
+                        u32 v;
+
+                        v = value & ~BYT_VAL_RESTORE_MASK;
+                        v |= vg->saved_context[i].val;
+                        if (v != value) {
+                                writel(v, reg);
+                                dev_dbg(dev, "restored pin %d val %#08x\n",
+                                        i, v);
+                        }
+                }
+        }
+
+        return 0;
+}
+#endif
+
 static int byt_gpio_runtime_suspend(struct device *dev)
 {
         return 0;
@@ -580,8 +701,9 @@ static int byt_gpio_runtime_resume(struct device *dev)
 }
 
 static const struct dev_pm_ops byt_gpio_pm_ops = {
-        .runtime_suspend = byt_gpio_runtime_suspend,
-        .runtime_resume = byt_gpio_runtime_resume,
+        SET_LATE_SYSTEM_SLEEP_PM_OPS(byt_gpio_suspend, byt_gpio_resume)
+        SET_RUNTIME_PM_OPS(byt_gpio_runtime_suspend, byt_gpio_runtime_resume,
+                           NULL)
 };
 
 static const struct acpi_device_id byt_gpio_acpi_match[] = {
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 3034fd03bced..82f691eeeec4 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1226,6 +1226,7 @@ static int chv_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 static int chv_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
                                      int value)
 {
+        chv_gpio_set(chip, offset, value);
         return pinctrl_gpio_direction_output(chip->base + offset);
 }
 
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index f4cd0b9b2438..a4814066ea08 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1477,28 +1477,25 @@ static void gpio_irq_ack(struct irq_data *d)
         /* the interrupt is already cleared before by reading ISR */
 }
 
-static unsigned int gpio_irq_startup(struct irq_data *d)
+static int gpio_irq_request_res(struct irq_data *d)
 {
         struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
         unsigned        pin = d->hwirq;
         int ret;
 
         ret = gpiochip_lock_as_irq(&at91_gpio->chip, pin);
-        if (ret) {
+        if (ret)
                 dev_err(at91_gpio->chip.dev, "unable to lock pind %lu IRQ\n",
                         d->hwirq);
-                return ret;
-        }
-        gpio_irq_unmask(d);
-        return 0;
+
+        return ret;
 }
 
-static void gpio_irq_shutdown(struct irq_data *d)
+static void gpio_irq_release_res(struct irq_data *d)
 {
         struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
         unsigned        pin = d->hwirq;
 
-        gpio_irq_mask(d);
         gpiochip_unlock_as_irq(&at91_gpio->chip, pin);
 }
 
@@ -1577,8 +1574,8 @@ void at91_pinctrl_gpio_resume(void)
 static struct irq_chip gpio_irqchip = {
         .name           = "GPIO",
         .irq_ack        = gpio_irq_ack,
-        .irq_startup    = gpio_irq_startup,
-        .irq_shutdown   = gpio_irq_shutdown,
+        .irq_request_resources = gpio_irq_request_res,
+        .irq_release_resources = gpio_irq_release_res,
         .irq_disable    = gpio_irq_mask,
         .irq_mask       = gpio_irq_mask,
         .irq_unmask     = gpio_irq_unmask,
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
index 24c5d88f943f..3c68a8e5e0dd 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
@@ -1011,6 +1011,7 @@ static const struct sunxi_pinctrl_desc sun4i_a10_pinctrl_data = {
         .pins = sun4i_a10_pins,
         .npins = ARRAY_SIZE(sun4i_a10_pins),
         .irq_banks = 1,
+        .irq_read_needs_mux = true,
 };
 
 static int sun4i_a10_pinctrl_probe(struct platform_device *pdev)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 3d0744337736..f8e171b76693 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -29,6 +29,7 @@
 #include <linux/slab.h>
 
 #include "../core.h"
+#include "../../gpio/gpiolib.h"
 #include "pinctrl-sunxi.h"
 
 static struct irq_chip sunxi_pinctrl_edge_irq_chip;
@@ -464,10 +465,19 @@ static int sunxi_pinctrl_gpio_direction_input(struct gpio_chip *chip,
 static int sunxi_pinctrl_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = dev_get_drvdata(chip->dev);
-
         u32 reg = sunxi_data_reg(offset);
         u8 index = sunxi_data_offset(offset);
-        u32 val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+        u32 set_mux = pctl->desc->irq_read_needs_mux &&
+                        test_bit(FLAG_USED_AS_IRQ, &chip->desc[offset].flags);
+        u32 val;
+
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_INPUT);
+
+        val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_IRQ);
 
         return val;
 }
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index 5a51523a3459..e248e81a0f9e 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -77,6 +77,9 @@
 #define IRQ_LEVEL_LOW           0x03
 #define IRQ_EDGE_BOTH           0x04
 
+#define SUN4I_FUNC_INPUT        0
+#define SUN4I_FUNC_IRQ          6
+
 struct sunxi_desc_function {
         const char      *name;
         u8              muxval;
@@ -94,6 +97,7 @@ struct sunxi_pinctrl_desc {
         int                             npins;
         unsigned                        pin_base;
         unsigned                        irq_banks;
+        bool                            irq_read_needs_mux;
 };
 
 struct sunxi_pinctrl_function {
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 1245dca79009..a4a8a6dc60c4 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1839,10 +1839,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
         }
 
         if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, true);
-                if (ret < 0)
-                        return ret;
-                rdev->ena_gpio_state = 1;
+                if (!rdev->ena_gpio_state) {
+                        ret = regulator_ena_gpio_ctrl(rdev, true);
+                        if (ret < 0)
+                                return ret;
+                        rdev->ena_gpio_state = 1;
+                }
         } else if (rdev->desc->ops->enable) {
                 ret = rdev->desc->ops->enable(rdev);
                 if (ret < 0)
@@ -1939,10 +1941,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
         trace_regulator_disable(rdev_get_name(rdev));
 
         if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, false);
-                if (ret < 0)
-                        return ret;
-                rdev->ena_gpio_state = 0;
+                if (rdev->ena_gpio_state) {
+                        ret = regulator_ena_gpio_ctrl(rdev, false);
+                        if (ret < 0)
+                                return ret;
+                        rdev->ena_gpio_state = 0;
+                }
 
