Merge 3.13-rc4 into char-misc-next

We want these fixes in here.

551 files changed, 7036 insertions, 3074 deletions

diff --git a/drivers/acpi/acpica/acresrc.h b/drivers/acpi/acpica/acresrc.h
index f691d0e4d9fa..ff97430455cb 100644
--- a/drivers/acpi/acpica/acresrc.h
+++ b/drivers/acpi/acpica/acresrc.h
@@ -184,7 +184,7 @@ acpi_rs_create_resource_list(union acpi_operand_object *aml_buffer,
                              struct acpi_buffer *output_buffer);
 
 acpi_status
-acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
+acpi_rs_create_aml_resources(struct acpi_buffer *resource_list,
                              struct acpi_buffer *output_buffer);
 
 acpi_status
@@ -227,8 +227,8 @@ acpi_rs_get_list_length(u8 * aml_buffer,
                         u32 aml_buffer_length, acpi_size * size_needed);
 
 acpi_status
-acpi_rs_get_aml_length(struct acpi_resource *linked_list_buffer,
-                       acpi_size * size_needed);
+acpi_rs_get_aml_length(struct acpi_resource *resource_list,
+                       acpi_size resource_list_size, acpi_size * size_needed);
 
 acpi_status
 acpi_rs_get_pci_routing_table_length(union acpi_operand_object *package_object,
diff --git a/drivers/acpi/acpica/nsalloc.c b/drivers/acpi/acpica/nsalloc.c
index 243737363fb8..fd1ff54cda19 100644
--- a/drivers/acpi/acpica/nsalloc.c
+++ b/drivers/acpi/acpica/nsalloc.c
@@ -106,6 +106,7 @@ struct acpi_namespace_node *acpi_ns_create_node(u32 name)
 void acpi_ns_delete_node(struct acpi_namespace_node *node)
 {
         union acpi_operand_object *obj_desc;
+        union acpi_operand_object *next_desc;
 
         ACPI_FUNCTION_NAME(ns_delete_node);
 
@@ -114,12 +115,13 @@ void acpi_ns_delete_node(struct acpi_namespace_node *node)
         acpi_ns_detach_object(node);
 
         /*
-         * Delete an attached data object if present (an object that was created
-         * and attached via acpi_attach_data). Note: After any normal object is
-         * detached above, the only possible remaining object is a data object.
+         * Delete an attached data object list if present (objects that were
+         * attached via acpi_attach_data). Note: After any normal object is
+         * detached above, the only possible remaining object(s) are data
+         * objects, in a linked list.
          */
         obj_desc = node->object;
-        if (obj_desc && (obj_desc->common.type == ACPI_TYPE_LOCAL_DATA)) {
+        while (obj_desc && (obj_desc->common.type == ACPI_TYPE_LOCAL_DATA)) {
 
                 /* Invoke the attached data deletion handler if present */
 
@@ -127,7 +129,15 @@ void acpi_ns_delete_node(struct acpi_namespace_node *node)
                         obj_desc->data.handler(node, obj_desc->data.pointer);
                 }
 
+                next_desc = obj_desc->common.next_object;
                 acpi_ut_remove_reference(obj_desc);
+                obj_desc = next_desc;
+        }
+
+        /* Special case for the statically allocated root node */
+
+        if (node == acpi_gbl_root_node) {
+                return;
         }
 
         /* Now we can delete the node */
diff --git a/drivers/acpi/acpica/nsutils.c b/drivers/acpi/acpica/nsutils.c
index cc2fea94c5f0..4a0665b6bcc1 100644
--- a/drivers/acpi/acpica/nsutils.c
+++ b/drivers/acpi/acpica/nsutils.c
@@ -593,24 +593,26 @@ struct acpi_namespace_node *acpi_ns_validate_handle(acpi_handle handle)
 
 void acpi_ns_terminate(void)
 {
-        union acpi_operand_object *obj_desc;
+        acpi_status status;
 
         ACPI_FUNCTION_TRACE(ns_terminate);
 
         /*
-         * 1) Free the entire namespace -- all nodes and objects
-         *
-         * Delete all object descriptors attached to namepsace nodes
+         * Free the entire namespace -- all nodes and all objects
+         * attached to the nodes
          */
         acpi_ns_delete_namespace_subtree(acpi_gbl_root_node);
 
-        /* Detach any objects attached to the root */
+        /* Delete any objects attached to the root node */
 
-        obj_desc = acpi_ns_get_attached_object(acpi_gbl_root_node);
-        if (obj_desc) {
-                acpi_ns_detach_object(acpi_gbl_root_node);
+        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+        if (ACPI_FAILURE(status)) {
+                return_VOID;
         }
 
+        acpi_ns_delete_node(acpi_gbl_root_node);
+        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Namespace freed\n"));
         return_VOID;
 }
diff --git a/drivers/acpi/acpica/rscalc.c b/drivers/acpi/acpica/rscalc.c
index b62a0f4f4f9b..b60c9cf82862 100644
--- a/drivers/acpi/acpica/rscalc.c
+++ b/drivers/acpi/acpica/rscalc.c
@@ -174,6 +174,7 @@ acpi_rs_stream_option_length(u32 resource_length,
  * FUNCTION:    acpi_rs_get_aml_length
  *
  * PARAMETERS:  resource            - Pointer to the resource linked list
+ *              resource_list_size  - Size of the resource linked list
  *              size_needed         - Where the required size is returned
  *
  * RETURN:      Status
@@ -185,16 +186,20 @@ acpi_rs_stream_option_length(u32 resource_length,
  ******************************************************************************/
 
 acpi_status
-acpi_rs_get_aml_length(struct acpi_resource * resource, acpi_size * size_needed)
+acpi_rs_get_aml_length(struct acpi_resource *resource,
+                       acpi_size resource_list_size, acpi_size * size_needed)
 {
         acpi_size aml_size_needed = 0;
+        struct acpi_resource *resource_end;
         acpi_rs_length total_size;
 
         ACPI_FUNCTION_TRACE(rs_get_aml_length);
 
         /* Traverse entire list of internal resource descriptors */
 
-        while (resource) {
+        resource_end =
+            ACPI_ADD_PTR(struct acpi_resource, resource, resource_list_size);
+        while (resource < resource_end) {
 
                 /* Validate the descriptor type */
 
diff --git a/drivers/acpi/acpica/rscreate.c b/drivers/acpi/acpica/rscreate.c
index 65f3e1c5b598..3a2ace93e62c 100644
--- a/drivers/acpi/acpica/rscreate.c
+++ b/drivers/acpi/acpica/rscreate.c
@@ -418,22 +418,21 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
  *
  * FUNCTION:    acpi_rs_create_aml_resources
  *
- * PARAMETERS:  linked_list_buffer      - Pointer to the resource linked list
- *              output_buffer           - Pointer to the user's buffer
+ * PARAMETERS:  resource_list           - Pointer to the resource list buffer
+ *              output_buffer           - Where the AML buffer is returned
  *
  * RETURN:      Status  AE_OK if okay, else a valid acpi_status code.
  *              If the output_buffer is too small, the error will be
  *              AE_BUFFER_OVERFLOW and output_buffer->Length will point
  *              to the size buffer needed.
  *
- * DESCRIPTION: Takes the linked list of device resources and
- *              creates a bytestream to be used as input for the
- *              _SRS control method.
+ * DESCRIPTION: Converts a list of device resources to an AML bytestream
+ *              to be used as input for the _SRS control method.
  *
  ******************************************************************************/
 
 acpi_status
-acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
+acpi_rs_create_aml_resources(struct acpi_buffer *resource_list,
                              struct acpi_buffer *output_buffer)
 {
         acpi_status status;
@@ -441,16 +440,16 @@ acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
 
         ACPI_FUNCTION_TRACE(rs_create_aml_resources);
 
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "LinkedListBuffer = %p\n",
-                          linked_list_buffer));
+        /* Params already validated, no need to re-validate here */
 
-        /*
-         * Params already validated, so we don't re-validate here
-         *
-         * Pass the linked_list_buffer into a module that calculates
-         * the buffer size needed for the byte stream.
-         */
-        status = acpi_rs_get_aml_length(linked_list_buffer, &aml_size_needed);
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "ResourceList Buffer = %p\n",
+                          resource_list->pointer));
+
+        /* Get the buffer size needed for the AML byte stream */
+
+        status = acpi_rs_get_aml_length(resource_list->pointer,
+                                        resource_list->length,
+                                        &aml_size_needed);
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "AmlSizeNeeded=%X, %s\n",
                           (u32)aml_size_needed, acpi_format_exception(status)));
@@ -467,10 +466,9 @@ acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
 
         /* Do the conversion */
 
-        status =
-            acpi_rs_convert_resources_to_aml(linked_list_buffer,
-                                             aml_size_needed,
-                                             output_buffer->pointer);
+        status = acpi_rs_convert_resources_to_aml(resource_list->pointer,
+                                                  aml_size_needed,
+                                                  output_buffer->pointer);
         if (ACPI_FAILURE(status)) {
                 return_ACPI_STATUS(status);
         }
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index aef303d56d86..14a7982c9961 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -753,7 +753,7 @@ acpi_rs_set_srs_method_data(struct acpi_namespace_node *node,
          * Convert the linked list into a byte stream
          */
         buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER;
-        status = acpi_rs_create_aml_resources(in_buffer->pointer, &buffer);
+        status = acpi_rs_create_aml_resources(in_buffer, &buffer);
         if (ACPI_FAILURE(status)) {
                 goto cleanup;
         }
diff --git a/drivers/acpi/acpica/utdebug.c b/drivers/acpi/acpica/utdebug.c
index 1a67b3944b3b..03ae8affe48f 100644
--- a/drivers/acpi/acpica/utdebug.c
+++ b/drivers/acpi/acpica/utdebug.c
@@ -185,6 +185,7 @@ acpi_debug_print(u32 requested_debug_level,
                 }
 
                 acpi_gbl_prev_thread_id = thread_id;
+                acpi_gbl_nesting_level = 0;
         }
 
         /*
@@ -193,13 +194,21 @@ acpi_debug_print(u32 requested_debug_level,
          */
         acpi_os_printf("%9s-%04ld ", module_name, line_number);
 
+#ifdef ACPI_EXEC_APP
+        /*
+         * For acpi_exec only, emit the thread ID and nesting level.
+         * Note: nesting level is really only useful during a single-thread
+         * execution. Otherwise, multiple threads will keep resetting the
+         * level.
+         */
         if (ACPI_LV_THREADS & acpi_dbg_level) {
                 acpi_os_printf("[%u] ", (u32)thread_id);
         }
 
-        acpi_os_printf("[%02ld] %-22.22s: ",
-                       acpi_gbl_nesting_level,
-                       acpi_ut_trim_function_name(function_name));
+        acpi_os_printf("[%02ld] ", acpi_gbl_nesting_level);
+#endif
+
+        acpi_os_printf("%-22.22s: ", acpi_ut_trim_function_name(function_name));
 
         va_start(args, format);
         acpi_os_vprintf(format, args);
@@ -420,7 +429,9 @@ acpi_ut_exit(u32 line_number,
                                  component_id, "%s\n", acpi_gbl_fn_exit_str);
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_exit)
@@ -467,7 +478,9 @@ acpi_ut_status_exit(u32 line_number,
                 }
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_status_exit)
@@ -504,7 +517,9 @@ acpi_ut_value_exit(u32 line_number,
                                  ACPI_FORMAT_UINT64(value));
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_value_exit)
@@ -540,7 +555,9 @@ acpi_ut_ptr_exit(u32 line_number,
                                  ptr);
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 #endif
diff --git a/drivers/acpi/nvs.c b/drivers/acpi/nvs.c
index 266bc58ce0ce..386a9fe497b4 100644
--- a/drivers/acpi/nvs.c
+++ b/drivers/acpi/nvs.c
@@ -13,7 +13,6 @@
 #include <linux/slab.h>
 #include <linux/acpi.h>
 #include <linux/acpi_io.h>
-#include <acpi/acpiosxf.h>
 
 /* ACPI NVS regions, APEI may use it */
 
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 0703bff5e60e..20360e480bd8 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -65,6 +65,9 @@ static struct acpi_scan_handler pci_root_handler = {
         .ids = root_device_ids,
         .attach = acpi_pci_root_add,
         .detach = acpi_pci_root_remove,
+        .hotplug = {
+                .ignore = true,
+        },
 };
 
 static DEFINE_MUTEX(osc_lock);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 15daa21fcd05..fd39459926b1 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1772,7 +1772,7 @@ static void acpi_scan_init_hotplug(acpi_handle handle, int type)
          */
         list_for_each_entry(hwid, &pnp.ids, list) {
                 handler = acpi_scan_match_handler(hwid->id, NULL);
-                if (handler) {
+                if (handler && !handler->hotplug.ignore) {
                         acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
                                         acpi_hotplug_notify_cb, handler);
                         break;
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 14df30580e15..721e949e606e 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -525,7 +525,7 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
          * generate wakeup events.
          */
         if (ACPI_SUCCESS(status) && (acpi_state == ACPI_STATE_S3)) {
-                acpi_event_status pwr_btn_status;
+                acpi_event_status pwr_btn_status = ACPI_EVENT_FLAG_DISABLED;
 
                 acpi_get_event_status(ACPI_EVENT_POWER_BUTTON, &pwr_btn_status);
 
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index db5293650f62..6dbc3ca45223 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -309,7 +309,7 @@ static void acpi_table_attr_init(struct acpi_table_attr *table_attr,
                 sprintf(table_attr->name + ACPI_NAME_SIZE, "%d",
                         table_attr->instance);
 
-        table_attr->attr.size = 0;
+        table_attr->attr.size = table_header->length;
         table_attr->attr.read = acpi_table_show;
         table_attr->attr.attr.name = table_attr->name;
         table_attr->attr.attr.mode = 0400;
@@ -354,8 +354,9 @@ static int acpi_tables_sysfs_init(void)
 {
         struct acpi_table_attr *table_attr;
         struct acpi_table_header *table_header = NULL;
-        int table_index = 0;
-        int result;
+        int table_index;
+        acpi_status status;
+        int ret;
 
         tables_kobj = kobject_create_and_add("tables", acpi_kobj);
         if (!tables_kobj)
@@ -365,33 +366,34 @@ static int acpi_tables_sysfs_init(void)
         if (!dynamic_tables_kobj)
                 goto err_dynamic_tables;
 
-        do {
-                result = acpi_get_table_by_index(table_index, &table_header);
-                if (!result) {
-                        table_index++;
-                        table_attr = NULL;
-                        table_attr =
-                            kzalloc(sizeof(struct acpi_table_attr), GFP_KERNEL);
-                        if (!table_attr)
-                                return -ENOMEM;
-
-                        acpi_table_attr_init(table_attr, table_header);
-                        result =
-                            sysfs_create_bin_file(tables_kobj,
-                                                  &table_attr->attr);
-                        if (result) {
-                                kfree(table_attr);
-                                return result;
-                        } else
-                                list_add_tail(&table_attr->node,
-                                              &acpi_table_attr_list);
+        for (table_index = 0;; table_index++) {
+                status = acpi_get_table_by_index(table_index, &table_header);
+
+                if (status == AE_BAD_PARAMETER)
+                        break;
+
+                if (ACPI_FAILURE(status))
+                        continue;
+
+                table_attr = NULL;
+                table_attr = kzalloc(sizeof(*table_attr), GFP_KERNEL);
+                if (!table_attr)
+                        return -ENOMEM;
+
+                acpi_table_attr_init(table_attr, table_header);
+                ret = sysfs_create_bin_file(tables_kobj, &table_attr->attr);
+                if (ret) {
+                        kfree(table_attr);
+                        return ret;
                 }
-        } while (!result);
+                list_add_tail(&table_attr->node, &acpi_table_attr_list);
+        }
+
         kobject_uevent(tables_kobj, KOBJ_ADD);
         kobject_uevent(dynamic_tables_kobj, KOBJ_ADD);
-        result = acpi_install_table_handler(acpi_sysfs_table_handler, NULL);
+        status = acpi_install_table_handler(acpi_sysfs_table_handler, NULL);
 
-        return result == AE_OK ? 0 : -EINVAL;
+        return ACPI_FAILURE(status) ? -EINVAL : 0;
 err_dynamic_tables:
         kobject_put(tables_kobj);
 err:
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index e2903d03180e..14f1e9506338 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -435,6 +435,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 on some Gigabyte */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3),
           .driver_data = board_ahci_yes_fbs },
+        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
+          .driver_data = board_ahci_yes_fbs },
 
         /* Promise */
         { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index f9554318504f..4b231baceb09 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -329,6 +329,7 @@ static SIMPLE_DEV_PM_OPS(ahci_pm_ops, ahci_suspend, ahci_resume);
 static const struct of_device_id ahci_of_match[] = {
         { .compatible = "snps,spear-ahci", },
         { .compatible = "snps,exynos5440-ahci", },
+        { .compatible = "ibm,476gtr-ahci", },
         {},
 };
 MODULE_DEVICE_TABLE(of, ahci_of_match);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 81a94a3919db..75b93678bbcd 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6304,10 +6304,9 @@ static void ata_port_detach(struct ata_port *ap)
                 for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
                         ata_tlink_delete(&ap->pmp_link[i]);
         }
-        ata_tport_delete(ap);
-
         /* remove the associated SCSI host */
         scsi_remove_host(ap->scsi_host);
+        ata_tport_delete(ap);
 }
 
 /**
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index db6dfcfa3e2e..ab58556d347c 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3625,6 +3625,7 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)
                 shost->max_lun = 1;
                 shost->max_channel = 1;
                 shost->max_cmd_len = 16;
+                shost->no_write_same = 1;
 
                 /* Schedule policy is determined by ->qc_defer()
                  * callback and it needs to see every deferred qc.
diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
index 68f9e3293e9c..88949c6d55dd 100644
--- a/drivers/ata/libata-zpodd.c
+++ b/drivers/ata/libata-zpodd.c
@@ -88,15 +88,13 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
 static bool odd_can_poweroff(struct ata_device *ata_dev)
 {
         acpi_handle handle;
-        acpi_status status;
         struct acpi_device *acpi_dev;
 
         handle = ata_dev_acpi_handle(ata_dev);
         if (!handle)
                 return false;
 
-        status = acpi_bus_get_device(handle, &acpi_dev);
-        if (ACPI_FAILURE(status))
+        if (acpi_bus_get_device(handle, &acpi_dev))
                 return false;
 
         return acpi_device_can_poweroff(acpi_dev);
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index e88690ebfd82..73492dd4a4bc 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -319,6 +319,7 @@ static int cf_init(struct arasan_cf_dev *acdev)
         ret = clk_set_rate(acdev->clk, 166000000);
         if (ret) {
                 dev_warn(acdev->host->dev, "clock set rate failed");
+                clk_disable_unprepare(acdev->clk);
                 return ret;
         }
 
diff --git a/drivers/base/regmap/regmap-mmio.c b/drivers/base/regmap/regmap-mmio.c
index 98745dd77e8c..81f977510775 100644
--- a/drivers/base/regmap/regmap-mmio.c
+++ b/drivers/base/regmap/regmap-mmio.c
@@ -40,7 +40,7 @@ static int regmap_mmio_gather_write(void *context,
 
         BUG_ON(reg_size != 4);
 
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                 ret = clk_enable(ctx->clk);
                 if (ret < 0)
                         return ret;
@@ -73,7 +73,7 @@ static int regmap_mmio_gather_write(void *context,
                 offset += ctx->val_bytes;
         }
 
-        if (ctx->clk)
+        if (!IS_ERR(ctx->clk))
                 clk_disable(ctx->clk);
 
         return 0;
@@ -96,7 +96,7 @@ static int regmap_mmio_read(void *context,
 
         BUG_ON(reg_size != 4);
 
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                 ret = clk_enable(ctx->clk);
                 if (ret < 0)
                         return ret;
@@ -129,7 +129,7 @@ static int regmap_mmio_read(void *context,
                 offset += ctx->val_bytes;
         }
 
-        if (ctx->clk)
+        if (!IS_ERR(ctx->clk))
                 clk_disable(ctx->clk);
 
         return 0;
@@ -139,7 +139,7 @@ static void regmap_mmio_free_context(void *context)
 {
         struct regmap_mmio_context *ctx = context;
 
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                 clk_unprepare(ctx->clk);
                 clk_put(ctx->clk);
         }
@@ -209,6 +209,7 @@ static struct regmap_mmio_context *regmap_mmio_gen_context(struct device *dev,
 
         ctx->regs = regs;
         ctx->val_bytes = config->val_bits / 8;
+        ctx->clk = ERR_PTR(-ENODEV);
 
         if (clk_id == NULL)
                 return ctx;
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 9c021d9cace0..c2e002100949 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1549,7 +1549,7 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
                                                 val + (i * val_bytes),
                                                 val_bytes);
                         if (ret != 0)
-                                return ret;
+                                goto out;
                 }
         } else {
                 ret = _regmap_raw_write(map, reg, wval, val_bytes * val_count);
@@ -1743,7 +1743,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
 /**
  * regmap_read(): Read a value from a single register
  *
- * @map: Register map to write to
+ * @map: Register map to read from
  * @reg: Register to be read from
  * @val: Pointer to store read value
  *
@@ -1770,7 +1770,7 @@ EXPORT_SYMBOL_GPL(regmap_read);
 /**
  * regmap_raw_read(): Read raw data from the device
  *
- * @map: Register map to write to
+ * @map: Register map to read from
  * @reg: First register to be read from
  * @val: Pointer to store read value
  * @val_len: Size of data to read
@@ -1882,7 +1882,7 @@ EXPORT_SYMBOL_GPL(regmap_fields_read);
 /**
  * regmap_bulk_read(): Read multiple registers from the device
  *
- * @map: Register map to write to
+ * @map: Register map to read from
  * @reg: First register to be read from
  * @val: Pointer to store read value, in native register size for device
  * @val_count: Number of registers to read
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index ea192ec029c4..f370fc13aea5 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -495,23 +495,23 @@ static int null_add_dev(void)
 
         spin_lock_init(&nullb->lock);
 
+        if (queue_mode == NULL_Q_MQ && use_per_node_hctx)
+                submit_queues = nr_online_nodes;
+
         if (setup_queues(nullb))
                 goto err;
 
         if (queue_mode == NULL_Q_MQ) {
                 null_mq_reg.numa_node = home_node;
                 null_mq_reg.queue_depth = hw_queue_depth;
+                null_mq_reg.nr_hw_queues = submit_queues;
 
                 if (use_per_node_hctx) {
                         null_mq_reg.ops->alloc_hctx = null_alloc_hctx;
                         null_mq_reg.ops->free_hctx = null_free_hctx;
-
-                        null_mq_reg.nr_hw_queues = nr_online_nodes;
                 } else {
                         null_mq_reg.ops->alloc_hctx = blk_mq_alloc_single_hw_queue;
                         null_mq_reg.ops->free_hctx = blk_mq_free_single_hw_queue;
-
-                        null_mq_reg.nr_hw_queues = submit_queues;
                 }
 
                 nullb->q = blk_mq_init_queue(&null_mq_reg, nullb);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 432db1b59b00..c4a4c9006288 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -489,7 +489,7 @@ static int blkif_queue_request(struct request *req)
 
                         if ((ring_req->operation == BLKIF_OP_INDIRECT) &&
                             (i % SEGS_PER_INDIRECT_FRAME == 0)) {
-                                unsigned long pfn;
+                                unsigned long uninitialized_var(pfn);
 
                                 if (segments)
                                         kunmap_atomic(segments);
@@ -2011,6 +2011,10 @@ static void blkif_release(struct gendisk *disk, fmode_t mode)
 
         bdev = bdget_disk(disk, 0);
 
+        if (!bdev) {
+                WARN(1, "Block device %s yanked out from us!\n", disk->disk_name);
+                goto out_mutex;
+        }
         if (bdev->bd_openers)
                 goto out;
 
@@ -2041,6 +2045,7 @@ static void blkif_release(struct gendisk *disk, fmode_t mode)
 
 out:
         bdput(bdev);
+out_mutex:
         mutex_unlock(&blkfront_mutex);
 }
 
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index c206de2951f2..2f2b08457c67 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -165,6 +165,19 @@ config HW_RANDOM_OMAP
 
           If unsure, say Y.
 
+config HW_RANDOM_OMAP3_ROM
+        tristate "OMAP3 ROM Random Number Generator support"
+        depends on HW_RANDOM && ARCH_OMAP3
+        default HW_RANDOM
+        ---help---
+          This driver provides kernel-side support for the Random Number
+          Generator hardware found on OMAP34xx processors.
+
+          To compile this driver as a module, choose M here: the
+          module will be called omap3-rom-rng.
+
+          If unsure, say Y.
+
 config HW_RANDOM_OCTEON
         tristate "Octeon Random Number Generator support"
         depends on HW_RANDOM && CAVIUM_OCTEON_SOC
@@ -327,3 +340,15 @@ config HW_RANDOM_TPM
           module will be called tpm-rng.
 
           If unsure, say Y.
+
+config HW_RANDOM_MSM
+        tristate "Qualcomm MSM Random Number Generator support"
+        depends on HW_RANDOM && ARCH_MSM
+        ---help---
+          This driver provides kernel-side support for the Random Number
+          Generator hardware found on Qualcomm MSM SoCs.
+
+          To compile this driver as a module, choose M here. the
+          module will be called msm-rng.
+
+          If unsure, say Y.
diff --git a/drivers/char/hw_random/Makefile b/drivers/char/hw_random/Makefile
index d7d2435ff7fa..3ae7755a52e7 100644
--- a/drivers/char/hw_random/Makefile
+++ b/drivers/char/hw_random/Makefile
@@ -15,6 +15,7 @@ n2-rng-y := n2-drv.o n2-asm.o
 obj-$(CONFIG_HW_RANDOM_VIA) += via-rng.o
 obj-$(CONFIG_HW_RANDOM_IXP4XX) += ixp4xx-rng.o
 obj-$(CONFIG_HW_RANDOM_OMAP) += omap-rng.o
+obj-$(CONFIG_HW_RANDOM_OMAP3_ROM) += omap3-rom-rng.o
 obj-$(CONFIG_HW_RANDOM_PASEMI) += pasemi-rng.o
 obj-$(CONFIG_HW_RANDOM_VIRTIO) += virtio-rng.o
 obj-$(CONFIG_HW_RANDOM_TX4939) += tx4939-rng.o
@@ -28,3 +29,4 @@ obj-$(CONFIG_HW_RANDOM_POWERNV) += powernv-rng.o
 obj-$(CONFIG_HW_RANDOM_EXYNOS)  += exynos-rng.o
 obj-$(CONFIG_HW_RANDOM_TPM) += tpm-rng.o
 obj-$(CONFIG_HW_RANDOM_BCM2835) += bcm2835-rng.o
+obj-$(CONFIG_HW_RANDOM_MSM) += msm-rng.o
diff --git a/drivers/char/hw_random/msm-rng.c b/drivers/char/hw_random/msm-rng.c
new file mode 100644
index 000000000000..148521e51dc6
--- /dev/null
+++ b/drivers/char/hw_random/msm-rng.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2011-2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/hw_random.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+/* Device specific register offsets */
+#define PRNG_DATA_OUT           0x0000
+#define PRNG_STATUS             0x0004
+#define PRNG_LFSR_CFG           0x0100
+#define PRNG_CONFIG             0x0104
+
+/* Device specific register masks and config values */
+#define PRNG_LFSR_CFG_MASK      0x0000ffff
+#define PRNG_LFSR_CFG_CLOCKS    0x0000dddd
+#define PRNG_CONFIG_HW_ENABLE   BIT(1)
+#define PRNG_STATUS_DATA_AVAIL  BIT(0)
+
+#define MAX_HW_FIFO_DEPTH       16
+#define MAX_HW_FIFO_SIZE        (MAX_HW_FIFO_DEPTH * 4)
+#define WORD_SZ                 4
+
+struct msm_rng {
+        void __iomem *base;
+        struct clk *clk;
+        struct hwrng hwrng;
+};
+
+#define to_msm_rng(p)   container_of(p, struct msm_rng, hwrng)
+
+static int msm_rng_enable(struct hwrng *hwrng, int enable)
+{
+        struct msm_rng *rng = to_msm_rng(hwrng);
+        u32 val;
+        int ret;
+
+        ret = clk_prepare_enable(rng->clk);
+        if (ret)
+                return ret;
+
+        if (enable) {
+                /* Enable PRNG only if it is not already enabled */
+                val = readl_relaxed(rng->base + PRNG_CONFIG);
+                if (val & PRNG_CONFIG_HW_ENABLE)
+                        goto already_enabled;
+
+                val = readl_relaxed(rng->base + PRNG_LFSR_CFG);
+                val &= ~PRNG_LFSR_CFG_MASK;
+                val |= PRNG_LFSR_CFG_CLOCKS;
+                writel(val, rng->base + PRNG_LFSR_CFG);
+
+                val = readl_relaxed(rng->base + PRNG_CONFIG);
+                val |= PRNG_CONFIG_HW_ENABLE;
+                writel(val, rng->base + PRNG_CONFIG);
+        } else {
+                val = readl_relaxed(rng->base + PRNG_CONFIG);
+                val &= ~PRNG_CONFIG_HW_ENABLE;
+                writel(val, rng->base + PRNG_CONFIG);
+        }
+
+already_enabled:
+        clk_disable_unprepare(rng->clk);
+        return 0;
+}
+
+static int msm_rng_read(struct hwrng *hwrng, void *data, size_t max, bool wait)
+{
+        struct msm_rng *rng = to_msm_rng(hwrng);
+        size_t currsize = 0;
+        u32 *retdata = data;
+        size_t maxsize;
+        int ret;
+        u32 val;
+
+        /* calculate max size bytes to transfer back to caller */
+        maxsize = min_t(size_t, MAX_HW_FIFO_SIZE, max);
+
+        /* no room for word data */
+        if (maxsize < WORD_SZ)
+                return 0;
+
+        ret = clk_prepare_enable(rng->clk);
+        if (ret)
+                return ret;
+
+        /* read random data from hardware */
+        do {
+                val = readl_relaxed(rng->base + PRNG_STATUS);
+                if (!(val & PRNG_STATUS_DATA_AVAIL))
+                        break;
+
+                val = readl_relaxed(rng->base + PRNG_DATA_OUT);
+                if (!val)
+                        break;
+
+                *retdata++ = val;
+                currsize += WORD_SZ;
+
+                /* make sure we stay on 32bit boundary */
+                if ((maxsize - currsize) < WORD_SZ)
+                        break;
+        } while (currsize < maxsize);
+
+        clk_disable_unprepare(rng->clk);
+
+        return currsize;
+}
+
+static int msm_rng_init(struct hwrng *hwrng)
+{
+        return msm_rng_enable(hwrng, 1);
+}
+
+static void msm_rng_cleanup(struct hwrng *hwrng)
+{
+        msm_rng_enable(hwrng, 0);
+}
+
+static int msm_rng_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        struct msm_rng *rng;
+        int ret;
+
+        rng = devm_kzalloc(&pdev->dev, sizeof(*rng), GFP_KERNEL);
+        if (!rng)
+                return -ENOMEM;
+
+        platform_set_drvdata(pdev, rng);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        rng->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(rng->base))
+                return PTR_ERR(rng->base);
+
+        rng->clk = devm_clk_get(&pdev->dev, "core");
+        if (IS_ERR(rng->clk))
+                return PTR_ERR(rng->clk);
+
+        rng->hwrng.name = KBUILD_MODNAME,
+        rng->hwrng.init = msm_rng_init,
+        rng->hwrng.cleanup = msm_rng_cleanup,
+        rng->hwrng.read = msm_rng_read,
+
+        ret = hwrng_register(&rng->hwrng);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to register hwrng\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int msm_rng_remove(struct platform_device *pdev)
+{
+        struct msm_rng *rng = platform_get_drvdata(pdev);
+
+        hwrng_unregister(&rng->hwrng);
+        return 0;
+}
+
+static const struct of_device_id msm_rng_of_match[] = {
+        { .compatible = "qcom,prng", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, msm_rng_of_match);
+
+static struct platform_driver msm_rng_driver = {
+        .probe = msm_rng_probe,
+        .remove = msm_rng_remove,
+        .driver = {
+                .name = KBUILD_MODNAME,
+                .owner = THIS_MODULE,
+                .of_match_table = of_match_ptr(msm_rng_of_match),
+        }
+};
+module_platform_driver(msm_rng_driver);
+
+MODULE_ALIAS("platform:" KBUILD_MODNAME);
+MODULE_AUTHOR("The Linux Foundation");
+MODULE_DESCRIPTION("Qualcomm MSM random number generator driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c
new file mode 100644
index 000000000000..c853e9e68573
--- /dev/null
+++ b/drivers/char/hw_random/omap3-rom-rng.c
@@ -0,0 +1,141 @@
+/*
+ * omap3-rom-rng.c - RNG driver for TI OMAP3 CPU family
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Juha Yrjola <juha.yrjola@solidboot.com>
+ *
+ * Copyright (C) 2013 Pali Rohár <pali.rohar@gmail.com>
+ *
+ * This file is licensed under  the terms of the GNU General Public
+ * License version 2. This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/random.h>
+#include <linux/hw_random.h>
+#include <linux/timer.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+
+#define RNG_RESET                       0x01
+#define RNG_GEN_PRNG_HW_INIT            0x02
+#define RNG_GEN_HW                      0x08
+
+/* param1: ptr, param2: count, param3: flag */
+static u32 (*omap3_rom_rng_call)(u32, u32, u32);
+
+static struct timer_list idle_timer;
+static int rng_idle;
+static struct clk *rng_clk;
+
+static void omap3_rom_rng_idle(unsigned long data)
+{
+        int r;
+
+        r = omap3_rom_rng_call(0, 0, RNG_RESET);
+        if (r != 0) {
+                pr_err("reset failed: %d\n", r);
+                return;
+        }
+        clk_disable_unprepare(rng_clk);
+        rng_idle = 1;
+}
+
+static int omap3_rom_rng_get_random(void *buf, unsigned int count)
+{
+        u32 r;
+        u32 ptr;
+
+        del_timer_sync(&idle_timer);
+        if (rng_idle) {
+                clk_prepare_enable(rng_clk);
+                r = omap3_rom_rng_call(0, 0, RNG_GEN_PRNG_HW_INIT);
+                if (r != 0) {
+                        clk_disable_unprepare(rng_clk);
+                        pr_err("HW init failed: %d\n", r);
+                        return -EIO;
+                }
+                rng_idle = 0;
+        }
+
+        ptr = virt_to_phys(buf);
+        r = omap3_rom_rng_call(ptr, count, RNG_GEN_HW);
+        mod_timer(&idle_timer, jiffies + msecs_to_jiffies(500));
+        if (r != 0)
+                return -EINVAL;
+        return 0;
+}
+
+static int omap3_rom_rng_data_present(struct hwrng *rng, int wait)
+{
+        return 1;
+}
+
+static int omap3_rom_rng_data_read(struct hwrng *rng, u32 *data)
+{
+        int r;
+
+        r = omap3_rom_rng_get_random(data, 4);
+        if (r < 0)
+                return r;
+        return 4;
+}
+
+static struct hwrng omap3_rom_rng_ops = {
+        .name           = "omap3-rom",
+        .data_present   = omap3_rom_rng_data_present,
+        .data_read      = omap3_rom_rng_data_read,
+};
+
+static int omap3_rom_rng_probe(struct platform_device *pdev)
+{
+        pr_info("initializing\n");
+
+        omap3_rom_rng_call = pdev->dev.platform_data;
+        if (!omap3_rom_rng_call) {
+                pr_err("omap3_rom_rng_call is NULL\n");
+                return -EINVAL;
+        }
+
+        setup_timer(&idle_timer, omap3_rom_rng_idle, 0);
+        rng_clk = clk_get(&pdev->dev, "ick");
+        if (IS_ERR(rng_clk)) {
+                pr_err("unable to get RNG clock\n");
+                return PTR_ERR(rng_clk);
+        }
+
+        /* Leave the RNG in reset state. */
+        clk_prepare_enable(rng_clk);
+        omap3_rom_rng_idle(0);
+
+        return hwrng_register(&omap3_rom_rng_ops);
+}
+
+static int omap3_rom_rng_remove(struct platform_device *pdev)
+{
+        hwrng_unregister(&omap3_rom_rng_ops);
+        clk_disable_unprepare(rng_clk);
+        clk_put(rng_clk);
+        return 0;
+}
+
+static struct platform_driver omap3_rom_rng_driver = {
+        .driver = {
+                .name           = "omap3-rom-rng",
+                .owner          = THIS_MODULE,
+        },
+        .probe          = omap3_rom_rng_probe,
+        .remove         = omap3_rom_rng_remove,
+};
+
+module_platform_driver(omap3_rom_rng_driver);
+
+MODULE_ALIAS("platform:omap3-rom-rng");
+MODULE_AUTHOR("Juha Yrjola");
+MODULE_AUTHOR("Pali Rohár <pali.rohar@gmail.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
index b761459a3436..ab7ffdec0ec3 100644
--- a/drivers/char/hw_random/pseries-rng.c
+++ b/drivers/char/hw_random/pseries-rng.c
@@ -24,7 +24,6 @@
 #include <linux/hw_random.h>
 #include <asm/vio.h>
 
-#define MODULE_NAME "pseries-rng"
 
 static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
 {
@@ -55,7 +54,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)
 };
 
 static struct hwrng pseries_rng = {
-        .name           = MODULE_NAME,
+        .name           = KBUILD_MODNAME,
         .data_read      = pseries_rng_data_read,
 };
 
@@ -78,7 +77,7 @@ static struct vio_device_id pseries_rng_driver_ids[] = {
 MODULE_DEVICE_TABLE(vio, pseries_rng_driver_ids);
 
 static struct vio_driver pseries_rng_driver = {
-        .name = MODULE_NAME,
+        .name = KBUILD_MODNAME,
         .probe = pseries_rng_probe,
         .remove = pseries_rng_remove,
         .get_desired_dma = pseries_rng_get_desired_dma,
diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
index e737772ad69a..de5a6dcfb3e2 100644
--- a/drivers/char/hw_random/via-rng.c
+++ b/drivers/char/hw_random/via-rng.c
@@ -221,7 +221,7 @@ static void __exit mod_exit(void)
 module_init(mod_init);
 module_exit(mod_exit);
 
-static struct x86_cpu_id via_rng_cpu_id[] = {
+static struct x86_cpu_id __maybe_unused via_rng_cpu_id[] = {
         X86_FEATURE_MATCH(X86_FEATURE_XSTORE),
         {}
 };
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index 40cc0cf2ded6..e6939e13e338 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -664,6 +664,13 @@ static struct dmi_system_id __initdata i8k_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Vostro"),
                 },
         },
+        {
+                .ident = "Dell XPS421",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS L421X"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index bdb953e15d2a..5c07a56962db 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -87,6 +87,7 @@ config ARM_ARCH_TIMER
 config ARM_ARCH_TIMER_EVTSTREAM
         bool "Support for ARM architected timer event stream generation"
         default y if ARM_ARCH_TIMER
+        depends on ARM_ARCH_TIMER
         help
           This option enables support for event stream generation based on
           the ARM architected timer. It is used for waking up CPUs executing
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 4aac9ee0d0c0..3cf12834681e 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -313,8 +313,20 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
                 goto err1;
         }
 
-        return sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
-                                cfg->clockevent_rating);
+        ret = clk_prepare(p->clk);
+        if (ret < 0)
+                goto err2;
+
+        ret = sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
+                               cfg->clockevent_rating);
+        if (ret < 0)
+                goto err3;
+
+        return 0;
+ err3:
+        clk_unprepare(p->clk);
+ err2:
+        clk_put(p->clk);
  err1:
         iounmap(p->mapbase);
  err0:
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 78b8dae49628..63557cda0a7d 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -472,12 +472,26 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
                 ret = PTR_ERR(p->clk);
                 goto err1;
         }
+
+        ret = clk_prepare(p->clk);
+        if (ret < 0)
+                goto err2;
+
         p->cs_enabled = false;
         p->enable_count = 0;
 
-        return sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
-                               cfg->clockevent_rating,
-                               cfg->clocksource_rating);
+        ret = sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
+                              cfg->clockevent_rating,
+                              cfg->clocksource_rating);
+        if (ret < 0)
+                goto err3;
+
+        return 0;
+
+ err3:
+        clk_unprepare(p->clk);
+ err2:
+        clk_put(p->clk);
  err1:
         iounmap(p->mapbase);
  err0:
diff --git a/drivers/cpufreq/at32ap-cpufreq.c b/drivers/cpufreq/at32ap-cpufreq.c
index 856ad80418ae..7c03dd84f66a 100644
--- a/drivers/cpufreq/at32ap-cpufreq.c
+++ b/drivers/cpufreq/at32ap-cpufreq.c
@@ -58,7 +58,7 @@ static int at32_set_target(struct cpufreq_policy *policy, unsigned int index)
         return 0;
 }
 
-static int __init at32_cpufreq_driver_init(struct cpufreq_policy *policy)
+static int at32_cpufreq_driver_init(struct cpufreq_policy *policy)
 {
         unsigned int frequency, rate, min_freq;
         int retval, steps, i;
diff --git a/drivers/cpufreq/exynos4210-cpufreq.c b/drivers/cpufreq/exynos4210-cpufreq.c
index f2c75065ce19..dfd1643b0b2f 100644
--- a/drivers/cpufreq/exynos4210-cpufreq.c
+++ b/drivers/cpufreq/exynos4210-cpufreq.c
@@ -157,4 +157,3 @@ err_moutcore:
         pr_debug("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos4210_cpufreq_init);
diff --git a/drivers/cpufreq/exynos4x12-cpufreq.c b/drivers/cpufreq/exynos4x12-cpufreq.c
index 8683304ce62c..efad5e657f6f 100644
--- a/drivers/cpufreq/exynos4x12-cpufreq.c
+++ b/drivers/cpufreq/exynos4x12-cpufreq.c
@@ -211,4 +211,3 @@ err_moutcore:
         pr_debug("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos4x12_cpufreq_init);
diff --git a/drivers/cpufreq/exynos5250-cpufreq.c b/drivers/cpufreq/exynos5250-cpufreq.c
index 9fae466d7746..8feda86fe42c 100644
--- a/drivers/cpufreq/exynos5250-cpufreq.c
+++ b/drivers/cpufreq/exynos5250-cpufreq.c
@@ -236,4 +236,3 @@ err_moutcore:
         pr_err("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos5250_cpufreq_init);
diff --git a/drivers/cpufreq/tegra-cpufreq.c b/drivers/cpufreq/tegra-cpufreq.c
index f42df7ec03c5..b7309c37033d 100644
--- a/drivers/cpufreq/tegra-cpufreq.c
+++ b/drivers/cpufreq/tegra-cpufreq.c
@@ -142,10 +142,8 @@ static int tegra_target(struct cpufreq_policy *policy, unsigned int index)
 
         mutex_lock(&tegra_cpu_lock);
 
-        if (is_suspended) {
-                ret = -EBUSY;
+        if (is_suspended)
                 goto out;
-        }
 
         freq = freq_table[index].frequency;
 
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 2a991e468f78..a55e68f2cfc8 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -400,7 +400,7 @@ EXPORT_SYMBOL_GPL(cpuidle_register_device);
  */
 void cpuidle_unregister_device(struct cpuidle_device *dev)
 {
-        if (dev->registered == 0)
+        if (!dev || dev->registered == 0)
                 return;
 
         cpuidle_pause_and_lock();
diff --git a/drivers/crypto/caam/Kconfig b/drivers/crypto/caam/Kconfig
index ca89f6b84b06..e7555ff4cafd 100644
--- a/drivers/crypto/caam/Kconfig
+++ b/drivers/crypto/caam/Kconfig
@@ -4,16 +4,29 @@ config CRYPTO_DEV_FSL_CAAM
         help
           Enables the driver module for Freescale's Cryptographic Accelerator
           and Assurance Module (CAAM), also known as the SEC version 4 (SEC4).
-          This module adds a job ring operation interface, and configures h/w
+          This module creates job ring devices, and configures h/w
           to operate as a DPAA component automatically, depending
           on h/w feature availability.
 