         } else if (rdev->desc->ops->disable) {
                 ret = rdev->desc->ops->disable(rdev);
@@ -3626,12 +3630,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
                                  config->ena_gpio, ret);
                         goto wash;
                 }
-
-                if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-                        rdev->ena_gpio_state = 1;
-
-                if (config->ena_gpio_invert)
-                        rdev->ena_gpio_state = !rdev->ena_gpio_state;
         }
 
         /* set regulator constraints */
@@ -3800,9 +3798,11 @@ int regulator_suspend_finish(void)
         list_for_each_entry(rdev, &regulator_list, list) {
                 mutex_lock(&rdev->mutex);
                 if (rdev->use_count > 0  || rdev->constraints->always_on) {
-                        error = _regulator_do_enable(rdev);
-                        if (error)
-                                ret = error;
+                        if (!_regulator_is_enabled(rdev)) {
+                                error = _regulator_do_enable(rdev);
+                                if (error)
+                                        ret = error;
+                        }
                 } else {
                         if (!have_full_constraints())
                                 goto unlock;
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index e2cffe01b807..fb991ec76423 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -17,6 +17,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/err.h>
+#include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 92f6af6da699..73354ee27877 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -951,6 +951,7 @@ static int rpmsg_probe(struct virtio_device *vdev)
         void *bufs_va;
         int err = 0, i;
         size_t total_buf_space;
+        bool notify;
 
         vrp = kzalloc(sizeof(*vrp), GFP_KERNEL);
         if (!vrp)
@@ -1030,8 +1031,22 @@ static int rpmsg_probe(struct virtio_device *vdev)
                 }
         }
 
+        /*
+         * Prepare to kick but don't notify yet - we can't do this before
+         * device is ready.
+         */
+        notify = virtqueue_kick_prepare(vrp->rvq);
+
+        /* From this point on, we can notify and get callbacks. */
+        virtio_device_ready(vdev);
+
         /* tell the remote processor it can start sending messages */
-        virtqueue_kick(vrp->rvq);
+        /*
+         * this might be concurrent with callbacks, but we are only
+         * doing notify, not a full kick here, so that's ok.
+         */
+        if (notify)
+                virtqueue_notify(vrp->rvq);
 
         dev_info(&vdev->dev, "rpmsg host is online\n");
 
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 4241eeab3386..f4cf6851fae9 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443_rtc_data = {
 
 static struct s3c_rtc_data const s3c6410_rtc_data = {
         .max_user_freq          = 32768,
+        .needs_src_clk          = true,
         .irq_handler            = s3c6410_rtc_irq,
         .set_freq               = s3c6410_rtc_setfreq,
         .enable_tick            = s3c6410_rtc_enable_tick,
diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
index 62b58d38ce2e..60de66252fa2 100644
--- a/drivers/scsi/libsas/sas_discover.c
+++ b/drivers/scsi/libsas/sas_discover.c
@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
         struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
         struct sas_ha_struct *ha = port->ha;
+        struct domain_device *ddev = port->port_dev;
 
         /* prevent revalidation from finding sata links in recovery */
         mutex_lock(&ha->disco_mutex);
@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
         SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
                     task_pid_nr(current));
 
-        if (port->port_dev)
-                res = sas_ex_revalidate_domain(port->port_dev);
+        if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
+                     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
+                res = sas_ex_revalidate_domain(ddev);
 
         SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
                     port->id, task_pid_nr(current), res);
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index af98b096af2f..175c9956cbe3 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -144,10 +144,9 @@ struct ffs_io_data {
         bool read;
 
         struct kiocb *kiocb;
-        const struct iovec *iovec;
-        unsigned long nr_segs;
-        char __user *buf;
-        size_t len;
+        struct iov_iter data;
+        const void *to_free;
+        char *buf;
 
         struct mm_struct *mm;
         struct work_struct work;
@@ -649,29 +648,10 @@ static void ffs_user_copy_worker(struct work_struct *work)
                                          io_data->req->actual;
 
         if (io_data->read && ret > 0) {
-                int i;
-                size_t pos = 0;
-
-                /*
-                 * Since req->length may be bigger than io_data->len (after
-                 * being rounded up to maxpacketsize), we may end up with more
-                 * data then user space has space for.
-                 */
-                ret = min_t(int, ret, io_data->len);
-
                 use_mm(io_data->mm);
-                for (i = 0; i < io_data->nr_segs; i++) {
-                        size_t len = min_t(size_t, ret - pos,
-                                        io_data->iovec[i].iov_len);
-                        if (!len)
-                                break;
-                        if (unlikely(copy_to_user(io_data->iovec[i].iov_base,
-                                                 &io_data->buf[pos], len))) {
-                                ret = -EFAULT;
-                                break;
-                        }
-                        pos += len;
-                }
+                ret = copy_to_iter(io_data->buf, ret, &io_data->data);
+                if (iov_iter_count(&io_data->data))
+                        ret = -EFAULT;
                 unuse_mm(io_data->mm);
         }
 