           To compile this driver as a module, choose M here: the module
           will be called caam.
 
+config CRYPTO_DEV_FSL_CAAM_JR
+        tristate "Freescale CAAM Job Ring driver backend"
+        depends on CRYPTO_DEV_FSL_CAAM
+        default y
+        help
+          Enables the driver module for Job Rings which are part of
+          Freescale's Cryptographic Accelerator
+          and Assurance Module (CAAM). This module adds a job ring operation
+          interface.
+
+          To compile this driver as a module, choose M here: the module
+          will be called caam_jr.
+
 config CRYPTO_DEV_FSL_CAAM_RINGSIZE
         int "Job Ring size"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM_JR
         range 2 9
         default "9"
         help
@@ -31,7 +44,7 @@ config CRYPTO_DEV_FSL_CAAM_RINGSIZE
 
 config CRYPTO_DEV_FSL_CAAM_INTC
         bool "Job Ring interrupt coalescing"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM_JR
         default n
         help
           Enable the Job Ring's interrupt coalescing feature.
@@ -62,7 +75,7 @@ config CRYPTO_DEV_FSL_CAAM_INTC_TIME_THLD
 
 config CRYPTO_DEV_FSL_CAAM_CRYPTO_API
         tristate "Register algorithm implementations with the Crypto API"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM && CRYPTO_DEV_FSL_CAAM_JR
         default y
         select CRYPTO_ALGAPI
         select CRYPTO_AUTHENC
@@ -76,7 +89,7 @@ config CRYPTO_DEV_FSL_CAAM_CRYPTO_API
 
 config CRYPTO_DEV_FSL_CAAM_AHASH_API
         tristate "Register hash algorithm implementations with Crypto API"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM && CRYPTO_DEV_FSL_CAAM_JR
         default y
         select CRYPTO_HASH
         help
@@ -88,7 +101,7 @@ config CRYPTO_DEV_FSL_CAAM_AHASH_API
 
 config CRYPTO_DEV_FSL_CAAM_RNG_API
         tristate "Register caam device for hwrng API"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM && CRYPTO_DEV_FSL_CAAM_JR
         default y
         select CRYPTO_RNG
         select HW_RANDOM
diff --git a/drivers/crypto/caam/Makefile b/drivers/crypto/caam/Makefile
index d56bd0ec65d8..550758a333e7 100644
--- a/drivers/crypto/caam/Makefile
+++ b/drivers/crypto/caam/Makefile
@@ -6,8 +6,10 @@ ifeq ($(CONFIG_CRYPTO_DEV_FSL_CAAM_DEBUG), y)
 endif
 
 obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM) += caam.o
+obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM_JR) += caam_jr.o
 obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API) += caamalg.o
 obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API) += caamhash.o
 obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API) += caamrng.o
 
-caam-objs := ctrl.o jr.o error.o key_gen.o
+caam-objs := ctrl.o
+caam_jr-objs := jr.o key_gen.o error.o
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 7c63b72ecd75..4cf5dec826e1 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -86,6 +86,7 @@
 #else
 #define debug(format, arg...)
 #endif
+static struct list_head alg_list;
 
 /* Set DK bit in class 1 operation if shared */
 static inline void append_dec_op1(u32 *desc, u32 type)
@@ -817,7 +818,7 @@ static void aead_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
                        ivsize, 1);
         print_hex_dump(KERN_ERR, "dst    @"__stringify(__LINE__)": ",
                        DUMP_PREFIX_ADDRESS, 16, 4, sg_virt(req->dst),
-                       req->cryptlen, 1);
+                       req->cryptlen - ctx->authsize, 1);
 #endif
 
         if (err) {
@@ -971,12 +972,9 @@ static void init_aead_job(u32 *sh_desc, dma_addr_t ptr,
                                  (edesc->src_nents ? : 1);
                 in_options = LDST_SGF;
         }
-        if (encrypt)
-                append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                                  req->cryptlen - authsize, in_options);
-        else
-                append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                                  req->cryptlen, in_options);
+
+        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize + req->cryptlen,
+                          in_options);
 
         if (likely(req->src == req->dst)) {
                 if (all_contig) {
@@ -997,7 +995,8 @@ static void init_aead_job(u32 *sh_desc, dma_addr_t ptr,
                 }
         }
         if (encrypt)
-                append_seq_out_ptr(desc, dst_dma, req->cryptlen, out_options);
+                append_seq_out_ptr(desc, dst_dma, req->cryptlen + authsize,
+                                   out_options);
         else
                 append_seq_out_ptr(desc, dst_dma, req->cryptlen - authsize,
                                    out_options);
@@ -1047,8 +1046,8 @@ static void init_aead_giv_job(u32 *sh_desc, dma_addr_t ptr,
                 sec4_sg_index += edesc->assoc_nents + 1 + edesc->src_nents;
                 in_options = LDST_SGF;
         }
-        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                          req->cryptlen - authsize, in_options);
+        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize + req->cryptlen,
+                          in_options);
 
         if (contig & GIV_DST_CONTIG) {
                 dst_dma = edesc->iv_dma;
@@ -1065,7 +1064,8 @@ static void init_aead_giv_job(u32 *sh_desc, dma_addr_t ptr,
                 }
         }
 
-        append_seq_out_ptr(desc, dst_dma, ivsize + req->cryptlen, out_options);
+        append_seq_out_ptr(desc, dst_dma, ivsize + req->cryptlen + authsize,
+                           out_options);
 }
 
 /*
@@ -1129,7 +1129,8 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
  * allocate and map the aead extended descriptor
  */
 static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
-                                           int desc_bytes, bool *all_contig_ptr)
+                                           int desc_bytes, bool *all_contig_ptr,
+                                           bool encrypt)
 {
         struct crypto_aead *aead = crypto_aead_reqtfm(req);
         struct caam_ctx *ctx = crypto_aead_ctx(aead);
@@ -1144,12 +1145,22 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
         bool assoc_chained = false, src_chained = false, dst_chained = false;
         int ivsize = crypto_aead_ivsize(aead);
         int sec4_sg_index, sec4_sg_len = 0, sec4_sg_bytes;
+        unsigned int authsize = ctx->authsize;
 
         assoc_nents = sg_count(req->assoc, req->assoclen, &assoc_chained);
-        src_nents = sg_count(req->src, req->cryptlen, &src_chained);
 
-        if (unlikely(req->dst != req->src))
-                dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained);
+        if (unlikely(req->dst != req->src)) {
+                src_nents = sg_count(req->src, req->cryptlen, &src_chained);
+                dst_nents = sg_count(req->dst,
+                                     req->cryptlen +
+                                        (encrypt ? authsize : (-authsize)),
+                                     &dst_chained);
+        } else {
+                src_nents = sg_count(req->src,
+                                     req->cryptlen +
+                                        (encrypt ? authsize : 0),
+                                     &src_chained);
+        }
 
         sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1,
                                  DMA_TO_DEVICE, assoc_chained);
@@ -1233,11 +1244,9 @@ static int aead_encrypt(struct aead_request *req)
         u32 *desc;
         int ret = 0;
 
-        req->cryptlen += ctx->authsize;
-
         /* allocate extended descriptor */
         edesc = aead_edesc_alloc(req, DESC_JOB_IO_LEN *
-                                 CAAM_CMD_SZ, &all_contig);
+                                 CAAM_CMD_SZ, &all_contig, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1274,7 +1283,7 @@ static int aead_decrypt(struct aead_request *req)
 
         /* allocate extended descriptor */
         edesc = aead_edesc_alloc(req, DESC_JOB_IO_LEN *
-                                 CAAM_CMD_SZ, &all_contig);
+                                 CAAM_CMD_SZ, &all_contig, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1331,7 +1340,8 @@ static struct aead_edesc *aead_giv_edesc_alloc(struct aead_givcrypt_request
         src_nents = sg_count(req->src, req->cryptlen, &src_chained);
 
         if (unlikely(req->dst != req->src))
-                dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained);
+                dst_nents = sg_count(req->dst, req->cryptlen + ctx->authsize,
+                                     &dst_chained);
 
         sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1,
                                  DMA_TO_DEVICE, assoc_chained);
@@ -1425,8 +1435,6 @@ static int aead_givencrypt(struct aead_givcrypt_request *areq)
         u32 *desc;
         int ret = 0;
 
-        req->cryptlen += ctx->authsize;
-
         /* allocate extended descriptor */
         edesc = aead_giv_edesc_alloc(areq, DESC_JOB_IO_LEN *
                                      CAAM_CMD_SZ, &contig);
@@ -2057,7 +2065,6 @@ static struct caam_alg_template driver_algs[] = {
 
 struct caam_crypto_alg {
         struct list_head entry;
-        struct device *ctrldev;
         int class1_alg_type;
         int class2_alg_type;
         int alg_op;
@@ -2070,14 +2077,12 @@ static int caam_cra_init(struct crypto_tfm *tfm)
         struct caam_crypto_alg *caam_alg =
                  container_of(alg, struct caam_crypto_alg, crypto_alg);
         struct caam_ctx *ctx = crypto_tfm_ctx(tfm);
-        struct caam_drv_private *priv = dev_get_drvdata(caam_alg->ctrldev);
-        int tgt_jr = atomic_inc_return(&priv->tfm_count);
 
-        /*
-         * distribute tfms across job rings to ensure in-order
-         * crypto request processing per tfm
-         */
-        ctx->jrdev = priv->jrdev[(tgt_jr / 2) % priv->total_jobrs];
+        ctx->jrdev = caam_jr_alloc();
+        if (IS_ERR(ctx->jrdev)) {
+                pr_err("Job Ring Device allocation for transform failed\n");
+                return PTR_ERR(ctx->jrdev);
+        }
 
         /* copy descriptor header template value */
         ctx->class1_alg_type = OP_TYPE_CLASS1_ALG | caam_alg->class1_alg_type;
@@ -2104,44 +2109,26 @@ static void caam_cra_exit(struct crypto_tfm *tfm)
                 dma_unmap_single(ctx->jrdev, ctx->sh_desc_givenc_dma,
                                  desc_bytes(ctx->sh_desc_givenc),
                                  DMA_TO_DEVICE);
+
+        caam_jr_free(ctx->jrdev);
 }
 
 static void __exit caam_algapi_exit(void)
 {
 
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
         struct caam_crypto_alg *t_alg, *n;
 
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
-                return;
-
-        ctrldev = &pdev->dev;
-        of_node_put(dev_node);
-        priv = dev_get_drvdata(ctrldev);
-
-        if (!priv->alg_list.next)
+        if (!alg_list.next)
                 return;
 
-        list_for_each_entry_safe(t_alg, n, &priv->alg_list, entry) {
+        list_for_each_entry_safe(t_alg, n, &alg_list, entry) {
                 crypto_unregister_alg(&t_alg->crypto_alg);
                 list_del(&t_alg->entry);
                 kfree(t_alg);
         }
 }
 
-static struct caam_crypto_alg *caam_alg_alloc(struct device *ctrldev,
-                                              struct caam_alg_template
+static struct caam_crypto_alg *caam_alg_alloc(struct caam_alg_template
                                               *template)
 {
         struct caam_crypto_alg *t_alg;
@@ -2149,7 +2136,7 @@ static struct caam_crypto_alg *caam_alg_alloc(struct device *ctrldev,
 
         t_alg = kzalloc(sizeof(struct caam_crypto_alg), GFP_KERNEL);
         if (!t_alg) {
-                dev_err(ctrldev, "failed to allocate t_alg\n");
+                pr_err("failed to allocate t_alg\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -2181,62 +2168,39 @@ static struct caam_crypto_alg *caam_alg_alloc(struct device *ctrldev,
         t_alg->class1_alg_type = template->class1_alg_type;
         t_alg->class2_alg_type = template->class2_alg_type;
         t_alg->alg_op = template->alg_op;
-        t_alg->ctrldev = ctrldev;
 
         return t_alg;
 }
 
 static int __init caam_algapi_init(void)
 {
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
         int i = 0, err = 0;
 
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return -ENODEV;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
-                return -ENODEV;
-
-        ctrldev = &pdev->dev;
-        priv = dev_get_drvdata(ctrldev);
-        of_node_put(dev_node);
-
-        INIT_LIST_HEAD(&priv->alg_list);
-
-        atomic_set(&priv->tfm_count, -1);
+        INIT_LIST_HEAD(&alg_list);
 
         /* register crypto algorithms the device supports */
         for (i = 0; i < ARRAY_SIZE(driver_algs); i++) {
                 /* TODO: check if h/w supports alg */
                 struct caam_crypto_alg *t_alg;
 
-                t_alg = caam_alg_alloc(ctrldev, &driver_algs[i]);
+                t_alg = caam_alg_alloc(&driver_algs[i]);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
-                        dev_warn(ctrldev, "%s alg allocation failed\n",
-                                 driver_algs[i].driver_name);
+                        pr_warn("%s alg allocation failed\n",
+                                driver_algs[i].driver_name);
                         continue;
                 }
 
                 err = crypto_register_alg(&t_alg->crypto_alg);
                 if (err) {
-                        dev_warn(ctrldev, "%s alg registration failed\n",
+                        pr_warn("%s alg registration failed\n",
                                 t_alg->crypto_alg.cra_driver_name);
                         kfree(t_alg);
                 } else
-                        list_add_tail(&t_alg->entry, &priv->alg_list);
+                        list_add_tail(&t_alg->entry, &alg_list);
         }
-        if (!list_empty(&priv->alg_list))
-                dev_info(ctrldev, "%s algorithms registered in /proc/crypto\n",
-                         (char *)of_get_property(dev_node, "compatible", NULL));
+        if (!list_empty(&alg_list))
+                pr_info("caam algorithms registered in /proc/crypto\n");
 
         return err;
 }
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index e732bd962e98..0378328f47a7 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -94,6 +94,9 @@
 #define debug(format, arg...)
 #endif
 
+
+static struct list_head hash_list;
+
 /* ahash per-session context */
 struct caam_hash_ctx {
         struct device *jrdev;
@@ -1653,7 +1656,6 @@ static struct caam_hash_template driver_hash[] = {
 
 struct caam_hash_alg {
         struct list_head entry;
-        struct device *ctrldev;
         int alg_type;
         int alg_op;
         struct ahash_alg ahash_alg;
@@ -1670,7 +1672,6 @@ static int caam_hash_cra_init(struct crypto_tfm *tfm)
         struct caam_hash_alg *caam_hash =
                  container_of(alg, struct caam_hash_alg, ahash_alg);
         struct caam_hash_ctx *ctx = crypto_tfm_ctx(tfm);
-        struct caam_drv_private *priv = dev_get_drvdata(caam_hash->ctrldev);
         /* Sizes for MDHA running digests: MD5, SHA1, 224, 256, 384, 512 */
         static const u8 runninglen[] = { HASH_MSG_LEN + MD5_DIGEST_SIZE,
                                          HASH_MSG_LEN + SHA1_DIGEST_SIZE,
@@ -1678,15 +1679,17 @@ static int caam_hash_cra_init(struct crypto_tfm *tfm)
                                          HASH_MSG_LEN + SHA256_DIGEST_SIZE,
                                          HASH_MSG_LEN + 64,
                                          HASH_MSG_LEN + SHA512_DIGEST_SIZE };
-        int tgt_jr = atomic_inc_return(&priv->tfm_count);
         int ret = 0;
 
         /*
-         * distribute tfms across job rings to ensure in-order
+         * Get a Job ring from Job Ring driver to ensure in-order
          * crypto request processing per tfm
          */
-        ctx->jrdev = priv->jrdev[tgt_jr % priv->total_jobrs];
-
+        ctx->jrdev = caam_jr_alloc();
+        if (IS_ERR(ctx->jrdev)) {
+                pr_err("Job Ring Device allocation for transform failed\n");
+                return PTR_ERR(ctx->jrdev);
+        }
         /* copy descriptor header template value */
         ctx->alg_type = OP_TYPE_CLASS2_ALG | caam_hash->alg_type;
         ctx->alg_op = OP_TYPE_CLASS2_ALG | caam_hash->alg_op;
@@ -1729,35 +1732,18 @@ static void caam_hash_cra_exit(struct crypto_tfm *tfm)
             !dma_mapping_error(ctx->jrdev, ctx->sh_desc_finup_dma))
                 dma_unmap_single(ctx->jrdev, ctx->sh_desc_finup_dma,
                                  desc_bytes(ctx->sh_desc_finup), DMA_TO_DEVICE);
+
+        caam_jr_free(ctx->jrdev);
 }
 
 static void __exit caam_algapi_hash_exit(void)
 {
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
         struct caam_hash_alg *t_alg, *n;
 
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
+        if (!hash_list.next)
                 return;
 
-        ctrldev = &pdev->dev;
-        of_node_put(dev_node);
-        priv = dev_get_drvdata(ctrldev);
-
-        if (!priv->hash_list.next)
-                return;
-
-        list_for_each_entry_safe(t_alg, n, &priv->hash_list, entry) {
+        list_for_each_entry_safe(t_alg, n, &hash_list, entry) {
                 crypto_unregister_ahash(&t_alg->ahash_alg);
                 list_del(&t_alg->entry);
                 kfree(t_alg);
@@ -1765,7 +1751,7 @@ static void __exit caam_algapi_hash_exit(void)
 }
 
 static struct caam_hash_alg *
-caam_hash_alloc(struct device *ctrldev, struct caam_hash_template *template,
+caam_hash_alloc(struct caam_hash_template *template,
                 bool keyed)
 {
         struct caam_hash_alg *t_alg;
@@ -1774,7 +1760,7 @@ caam_hash_alloc(struct device *ctrldev, struct caam_hash_template *template,
 
         t_alg = kzalloc(sizeof(struct caam_hash_alg), GFP_KERNEL);
         if (!t_alg) {
-                dev_err(ctrldev, "failed to allocate t_alg\n");
+                pr_err("failed to allocate t_alg\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -1805,37 +1791,15 @@ caam_hash_alloc(struct device *ctrldev, struct caam_hash_template *template,
 
         t_alg->alg_type = template->alg_type;
         t_alg->alg_op = template->alg_op;
-        t_alg->ctrldev = ctrldev;
 
         return t_alg;
 }
 
 static int __init caam_algapi_hash_init(void)
 {
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
         int i = 0, err = 0;
 
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return -ENODEV;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
-                return -ENODEV;
-
-        ctrldev = &pdev->dev;
-        priv = dev_get_drvdata(ctrldev);
-        of_node_put(dev_node);
-
-        INIT_LIST_HEAD(&priv->hash_list);
-
-        atomic_set(&priv->tfm_count, -1);
+        INIT_LIST_HEAD(&hash_list);
 
         /* register crypto algorithms the device supports */
         for (i = 0; i < ARRAY_SIZE(driver_hash); i++) {
@@ -1843,38 +1807,38 @@ static int __init caam_algapi_hash_init(void)
                 struct caam_hash_alg *t_alg;
 
                 /* register hmac version */
-                t_alg = caam_hash_alloc(ctrldev, &driver_hash[i], true);
+                t_alg = caam_hash_alloc(&driver_hash[i], true);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
-                        dev_warn(ctrldev, "%s alg allocation failed\n",
-                                 driver_hash[i].driver_name);
+                        pr_warn("%s alg allocation failed\n",
+                                driver_hash[i].driver_name);
                         continue;
                 }
 
                 err = crypto_register_ahash(&t_alg->ahash_alg);
                 if (err) {
-                        dev_warn(ctrldev, "%s alg registration failed\n",
+                        pr_warn("%s alg registration failed\n",
                                 t_alg->ahash_alg.halg.base.cra_driver_name);
                         kfree(t_alg);
                 } else
-                        list_add_tail(&t_alg->entry, &priv->hash_list);
+                        list_add_tail(&t_alg->entry, &hash_list);
 
                 /* register unkeyed version */
-                t_alg = caam_hash_alloc(ctrldev, &driver_hash[i], false);
+                t_alg = caam_hash_alloc(&driver_hash[i], false);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
-                        dev_warn(ctrldev, "%s alg allocation failed\n",
-                                 driver_hash[i].driver_name);
+                        pr_warn("%s alg allocation failed\n",
+                                driver_hash[i].driver_name);
                         continue;
                 }
 
                 err = crypto_register_ahash(&t_alg->ahash_alg);
                 if (err) {
-                        dev_warn(ctrldev, "%s alg registration failed\n",
+                        pr_warn("%s alg registration failed\n",
                                 t_alg->ahash_alg.halg.base.cra_driver_name);
                         kfree(t_alg);
                 } else
-                        list_add_tail(&t_alg->entry, &priv->hash_list);
+                        list_add_tail(&t_alg->entry, &hash_list);
         }
 
         return err;
diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
index d1939a9539c0..28486b19fc36 100644
--- a/drivers/crypto/caam/caamrng.c
+++ b/drivers/crypto/caam/caamrng.c
@@ -273,34 +273,23 @@ static struct hwrng caam_rng = {
 
 static void __exit caam_rng_exit(void)
 {
+        caam_jr_free(rng_ctx.jrdev);
         hwrng_unregister(&caam_rng);
 }
 
 static int __init caam_rng_init(void)
 {
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
-
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return -ENODEV;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
-                return -ENODEV;
+        struct device *dev;
 
-        ctrldev = &pdev->dev;
-        priv = dev_get_drvdata(ctrldev);
-        of_node_put(dev_node);
+        dev = caam_jr_alloc();
+        if (IS_ERR(dev)) {
+                pr_err("Job Ring Device allocation for transform failed\n");
+                return PTR_ERR(dev);
+        }
 
-        caam_init_rng(&rng_ctx, priv->jrdev[0]);
+        caam_init_rng(&rng_ctx, dev);
 
-        dev_info(priv->jrdev[0], "registering rng-caam\n");
+        dev_info(dev, "registering rng-caam\n");
         return hwrng_register(&caam_rng);
 }
 
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index bc6d820812b6..63fb1af2c431 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -16,82 +16,75 @@
 #include "error.h"
 #include "ctrl.h"
 
-static int caam_remove(struct platform_device *pdev)
-{
-        struct device *ctrldev;
-        struct caam_drv_private *ctrlpriv;
-        struct caam_drv_private_jr *jrpriv;
-        struct caam_full __iomem *topregs;
-        int ring, ret = 0;
-
-        ctrldev = &pdev->dev;
-        ctrlpriv = dev_get_drvdata(ctrldev);
-        topregs = (struct caam_full __iomem *)ctrlpriv->ctrl;
-
-        /* shut down JobRs */
-        for (ring = 0; ring < ctrlpriv->total_jobrs; ring++) {
-                ret |= caam_jr_shutdown(ctrlpriv->jrdev[ring]);
-                jrpriv = dev_get_drvdata(ctrlpriv->jrdev[ring]);
-                irq_dispose_mapping(jrpriv->irq);
-        }
-
-        /* Shut down debug views */
-#ifdef CONFIG_DEBUG_FS
-        debugfs_remove_recursive(ctrlpriv->dfs_root);
-#endif
-
-        /* Unmap controller region */
-        iounmap(&topregs->ctrl);
-
-        kfree(ctrlpriv->jrdev);
-        kfree(ctrlpriv);
-
-        return ret;
-}
-
 /*
  * Descriptor to instantiate RNG State Handle 0 in normal mode and
  * load the JDKEK, TDKEK and TDSK registers
  */
-static void build_instantiation_desc(u32 *desc)
+static void build_instantiation_desc(u32 *desc, int handle, int do_sk)
 {
-        u32 *jump_cmd;
+        u32 *jump_cmd, op_flags;
 
         init_job_desc(desc, 0);
 
+        op_flags = OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
+                        (handle << OP_ALG_AAI_SHIFT) | OP_ALG_AS_INIT;
+
         /* INIT RNG in non-test mode */
-        append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
-                         OP_ALG_AS_INIT);
+        append_operation(desc, op_flags);
+
+        if (!handle && do_sk) {
+                /*
+                 * For SH0, Secure Keys must be generated as well
+                 */
+
+                /* wait for done */
+                jump_cmd = append_jump(desc, JUMP_CLASS_CLASS1);
+                set_jump_tgt_here(desc, jump_cmd);
+
+                /*
+                 * load 1 to clear written reg:
+                 * resets the done interrrupt and returns the RNG to idle.
+                 */
+                append_load_imm_u32(desc, 1, LDST_SRCDST_WORD_CLRW);
+
+                /* Initialize State Handle  */
+                append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
+                                 OP_ALG_AAI_RNG4_SK);
+        }
 
-        /* wait for done */
-        jump_cmd = append_jump(desc, JUMP_CLASS_CLASS1);
-        set_jump_tgt_here(desc, jump_cmd);
+        append_jump(desc, JUMP_CLASS_CLASS1 | JUMP_TYPE_HALT);
+}
 
-        /*
-         * load 1 to clear written reg:
-         * resets the done interrupt and returns the RNG to idle.
-         */
-        append_load_imm_u32(desc, 1, LDST_SRCDST_WORD_CLRW);
+/* Descriptor for deinstantiation of State Handle 0 of the RNG block. */
+static void build_deinstantiation_desc(u32 *desc, int handle)
+{
+        init_job_desc(desc, 0);
 
-        /* generate secure keys (non-test) */
+        /* Uninstantiate State Handle 0 */
         append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
-                         OP_ALG_RNG4_SK);
+                         (handle << OP_ALG_AAI_SHIFT) | OP_ALG_AS_INITFINAL);
+
+        append_jump(desc, JUMP_CLASS_CLASS1 | JUMP_TYPE_HALT);
 }
 
-static int instantiate_rng(struct device *ctrldev)
+/*
+ * run_descriptor_deco0 - runs a descriptor on DECO0, under direct control of
+ *                        the software (no JR/QI used).
+ * @ctrldev - pointer to device
+ * @status - descriptor status, after being run
+ *
+ * Return: - 0 if no error occurred
+ *         - -ENODEV if the DECO couldn't be acquired
+ *         - -EAGAIN if an error occurred while executing the descriptor
+ */
+static inline int run_descriptor_deco0(struct device *ctrldev, u32 *desc,
+                                        u32 *status)
 {
         struct caam_drv_private *ctrlpriv = dev_get_drvdata(ctrldev);
         struct caam_full __iomem *topregs;
         unsigned int timeout = 100000;
-        u32 *desc;
-        int i, ret = 0;
-
-        desc = kmalloc(CAAM_CMD_SZ * 6, GFP_KERNEL | GFP_DMA);
-        if (!desc) {
-                dev_err(ctrldev, "can't allocate RNG init descriptor memory\n");
-                return -ENOMEM;
-        }
-        build_instantiation_desc(desc);
+        u32 deco_dbg_reg, flags;
+        int i;
 
         /* Set the bit to request direct access to DECO0 */
         topregs = (struct caam_full __iomem *)ctrlpriv->ctrl;
@@ -103,36 +96,219 @@ static int instantiate_rng(struct device *ctrldev)
 
         if (!timeout) {
                 dev_err(ctrldev, "failed to acquire DECO 0\n");
-                ret = -EIO;
-                goto out;
+                clrbits32(&topregs->ctrl.deco_rq, DECORR_RQD0ENABLE);
+                return -ENODEV;
         }
 
         for (i = 0; i < desc_len(desc); i++)
-                topregs->deco.descbuf[i] = *(desc + i);
+                wr_reg32(&topregs->deco.descbuf[i], *(desc + i));
+
+        flags = DECO_JQCR_WHL;
+        /*
+         * If the descriptor length is longer than 4 words, then the
+         * FOUR bit in JRCTRL register must be set.
+         */
+        if (desc_len(desc) >= 4)
+                flags |= DECO_JQCR_FOUR;
 
-        wr_reg32(&topregs->deco.jr_ctl_hi, DECO_JQCR_WHL | DECO_JQCR_FOUR);
+        /* Instruct the DECO to execute it */
+        wr_reg32(&topregs->deco.jr_ctl_hi, flags);
 
         timeout = 10000000;
-        while ((rd_reg32(&topregs->deco.desc_dbg) & DECO_DBG_VALID) &&
-                                                                 --timeout)
+        do {
+                deco_dbg_reg = rd_reg32(&topregs->deco.desc_dbg);
+                /*
+                 * If an error occured in the descriptor, then
+                 * the DECO status field will be set to 0x0D
+                 */
+                if ((deco_dbg_reg & DESC_DBG_DECO_STAT_MASK) ==
+                    DESC_DBG_DECO_STAT_HOST_ERR)
+                        break;
                 cpu_relax();
+        } while ((deco_dbg_reg & DESC_DBG_DECO_STAT_VALID) && --timeout);
 
-        if (!timeout) {
-                dev_err(ctrldev, "failed to instantiate RNG\n");
-                ret = -EIO;
-        }
+        *status = rd_reg32(&topregs->deco.op_status_hi) &
+                  DECO_OP_STATUS_HI_ERR_MASK;
 
+        /* Mark the DECO as free */
         clrbits32(&topregs->ctrl.deco_rq, DECORR_RQD0ENABLE);
-out:
+
+        if (!timeout)
+                return -EAGAIN;
+
+        return 0;
+}
+
+/*
+ * instantiate_rng - builds and executes a descriptor on DECO0,
+ *                   which initializes the RNG block.
+ * @ctrldev - pointer to device
+ * @state_handle_mask - bitmask containing the instantiation status
+ *                      for the RNG4 state handles which exist in
+ *                      the RNG4 block: 1 if it's been instantiated
+ *                      by an external entry, 0 otherwise.
+ * @gen_sk  - generate data to be loaded into the JDKEK, TDKEK and TDSK;
+ *            Caution: this can be done only once; if the keys need to be
+ *            regenerated, a POR is required
+ *
+ * Return: - 0 if no error occurred
+ *         - -ENOMEM if there isn't enough memory to allocate the descriptor
+ *         - -ENODEV if DECO0 couldn't be acquired
+ *         - -EAGAIN if an error occurred when executing the descriptor
+ *            f.i. there was a RNG hardware error due to not "good enough"
+ *            entropy being aquired.
+ */
+static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
+                           int gen_sk)
+{
+        struct caam_drv_private *ctrlpriv = dev_get_drvdata(ctrldev);
+        struct caam_full __iomem *topregs;
+        struct rng4tst __iomem *r4tst;
+        u32 *desc, status, rdsta_val;
+        int ret = 0, sh_idx;
+
+        topregs = (struct caam_full __iomem *)ctrlpriv->ctrl;
+        r4tst = &topregs->ctrl.r4tst[0];
+
+        desc = kmalloc(CAAM_CMD_SZ * 7, GFP_KERNEL);
+        if (!desc)
+                return -ENOMEM;
+
+        for (sh_idx = 0; sh_idx < RNG4_MAX_HANDLES; sh_idx++) {
+                /*
+                 * If the corresponding bit is set, this state handle
+                 * was initialized by somebody else, so it's left alone.
+                 */
+                if ((1 << sh_idx) & state_handle_mask)
+                        continue;
+
+                /* Create the descriptor for instantiating RNG State Handle */
+                build_instantiation_desc(desc, sh_idx, gen_sk);
+
+                /* Try to run it through DECO0 */
+                ret = run_descriptor_deco0(ctrldev, desc, &status);
+
+                /*
+                 * If ret is not 0, or descriptor status is not 0, then
+                 * something went wrong. No need to try the next state
+                 * handle (if available), bail out here.
+                 * Also, if for some reason, the State Handle didn't get
+                 * instantiated although the descriptor has finished
+                 * without any error (HW optimizations for later
+                 * CAAM eras), then try again.
+                 */
+                rdsta_val =
+                        rd_reg32(&topregs->ctrl.r4tst[0].rdsta) & RDSTA_IFMASK;
+                if (status || !(rdsta_val & (1 << sh_idx)))
+                        ret = -EAGAIN;
+                if (ret)
+                        break;
+
+                dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx);
+                /* Clear the contents before recreating the descriptor */
+                memset(desc, 0x00, CAAM_CMD_SZ * 7);
+        }
+
         kfree(desc);
+
         return ret;
 }
 
 /*
- * By default, the TRNG runs for 200 clocks per sample;
- * 1600 clocks per sample generates better entropy.
+ * deinstantiate_rng - builds and executes a descriptor on DECO0,
+ *                     which deinitializes the RNG block.
+ * @ctrldev - pointer to device
+ * @state_handle_mask - bitmask containing the instantiation status
+ *                      for the RNG4 state handles which exist in
+ *                      the RNG4 block: 1 if it's been instantiated
+ *
+ * Return: - 0 if no error occurred
+ *         - -ENOMEM if there isn't enough memory to allocate the descriptor
+ *         - -ENODEV if DECO0 couldn't be acquired
+ *         - -EAGAIN if an error occurred when executing the descriptor
  */
-static void kick_trng(struct platform_device *pdev)
+static int deinstantiate_rng(struct device *ctrldev, int state_handle_mask)
+{
+        u32 *desc, status;
+        int sh_idx, ret = 0;
+
+        desc = kmalloc(CAAM_CMD_SZ * 3, GFP_KERNEL);
+        if (!desc)
+                return -ENOMEM;
+
+        for (sh_idx = 0; sh_idx < RNG4_MAX_HANDLES; sh_idx++) {
+                /*
+                 * If the corresponding bit is set, then it means the state
+                 * handle was initialized by us, and thus it needs to be
+                 * deintialized as well
+                 */
+                if ((1 << sh_idx) & state_handle_mask) {
+                        /*
+                         * Create the descriptor for deinstantating this state
+                         * handle
+                         */
+                        build_deinstantiation_desc(desc, sh_idx);
+
+                        /* Try to run it through DECO0 */
+                        ret = run_descriptor_deco0(ctrldev, desc, &status);
+
+                        if (ret || status) {
+                                dev_err(ctrldev,
+                                        "Failed to deinstantiate RNG4 SH%d\n",
+                                        sh_idx);
+                                break;
+                        }
+                        dev_info(ctrldev, "Deinstantiated RNG4 SH%d\n", sh_idx);
+                }
+        }
+
+        kfree(desc);
+
+        return ret;
+}
+
+static int caam_remove(struct platform_device *pdev)
+{
+        struct device *ctrldev;
+        struct caam_drv_private *ctrlpriv;
+        struct caam_full __iomem *topregs;
+        int ring, ret = 0;
+
+        ctrldev = &pdev->dev;
+        ctrlpriv = dev_get_drvdata(ctrldev);
+        topregs = (struct caam_full __iomem *)ctrlpriv->ctrl;
+
+        /* Remove platform devices for JobRs */
+        for (ring = 0; ring < ctrlpriv->total_jobrs; ring++) {
+                if (ctrlpriv->jrpdev[ring])
+                        of_device_unregister(ctrlpriv->jrpdev[ring]);
+        }
+
+        /* De-initialize RNG state handles initialized by this driver. */
+        if (ctrlpriv->rng4_sh_init)
+                deinstantiate_rng(ctrldev, ctrlpriv->rng4_sh_init);
+
+        /* Shut down debug views */
+#ifdef CONFIG_DEBUG_FS
+        debugfs_remove_recursive(ctrlpriv->dfs_root);
+#endif
+
+        /* Unmap controller region */
+        iounmap(&topregs->ctrl);
+
+        kfree(ctrlpriv->jrpdev);
+        kfree(ctrlpriv);
+
+        return ret;
+}
+
+/*
+ * kick_trng - sets the various parameters for enabling the initialization
+ *             of the RNG4 block in CAAM
+ * @pdev - pointer to the platform device
+ * @ent_delay - Defines the length (in system clocks) of each entropy sample.
+ */
+static void kick_trng(struct platform_device *pdev, int ent_delay)
 {
         struct device *ctrldev = &pdev->dev;
         struct caam_drv_private *ctrlpriv = dev_get_drvdata(ctrldev);
@@ -145,14 +321,31 @@ static void kick_trng(struct platform_device *pdev)
 
         /* put RNG4 into program mode */
         setbits32(&r4tst->rtmctl, RTMCTL_PRGM);
-        /* 1600 clocks per sample */
+
+        /*
+         * Performance-wise, it does not make sense to
+         * set the delay to a value that is lower
+         * than the last one that worked (i.e. the state handles
+         * were instantiated properly. Thus, instead of wasting
+         * time trying to set the values controlling the sample
+         * frequency, the function simply returns.
+         */
+        val = (rd_reg32(&r4tst->rtsdctl) & RTSDCTL_ENT_DLY_MASK)
+              >> RTSDCTL_ENT_DLY_SHIFT;
+        if (ent_delay <= val) {
+                /* put RNG4 into run mode */
+                clrbits32(&r4tst->rtmctl, RTMCTL_PRGM);
+                return;
+        }
+
         val = rd_reg32(&r4tst->rtsdctl);
-        val = (val & ~RTSDCTL_ENT_DLY_MASK) | (1600 << RTSDCTL_ENT_DLY_SHIFT);
+        val = (val & ~RTSDCTL_ENT_DLY_MASK) |
+              (ent_delay << RTSDCTL_ENT_DLY_SHIFT);
         wr_reg32(&r4tst->rtsdctl, val);
-        /* min. freq. count */
-        wr_reg32(&r4tst->rtfrqmin, 400);
-        /* max. freq. count */
-        wr_reg32(&r4tst->rtfrqmax, 6400);
+        /* min. freq. count, equal to 1/4 of the entropy sample length */
+        wr_reg32(&r4tst->rtfrqmin, ent_delay >> 2);
+        /* max. freq. count, equal to 8 times the entropy sample length */
+        wr_reg32(&r4tst->rtfrqmax, ent_delay << 3);
         /* put RNG4 into run mode */
         clrbits32(&r4tst->rtmctl, RTMCTL_PRGM);
 }
@@ -193,7 +386,7 @@ EXPORT_SYMBOL(caam_get_era);
 /* Probe routine for CAAM top (controller) level */
 static int caam_probe(struct platform_device *pdev)
 {
-        int ret, ring, rspec;
+        int ret, ring, rspec, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
         u64 caam_id;
         struct device *dev;
         struct device_node *nprop, *np;
@@ -258,8 +451,9 @@ static int caam_probe(struct platform_device *pdev)
                         rspec++;
         }
 