@@ -684,7 +664,7 @@ static void ffs_user_copy_worker(struct work_struct *work)
 
         io_data->kiocb->private = NULL;
         if (io_data->read)
-                kfree(io_data->iovec);
+                kfree(io_data->to_free);
         kfree(io_data->buf);
         kfree(io_data);
 }
@@ -743,6 +723,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                  * before the waiting completes, so do not assign to 'gadget' earlier
                  */
                 struct usb_gadget *gadget = epfile->ffs->gadget;
+                size_t copied;
 
                 spin_lock_irq(&epfile->ffs->eps_lock);
                 /* In the meantime, endpoint got disabled or changed. */
@@ -750,34 +731,21 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                         spin_unlock_irq(&epfile->ffs->eps_lock);
                         return -ESHUTDOWN;
                 }
+                data_len = iov_iter_count(&io_data->data);
                 /*
                  * Controller may require buffer size to be aligned to
                  * maxpacketsize of an out endpoint.
                  */
-                data_len = io_data->read ?
-                           usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
-                           io_data->len;
+                if (io_data->read)
+                        data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
                 spin_unlock_irq(&epfile->ffs->eps_lock);
 
                 data = kmalloc(data_len, GFP_KERNEL);
                 if (unlikely(!data))
                         return -ENOMEM;
-                if (io_data->aio && !io_data->read) {
-                        int i;
-                        size_t pos = 0;
-                        for (i = 0; i < io_data->nr_segs; i++) {
-                                if (unlikely(copy_from_user(&data[pos],
-                                             io_data->iovec[i].iov_base,
-                                             io_data->iovec[i].iov_len))) {
-                                        ret = -EFAULT;
-                                        goto error;
-                                }
-                                pos += io_data->iovec[i].iov_len;
-                        }
-                } else {
-                        if (!io_data->read &&
-                            unlikely(__copy_from_user(data, io_data->buf,
-                                                      io_data->len))) {
+                if (!io_data->read) {
+                        copied = copy_from_iter(data, data_len, &io_data->data);
+                        if (copied != data_len) {
                                 ret = -EFAULT;
                                 goto error;
                         }
@@ -876,10 +844,8 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                                  */
                                 ret = ep->status;
                                 if (io_data->read && ret > 0) {
-                                        ret = min_t(size_t, ret, io_data->len);
-
-                                        if (unlikely(copy_to_user(io_data->buf,
-                                                data, ret)))
+                                        ret = copy_to_iter(data, ret, &io_data->data);
+                                        if (unlikely(iov_iter_count(&io_data->data)))
                                                 ret = -EFAULT;
                                 }
                         }
@@ -898,37 +864,6 @@ error:
         return ret;
 }
 
-static ssize_t
-ffs_epfile_write(struct file *file, const char __user *buf, size_t len,
-                 loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-
-        ENTER();
-
-        io_data.aio = false;
-        io_data.read = false;
-        io_data.buf = (char * __user)buf;
-        io_data.len = len;
-
-        return ffs_epfile_io(file, &io_data);
-}
-
-static ssize_t
-ffs_epfile_read(struct file *file, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-
-        ENTER();
-
-        io_data.aio = false;
-        io_data.read = true;
-        io_data.buf = buf;
-        io_data.len = len;
-
-        return ffs_epfile_io(file, &io_data);
-}
-
 static int
 ffs_epfile_open(struct inode *inode, struct file *file)
 {
@@ -965,67 +900,86 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
         return value;
 }
 
-static ssize_t ffs_epfile_aio_write(struct kiocb *kiocb,
-                                    const struct iovec *iovec,
-                                    unsigned long nr_segs, loff_t loff)
+static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
 {
-        struct ffs_io_data *io_data;
+        struct ffs_io_data io_data, *p = &io_data;
+        ssize_t res;
 
         ENTER();
 
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
-        if (unlikely(!io_data))
-                return -ENOMEM;
+        if (!is_sync_kiocb(kiocb)) {
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
+                if (unlikely(!p))
+                        return -ENOMEM;
+                p->aio = true;
+        } else {
+                p->aio = false;
+        }
 
-        io_data->aio = true;
-        io_data->read = false;
-        io_data->kiocb = kiocb;
-        io_data->iovec = iovec;
-        io_data->nr_segs = nr_segs;
-        io_data->len = kiocb->ki_nbytes;
-        io_data->mm = current->mm;
+        p->read = false;
+        p->kiocb = kiocb;
+        p->data = *from;
+        p->mm = current->mm;
 
-        kiocb->private = io_data;
+        kiocb->private = p;
 
         kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+        if (p->aio)
+                kfree(p);
+        else
+                *from = p->data;
+        return res;
 }
 
-static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb,
-                                   const struct iovec *iovec,
-                                   unsigned long nr_segs, loff_t loff)
+static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
 {
-        struct ffs_io_data *io_data;
-        struct iovec *iovec_copy;
+        struct ffs_io_data io_data, *p = &io_data;
+        ssize_t res;
 
         ENTER();
 
-        iovec_copy = kmalloc_array(nr_segs, sizeof(*iovec_copy), GFP_KERNEL);
-        if (unlikely(!iovec_copy))
-                return -ENOMEM;
-
-        memcpy(iovec_copy, iovec, sizeof(struct iovec)*nr_segs);
-
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
-        if (unlikely(!io_data)) {
-                kfree(iovec_copy);
-                return -ENOMEM;
+        if (!is_sync_kiocb(kiocb)) {
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
+                if (unlikely(!p))
+                        return -ENOMEM;
+                p->aio = true;
+        } else {
+                p->aio = false;
         }
 
-        io_data->aio = true;
-        io_data->read = true;
-        io_data->kiocb = kiocb;
-        io_data->iovec = iovec_copy;
-        io_data->nr_segs = nr_segs;
-        io_data->len = kiocb->ki_nbytes;
-        io_data->mm = current->mm;
+        p->read = true;
+        p->kiocb = kiocb;
+        if (p->aio) {
+                p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
+                if (!p->to_free) {
+                        kfree(p);
+                        return -ENOMEM;
+                }
+        } else {
+                p->data = *to;
+                p->to_free = NULL;
+        }
+        p->mm = current->mm;
 