-        ctrlpriv->jrdev = kzalloc(sizeof(struct device *) * rspec, GFP_KERNEL);
-        if (ctrlpriv->jrdev == NULL) {
+        ctrlpriv->jrpdev = kzalloc(sizeof(struct platform_device *) * rspec,
+                                                                GFP_KERNEL);
+        if (ctrlpriv->jrpdev == NULL) {
                 iounmap(&topregs->ctrl);
                 return -ENOMEM;
         }
@@ -267,13 +461,24 @@ static int caam_probe(struct platform_device *pdev)
         ring = 0;
         ctrlpriv->total_jobrs = 0;
         for_each_compatible_node(np, NULL, "fsl,sec-v4.0-job-ring") {
-                caam_jr_probe(pdev, np, ring);
+                ctrlpriv->jrpdev[ring] =
+                                of_platform_device_create(np, NULL, dev);
+                if (!ctrlpriv->jrpdev[ring]) {
+                        pr_warn("JR%d Platform device creation error\n", ring);
+                        continue;
+                }
                 ctrlpriv->total_jobrs++;
                 ring++;
         }
         if (!ring) {
                 for_each_compatible_node(np, NULL, "fsl,sec4.0-job-ring") {
-                        caam_jr_probe(pdev, np, ring);
+                        ctrlpriv->jrpdev[ring] =
+                                of_platform_device_create(np, NULL, dev);
+                        if (!ctrlpriv->jrpdev[ring]) {
+                                pr_warn("JR%d Platform device creation error\n",
+                                        ring);
+                                continue;
+                        }
                         ctrlpriv->total_jobrs++;
                         ring++;
                 }
@@ -299,16 +504,55 @@ static int caam_probe(struct platform_device *pdev)
 
         /*
          * If SEC has RNG version >= 4 and RNG state handle has not been
-         * already instantiated ,do RNG instantiation
+         * already instantiated, do RNG instantiation
          */
-        if ((cha_vid & CHA_ID_RNG_MASK) >> CHA_ID_RNG_SHIFT >= 4 &&
-            !(rd_reg32(&topregs->ctrl.r4tst[0].rdsta) & RDSTA_IF0)) {
-                kick_trng(pdev);
-                ret = instantiate_rng(dev);
+        if ((cha_vid & CHA_ID_RNG_MASK) >> CHA_ID_RNG_SHIFT >= 4) {
+                ctrlpriv->rng4_sh_init =
+                        rd_reg32(&topregs->ctrl.r4tst[0].rdsta);
+                /*
+                 * If the secure keys (TDKEK, JDKEK, TDSK), were already
+                 * generated, signal this to the function that is instantiating
+                 * the state handles. An error would occur if RNG4 attempts
+                 * to regenerate these keys before the next POR.
+                 */
+                gen_sk = ctrlpriv->rng4_sh_init & RDSTA_SKVN ? 0 : 1;
+                ctrlpriv->rng4_sh_init &= RDSTA_IFMASK;
+                do {
+                        int inst_handles =
+                                rd_reg32(&topregs->ctrl.r4tst[0].rdsta) &
+                                                                RDSTA_IFMASK;
+                        /*
+                         * If either SH were instantiated by somebody else
+                         * (e.g. u-boot) then it is assumed that the entropy
+                         * parameters are properly set and thus the function
+                         * setting these (kick_trng(...)) is skipped.
+                         * Also, if a handle was instantiated, do not change
+                         * the TRNG parameters.
+                         */
+                        if (!(ctrlpriv->rng4_sh_init || inst_handles)) {
+                                kick_trng(pdev, ent_delay);
+                                ent_delay += 400;
+                        }
+                        /*
+                         * if instantiate_rng(...) fails, the loop will rerun
+                         * and the kick_trng(...) function will modfiy the
+                         * upper and lower limits of the entropy sampling
+                         * interval, leading to a sucessful initialization of
+                         * the RNG.
+                         */
+                        ret = instantiate_rng(dev, inst_handles,
+                                              gen_sk);
+                } while ((ret == -EAGAIN) && (ent_delay < RTSDCTL_ENT_DLY_MAX));
                 if (ret) {
+                        dev_err(dev, "failed to instantiate RNG");
                         caam_remove(pdev);
                         return ret;
                 }
+                /*
+                 * Set handles init'ed by this module as the complement of the
+                 * already initialized ones
+                 */
+                ctrlpriv->rng4_sh_init = ~ctrlpriv->rng4_sh_init & RDSTA_IFMASK;
 
                 /* Enable RDB bit so that RNG works faster */
                 setbits32(&topregs->ctrl.scfgr, SCFGR_RDBENABLE);
diff --git a/drivers/crypto/caam/desc.h b/drivers/crypto/caam/desc.h
index 53b296f78b0d..7e4500f18df6 100644
--- a/drivers/crypto/caam/desc.h
+++ b/drivers/crypto/caam/desc.h
@@ -1155,8 +1155,15 @@ struct sec4_sg_entry {
 
 /* randomizer AAI set */
 #define OP_ALG_AAI_RNG          (0x00 << OP_ALG_AAI_SHIFT)
-#define OP_ALG_AAI_RNG_NOZERO   (0x10 << OP_ALG_AAI_SHIFT)
-#define OP_ALG_AAI_RNG_ODD      (0x20 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG_NZB      (0x10 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG_OBP      (0x20 << OP_ALG_AAI_SHIFT)
+
+/* RNG4 AAI set */
+#define OP_ALG_AAI_RNG4_SH_0    (0x00 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG4_SH_1    (0x01 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG4_PS      (0x40 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG4_AI      (0x80 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG4_SK      (0x100 << OP_ALG_AAI_SHIFT)
 
 /* hmac/smac AAI set */
 #define OP_ALG_AAI_HASH         (0x00 << OP_ALG_AAI_SHIFT)
@@ -1178,12 +1185,6 @@ struct sec4_sg_entry {
 #define OP_ALG_AAI_GSM          (0x10 << OP_ALG_AAI_SHIFT)
 #define OP_ALG_AAI_EDGE         (0x20 << OP_ALG_AAI_SHIFT)
 
-/* RNG4 set */
-#define OP_ALG_RNG4_SHIFT       4
-#define OP_ALG_RNG4_MASK        (0x1f3 << OP_ALG_RNG4_SHIFT)
-
-#define OP_ALG_RNG4_SK          (0x100 << OP_ALG_RNG4_SHIFT)
-
 #define OP_ALG_AS_SHIFT         2
 #define OP_ALG_AS_MASK          (0x3 << OP_ALG_AS_SHIFT)
 #define OP_ALG_AS_UPDATE        (0 << OP_ALG_AS_SHIFT)
diff --git a/drivers/crypto/caam/intern.h b/drivers/crypto/caam/intern.h
index 34c4b9f7fbfa..6d85fcc5bd0a 100644
--- a/drivers/crypto/caam/intern.h
+++ b/drivers/crypto/caam/intern.h
@@ -37,13 +37,16 @@ struct caam_jrentry_info {
 
 /* Private sub-storage for a single JobR */
 struct caam_drv_private_jr {
-        struct device *parentdev;       /* points back to controller dev */
-        struct platform_device *jr_pdev;/* points to platform device for JR */
+        struct list_head        list_node;      /* Job Ring device list */
+        struct device           *dev;
         int ridx;
         struct caam_job_ring __iomem *rregs;    /* JobR's register space */
         struct tasklet_struct irqtask;
         int irq;                        /* One per queue */
 
+        /* Number of scatterlist crypt transforms active on the JobR */
+        atomic_t tfm_count ____cacheline_aligned;
+
         /* Job ring info */
         int ringsize;   /* Size of rings (assume input = output) */
         struct caam_jrentry_info *entinfo;      /* Alloc'ed 1 per ring entry */
@@ -63,7 +66,7 @@ struct caam_drv_private_jr {
 struct caam_drv_private {
 
         struct device *dev;
-        struct device **jrdev; /* Alloc'ed array per sub-device */
+        struct platform_device **jrpdev; /* Alloc'ed array per sub-device */
         struct platform_device *pdev;
 
         /* Physical-presence section */
@@ -80,12 +83,11 @@ struct caam_drv_private {
         u8 qi_present;          /* Nonzero if QI present in device */
         int secvio_irq;         /* Security violation interrupt number */
 
-        /* which jr allocated to scatterlist crypto */
-        atomic_t tfm_count ____cacheline_aligned;
-        /* list of registered crypto algorithms (mk generic context handle?) */
-        struct list_head alg_list;
-        /* list of registered hash algorithms (mk generic context handle?) */
-        struct list_head hash_list;
+#define RNG4_MAX_HANDLES 2
+        /* RNG4 block */
+        u32 rng4_sh_init;       /* This bitmap shows which of the State
+                                   Handles of the RNG4 block are initialized
+                                   by this driver */
 
         /*
          * debugfs entries for developer view into driver/device
diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index bdb786d5a5e5..1d80bd3636c5 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/of_irq.h>
+#include <linux/of_address.h>
 
 #include "compat.h"
 #include "regs.h"
@@ -13,6 +14,113 @@
 #include "desc.h"
 #include "intern.h"
 
+struct jr_driver_data {
+        /* List of Physical JobR's with the Driver */
+        struct list_head        jr_list;
+        spinlock_t              jr_alloc_lock;  /* jr_list lock */
+} ____cacheline_aligned;
+
+static struct jr_driver_data driver_data;
+
+static int caam_reset_hw_jr(struct device *dev)
+{
+        struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
+        unsigned int timeout = 100000;
+
+        /*
+         * mask interrupts since we are going to poll
+         * for reset completion status
+         */
+        setbits32(&jrp->rregs->rconfig_lo, JRCFG_IMSK);
+
+        /* initiate flush (required prior to reset) */
+        wr_reg32(&jrp->rregs->jrcommand, JRCR_RESET);
+        while (((rd_reg32(&jrp->rregs->jrintstatus) & JRINT_ERR_HALT_MASK) ==
+                JRINT_ERR_HALT_INPROGRESS) && --timeout)
+                cpu_relax();
+
+        if ((rd_reg32(&jrp->rregs->jrintstatus) & JRINT_ERR_HALT_MASK) !=
+            JRINT_ERR_HALT_COMPLETE || timeout == 0) {
+                dev_err(dev, "failed to flush job ring %d\n", jrp->ridx);
+                return -EIO;
+        }
+
+        /* initiate reset */
+        timeout = 100000;
+        wr_reg32(&jrp->rregs->jrcommand, JRCR_RESET);
+        while ((rd_reg32(&jrp->rregs->jrcommand) & JRCR_RESET) && --timeout)
+                cpu_relax();
+
+        if (timeout == 0) {
+                dev_err(dev, "failed to reset job ring %d\n", jrp->ridx);
+                return -EIO;
+        }
+
+        /* unmask interrupts */
+        clrbits32(&jrp->rregs->rconfig_lo, JRCFG_IMSK);
+
+        return 0;
+}
+
+/*
+ * Shutdown JobR independent of platform property code
+ */
+int caam_jr_shutdown(struct device *dev)
+{
+        struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
+        dma_addr_t inpbusaddr, outbusaddr;
+        int ret;
+
+        ret = caam_reset_hw_jr(dev);
+
+        tasklet_kill(&jrp->irqtask);
+
+        /* Release interrupt */
+        free_irq(jrp->irq, dev);
+
+        /* Free rings */
+        inpbusaddr = rd_reg64(&jrp->rregs->inpring_base);
+        outbusaddr = rd_reg64(&jrp->rregs->outring_base);
+        dma_free_coherent(dev, sizeof(dma_addr_t) * JOBR_DEPTH,
+                          jrp->inpring, inpbusaddr);
+        dma_free_coherent(dev, sizeof(struct jr_outentry) * JOBR_DEPTH,
+                          jrp->outring, outbusaddr);
+        kfree(jrp->entinfo);
+
+        return ret;
+}
+
+static int caam_jr_remove(struct platform_device *pdev)
+{
+        int ret;
+        struct device *jrdev;
+        struct caam_drv_private_jr *jrpriv;
+
+        jrdev = &pdev->dev;
+        jrpriv = dev_get_drvdata(jrdev);
+
+        /*
+         * Return EBUSY if job ring already allocated.
+         */
+        if (atomic_read(&jrpriv->tfm_count)) {
+                dev_err(jrdev, "Device is busy\n");
+                return -EBUSY;
+        }
+
+        /* Remove the node from Physical JobR list maintained by driver */
+        spin_lock(&driver_data.jr_alloc_lock);
+        list_del(&jrpriv->list_node);
+        spin_unlock(&driver_data.jr_alloc_lock);
+
+        /* Release ring */
+        ret = caam_jr_shutdown(jrdev);
+        if (ret)
+                dev_err(jrdev, "Failed to shut down job ring\n");
+        irq_dispose_mapping(jrpriv->irq);
+
+        return ret;
+}
+
 /* Main per-ring interrupt handler */
 static irqreturn_t caam_jr_interrupt(int irq, void *st_dev)
 {
@@ -128,6 +236,59 @@ static void caam_jr_dequeue(unsigned long devarg)
 }
 
 /**
+ * caam_jr_alloc() - Alloc a job ring for someone to use as needed.
+ *
+ * returns :  pointer to the newly allocated physical
+ *            JobR dev can be written to if successful.
+ **/
+struct device *caam_jr_alloc(void)
+{
+        struct caam_drv_private_jr *jrpriv, *min_jrpriv = NULL;
+        struct device *dev = NULL;
+        int min_tfm_cnt = INT_MAX;
+        int tfm_cnt;
+
+        spin_lock(&driver_data.jr_alloc_lock);
+
+        if (list_empty(&driver_data.jr_list)) {
+                spin_unlock(&driver_data.jr_alloc_lock);
+                return ERR_PTR(-ENODEV);
+        }
+
+        list_for_each_entry(jrpriv, &driver_data.jr_list, list_node) {
+                tfm_cnt = atomic_read(&jrpriv->tfm_count);
+                if (tfm_cnt < min_tfm_cnt) {
+                        min_tfm_cnt = tfm_cnt;
+                        min_jrpriv = jrpriv;
+                }
+                if (!min_tfm_cnt)
+                        break;
+        }
+
+        if (min_jrpriv) {
+                atomic_inc(&min_jrpriv->tfm_count);
+                dev = min_jrpriv->dev;
+        }
+        spin_unlock(&driver_data.jr_alloc_lock);
+
+        return dev;
+}
+EXPORT_SYMBOL(caam_jr_alloc);
+
+/**
+ * caam_jr_free() - Free the Job Ring
+ * @rdev     - points to the dev that identifies the Job ring to
+ *             be released.
+ **/
+void caam_jr_free(struct device *rdev)
+{
+        struct caam_drv_private_jr *jrpriv = dev_get_drvdata(rdev);
+
+        atomic_dec(&jrpriv->tfm_count);
+}
+EXPORT_SYMBOL(caam_jr_free);
+
+/**
  * caam_jr_enqueue() - Enqueue a job descriptor head. Returns 0 if OK,
  * -EBUSY if the queue is full, -EIO if it cannot map the caller's
  * descriptor.
@@ -207,46 +368,6 @@ int caam_jr_enqueue(struct device *dev, u32 *desc,
 }
 EXPORT_SYMBOL(caam_jr_enqueue);
 
-static int caam_reset_hw_jr(struct device *dev)
-{
-        struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
-        unsigned int timeout = 100000;
-
-        /*
-         * mask interrupts since we are going to poll
-         * for reset completion status
-         */
-        setbits32(&jrp->rregs->rconfig_lo, JRCFG_IMSK);
-
-        /* initiate flush (required prior to reset) */
-        wr_reg32(&jrp->rregs->jrcommand, JRCR_RESET);
-        while (((rd_reg32(&jrp->rregs->jrintstatus) & JRINT_ERR_HALT_MASK) ==
-                JRINT_ERR_HALT_INPROGRESS) && --timeout)
-                cpu_relax();
-
-        if ((rd_reg32(&jrp->rregs->jrintstatus) & JRINT_ERR_HALT_MASK) !=
-            JRINT_ERR_HALT_COMPLETE || timeout == 0) {
-                dev_err(dev, "failed to flush job ring %d\n", jrp->ridx);
-                return -EIO;
-        }
-
-        /* initiate reset */
-        timeout = 100000;
-        wr_reg32(&jrp->rregs->jrcommand, JRCR_RESET);
-        while ((rd_reg32(&jrp->rregs->jrcommand) & JRCR_RESET) && --timeout)
-                cpu_relax();
-
-        if (timeout == 0) {
-                dev_err(dev, "failed to reset job ring %d\n", jrp->ridx);
-                return -EIO;
-        }
-
-        /* unmask interrupts */
-        clrbits32(&jrp->rregs->rconfig_lo, JRCFG_IMSK);
-
-        return 0;
-}
-
 /*
  * Init JobR independent of platform property detection
  */
@@ -262,7 +383,7 @@ static int caam_jr_init(struct device *dev)
 
         /* Connect job ring interrupt handler. */
         error = request_irq(jrp->irq, caam_jr_interrupt, IRQF_SHARED,
-                            "caam-jobr", dev);
+                            dev_name(dev), dev);
         if (error) {
                 dev_err(dev, "can't connect JobR %d interrupt (%d)\n",
                         jrp->ridx, jrp->irq);
@@ -318,86 +439,43 @@ static int caam_jr_init(struct device *dev)
         return 0;
 }
 
-/*
- * Shutdown JobR independent of platform property code
- */
-int caam_jr_shutdown(struct device *dev)
-{
-        struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
-        dma_addr_t inpbusaddr, outbusaddr;
-        int ret;
-
-        ret = caam_reset_hw_jr(dev);
-
-        tasklet_kill(&jrp->irqtask);
-
-        /* Release interrupt */
-        free_irq(jrp->irq, dev);
-
-        /* Free rings */
-        inpbusaddr = rd_reg64(&jrp->rregs->inpring_base);
-        outbusaddr = rd_reg64(&jrp->rregs->outring_base);
-        dma_free_coherent(dev, sizeof(dma_addr_t) * JOBR_DEPTH,
-                          jrp->inpring, inpbusaddr);
-        dma_free_coherent(dev, sizeof(struct jr_outentry) * JOBR_DEPTH,
-                          jrp->outring, outbusaddr);
-        kfree(jrp->entinfo);
-        of_device_unregister(jrp->jr_pdev);
-
-        return ret;
-}
 
 /*
- * Probe routine for each detected JobR subsystem. It assumes that
- * property detection was picked up externally.
+ * Probe routine for each detected JobR subsystem.
  */
-int caam_jr_probe(struct platform_device *pdev, struct device_node *np,
-                  int ring)
+static int caam_jr_probe(struct platform_device *pdev)
 {
-        struct device *ctrldev, *jrdev;
-        struct platform_device *jr_pdev;
-        struct caam_drv_private *ctrlpriv;
+        struct device *jrdev;
+        struct device_node *nprop;
+        struct caam_job_ring __iomem *ctrl;
         struct caam_drv_private_jr *jrpriv;
-        u32 *jroffset;
+        static int total_jobrs;
         int error;
 
-        ctrldev = &pdev->dev;
-        ctrlpriv = dev_get_drvdata(ctrldev);
-
+        jrdev = &pdev->dev;
         jrpriv = kmalloc(sizeof(struct caam_drv_private_jr),
                          GFP_KERNEL);
-        if (jrpriv == NULL) {
-                dev_err(ctrldev, "can't alloc private mem for job ring %d\n",
-                        ring);
+        if (!jrpriv)
                 return -ENOMEM;
-        }
-        jrpriv->parentdev = ctrldev; /* point back to parent */
-        jrpriv->ridx = ring; /* save ring identity relative to detection */
 
-        /*
-         * Derive a pointer to the detected JobRs regs
-         * Driver has already iomapped the entire space, we just
-         * need to add in the offset to this JobR. Don't know if I
-         * like this long-term, but it'll run
-         */
-        jroffset = (u32 *)of_get_property(np, "reg", NULL);
-        jrpriv->rregs = (struct caam_job_ring __iomem *)((void *)ctrlpriv->ctrl
-                                                         + *jroffset);
+        dev_set_drvdata(jrdev, jrpriv);
 
-        /* Build a local dev for each detected queue */
-        jr_pdev = of_platform_device_create(np, NULL, ctrldev);
-        if (jr_pdev == NULL) {
-                kfree(jrpriv);
-                return -EINVAL;
+        /* save ring identity relative to detection */
+        jrpriv->ridx = total_jobrs++;
+
+        nprop = pdev->dev.of_node;
+        /* Get configuration properties from device tree */
+        /* First, get register page */
+        ctrl = of_iomap(nprop, 0);
+        if (!ctrl) {
+                dev_err(jrdev, "of_iomap() failed\n");
+                return -ENOMEM;
         }
 
-        jrpriv->jr_pdev = jr_pdev;
-        jrdev = &jr_pdev->dev;
-        dev_set_drvdata(jrdev, jrpriv);
-        ctrlpriv->jrdev[ring] = jrdev;
+        jrpriv->rregs = (struct caam_job_ring __force *)ctrl;
 
         if (sizeof(dma_addr_t) == sizeof(u64))
-                if (of_device_is_compatible(np, "fsl,sec-v5.0-job-ring"))
+                if (of_device_is_compatible(nprop, "fsl,sec-v5.0-job-ring"))
                         dma_set_mask(jrdev, DMA_BIT_MASK(40));
                 else
                         dma_set_mask(jrdev, DMA_BIT_MASK(36));
@@ -405,15 +483,61 @@ int caam_jr_probe(struct platform_device *pdev, struct device_node *np,
                 dma_set_mask(jrdev, DMA_BIT_MASK(32));
 
         /* Identify the interrupt */
-        jrpriv->irq = irq_of_parse_and_map(np, 0);
+        jrpriv->irq = irq_of_parse_and_map(nprop, 0);
 
         /* Now do the platform independent part */
         error = caam_jr_init(jrdev); /* now turn on hardware */
         if (error) {
-                of_device_unregister(jr_pdev);
                 kfree(jrpriv);
                 return error;
         }
 
-        return error;
+        jrpriv->dev = jrdev;
+        spin_lock(&driver_data.jr_alloc_lock);
+        list_add_tail(&jrpriv->list_node, &driver_data.jr_list);
+        spin_unlock(&driver_data.jr_alloc_lock);
+
+        atomic_set(&jrpriv->tfm_count, 0);
+
+        return 0;
+}
+
+static struct of_device_id caam_jr_match[] = {
+        {
+                .compatible = "fsl,sec-v4.0-job-ring",
+        },
+        {
+                .compatible = "fsl,sec4.0-job-ring",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, caam_jr_match);
+
+static struct platform_driver caam_jr_driver = {
+        .driver = {
+                .name = "caam_jr",
+                .owner = THIS_MODULE,
+                .of_match_table = caam_jr_match,
+        },
+        .probe       = caam_jr_probe,
+        .remove      = caam_jr_remove,
+};
+
+static int __init jr_driver_init(void)
+{
+        spin_lock_init(&driver_data.jr_alloc_lock);
+        INIT_LIST_HEAD(&driver_data.jr_list);
+        return platform_driver_register(&caam_jr_driver);
+}
+
+static void __exit jr_driver_exit(void)
+{
+        platform_driver_unregister(&caam_jr_driver);
 }
+
+module_init(jr_driver_init);
+module_exit(jr_driver_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("FSL CAAM JR request backend");
+MODULE_AUTHOR("Freescale Semiconductor - NMG/STC");
diff --git a/drivers/crypto/caam/jr.h b/drivers/crypto/caam/jr.h
index 9d8741a59037..97113a6d6c58 100644
--- a/drivers/crypto/caam/jr.h
+++ b/drivers/crypto/caam/jr.h
@@ -8,12 +8,11 @@
 #define JR_H
 
 /* Prototypes for backend-level services exposed to APIs */
+struct device *caam_jr_alloc(void);
+void caam_jr_free(struct device *rdev);
 int caam_jr_enqueue(struct device *dev, u32 *desc,
                     void (*cbk)(struct device *dev, u32 *desc, u32 status,
                                 void *areq),
                     void *areq);
 
-extern int caam_jr_probe(struct platform_device *pdev, struct device_node *np,
-                         int ring);
-extern int caam_jr_shutdown(struct device *dev);
 #endif /* JR_H */
diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h
index 4455396918de..d50174f45b21 100644
--- a/drivers/crypto/caam/regs.h
+++ b/drivers/crypto/caam/regs.h
@@ -245,7 +245,7 @@ struct rngtst {
 
 /* RNG4 TRNG test registers */
 struct rng4tst {
-#define RTMCTL_PRGM 0x00010000  /* 1 -> program mode, 0 -> run mode */
+#define RTMCTL_PRGM     0x00010000      /* 1 -> program mode, 0 -> run mode */
         u32 rtmctl;             /* misc. control register */
         u32 rtscmisc;           /* statistical check misc. register */
         u32 rtpkrrng;           /* poker range register */
@@ -255,6 +255,8 @@ struct rng4tst {
         };
 #define RTSDCTL_ENT_DLY_SHIFT 16
 #define RTSDCTL_ENT_DLY_MASK (0xffff << RTSDCTL_ENT_DLY_SHIFT)
+#define RTSDCTL_ENT_DLY_MIN 1200
+#define RTSDCTL_ENT_DLY_MAX 12800
         u32 rtsdctl;            /* seed control register */
         union {
                 u32 rtsblim;    /* PRGM=1: sparse bit limit register */
@@ -266,7 +268,11 @@ struct rng4tst {
                 u32 rtfrqcnt;   /* PRGM=0: freq. count register */
         };
         u32 rsvd1[40];
+#define RDSTA_SKVT 0x80000000
+#define RDSTA_SKVN 0x40000000
 #define RDSTA_IF0 0x00000001
+#define RDSTA_IF1 0x00000002
+#define RDSTA_IFMASK (RDSTA_IF1 | RDSTA_IF0)
         u32 rdsta;
         u32 rsvd2[15];
 };
@@ -692,6 +698,7 @@ struct caam_deco {
         u32 jr_ctl_hi;  /* CxJRR - JobR Control Register      @800 */
         u32 jr_ctl_lo;
         u64 jr_descaddr;        /* CxDADR - JobR Descriptor Address */
+#define DECO_OP_STATUS_HI_ERR_MASK 0xF00000FF
         u32 op_status_hi;       /* DxOPSTA - DECO Operation Status */
         u32 op_status_lo;
         u32 rsvd24[2];
@@ -706,12 +713,13 @@ struct caam_deco {
         u32 rsvd29[48];
         u32 descbuf[64];        /* DxDESB - Descriptor buffer */
         u32 rscvd30[193];
+#define DESC_DBG_DECO_STAT_HOST_ERR     0x00D00000
+#define DESC_DBG_DECO_STAT_VALID        0x80000000
+#define DESC_DBG_DECO_STAT_MASK         0x00F00000
         u32 desc_dbg;           /* DxDDR - DECO Debug Register */
         u32 rsvd31[126];
 };
 
-/* DECO DBG Register Valid Bit*/
-#define DECO_DBG_VALID          0x80000000
 #define DECO_JQCR_WHL           0x20000000
 #define DECO_JQCR_FOUR          0x10000000
 
diff --git a/drivers/crypto/caam/sg_sw_sec4.h b/drivers/crypto/caam/sg_sw_sec4.h
index e0037c8ee243..b12ff85f4241 100644
--- a/drivers/crypto/caam/sg_sw_sec4.h
+++ b/drivers/crypto/caam/sg_sw_sec4.h
@@ -117,6 +117,21 @@ static int dma_unmap_sg_chained(struct device *dev, struct scatterlist *sg,
         return nents;
 }
 
+/* Map SG page in kernel virtual address space and copy */
+static inline void sg_map_copy(u8 *dest, struct scatterlist *sg,
+                               int len, int offset)
+{
+        u8 *mapped_addr;
+
+        /*
+         * Page here can be user-space pinned using get_user_pages
+         * Same must be kmapped before use and kunmapped subsequently
+         */
+        mapped_addr = kmap_atomic(sg_page(sg));
+        memcpy(dest, mapped_addr + offset, len);
+        kunmap_atomic(mapped_addr);
+}
+
 /* Copy from len bytes of sg to dest, starting from beginning */
 static inline void sg_copy(u8 *dest, struct scatterlist *sg, unsigned int len)
 {
@@ -124,15 +139,15 @@ static inline void sg_copy(u8 *dest, struct scatterlist *sg, unsigned int len)
         int cpy_index = 0, next_cpy_index = current_sg->length;
 
         while (next_cpy_index < len) {
-                memcpy(dest + cpy_index, (u8 *) sg_virt(current_sg),
-                       current_sg->length);
+                sg_map_copy(dest + cpy_index, current_sg, current_sg->length,
+                            current_sg->offset);
                 current_sg = scatterwalk_sg_next(current_sg);
                 cpy_index = next_cpy_index;
                 next_cpy_index += current_sg->length;
         }
         if (cpy_index < len)
-                memcpy(dest + cpy_index, (u8 *) sg_virt(current_sg),
-                       len - cpy_index);
+                sg_map_copy(dest + cpy_index, current_sg, len-cpy_index,
+                            current_sg->offset);
 }
 
 /* Copy sg data, from to_skip to end, to dest */
@@ -140,7 +155,7 @@ static inline void sg_copy_part(u8 *dest, struct scatterlist *sg,
                                       int to_skip, unsigned int end)
 {
         struct scatterlist *current_sg = sg;
-        int sg_index, cpy_index;
+        int sg_index, cpy_index, offset;
 
         sg_index = current_sg->length;
         while (sg_index <= to_skip) {
@@ -148,9 +163,10 @@ static inline void sg_copy_part(u8 *dest, struct scatterlist *sg,
                 sg_index += current_sg->length;
         }
         cpy_index = sg_index - to_skip;
-        memcpy(dest, (u8 *) sg_virt(current_sg) +
-               current_sg->length - cpy_index, cpy_index);
-        current_sg = scatterwalk_sg_next(current_sg);
-        if (end - sg_index)
+        offset = current_sg->offset + current_sg->length - cpy_index;
+        sg_map_copy(dest, current_sg, cpy_index, offset);
+        if (end - sg_index) {
+                current_sg = scatterwalk_sg_next(current_sg);
                 sg_copy(dest + cpy_index, current_sg, end - sg_index);
+        }
 }
diff --git a/drivers/crypto/dcp.c b/drivers/crypto/dcp.c
index a8a7dd4b0d25..247ab8048f5b 100644
--- a/drivers/crypto/dcp.c
+++ b/drivers/crypto/dcp.c
@@ -733,12 +733,9 @@ static int dcp_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, dev);
 
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!r) {
-                dev_err(&pdev->dev, "failed to get IORESOURCE_MEM\n");
-                return -ENXIO;
-        }
-        dev->dcp_regs_base = devm_ioremap(&pdev->dev, r->start,
-                                          resource_size(r));
+        dev->dcp_regs_base = devm_ioremap_resource(&pdev->dev, r);
+        if (IS_ERR(dev->dcp_regs_base))
+                return PTR_ERR(dev->dcp_regs_base);
 
         dcp_set(dev, DCP_CTRL_SFRST, DCP_REG_CTRL);
         udelay(10);
@@ -762,7 +759,8 @@ static int dcp_probe(struct platform_device *pdev)
                 return -EIO;
         }
         dev->dcp_vmi_irq = r->start;
-        ret = request_irq(dev->dcp_vmi_irq, dcp_vmi_irq, 0, "dcp", dev);
+        ret = devm_request_irq(&pdev->dev, dev->dcp_vmi_irq, dcp_vmi_irq, 0,
+                               "dcp", dev);
         if (ret != 0) {
                 dev_err(&pdev->dev, "can't request_irq (0)\n");
                 return -EIO;
@@ -771,15 +769,14 @@ static int dcp_probe(struct platform_device *pdev)
         r = platform_get_resource(pdev, IORESOURCE_IRQ, 1);
         if (!r) {
                 dev_err(&pdev->dev, "can't get IRQ resource (1)\n");
-                ret = -EIO;
-                goto err_free_irq0;
+                return -EIO;
         }
         dev->dcp_irq = r->start;
-        ret = request_irq(dev->dcp_irq, dcp_irq, 0, "dcp", dev);
+        ret = devm_request_irq(&pdev->dev, dev->dcp_irq, dcp_irq, 0, "dcp",
+                               dev);
         if (ret != 0) {
                 dev_err(&pdev->dev, "can't request_irq (1)\n");
-                ret = -EIO;
-                goto err_free_irq0;
+                return -EIO;
         }
 
         dev->hw_pkg[0] = dma_alloc_coherent(&pdev->dev,
@@ -788,8 +785,7 @@ static int dcp_probe(struct platform_device *pdev)
                         GFP_KERNEL);
         if (!dev->hw_pkg[0]) {
                 dev_err(&pdev->dev, "Could not allocate hw descriptors\n");
-                ret = -ENOMEM;
-                goto err_free_irq1;
+                return -ENOMEM;
         }
 
         for (i = 1; i < DCP_MAX_PKG; i++) {
@@ -848,16 +844,14 @@ err_unregister:
         for (j = 0; j < i; j++)
                 crypto_unregister_alg(&algs[j]);
 err_free_key_iv:
+        tasklet_kill(&dev->done_task);
+        tasklet_kill(&dev->queue_task);
         dma_free_coherent(&pdev->dev, 2 * AES_KEYSIZE_128, dev->payload_base,
                         dev->payload_base_dma);
 err_free_hw_packet:
         dma_free_coherent(&pdev->dev, DCP_MAX_PKG *
                 sizeof(struct dcp_hw_packet), dev->hw_pkg[0],
                 dev->hw_phys_pkg);
-err_free_irq1:
-        free_irq(dev->dcp_irq, dev);
-err_free_irq0:
-        free_irq(dev->dcp_vmi_irq, dev);
 
         return ret;
 }
@@ -868,23 +862,20 @@ static int dcp_remove(struct platform_device *pdev)
         int j;
         dev = platform_get_drvdata(pdev);
 
-        dma_free_coherent(&pdev->dev,
-                        DCP_MAX_PKG * sizeof(struct dcp_hw_packet),
-                        dev->hw_pkg[0], dev->hw_phys_pkg);
-
-        dma_free_coherent(&pdev->dev, 2 * AES_KEYSIZE_128, dev->payload_base,
-                        dev->payload_base_dma);
+        misc_deregister(&dev->dcp_bootstream_misc);
 
-        free_irq(dev->dcp_irq, dev);
-        free_irq(dev->dcp_vmi_irq, dev);
+        for (j = 0; j < ARRAY_SIZE(algs); j++)
+                crypto_unregister_alg(&algs[j]);
 
         tasklet_kill(&dev->done_task);
         tasklet_kill(&dev->queue_task);
 
-        for (j = 0; j < ARRAY_SIZE(algs); j++)
-                crypto_unregister_alg(&algs[j]);
+        dma_free_coherent(&pdev->dev, 2 * AES_KEYSIZE_128, dev->payload_base,
+                        dev->payload_base_dma);
 
-        misc_deregister(&dev->dcp_bootstream_misc);
+        dma_free_coherent(&pdev->dev,
+                        DCP_MAX_PKG * sizeof(struct dcp_hw_packet),
+                        dev->hw_pkg[0], dev->hw_phys_pkg);
 
         return 0;
 }
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 214357e12dc0..9dd6e01eac33 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1149,32 +1149,24 @@ static int aead_setkey(struct crypto_aead *tfm, const u8 *key,
                         unsigned int keylen)
 {
         struct ixp_ctx *ctx = crypto_aead_ctx(tfm);
-        struct rtattr *rta = (struct rtattr *)key;
-        struct crypto_authenc_key_param *param;
+        struct crypto_authenc_keys keys;
 
-        if (!RTA_OK(rta, keylen))
-                goto badkey;
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-                goto badkey;
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
+        if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
                 goto badkey;
 
-        param = RTA_DATA(rta);
-        ctx->enckey_len = be32_to_cpu(param->enckeylen);
-
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
+        if (keys.authkeylen > sizeof(ctx->authkey))
+                goto badkey;
 
-        if (keylen < ctx->enckey_len)
+        if (keys.enckeylen > sizeof(ctx->enckey))
                 goto badkey;
 
-        ctx->authkey_len = keylen - ctx->enckey_len;
-        memcpy(ctx->enckey, key + ctx->authkey_len, ctx->enckey_len);
-        memcpy(ctx->authkey, key, ctx->authkey_len);
+        memcpy(ctx->authkey, keys.authkey, keys.authkeylen);
+        memcpy(ctx->enckey, keys.enckey, keys.enckeylen);
+        ctx->authkey_len = keys.authkeylen;
+        ctx->enckey_len = keys.enckeylen;
 
         return aead_setup(tfm, crypto_aead_authsize(tfm));
 badkey:
-        ctx->enckey_len = 0;
         crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
         return -EINVAL;
 }
diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c
index 3374a3ebe4c7..8d1e6f8e9e9c 100644
--- a/drivers/crypto/mv_cesa.c
+++ b/drivers/crypto/mv_cesa.c
@@ -907,7 +907,7 @@ static int mv_cra_hash_hmac_sha1_init(struct crypto_tfm *tfm)
         return mv_cra_hash_init(tfm, "sha1", COP_HMAC_SHA1, SHA1_BLOCK_SIZE);
 }
 
-irqreturn_t crypto_int(int irq, void *priv)
+static irqreturn_t crypto_int(int irq, void *priv)
 {
         u32 val;
 
@@ -928,7 +928,7 @@ irqreturn_t crypto_int(int irq, void *priv)
         return IRQ_HANDLED;
 }
 
-struct crypto_alg mv_aes_alg_ecb = {
+static struct crypto_alg mv_aes_alg_ecb = {
         .cra_name               = "ecb(aes)",
         .cra_driver_name        = "mv-ecb-aes",
         .cra_priority   = 300,
@@ -951,7 +951,7 @@ struct crypto_alg mv_aes_alg_ecb = {
         },
 };
 
-struct crypto_alg mv_aes_alg_cbc = {
+static struct crypto_alg mv_aes_alg_cbc = {
         .cra_name               = "cbc(aes)",
         .cra_driver_name        = "mv-cbc-aes",
         .cra_priority   = 300,
@@ -975,7 +975,7 @@ struct crypto_alg mv_aes_alg_cbc = {
         },
 };
 
-struct ahash_alg mv_sha1_alg = {
+static struct ahash_alg mv_sha1_alg = {
         .init = mv_hash_init,
         .update = mv_hash_update,
         .final = mv_hash_final,
@@ -999,7 +999,7 @@ struct ahash_alg mv_sha1_alg = {
                  }
 };
 
-struct ahash_alg mv_hmac_sha1_alg = {
+static struct ahash_alg mv_hmac_sha1_alg = {
         .init = mv_hash_init,
         .update = mv_hash_update,
         .final = mv_hash_final,
@@ -1084,7 +1084,7 @@ static int mv_probe(struct platform_device *pdev)
                 goto err_unmap_sram;
         }
 
-        ret = request_irq(irq, crypto_int, IRQF_DISABLED, dev_name(&pdev->dev),
+        ret = request_irq(irq, crypto_int, 0, dev_name(&pdev->dev),
                         cp);
         if (ret)
                 goto err_thread;
@@ -1187,7 +1187,7 @@ static struct platform_driver marvell_crypto = {
         .driver         = {
                 .owner  = THIS_MODULE,
                 .name   = "mv_crypto",
-                .of_match_table = of_match_ptr(mv_cesa_of_match_table),
+                .of_match_table = mv_cesa_of_match_table,
         },
 };
 MODULE_ALIAS("platform:mv_crypto");
diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index ce791c2f81f7..a9ccbf14096e 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -275,7 +275,7 @@ static int omap_aes_write_ctrl(struct omap_aes_dev *dd)
         if (dd->flags & FLAGS_CBC)
                 val |= AES_REG_CTRL_CBC;
         if (dd->flags & FLAGS_CTR) {
-                val |= AES_REG_CTRL_CTR | AES_REG_CTRL_CTR_WIDTH_32;
+                val |= AES_REG_CTRL_CTR | AES_REG_CTRL_CTR_WIDTH_128;
                 mask = AES_REG_CTRL_CTR | AES_REG_CTRL_CTR_WIDTH_MASK;
         }
         if (dd->flags & FLAGS_ENCRYPT)
@@ -554,7 +554,7 @@ static int omap_aes_crypt_dma_stop(struct omap_aes_dev *dd)
         return err;
 }
 