-        kiocb->private = io_data;
+        kiocb->private = p;
 
         kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+
+        if (p->aio) {
+                kfree(p->to_free);
+                kfree(p);
+        } else {
+                *to = p->data;
+        }
+        return res;
 }
 
 static int
@@ -1105,10 +1059,10 @@ static const struct file_operations ffs_epfile_operations = {
         .llseek =       no_llseek,
 
         .open =         ffs_epfile_open,
-        .write =        ffs_epfile_write,
-        .read =         ffs_epfile_read,
-        .aio_write =    ffs_epfile_aio_write,
-        .aio_read =     ffs_epfile_aio_read,
+        .write =        new_sync_write,
+        .read =         new_sync_read,
+        .write_iter =   ffs_epfile_write_iter,
+        .read_iter =    ffs_epfile_read_iter,
         .release =      ffs_epfile_release,
         .unlocked_ioctl =       ffs_epfile_ioctl,
 };
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index db49ec4c748e..200f9a584064 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -74,6 +74,8 @@ MODULE_DESCRIPTION (DRIVER_DESC);
 MODULE_AUTHOR ("David Brownell");
 MODULE_LICENSE ("GPL");
 
+static int ep_open(struct inode *, struct file *);
+
 
 /*----------------------------------------------------------------------*/
 
@@ -283,14 +285,15 @@ static void epio_complete (struct usb_ep *ep, struct usb_request *req)
  * still need dev->lock to use epdata->ep.
  */
 static int
-get_ready_ep (unsigned f_flags, struct ep_data *epdata)
+get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write)
 {
         int     val;
 
         if (f_flags & O_NONBLOCK) {
                 if (!mutex_trylock(&epdata->lock))
                         goto nonblock;
-                if (epdata->state != STATE_EP_ENABLED) {
+                if (epdata->state != STATE_EP_ENABLED &&
+                    (!is_write || epdata->state != STATE_EP_READY)) {
                         mutex_unlock(&epdata->lock);
 nonblock:
                         val = -EAGAIN;
@@ -305,18 +308,20 @@ nonblock:
 
         switch (epdata->state) {
         case STATE_EP_ENABLED:
+                return 0;
+        case STATE_EP_READY:                    /* not configured yet */
+                if (is_write)
+                        return 0;
+                // FALLTHRU
+        case STATE_EP_UNBOUND:                  /* clean disconnect */
                 break;
         // case STATE_EP_DISABLED:              /* "can't happen" */
-        // case STATE_EP_READY:                 /* "can't happen" */
         default:                                /* error! */
                 pr_debug ("%s: ep %p not available, state %d\n",
                                 shortname, epdata, epdata->state);
-                // FALLTHROUGH
-        case STATE_EP_UNBOUND:                  /* clean disconnect */
-                val = -ENODEV;
-                mutex_unlock(&epdata->lock);
         }
-        return val;
+        mutex_unlock(&epdata->lock);
+        return -ENODEV;
 }
 
 static ssize_t
@@ -363,97 +368,6 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)
         return value;
 }
 
-
-/* handle a synchronous OUT bulk/intr/iso transfer */
-static ssize_t
-ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-
-        /* FIXME readahead for O_NONBLOCK and poll(); careful with ZLPs */
-
-        value = -ENOMEM;
-        kbuf = kmalloc (len, GFP_KERNEL);
-        if (unlikely (!kbuf))
-                goto free1;
-
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s read %zu OUT, status %d\n",
-                data->name, len, (int) value);
-        if (value >= 0 && copy_to_user (buf, kbuf, value))
-                value = -EFAULT;
-
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
-
-/* handle a synchronous IN bulk/intr/iso transfer */
-static ssize_t
-ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (!usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-
-        /* FIXME writebehind for O_NONBLOCK and poll(), qlen = 1 */
-
-        value = -ENOMEM;
-        kbuf = memdup_user(buf, len);
-        if (IS_ERR(kbuf)) {
-                value = PTR_ERR(kbuf);
-                kbuf = NULL;
-                goto free1;
-        }
-
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s write %zu IN, status %d\n",
-                data->name, len, (int) value);
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
-
 static int
 ep_release (struct inode *inode, struct file *fd)
 {
@@ -481,7 +395,7 @@ static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
         struct ep_data          *data = fd->private_data;
         int                     status;
 
-        if ((status = get_ready_ep (fd->f_flags, data)) < 0)
+        if ((status = get_ready_ep (fd->f_flags, data, false)) < 0)
                 return status;
 
         spin_lock_irq (&data->dev->lock);
@@ -517,8 +431,8 @@ struct kiocb_priv {
         struct mm_struct        *mm;
         struct work_struct      work;
         void                    *buf;
-        const struct iovec      *iv;
-        unsigned long           nr_segs;
+        struct iov_iter         to;
+        const void              *to_free;
         unsigned                actual;
 };
 
@@ -541,35 +455,6 @@ static int ep_aio_cancel(struct kiocb *iocb)
         return value;
 }
 
-static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
-{
-        ssize_t                 len, total;
-        void                    *to_copy;
-        int                     i;
-
-        /* copy stuff into user buffers */
-        total = priv->actual;
-        len = 0;
-        to_copy = priv->buf;
-        for (i=0; i < priv->nr_segs; i++) {
-                ssize_t this = min((ssize_t)(priv->iv[i].iov_len), total);
-
-                if (copy_to_user(priv->iv[i].iov_base, to_copy, this)) {
-                        if (len == 0)
-                                len = -EFAULT;
-                        break;
-                }
-
-                total -= this;
-                len += this;
-                to_copy += this;
-                if (total == 0)
-                        break;
-        }
-
-        return len;
-}
-
 static void ep_user_copy_worker(struct work_struct *work)
 {
         struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work);
@@ -578,13 +463,16 @@ static void ep_user_copy_worker(struct work_struct *work)
         size_t ret;
 
         use_mm(mm);
-        ret = ep_copy_to_user(priv);
+        ret = copy_to_iter(priv->buf, priv->actual, &priv->to);
         unuse_mm(mm);
+        if (!ret)
+                ret = -EFAULT;
 