-int omap_aes_check_aligned(struct scatterlist *sg)
+static int omap_aes_check_aligned(struct scatterlist *sg)
 {
         while (sg) {
                 if (!IS_ALIGNED(sg->offset, 4))
@@ -566,7 +566,7 @@ int omap_aes_check_aligned(struct scatterlist *sg)
         return 0;
 }
 
-int omap_aes_copy_sgs(struct omap_aes_dev *dd)
+static int omap_aes_copy_sgs(struct omap_aes_dev *dd)
 {
         void *buf_in, *buf_out;
         int pages;
diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index e28104b4aab0..e45aaaf0db30 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -2033,3 +2033,4 @@ module_platform_driver(omap_sham_driver);
 MODULE_DESCRIPTION("OMAP SHA1/MD5 hw acceleration support.");
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Dmitry Kasatkin");
+MODULE_ALIAS("platform:omap-sham");
diff --git a/drivers/crypto/picoxcell_crypto.c b/drivers/crypto/picoxcell_crypto.c
index 888f7f4a6d3f..a6175ba6d238 100644
--- a/drivers/crypto/picoxcell_crypto.c
+++ b/drivers/crypto/picoxcell_crypto.c
@@ -495,45 +495,29 @@ static int spacc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
 {
         struct spacc_aead_ctx *ctx = crypto_aead_ctx(tfm);
         struct spacc_alg *alg = to_spacc_alg(tfm->base.__crt_alg);
-        struct rtattr *rta = (void *)key;
-        struct crypto_authenc_key_param *param;
-        unsigned int authkeylen, enckeylen;
+        struct crypto_authenc_keys keys;
         int err = -EINVAL;
 
-        if (!RTA_OK(rta, keylen))
+        if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
                 goto badkey;
 
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+        if (keys.enckeylen > AES_MAX_KEY_SIZE)
                 goto badkey;
 
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
-                goto badkey;
-
-        param = RTA_DATA(rta);
-        enckeylen = be32_to_cpu(param->enckeylen);
-
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
-
-        if (keylen < enckeylen)
-                goto badkey;
-
-        authkeylen = keylen - enckeylen;
-
-        if (enckeylen > AES_MAX_KEY_SIZE)
+        if (keys.authkeylen > sizeof(ctx->hash_ctx))
                 goto badkey;
 
         if ((alg->ctrl_default & SPACC_CRYPTO_ALG_MASK) ==
             SPA_CTRL_CIPH_ALG_AES)
-                err = spacc_aead_aes_setkey(tfm, key + authkeylen, enckeylen);
+                err = spacc_aead_aes_setkey(tfm, keys.enckey, keys.enckeylen);
         else
-                err = spacc_aead_des_setkey(tfm, key + authkeylen, enckeylen);
+                err = spacc_aead_des_setkey(tfm, keys.enckey, keys.enckeylen);
 
         if (err)
                 goto badkey;
 
-        memcpy(ctx->hash_ctx, key, authkeylen);
-        ctx->hash_key_len = authkeylen;
+        memcpy(ctx->hash_ctx, keys.authkey, keys.authkeylen);
+        ctx->hash_key_len = keys.authkeylen;
 
         return 0;
 
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index d7bb8bac36e9..785a9ded7bdf 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -1058,7 +1058,7 @@ static struct platform_driver sahara_driver = {
         .driver         = {
                 .name   = SAHARA_NAME,
                 .owner  = THIS_MODULE,
-                .of_match_table = of_match_ptr(sahara_dt_ids),
+                .of_match_table = sahara_dt_ids,
         },
         .id_table = sahara_platform_ids,
 };
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 6cd0e6038583..b44f4ddc565c 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -673,39 +673,20 @@ static int aead_setkey(struct crypto_aead *authenc,
                        const u8 *key, unsigned int keylen)
 {
         struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
-        struct rtattr *rta = (void *)key;
-        struct crypto_authenc_key_param *param;
-        unsigned int authkeylen;
-        unsigned int enckeylen;
-
-        if (!RTA_OK(rta, keylen))
-                goto badkey;
+        struct crypto_authenc_keys keys;
 
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+        if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
                 goto badkey;
 
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
+        if (keys.authkeylen + keys.enckeylen > TALITOS_MAX_KEY_SIZE)
                 goto badkey;
 
-        param = RTA_DATA(rta);
-        enckeylen = be32_to_cpu(param->enckeylen);
-
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
+        memcpy(ctx->key, keys.authkey, keys.authkeylen);
+        memcpy(&ctx->key[keys.authkeylen], keys.enckey, keys.enckeylen);
 
-        if (keylen < enckeylen)
-                goto badkey;
-
-        authkeylen = keylen - enckeylen;
-
-        if (keylen > TALITOS_MAX_KEY_SIZE)
-                goto badkey;
-
-        memcpy(&ctx->key, key, keylen);
-
-        ctx->keylen = keylen;
-        ctx->enckeylen = enckeylen;
-        ctx->authkeylen = authkeylen;
+        ctx->keylen = keys.authkeylen + keys.enckeylen;
+        ctx->enckeylen = keys.enckeylen;
+        ctx->authkeylen = keys.authkeylen;
 
         return 0;
 
@@ -809,7 +790,7 @@ static void ipsec_esp_unmap(struct device *dev,
 
         if (edesc->assoc_chained)
                 talitos_unmap_sg_chain(dev, areq->assoc, DMA_TO_DEVICE);
-        else
+        else if (areq->assoclen)
                 /* assoc_nents counts also for IV in non-contiguous cases */
                 dma_unmap_sg(dev, areq->assoc,
                              edesc->assoc_nents ? edesc->assoc_nents - 1 : 1,
@@ -992,7 +973,11 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
                 dma_sync_single_for_device(dev, edesc->dma_link_tbl,
                                            edesc->dma_len, DMA_BIDIRECTIONAL);
         } else {
-                to_talitos_ptr(&desc->ptr[1], sg_dma_address(areq->assoc));
+                if (areq->assoclen)
+                        to_talitos_ptr(&desc->ptr[1],
+                                       sg_dma_address(areq->assoc));
+                else
+                        to_talitos_ptr(&desc->ptr[1], edesc->iv_dma);
                 desc->ptr[1].j_extent = 0;
         }
 
@@ -1127,7 +1112,8 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                                                  unsigned int authsize,
                                                  unsigned int ivsize,
                                                  int icv_stashing,
-                                                 u32 cryptoflags)
+                                                 u32 cryptoflags,
+                                                 bool encrypt)
 {
         struct talitos_edesc *edesc;
         int assoc_nents = 0, src_nents, dst_nents, alloc_len, dma_len;
@@ -1141,10 +1127,10 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                 return ERR_PTR(-EINVAL);
         }
 
-        if (iv)
+        if (ivsize)
                 iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
 
-        if (assoc) {
+        if (assoclen) {
                 /*
                  * Currently it is assumed that iv is provided whenever assoc
                  * is.
@@ -1160,19 +1146,17 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                         assoc_nents = assoc_nents ? assoc_nents + 1 : 2;
         }
 
-        src_nents = sg_count(src, cryptlen + authsize, &src_chained);
-        src_nents = (src_nents == 1) ? 0 : src_nents;
-
-        if (!dst) {
-                dst_nents = 0;
-        } else {
-                if (dst == src) {
-                        dst_nents = src_nents;
-                } else {
-                        dst_nents = sg_count(dst, cryptlen + authsize,
-                                             &dst_chained);
-                        dst_nents = (dst_nents == 1) ? 0 : dst_nents;
-                }
+        if (!dst || dst == src) {
+                src_nents = sg_count(src, cryptlen + authsize, &src_chained);
+                src_nents = (src_nents == 1) ? 0 : src_nents;
+                dst_nents = dst ? src_nents : 0;
+        } else { /* dst && dst != src*/
+                src_nents = sg_count(src, cryptlen + (encrypt ? 0 : authsize),
+                                     &src_chained);
+                src_nents = (src_nents == 1) ? 0 : src_nents;
+                dst_nents = sg_count(dst, cryptlen + (encrypt ? authsize : 0),
+                                     &dst_chained);
+                dst_nents = (dst_nents == 1) ? 0 : dst_nents;
         }
 
         /*
@@ -1192,9 +1176,16 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 
         edesc = kmalloc(alloc_len, GFP_DMA | flags);
         if (!edesc) {
-                talitos_unmap_sg_chain(dev, assoc, DMA_TO_DEVICE);
+                if (assoc_chained)
+                        talitos_unmap_sg_chain(dev, assoc, DMA_TO_DEVICE);
+                else if (assoclen)
+                        dma_unmap_sg(dev, assoc,
+                                     assoc_nents ? assoc_nents - 1 : 1,
+                                     DMA_TO_DEVICE);
+
                 if (iv_dma)
                         dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE);
+
                 dev_err(dev, "could not allocate edescriptor\n");
                 return ERR_PTR(-ENOMEM);
         }
@@ -1216,7 +1207,7 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 }
 
 static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
-                                              int icv_stashing)
+                                              int icv_stashing, bool encrypt)
 {
         struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
         struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
@@ -1225,7 +1216,7 @@ static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
         return talitos_edesc_alloc(ctx->dev, areq->assoc, areq->src, areq->dst,
                                    iv, areq->assoclen, areq->cryptlen,
                                    ctx->authsize, ivsize, icv_stashing,
-                                   areq->base.flags);
+                                   areq->base.flags, encrypt);
 }
 
 static int aead_encrypt(struct aead_request *req)
@@ -1235,7 +1226,7 @@ static int aead_encrypt(struct aead_request *req)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(req, req->iv, 0);
+        edesc = aead_edesc_alloc(req, req->iv, 0, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1258,7 +1249,7 @@ static int aead_decrypt(struct aead_request *req)
         req->cryptlen -= authsize;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(req, req->iv, 1);
+        edesc = aead_edesc_alloc(req, req->iv, 1, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1304,7 +1295,7 @@ static int aead_givencrypt(struct aead_givcrypt_request *req)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(areq, req->giv, 0);
+        edesc = aead_edesc_alloc(areq, req->giv, 0, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1460,7 +1451,7 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
 }
 
 static struct talitos_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request *
-                                                    areq)
+                                                    areq, bool encrypt)
 {
         struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
         struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
@@ -1468,7 +1459,7 @@ static struct talitos_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request *
 
         return talitos_edesc_alloc(ctx->dev, NULL, areq->src, areq->dst,
                                    areq->info, 0, areq->nbytes, 0, ivsize, 0,
-                                   areq->base.flags);
+                                   areq->base.flags, encrypt);
 }
 
 static int ablkcipher_encrypt(struct ablkcipher_request *areq)
@@ -1478,7 +1469,7 @@ static int ablkcipher_encrypt(struct ablkcipher_request *areq)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = ablkcipher_edesc_alloc(areq);
+        edesc = ablkcipher_edesc_alloc(areq, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1495,7 +1486,7 @@ static int ablkcipher_decrypt(struct ablkcipher_request *areq)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = ablkcipher_edesc_alloc(areq);
+        edesc = ablkcipher_edesc_alloc(areq, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1647,7 +1638,7 @@ static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq,
         struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
 
         return talitos_edesc_alloc(ctx->dev, NULL, req_ctx->psrc, NULL, NULL, 0,
-                                   nbytes, 0, 0, 0, areq->base.flags);
+                                   nbytes, 0, 0, 0, areq->base.flags, false);
 }
 
 static int ahash_init(struct ahash_request *areq)
diff --git a/drivers/crypto/tegra-aes.c b/drivers/crypto/tegra-aes.c
index fa05e3c329bd..060eecc5dbc3 100644
--- a/drivers/crypto/tegra-aes.c
+++ b/drivers/crypto/tegra-aes.c
@@ -27,6 +27,8 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/errno.h>
@@ -199,8 +201,6 @@ static void aes_workqueue_handler(struct work_struct *work);
 static DECLARE_WORK(aes_work, aes_workqueue_handler);
 static struct workqueue_struct *aes_wq;
 
-extern unsigned long long tegra_chip_uid(void);
-
 static inline u32 aes_readl(struct tegra_aes_dev *dd, u32 offset)
 {
         return readl(dd->io_base + offset);
@@ -713,13 +713,12 @@ static int tegra_aes_rng_reset(struct crypto_rng *tfm, u8 *seed,
         struct tegra_aes_dev *dd = aes_dev;
         struct tegra_aes_ctx *ctx = &rng_ctx;
         struct tegra_aes_slot *key_slot;
-        struct timespec ts;
         int ret = 0;
-        u64 nsec, tmp[2];
+        u8 tmp[16]; /* 16 bytes = 128 bits of entropy */
         u8 *dt;
 
         if (!ctx || !dd) {
-                dev_err(dd->dev, "ctx=0x%x, dd=0x%x\n",
+                pr_err("ctx=0x%x, dd=0x%x\n",
                         (unsigned int)ctx, (unsigned int)dd);
                 return -EINVAL;
         }
@@ -778,14 +777,8 @@ static int tegra_aes_rng_reset(struct crypto_rng *tfm, u8 *seed,
         if (dd->ivlen >= (2 * DEFAULT_RNG_BLK_SZ + AES_KEYSIZE_128)) {
                 dt = dd->iv + DEFAULT_RNG_BLK_SZ + AES_KEYSIZE_128;
         } else {
-                getnstimeofday(&ts);
-                nsec = timespec_to_ns(&ts);
-                do_div(nsec, 1000);
-                nsec ^= dd->ctr << 56;
-                dd->ctr++;
-                tmp[0] = nsec;
-                tmp[1] = tegra_chip_uid();
-                dt = (u8 *)tmp;
+                get_random_bytes(tmp, sizeof(tmp));
+                dt = tmp;
         }
         memcpy(dd->dt, dt, DEFAULT_RNG_BLK_SZ);
 
@@ -804,7 +797,7 @@ static int tegra_aes_cra_init(struct crypto_tfm *tfm)
         return 0;
 }
 
-void tegra_aes_cra_exit(struct crypto_tfm *tfm)
+static void tegra_aes_cra_exit(struct crypto_tfm *tfm)
 {
         struct tegra_aes_ctx *ctx =
                 crypto_ablkcipher_ctx((struct crypto_ablkcipher *)tfm);
@@ -924,7 +917,7 @@ static int tegra_aes_probe(struct platform_device *pdev)
         }
 
         /* Initialize the vde clock */
-        dd->aes_clk = clk_get(dev, "vde");
+        dd->aes_clk = devm_clk_get(dev, "vde");
         if (IS_ERR(dd->aes_clk)) {
                 dev_err(dev, "iclock intialization failed.\n");
                 err = -ENODEV;
@@ -1033,8 +1026,6 @@ out:
         if (dd->buf_out)
                 dma_free_coherent(dev, AES_HW_DMA_BUFFER_SIZE_BYTES,
                         dd->buf_out, dd->dma_buf_out);
-        if (!IS_ERR(dd->aes_clk))
-                clk_put(dd->aes_clk);
         if (aes_wq)
                 destroy_workqueue(aes_wq);
         spin_lock(&list_lock);
@@ -1068,7 +1059,6 @@ static int tegra_aes_remove(struct platform_device *pdev)
                           dd->buf_in, dd->dma_buf_in);
         dma_free_coherent(dev, AES_HW_DMA_BUFFER_SIZE_BYTES,
                           dd->buf_out, dd->dma_buf_out);
-        clk_put(dd->aes_clk);
         aes_dev = NULL;
 
         return 0;
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index 16a2aa28f856..ec4ee5c1fe9d 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -1169,7 +1169,7 @@ static void pl08x_desc_free(struct virt_dma_desc *vd)
         struct pl08x_txd *txd = to_pl08x_txd(&vd->tx);
         struct pl08x_dma_chan *plchan = to_pl08x_chan(vd->tx.chan);
 
-        dma_descriptor_unmap(txd);
+        dma_descriptor_unmap(&vd->tx);
         if (!txd->done)
                 pl08x_release_mux(plchan);
 
diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index dcb1e05149a7..8869500ab92b 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -1017,6 +1017,7 @@ static int mmp_pdma_probe(struct platform_device *op)
                 }
         }
 
+        platform_set_drvdata(op, pdev);
         dev_info(pdev->device.dev, "initialized %d channels\n", dma_channels);
         return 0;
 }
diff --git a/drivers/dma/s3c24xx-dma.c b/drivers/dma/s3c24xx-dma.c
index 4cb127978636..4eddedb6eb7d 100644
--- a/drivers/dma/s3c24xx-dma.c
+++ b/drivers/dma/s3c24xx-dma.c
@@ -628,42 +628,13 @@ retry:
         s3cchan->state = S3C24XX_DMA_CHAN_IDLE;
 }
 
-static void s3c24xx_dma_unmap_buffers(struct s3c24xx_txd *txd)
-{
-        struct device *dev = txd->vd.tx.chan->device->dev;
-        struct s3c24xx_sg *dsg;
-
-        if (!(txd->vd.tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                if (txd->vd.tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_single(dev, dsg->src_addr, dsg->len,
-                                                DMA_TO_DEVICE);
-                else {
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_page(dev, dsg->src_addr, dsg->len,
-                                                DMA_TO_DEVICE);
-                }
-        }
-
-        if (!(txd->vd.tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                if (txd->vd.tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_single(dev, dsg->dst_addr, dsg->len,
-                                                DMA_FROM_DEVICE);
-                else
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_page(dev, dsg->dst_addr, dsg->len,
-                                                DMA_FROM_DEVICE);
-        }
-}
-
 static void s3c24xx_dma_desc_free(struct virt_dma_desc *vd)
 {
         struct s3c24xx_txd *txd = to_s3c24xx_txd(&vd->tx);
         struct s3c24xx_dma_chan *s3cchan = to_s3c24xx_dma_chan(vd->tx.chan);
 
         if (!s3cchan->slave)
-                s3c24xx_dma_unmap_buffers(txd);
+                dma_descriptor_unmap(&vd->tx);
 
         s3c24xx_dma_free_txd(txd);
 }
@@ -795,7 +766,7 @@ static enum dma_status s3c24xx_dma_tx_status(struct dma_chan *chan,
 
         spin_lock_irqsave(&s3cchan->vc.lock, flags);
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS) {
+        if (ret == DMA_COMPLETE) {
                 spin_unlock_irqrestore(&s3cchan->vc.lock, flags);
                 return ret;
         }
diff --git a/drivers/dma/sh/rcar-hpbdma.c b/drivers/dma/sh/rcar-hpbdma.c
index ebad84591a6e..3083d901a414 100644
--- a/drivers/dma/sh/rcar-hpbdma.c
+++ b/drivers/dma/sh/rcar-hpbdma.c
@@ -60,6 +60,7 @@
 #define HPB_DMAE_DSTPR_DMSTP    BIT(0)
 
 /* DMA status register (DSTSR) bits */
+#define HPB_DMAE_DSTSR_DQSTS    BIT(2)
 #define HPB_DMAE_DSTSR_DMSTS    BIT(0)
 
 /* DMA common registers */
@@ -286,6 +287,9 @@ static void hpb_dmae_halt(struct shdma_chan *schan)
 
         ch_reg_write(chan, HPB_DMAE_DCMDR_DQEND, HPB_DMAE_DCMDR);
         ch_reg_write(chan, HPB_DMAE_DSTPR_DMSTP, HPB_DMAE_DSTPR);
+
+        chan->plane_idx = 0;
+        chan->first_desc = true;
 }
 
 static const struct hpb_dmae_slave_config *
@@ -385,7 +389,10 @@ static bool hpb_dmae_channel_busy(struct shdma_chan *schan)
         struct hpb_dmae_chan *chan = to_chan(schan);
         u32 dstsr = ch_reg_read(chan, HPB_DMAE_DSTSR);
 
-        return (dstsr & HPB_DMAE_DSTSR_DMSTS) == HPB_DMAE_DSTSR_DMSTS;
+        if (chan->xfer_mode == XFER_DOUBLE)
+                return dstsr & HPB_DMAE_DSTSR_DQSTS;
+        else
+                return dstsr & HPB_DMAE_DSTSR_DMSTS;
 }
 
 static int
@@ -510,6 +517,8 @@ static int hpb_dmae_chan_probe(struct hpb_dmae_device *hpbdev, int id)
         }
 
         schan = &new_hpb_chan->shdma_chan;
+        schan->max_xfer_len = HPB_DMA_TCR_MAX;
+
         shdma_chan_probe(sdev, schan, id);
 
         if (pdev->id >= 0)
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 8472405c5586..d7f1b57bd3be 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -945,7 +945,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
         u32                     tad_offset;
         u32                     rir_way;
         u32                     mb, kb;
-        u64                     ch_addr, offset, limit, prv = 0;
+        u64                     ch_addr, offset, limit = 0, prv = 0;
 
 
         /*
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index 3c55ec856e39..a287cece0593 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -1082,7 +1082,7 @@ static void arizona_micd_set_level(struct arizona *arizona, int index,
 static int arizona_extcon_probe(struct platform_device *pdev)
 {
         struct arizona *arizona = dev_get_drvdata(pdev->dev.parent);
-        struct arizona_pdata *pdata;
+        struct arizona_pdata *pdata = &arizona->pdata;
         struct arizona_extcon_info *info;
         unsigned int val;
         int jack_irq_fall, jack_irq_rise;
@@ -1091,8 +1091,6 @@ static int arizona_extcon_probe(struct platform_device *pdev)
         if (!arizona->dapm || !arizona->dapm->card)
                 return -EPROBE_DEFER;
 
-        pdata = dev_get_platdata(arizona->dev);
-
         info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
         if (!info) {
                 dev_err(&pdev->dev, "Failed to allocate memory\n");
diff --git a/drivers/extcon/extcon-class.c b/drivers/extcon/extcon-class.c
index 15443d3b6be1..76322330cbd7 100644
--- a/drivers/extcon/extcon-class.c
+++ b/drivers/extcon/extcon-class.c
@@ -792,6 +792,8 @@ void extcon_dev_unregister(struct extcon_dev *edev)
                 return;
         }
 
+        device_unregister(&edev->dev);
+
         if (edev->mutually_exclusive && edev->max_supported) {
                 for (index = 0; edev->mutually_exclusive[index];
                                 index++)
@@ -812,7 +814,6 @@ void extcon_dev_unregister(struct extcon_dev *edev)
         if (switch_class)
                 class_compat_remove_link(switch_class, &edev->dev, NULL);
 #endif
-        device_unregister(&edev->dev);
         put_device(&edev->dev);
 }
 EXPORT_SYMBOL_GPL(extcon_dev_unregister);
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 281029daf98c..b0bb056458a3 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1623,6 +1623,7 @@ static struct scsi_host_template scsi_driver_template = {
         .cmd_per_lun            = 1,
         .can_queue              = 1,
         .sdev_attrs             = sbp2_scsi_sysfs_attrs,
+        .no_write_same          = 1,
 };
 
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 5002d50e3781..743fd426f21b 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -18,14 +18,12 @@ module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
 
 static int efi_pstore_open(struct pstore_info *psi)
 {
-        efivar_entry_iter_begin();
         psi->data = NULL;
         return 0;
 }
 
 static int efi_pstore_close(struct pstore_info *psi)
 {
-        efivar_entry_iter_end();
         psi->data = NULL;
         return 0;
 }
@@ -39,6 +37,12 @@ struct pstore_read_data {
         char **buf;
 };
 
+static inline u64 generic_id(unsigned long timestamp,
+                             unsigned int part, int count)
+{
+        return (timestamp * 100 + part) * 1000 + count;
+}
+
 static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
 {
         efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
@@ -57,7 +61,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
 
         if (sscanf(name, "dump-type%u-%u-%d-%lu-%c",
                    cb_data->type, &part, &cnt, &time, &data_type) == 5) {
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, cnt);
                 *cb_data->count = cnt;
                 cb_data->timespec->tv_sec = time;
                 cb_data->timespec->tv_nsec = 0;
@@ -67,7 +71,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
                         *cb_data->compressed = false;
         } else if (sscanf(name, "dump-type%u-%u-%d-%lu",
                    cb_data->type, &part, &cnt, &time) == 4) {
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, cnt);
                 *cb_data->count = cnt;
                 cb_data->timespec->tv_sec = time;
                 cb_data->timespec->tv_nsec = 0;
@@ -79,7 +83,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
                  * which doesn't support holding
                  * multiple logs, remains.
                  */
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, 0);
                 *cb_data->count = 0;
                 cb_data->timespec->tv_sec = time;
                 cb_data->timespec->tv_nsec = 0;
@@ -91,19 +95,125 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
         __efivar_entry_get(entry, &entry->var.Attributes,
                            &entry->var.DataSize, entry->var.Data);
         size = entry->var.DataSize;
+        memcpy(*cb_data->buf, entry->var.Data,
+               (size_t)min_t(unsigned long, EFIVARS_DATA_SIZE_MAX, size));
 
-        *cb_data->buf = kmemdup(entry->var.Data, size, GFP_KERNEL);
-        if (*cb_data->buf == NULL)
-                return -ENOMEM;
         return size;
 }
 
+/**
+ * efi_pstore_scan_sysfs_enter
+ * @entry: scanning entry
+ * @next: next entry
+ * @head: list head
+ */
+static void efi_pstore_scan_sysfs_enter(struct efivar_entry *pos,
+                                        struct efivar_entry *next,
+                                        struct list_head *head)
+{
+        pos->scanning = true;
+        if (&next->list != head)
+                next->scanning = true;
+}
+
+/**
+ * __efi_pstore_scan_sysfs_exit
+ * @entry: deleting entry
+ * @turn_off_scanning: Check if a scanning flag should be turned off
+ */
+static inline void __efi_pstore_scan_sysfs_exit(struct efivar_entry *entry,
+                                                bool turn_off_scanning)
+{
+        if (entry->deleting) {
+                list_del(&entry->list);
+                efivar_entry_iter_end();
+                efivar_unregister(entry);
+                efivar_entry_iter_begin();
+        } else if (turn_off_scanning)
+                entry->scanning = false;
+}
+
+/**
+ * efi_pstore_scan_sysfs_exit
+ * @pos: scanning entry
+ * @next: next entry
+ * @head: list head
+ * @stop: a flag checking if scanning will stop
+ */
+static void efi_pstore_scan_sysfs_exit(struct efivar_entry *pos,
+                                       struct efivar_entry *next,
+                                       struct list_head *head, bool stop)
+{
+        __efi_pstore_scan_sysfs_exit(pos, true);
+        if (stop)
+                __efi_pstore_scan_sysfs_exit(next, &next->list != head);
+}
+
+/**
+ * efi_pstore_sysfs_entry_iter
+ *
+ * @data: function-specific data to pass to callback
+ * @pos: entry to begin iterating from
+ *
+ * You MUST call efivar_enter_iter_begin() before this function, and
+ * efivar_entry_iter_end() afterwards.
+ *
+ * It is possible to begin iteration from an arbitrary entry within
+ * the list by passing @pos. @pos is updated on return to point to
+ * the next entry of the last one passed to efi_pstore_read_func().
+ * To begin iterating from the beginning of the list @pos must be %NULL.
+ */
+static int efi_pstore_sysfs_entry_iter(void *data, struct efivar_entry **pos)
+{
+        struct efivar_entry *entry, *n;
+        struct list_head *head = &efivar_sysfs_list;
+        int size = 0;
+
+        if (!*pos) {
+                list_for_each_entry_safe(entry, n, head, list) {
+                        efi_pstore_scan_sysfs_enter(entry, n, head);
+
+                        size = efi_pstore_read_func(entry, data);
+                        efi_pstore_scan_sysfs_exit(entry, n, head, size < 0);
+                        if (size)
+                                break;
+                }
+                *pos = n;
+                return size;
+        }
+
+        list_for_each_entry_safe_from((*pos), n, head, list) {
+                efi_pstore_scan_sysfs_enter((*pos), n, head);
+
+                size = efi_pstore_read_func((*pos), data);
+                efi_pstore_scan_sysfs_exit((*pos), n, head, size < 0);
+                if (size)
+                        break;
+        }
+        *pos = n;
+        return size;
+}
+
+/**
+ * efi_pstore_read
+ *
+ * This function returns a size of NVRAM entry logged via efi_pstore_write().
+ * The meaning and behavior of efi_pstore/pstore are as below.
+ *
+ * size > 0: Got data of an entry logged via efi_pstore_write() successfully,
+ *           and pstore filesystem will continue reading subsequent entries.
+ * size == 0: Entry was not logged via efi_pstore_write(),
+ *            and efi_pstore driver will continue reading subsequent entries.
+ * size < 0: Failed to get data of entry logging via efi_pstore_write(),
+ *           and pstore will stop reading entry.
+ */
 static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
                                int *count, struct timespec *timespec,
                                char **buf, bool *compressed,
                                struct pstore_info *psi)
 {
         struct pstore_read_data data;
+        ssize_t size;
 
         data.id = id;
         data.type = type;
@@ -112,8 +222,17 @@ static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
         data.compressed = compressed;
         data.buf = buf;
 
-        return __efivar_entry_iter(efi_pstore_read_func, &efivar_sysfs_list, &data,
-                                   (struct efivar_entry **)&psi->data);
+        *data.buf = kzalloc(EFIVARS_DATA_SIZE_MAX, GFP_KERNEL);
+        if (!*data.buf)
+                return -ENOMEM;
+
+        efivar_entry_iter_begin();
+        size = efi_pstore_sysfs_entry_iter(&data,
+                                           (struct efivar_entry **)&psi->data);
+        efivar_entry_iter_end();
+        if (size <= 0)
+                kfree(*data.buf);
+        return size;
 }
 
 static int efi_pstore_write(enum pstore_type_id type,
@@ -184,9 +303,17 @@ static int efi_pstore_erase_func(struct efivar_entry *entry, void *data)
                         return 0;
         }
 
+        if (entry->scanning) {
+                /*
+                 * Skip deletion because this entry will be deleted
+                 * after scanning is completed.
+                 */
+                entry->deleting = true;
+        } else
+                list_del(&entry->list);
+
         /* found */
         __efivar_entry_delete(entry);
-        list_del(&entry->list);
 
         return 1;
 }
@@ -199,14 +326,16 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
         char name[DUMP_NAME_LEN];
         efi_char16_t efi_name[DUMP_NAME_LEN];
         int found, i;
+        unsigned int part;
 
-        sprintf(name, "dump-type%u-%u-%d-%lu", type, (unsigned int)id, count,
-                time.tv_sec);
+        do_div(id, 1000);
+        part = do_div(id, 100);
+        sprintf(name, "dump-type%u-%u-%d-%lu", type, part, count, time.tv_sec);
 
         for (i = 0; i < DUMP_NAME_LEN; i++)
                 efi_name[i] = name[i];
 
-        edata.id = id;
+        edata.id = part;
         edata.type = type;
         edata.count = count;
         edata.time = time;
@@ -214,10 +343,12 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
 
         efivar_entry_iter_begin();
         found = __efivar_entry_iter(efi_pstore_erase_func, &efivar_sysfs_list, &edata, &entry);
-        efivar_entry_iter_end();
 
-        if (found)
+        if (found && !entry->scanning) {
+                efivar_entry_iter_end();
                 efivar_unregister(entry);
+        } else
+                efivar_entry_iter_end();
 
         return 0;
 }
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 933eb027d527..3dc248239197 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -383,12 +383,16 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
         else if (__efivar_entry_delete(entry))
                 err = -EIO;
 
-        efivar_entry_iter_end();
-
-        if (err)
+        if (err) {
+                efivar_entry_iter_end();
                 return err;
+        }
 
-        efivar_unregister(entry);
+        if (!entry->scanning) {
+                efivar_entry_iter_end();
+                efivar_unregister(entry);
+        } else
+                efivar_entry_iter_end();
 
         /* It's dead Jim.... */
         return count;
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 391c67b182d9..b22659cccca4 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -683,8 +683,16 @@ struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid,
         if (!found)
                 return NULL;
 
-        if (remove)
-                list_del(&entry->list);
+        if (remove) {
+                if (entry->scanning) {
+                        /*
+                         * The entry will be deleted
+                         * after scanning is completed.
+                         */
+                        entry->deleting = true;
+                } else
+                        list_del(&entry->list);
+        }
 
         return entry;
 }
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index 72c927dc3be1..54c18c220a60 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -158,7 +158,7 @@ static int bcm_kona_gpio_get(struct gpio_chip *chip, unsigned gpio)
         spin_unlock_irqrestore(&kona_gpio->lock, flags);
 
         /* return the specified bit status */
-        return !!(val & bit);
+        return !!(val & BIT(bit));
 }
 
 static int bcm_kona_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index 8847adf392b7..84be70157ad6 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -327,7 +327,7 @@ static int gpio_to_irq_unbanked(struct gpio_chip *chip, unsigned offset)
          * NOTE:  we assume for now that only irqs in the first gpio_chip
          * can provide direct-mapped IRQs to AINTC (up to 32 GPIOs).
          */
-        if (offset < d->irq_base)
+        if (offset < d->gpio_unbanked)
                 return d->gpio_irq + offset;
         else
                 return -ENODEV;
@@ -419,6 +419,8 @@ static int davinci_gpio_irq_setup(struct platform_device *pdev)
 
                 /* pass "bank 0" GPIO IRQs to AINTC */
                 chips[0].chip.to_irq = gpio_to_irq_unbanked;
+                chips[0].gpio_irq = bank_irq;
+                chips[0].gpio_unbanked = pdata->gpio_unbanked;
                 binten = BIT(0);
 
                 /* AINTC handles mask/unmask; GPIO handles triggering */
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 914e859e3eda..d7d6d72eba33 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -70,10 +70,14 @@ static int mpc8572_gpio_get(struct gpio_chip *gc, unsigned int gpio)
         u32 val;
         struct of_mm_gpio_chip *mm = to_of_mm_gpio_chip(gc);
         struct mpc8xxx_gpio_chip *mpc8xxx_gc = to_mpc8xxx_gpio_chip(mm);
+        u32 out_mask, out_shadow;
 
-        val = in_be32(mm->regs + GPIO_DAT) & ~in_be32(mm->regs + GPIO_DIR);
+        out_mask = in_be32(mm->regs + GPIO_DIR);
 
-        return (val | mpc8xxx_gc->data) & mpc8xxx_gpio2mask(gpio);
+        val = in_be32(mm->regs + GPIO_DAT) & ~out_mask;
+        out_shadow = mpc8xxx_gc->data & out_mask;
+
+        return (val | out_shadow) & mpc8xxx_gpio2mask(gpio);
 }
 
 static int mpc8xxx_gpio_get(struct gpio_chip *gc, unsigned int gpio)
diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
index f7a0cc4da950..7b37300973db 100644
--- a/drivers/gpio/gpio-msm-v2.c
+++ b/drivers/gpio/gpio-msm-v2.c
@@ -102,7 +102,7 @@ struct msm_gpio_dev {
         DECLARE_BITMAP(wake_irqs, MAX_NR_GPIO);
         DECLARE_BITMAP(dual_edge_irqs, MAX_NR_GPIO);
         struct irq_domain *domain;
-        unsigned int summary_irq;
+        int summary_irq;
         void __iomem *msm_tlmm_base;
 };
 
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 3c3321f94053..db3129043e63 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -79,7 +79,7 @@ struct mvebu_gpio_chip {
         spinlock_t         lock;
         void __iomem      *membase;
         void __iomem      *percpu_membase;
-        unsigned int       irqbase;
+        int                irqbase;
         struct irq_domain *domain;
         int                soc_variant;
 };
diff --git a/drivers/gpio/gpio-pl061.c b/drivers/gpio/gpio-pl061.c
index f22f7f3e2e53..b4d42112d02d 100644
--- a/drivers/gpio/gpio-pl061.c
+++ b/drivers/gpio/gpio-pl061.c
@@ -286,11 +286,6 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
         if (!chip->base)
                 return -ENOMEM;
 
-        chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
-                                             irq_base, &pl061_domain_ops, chip);
-        if (!chip->domain)
-                return -ENODEV;
-
         spin_lock_init(&chip->lock);
 
         chip->gc.request = pl061_gpio_request;
@@ -320,6 +315,11 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
         irq_set_chained_handler(irq, pl061_irq_handler);
         irq_set_handler_data(irq, chip);
 
+        chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
+                                             irq_base, &pl061_domain_ops, chip);
+        if (!chip->domain)
+                return -ENODEV;
+
         for (i = 0; i < PL061_GPIO_NR; i++) {
                 if (pdata) {
                         if (pdata->directions & (1 << i))
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index d3f15ae93bd3..fe088a30567a 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -381,7 +381,7 @@ static int gpio_rcar_probe(struct platform_device *pdev)
         if (!p->irq_domain) {
                 ret = -ENXIO;
                 dev_err(&pdev->dev, "cannot initialize irq domain\n");
-                goto err1;
+                goto err0;
         }
 
         if (devm_request_irq(&pdev->dev, irq->start,
diff --git a/drivers/gpio/gpio-tb10x.c b/drivers/gpio/gpio-tb10x.c
index 0502b9a041a5..da071ddbad99 100644
--- a/drivers/gpio/gpio-tb10x.c
+++ b/drivers/gpio/gpio-tb10x.c
@@ -132,6 +132,7 @@ static int tb10x_gpio_direction_out(struct gpio_chip *chip,
         int mask = BIT(offset);
         int val = TB10X_GPIO_DIR_OUT << offset;
 
+        tb10x_gpio_set(chip, offset, value);
         tb10x_set_bits(tb10x_gpio, OFFSET_TO_REG_DDR, mask, val);
 
         return 0;
diff --git a/drivers/gpio/gpio-twl4030.c b/drivers/gpio/gpio-twl4030.c
index 0c7e891c8651..b97d6a6577b9 100644
--- a/drivers/gpio/gpio-twl4030.c
+++ b/drivers/gpio/gpio-twl4030.c
@@ -354,17 +354,18 @@ static void twl_set(struct gpio_chip *chip, unsigned offset, int value)
 static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
 {
         struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
+        int ret = -EINVAL;
 
         mutex_lock(&priv->mutex);
         if (offset < TWL4030_GPIO_MAX)
-                twl4030_set_gpio_dataout(offset, value);
+                ret = twl4030_set_gpio_direction(offset, 0);
 
         priv->direction |= BIT(offset);
         mutex_unlock(&priv->mutex);
 
         twl_set(chip, offset, value);
 
-        return 0;
+        return ret;
 }
 
 static int twl_to_irq(struct gpio_chip *chip, unsigned offset)
@@ -435,7 +436,8 @@ static int gpio_twl4030_debounce(u32 debounce, u8 mmc_cd)
 
 static int gpio_twl4030_remove(struct platform_device *pdev);
 
-static struct twl4030_gpio_platform_data *of_gpio_twl4030(struct device *dev)
+static struct twl4030_gpio_platform_data *of_gpio_twl4030(struct device *dev,
+                                struct twl4030_gpio_platform_data *pdata)
 {
         struct twl4030_gpio_platform_data *omap_twl_info;
 
@@ -443,6 +445,9 @@ static struct twl4030_gpio_platform_data *of_gpio_twl4030(struct device *dev)
         if (!omap_twl_info)
                 return NULL;
 
+        if (pdata)
+                *omap_twl_info = *pdata;
+
         omap_twl_info->use_leds = of_property_read_bool(dev->of_node,
                         "ti,use-leds");
 
@@ -500,7 +505,7 @@ no_irqs:
         mutex_init(&priv->mutex);
 
         if (node)
-                pdata = of_gpio_twl4030(&pdev->dev);
+                pdata = of_gpio_twl4030(&pdev->dev, pdata);
 
         if (pdata == NULL) {
                 dev_err(&pdev->dev, "Platform data is missing\n");
diff --git a/drivers/gpio/gpio-ucb1400.c b/drivers/gpio/gpio-ucb1400.c
index 1a605f2a0f55..06fb5cf99ded 100644
--- a/drivers/gpio/gpio-ucb1400.c
+++ b/drivers/gpio/gpio-ucb1400.c
@@ -105,3 +105,4 @@ module_platform_driver(ucb1400_gpio_driver);
 
 MODULE_DESCRIPTION("Philips UCB1400 GPIO driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:ucb1400_gpio");
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 4e10b10d3ddd..85f772c0b26a 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -14,6 +14,7 @@
 #include <linux/idr.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
+#include <linux/gpio/driver.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/gpio.h>
@@ -1308,6 +1309,18 @@ struct gpio_chip *gpiochip_find(void *data,
 }
 EXPORT_SYMBOL_GPL(gpiochip_find);
 
+static int gpiochip_match_name(struct gpio_chip *chip, void *data)
+{
+        const char *name = data;
+
+        return !strcmp(chip->label, name);
+}
+
+static struct gpio_chip *find_chip_by_name(const char *name)
+{
+        return gpiochip_find((void *)name, gpiochip_match_name);
+}
+
 #ifdef CONFIG_PINCTRL
 