         /* completing the iocb can drop the ctx and mm, don't touch mm after */
         aio_complete(iocb, ret, ret);
 
         kfree(priv->buf);
+        kfree(priv->to_free);
         kfree(priv);
 }
 
@@ -603,8 +491,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
          * don't need to copy anything to userspace, so we can
          * complete the aio request immediately.
          */
-        if (priv->iv == NULL || unlikely(req->actual == 0)) {
+        if (priv->to_free == NULL || unlikely(req->actual == 0)) {
                 kfree(req->buf);
+                kfree(priv->to_free);
                 kfree(priv);
                 iocb->private = NULL;
                 /* aio_complete() reports bytes-transferred _and_ faults */
@@ -618,6 +507,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
 
                 priv->buf = req->buf;
                 priv->actual = req->actual;
+                INIT_WORK(&priv->work, ep_user_copy_worker);
                 schedule_work(&priv->work);
         }
         spin_unlock(&epdata->dev->lock);
@@ -626,38 +516,17 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
         put_ep(epdata);
 }
 
-static ssize_t
-ep_aio_rwtail(
-        struct kiocb    *iocb,
-        char            *buf,
-        size_t          len,
-        struct ep_data  *epdata,
-        const struct iovec *iv,
-        unsigned long   nr_segs
-)
+static ssize_t ep_aio(struct kiocb *iocb,
+                      struct kiocb_priv *priv,
+                      struct ep_data *epdata,
+                      char *buf,
+                      size_t len)
 {
-        struct kiocb_priv       *priv;
-        struct usb_request      *req;
-        ssize_t                 value;
+        struct usb_request *req;
+        ssize_t value;
 
-        priv = kmalloc(sizeof *priv, GFP_KERNEL);
-        if (!priv) {
-                value = -ENOMEM;
-fail:
-                kfree(buf);
-                return value;
-        }
         iocb->private = priv;
         priv->iocb = iocb;
-        priv->iv = iv;
-        priv->nr_segs = nr_segs;
-        INIT_WORK(&priv->work, ep_user_copy_worker);
-
-        value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
-        if (unlikely(value < 0)) {
-                kfree(priv);
-                goto fail;
-        }
 
         kiocb_set_cancel_fn(iocb, ep_aio_cancel);
         get_ep(epdata);
@@ -669,75 +538,154 @@ fail:
          * allocate or submit those if the host disconnected.
          */
         spin_lock_irq(&epdata->dev->lock);
-        if (likely(epdata->ep)) {
-                req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
-                if (likely(req)) {
-                        priv->req = req;
-                        req->buf = buf;
-                        req->length = len;
-                        req->complete = ep_aio_complete;
-                        req->context = iocb;
-                        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
-                        if (unlikely(0 != value))
-                                usb_ep_free_request(epdata->ep, req);
-                } else
-                        value = -EAGAIN;
-        } else
-                value = -ENODEV;
-        spin_unlock_irq(&epdata->dev->lock);
+        value = -ENODEV;
+        if (unlikely(epdata->ep))
+                goto fail;
 
-        mutex_unlock(&epdata->lock);
+        req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
+        value = -ENOMEM;
+        if (unlikely(!req))
+                goto fail;
 
-        if (unlikely(value)) {
-                kfree(priv);
-                put_ep(epdata);
-        } else
-                value = -EIOCBQUEUED;
+        priv->req = req;
+        req->buf = buf;
+        req->length = len;
+        req->complete = ep_aio_complete;
+        req->context = iocb;
+        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
+        if (unlikely(0 != value)) {
+                usb_ep_free_request(epdata->ep, req);
+                goto fail;
+        }
+        spin_unlock_irq(&epdata->dev->lock);
+        return -EIOCBQUEUED;
+
+fail:
+        spin_unlock_irq(&epdata->dev->lock);
+        kfree(priv->to_free);
+        kfree(priv);
+        put_ep(epdata);
         return value;
 }
 
 static ssize_t
-ep_aio_read(struct kiocb *iocb, const struct iovec *iov,
-                unsigned long nr_segs, loff_t o)
+ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
-        char                    *buf;
+        struct file *file = iocb->ki_filp;
+        struct ep_data *epdata = file->private_data;
+        size_t len = iov_iter_count(to);
+        ssize_t value;
+        char *buf;
 
-        if (unlikely(usb_endpoint_dir_in(&epdata->desc)))
-                return -EINVAL;
+        if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0)
+                return value;
 
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
-        if (unlikely(!buf))
-                return -ENOMEM;
+        /* halt any endpoint by doing a "wrong direction" i/o call */
+        if (usb_endpoint_dir_in(&epdata->desc)) {
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
 
-        return ep_aio_rwtail(iocb, buf, iocb->ki_nbytes, epdata, iov, nr_segs);
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
+                return -ENOMEM;
+        }
+        if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+                if (value >= 0 && copy_to_iter(buf, value, to))
+                        value = -EFAULT;
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (!priv)
+                        goto fail;
+                priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL);
+                if (!priv->to_free) {
+                        kfree(priv);
+                        goto fail;
+                }
+                value = ep_aio(iocb, priv, epdata, buf, len);
+                if (value == -EIOCBQUEUED)
+                        buf = NULL;
+        }
+fail:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
 
+static ssize_t ep_config(struct ep_data *, const char *, size_t);
+
 static ssize_t
-ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
-                unsigned long nr_segs, loff_t o)
+ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
-        char                    *buf;
-        size_t                  len = 0;
-        int                     i = 0;
+        struct file *file = iocb->ki_filp;
+        struct ep_data *epdata = file->private_data;
+        size_t len = iov_iter_count(from);
+        bool configured;
+        ssize_t value;
+        char *buf;
+
+        if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0)
+                return value;
 
-        if (unlikely(!usb_endpoint_dir_in(&epdata->desc)))
-                return -EINVAL;
+        configured = epdata->state == STATE_EP_ENABLED;
 
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
-        if (unlikely(!buf))
+        /* halt any endpoint by doing a "wrong direction" i/o call */
+        if (configured && !usb_endpoint_dir_in(&epdata->desc)) {
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
+
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
                 return -ENOMEM;
+        }
 
-        for (i=0; i < nr_segs; i++) {
-                if (unlikely(copy_from_user(&buf[len], iov[i].iov_base,
-                                iov[i].iov_len) != 0)) {
-                        kfree(buf);
-                        return -EFAULT;
+        if (unlikely(copy_from_iter(buf, len, from) != len)) {
+                value = -EFAULT;
+                goto out;
+        }
+
+        if (unlikely(!configured)) {
+                value = ep_config(epdata, buf, len);
+        } else if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (priv) {
+                        value = ep_aio(iocb, priv, epdata, buf, len);
+                        if (value == -EIOCBQUEUED)
+                                buf = NULL;
                 }
-                len += iov[i].iov_len;
         }
-        return ep_aio_rwtail(iocb, buf, len, epdata, NULL, 0);
+out:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
 
 /*----------------------------------------------------------------------*/
@@ -745,15 +693,15 @@ ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
 /* used after endpoint configuration */
 static const struct file_operations ep_io_operations = {
         .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
 
-        .read =         ep_read,
-        .write =        ep_write,
-        .unlocked_ioctl = ep_ioctl,
+        .open =         ep_open,
         .release =      ep_release,
-
-        .aio_read =     ep_aio_read,
-        .aio_write =    ep_aio_write,
+        .llseek =       no_llseek,
+        .read =         new_sync_read,
+        .write =        new_sync_write,
+        .unlocked_ioctl = ep_ioctl,
+        .read_iter =    ep_read_iter,
+        .write_iter =   ep_write_iter,
 };
 
 /* ENDPOINT INITIALIZATION
@@ -770,17 +718,12 @@ static const struct file_operations ep_io_operations = {
  * speed descriptor, then optional high speed descriptor.
  */
 static ssize_t
-ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ep_config (struct ep_data *data, const char *buf, size_t len)
 {
-        struct ep_data          *data = fd->private_data;
         struct usb_ep           *ep;
         u32                     tag;
         int                     value, length = len;
 
-        value = mutex_lock_interruptible(&data->lock);
-        if (value < 0)
-                return value;
-
         if (data->state != STATE_EP_READY) {
                 value = -EL2HLT;
                 goto fail;
@@ -791,9 +734,7 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 goto fail0;
 
         /* we might need to change message format someday */
-        if (copy_from_user (&tag, buf, 4)) {
-                goto fail1;
-        }
+        memcpy(&tag, buf, 4);
         if (tag != 1) {
                 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
                 goto fail0;
@@ -806,19 +747,15 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
          */
 
         /* full/low speed descriptor, then high speed */
-        if (copy_from_user (&data->desc, buf, USB_DT_ENDPOINT_SIZE)) {
-                goto fail1;
-        }
+        memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE);
         if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
                         || data->desc.bDescriptorType != USB_DT_ENDPOINT)
                 goto fail0;
         if (len != USB_DT_ENDPOINT_SIZE) {
                 if (len != 2 * USB_DT_ENDPOINT_SIZE)
                         goto fail0;
-                if (copy_from_user (&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
-                                        USB_DT_ENDPOINT_SIZE)) {
-                        goto fail1;
-                }
+                memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
+                        USB_DT_ENDPOINT_SIZE);
                 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
                                 || data->hs_desc.bDescriptorType
                                         != USB_DT_ENDPOINT) {
@@ -840,24 +777,20 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         case USB_SPEED_LOW:
         case USB_SPEED_FULL:
                 ep->desc = &data->desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                 break;
         case USB_SPEED_HIGH:
                 /* fails if caller didn't provide that descriptor... */
                 ep->desc = &data->hs_desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                 break;
         default:
                 DBG(data->dev, "unconnected, %s init abandoned\n",
                                 data->name);
                 value = -EINVAL;
+                goto gone;
         }
+        value = usb_ep_enable(ep);
         if (value == 0) {
-                fd->f_op = &ep_io_operations;
+                data->state = STATE_EP_ENABLED;
                 value = length;
         }
 gone:
@@ -867,14 +800,10 @@ fail:
                 data->desc.bDescriptorType = 0;
                 data->hs_desc.bDescriptorType = 0;
         }
-        mutex_unlock(&data->lock);
         return value;
 fail0:
         value = -EINVAL;
         goto fail;
-fail1:
-        value = -EFAULT;
-        goto fail;
 }
 
 static int
@@ -902,15 +831,6 @@ ep_open (struct inode *inode, struct file *fd)
         return value;
 }
 
-/* used before endpoint configuration */
-static const struct file_operations ep_config_operations = {
-        .llseek =       no_llseek,
-
-        .open =         ep_open,
-        .write =        ep_config,
-        .release =      ep_release,
-};
-
 /*----------------------------------------------------------------------*/
 
 /* EP0 IMPLEMENTATION can be partly in userspace.
@@ -989,6 +909,10 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
         enum ep0_state                  state;
 
         spin_lock_irq (&dev->lock);
+        if (dev->state <= STATE_DEV_OPENED) {
+                retval = -EINVAL;
+                goto done;
+        }
 
         /* report fd mode change before acting on it */
         if (dev->setup_abort) {
@@ -1187,8 +1111,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         struct dev_data         *dev = fd->private_data;
         ssize_t                 retval = -ESRCH;
 
-        spin_lock_irq (&dev->lock);
-
         /* report fd mode change before acting on it */
         if (dev->setup_abort) {
                 dev->setup_abort = 0;
@@ -1234,7 +1156,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         } else
                 DBG (dev, "fail %s, state %d\n", __func__, dev->state);
 