 /**
@@ -1341,8 +1354,10 @@ int gpiochip_add_pingroup_range(struct gpio_chip *chip,
         ret = pinctrl_get_group_pins(pctldev, pin_group,
                                         &pin_range->range.pins,
                                         &pin_range->range.npins);
-        if (ret < 0)
+        if (ret < 0) {
+                kfree(pin_range);
                 return ret;
+        }
 
         pinctrl_add_gpio_range(pctldev, &pin_range->range);
 
@@ -2260,26 +2275,10 @@ void gpiod_add_table(struct gpiod_lookup *table, size_t size)
         mutex_unlock(&gpio_lookup_lock);
 }
 
-/*
- * Caller must have a acquired gpio_lookup_lock
- */
-static struct gpio_chip *find_chip_by_name(const char *name)
-{
-        struct gpio_chip *chip = NULL;
-
-        list_for_each_entry(chip, &gpio_lookup_list, list) {
-                if (chip->label == NULL)
-                        continue;
-                if (!strcmp(chip->label, name))
-                        break;
-        }
-
-        return chip;
-}
-
 #ifdef CONFIG_OF
 static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
-                                      unsigned int idx, unsigned long *flags)
+                                      unsigned int idx,
+                                      enum gpio_lookup_flags *flags)
 {
         char prop_name[32]; /* 32 is max size of property name */
         enum of_gpio_flags of_flags;
@@ -2297,20 +2296,22 @@ static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
                 return desc;
 
         if (of_flags & OF_GPIO_ACTIVE_LOW)
-                *flags |= GPIOF_ACTIVE_LOW;
+                *flags |= GPIO_ACTIVE_LOW;
 
         return desc;
 }
 #else
 static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
-                                      unsigned int idx, unsigned long *flags)
+                                      unsigned int idx,
+                                      enum gpio_lookup_flags *flags)
 {
         return ERR_PTR(-ENODEV);
 }
 #endif
 
 static struct gpio_desc *acpi_find_gpio(struct device *dev, const char *con_id,
-                                        unsigned int idx, unsigned long *flags)
+                                        unsigned int idx,
+                                        enum gpio_lookup_flags *flags)
 {
         struct acpi_gpio_info info;
         struct gpio_desc *desc;
@@ -2320,13 +2321,14 @@ static struct gpio_desc *acpi_find_gpio(struct device *dev, const char *con_id,
                 return desc;
 
         if (info.gpioint && info.active_low)
-                *flags |= GPIOF_ACTIVE_LOW;
+                *flags |= GPIO_ACTIVE_LOW;
 
         return desc;
 }
 
 static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
-                                    unsigned int idx, unsigned long *flags)
+                                    unsigned int idx,
+                                    enum gpio_lookup_flags *flags)
 {
         const char *dev_id = dev ? dev_name(dev) : NULL;
         struct gpio_desc *desc = ERR_PTR(-ENODEV);
@@ -2366,7 +2368,7 @@ static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
                                 continue;
                         }
 
-                        if (chip->ngpio >= p->chip_hwnum) {
+                        if (chip->ngpio <= p->chip_hwnum) {
                                 dev_warn(dev, "GPIO chip %s has %d GPIOs\n",
                                          chip->label, chip->ngpio);
                                 continue;
@@ -2416,9 +2418,9 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
                                                const char *con_id,
                                                unsigned int idx)
 {
-        struct gpio_desc *desc;
+        struct gpio_desc *desc = NULL;
         int status;
-        unsigned long flags = 0;
+        enum gpio_lookup_flags flags = 0;
 
         dev_dbg(dev, "GPIO lookup for consumer %s\n", con_id);
 
@@ -2429,13 +2431,23 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
         } else if (IS_ENABLED(CONFIG_ACPI) && dev && ACPI_HANDLE(dev)) {
                 dev_dbg(dev, "using ACPI for GPIO lookup\n");
                 desc = acpi_find_gpio(dev, con_id, idx, &flags);
-        } else {
+        }
+
+        /*
+         * Either we are not using DT or ACPI, or their lookup did not return
+         * a result. In that case, use platform lookup as a fallback.
+         */
+        if (!desc || IS_ERR(desc)) {
+                struct gpio_desc *pdesc;
                 dev_dbg(dev, "using lookup tables for GPIO lookup");
-                desc = gpiod_find(dev, con_id, idx, &flags);
+                pdesc = gpiod_find(dev, con_id, idx, &flags);
+                /* If used as fallback, do not replace the previous error */
+                if (!IS_ERR(pdesc) || !desc)
+                        desc = pdesc;
         }
 
         if (IS_ERR(desc)) {
-                dev_warn(dev, "lookup for GPIO %s failed\n", con_id);
+                dev_dbg(dev, "lookup for GPIO %s failed\n", con_id);
                 return desc;
         }
 
@@ -2444,8 +2456,12 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
         if (status < 0)
                 return ERR_PTR(status);
 
-        if (flags & GPIOF_ACTIVE_LOW)
+        if (flags & GPIO_ACTIVE_LOW)
                 set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+        if (flags & GPIO_OPEN_DRAIN)
+                set_bit(FLAG_OPEN_DRAIN, &desc->flags);
+        if (flags & GPIO_OPEN_SOURCE)
+                set_bit(FLAG_OPEN_SOURCE, &desc->flags);
 
         return desc;
 }
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index fb7cf0e796f6..0a1e4a5f4234 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -2674,7 +2674,7 @@ static int add_3d_struct_modes(struct drm_connector *connector, u16 structure,
         int modes = 0;
         u8 cea_mode;
 
-        if (video_db == NULL || video_index > video_len)
+        if (video_db == NULL || video_index >= video_len)
                 return 0;
 
         /* CEA modes are numbered 1..127 */
@@ -2701,7 +2701,7 @@ static int add_3d_struct_modes(struct drm_connector *connector, u16 structure,
         if (structure & (1 << 8)) {
                 newmode = drm_mode_duplicate(dev, &edid_cea_modes[cea_mode]);
                 if (newmode) {
-                        newmode->flags = DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF;
+                        newmode->flags |= DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF;
                         drm_mode_probed_add(connector, newmode);
                         modes++;
                 }
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index bd2bca395792..c22c3097c3e8 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -516,7 +516,7 @@ int drm_sysfs_device_add(struct drm_minor *minor)
                 minor_str = "card%d";
 
         minor->kdev = kzalloc(sizeof(*minor->kdev), GFP_KERNEL);
-        if (!minor->dev) {
+        if (!minor->kdev) {
                 r = -ENOMEM;
                 goto error;
         }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index b676006a95a0..22b8f5eced80 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -173,28 +173,37 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
 static void exynos_drm_preclose(struct drm_device *dev,
                                         struct drm_file *file)
 {
+        exynos_drm_subdrv_close(dev, file);
+}
+
+static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
+{
         struct exynos_drm_private *private = dev->dev_private;
-        struct drm_pending_vblank_event *e, *t;
+        struct drm_pending_vblank_event *v, *vt;
+        struct drm_pending_event *e, *et;
         unsigned long flags;
 
-        /* release events of current file */
+        if (!file->driver_priv)
+                return;
+
+        /* Release all events not unhandled by page flip handler. */
         spin_lock_irqsave(&dev->event_lock, flags);
-        list_for_each_entry_safe(e, t, &private->pageflip_event_list,
+        list_for_each_entry_safe(v, vt, &private->pageflip_event_list,
                         base.link) {
-                if (e->base.file_priv == file) {
-                        list_del(&e->base.link);
-                        e->base.destroy(&e->base);
+                if (v->base.file_priv == file) {
+                        list_del(&v->base.link);
+                        drm_vblank_put(dev, v->pipe);
+                        v->base.destroy(&v->base);
                 }
         }
-        spin_unlock_irqrestore(&dev->event_lock, flags);
 
-        exynos_drm_subdrv_close(dev, file);
-}
+        /* Release all events handled by page flip handler but not freed. */
+        list_for_each_entry_safe(e, et, &file->event_list, link) {
+                list_del(&e->link);
+                e->destroy(e);
+        }
+        spin_unlock_irqrestore(&dev->event_lock, flags);
 
-static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
-{
-        if (!file->driver_priv)
-                return;
 
         kfree(file->driver_priv);
         file->driver_priv = NULL;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 23da72b5eae9..a61878bf5dcd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -31,7 +31,7 @@
 #include "exynos_drm_iommu.h"
 
 /*
- * FIMD is stand for Fully Interactive Mobile Display and
+ * FIMD stands for Fully Interactive Mobile Display and
  * as a display controller, it transfers contents drawn on memory
  * to a LCD Panel through Display Interfaces such as RGB or
  * CPU Interface.
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 989be12cdd6e..2e367a1c6a64 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -534,8 +534,10 @@ static int i915_drm_freeze(struct drm_device *dev)
                  * Disable CRTCs directly since we want to preserve sw state
                  * for _thaw.
                  */
+                mutex_lock(&dev->mode_config.mutex);
                 list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
                         dev_priv->display.crtc_disable(crtc);
+                mutex_unlock(&dev->mode_config.mutex);
 
                 intel_modeset_suspend_hw(dev);
         }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 12bbd5eac70d..621c7c67a643 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4442,10 +4442,9 @@ i915_gem_init_hw(struct drm_device *dev)
         if (dev_priv->ellc_size)
                 I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
 
-        if (IS_HSW_GT3(dev))
-                I915_WRITE(MI_PREDICATE_RESULT_2, LOWER_SLICE_ENABLED);
-        else
-                I915_WRITE(MI_PREDICATE_RESULT_2, LOWER_SLICE_DISABLED);
+        if (IS_HASWELL(dev))
+                I915_WRITE(MI_PREDICATE_RESULT_2, IS_HSW_GT3(dev) ?
+                           LOWER_SLICE_ENABLED : LOWER_SLICE_DISABLED);
 
         if (HAS_PCH_NOP(dev)) {
                 u32 temp = I915_READ(GEN7_MSG_CTL);
diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
index 7d5752fda5f1..9bb533e0d762 100644
--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
@@ -125,13 +125,15 @@ static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
 
         ret = i915_gem_object_get_pages(obj);
         if (ret)
-                goto error;
+                goto err;
+
+        i915_gem_object_pin_pages(obj);
 
         ret = -ENOMEM;
 
         pages = drm_malloc_ab(obj->base.size >> PAGE_SHIFT, sizeof(*pages));
         if (pages == NULL)
-                goto error;
+                goto err_unpin;
 
         i = 0;
         for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0)
@@ -141,15 +143,16 @@ static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
         drm_free_large(pages);
 
         if (!obj->dma_buf_vmapping)
-                goto error;
+                goto err_unpin;
 
         obj->vmapping_count = 1;
-        i915_gem_object_pin_pages(obj);
 out_unlock:
         mutex_unlock(&dev->struct_mutex);
         return obj->dma_buf_vmapping;
 
-error:
+err_unpin:
+        i915_gem_object_unpin_pages(obj);
+err:
         mutex_unlock(&dev->struct_mutex);
         return ERR_PTR(ret);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 885d595e0e02..b7e787fb4649 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -33,6 +33,9 @@
 #include "intel_drv.h"
 #include <linux/dma_remapping.h>
 
+#define  __EXEC_OBJECT_HAS_PIN (1<<31)
+#define  __EXEC_OBJECT_HAS_FENCE (1<<30)
+
 struct eb_vmas {
         struct list_head vmas;
         int and;
@@ -187,7 +190,28 @@ static struct i915_vma *eb_get_vma(struct eb_vmas *eb, unsigned long handle)
         }
 }
 
-static void eb_destroy(struct eb_vmas *eb) {
+static void
+i915_gem_execbuffer_unreserve_vma(struct i915_vma *vma)
+{
+        struct drm_i915_gem_exec_object2 *entry;
+        struct drm_i915_gem_object *obj = vma->obj;
+
+        if (!drm_mm_node_allocated(&vma->node))
+                return;
+
+        entry = vma->exec_entry;
+
+        if (entry->flags & __EXEC_OBJECT_HAS_FENCE)
+                i915_gem_object_unpin_fence(obj);
+
+        if (entry->flags & __EXEC_OBJECT_HAS_PIN)
+                i915_gem_object_unpin(obj);
+
+        entry->flags &= ~(__EXEC_OBJECT_HAS_FENCE | __EXEC_OBJECT_HAS_PIN);
+}
+
+static void eb_destroy(struct eb_vmas *eb)
+{
         while (!list_empty(&eb->vmas)) {
                 struct i915_vma *vma;
 
@@ -195,6 +219,7 @@ static void eb_destroy(struct eb_vmas *eb) {
                                        struct i915_vma,
                                        exec_list);
                 list_del_init(&vma->exec_list);
+                i915_gem_execbuffer_unreserve_vma(vma);
                 drm_gem_object_unreference(&vma->obj->base);
         }
         kfree(eb);
@@ -478,9 +503,6 @@ i915_gem_execbuffer_relocate(struct eb_vmas *eb,
         return ret;
 }
 
-#define  __EXEC_OBJECT_HAS_PIN (1<<31)
-#define  __EXEC_OBJECT_HAS_FENCE (1<<30)
-
 static int
 need_reloc_mappable(struct i915_vma *vma)
 {
@@ -552,26 +574,6 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
         return 0;
 }
 
-static void
-i915_gem_execbuffer_unreserve_vma(struct i915_vma *vma)
-{
-        struct drm_i915_gem_exec_object2 *entry;
-        struct drm_i915_gem_object *obj = vma->obj;
-
-        if (!drm_mm_node_allocated(&vma->node))
-                return;
-
-        entry = vma->exec_entry;
-
-        if (entry->flags & __EXEC_OBJECT_HAS_FENCE)
-                i915_gem_object_unpin_fence(obj);
-
-        if (entry->flags & __EXEC_OBJECT_HAS_PIN)
-                i915_gem_object_unpin(obj);
-
-        entry->flags &= ~(__EXEC_OBJECT_HAS_FENCE | __EXEC_OBJECT_HAS_PIN);
-}
-
 static int
 i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                             struct list_head *vmas,
@@ -670,13 +672,14 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                                 goto err;
                 }
 
-err:            /* Decrement pin count for bound objects */
-                list_for_each_entry(vma, vmas, exec_list)
-                        i915_gem_execbuffer_unreserve_vma(vma);
-
+err:
                 if (ret != -ENOSPC || retry++)
                         return ret;
 
+                /* Decrement pin count for bound objects */
+                list_for_each_entry(vma, vmas, exec_list)
+                        i915_gem_execbuffer_unreserve_vma(vma);
+
                 ret = i915_gem_evict_vm(vm, true);
                 if (ret)
                         return ret;
@@ -708,6 +711,7 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
         while (!list_empty(&eb->vmas)) {
                 vma = list_first_entry(&eb->vmas, struct i915_vma, exec_list);
                 list_del_init(&vma->exec_list);
+                i915_gem_execbuffer_unreserve_vma(vma);
                 drm_gem_object_unreference(&vma->obj->base);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 3620a1b0a73c..38cb8d44a013 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -57,7 +57,9 @@ typedef gen8_gtt_pte_t gen8_ppgtt_pde_t;
 #define HSW_WB_LLC_AGE3                 HSW_CACHEABILITY_CONTROL(0x2)
 #define HSW_WB_LLC_AGE0                 HSW_CACHEABILITY_CONTROL(0x3)
 #define HSW_WB_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0xb)
+#define HSW_WB_ELLC_LLC_AGE3            HSW_CACHEABILITY_CONTROL(0x8)
 #define HSW_WT_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0x6)
+#define HSW_WT_ELLC_LLC_AGE3            HSW_CACHEABILITY_CONTROL(0x7)
 
 #define GEN8_PTES_PER_PAGE              (PAGE_SIZE / sizeof(gen8_gtt_pte_t))
 #define GEN8_PDES_PER_PAGE              (PAGE_SIZE / sizeof(gen8_ppgtt_pde_t))
@@ -185,10 +187,10 @@ static gen6_gtt_pte_t iris_pte_encode(dma_addr_t addr,
         case I915_CACHE_NONE:
                 break;
         case I915_CACHE_WT:
-                pte |= HSW_WT_ELLC_LLC_AGE0;
+                pte |= HSW_WT_ELLC_LLC_AGE3;
                 break;
         default:
-                pte |= HSW_WB_ELLC_LLC_AGE0;
+                pte |= HSW_WB_ELLC_LLC_AGE3;
                 break;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index f9eafb6ed523..ee2742122a02 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -235,6 +235,7 @@
  */
 #define MI_LOAD_REGISTER_IMM(x) MI_INSTR(0x22, 2*x-1)
 #define MI_STORE_REGISTER_MEM(x) MI_INSTR(0x24, 2*x-1)
+#define  MI_SRM_LRM_GLOBAL_GTT          (1<<22)
 #define MI_FLUSH_DW             MI_INSTR(0x26, 1) /* for GEN6 */
 #define   MI_FLUSH_DW_STORE_INDEX       (1<<21)
 #define   MI_INVALIDATE_TLB             (1<<18)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 330077bcd0bd..526c8ded16b0 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -173,7 +173,7 @@ static void intel_prepare_ddi_buffers(struct drm_device *dev, enum port port)
                 ddi_translations = ddi_translations_dp;
                 break;
         case PORT_D:
-                if (intel_dpd_is_edp(dev))
+                if (intel_dp_is_edp(dev, PORT_D))
                         ddi_translations = ddi_translations_edp;
                 else
                         ddi_translations = ddi_translations_dp;
@@ -1158,9 +1158,10 @@ static void intel_ddi_post_disable(struct intel_encoder *intel_encoder)
         if (wait)
                 intel_wait_ddi_buf_idle(dev_priv, port);
 
-        if (type == INTEL_OUTPUT_EDP) {
+        if (type == INTEL_OUTPUT_DISPLAYPORT || type == INTEL_OUTPUT_EDP) {
                 struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
                 ironlake_edp_panel_vdd_on(intel_dp);
+                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
                 ironlake_edp_panel_off(intel_dp);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 7ec8b488bb1d..080f6fd4e839 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5815,7 +5815,7 @@ static void intel_set_pipe_csc(struct drm_crtc *crtc)
                 uint16_t postoff = 0;
 
                 if (intel_crtc->config.limited_color_range)
-                        postoff = (16 * (1 << 13) / 255) & 0x1fff;
+                        postoff = (16 * (1 << 12) / 255) & 0x1fff;
 
                 I915_WRITE(PIPE_CSC_POSTOFF_HI(pipe), postoff);
                 I915_WRITE(PIPE_CSC_POSTOFF_ME(pipe), postoff);
@@ -6402,7 +6402,7 @@ static void hsw_restore_lcpll(struct drm_i915_private *dev_priv)
 
         /* Make sure we're not on PC8 state before disabling PC8, otherwise
          * we'll hang the machine! */
-        dev_priv->uncore.funcs.force_wake_get(dev_priv);
+        gen6_gt_force_wake_get(dev_priv);
 
         if (val & LCPLL_POWER_DOWN_ALLOW) {
                 val &= ~LCPLL_POWER_DOWN_ALLOW;
@@ -6436,7 +6436,7 @@ static void hsw_restore_lcpll(struct drm_i915_private *dev_priv)
                         DRM_ERROR("Switching back to LCPLL failed\n");
         }
 
-        dev_priv->uncore.funcs.force_wake_put(dev_priv);
+        gen6_gt_force_wake_put(dev_priv);
 }
 
 void hsw_enable_pc8_work(struct work_struct *__work)
@@ -8354,7 +8354,8 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
                 intel_ring_emit(ring, ~(DERRMR_PIPEA_PRI_FLIP_DONE |
                                         DERRMR_PIPEB_PRI_FLIP_DONE |
                                         DERRMR_PIPEC_PRI_FLIP_DONE));
-                intel_ring_emit(ring, MI_STORE_REGISTER_MEM(1));
+                intel_ring_emit(ring, MI_STORE_REGISTER_MEM(1) |
+                                MI_SRM_LRM_GLOBAL_GTT);
                 intel_ring_emit(ring, DERRMR);
                 intel_ring_emit(ring, ring->scratch.gtt_offset + 256);
         }
@@ -10049,7 +10050,7 @@ static void intel_setup_outputs(struct drm_device *dev)
                         intel_ddi_init(dev, PORT_D);
         } else if (HAS_PCH_SPLIT(dev)) {
                 int found;
-                dpd_is_edp = intel_dpd_is_edp(dev);
+                dpd_is_edp = intel_dp_is_edp(dev, PORT_D);
 
                 if (has_edp_a(dev))
                         intel_dp_init(dev, DP_A, PORT_A);
@@ -10086,8 +10087,7 @@ static void intel_setup_outputs(struct drm_device *dev)
                         intel_hdmi_init(dev, VLV_DISPLAY_BASE + GEN4_HDMIC,
                                         PORT_C);
                         if (I915_READ(VLV_DISPLAY_BASE + DP_C) & DP_DETECTED)
-                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_C,
-                                              PORT_C);
+                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_C, PORT_C);
                 }
 
                 intel_dsi_init(dev);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 0b2e842fef01..30c627c7b7ba 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -3326,11 +3326,19 @@ intel_trans_dp_port_sel(struct drm_crtc *crtc)
 }
 
 /* check the VBT to see whether the eDP is on DP-D port */
-bool intel_dpd_is_edp(struct drm_device *dev)
+bool intel_dp_is_edp(struct drm_device *dev, enum port port)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         union child_device_config *p_child;
         int i;
+        static const short port_mapping[] = {
+                [PORT_B] = PORT_IDPB,
+                [PORT_C] = PORT_IDPC,
+                [PORT_D] = PORT_IDPD,
+        };
+
+        if (port == PORT_A)
+                return true;
 
         if (!dev_priv->vbt.child_dev_num)
                 return false;
@@ -3338,7 +3346,7 @@ bool intel_dpd_is_edp(struct drm_device *dev)
         for (i = 0; i < dev_priv->vbt.child_dev_num; i++) {
                 p_child = dev_priv->vbt.child_dev + i;
 
-                if (p_child->common.dvo_port == PORT_IDPD &&
+                if (p_child->common.dvo_port == port_mapping[port] &&
                     (p_child->common.device_type & DEVICE_TYPE_eDP_BITS) ==
                     (DEVICE_TYPE_eDP & DEVICE_TYPE_eDP_BITS))
                         return true;
@@ -3616,26 +3624,10 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
         intel_dp->DP = I915_READ(intel_dp->output_reg);
         intel_dp->attached_connector = intel_connector;
 
-        type = DRM_MODE_CONNECTOR_DisplayPort;
-        /*
-         * FIXME : We need to initialize built-in panels before external panels.
-         * For X0, DP_C is fixed as eDP. Revisit this as part of VLV eDP cleanup
-         */
-        switch (port) {
-        case PORT_A:
+        if (intel_dp_is_edp(dev, port))
                 type = DRM_MODE_CONNECTOR_eDP;
-                break;
-        case PORT_C:
-                if (IS_VALLEYVIEW(dev))
-                        type = DRM_MODE_CONNECTOR_eDP;
-                break;
-        case PORT_D:
-                if (HAS_PCH_SPLIT(dev) && intel_dpd_is_edp(dev))
-                        type = DRM_MODE_CONNECTOR_eDP;
-                break;
-        default:        /* silence GCC warning */
-                break;
-        }
+        else
+                type = DRM_MODE_CONNECTOR_DisplayPort;
 
         /*
          * For eDP we always set the encoder type to INTEL_OUTPUT_EDP, but
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 1e49aa8f5377..a18e88b3e425 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -708,7 +708,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder);
 void intel_dp_check_link_status(struct intel_dp *intel_dp);
 bool intel_dp_compute_config(struct intel_encoder *encoder,
                              struct intel_crtc_config *pipe_config);
-bool intel_dpd_is_edp(struct drm_device *dev);
+bool intel_dp_is_edp(struct drm_device *dev, enum port port);
 void ironlake_edp_backlight_on(struct intel_dp *intel_dp);
 void ironlake_edp_backlight_off(struct intel_dp *intel_dp);
 void ironlake_edp_panel_on(struct intel_dp *intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index caf2ee4e5441..6e0d5e075b15 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -1180,7 +1180,7 @@ static bool g4x_compute_wm0(struct drm_device *dev,
 
         adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
         clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
         hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
         pixel_size = crtc->fb->bits_per_pixel / 8;
 
@@ -1267,7 +1267,7 @@ static bool g4x_compute_srwm(struct drm_device *dev,
         crtc = intel_get_crtc_for_plane(dev, plane);
         adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
         clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
         hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
         pixel_size = crtc->fb->bits_per_pixel / 8;
 
@@ -1498,7 +1498,7 @@ static void i965_update_wm(struct drm_crtc *unused_crtc)
                 const struct drm_display_mode *adjusted_mode =
                         &to_intel_crtc(crtc)->config.adjusted_mode;
                 int clock = adjusted_mode->crtc_clock;
-                int htotal = adjusted_mode->htotal;
+                int htotal = adjusted_mode->crtc_htotal;
                 int hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
                 int pixel_size = crtc->fb->bits_per_pixel / 8;
                 unsigned long line_time_us;
@@ -1624,7 +1624,7 @@ static void i9xx_update_wm(struct drm_crtc *unused_crtc)
                 const struct drm_display_mode *adjusted_mode =
                         &to_intel_crtc(enabled)->config.adjusted_mode;
                 int clock = adjusted_mode->crtc_clock;
-                int htotal = adjusted_mode->htotal;
+                int htotal = adjusted_mode->crtc_htotal;
                 int hdisplay = to_intel_crtc(enabled)->config.pipe_src_w;
                 int pixel_size = enabled->fb->bits_per_pixel / 8;
                 unsigned long line_time_us;
@@ -1776,7 +1776,7 @@ static bool ironlake_compute_srwm(struct drm_device *dev, int level, int plane,
         crtc = intel_get_crtc_for_plane(dev, plane);
         adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
         clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
         hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
         pixel_size = crtc->fb->bits_per_pixel / 8;
 
@@ -2469,8 +2469,9 @@ hsw_compute_linetime_wm(struct drm_device *dev, struct drm_crtc *crtc)
         /* The WM are computed with base on how long it takes to fill a single
          * row at the given clock rate, multiplied by 8.
          * */
-        linetime = DIV_ROUND_CLOSEST(mode->htotal * 1000 * 8, mode->clock);
-        ips_linetime = DIV_ROUND_CLOSEST(mode->htotal * 1000 * 8,
+        linetime = DIV_ROUND_CLOSEST(mode->crtc_htotal * 1000 * 8,
+                                     mode->crtc_clock);
+        ips_linetime = DIV_ROUND_CLOSEST(mode->crtc_htotal * 1000 * 8,
                                          intel_ddi_get_cdclk_freq(dev_priv));
 
         return PIPE_WM_LINETIME_IPS_LINETIME(ips_linetime) |
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
index edcf801613e6..b3fa1ba191b7 100644
--- a/drivers/gpu/drm/nouveau/Makefile
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -59,6 +59,7 @@ nouveau-y += core/subdev/clock/nv40.o
 nouveau-y += core/subdev/clock/nv50.o
 nouveau-y += core/subdev/clock/nv84.o
 nouveau-y += core/subdev/clock/nva3.o
+nouveau-y += core/subdev/clock/nvaa.o
 nouveau-y += core/subdev/clock/nvc0.o
 nouveau-y += core/subdev/clock/nve0.o
 nouveau-y += core/subdev/clock/pllnv04.o
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
index db139827047c..db3fc7be856a 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
@@ -283,7 +283,7 @@ nv50_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                 device->oclass[NVDEV_SUBDEV_GPIO   ] = &nv50_gpio_oclass;
                 device->oclass[NVDEV_SUBDEV_I2C    ] = &nv94_i2c_oclass;
-                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nv84_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nvaa_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv84_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv50_devinit_oclass;
@@ -311,7 +311,7 @@ nv50_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                 device->oclass[NVDEV_SUBDEV_GPIO   ] = &nv50_gpio_oclass;
                 device->oclass[NVDEV_SUBDEV_I2C    ] = &nv94_i2c_oclass;
-                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nv84_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nvaa_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv84_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv50_devinit_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
index 5f555788121c..e6352bd5b4ff 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
@@ -33,6 +33,7 @@
 #include <engine/dmaobj.h>
 #include <engine/fifo.h>
 
+#include "nv04.h"
 #include "nv50.h"
 
 /*******************************************************************************
@@ -460,6 +461,8 @@ nv50_fifo_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         nv_subdev(priv)->intr = nv04_fifo_intr;
         nv_engine(priv)->cclass = &nv50_fifo_cclass;
         nv_engine(priv)->sclass = nv50_fifo_sclass;
+        priv->base.pause = nv04_fifo_pause;
+        priv->base.start = nv04_fifo_start;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
index 0908dc834c84..fe0f41e65d9b 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
@@ -35,6 +35,7 @@
 #include <engine/dmaobj.h>
 #include <engine/fifo.h>
 
+#include "nv04.h"
 #include "nv50.h"
 
 /*******************************************************************************
@@ -432,6 +433,8 @@ nv84_fifo_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         nv_subdev(priv)->intr = nv04_fifo_intr;
         nv_engine(priv)->cclass = &nv84_fifo_cclass;
         nv_engine(priv)->sclass = nv84_fifo_sclass;
+        priv->base.pause = nv04_fifo_pause;
+        priv->base.start = nv04_fifo_start;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/software/nv50.c b/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
index b574dd4bb828..5ce686ee729e 100644
--- a/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
@@ -176,7 +176,7 @@ nv50_software_context_ctor(struct nouveau_object *parent,
         if (ret)
                 return ret;
 
-        chan->vblank.nr_event = pdisp->vblank->index_nr;
+        chan->vblank.nr_event = pdisp ? pdisp->vblank->index_nr : 0;
         chan->vblank.event = kzalloc(chan->vblank.nr_event *
                                      sizeof(*chan->vblank.event), GFP_KERNEL);
         if (!chan->vblank.event)
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
index e2675bc0edba..8f4ced75444a 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
@@ -14,6 +14,9 @@ enum nv_clk_src {
         nv_clk_src_hclk,
         nv_clk_src_hclkm3,
         nv_clk_src_hclkm3d2,
+        nv_clk_src_hclkm2d3, /* NVAA */
+        nv_clk_src_hclkm4, /* NVAA */
+        nv_clk_src_cclk, /* NVAA */
 
         nv_clk_src_host,
 
@@ -127,6 +130,7 @@ extern struct nouveau_oclass nv04_clock_oclass;
 extern struct nouveau_oclass nv40_clock_oclass;
 extern struct nouveau_oclass *nv50_clock_oclass;
 extern struct nouveau_oclass *nv84_clock_oclass;
+extern struct nouveau_oclass *nvaa_clock_oclass;
 extern struct nouveau_oclass nva3_clock_oclass;
 extern struct nouveau_oclass nvc0_clock_oclass;
 extern struct nouveau_oclass nve0_clock_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
index da50c1b12928..30c1f3a4158e 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
@@ -69,6 +69,11 @@ nv04_clock_pll_prog(struct nouveau_clock *clk, u32 reg1,
         return 0;
 }
 
+static struct nouveau_clocks
+nv04_domain[] = {
+        { nv_clk_src_max }
+};
+
 static int
 nv04_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                 struct nouveau_oclass *oclass, void *data, u32 size,
@@ -77,7 +82,7 @@ nv04_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv04_clock_priv *priv;
         int ret;
 
-        ret = nouveau_clock_create(parent, engine, oclass, NULL, &priv);
+        ret = nouveau_clock_create(parent, engine, oclass, nv04_domain, &priv);
         *pobject = nv_object(priv);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c
new file mode 100644
index 000000000000..7a723b4f564d
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c
@@ -0,0 +1,445 @@
+/*
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+
+#include <engine/fifo.h>
+#include <subdev/bios.h>
+#include <subdev/bios/pll.h>
+#include <subdev/timer.h>
+#include <subdev/clock.h>
+
+#include "pll.h"
+
+struct nvaa_clock_priv {
+        struct nouveau_clock base;
+        enum nv_clk_src csrc, ssrc, vsrc;
+        u32 cctrl, sctrl;
+        u32 ccoef, scoef;
+        u32 cpost, spost;
+        u32 vdiv;
+};
+
+static u32
+read_div(struct nouveau_clock *clk)
+{
+        return nv_rd32(clk, 0x004600);
+}
+
+static u32
+read_pll(struct nouveau_clock *clk, u32 base)
+{
+        u32 ctrl = nv_rd32(clk, base + 0);
+        u32 coef = nv_rd32(clk, base + 4);
+        u32 ref = clk->read(clk, nv_clk_src_href);
+        u32 post_div = 0;
+        u32 clock = 0;
+        int N1, M1;
+
+        switch (base){
+        case 0x4020:
+                post_div = 1 << ((nv_rd32(clk, 0x4070) & 0x000f0000) >> 16);
+                break;
+        case 0x4028:
+                post_div = (nv_rd32(clk, 0x4040) & 0x000f0000) >> 16;
+                break;
+        default:
+                break;
+        }
+
+        N1 = (coef & 0x0000ff00) >> 8;
+        M1 = (coef & 0x000000ff);
+        if ((ctrl & 0x80000000) && M1) {
+                clock = ref * N1 / M1;
+                clock = clock / post_div;
+        }
+
+        return clock;
+}
+
+static int
+nvaa_clock_read(struct nouveau_clock *clk, enum nv_clk_src src)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        u32 mast = nv_rd32(clk, 0x00c054);
+        u32 P = 0;
+
+        switch (src) {
+        case nv_clk_src_crystal:
+                return nv_device(priv)->crystal;
+        case nv_clk_src_href:
+                return 100000; /* PCIE reference clock */
+        case nv_clk_src_hclkm4:
+                return clk->read(clk, nv_clk_src_href) * 4;
+        case nv_clk_src_hclkm2d3:
+                return clk->read(clk, nv_clk_src_href) * 2 / 3;
+        case nv_clk_src_host:
+                switch (mast & 0x000c0000) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_hclkm2d3);
+                case 0x00040000: break;
+                case 0x00080000: return clk->read(clk, nv_clk_src_hclkm4);
+                case 0x000c0000: return clk->read(clk, nv_clk_src_cclk);
+                }
+                break;
+        case nv_clk_src_core:
+                P = (nv_rd32(clk, 0x004028) & 0x00070000) >> 16;
+
+                switch (mast & 0x00000003) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_crystal) >> P;
+                case 0x00000001: return 0;
+                case 0x00000002: return clk->read(clk, nv_clk_src_hclkm4) >> P;
+                case 0x00000003: return read_pll(clk, 0x004028) >> P;
+                }
+                break;
+        case nv_clk_src_cclk:
+                if ((mast & 0x03000000) != 0x03000000)
+                        return clk->read(clk, nv_clk_src_core);
+
+                if ((mast & 0x00000200) == 0x00000000)
+                        return clk->read(clk, nv_clk_src_core);
+
+                switch (mast & 0x00000c00) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_href);
+                case 0x00000400: return clk->read(clk, nv_clk_src_hclkm4);
+                case 0x00000800: return clk->read(clk, nv_clk_src_hclkm2d3);
+                default: return 0;
+                }
+        case nv_clk_src_shader:
+                P = (nv_rd32(clk, 0x004020) & 0x00070000) >> 16;
+                switch (mast & 0x00000030) {
+                case 0x00000000:
+                        if (mast & 0x00000040)
+                                return clk->read(clk, nv_clk_src_href) >> P;
+                        return clk->read(clk, nv_clk_src_crystal) >> P;
+                case 0x00000010: break;
+                case 0x00000020: return read_pll(clk, 0x004028) >> P;
+                case 0x00000030: return read_pll(clk, 0x004020) >> P;
+                }
+                break;
+        case nv_clk_src_mem:
+                return 0;
+                break;
+        case nv_clk_src_vdec:
+                P = (read_div(clk) & 0x00000700) >> 8;
+
+                switch (mast & 0x00400000) {
+                case 0x00400000:
+                        return clk->read(clk, nv_clk_src_core) >> P;
+                        break;
+                default:
+                        return 500000 >> P;
+                        break;
+                }
+                break;
+        default:
+                break;
+        }
+
+        nv_debug(priv, "unknown clock source %d 0x%08x\n", src, mast);
+        return 0;
+}
+
+static u32
+calc_pll(struct nvaa_clock_priv *priv, u32 reg,
+         u32 clock, int *N, int *M, int *P)
+{
+        struct nouveau_bios *bios = nouveau_bios(priv);
+        struct nvbios_pll pll;
+        struct nouveau_clock *clk = &priv->base;
+        int ret;
+
+        ret = nvbios_pll_parse(bios, reg, &pll);
+        if (ret)
+                return 0;
+
+        pll.vco2.max_freq = 0;
+        pll.refclk = clk->read(clk, nv_clk_src_href);
+        if (!pll.refclk)
+                return 0;
+
+        return nv04_pll_calc(nv_subdev(priv), &pll, clock, N, M, NULL, NULL, P);
+}
+
+static inline u32
+calc_P(u32 src, u32 target, int *div)
+{
+        u32 clk0 = src, clk1 = src;
+        for (*div = 0; *div <= 7; (*div)++) {
+                if (clk0 <= target) {
+                        clk1 = clk0 << (*div ? 1 : 0);
+                        break;
+                }
+                clk0 >>= 1;
+        }
+
+        if (target - clk0 <= clk1 - target)
+                return clk0;
+        (*div)--;
+        return clk1;
+}
+
+static int
+nvaa_clock_calc(struct nouveau_clock *clk, struct nouveau_cstate *cstate)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        const int shader = cstate->domain[nv_clk_src_shader];
+        const int core = cstate->domain[nv_clk_src_core];
+        const int vdec = cstate->domain[nv_clk_src_vdec];
+        u32 out = 0, clock = 0;
+        int N, M, P1, P2 = 0;
+        int divs = 0;
+
+        /* cclk: find suitable source, disable PLL if we can */
+        if (core < clk->read(clk, nv_clk_src_hclkm4))
+                out = calc_P(clk->read(clk, nv_clk_src_hclkm4), core, &divs);
+
+        /* Calculate clock * 2, so shader clock can use it too */
+        clock = calc_pll(priv, 0x4028, (core << 1), &N, &M, &P1);
+
+        if (abs(core - out) <=
+            abs(core - (clock >> 1))) {
+                priv->csrc = nv_clk_src_hclkm4;
+                priv->cctrl = divs << 16;
+        } else {
+                /* NVCTRL is actually used _after_ NVPOST, and after what we
+                 * call NVPLL. To make matters worse, NVPOST is an integer
+                 * divider instead of a right-shift number. */
+                if(P1 > 2) {
+                        P2 = P1 - 2;
+                        P1 = 2;
+                }
+
+                priv->csrc = nv_clk_src_core;
+                priv->ccoef = (N << 8) | M;
+
+                priv->cctrl = (P2 + 1) << 16;
+                priv->cpost = (1 << P1) << 16;
+        }
+
+        /* sclk: nvpll + divisor, href or spll */
+        out = 0;
+        if (shader == clk->read(clk, nv_clk_src_href)) {
+                priv->ssrc = nv_clk_src_href;
+        } else {
+                clock = calc_pll(priv, 0x4020, shader, &N, &M, &P1);
+                if (priv->csrc == nv_clk_src_core) {
+                        out = calc_P((core << 1), shader, &divs);
+                }
+
+                if (abs(shader - out) <=
+                    abs(shader - clock) &&
+                   (divs + P2) <= 7) {
+                        priv->ssrc = nv_clk_src_core;
+                        priv->sctrl = (divs + P2) << 16;
+                } else {
+                        priv->ssrc = nv_clk_src_shader;
+                        priv->scoef = (N << 8) | M;
+                        priv->sctrl = P1 << 16;
+                }
+        }
+
+        /* vclk */
+        out = calc_P(core, vdec, &divs);
+        clock = calc_P(500000, vdec, &P1);
+        if(abs(vdec - out) <=
+           abs(vdec - clock)) {
+                priv->vsrc = nv_clk_src_cclk;
+                priv->vdiv = divs << 16;
+        } else {
+                priv->vsrc = nv_clk_src_vdec;
+                priv->vdiv = P1 << 16;
+        }
+
+        /* Print strategy! */
+        nv_debug(priv, "nvpll: %08x %08x %08x\n",
+                        priv->ccoef, priv->cpost, priv->cctrl);
+        nv_debug(priv, " spll: %08x %08x %08x\n",
+                        priv->scoef, priv->spost, priv->sctrl);
+        nv_debug(priv, " vdiv: %08x\n", priv->vdiv);
+        if (priv->csrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "core: hrefm4\n");
+        else
+                nv_debug(priv, "core: nvpll\n");
+
+        if (priv->ssrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "shader: hrefm4\n");
+        else if (priv->ssrc == nv_clk_src_core)
+                nv_debug(priv, "shader: nvpll\n");
+        else
+                nv_debug(priv, "shader: spll\n");
+
+        if (priv->vsrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "vdec: 500MHz\n");
+        else
+                nv_debug(priv, "vdec: core\n");
+
+        return 0;
+}
+
+static int
+nvaa_clock_prog(struct nouveau_clock *clk)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        struct nouveau_fifo *pfifo = nouveau_fifo(clk);
+        unsigned long flags;
+        u32 pllmask = 0, mast, ptherm_gate;
+        int ret = -EBUSY;
+
+        /* halt and idle execution engines */
+        ptherm_gate = nv_mask(clk, 0x020060, 0x00070000, 0x00000000);
+        nv_mask(clk, 0x002504, 0x00000001, 0x00000001);
+        /* Wait until the interrupt handler is finished */
+        if (!nv_wait(clk, 0x000100, 0xffffffff, 0x00000000))
+                goto resume;
+
+        if (pfifo)
+                pfifo->pause(pfifo, &flags);
+
+        if (!nv_wait(clk, 0x002504, 0x00000010, 0x00000010))
+                goto resume;
+        if (!nv_wait(clk, 0x00251c, 0x0000003f, 0x0000003f))
+                goto resume;
+
+        /* First switch to safe clocks: href */
+        mast = nv_mask(clk, 0xc054, 0x03400e70, 0x03400640);
+        mast &= ~0x00400e73;
+        mast |= 0x03000000;
+
+        switch (priv->csrc) {
+        case nv_clk_src_hclkm4:
+                nv_mask(clk, 0x4028, 0x00070000, priv->cctrl);
+                mast |= 0x00000002;
+                break;
+        case nv_clk_src_core:
+                nv_wr32(clk, 0x402c, priv->ccoef);
+                nv_wr32(clk, 0x4028, 0x80000000 | priv->cctrl);
+                nv_wr32(clk, 0x4040, priv->cpost);
+                pllmask |= (0x3 << 8);
+                mast |= 0x00000003;
+                break;
+        default:
+                nv_warn(priv,"Reclocking failed: unknown core clock\n");
+                goto resume;
+        }
+
+        switch (priv->ssrc) {
+        case nv_clk_src_href:
+                nv_mask(clk, 0x4020, 0x00070000, 0x00000000);
+                /* mast |= 0x00000000; */
+                break;
+        case nv_clk_src_core:
+                nv_mask(clk, 0x4020, 0x00070000, priv->sctrl);
+                mast |= 0x00000020;
+                break;
+        case nv_clk_src_shader:
+                nv_wr32(clk, 0x4024, priv->scoef);
+                nv_wr32(clk, 0x4020, 0x80000000 | priv->sctrl);
+                nv_wr32(clk, 0x4070, priv->spost);
+                pllmask |= (0x3 << 12);
+                mast |= 0x00000030;
+                break;
+        default:
+                nv_warn(priv,"Reclocking failed: unknown sclk clock\n");
+                goto resume;
+        }
+
+        if (!nv_wait(clk, 0x004080, pllmask, pllmask)) {
+                nv_warn(priv,"Reclocking failed: unstable PLLs\n");
+                goto resume;
+        }
+
+        switch (priv->vsrc) {
+        case nv_clk_src_cclk:
+                mast |= 0x00400000;
+        default:
+                nv_wr32(clk, 0x4600, priv->vdiv);
+        }
+
+        nv_wr32(clk, 0xc054, mast);
+        ret = 0;
+
+resume:
+        if (pfifo)
+                pfifo->start(pfifo, &flags);
+
+        nv_mask(clk, 0x002504, 0x00000001, 0x00000000);
+        nv_wr32(clk, 0x020060, ptherm_gate);
+
+        /* Disable some PLLs and dividers when unused */
+        if (priv->csrc != nv_clk_src_core) {
+                nv_wr32(clk, 0x4040, 0x00000000);
+                nv_mask(clk, 0x4028, 0x80000000, 0x00000000);
+        }
+
+        if (priv->ssrc != nv_clk_src_shader) {
+                nv_wr32(clk, 0x4070, 0x00000000);
+                nv_mask(clk, 0x4020, 0x80000000, 0x00000000);
+        }
+
+        return ret;
+}
+
+static void
+nvaa_clock_tidy(struct nouveau_clock *clk)
+{
+}
+
+static struct nouveau_clocks
+nvaa_domains[] = {
+        { nv_clk_src_crystal, 0xff },
+        { nv_clk_src_href   , 0xff },
+        { nv_clk_src_core   , 0xff, 0, "core", 1000 },
+        { nv_clk_src_shader , 0xff, 0, "shader", 1000 },
+        { nv_clk_src_vdec   , 0xff, 0, "vdec", 1000 },
+        { nv_clk_src_max }
+};
+
+static int
+nvaa_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+                struct nouveau_oclass *oclass, void *data, u32 size,
+                struct nouveau_object **pobject)
+{
+        struct nvaa_clock_priv *priv;
+        int ret;
+
+        ret = nouveau_clock_create(parent, engine, oclass, nvaa_domains, &priv);
+        *pobject = nv_object(priv);
+        if (ret)
+                return ret;
+
+        priv->base.read = nvaa_clock_read;
+        priv->base.calc = nvaa_clock_calc;
+        priv->base.prog = nvaa_clock_prog;
+        priv->base.tidy = nvaa_clock_tidy;
+        return 0;
+}
+
+struct nouveau_oclass *
+nvaa_clock_oclass = &(struct nouveau_oclass) {
+        .handle = NV_SUBDEV(CLOCK, 0xaa),
+        .ofuncs = &(struct nouveau_ofuncs) {
+                .ctor = nvaa_clock_ctor,
+                .dtor = _nouveau_clock_dtor,
+                .init = _nouveau_clock_init,
+                .fini = _nouveau_clock_fini,
+        },
+};
diff --git a/drivers/gpu/drm/nouveau/dispnv04/overlay.c b/drivers/gpu/drm/nouveau/dispnv04/overlay.c
index 3618ac6b6316..32e7064b819b 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/overlay.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/overlay.c
@@ -58,8 +58,8 @@ struct nouveau_plane {
 };
 
 static uint32_t formats[] = {
-        DRM_FORMAT_NV12,
         DRM_FORMAT_UYVY,
+        DRM_FORMAT_NV12,
 };
 
 /* Sine can be approximated with
@@ -99,13 +99,28 @@ nv10_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
         struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
         struct nouveau_bo *cur = nv_plane->cur;
         bool flip = nv_plane->flip;
-        int format = ALIGN(src_w * 4, 0x100);
         int soff = NV_PCRTC0_SIZE * nv_crtc->index;
         int soff2 = NV_PCRTC0_SIZE * !nv_crtc->index;
-        int ret;
+        int format, ret;
+
+        /* Source parameters given in 16.16 fixed point, ignore fractional. */
+        src_x >>= 16;
+        src_y >>= 16;
+        src_w >>= 16;
+        src_h >>= 16;
+
+        format = ALIGN(src_w * 4, 0x100);
 
         if (format > 0xffff)
-                return -EINVAL;
+                return -ERANGE;
+
+        if (dev->chipset >= 0x30) {
+                if (crtc_w < (src_w >> 1) || crtc_h < (src_h >> 1))
+                        return -ERANGE;
+        } else {
+                if (crtc_w < (src_w >> 3) || crtc_h < (src_h >> 3))
+                        return -ERANGE;
+        }
 
         ret = nouveau_bo_pin(nv_fb->nvbo, TTM_PL_FLAG_VRAM);
         if (ret)
@@ -113,12 +128,6 @@ nv10_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
 
         nv_plane->cur = nv_fb->nvbo;
 
-        /* Source parameters given in 16.16 fixed point, ignore fractional. */
-        src_x = src_x >> 16;
-        src_y = src_y >> 16;
-        src_w = src_w >> 16;
-        src_h = src_h >> 16;
-
         nv_mask(dev, NV_PCRTC_ENGINE_CTRL + soff, NV_CRTC_FSEL_OVERLAY, NV_CRTC_FSEL_OVERLAY);
         nv_mask(dev, NV_PCRTC_ENGINE_CTRL + soff2, NV_CRTC_FSEL_OVERLAY, 0);
 
@@ -245,14 +254,25 @@ nv10_overlay_init(struct drm_device *device)
 {
         struct nouveau_device *dev = nouveau_dev(device);
         struct nouveau_plane *plane = kzalloc(sizeof(struct nouveau_plane), GFP_KERNEL);
+        int num_formats = ARRAY_SIZE(formats);
         int ret;
 
         if (!plane)
                 return;
 
+        switch (dev->chipset) {
+        case 0x10:
+        case 0x11:
+        case 0x15:
+        case 0x1a:
+        case 0x20:
+                num_formats = 1;
+                break;
+        }
+
         ret = drm_plane_init(device, &plane->base, 3 /* both crtc's */,
                              &nv10_plane_funcs,
-                             formats, ARRAY_SIZE(formats), false);
+                             formats, num_formats, false);
         if (ret)
                 goto err;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 7809d92183c4..29c3efdfc7dd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -608,6 +608,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
         fence = nouveau_fence_ref(new_bo->bo.sync_obj);
         spin_unlock(&new_bo->bo.bdev->fence_lock);
         ret = nouveau_fence_sync(fence, chan);
+        nouveau_fence_unref(&fence);
         if (ret)
                 return ret;
 
@@ -701,7 +702,7 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
 
         s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head);
         if (s->event)
-                drm_send_vblank_event(dev, -1, s->event);
+                drm_send_vblank_event(dev, s->crtc, s->event);
 
         list_del(&s->head);
         if (ps)
diff --git a/drivers/gpu/drm/nouveau/nouveau_hwmon.c b/drivers/gpu/drm/nouveau/nouveau_hwmon.c
index 38a4db5bfe21..4aff04fa483c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_hwmon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_hwmon.c
@@ -630,7 +630,6 @@ error:
         hwmon->hwmon = NULL;
         return ret;
 #else
-        hwmon->hwmon = NULL;
         return 0;
 #endif
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index f8e66c08b11a..4e384a2f99c3 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1265,7 +1265,7 @@ nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b,
                     uint32_t start, uint32_t size)
 {
         struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
-        u32 end = max(start + size, (u32)256);
+        u32 end = min_t(u32, start + size, 256);
         u32 i;
 
         for (i = start; i < end; i++) {
diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
index 0109a9644cb2..821ab7b9409b 100644
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -92,6 +92,7 @@ qxl_release_free(struct qxl_device *qdev,
                                                 - DRM_FILE_OFFSET);
                 qxl_fence_remove_release(&bo->fence, release->id);
                 qxl_bo_unref(&bo);
+                kfree(entry);
         }
         spin_lock(&qdev->release_idr_lock);
         idr_remove(&qdev->release_idr, release->id);
diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
index 0652ee0a2098..f685035dbe39 100644
--- a/drivers/gpu/drm/radeon/atombios_i2c.c
+++ b/drivers/gpu/drm/radeon/atombios_i2c.c
@@ -44,7 +44,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
         PROCESS_I2C_CHANNEL_TRANSACTION_PS_ALLOCATION args;
         int index = GetIndexIntoMasterTable(COMMAND, ProcessI2cChannelTransaction);
         unsigned char *base;
-        u16 out;
+        u16 out = cpu_to_le16(0);
 
         memset(&args, 0, sizeof(args));
 
@@ -55,11 +55,14 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
                         DRM_ERROR("hw i2c: tried to write too many bytes (%d vs 3)\n", num);
                         return -EINVAL;
                 }
-                args.ucRegIndex = buf[0];
-                if (num > 1) {
+                if (buf == NULL)
+                        args.ucRegIndex = 0;
+                else
+                        args.ucRegIndex = buf[0];
+                if (num)
                         num--;
+                if (num)
                         memcpy(&out, &buf[1], num);
-                }
                 args.lpI2CDataOut = cpu_to_le16(out);
         } else {
                 if (num > ATOM_MAX_HW_I2C_READ) {
@@ -96,14 +99,14 @@ int radeon_atom_hw_i2c_xfer(struct i2c_adapter *i2c_adap,
         struct radeon_i2c_chan *i2c = i2c_get_adapdata(i2c_adap);
         struct i2c_msg *p;
         int i, remaining, current_count, buffer_offset, max_bytes, ret;
-        u8 buf = 0, flags;
+        u8 flags;
 
         /* check for bus probe */
         p = &msgs[0];
         if ((num == 1) && (p->len == 0)) {
                 ret = radeon_process_i2c_ch(i2c,
                                             p->addr, HW_I2C_WRITE,
-                                            &buf, 1);
+                                            NULL, 0);
                 if (ret)
                         return ret;
                 else
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 009f46e0ce72..de86493cbc44 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -93,11 +93,13 @@ void dce6_afmt_select_pin(struct drm_encoder *encoder)
         struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        u32 offset = dig->afmt->offset;
+        u32 offset;
 
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                 return;
 
+        offset = dig->afmt->offset;
+
         WREG32(AFMT_AUDIO_SRC_CONTROL + offset,
                AFMT_AUDIO_SRC_SELECT(dig->afmt->pin->id));
 }
@@ -112,7 +114,7 @@ void dce6_afmt_write_latency_fields(struct drm_encoder *encoder,
         struct radeon_connector *radeon_connector = NULL;
         u32 tmp = 0, offset;
 
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                 return;
 
         offset = dig->afmt->pin->offset;
@@ -156,7 +158,7 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         u8 *sadb;
         int sad_count;
 
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                 return;
 
         offset = dig->afmt->pin->offset;
@@ -217,7 +219,7 @@ void dce6_afmt_write_sad_regs(struct drm_encoder *encoder)
                 { AZ_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13, HDMI_AUDIO_CODING_TYPE_WMA_PRO },
         };
 
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                 return;
 
         offset = dig->afmt->pin->offset;
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index cdc003085a76..49c4d48f54d6 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -785,8 +785,8 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
         struct ni_ps *ps = ni_get_ps(rps);
         struct radeon_clock_and_voltage_limits *max_limits;
         bool disable_mclk_switching;
-        u32 mclk, sclk;
-        u16 vddc, vddci;
+        u32 mclk;
+        u16 vddci;
         u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
         int i;
 
@@ -839,24 +839,14 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
 
         /* XXX validate the min clocks required for display */
 
+        /* adjust low state */
         if (disable_mclk_switching) {
-                mclk  = ps->performance_levels[ps->performance_level_count - 1].mclk;
-                sclk = ps->performance_levels[0].sclk;
-                vddc = ps->performance_levels[0].vddc;
-                vddci = ps->performance_levels[ps->performance_level_count - 1].vddci;
-        } else {
-                sclk = ps->performance_levels[0].sclk;
-                mclk = ps->performance_levels[0].mclk;
-                vddc = ps->performance_levels[0].vddc;
-                vddci = ps->performance_levels[0].vddci;
+                ps->performance_levels[0].mclk =
+                        ps->performance_levels[ps->performance_level_count - 1].mclk;
+                ps->performance_levels[0].vddci =
+                        ps->performance_levels[ps->performance_level_count - 1].vddci;
         }
 
-        /* adjusted low state */
-        ps->performance_levels[0].sclk = sclk;
-        ps->performance_levels[0].mclk = mclk;
-        ps->performance_levels[0].vddc = vddc;
-        ps->performance_levels[0].vddci = vddci;
-
         btc_skip_blacklist_clocks(rdev, max_limits->sclk, max_limits->mclk,
                                   &ps->performance_levels[0].sclk,
                                   &ps->performance_levels[0].mclk);
@@ -868,11 +858,15 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
                         ps->performance_levels[i].vddc = ps->performance_levels[i - 1].vddc;
         }
 
+        /* adjust remaining states */
         if (disable_mclk_switching) {
                 mclk = ps->performance_levels[0].mclk;
+                vddci = ps->performance_levels[0].vddci;
                 for (i = 1; i < ps->performance_level_count; i++) {
                         if (mclk < ps->performance_levels[i].mclk)
                                 mclk = ps->performance_levels[i].mclk;
+                        if (vddci < ps->performance_levels[i].vddci)
+                                vddci = ps->performance_levels[i].vddci;
                 }
                 for (i = 0; i < ps->performance_level_count; i++) {
                         ps->performance_levels[i].mclk = mclk;
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 4b89262f3f0e..b7d3ecba43e3 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -304,9 +304,9 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                         WREG32(DCCG_AUDIO_DTO1_MODULE, dto_modulo);
                         WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                 }
-        } else if (ASIC_IS_DCE3(rdev)) {
+        } else {
                 /* according to the reg specs, this should DCE3.2 only, but in
-                 * practice it seems to cover DCE3.0/3.1 as well.
+                 * practice it seems to cover DCE2.0/3.0/3.1 as well.
                  */
                 if (dig->dig_encoder == 0) {
                         WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
@@ -317,10 +317,6 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                         WREG32(DCCG_AUDIO_DTO1_MODULE, clock * 100);
                         WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                 }
-        } else {
-                /* according to the reg specs, this should be DCE2.0 and DCE3.0/3.1 */
-                WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
-                       AUDIO_DTO_MODULE(clock / 10));
         }
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index ecf2a3960c07..b1f990d0eaa1 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -2710,10 +2710,10 @@ void radeon_vm_fence(struct radeon_device *rdev,
                      struct radeon_vm *vm,
                      struct radeon_fence *fence);
 uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr);
-int radeon_vm_bo_update_pte(struct radeon_device *rdev,
-                            struct radeon_vm *vm,
-                            struct radeon_bo *bo,
-                            struct ttm_mem_reg *mem);
+int radeon_vm_bo_update(struct radeon_device *rdev,
+                        struct radeon_vm *vm,
+                        struct radeon_bo *bo,
+                        struct ttm_mem_reg *mem);
 void radeon_vm_bo_invalidate(struct radeon_device *rdev,
                              struct radeon_bo *bo);
 struct radeon_bo_va *radeon_vm_bo_find(struct radeon_vm *vm,
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index f79ee184ffd5..5c39bf7c3d88 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2918,7 +2918,7 @@ int radeon_atom_get_memory_pll_dividers(struct radeon_device *rdev,
                         mpll_param->dll_speed = args.ucDllSpeed;
                         mpll_param->bwcntl = args.ucBWCntl;
                         mpll_param->vco_mode =
-                                (args.ucPllCntlFlag & MPLL_CNTL_FLAG_VCO_MODE_MASK) ? 1 : 0;
+                                (args.ucPllCntlFlag & MPLL_CNTL_FLAG_VCO_MODE_MASK);
                         mpll_param->yclk_sel =
                                 (args.ucPllCntlFlag & MPLL_CNTL_FLAG_BYPASS_DQ_PLL) ? 1 : 0;
                         mpll_param->qdr =
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index f41594b2eeac..0b366169d64d 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -360,13 +360,13 @@ static int radeon_bo_vm_update_pte(struct radeon_cs_parser *parser,
         struct radeon_bo *bo;
         int r;
 
-        r = radeon_vm_bo_update_pte(rdev, vm, rdev->ring_tmp_bo.bo, &rdev->ring_tmp_bo.bo->tbo.mem);
+        r = radeon_vm_bo_update(rdev, vm, rdev->ring_tmp_bo.bo, &rdev->ring_tmp_bo.bo->tbo.mem);
         if (r) {
                 return r;
         }
         list_for_each_entry(lobj, &parser->validated, tv.head) {
                 bo = lobj->bo;
-                r = radeon_vm_bo_update_pte(parser->rdev, vm, bo, &bo->tbo.mem);
+                r = radeon_vm_bo_update(parser->rdev, vm, bo, &bo->tbo.mem);
                 if (r) {
                         return r;
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 543dcfae7e6f..00e0d449021c 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -108,9 +108,10 @@
  * 1.31- Add support for num Z pipes from GET_PARAM
  * 1.32- fixes for rv740 setup
  * 1.33- Add r6xx/r7xx const buffer support
+ * 1.34- fix evergreen/cayman GS register
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            33
+#define DRIVER_MINOR            34
 #define DRIVER_PATCHLEVEL       0
 
 long radeon_drm_ioctl(struct file *filp,
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 3044e504f4ec..96e440061bdb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -29,6 +29,7 @@
 #include <drm/radeon_drm.h>
 #include "radeon.h"
 #include "radeon_reg.h"
+#include "radeon_trace.h"
 
 /*
  * GART
@@ -737,6 +738,7 @@ struct radeon_fence *radeon_vm_grab_id(struct radeon_device *rdev,
         for (i = 0; i < 2; ++i) {
                 if (choices[i]) {
                         vm->id = choices[i];
+                        trace_radeon_vm_grab_id(vm->id, ring);
                         return rdev->vm_manager.active[choices[i]];
                 }
         }
@@ -1116,7 +1118,7 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
 }
 
 /**
- * radeon_vm_bo_update_pte - map a bo into the vm page table
+ * radeon_vm_bo_update - map a bo into the vm page table
  *
  * @rdev: radeon_device pointer
  * @vm: requested vm
@@ -1128,10 +1130,10 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
  *
  * Object have to be reserved & global and local mutex must be locked!
  */
-int radeon_vm_bo_update_pte(struct radeon_device *rdev,
-                            struct radeon_vm *vm,
-                            struct radeon_bo *bo,
-                            struct ttm_mem_reg *mem)
+int radeon_vm_bo_update(struct radeon_device *rdev,
+                        struct radeon_vm *vm,
+                        struct radeon_bo *bo,
+                        struct ttm_mem_reg *mem)
 {
         struct radeon_ib ib;
         struct radeon_bo_va *bo_va;
@@ -1176,6 +1178,8 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
                 bo_va->valid = false;
         }
 
+        trace_radeon_vm_bo_update(bo_va);
+
         nptes = radeon_bo_ngpu_pages(bo);
 
         /* assume two extra pdes in case the mapping overlaps the borders */
@@ -1257,7 +1261,7 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
         mutex_lock(&rdev->vm_manager.lock);
         mutex_lock(&bo_va->vm->mutex);
         if (bo_va->soffset) {
-                r = radeon_vm_bo_update_pte(rdev, bo_va->vm, bo_va->bo, NULL);
+                r = radeon_vm_bo_update(rdev, bo_va->vm, bo_va->bo, NULL);
         }
         mutex_unlock(&rdev->vm_manager.lock);
         list_del(&bo_va->vm_list);
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index d1385ccc672c..984097b907ef 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -537,8 +537,7 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
                                       struct device_attribute *attr,
                                       char *buf)
 {
-        struct drm_device *ddev = dev_get_drvdata(dev);
-        struct radeon_device *rdev = ddev->dev_private;
+        struct radeon_device *rdev = dev_get_drvdata(dev);
         int temp;
 
         if (rdev->asic->pm.get_temperature)
@@ -553,8 +552,7 @@ static ssize_t radeon_hwmon_show_temp_thresh(struct device *dev,
                                              struct device_attribute *attr,
                                              char *buf)
 {
-        struct drm_device *ddev = dev_get_drvdata(dev);
-        struct radeon_device *rdev = ddev->dev_private;
+        struct radeon_device *rdev = dev_get_drvdata(dev);
         int hyst = to_sensor_dev_attr(attr)->index;
         int temp;
 
@@ -566,23 +564,14 @@ static ssize_t radeon_hwmon_show_temp_thresh(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%d\n", temp);
 }
 
-static ssize_t radeon_hwmon_show_name(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
-{
-        return sprintf(buf, "radeon\n");
-}
-
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, radeon_hwmon_show_temp, NULL, 0);
 static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 0);
 static SENSOR_DEVICE_ATTR(temp1_crit_hyst, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 1);
-static SENSOR_DEVICE_ATTR(name, S_IRUGO, radeon_hwmon_show_name, NULL, 0);
 
 static struct attribute *hwmon_attributes[] = {
         &sensor_dev_attr_temp1_input.dev_attr.attr,
         &sensor_dev_attr_temp1_crit.dev_attr.attr,
         &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr,
-        &sensor_dev_attr_name.dev_attr.attr,
         NULL
 };
 
@@ -590,8 +579,7 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
                                         struct attribute *attr, int index)
 {
         struct device *dev = container_of(kobj, struct device, kobj);
-        struct drm_device *ddev = dev_get_drvdata(dev);
-        struct radeon_device *rdev = ddev->dev_private;
+        struct radeon_device *rdev = dev_get_drvdata(dev);
 
         /* Skip limit attributes if DPM is not enabled */
         if (rdev->pm.pm_method != PM_METHOD_DPM &&
@@ -607,11 +595,15 @@ static const struct attribute_group hwmon_attrgroup = {
         .is_visible = hwmon_attributes_visible,
 };
 
+static const struct attribute_group *hwmon_groups[] = {
+        &hwmon_attrgroup,
+        NULL
+};
+
 static int radeon_hwmon_init(struct radeon_device *rdev)
 {
         int err = 0;
-
-        rdev->pm.int_hwmon_dev = NULL;
+        struct device *hwmon_dev;
 
         switch (rdev->pm.int_thermal_type) {
         case THERMAL_TYPE_RV6XX:
@@ -624,20 +616,13 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
         case THERMAL_TYPE_KV:
                 if (rdev->asic->pm.get_temperature == NULL)
                         return err;
-                rdev->pm.int_hwmon_dev = hwmon_device_register(rdev->dev);
-                if (IS_ERR(rdev->pm.int_hwmon_dev)) {
-                        err = PTR_ERR(rdev->pm.int_hwmon_dev);
+                hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
+                                                              "radeon", rdev,
+                                                              hwmon_groups);
+                if (IS_ERR(hwmon_dev)) {
+                        err = PTR_ERR(hwmon_dev);
                         dev_err(rdev->dev,
                                 "Unable to register hwmon device: %d\n", err);
-                        break;
-                }
-                dev_set_drvdata(rdev->pm.int_hwmon_dev, rdev->ddev);
-                err = sysfs_create_group(&rdev->pm.int_hwmon_dev->kobj,
-                                         &hwmon_attrgroup);
-                if (err) {
-                        dev_err(rdev->dev,
-                                "Unable to create hwmon sysfs file: %d\n", err);
-                        hwmon_device_unregister(rdev->dev);
                 }
                 break;
         default:
@@ -647,14 +632,6 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
         return err;
 }
 
-static void radeon_hwmon_fini(struct radeon_device *rdev)
-{
-        if (rdev->pm.int_hwmon_dev) {
-                sysfs_remove_group(&rdev->pm.int_hwmon_dev->kobj, &hwmon_attrgroup);
-                hwmon_device_unregister(rdev->pm.int_hwmon_dev);
-        }
-}
-
 static void radeon_dpm_thermal_work_handler(struct work_struct *work)
 {
         struct radeon_device *rdev =
@@ -1337,8 +1314,6 @@ static void radeon_pm_fini_old(struct radeon_device *rdev)
 
         if (rdev->pm.power_state)
                 kfree(rdev->pm.power_state);
-
-        radeon_hwmon_fini(rdev);
 }
 
 static void radeon_pm_fini_dpm(struct radeon_device *rdev)
@@ -1358,8 +1333,6 @@ static void radeon_pm_fini_dpm(struct radeon_device *rdev)
 
         if (rdev->pm.power_state)
                 kfree(rdev->pm.power_state);
-
-        radeon_hwmon_fini(rdev);
 }
 
 void radeon_pm_fini(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/radeon_trace.h b/drivers/gpu/drm/radeon/radeon_trace.h
index 9f0e18172b6e..0473257d4078 100644
--- a/drivers/gpu/drm/radeon/radeon_trace.h
+++ b/drivers/gpu/drm/radeon/radeon_trace.h
@@ -47,6 +47,39 @@ TRACE_EVENT(radeon_cs,
                       __entry->fences)
 );
 
+TRACE_EVENT(radeon_vm_grab_id,
+            TP_PROTO(unsigned vmid, int ring),
+            TP_ARGS(vmid, ring),
+            TP_STRUCT__entry(
+                             __field(u32, vmid)
+                             __field(u32, ring)
+                             ),
+
+            TP_fast_assign(
+                           __entry->vmid = vmid;
+                           __entry->ring = ring;
+                           ),
+            TP_printk("vmid=%u, ring=%u", __entry->vmid, __entry->ring)
+);
+
+TRACE_EVENT(radeon_vm_bo_update,
+            TP_PROTO(struct radeon_bo_va *bo_va),
+            TP_ARGS(bo_va),
+            TP_STRUCT__entry(
+                             __field(u64, soffset)
+                             __field(u64, eoffset)
+                             __field(u32, flags)
+                             ),
+
+            TP_fast_assign(
+                           __entry->soffset = bo_va->soffset;
+                           __entry->eoffset = bo_va->eoffset;
+                           __entry->flags = bo_va->flags;
+                           ),
+            TP_printk("soffs=%010llx, eoffs=%010llx, flags=%08x",
+                      __entry->soffset, __entry->eoffset, __entry->flags)
+);
+
 TRACE_EVENT(radeon_vm_set_page,
             TP_PROTO(uint64_t pe, uint64_t addr, unsigned count,
                      uint32_t incr, uint32_t flags),
diff --git a/drivers/gpu/drm/radeon/reg_srcs/cayman b/drivers/gpu/drm/radeon/reg_srcs/cayman
index a072fa8c46b0..d46b58d078aa 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/cayman
+++ b/drivers/gpu/drm/radeon/reg_srcs/cayman
@@ -21,7 +21,7 @@ cayman 0x9400
 0x000089AC VGT_COMPUTE_THREAD_GOURP_SIZE
 0x000089B0 VGT_HS_OFFCHIP_PARAM
 0x00008A14 PA_CL_ENHANCE
-0x00008A60 PA_SC_LINE_STIPPLE_VALUE
+0x00008A60 PA_SU_LINE_STIPPLE_VALUE
 0x00008B10 PA_SC_LINE_STIPPLE_STATE
 0x00008BF0 PA_SC_ENHANCE
 0x00008D8C SQ_DYN_GPR_CNTL_PS_FLUSH_REQ
@@ -532,7 +532,7 @@ cayman 0x9400
 0x00028B84 PA_SU_POLY_OFFSET_FRONT_OFFSET
 0x00028B88 PA_SU_POLY_OFFSET_BACK_SCALE
 0x00028B8C PA_SU_POLY_OFFSET_BACK_OFFSET
-0x00028B74 VGT_GS_INSTANCE_CNT
+0x00028B90 VGT_GS_INSTANCE_CNT
 0x00028BD4 PA_SC_CENTROID_PRIORITY_0
 0x00028BD8 PA_SC_CENTROID_PRIORITY_1
 0x00028BDC PA_SC_LINE_CNTL
diff --git a/drivers/gpu/drm/radeon/reg_srcs/evergreen b/drivers/gpu/drm/radeon/reg_srcs/evergreen
index b912a37689bf..57745c8761c8 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/evergreen
+++ b/drivers/gpu/drm/radeon/reg_srcs/evergreen
@@ -22,7 +22,7 @@ evergreen 0x9400
 0x000089A4 VGT_COMPUTE_START_Z
 0x000089AC VGT_COMPUTE_THREAD_GOURP_SIZE
 0x00008A14 PA_CL_ENHANCE
-0x00008A60 PA_SC_LINE_STIPPLE_VALUE
+0x00008A60 PA_SU_LINE_STIPPLE_VALUE
 0x00008B10 PA_SC_LINE_STIPPLE_STATE
 0x00008BF0 PA_SC_ENHANCE
 0x00008D8C SQ_DYN_GPR_CNTL_PS_FLUSH_REQ
@@ -545,7 +545,7 @@ evergreen 0x9400
 0x00028B84 PA_SU_POLY_OFFSET_FRONT_OFFSET
 0x00028B88 PA_SU_POLY_OFFSET_BACK_SCALE
 0x00028B8C PA_SU_POLY_OFFSET_BACK_OFFSET
-0x00028B74 VGT_GS_INSTANCE_CNT
+0x00028B90 VGT_GS_INSTANCE_CNT
 0x00028C00 PA_SC_LINE_CNTL
 0x00028C08 PA_SU_VTX_CNTL
 0x00028C0C PA_CL_GB_VERT_CLIP_ADJ
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 6a64ccaa0695..a36736dab5e0 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3882,8 +3882,15 @@ static int si_mc_init(struct radeon_device *rdev)
         rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
         rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
         /* size in MB on si */
-        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
-        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
+        tmp = RREG32(CONFIG_MEMSIZE);
+        /* some boards may have garbage in the upper 16 bits */
+        if (tmp & 0xffff0000) {
+                DRM_INFO("Probable bad vram size: 0x%08x\n", tmp);
+                if (tmp & 0xffff)
+                        tmp &= 0xffff;
+        }
+        rdev->mc.mc_vram_size = tmp * 1024ULL * 1024ULL;
+        rdev->mc.real_vram_size = rdev->mc.mc_vram_size;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
         si_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 28e178137718..07eba596d458 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -135,11 +135,11 @@ int tegra_drm_submit(struct tegra_drm_context *context,
         unsigned int num_relocs = args->num_relocs;
         unsigned int num_waitchks = args->num_waitchks;
         struct drm_tegra_cmdbuf __user *cmdbufs =
-                (void * __user)(uintptr_t)args->cmdbufs;
+                (void __user *)(uintptr_t)args->cmdbufs;
         struct drm_tegra_reloc __user *relocs =
-                (void * __user)(uintptr_t)args->relocs;
+                (void __user *)(uintptr_t)args->relocs;
         struct drm_tegra_waitchk __user *waitchks =
-                (void * __user)(uintptr_t)args->waitchks;
+                (void __user *)(uintptr_t)args->waitchks;
         struct drm_tegra_syncpt syncpt;
         struct host1x_job *job;
         int err;
@@ -163,9 +163,10 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 struct drm_tegra_cmdbuf cmdbuf;
                 struct host1x_bo *bo;
 
-                err = copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf));
-                if (err)
+                if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
+                        err = -EFAULT;
                         goto fail;
+                }
 
                 bo = host1x_bo_lookup(drm, file, cmdbuf.handle);
                 if (!bo) {
@@ -178,10 +179,11 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 cmdbufs++;
         }
 
-        err = copy_from_user(job->relocarray, relocs,
-                             sizeof(*relocs) * num_relocs);
-        if (err)
+        if (copy_from_user(job->relocarray, relocs,
+                           sizeof(*relocs) * num_relocs)) {
+                err = -EFAULT;
                 goto fail;
+        }
 
         while (num_relocs--) {
                 struct host1x_reloc *reloc = &job->relocarray[num_relocs];
@@ -199,15 +201,17 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 }
         }
 
-        err = copy_from_user(job->waitchk, waitchks,
-                             sizeof(*waitchks) * num_waitchks);
-        if (err)
+        if (copy_from_user(job->waitchk, waitchks,
+                           sizeof(*waitchks) * num_waitchks)) {
+                err = -EFAULT;
                 goto fail;
+        }
 
-        err = copy_from_user(&syncpt, (void * __user)(uintptr_t)args->syncpts,
-                             sizeof(syncpt));
-        if (err)
+        if (copy_from_user(&syncpt, (void __user *)(uintptr_t)args->syncpts,
+                           sizeof(syncpt))) {
+                err = -EFAULT;
                 goto fail;
+        }
 
         job->is_addr_reg = context->client->ops->is_addr_reg;
         job->syncpt_incrs = syncpt.incrs;
@@ -573,7 +577,7 @@ static void tegra_debugfs_cleanup(struct drm_minor *minor)
 }
 #endif
 
-struct drm_driver tegra_drm_driver = {
+static struct drm_driver tegra_drm_driver = {
         .driver_features = DRIVER_MODESET | DRIVER_GEM,
         .load = tegra_drm_load,
         .unload = tegra_drm_unload,
diff --git a/drivers/gpu/drm/tegra/drm.h b/drivers/gpu/drm/tegra/drm.h
index fdfe259ed7f8..7da0b923131f 100644
--- a/drivers/gpu/drm/tegra/drm.h
+++ b/drivers/gpu/drm/tegra/drm.h
@@ -116,7 +116,7 @@ host1x_client_to_dc(struct host1x_client *client)
 
 static inline struct tegra_dc *to_tegra_dc(struct drm_crtc *crtc)
 {
-        return container_of(crtc, struct tegra_dc, base);
+        return crtc ? container_of(crtc, struct tegra_dc, base) : NULL;
 }
 
 static inline void tegra_dc_writel(struct tegra_dc *dc, unsigned long value,
diff --git a/drivers/gpu/drm/tegra/fb.c b/drivers/gpu/drm/tegra/fb.c
index 490f7719e317..a3835e7de184 100644
--- a/drivers/gpu/drm/tegra/fb.c
+++ b/drivers/gpu/drm/tegra/fb.c
@@ -247,7 +247,7 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
                  info->var.yoffset * fb->pitches[0];
 
         drm->mode_config.fb_base = (resource_size_t)bo->paddr;
-        info->screen_base = bo->vaddr + offset;
+        info->screen_base = (void __iomem *)bo->vaddr + offset;
         info->screen_size = size;
         info->fix.smem_start = (unsigned long)(bo->paddr + offset);
         info->fix.smem_len = size;
diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
index ba47ca4fb880..3b29018913a5 100644
--- a/drivers/gpu/drm/tegra/rgb.c
+++ b/drivers/gpu/drm/tegra/rgb.c
@@ -14,6 +14,8 @@
 
 struct tegra_rgb {
         struct tegra_output output;
+        struct tegra_dc *dc;
+
         struct clk *clk_parent;
         struct clk *clk;
 };
@@ -84,18 +86,18 @@ static void tegra_dc_write_regs(struct tegra_dc *dc,
 
 static int tegra_output_rgb_enable(struct tegra_output *output)
 {
-        struct tegra_dc *dc = to_tegra_dc(output->encoder.crtc);
+        struct tegra_rgb *rgb = to_rgb(output);
 
-        tegra_dc_write_regs(dc, rgb_enable, ARRAY_SIZE(rgb_enable));
+        tegra_dc_write_regs(rgb->dc, rgb_enable, ARRAY_SIZE(rgb_enable));
 
         return 0;
 }
 
 static int tegra_output_rgb_disable(struct tegra_output *output)
 {
-        struct tegra_dc *dc = to_tegra_dc(output->encoder.crtc);
+        struct tegra_rgb *rgb = to_rgb(output);
 
-        tegra_dc_write_regs(dc, rgb_disable, ARRAY_SIZE(rgb_disable));
+        tegra_dc_write_regs(rgb->dc, rgb_disable, ARRAY_SIZE(rgb_disable));
 
         return 0;
 }
@@ -146,6 +148,7 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
 
         rgb->output.dev = dc->dev;
         rgb->output.of_node = np;
+        rgb->dc = dc;
 
         err = tegra_output_probe(&rgb->output);
         if (err < 0)
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index 24ffbe990736..8d67b943ac05 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -125,6 +125,12 @@ static int udl_gem_get_pages(struct udl_gem_object *obj, gfp_t gfpmask)
 
 static void udl_gem_put_pages(struct udl_gem_object *obj)
 {
+        if (obj->base.import_attach) {
+                drm_free_large(obj->pages);
+                obj->pages = NULL;
+                return;
+        }
+
         drm_gem_put_pages(&obj->base, obj->pages, false, false);
         obj->pages = NULL;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
index 7776e6f0aef6..0489c6152482 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
@@ -150,6 +150,8 @@ struct vmw_ttm_tt {
         bool mapped;
 };
 
+const size_t vmw_tt_size = sizeof(struct vmw_ttm_tt);
+
 /**
  * Helper functions to advance a struct vmw_piter iterator.
  *
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index db85985c7086..20890ad8408b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -615,6 +615,7 @@ extern int vmw_mmap(struct file *filp, struct vm_area_struct *vma);
  * TTM buffer object driver - vmwgfx_buffer.c
  */
 
+extern const size_t vmw_tt_size;
 extern struct ttm_placement vmw_vram_placement;
 extern struct ttm_placement vmw_vram_ne_placement;
 extern struct ttm_placement vmw_vram_sys_placement;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ecb3d867b426..03f1c2038631 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -75,6 +75,7 @@ void vmw_display_unit_cleanup(struct vmw_display_unit *du)
                 vmw_surface_unreference(&du->cursor_surface);
         if (du->cursor_dmabuf)
                 vmw_dmabuf_unreference(&du->cursor_dmabuf);
+        drm_sysfs_connector_remove(&du->connector);
         drm_crtc_cleanup(&du->crtc);
         drm_encoder_cleanup(&du->encoder);
         drm_connector_cleanup(&du->connector);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 79f7e8e60529..a055a26819c2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -260,6 +260,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
                 connector->encoder = NULL;
                 encoder->crtc = NULL;
                 crtc->fb = NULL;
+                crtc->enabled = false;
 
                 vmw_ldu_del_active(dev_priv, ldu);
 
@@ -285,6 +286,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
         crtc->x = set->x;
         crtc->y = set->y;
         crtc->mode = *mode;
+        crtc->enabled = true;
 
         vmw_ldu_add_active(dev_priv, ldu, vfb);
 
@@ -369,6 +371,8 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
         encoder->possible_crtcs = (1 << unit);
         encoder->possible_clones = 0;
 