-        spin_unlock_irq (&dev->lock);
         return retval;
 }
 
@@ -1281,6 +1202,9 @@ ep0_poll (struct file *fd, poll_table *wait)
        struct dev_data         *dev = fd->private_data;
        int                     mask = 0;
 
+        if (dev->state <= STATE_DEV_OPENED)
+                return DEFAULT_POLLMASK;
+
        poll_wait(fd, &dev->wait, wait);
 
        spin_lock_irq (&dev->lock);
@@ -1316,19 +1240,6 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
         return ret;
 }
 
-/* used after device configuration */
-static const struct file_operations ep0_io_operations = {
-        .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
-
-        .read =         ep0_read,
-        .write =        ep0_write,
-        .fasync =       ep0_fasync,
-        .poll =         ep0_poll,
-        .unlocked_ioctl =       dev_ioctl,
-        .release =      dev_release,
-};
-
 /*----------------------------------------------------------------------*/
 
 /* The in-kernel gadget driver handles most ep0 issues, in particular
@@ -1650,7 +1561,7 @@ static int activate_ep_files (struct dev_data *dev)
                         goto enomem1;
 
                 data->dentry = gadgetfs_create_file (dev->sb, data->name,
-                                data, &ep_config_operations);
+                                data, &ep_io_operations);
                 if (!data->dentry)
                         goto enomem2;
                 list_add_tail (&data->epfiles, &dev->epfiles);
@@ -1852,6 +1763,14 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         u32                     tag;
         char                    *kbuf;
 
+        spin_lock_irq(&dev->lock);
+        if (dev->state > STATE_DEV_OPENED) {
+                value = ep0_write(fd, buf, len, ptr);
+                spin_unlock_irq(&dev->lock);
+                return value;
+        }
+        spin_unlock_irq(&dev->lock);
+
         if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
                 return -EINVAL;
 
@@ -1925,7 +1844,6 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                  * on, they can work ... except in cleanup paths that
                  * kick in after the ep0 descriptor is closed.
                  */
-                fd->f_op = &ep0_io_operations;
                 value = len;
         }
         return value;
@@ -1956,12 +1874,14 @@ dev_open (struct inode *inode, struct file *fd)
         return value;
 }
 
-static const struct file_operations dev_init_operations = {
+static const struct file_operations ep0_operations = {
         .llseek =       no_llseek,
 
         .open =         dev_open,
+        .read =         ep0_read,
         .write =        dev_config,
         .fasync =       ep0_fasync,
+        .poll =         ep0_poll,
         .unlocked_ioctl = dev_ioctl,
         .release =      dev_release,
 };
@@ -2077,7 +1997,7 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                 goto Enomem;
 
         dev->sb = sb;
-        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &dev_init_operations);
+        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
         if (!dev->dentry) {
                 put_dev(dev);
                 goto Enomem;
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index f88bfdf5b6a0..2027a27546ef 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -868,12 +868,14 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
                                 func = vfio_pci_set_err_trigger;
                         break;
                 }
+                break;
         case VFIO_PCI_REQ_IRQ_INDEX:
                 switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
                 case VFIO_IRQ_SET_ACTION_TRIGGER:
                         func = vfio_pci_set_req_trigger;
                         break;
                 }
+                break;
         }
 
         if (!func)
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 0413157f3b49..6a356e344f82 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/balloon_compaction.h>
 #include <linux/oom.h>
+#include <linux/wait.h>
 
 /*
  * Balloon device works in 4K page units.  So each page is pointed to by
@@ -334,17 +335,25 @@ static int virtballoon_oom_notify(struct notifier_block *self,
 static int balloon(void *_vballoon)
 {
         struct virtio_balloon *vb = _vballoon;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
         set_freezable();
         while (!kthread_should_stop()) {
                 s64 diff;
 
                 try_to_freeze();
-                wait_event_interruptible(vb->config_change,
-                                         (diff = towards_target(vb)) != 0
-                                         || vb->need_stats_update
-                                         || kthread_should_stop()
-                                         || freezing(current));
+
+                add_wait_queue(&vb->config_change, &wait);
+                for (;;) {
+                        if ((diff = towards_target(vb)) != 0 ||
+                            vb->need_stats_update ||
+                            kthread_should_stop() ||
+                            freezing(current))
+                                break;
+                        wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+                }
+                remove_wait_queue(&vb->config_change, &wait);
+
                 if (vb->need_stats_update)
                         stats_handle_request(vb);
                 if (diff > 0)
@@ -499,6 +508,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
         if (err < 0)
                 goto out_oom_notify;
 
+        virtio_device_ready(vdev);
+
         vb->thread = kthread_run(balloon, vb, "vballoon");
         if (IS_ERR(vb->thread)) {
                 err = PTR_ERR(vb->thread);
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index cad569890908..6010d7ec0a0f 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -156,22 +156,95 @@ static void vm_get(struct virtio_device *vdev, unsigned offset,
                    void *buf, unsigned len)
 {
         struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        u8 *ptr = buf;
-        int i;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
+        u8 b;
+        __le16 w;
+        __le32 l;
 
-        for (i = 0; i < len; i++)
-                ptr[i] = readb(vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+        if (vm_dev->version == 1) {
+                u8 *ptr = buf;
+                int i;
+
+                for (i = 0; i < len; i++)
+                        ptr[i] = readb(base + offset + i);
+                return;
+        }
+
+        switch (len) {
+        case 1:
+                b = readb(base + offset);
+                memcpy(buf, &b, sizeof b);
+                break;
+        case 2:
+                w = cpu_to_le16(readw(base + offset));
+                memcpy(buf, &w, sizeof w);
+                break;
+        case 4:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                break;
+        case 8:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                l = cpu_to_le32(ioread32(base + offset + sizeof l));
+                memcpy(buf + sizeof l, &l, sizeof l);
+                break;
+        default:
+                BUG();
+        }
 }
 
 static void vm_set(struct virtio_device *vdev, unsigned offset,
                    const void *buf, unsigned len)
 {
         struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        const u8 *ptr = buf;
-        int i;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
+        u8 b;
+        __le16 w;
+        __le32 l;
 