+        (void) drm_sysfs_connector_add(connector);
+
         drm_crtc_init(dev, crtc, &vmw_legacy_crtc_funcs);
 
         drm_mode_crtc_set_gamma_size(crtc, 256);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index efe2b74c5eb1..9b5ea2ac7ddf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -352,6 +352,38 @@ int vmw_user_lookup_handle(struct vmw_private *dev_priv,
 /**
  * Buffer management.
  */
+
+/**
+ * vmw_dmabuf_acc_size - Calculate the pinned memory usage of buffers
+ *
+ * @dev_priv: Pointer to a struct vmw_private identifying the device.
+ * @size: The requested buffer size.
+ * @user: Whether this is an ordinary dma buffer or a user dma buffer.
+ */
+static size_t vmw_dmabuf_acc_size(struct vmw_private *dev_priv, size_t size,
+                                  bool user)
+{
+        static size_t struct_size, user_struct_size;
+        size_t num_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+        size_t page_array_size = ttm_round_pot(num_pages * sizeof(void *));
+
+        if (unlikely(struct_size == 0)) {
+                size_t backend_size = ttm_round_pot(vmw_tt_size);
+
+                struct_size = backend_size +
+                        ttm_round_pot(sizeof(struct vmw_dma_buffer));
+                user_struct_size = backend_size +
+                        ttm_round_pot(sizeof(struct vmw_user_dma_buffer));
+        }
+
+        if (dev_priv->map_mode == vmw_dma_alloc_coherent)
+                page_array_size +=
+                        ttm_round_pot(num_pages * sizeof(dma_addr_t));
+
+        return ((user) ? user_struct_size : struct_size) +
+                page_array_size;
+}
+
 void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
 {
         struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
@@ -359,6 +391,13 @@ void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
         kfree(vmw_bo);
 }
 
+static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
+{
+        struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
+
+        ttm_prime_object_kfree(vmw_user_bo, prime);
+}
+
 int vmw_dmabuf_init(struct vmw_private *dev_priv,
                     struct vmw_dma_buffer *vmw_bo,
                     size_t size, struct ttm_placement *placement,
@@ -368,28 +407,23 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
         struct ttm_bo_device *bdev = &dev_priv->bdev;
         size_t acc_size;
         int ret;
+        bool user = (bo_free == &vmw_user_dmabuf_destroy);
 
-        BUG_ON(!bo_free);
+        BUG_ON(!bo_free && (!user && (bo_free != vmw_dmabuf_bo_free)));
 
-        acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct vmw_dma_buffer));
+        acc_size = vmw_dmabuf_acc_size(dev_priv, size, user);
         memset(vmw_bo, 0, sizeof(*vmw_bo));
 
         INIT_LIST_HEAD(&vmw_bo->res_list);
 
         ret = ttm_bo_init(bdev, &vmw_bo->base, size,
-                          ttm_bo_type_device, placement,
+                          (user) ? ttm_bo_type_device :
+                          ttm_bo_type_kernel, placement,
                           0, interruptible,
                           NULL, acc_size, NULL, bo_free);
         return ret;
 }
 
-static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
-{
-        struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
-
-        ttm_prime_object_kfree(vmw_user_bo, prime);
-}
-
 static void vmw_user_dmabuf_release(struct ttm_base_object **p_base)
 {
         struct vmw_user_dma_buffer *vmw_user_bo;
@@ -781,54 +815,55 @@ err_ref:
 }
 
 
+/**
+ * vmw_dumb_create - Create a dumb kms buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @args: Pointer to a struct drm_mode_create_dumb structure
+ *
+ * This is a driver callback for the core drm create_dumb functionality.
+ * Note that this is very similar to the vmw_dmabuf_alloc ioctl, except
+ * that the arguments have a different format.
+ */
 int vmw_dumb_create(struct drm_file *file_priv,
                     struct drm_device *dev,
                     struct drm_mode_create_dumb *args)
 {
         struct vmw_private *dev_priv = vmw_priv(dev);
         struct vmw_master *vmaster = vmw_master(file_priv->master);
-        struct vmw_user_dma_buffer *vmw_user_bo;
-        struct ttm_buffer_object *tmp;
+        struct vmw_dma_buffer *dma_buf;
         int ret;
 
         args->pitch = args->width * ((args->bpp + 7) / 8);
         args->size = args->pitch * args->height;
 
-        vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
-        if (vmw_user_bo == NULL)
-                return -ENOMEM;
-
         ret = ttm_read_lock(&vmaster->lock, true);
-        if (ret != 0) {
-                kfree(vmw_user_bo);
+        if (unlikely(ret != 0))
                 return ret;
-        }
 
-        ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
-                              &vmw_vram_sys_placement, true,
-                              &vmw_user_dmabuf_destroy);
-        if (ret != 0)
-                goto out_no_dmabuf;
-
-        tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
-        ret = ttm_prime_object_init(vmw_fpriv(file_priv)->tfile,
-                                    args->size,
-                                    &vmw_user_bo->prime,
-                                    false,
-                                    ttm_buffer_type,
-                                    &vmw_user_dmabuf_release, NULL);
+        ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
+                                    args->size, false, &args->handle,
+                                    &dma_buf);
         if (unlikely(ret != 0))
-                goto out_no_base_object;
-
-        args->handle = vmw_user_bo->prime.base.hash.key;
+                goto out_no_dmabuf;
 
-out_no_base_object:
-        ttm_bo_unref(&tmp);
+        vmw_dmabuf_unreference(&dma_buf);
 out_no_dmabuf:
         ttm_read_unlock(&vmaster->lock);
         return ret;
 }
 
+/**
+ * vmw_dumb_map_offset - Return the address space offset of a dumb buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @handle: Handle identifying the dumb buffer.
+ * @offset: The address space offset returned.
+ *
+ * This is a driver callback for the core drm dumb_map_offset functionality.
+ */
 int vmw_dumb_map_offset(struct drm_file *file_priv,
                         struct drm_device *dev, uint32_t handle,
                         uint64_t *offset)
@@ -846,6 +881,15 @@ int vmw_dumb_map_offset(struct drm_file *file_priv,
         return 0;
 }
 
+/**
+ * vmw_dumb_destroy - Destroy a dumb boffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @handle: Handle identifying the dumb buffer.
+ *
+ * This is a driver callback for the core drm dumb_destroy functionality.
+ */
 int vmw_dumb_destroy(struct drm_file *file_priv,
                      struct drm_device *dev,
                      uint32_t handle)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index 26387c3d5a21..22406c8651ea 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -310,6 +310,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
                 crtc->fb = NULL;
                 crtc->x = 0;
                 crtc->y = 0;
+                crtc->enabled = false;
 
                 vmw_sou_del_active(dev_priv, sou);
 
@@ -370,6 +371,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
                 crtc->fb = NULL;
                 crtc->x = 0;
                 crtc->y = 0;
+                crtc->enabled = false;
 
                 return ret;
         }
@@ -382,6 +384,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
         crtc->fb = fb;
         crtc->x = set->x;
         crtc->y = set->y;
+        crtc->enabled = true;
 
         return 0;
 }
@@ -464,6 +467,8 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
         encoder->possible_crtcs = (1 << unit);
         encoder->possible_clones = 0;
 
+        (void) drm_sysfs_connector_add(connector);
+
         drm_crtc_init(dev, crtc, &vmw_screen_object_crtc_funcs);
 
         drm_mode_crtc_set_gamma_size(crtc, 256);
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 509383f8be03..6a929591aa73 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -19,6 +19,7 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 
+#include "bus.h"
 #include "dev.h"
 
 static DEFINE_MUTEX(clients_lock);
@@ -257,7 +258,7 @@ static int host1x_unregister_client(struct host1x *host1x,
         return -ENODEV;
 }
 
-struct bus_type host1x_bus_type = {
+static struct bus_type host1x_bus_type = {
         .name = "host1x",
 };
 
@@ -301,7 +302,7 @@ static int host1x_device_add(struct host1x *host1x,
         device->dev.coherent_dma_mask = host1x->dev->coherent_dma_mask;
         device->dev.dma_mask = &device->dev.coherent_dma_mask;
         device->dev.release = host1x_device_release;
-        dev_set_name(&device->dev, driver->name);
+        dev_set_name(&device->dev, "%s", driver->name);
         device->dev.bus = &host1x_bus_type;
         device->dev.parent = host1x->dev;
 
diff --git a/drivers/gpu/host1x/hw/cdma_hw.c b/drivers/gpu/host1x/hw/cdma_hw.c
index 37e2a63241a9..6b09b71940c2 100644
--- a/drivers/gpu/host1x/hw/cdma_hw.c
+++ b/drivers/gpu/host1x/hw/cdma_hw.c
@@ -54,8 +54,8 @@ static void cdma_timeout_cpu_incr(struct host1x_cdma *cdma, u32 getptr,
                 u32 *p = (u32 *)((u32)pb->mapped + getptr);
                 *(p++) = HOST1X_OPCODE_NOP;
                 *(p++) = HOST1X_OPCODE_NOP;
-                dev_dbg(host1x->dev, "%s: NOP at 0x%x\n", __func__,
-                        pb->phys + getptr);
+                dev_dbg(host1x->dev, "%s: NOP at %#llx\n", __func__,
+                        (u64)pb->phys + getptr);
                 getptr = (getptr + 8) & (pb->size_bytes - 1);
         }
         wmb();
diff --git a/drivers/gpu/host1x/hw/debug_hw.c b/drivers/gpu/host1x/hw/debug_hw.c
index 640c75ca5a8b..f72c873eff81 100644
--- a/drivers/gpu/host1x/hw/debug_hw.c
+++ b/drivers/gpu/host1x/hw/debug_hw.c
@@ -163,8 +163,8 @@ static void show_channel_gathers(struct output *o, struct host1x_cdma *cdma)
                                 continue;
                         }
 
-                        host1x_debug_output(o, "    GATHER at %08x+%04x, %d words\n",
-                                            g->base, g->offset, g->words);
+                        host1x_debug_output(o, "    GATHER at %#llx+%04x, %d words\n",
+                                            (u64)g->base, g->offset, g->words);
 
                         show_gather(o, g->base + g->offset, g->words, cdma,
                                     g->base, mapped);
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 329fbb9b5976..34e2d39d4ce8 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -460,6 +460,7 @@ config HID_MULTITOUCH
           - Stantum multitouch panels
           - Touch International Panels
           - Unitec Panels
+          - Wistron optical touch panels
           - XAT optical touch panels
           - Xiroku optical touch panels
           - Zytronic touch panels
diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c
index a42e6a394c5e..0e6a42d37eb6 100644
--- a/drivers/hid/hid-appleir.c
+++ b/drivers/hid/hid-appleir.c
@@ -297,6 +297,9 @@ static int appleir_probe(struct hid_device *hid, const struct hid_device_id *id)
 
         appleir->hid = hid;
 
+        /* force input as some remotes bypass the input registration */
+        hid->quirks |= HID_QUIRK_HIDINPUT_FORCE;
+
         spin_lock_init(&appleir->lock);
         setup_timer(&appleir->key_up_timer,
                     key_up_tick, (unsigned long) appleir);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 8c10f2742233..253fe23ef7fe 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1723,6 +1723,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_MANTICORE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
@@ -1879,7 +1880,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
 
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
         { }
 };
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 76559629568c..f9304cb37154 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -489,6 +489,7 @@
 #define USB_VENDOR_ID_KYE               0x0458
 #define USB_DEVICE_ID_KYE_ERGO_525V     0x0087
 #define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE  0x0138
+#define USB_DEVICE_ID_GENIUS_MANTICORE  0x0153
 #define USB_DEVICE_ID_GENIUS_GX_IMPERATOR       0x4018
 #define USB_DEVICE_ID_KYE_GPEN_560      0x5003
 #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
@@ -640,7 +641,6 @@
 #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN    0x0003
 
 #define USB_VENDOR_ID_NINTENDO          0x057e
-#define USB_VENDOR_ID_NINTENDO2         0x054c
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE  0x0306
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE2 0x0330
 
@@ -902,6 +902,9 @@
 #define USB_DEVICE_ID_SUPER_DUAL_BOX_PRO 0x8802
 #define USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO 0x8804
 
+#define USB_VENDOR_ID_WISTRON           0x0fb8
+#define USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH             0x1109
+
 #define USB_VENDOR_ID_X_TENSIONS               0x1ae7
 #define USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE    0x9001
 
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index 73845120295e..e77696367591 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -342,6 +342,10 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83,
                                         "Genius Gx Imperator Keyboard");
                 break;
+        case USB_DEVICE_ID_GENIUS_MANTICORE:
+                rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
+                                        "Genius Manticore Keyboard");
+                break;
         }
         return rdesc;
 }
@@ -418,6 +422,14 @@ static int kye_probe(struct hid_device *hdev, const struct hid_device_id *id)
                         goto enabling_err;
                 }
                 break;
+        case USB_DEVICE_ID_GENIUS_MANTICORE:
+                /*
+                 * The manticore keyboard needs to have all the interfaces
+                 * opened at least once to be fully functional.
+                 */
+                if (hid_hw_open(hdev))
+                        hid_hw_close(hdev);
+                break;
         }
 
         return 0;
@@ -439,6 +451,8 @@ static const struct hid_device_id kye_devices[] = {
                                 USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                 USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+                                USB_DEVICE_ID_GENIUS_MANTICORE) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, kye_devices);
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index a2cedb8ae1c0..d83b1e8b505b 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1335,6 +1335,12 @@ static const struct hid_device_id mt_devices[] = {
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_UNITEC,
                         USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19) },
+
+        /* Wistron panels */
+        { .driver_data = MT_CLS_NSMU,
+                MT_USB_DEVICE(USB_VENDOR_ID_WISTRON,
+                        USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH) },
+
         /* XAT */
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_XAT,
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index a184e1921c11..8fab82829f8b 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -112,13 +112,15 @@ static int sensor_hub_get_physical_device_count(
 
 static void sensor_hub_fill_attr_info(
                 struct hid_sensor_hub_attribute_info *info,
-                s32 index, s32 report_id, s32 units, s32 unit_expo, s32 size)
+                s32 index, s32 report_id, struct hid_field *field)
 {
         info->index = index;
         info->report_id = report_id;
-        info->units = units;
-        info->unit_expo = unit_expo;
-        info->size = size/8;
+        info->units = field->unit;
+        info->unit_expo = field->unit_exponent;
+        info->size = (field->report_size * field->report_count)/8;
+        info->logical_minimum = field->logical_minimum;
+        info->logical_maximum = field->logical_maximum;
 }
 
 static struct hid_sensor_hub_callbacks *sensor_hub_get_callback(
@@ -325,9 +327,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
                         if (field->physical == usage_id &&
                                 field->logical == attr_usage_id) {
                                 sensor_hub_fill_attr_info(info, i, report->id,
-                                        field->unit, field->unit_exponent,
-                                        field->report_size *
-                                                        field->report_count);
+                                                          field);
                                 ret = 0;
                         } else {
                                 for (j = 0; j < field->maxusage; ++j) {
@@ -336,11 +336,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
                                         field->usage[j].collection_index ==
                                         collection_index) {
                                                 sensor_hub_fill_attr_info(info,
-                                                        i, report->id,
-                                                        field->unit,
-                                                        field->unit_exponent,
-                                                        field->report_size *
-                                                        field->report_count);
+                                                          i, report->id, field);
                                                 ret = 0;
                                                 break;
                                         }
@@ -573,6 +569,8 @@ static int sensor_hub_probe(struct hid_device *hdev,
                                         goto err_free_names;
                         }
                         sd->hid_sensor_hub_client_devs[
+                                sd->hid_sensor_client_cnt].id = PLATFORM_DEVID_AUTO;
+                        sd->hid_sensor_hub_client_devs[
                                 sd->hid_sensor_client_cnt].name = name;
                         sd->hid_sensor_hub_client_devs[
                                 sd->hid_sensor_client_cnt].platform_data =
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index da551d113762..098af2f84b8c 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -225,6 +225,13 @@ static const unsigned int buzz_keymap[] = {
 struct sony_sc {
         unsigned long quirks;
 
+#ifdef CONFIG_SONY_FF
+        struct work_struct rumble_worker;
+        struct hid_device *hdev;
+        __u8 left;
+        __u8 right;
+#endif
+
         void *extra;
 };
 
@@ -615,9 +622,9 @@ static void buzz_remove(struct hid_device *hdev)
 }
 
 #ifdef CONFIG_SONY_FF
-static int sony_play_effect(struct input_dev *dev, void *data,
-                            struct ff_effect *effect)
+static void sony_rumble_worker(struct work_struct *work)
 {
+        struct sony_sc *sc = container_of(work, struct sony_sc, rumble_worker);
         unsigned char buf[] = {
                 0x01,
                 0x00, 0xff, 0x00, 0xff, 0x00,
@@ -628,21 +635,28 @@ static int sony_play_effect(struct input_dev *dev, void *data,
                 0xff, 0x27, 0x10, 0x00, 0x32,
                 0x00, 0x00, 0x00, 0x00, 0x00
         };
-        __u8 left;
-        __u8 right;
+
+        buf[3] = sc->right;
+        buf[5] = sc->left;
+
+        sc->hdev->hid_output_raw_report(sc->hdev, buf, sizeof(buf),
+                                        HID_OUTPUT_REPORT);
+}
+
+static int sony_play_effect(struct input_dev *dev, void *data,
+                            struct ff_effect *effect)
+{
         struct hid_device *hid = input_get_drvdata(dev);
+        struct sony_sc *sc = hid_get_drvdata(hid);
 
         if (effect->type != FF_RUMBLE)
                 return 0;
 
-        left = effect->u.rumble.strong_magnitude / 256;
-        right = effect->u.rumble.weak_magnitude ? 1 : 0;
-
-        buf[3] = right;
-        buf[5] = left;
+        sc->left = effect->u.rumble.strong_magnitude / 256;
+        sc->right = effect->u.rumble.weak_magnitude ? 1 : 0;
 
-        return hid->hid_output_raw_report(hid, buf, sizeof(buf),
-                                          HID_OUTPUT_REPORT);
+        schedule_work(&sc->rumble_worker);
+        return 0;
 }
 
 static int sony_init_ff(struct hid_device *hdev)
@@ -650,16 +664,31 @@ static int sony_init_ff(struct hid_device *hdev)
         struct hid_input *hidinput = list_entry(hdev->inputs.next,
                                                 struct hid_input, list);
         struct input_dev *input_dev = hidinput->input;
+        struct sony_sc *sc = hid_get_drvdata(hdev);
+
+        sc->hdev = hdev;
+        INIT_WORK(&sc->rumble_worker, sony_rumble_worker);
 
         input_set_capability(input_dev, EV_FF, FF_RUMBLE);
         return input_ff_create_memless(input_dev, NULL, sony_play_effect);
 }
 
+static void sony_destroy_ff(struct hid_device *hdev)
+{
+        struct sony_sc *sc = hid_get_drvdata(hdev);
+
+        cancel_work_sync(&sc->rumble_worker);
+}
+
 #else
 static int sony_init_ff(struct hid_device *hdev)
 {
         return 0;
 }
+
+static void sony_destroy_ff(struct hid_device *hdev)
+{
+}
 #endif
 
 static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
@@ -728,6 +757,8 @@ static void sony_remove(struct hid_device *hdev)
         if (sc->quirks & BUZZ_CONTROLLER)
                 buzz_remove(hdev);
 
+        sony_destroy_ff(hdev);
+
         hid_hw_stop(hdev);
 }
 
diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
index 1446f526ee8b..abb20db2b443 100644
--- a/drivers/hid/hid-wiimote-core.c
+++ b/drivers/hid/hid-wiimote-core.c
@@ -834,8 +834,7 @@ static void wiimote_init_set_type(struct wiimote_data *wdata,
                 goto done;
         }
 
-        if (vendor == USB_VENDOR_ID_NINTENDO ||
-            vendor == USB_VENDOR_ID_NINTENDO2) {
+        if (vendor == USB_VENDOR_ID_NINTENDO) {
                 if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE) {
                         devtype = WIIMOTE_DEV_GEN10;
                         goto done;
@@ -1856,8 +1855,6 @@ static void wiimote_hid_remove(struct hid_device *hdev)
 static const struct hid_device_id wiimote_hid_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                 USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2,
-                                USB_DEVICE_ID_NINTENDO_WIIMOTE) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                 USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
         { }
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 93b00d76374c..cedc6da93c19 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -287,7 +287,7 @@ static int uhid_event_from_user(const char __user *buffer, size_t len,
                          */
                         struct uhid_create_req_compat *compat;
 
-                        compat = kmalloc(sizeof(*compat), GFP_KERNEL);
+                        compat = kzalloc(sizeof(*compat), GFP_KERNEL);
                         if (!compat)
                                 return -ENOMEM;
 
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 1d7ff46812c3..dafc63c6932d 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -18,7 +18,6 @@
 #include <linux/err.h>
 
 #include <acpi/acpi.h>
-#include <acpi/acpixf.h>
 #include <acpi/acpi_drivers.h>
 #include <acpi/acpi_bus.h>
 
diff --git a/drivers/hwmon/hih6130.c b/drivers/hwmon/hih6130.c
index 2dc37c7c6947..7d68a08baaa8 100644
--- a/drivers/hwmon/hih6130.c
+++ b/drivers/hwmon/hih6130.c
@@ -43,6 +43,7 @@
  * @last_update: time of last update (jiffies)
  * @temperature: cached temperature measurement value
  * @humidity: cached humidity measurement value
+ * @write_length: length for I2C measurement request
  */
 struct hih6130 {
         struct device *hwmon_dev;
@@ -51,6 +52,7 @@ struct hih6130 {
         unsigned long last_update;
         int temperature;
         int humidity;
+        size_t write_length;
 };
 
 /**
@@ -121,8 +123,15 @@ static int hih6130_update_measurements(struct i2c_client *client)
          */
         if (time_after(jiffies, hih6130->last_update + HZ) || !hih6130->valid) {
 
-                /* write to slave address, no data, to request a measurement */
-                ret = i2c_master_send(client, tmp, 0);
+                /*
+                 * Write to slave address to request a measurement.
+                 * According with the datasheet it should be with no data, but
+                 * for systems with I2C bus drivers that do not allow zero
+                 * length packets we write one dummy byte to allow sensor
+                 * measurements on them.
+                 */
+                tmp[0] = 0;
+                ret = i2c_master_send(client, tmp, hih6130->write_length);
                 if (ret < 0)
                         goto out;
 
@@ -252,6 +261,9 @@ static int hih6130_probe(struct i2c_client *client,
                 goto fail_remove_sysfs;
         }
 
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_QUICK))
+                hih6130->write_length = 1;
+
         return 0;
 
 fail_remove_sysfs:
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index 6cf6bff79003..a2f3b4a365e4 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -94,6 +94,8 @@ static inline u8 FAN_TO_REG(long rpm, int div)
 {
         if (rpm <= 0)
                 return 255;
+        if (rpm > 1350000)
+                return 1;
         return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
 }
 
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 4c4c1421bf28..8b8f3aa49726 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -1610,12 +1610,14 @@ static int lm90_probe(struct i2c_client *client,
                                                 "lm90", client);
                 if (err < 0) {
                         dev_err(dev, "cannot request IRQ %d\n", client->irq);
-                        goto exit_remove_files;
+                        goto exit_unregister;
                 }
         }
 
         return 0;
 
+exit_unregister:
+        hwmon_device_unregister(data->hwmon_dev);
 exit_remove_files:
         lm90_remove_files(client, data);
 exit_restore:
diff --git a/drivers/hwmon/sis5595.c b/drivers/hwmon/sis5595.c
index 1404e6319deb..72a889702f0d 100644
--- a/drivers/hwmon/sis5595.c
+++ b/drivers/hwmon/sis5595.c
@@ -141,6 +141,8 @@ static inline u8 FAN_TO_REG(long rpm, int div)
 {
         if (rpm <= 0)
                 return 255;
+        if (rpm > 1350000)
+                return 1;
         return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
 }
 
diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c
index 0e7017841f7d..aee14e2192f8 100644
--- a/drivers/hwmon/vt8231.c
+++ b/drivers/hwmon/vt8231.c
@@ -145,7 +145,7 @@ static const u8 regtempmin[] = { 0x3a, 0x3e, 0x2c, 0x2e, 0x30, 0x32 };
  */
 static inline u8 FAN_TO_REG(long rpm, int div)
 {
-        if (rpm == 0)
+        if (rpm <= 0 || rpm > 1310720)
                 return 0;
         return clamp_val(1310720 / (rpm * div), 1, 255);
 }
diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index edb06cda5a68..6ed76ceb9270 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -481,9 +481,11 @@ store_pwm(struct device *dev, struct device_attribute *attr,
         if (err)
                 return err;
         val = clamp_val(val, 0, 255);
+        val = DIV_ROUND_CLOSEST(val, 0x11);
 
         mutex_lock(&data->update_lock);
-        data->pwm[nr] = val;
+        data->pwm[nr] = val * 0x11;
+        val |= w83l786ng_read_value(client, W83L786NG_REG_PWM[nr]) & 0xf0;
         w83l786ng_write_value(client, W83L786NG_REG_PWM[nr], val);
         mutex_unlock(&data->update_lock);
         return count;
@@ -510,7 +512,7 @@ store_pwm_enable(struct device *dev, struct device_attribute *attr,
         mutex_lock(&data->update_lock);
         reg = w83l786ng_read_value(client, W83L786NG_REG_FAN_CFG);
         data->pwm_enable[nr] = val;
-        reg &= ~(0x02 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
+        reg &= ~(0x03 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
         reg |= (val - 1) << W83L786NG_PWM_ENABLE_SHIFT[nr];
         w83l786ng_write_value(client, W83L786NG_REG_FAN_CFG, reg);
         mutex_unlock(&data->update_lock);
@@ -776,9 +778,10 @@ static struct w83l786ng_data *w83l786ng_update_device(struct device *dev)
                             ((pwmcfg >> W83L786NG_PWM_MODE_SHIFT[i]) & 1)
                             ? 0 : 1;
                         data->pwm_enable[i] =
-                            ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 2) + 1;
-                        data->pwm[i] = w83l786ng_read_value(client,
-                            W83L786NG_REG_PWM[i]);
+                            ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1;
+                        data->pwm[i] =
+                            (w83l786ng_read_value(client, W83L786NG_REG_PWM[i])
+                             & 0x0f) * 0x11;
                 }
 
 
diff --git a/drivers/i2c/busses/i2c-bcm-kona.c b/drivers/i2c/busses/i2c-bcm-kona.c
index 036cf03aeb61..18a74a6751a9 100644
--- a/drivers/i2c/busses/i2c-bcm-kona.c
+++ b/drivers/i2c/busses/i2c-bcm-kona.c
@@ -20,7 +20,6 @@
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/io.h>
-#include <linux/clk.h>
 #include <linux/slab.h>
 
 /* Hardware register offsets and field defintions */
@@ -891,7 +890,7 @@ static const struct of_device_id bcm_kona_i2c_of_match[] = {
         {.compatible = "brcm,kona-i2c",},
         {},
 };
-MODULE_DEVICE_TABLE(of, kona_i2c_of_match);
+MODULE_DEVICE_TABLE(of, bcm_kona_i2c_of_match);
 
 static struct platform_driver bcm_kona_i2c_driver = {
         .driver = {
diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index d7e8600f31fb..77df97b932af 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -299,6 +299,7 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
         strlcpy(adap->name, "bcm2835 I2C adapter", sizeof(adap->name));
         adap->algo = &bcm2835_i2c_algo;
         adap->dev.parent = &pdev->dev;
+        adap->dev.of_node = pdev->dev.of_node;
 
         bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0);
 
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index ff05d9fef4a8..af0b5830303d 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -125,12 +125,12 @@ static struct davinci_i2c_platform_data davinci_i2c_platform_data_default = {
 static inline void davinci_i2c_write_reg(struct davinci_i2c_dev *i2c_dev,
                                          int reg, u16 val)
 {
-        __raw_writew(val, i2c_dev->base + reg);
+        writew_relaxed(val, i2c_dev->base + reg);
 }
 
 static inline u16 davinci_i2c_read_reg(struct davinci_i2c_dev *i2c_dev, int reg)
 {
-        return __raw_readw(i2c_dev->base + reg);
+        return readw_relaxed(i2c_dev->base + reg);
 }
 
 /* Generate a pulse on the i2c clock pin. */
diff --git a/drivers/i2c/busses/i2c-diolan-u2c.c b/drivers/i2c/busses/i2c-diolan-u2c.c
index dae3ddfe7619..721f7ebf9a3b 100644
--- a/drivers/i2c/busses/i2c-diolan-u2c.c
+++ b/drivers/i2c/busses/i2c-diolan-u2c.c
@@ -25,8 +25,6 @@
 #define USB_VENDOR_ID_DIOLAN            0x0abf
 #define USB_DEVICE_ID_DIOLAN_U2C        0x3370
 
-#define DIOLAN_OUT_EP           0x02
-#define DIOLAN_IN_EP            0x84
 
 /* commands via USB, must match command ids in the firmware */
 #define CMD_I2C_READ            0x01
@@ -84,6 +82,7 @@
 struct i2c_diolan_u2c {
         u8 obuffer[DIOLAN_OUTBUF_LEN];  /* output buffer */
         u8 ibuffer[DIOLAN_INBUF_LEN];   /* input buffer */
+        int ep_in, ep_out;              /* Endpoints    */
         struct usb_device *usb_dev;     /* the usb device for this device */
         struct usb_interface *interface;/* the interface for this device */
         struct i2c_adapter adapter;     /* i2c related things */
@@ -109,7 +108,7 @@ static int diolan_usb_transfer(struct i2c_diolan_u2c *dev)
                 return -EINVAL;
 
         ret = usb_bulk_msg(dev->usb_dev,
-                           usb_sndbulkpipe(dev->usb_dev, DIOLAN_OUT_EP),
+                           usb_sndbulkpipe(dev->usb_dev, dev->ep_out),
                            dev->obuffer, dev->olen, &actual,
                            DIOLAN_USB_TIMEOUT);
         if (!ret) {
@@ -118,7 +117,7 @@ static int diolan_usb_transfer(struct i2c_diolan_u2c *dev)
 
                         tmpret = usb_bulk_msg(dev->usb_dev,
                                               usb_rcvbulkpipe(dev->usb_dev,
-                                                              DIOLAN_IN_EP),
+                                                              dev->ep_in),
                                               dev->ibuffer,
                                               sizeof(dev->ibuffer), &actual,
                                               DIOLAN_USB_TIMEOUT);
@@ -210,7 +209,7 @@ static void diolan_flush_input(struct i2c_diolan_u2c *dev)
                 int ret;
 
                 ret = usb_bulk_msg(dev->usb_dev,
-                                   usb_rcvbulkpipe(dev->usb_dev, DIOLAN_IN_EP),
+                                   usb_rcvbulkpipe(dev->usb_dev, dev->ep_in),
                                    dev->ibuffer, sizeof(dev->ibuffer), &actual,
                                    DIOLAN_USB_TIMEOUT);
                 if (ret < 0 || actual == 0)
@@ -445,9 +444,14 @@ static void diolan_u2c_free(struct i2c_diolan_u2c *dev)
 static int diolan_u2c_probe(struct usb_interface *interface,
                             const struct usb_device_id *id)
 {
+        struct usb_host_interface *hostif = interface->cur_altsetting;
         struct i2c_diolan_u2c *dev;
         int ret;
 
+        if (hostif->desc.bInterfaceNumber != 0
+            || hostif->desc.bNumEndpoints < 2)
+                return -ENODEV;
+
         /* allocate memory for our device state and initialize it */
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (dev == NULL) {
@@ -455,6 +459,8 @@ static int diolan_u2c_probe(struct usb_interface *interface,
                 ret = -ENOMEM;
                 goto error;
         }
+        dev->ep_out = hostif->endpoint[0].desc.bEndpointAddress;
+        dev->ep_in = hostif->endpoint[1].desc.bEndpointAddress;
 
         dev->usb_dev = usb_get_dev(interface_to_usbdev(interface));
         dev->interface = interface;
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 1d7efa3169cd..d0cfbb4cb964 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -312,7 +312,9 @@ static int i2c_imx_start(struct imx_i2c_struct *i2c_imx)
 
         dev_dbg(&i2c_imx->adapter.dev, "<%s>\n", __func__);
 
-        clk_prepare_enable(i2c_imx->clk);
+        result = clk_prepare_enable(i2c_imx->clk);
+        if (result)
+                return result;
         imx_i2c_write_reg(i2c_imx->ifdr, i2c_imx, IMX_I2C_IFDR);
         /* Enable I2C controller */
         imx_i2c_write_reg(i2c_imx->hwdata->i2sr_clr_opcode, i2c_imx, IMX_I2C_I2SR);
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index a6a891d7970d..90dcc2eaac5f 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -266,13 +266,13 @@ static const u8 reg_map_ip_v2[] = {
 static inline void omap_i2c_write_reg(struct omap_i2c_dev *i2c_dev,
                                       int reg, u16 val)
 {
-        __raw_writew(val, i2c_dev->base +
+        writew_relaxed(val, i2c_dev->base +
                         (i2c_dev->regs[reg] << i2c_dev->reg_shift));
 }
 
 static inline u16 omap_i2c_read_reg(struct omap_i2c_dev *i2c_dev, int reg)
 {
-        return __raw_readw(i2c_dev->base +
+        return readw_relaxed(i2c_dev->base +
                                 (i2c_dev->regs[reg] << i2c_dev->reg_shift));
 }
 
@@ -1037,6 +1037,20 @@ static const struct i2c_algorithm omap_i2c_algo = {
 };
 
 #ifdef CONFIG_OF
+static struct omap_i2c_bus_platform_data omap2420_pdata = {
+        .rev = OMAP_I2C_IP_VERSION_1,
+        .flags = OMAP_I2C_FLAG_NO_FIFO |
+                        OMAP_I2C_FLAG_SIMPLE_CLOCK |
+                        OMAP_I2C_FLAG_16BIT_DATA_REG |
+                        OMAP_I2C_FLAG_BUS_SHIFT_2,
+};
+
+static struct omap_i2c_bus_platform_data omap2430_pdata = {
+        .rev = OMAP_I2C_IP_VERSION_1,
+        .flags = OMAP_I2C_FLAG_BUS_SHIFT_2 |
+                        OMAP_I2C_FLAG_FORCE_19200_INT_CLK,
+};
+
 static struct omap_i2c_bus_platform_data omap3_pdata = {
         .rev = OMAP_I2C_IP_VERSION_1,
         .flags = OMAP_I2C_FLAG_BUS_SHIFT_2,
@@ -1055,6 +1069,14 @@ static const struct of_device_id omap_i2c_of_match[] = {
                 .compatible = "ti,omap3-i2c",
                 .data = &omap3_pdata,
         },
+        {
+                .compatible = "ti,omap2430-i2c",
+                .data = &omap2430_pdata,
+        },
+        {
+                .compatible = "ti,omap2420-i2c",
+                .data = &omap2420_pdata,
+        },
         { },
 };
 MODULE_DEVICE_TABLE(of, omap_i2c_of_match);
@@ -1140,9 +1162,9 @@ omap_i2c_probe(struct platform_device *pdev)
          * Read the Rev hi bit-[15:14] ie scheme this is 1 indicates ver2.
          * On omap1/3/2 Offset 4 is IE Reg the bit [15:14] is 0 at reset.
          * Also since the omap_i2c_read_reg uses reg_map_ip_* a
-         * raw_readw is done.
+         * readw_relaxed is done.
          */
-        rev = __raw_readw(dev->base + 0x04);
+        rev = readw_relaxed(dev->base + 0x04);
 
         dev->scheme = OMAP_I2C_SCHEME(rev);
         switch (dev->scheme) {
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 797e3117bef7..2d0847b6be62 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -139,6 +139,8 @@ struct i2c_adapter *i2c_add_mux_adapter(struct i2c_adapter *parent,
         priv->adap.algo = &priv->algo;
         priv->adap.algo_data = priv;
         priv->adap.dev.parent = &parent->dev;
+        priv->adap.retries = parent->retries;
+        priv->adap.timeout = parent->timeout;
 
         /* Sanity check on class */
         if (i2c_mux_parent_classes(parent) & class)
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index cbd4e9abc47e..92d1206482a6 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -329,7 +329,7 @@ static struct cpuidle_state atom_cstates[] __initdata = {
         {
                 .enter = NULL }
 };
-static struct cpuidle_state avn_cstates[CPUIDLE_STATE_MAX] = {
+static struct cpuidle_state avn_cstates[] __initdata = {
         {
                 .name = "C1-AVN",
                 .desc = "MWAIT 0x00",
@@ -340,7 +340,7 @@ static struct cpuidle_state avn_cstates[CPUIDLE_STATE_MAX] = {
         {
                 .name = "C6-AVN",
                 .desc = "MWAIT 0x51",
-                .flags = MWAIT2flg(0x58) | CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
+                .flags = MWAIT2flg(0x51) | CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                 .exit_latency = 15,
                 .target_residency = 45,
                 .enter = &intel_idle },
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index dcda17395c4e..1cae4e920c9b 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -350,7 +350,7 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&accel_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -363,10 +363,11 @@ static int hid_accel_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct accel_3d_state *accel_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_ACCEL_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&accel_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index d72118d1189c..98ba761cbb9c 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -112,9 +112,10 @@ static int kxsd9_read(struct iio_dev *indio_dev, u8 address)
         mutex_lock(&st->buf_lock);
         st->tx[0] = KXSD9_READ(address);
         ret = spi_sync_transfer(st->us, xfers, ARRAY_SIZE(xfers));
-        if (ret)
-                return ret;
-        return (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
+        if (!ret)
+                ret = (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
+        mutex_unlock(&st->buf_lock);
+        return ret;
 }
 
 static IIO_CONST_ATTR(accel_scale_available,
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 17df74908db1..5b1aa027c034 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -1047,6 +1047,7 @@ static int at91_adc_probe(struct platform_device *pdev)
         } else {
                 if (!st->caps->has_tsmr) {
                         dev_err(&pdev->dev, "We don't support non-TSMR adc\n");
+                        ret = -ENODEV;
                         goto error_disable_adc_clk;
                 }
 
diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
index 12948325431c..c8c1baaec6c1 100644
--- a/drivers/iio/adc/mcp3422.c
+++ b/drivers/iio/adc/mcp3422.c
@@ -88,10 +88,10 @@ static const int mcp3422_sample_rates[4] = {
 
 /* sample rates to sign extension table */
 static const int mcp3422_sign_extend[4] = {
-        [MCP3422_SRATE_240] = 12,
-        [MCP3422_SRATE_60] = 14,
-        [MCP3422_SRATE_15] = 16,
-        [MCP3422_SRATE_3] = 18 };
+        [MCP3422_SRATE_240] = 11,
+        [MCP3422_SRATE_60] = 13,
+        [MCP3422_SRATE_15] = 15,
+        [MCP3422_SRATE_3] = 17 };
 
 /* Client data (each client gets its own) */
 struct mcp3422 {
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 728411ec7642..d4d748214e4b 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -229,12 +229,15 @@ static int tiadc_iio_buffered_hardware_setup(struct iio_dev *indio_dev,
         unsigned long flags,
         const struct iio_buffer_setup_ops *setup_ops)
 {
+        struct iio_buffer *buffer;
         int ret;
 
-        indio_dev->buffer = iio_kfifo_allocate(indio_dev);
-        if (!indio_dev->buffer)
+        buffer = iio_kfifo_allocate(indio_dev);
+        if (!buffer)
                 return -ENOMEM;
 
+        iio_device_attach_buffer(indio_dev, buffer);
+
         ret = request_threaded_irq(irq, pollfunc_th, pollfunc_bh,
                                 flags, indio_dev->name, indio_dev);
         if (ret)
diff --git a/drivers/iio/common/hid-sensors/Kconfig b/drivers/iio/common/hid-sensors/Kconfig
index 1178121b55b0..39188b72cd3b 100644
--- a/drivers/iio/common/hid-sensors/Kconfig
+++ b/drivers/iio/common/hid-sensors/Kconfig
@@ -25,13 +25,4 @@ config HID_SENSOR_IIO_TRIGGER
           If this driver is compiled as a module, it will be named
           hid-sensor-trigger.
 