-        for (i = 0; i < len; i++)
-                writeb(ptr[i], vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+        if (vm_dev->version == 1) {
+                const u8 *ptr = buf;
+                int i;
+
+                for (i = 0; i < len; i++)
+                        writeb(ptr[i], base + offset + i);
+
+                return;
+        }
+
+        switch (len) {
+        case 1:
+                memcpy(&b, buf, sizeof b);
+                writeb(b, base + offset);
+                break;
+        case 2:
+                memcpy(&w, buf, sizeof w);
+                writew(le16_to_cpu(w), base + offset);
+                break;
+        case 4:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                break;
+        case 8:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                memcpy(&l, buf + sizeof l, sizeof l);
+                writel(le32_to_cpu(l), base + offset + sizeof l);
+                break;
+        default:
+                BUG();
+        }
+}
+
+static u32 vm_generation(struct virtio_device *vdev)
+{
+        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
+
+        if (vm_dev->version == 1)
+                return 0;
+        else
+                return readl(vm_dev->base + VIRTIO_MMIO_CONFIG_GENERATION);
 }
 
 static u8 vm_get_status(struct virtio_device *vdev)
@@ -440,6 +513,7 @@ static const char *vm_bus_name(struct virtio_device *vdev)
 static const struct virtio_config_ops virtio_mmio_config_ops = {
         .get            = vm_get,
         .set            = vm_set,
+        .generation     = vm_generation,
         .get_status     = vm_get_status,
         .set_status     = vm_set_status,
         .reset          = vm_reset,
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index b4bca2d4a7e5..70fba973a107 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsigned int irq)
         pirq_query_unmask(irq);
 
         rc = set_evtchn_to_irq(evtchn, irq);
-        if (rc != 0) {
-                pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
-                       irq, rc);
-                xen_evtchn_close(evtchn);
-                return 0;
-        }
+        if (rc)
+                goto err;
+
         bind_evtchn_to_cpu(evtchn, 0);
         info->evtchn = evtchn;
 
+        rc = xen_evtchn_port_setup(info);
+        if (rc)
+                goto err;
+
 out:
         unmask_evtchn(evtchn);
         eoi_pirq(irq_get_irq_data(irq));
 
         return 0;
+
+err:
+        pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
+        xen_evtchn_close(evtchn);
+        return 0;
 }
 
 static unsigned int startup_pirq(struct irq_data *data)
diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
index 46ae0f9f02ad..75fe3d466515 100644
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -16,7 +16,7 @@
 #include "conf_space.h"
 #include "conf_space_quirks.h"
 
-static bool permissive;
+bool permissive;
 module_param(permissive, bool, 0644);
 
 /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
index e56c934ad137..2e1d73d1d5d0 100644
--- a/drivers/xen/xen-pciback/conf_space.h
+++ b/drivers/xen/xen-pciback/conf_space.h
@@ -64,6 +64,8 @@ struct config_field_entry {
         void *data;
 };
 
+extern bool permissive;
+
 #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
 
 /* Add fields to a device - the add_fields macro expects to get a pointer to
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index c5ee82587e8c..2d7369391472 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -11,6 +11,10 @@
 #include "pciback.h"
 #include "conf_space.h"
 
+struct pci_cmd_info {
+        u16 val;
+};
+
 struct pci_bar_info {
         u32 val;
         u32 len_val;
@@ -20,22 +24,36 @@ struct pci_bar_info {
 #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
 #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
 
-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+/* Bits guests are allowed to control in permissive mode. */
+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
+                           PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
+                           PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
+
+static void *command_init(struct pci_dev *dev, int offset)
 {
-        int i;
-        int ret;
-
-        ret = xen_pcibk_read_config_word(dev, offset, value, data);
-        if (!pci_is_enabled(dev))
-                return ret;
-
-        for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-                if (dev->resource[i].flags & IORESOURCE_IO)
-                        *value |= PCI_COMMAND_IO;
-                if (dev->resource[i].flags & IORESOURCE_MEM)
-                        *value |= PCI_COMMAND_MEMORY;
+        struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
+        int err;
+
+        if (!cmd)
+                return ERR_PTR(-ENOMEM);
+
+        err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
+        if (err) {
+                kfree(cmd);
+                return ERR_PTR(err);
         }
 
+        return cmd;
+}
+
+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+{
+        int ret = pci_read_config_word(dev, offset, value);
+        const struct pci_cmd_info *cmd = data;
+
+        *value &= PCI_COMMAND_GUEST;
+        *value |= cmd->val & ~PCI_COMMAND_GUEST;
+
         return ret;
 }
 
@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
 {
         struct xen_pcibk_dev_data *dev_data;
         int err;
+        u16 val;
+        struct pci_cmd_info *cmd = data;
 
         dev_data = pci_get_drvdata(dev);
         if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
                 }
         }
 
+        cmd->val = value;
+
+        if (!permissive && (!dev_data || !dev_data->permissive))
+                return 0;
+
+        /* Only allow the guest to control certain bits. */
+        err = pci_read_config_word(dev, offset, &val);
+        if (err || val == value)
+                return err;
+
+        value &= PCI_COMMAND_GUEST;
+        value |= val & ~PCI_COMMAND_GUEST;
+
         return pci_write_config_word(dev, offset, value);
 }
 
@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
         {
          .offset    = PCI_COMMAND,
          .size      = 2,
+         .init      = command_init,
+         .release   = bar_release,
          .u.w.read  = command_read,
          .u.w.write = command_write,
         },