-config HID_SENSOR_ENUM_BASE_QUIRKS
-        bool "ENUM base quirks for HID Sensor IIO drivers"
-        depends on HID_SENSOR_IIO_COMMON
-        help
-          Say yes here to build support for sensor hub FW using
-          enumeration, which is using 1 as base instead of 0.
-          Since logical minimum is still set 0 instead of 1,
-          there is no easy way to differentiate.
-
 endmenu
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index b6e77e0fc420..7dcf83998e6f 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -33,33 +33,42 @@ static int hid_sensor_data_rdy_trigger_set_state(struct iio_trigger *trig,
 {
         struct hid_sensor_common *st = iio_trigger_get_drvdata(trig);
         int state_val;
+        int report_val;
 
         if (state) {
                 if (sensor_hub_device_open(st->hsdev))
                         return -EIO;
-        } else
+                state_val =
+                HID_USAGE_SENSOR_PROP_POWER_STATE_D0_FULL_POWER_ENUM;
+                report_val =
+                HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM;
+
+        } else {
                 sensor_hub_device_close(st->hsdev);
+                state_val =
+                HID_USAGE_SENSOR_PROP_POWER_STATE_D4_POWER_OFF_ENUM;
+                report_val =
+                HID_USAGE_SENSOR_PROP_REPORTING_STATE_NO_EVENTS_ENUM;
+        }
 
-        state_val = state ? 1 : 0;
-        if (IS_ENABLED(CONFIG_HID_SENSOR_ENUM_BASE_QUIRKS))
-                ++state_val;
         st->data_ready = state;
+        state_val += st->power_state.logical_minimum;
+        report_val += st->report_state.logical_minimum;
         sensor_hub_set_feature(st->hsdev, st->power_state.report_id,
                                         st->power_state.index,
                                         (s32)state_val);
 
         sensor_hub_set_feature(st->hsdev, st->report_state.report_id,
                                         st->report_state.index,
-                                        (s32)state_val);
+                                        (s32)report_val);
 
         return 0;
 }
 
-void hid_sensor_remove_trigger(struct iio_dev *indio_dev)
+void hid_sensor_remove_trigger(struct hid_sensor_common *attrb)
 {
-        iio_trigger_unregister(indio_dev->trig);
-        iio_trigger_free(indio_dev->trig);
-        indio_dev->trig = NULL;
+        iio_trigger_unregister(attrb->trigger);
+        iio_trigger_free(attrb->trigger);
 }
 EXPORT_SYMBOL(hid_sensor_remove_trigger);
 
@@ -90,7 +99,7 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
                 dev_err(&indio_dev->dev, "Trigger Register Failed\n");
                 goto error_free_trig;
         }
-        indio_dev->trig = trig;
+        indio_dev->trig = attrb->trigger = trig;
 
         return ret;
 
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
index 9a8731478eda..ca02f7811aa8 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
@@ -21,6 +21,6 @@
 
 int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
                                 struct hid_sensor_common *attrb);
-void hid_sensor_remove_trigger(struct iio_dev *indio_dev);
+void hid_sensor_remove_trigger(struct hid_sensor_common *attrb);
 
 #endif
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index ea01c6bcfb56..e54f0f4959d3 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -348,7 +348,7 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&gyro_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -361,10 +361,11 @@ static int hid_gyro_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&gyro_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index f98c2b509254..a022f27c6690 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -43,6 +43,7 @@ config GP2AP020A00F
         depends on I2C
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
+        select IRQ_WORK
         help
           Say Y here if you have a Sharp GP2AP020A00F proximity/ALS combo-chip
           hooked to an I2C bus.
@@ -81,6 +82,8 @@ config SENSORS_LM3533
 config TCS3472
         tristate "TAOS TCS3472 color light-to-digital converter"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
          If you say yes here you get support for the TAOS TCS3472
          family of color light-to-digital converters with IR filter.
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index fa6ae8cf89ea..8e8b9d722853 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -314,7 +314,7 @@ static int hid_als_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&als_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -327,10 +327,11 @@ static int hid_als_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct als_state *als_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_ALS);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&als_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index 0cf09637b35b..d86d226dcd67 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -19,6 +19,8 @@ config AK8975
 config MAG3110
         tristate "Freescale MAG3110 3-Axis Magnetometer"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say yes here to build support for the Freescale MAG3110 3-Axis
           magnetometer.
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index 2634920562fb..b26e1028a0a0 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -351,7 +351,7 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&magn_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -364,10 +364,11 @@ static int hid_magn_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct magn_3d_state *magn_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_COMPASS_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&magn_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
index 783c5b417356..becf54496967 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -250,7 +250,12 @@ done:
         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SAMP_FREQ) | \
                 BIT(IIO_CHAN_INFO_SCALE), \
         .scan_index = idx, \
-        .scan_type = IIO_ST('s', 16, 16, IIO_BE), \
+        .scan_type = { \
+                .sign = 's', \
+                .realbits = 16, \
+                .storagebits = 16, \
+                .endianness = IIO_BE, \
+        }, \
 }
 
 static const struct iio_chan_spec mag3110_channels[] = {
diff --git a/drivers/input/keyboard/adp5588-keys.c b/drivers/input/keyboard/adp5588-keys.c
index dbd2047f1641..3ed23513d881 100644
--- a/drivers/input/keyboard/adp5588-keys.c
+++ b/drivers/input/keyboard/adp5588-keys.c
@@ -536,7 +536,8 @@ static int adp5588_probe(struct i2c_client *client,
                 __set_bit(EV_REP, input->evbit);
 
         for (i = 0; i < input->keycodemax; i++)
-                __set_bit(kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(kpad->keycode[i], input->keybit);
         __clear_bit(KEY_RESERVED, input->keybit);
 
         if (kpad->gpimapsize)
diff --git a/drivers/input/keyboard/adp5589-keys.c b/drivers/input/keyboard/adp5589-keys.c
index 67d12b3427c9..60dafd4fa692 100644
--- a/drivers/input/keyboard/adp5589-keys.c
+++ b/drivers/input/keyboard/adp5589-keys.c
@@ -992,7 +992,8 @@ static int adp5589_probe(struct i2c_client *client,
                 __set_bit(EV_REP, input->evbit);
 
         for (i = 0; i < input->keycodemax; i++)
-                __set_bit(kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(kpad->keycode[i], input->keybit);
         __clear_bit(KEY_RESERVED, input->keybit);
 
         if (kpad->gpimapsize)
diff --git a/drivers/input/keyboard/bf54x-keys.c b/drivers/input/keyboard/bf54x-keys.c
index fc88fb48d70d..09b91d093087 100644
--- a/drivers/input/keyboard/bf54x-keys.c
+++ b/drivers/input/keyboard/bf54x-keys.c
@@ -289,7 +289,8 @@ static int bfin_kpad_probe(struct platform_device *pdev)
                 __set_bit(EV_REP, input->evbit);
 
         for (i = 0; i < input->keycodemax; i++)
-                __set_bit(bf54x_kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (bf54x_kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(bf54x_kpad->keycode[i], input->keybit);
         __clear_bit(KEY_RESERVED, input->keybit);
 
         error = input_register_device(input);
diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index 0735de3a6468..1cb1da294419 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -158,7 +158,7 @@
 
 /* ORIENT ADXL346 only */
 #define ADXL346_2D_VALID                (1 << 6)
-#define ADXL346_2D_ORIENT(x)            (((x) & 0x3) >> 4)
+#define ADXL346_2D_ORIENT(x)            (((x) & 0x30) >> 4)
 #define ADXL346_3D_VALID                (1 << 3)
 #define ADXL346_3D_ORIENT(x)            ((x) & 0x7)
 #define ADXL346_2D_PORTRAIT_POS         0       /* +X */
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index 86b822806e95..45e0e3e55de2 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -180,7 +180,10 @@ static int64_t hp_sdc_rtc_read_i8042timer (uint8_t loadcmd, int numreg)
         if (WARN_ON(down_interruptible(&i8042tregs)))
                 return -1;
 
-        if (hp_sdc_enqueue_transaction(&t)) return -1;
+        if (hp_sdc_enqueue_transaction(&t)) {
+                up(&i8042tregs);
+                return -1;
+        }
         
         /* Sleep until results come back. */
         if (WARN_ON(down_interruptible(&i8042tregs)))
diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
index e37392976fdd..0deca5a3c87f 100644
--- a/drivers/input/misc/pcf8574_keypad.c
+++ b/drivers/input/misc/pcf8574_keypad.c
@@ -113,9 +113,12 @@ static int pcf8574_kp_probe(struct i2c_client *client, const struct i2c_device_i
         idev->keycodemax = ARRAY_SIZE(lp->btncode);
 
         for (i = 0; i < ARRAY_SIZE(pcf8574_kp_btncode); i++) {
-                lp->btncode[i] = pcf8574_kp_btncode[i];
-                __set_bit(lp->btncode[i] & KEY_MAX, idev->keybit);
+                if (lp->btncode[i] <= KEY_MAX) {
+                        lp->btncode[i] = pcf8574_kp_btncode[i];
+                        __set_bit(lp->btncode[i], idev->keybit);
+                }
         }
+        __clear_bit(KEY_RESERVED, idev->keybit);
 
         sprintf(lp->name, DRV_NAME);
         sprintf(lp->phys, "kp_data/input0");
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index ca7a26f1dce8..5cf62e315218 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -70,6 +70,25 @@ static const struct alps_nibble_commands alps_v4_nibble_commands[] = {
         { PSMOUSE_CMD_SETSCALE11,       0x00 }, /* f */
 };
 
+static const struct alps_nibble_commands alps_v6_nibble_commands[] = {
+        { PSMOUSE_CMD_ENABLE,           0x00 }, /* 0 */
+        { PSMOUSE_CMD_SETRATE,          0x0a }, /* 1 */
+        { PSMOUSE_CMD_SETRATE,          0x14 }, /* 2 */
+        { PSMOUSE_CMD_SETRATE,          0x28 }, /* 3 */
+        { PSMOUSE_CMD_SETRATE,          0x3c }, /* 4 */
+        { PSMOUSE_CMD_SETRATE,          0x50 }, /* 5 */
+        { PSMOUSE_CMD_SETRATE,          0x64 }, /* 6 */
+        { PSMOUSE_CMD_SETRATE,          0xc8 }, /* 7 */
+        { PSMOUSE_CMD_GETID,            0x00 }, /* 8 */
+        { PSMOUSE_CMD_GETINFO,          0x00 }, /* 9 */
+        { PSMOUSE_CMD_SETRES,           0x00 }, /* a */
+        { PSMOUSE_CMD_SETRES,           0x01 }, /* b */
+        { PSMOUSE_CMD_SETRES,           0x02 }, /* c */
+        { PSMOUSE_CMD_SETRES,           0x03 }, /* d */
+        { PSMOUSE_CMD_SETSCALE21,       0x00 }, /* e */
+        { PSMOUSE_CMD_SETSCALE11,       0x00 }, /* f */
+};
+
 
 #define ALPS_DUALPOINT          0x02    /* touchpad has trackstick */
 #define ALPS_PASS               0x04    /* device has a pass-through port */
@@ -103,6 +122,7 @@ static const struct alps_model_info alps_model_data[] = {
         /* Dell Latitude E5500, E6400, E6500, Precision M4400 */
         { { 0x62, 0x02, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
+        { { 0x73, 0x00, 0x14 }, 0x00, ALPS_PROTO_V6, 0xff, 0xff, ALPS_DUALPOINT },              /* Dell XT2 */
         { { 0x73, 0x02, 0x50 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },           /* Dell Vostro 1400 */
         { { 0x52, 0x01, 0x14 }, 0x00, ALPS_PROTO_V2, 0xff, 0xff,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },                            /* Toshiba Tecra A11-11L */
@@ -645,6 +665,76 @@ static void alps_process_packet_v3(struct psmouse *psmouse)
         alps_process_touchpad_packet_v3(psmouse);
 }
 
+static void alps_process_packet_v6(struct psmouse *psmouse)
+{
+        struct alps_data *priv = psmouse->private;
+        unsigned char *packet = psmouse->packet;
+        struct input_dev *dev = psmouse->dev;
+        struct input_dev *dev2 = priv->dev2;
+        int x, y, z, left, right, middle;
+
+        /*
+         * We can use Byte5 to distinguish if the packet is from Touchpad
+         * or Trackpoint.
+         * Touchpad:    0 - 0x7E
+         * Trackpoint:  0x7F
+         */
+        if (packet[5] == 0x7F) {
+                /* It should be a DualPoint when received Trackpoint packet */
+                if (!(priv->flags & ALPS_DUALPOINT))
+                        return;
+
+                /* Trackpoint packet */
+                x = packet[1] | ((packet[3] & 0x20) << 2);
+                y = packet[2] | ((packet[3] & 0x40) << 1);
+                z = packet[4];
+                left = packet[3] & 0x01;
+                right = packet[3] & 0x02;
+                middle = packet[3] & 0x04;
+
+                /* To prevent the cursor jump when finger lifted */
+                if (x == 0x7F && y == 0x7F && z == 0x7F)
+                        x = y = z = 0;
+
+                /* Divide 4 since trackpoint's speed is too fast */
+                input_report_rel(dev2, REL_X, (char)x / 4);
+                input_report_rel(dev2, REL_Y, -((char)y / 4));
+
+                input_report_key(dev2, BTN_LEFT, left);
+                input_report_key(dev2, BTN_RIGHT, right);
+                input_report_key(dev2, BTN_MIDDLE, middle);
+
+                input_sync(dev2);
+                return;
+        }
+
+        /* Touchpad packet */
+        x = packet[1] | ((packet[3] & 0x78) << 4);
+        y = packet[2] | ((packet[4] & 0x78) << 4);
+        z = packet[5];
+        left = packet[3] & 0x01;
+        right = packet[3] & 0x02;
+
+        if (z > 30)
+                input_report_key(dev, BTN_TOUCH, 1);
+        if (z < 25)
+                input_report_key(dev, BTN_TOUCH, 0);
+
+        if (z > 0) {
+                input_report_abs(dev, ABS_X, x);
+                input_report_abs(dev, ABS_Y, y);
+        }
+
+        input_report_abs(dev, ABS_PRESSURE, z);
+        input_report_key(dev, BTN_TOOL_FINGER, z > 0);
+
+        /* v6 touchpad does not have middle button */
+        input_report_key(dev, BTN_LEFT, left);
+        input_report_key(dev, BTN_RIGHT, right);
+
+        input_sync(dev);
+}
+
 static void alps_process_packet_v4(struct psmouse *psmouse)
 {
         struct alps_data *priv = psmouse->private;
@@ -897,7 +987,7 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
         }
 
         /* Bytes 2 - pktsize should have 0 in the highest bit */
-        if (priv->proto_version != ALPS_PROTO_V5 &&
+        if ((priv->proto_version < ALPS_PROTO_V5) &&
             psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
             (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
                 psmouse_dbg(psmouse, "refusing packet[%i] = %x\n",
@@ -1085,6 +1175,80 @@ static int alps_absolute_mode_v1_v2(struct psmouse *psmouse)
         return ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETPOLL);
 }
 
+static int alps_monitor_mode_send_word(struct psmouse *psmouse, u16 word)
+{
+        int i, nibble;
+
+        /*
+         * b0-b11 are valid bits, send sequence is inverse.
+         * e.g. when word = 0x0123, nibble send sequence is 3, 2, 1
+         */
+        for (i = 0; i <= 8; i += 4) {
+                nibble = (word >> i) & 0xf;
+                if (alps_command_mode_send_nibble(psmouse, nibble))
+                        return -1;
+        }
+
+        return 0;
+}
+
+static int alps_monitor_mode_write_reg(struct psmouse *psmouse,
+                                       u16 addr, u16 value)
+{
+        struct ps2dev *ps2dev = &psmouse->ps2dev;
+
+        /* 0x0A0 is the command to write the word */
+        if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_ENABLE) ||
+            alps_monitor_mode_send_word(psmouse, 0x0A0) ||
+            alps_monitor_mode_send_word(psmouse, addr) ||
+            alps_monitor_mode_send_word(psmouse, value) ||
+            ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE))
+                return -1;
+
+        return 0;
+}
+
+static int alps_monitor_mode(struct psmouse *psmouse, bool enable)
+{
+        struct ps2dev *ps2dev = &psmouse->ps2dev;
+
+        if (enable) {
+                /* EC E9 F5 F5 E7 E6 E7 E9 to enter monitor mode */
+                if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_RESET_WRAP) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_GETINFO) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE21) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE21) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_GETINFO))
+                        return -1;
+        } else {
+                /* EC to exit monitor mode */
+                if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_RESET_WRAP))
+                        return -1;
+        }
+
+        return 0;
+}
+
+static int alps_absolute_mode_v6(struct psmouse *psmouse)
+{
+        u16 reg_val = 0x181;
+        int ret = -1;
+
+        /* enter monitor mode, to write the register */
+        if (alps_monitor_mode(psmouse, true))
+                return -1;
+
+        ret = alps_monitor_mode_write_reg(psmouse, 0x000, reg_val);
+
+        if (alps_monitor_mode(psmouse, false))
+                ret = -1;
+
+        return ret;
+}
+
 static int alps_get_status(struct psmouse *psmouse, char *param)
 {
         /* Get status: 0xF5 0xF5 0xF5 0xE9 */
@@ -1189,6 +1353,32 @@ static int alps_hw_init_v1_v2(struct psmouse *psmouse)
         return 0;
 }
 
+static int alps_hw_init_v6(struct psmouse *psmouse)
+{
+        unsigned char param[2] = {0xC8, 0x14};
+
+        /* Enter passthrough mode to let trackpoint enter 6byte raw mode */
+        if (alps_passthrough_mode_v2(psmouse, true))
+                return -1;
+
+        if (ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, &param[0], PSMOUSE_CMD_SETRATE) ||
+            ps2_command(&psmouse->ps2dev, &param[1], PSMOUSE_CMD_SETRATE))
+                return -1;
+
+        if (alps_passthrough_mode_v2(psmouse, false))
+                return -1;
+
+        if (alps_absolute_mode_v6(psmouse)) {
+                psmouse_err(psmouse, "Failed to enable absolute mode\n");
+                return -1;
+        }
+
+        return 0;
+}
+
 /*
  * Enable or disable passthrough mode to the trackstick.
  */
@@ -1553,6 +1743,8 @@ static void alps_set_defaults(struct alps_data *priv)
                 priv->hw_init = alps_hw_init_v1_v2;
                 priv->process_packet = alps_process_packet_v1_v2;
                 priv->set_abs_params = alps_set_abs_params_st;
+                priv->x_max = 1023;
+                priv->y_max = 767;
                 break;
         case ALPS_PROTO_V3:
                 priv->hw_init = alps_hw_init_v3;
@@ -1584,6 +1776,14 @@ static void alps_set_defaults(struct alps_data *priv)
                 priv->x_bits = 23;
                 priv->y_bits = 12;
                 break;
+        case ALPS_PROTO_V6:
+                priv->hw_init = alps_hw_init_v6;
+                priv->process_packet = alps_process_packet_v6;
+                priv->set_abs_params = alps_set_abs_params_st;
+                priv->nibble_commands = alps_v6_nibble_commands;
+                priv->x_max = 2047;
+                priv->y_max = 1535;
+                break;
         }
 }
 
@@ -1705,8 +1905,8 @@ static void alps_disconnect(struct psmouse *psmouse)
 static void alps_set_abs_params_st(struct alps_data *priv,
                                    struct input_dev *dev1)
 {
-        input_set_abs_params(dev1, ABS_X, 0, 1023, 0, 0);
-        input_set_abs_params(dev1, ABS_Y, 0, 767, 0, 0);
+        input_set_abs_params(dev1, ABS_X, 0, priv->x_max, 0, 0);
+        input_set_abs_params(dev1, ABS_Y, 0, priv->y_max, 0, 0);
 }
 
 static void alps_set_abs_params_mt(struct alps_data *priv,
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index eee59853b9ce..704f0f924307 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -17,6 +17,7 @@
 #define ALPS_PROTO_V3   3
 #define ALPS_PROTO_V4   4
 #define ALPS_PROTO_V5   5
+#define ALPS_PROTO_V6   6
 
 /**
  * struct alps_model_info - touchpad ID table
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 8551dcaf24db..597e9b8fc18d 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1313,6 +1313,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                         break;
                 case 6:
                 case 7:
+                case 8:
                         etd->hw_version = 4;
                         break;
                 default:
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 98707fb2cb5d..8f4c4ab04bc2 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -455,16 +455,26 @@ static DEVICE_ATTR_RO(type);
 static DEVICE_ATTR_RO(proto);
 static DEVICE_ATTR_RO(id);
 static DEVICE_ATTR_RO(extra);
-static DEVICE_ATTR_RO(modalias);
-static DEVICE_ATTR_WO(drvctl);
-static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
-static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
 
 static struct attribute *serio_device_id_attrs[] = {
         &dev_attr_type.attr,
         &dev_attr_proto.attr,
         &dev_attr_id.attr,
         &dev_attr_extra.attr,
+        NULL
+};
+
+static struct attribute_group serio_id_attr_group = {
+        .name   = "id",
+        .attrs  = serio_device_id_attrs,
+};
+
+static DEVICE_ATTR_RO(modalias);
+static DEVICE_ATTR_WO(drvctl);
+static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
+static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
+
+static struct attribute *serio_device_attrs[] = {
         &dev_attr_modalias.attr,
         &dev_attr_description.attr,
         &dev_attr_drvctl.attr,
@@ -472,13 +482,13 @@ static struct attribute *serio_device_id_attrs[] = {
         NULL
 };
 
-static struct attribute_group serio_id_attr_group = {
-        .name   = "id",
-        .attrs  = serio_device_id_attrs,
+static struct attribute_group serio_device_attr_group = {
+        .attrs  = serio_device_attrs,
 };
 
 static const struct attribute_group *serio_device_attr_groups[] = {
         &serio_id_attr_group,
+        &serio_device_attr_group,
         NULL
 };
 
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 00d1e547b211..961d58d32647 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -906,6 +906,17 @@ config TOUCHSCREEN_STMPE
           To compile this driver as a module, choose M here: the
           module will be called stmpe-ts.
 
+config TOUCHSCREEN_SUR40
+        tristate "Samsung SUR40 (Surface 2.0/PixelSense) touchscreen"
+        depends on USB
+        select INPUT_POLLDEV
+        help
+          Say Y here if you want support for the Samsung SUR40 touchscreen
+          (also known as Microsoft Surface 2.0 or Microsoft PixelSense).
+
+          To compile this driver as a module, choose M here: the
+          module will be called sur40.
+
 config TOUCHSCREEN_TPS6507X
         tristate "TPS6507x based touchscreens"
         depends on I2C
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index 7587883b8d38..62801f213346 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -54,6 +54,7 @@ obj-$(CONFIG_TOUCHSCREEN_PIXCIR)	+= pixcir_i2c_ts.o
 obj-$(CONFIG_TOUCHSCREEN_S3C2410)       += s3c2410_ts.o
 obj-$(CONFIG_TOUCHSCREEN_ST1232)        += st1232.o
 obj-$(CONFIG_TOUCHSCREEN_STMPE)         += stmpe-ts.o
+obj-$(CONFIG_TOUCHSCREEN_SUR40)         += sur40.o
 obj-$(CONFIG_TOUCHSCREEN_TI_AM335X_TSC) += ti_am335x_tsc.o
 obj-$(CONFIG_TOUCHSCREEN_TNETV107X)     += tnetv107x-ts.o
 obj-$(CONFIG_TOUCHSCREEN_TOUCHIT213)    += touchit213.o
diff --git a/drivers/input/touchscreen/atmel-wm97xx.c b/drivers/input/touchscreen/atmel-wm97xx.c
index 268a35e55d7f..279c0e42b8a7 100644
--- a/drivers/input/touchscreen/atmel-wm97xx.c
+++ b/drivers/input/touchscreen/atmel-wm97xx.c
@@ -391,7 +391,7 @@ static int __exit atmel_wm97xx_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM_SLEEP
-static int atmel_wm97xx_suspend(struct *dev)
+static int atmel_wm97xx_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct atmel_wm97xx *atmel_wm97xx = platform_get_drvdata(pdev);
diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
index 42d830efa316..a035a390f8e2 100644
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -1246,8 +1246,7 @@ static void cyttsp4_watchdog_timer(unsigned long handle)
 
         dev_vdbg(cd->dev, "%s: Watchdog timer triggered\n", __func__);
 
-        if (!work_pending(&cd->watchdog_work))
-                schedule_work(&cd->watchdog_work);
+        schedule_work(&cd->watchdog_work);
 
         return;
 }
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
new file mode 100644
index 000000000000..f1cb05148b46
--- /dev/null
+++ b/drivers/input/touchscreen/sur40.c
@@ -0,0 +1,466 @@
+/*
+ * Surface2.0/SUR40/PixelSense input driver
+ *
+ * Copyright (c) 2013 by Florian 'floe' Echtler <floe@butterbrot.org>
+ *
+ * Derived from the USB Skeleton driver 1.1,
+ * Copyright (c) 2003 Greg Kroah-Hartman (greg@kroah.com)
+ *
+ * and from the Apple USB BCM5974 multitouch driver,
+ * Copyright (c) 2008 Henrik Rydberg (rydberg@euromail.se)
+ *
+ * and from the generic hid-multitouch driver,
+ * Copyright (c) 2010-2012 Stephane Chatty <chatty@enac.fr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/completion.h>
+#include <linux/uaccess.h>
+#include <linux/usb.h>
+#include <linux/printk.h>
+#include <linux/input-polldev.h>
+#include <linux/input/mt.h>
+#include <linux/usb/input.h>
+
+/* read 512 bytes from endpoint 0x86 -> get header + blobs */
+struct sur40_header {
+
+        __le16 type;       /* always 0x0001 */
+        __le16 count;      /* count of blobs (if 0: continue prev. packet) */
+
+        __le32 packet_id;  /* unique ID for all packets in one frame */
+
+        __le32 timestamp;  /* milliseconds (inc. by 16 or 17 each frame) */
+        __le32 unknown;    /* "epoch?" always 02/03 00 00 00 */
+
+} __packed;
+
+struct sur40_blob {
+
+        __le16 blob_id;
+
+        u8 action;         /* 0x02 = enter/exit, 0x03 = update (?) */
+        u8 unknown;        /* always 0x01 or 0x02 (no idea what this is?) */
+
+        __le16 bb_pos_x;   /* upper left corner of bounding box */
+        __le16 bb_pos_y;
+
+        __le16 bb_size_x;  /* size of bounding box */
+        __le16 bb_size_y;
+
+        __le16 pos_x;      /* finger tip position */
+        __le16 pos_y;
+
+        __le16 ctr_x;      /* centroid position */
+        __le16 ctr_y;
+
+        __le16 axis_x;     /* somehow related to major/minor axis, mostly: */
+        __le16 axis_y;     /* axis_x == bb_size_y && axis_y == bb_size_x */
+
+        __le32 angle;      /* orientation in radians relative to x axis -
+                              actually an IEEE754 float, don't use in kernel */
+
+        __le32 area;       /* size in pixels/pressure (?) */
+
+        u8 padding[32];
+
+} __packed;
+
+/* combined header/blob data */
+struct sur40_data {
+        struct sur40_header header;
+        struct sur40_blob   blobs[];
+} __packed;
+
+
+/* version information */
+#define DRIVER_SHORT   "sur40"
+#define DRIVER_AUTHOR  "Florian 'floe' Echtler <floe@butterbrot.org>"
+#define DRIVER_DESC    "Surface2.0/SUR40/PixelSense input driver"
+
+/* vendor and device IDs */
+#define ID_MICROSOFT 0x045e
+#define ID_SUR40     0x0775
+
+/* sensor resolution */
+#define SENSOR_RES_X 1920
+#define SENSOR_RES_Y 1080
+
+/* touch data endpoint */
+#define TOUCH_ENDPOINT 0x86
+
+/* polling interval (ms) */
+#define POLL_INTERVAL 10
+
+/* maximum number of contacts FIXME: this is a guess? */
+#define MAX_CONTACTS 64
+
+/* control commands */
+#define SUR40_GET_VERSION 0xb0 /* 12 bytes string    */
+#define SUR40_UNKNOWN1    0xb3 /*  5 bytes           */
+#define SUR40_UNKNOWN2    0xc1 /* 24 bytes           */
+
+#define SUR40_GET_STATE   0xc5 /*  4 bytes state (?) */
+#define SUR40_GET_SENSORS 0xb1 /*  8 bytes sensors   */
+
+/*
+ * Note: an earlier, non-public version of this driver used USB_RECIP_ENDPOINT
+ * here by mistake which is very likely to have corrupted the firmware EEPROM
+ * on two separate SUR40 devices. Thanks to Alan Stern who spotted this bug.
+ * Should you ever run into a similar problem, the background story to this
+ * incident and instructions on how to fix the corrupted EEPROM are available
+ * at https://floe.butterbrot.org/matrix/hacking/surface/brick.html
+*/
+
+struct sur40_state {
+
+        struct usb_device *usbdev;
+        struct device *dev;
+        struct input_polled_dev *input;
+
+        struct sur40_data *bulk_in_buffer;
+        size_t bulk_in_size;
+        u8 bulk_in_epaddr;
+
+        char phys[64];
+};
+
+static int sur40_command(struct sur40_state *dev,
+                         u8 command, u16 index, void *buffer, u16 size)
+{
+        return usb_control_msg(dev->usbdev, usb_rcvctrlpipe(dev->usbdev, 0),
+                               command,
+                               USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+                               0x00, index, buffer, size, 1000);
+}
+
+/* Initialization routine, called from sur40_open */
+static int sur40_init(struct sur40_state *dev)
+{
+        int result;
+        u8 buffer[24];
+
+        /* stupidly replay the original MS driver init sequence */
+        result = sur40_command(dev, SUR40_GET_VERSION, 0x00, buffer, 12);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_GET_VERSION, 0x01, buffer, 12);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_GET_VERSION, 0x02, buffer, 12);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_UNKNOWN2,    0x00, buffer, 24);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_UNKNOWN1,    0x00, buffer,  5);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_GET_VERSION, 0x03, buffer, 12);
+
+        /*
+         * Discard the result buffer - no known data inside except
+         * some version strings, maybe extract these sometime...
+         */
+
+        return result;
+}
+
+/*
+ * Callback routines from input_polled_dev
+ */
+
+/* Enable the device, polling will now start. */
+static void sur40_open(struct input_polled_dev *polldev)
+{
+        struct sur40_state *sur40 = polldev->private;
+
+        dev_dbg(sur40->dev, "open\n");
+        sur40_init(sur40);
+}
+
+/* Disable device, polling has stopped. */
+static void sur40_close(struct input_polled_dev *polldev)
+{
+        struct sur40_state *sur40 = polldev->private;
+
+        dev_dbg(sur40->dev, "close\n");
+        /*
+         * There is no known way to stop the device, so we simply
+         * stop polling.
+         */
+}
+
+/*
+ * This function is called when a whole contact has been processed,
+ * so that it can assign it to a slot and store the data there.
+ */
+static void sur40_report_blob(struct sur40_blob *blob, struct input_dev *input)
+{
+        int wide, major, minor;
+
+        int bb_size_x = le16_to_cpu(blob->bb_size_x);
+        int bb_size_y = le16_to_cpu(blob->bb_size_y);
+
+        int pos_x = le16_to_cpu(blob->pos_x);
+        int pos_y = le16_to_cpu(blob->pos_y);
+
+        int ctr_x = le16_to_cpu(blob->ctr_x);
+        int ctr_y = le16_to_cpu(blob->ctr_y);
+
+        int slotnum = input_mt_get_slot_by_key(input, blob->blob_id);
+        if (slotnum < 0 || slotnum >= MAX_CONTACTS)
+                return;
+
+        input_mt_slot(input, slotnum);
+        input_mt_report_slot_state(input, MT_TOOL_FINGER, 1);
+        wide = (bb_size_x > bb_size_y);
+        major = max(bb_size_x, bb_size_y);
+        minor = min(bb_size_x, bb_size_y);
+
+        input_report_abs(input, ABS_MT_POSITION_X, pos_x);
+        input_report_abs(input, ABS_MT_POSITION_Y, pos_y);
+        input_report_abs(input, ABS_MT_TOOL_X, ctr_x);
+        input_report_abs(input, ABS_MT_TOOL_Y, ctr_y);
+
+        /* TODO: use a better orientation measure */
+        input_report_abs(input, ABS_MT_ORIENTATION, wide);
+        input_report_abs(input, ABS_MT_TOUCH_MAJOR, major);
+        input_report_abs(input, ABS_MT_TOUCH_MINOR, minor);
+}
+
+/* core function: poll for new input data */
+static void sur40_poll(struct input_polled_dev *polldev)
+{
+
+        struct sur40_state *sur40 = polldev->private;
+        struct input_dev *input = polldev->input;
+        int result, bulk_read, need_blobs, packet_blobs, i;
+        u32 uninitialized_var(packet_id);
+
+        struct sur40_header *header = &sur40->bulk_in_buffer->header;
+        struct sur40_blob *inblob = &sur40->bulk_in_buffer->blobs[0];
+
+        dev_dbg(sur40->dev, "poll\n");
+
+        need_blobs = -1;
+
+        do {
+
+                /* perform a blocking bulk read to get data from the device */
+                result = usb_bulk_msg(sur40->usbdev,
+                        usb_rcvbulkpipe(sur40->usbdev, sur40->bulk_in_epaddr),
+                        sur40->bulk_in_buffer, sur40->bulk_in_size,
+                        &bulk_read, 1000);
+
+                dev_dbg(sur40->dev, "received %d bytes\n", bulk_read);
+
+                if (result < 0) {
+                        dev_err(sur40->dev, "error in usb_bulk_read\n");
+                        return;
+                }
+
+                result = bulk_read - sizeof(struct sur40_header);
+
+                if (result % sizeof(struct sur40_blob) != 0) {
+                        dev_err(sur40->dev, "transfer size mismatch\n");
+                        return;
+                }
+
+                /* first packet? */
+                if (need_blobs == -1) {
+                        need_blobs = le16_to_cpu(header->count);
+                        dev_dbg(sur40->dev, "need %d blobs\n", need_blobs);
+                        packet_id = le32_to_cpu(header->packet_id);
+                }
+
+                /*
+                 * Sanity check. when video data is also being retrieved, the
+                 * packet ID will usually increase in the middle of a series
+                 * instead of at the end.
+                 */
+                if (packet_id != header->packet_id)
+                        dev_warn(sur40->dev, "packet ID mismatch\n");
+
+                packet_blobs = result / sizeof(struct sur40_blob);
+                dev_dbg(sur40->dev, "received %d blobs\n", packet_blobs);
+
+                /* packets always contain at least 4 blobs, even if empty */
+                if (packet_blobs > need_blobs)
+                        packet_blobs = need_blobs;
+
+                for (i = 0; i < packet_blobs; i++) {
+                        need_blobs--;
+                        dev_dbg(sur40->dev, "processing blob\n");
+                        sur40_report_blob(&(inblob[i]), input);
+                }
+
+        } while (need_blobs > 0);
+
+        input_mt_sync_frame(input);
+        input_sync(input);
+}
+
+/* Initialize input device parameters. */
+static void sur40_input_setup(struct input_dev *input_dev)
+{
+        __set_bit(EV_KEY, input_dev->evbit);
+        __set_bit(EV_ABS, input_dev->evbit);
+
+        input_set_abs_params(input_dev, ABS_MT_POSITION_X,
+                             0, SENSOR_RES_X, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
+                             0, SENSOR_RES_Y, 0, 0);
+
+        input_set_abs_params(input_dev, ABS_MT_TOOL_X,
+                             0, SENSOR_RES_X, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_TOOL_Y,
+                             0, SENSOR_RES_Y, 0, 0);
+
+        /* max value unknown, but major/minor axis
+         * can never be larger than screen */
+        input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
+                             0, SENSOR_RES_X, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_TOUCH_MINOR,
+                             0, SENSOR_RES_Y, 0, 0);
+
+        input_set_abs_params(input_dev, ABS_MT_ORIENTATION, 0, 1, 0, 0);
+
+        input_mt_init_slots(input_dev, MAX_CONTACTS,
+                            INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED);
+}
+
+/* Check candidate USB interface. */
+static int sur40_probe(struct usb_interface *interface,
+                       const struct usb_device_id *id)
+{
+        struct usb_device *usbdev = interface_to_usbdev(interface);
+        struct sur40_state *sur40;
+        struct usb_host_interface *iface_desc;
+        struct usb_endpoint_descriptor *endpoint;
+        struct input_polled_dev *poll_dev;
+        int error;
+
+        /* Check if we really have the right interface. */
+        iface_desc = &interface->altsetting[0];
+        if (iface_desc->desc.bInterfaceClass != 0xFF)
+                return -ENODEV;
+
+        /* Use endpoint #4 (0x86). */
+        endpoint = &iface_desc->endpoint[4].desc;
+        if (endpoint->bEndpointAddress != TOUCH_ENDPOINT)
+                return -ENODEV;
+
+        /* Allocate memory for our device state and initialize it. */
+        sur40 = kzalloc(sizeof(struct sur40_state), GFP_KERNEL);
+        if (!sur40)
+                return -ENOMEM;
+
+        poll_dev = input_allocate_polled_device();
+        if (!poll_dev) {
+                error = -ENOMEM;
+                goto err_free_dev;
+        }
+
+        /* Set up polled input device control structure */
+        poll_dev->private = sur40;
+        poll_dev->poll_interval = POLL_INTERVAL;
+        poll_dev->open = sur40_open;
+        poll_dev->poll = sur40_poll;
+        poll_dev->close = sur40_close;
+
+        /* Set up regular input device structure */
+        sur40_input_setup(poll_dev->input);
+
+        poll_dev->input->name = "Samsung SUR40";
+        usb_to_input_id(usbdev, &poll_dev->input->id);
+        usb_make_path(usbdev, sur40->phys, sizeof(sur40->phys));
+        strlcat(sur40->phys, "/input0", sizeof(sur40->phys));
+        poll_dev->input->phys = sur40->phys;
+        poll_dev->input->dev.parent = &interface->dev;
+
+        sur40->usbdev = usbdev;
+        sur40->dev = &interface->dev;
+        sur40->input = poll_dev;
+
+        /* use the bulk-in endpoint tested above */
+        sur40->bulk_in_size = usb_endpoint_maxp(endpoint);
+        sur40->bulk_in_epaddr = endpoint->bEndpointAddress;
+        sur40->bulk_in_buffer = kmalloc(sur40->bulk_in_size, GFP_KERNEL);
+        if (!sur40->bulk_in_buffer) {
+                dev_err(&interface->dev, "Unable to allocate input buffer.");
+                error = -ENOMEM;
+                goto err_free_polldev;
+        }
+
+        error = input_register_polled_device(poll_dev);
+        if (error) {
+                dev_err(&interface->dev,
+                        "Unable to register polled input device.");
+                goto err_free_buffer;
+        }
+
+        /* we can register the device now, as it is ready */
+        usb_set_intfdata(interface, sur40);
+        dev_dbg(&interface->dev, "%s is now attached\n", DRIVER_DESC);
+
+        return 0;
+
+err_free_buffer:
+        kfree(sur40->bulk_in_buffer);
+err_free_polldev:
+        input_free_polled_device(sur40->input);
+err_free_dev:
+        kfree(sur40);
+
+        return error;
+}
+
+/* Unregister device & clean up. */
+static void sur40_disconnect(struct usb_interface *interface)
+{
+        struct sur40_state *sur40 = usb_get_intfdata(interface);
+
+        input_unregister_polled_device(sur40->input);
+        input_free_polled_device(sur40->input);
+        kfree(sur40->bulk_in_buffer);
+        kfree(sur40);
+
+        usb_set_intfdata(interface, NULL);
+        dev_dbg(&interface->dev, "%s is now disconnected\n", DRIVER_DESC);
+}
+
+static const struct usb_device_id sur40_table[] = {
+        { USB_DEVICE(ID_MICROSOFT, ID_SUR40) },  /* Samsung SUR40 */
+        { }                                      /* terminating null entry */
+};
+MODULE_DEVICE_TABLE(usb, sur40_table);
+
+/* USB-specific object needed to register this driver with the USB subsystem. */
+static struct usb_driver sur40_driver = {
+        .name = DRIVER_SHORT,
+        .probe = sur40_probe,
+        .disconnect = sur40_disconnect,
+        .id_table = sur40_table,
+};
+
+module_usb_driver(sur40_driver);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index ae4b6b903629..5f87bed05467 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -106,6 +106,7 @@ struct usbtouch_device_info {
 struct usbtouch_usb {
         unsigned char *data;
         dma_addr_t data_dma;
+        int data_size;
         unsigned char *buffer;
         int buf_len;
         struct urb *irq;
@@ -1521,7 +1522,7 @@ static int usbtouch_reset_resume(struct usb_interface *intf)
 static void usbtouch_free_buffers(struct usb_device *udev,
                                   struct usbtouch_usb *usbtouch)
 {
-        usb_free_coherent(udev, usbtouch->type->rept_size,
+        usb_free_coherent(udev, usbtouch->data_size,
                           usbtouch->data, usbtouch->data_dma);
         kfree(usbtouch->buffer);
 }
@@ -1566,7 +1567,20 @@ static int usbtouch_probe(struct usb_interface *intf,
         if (!type->process_pkt)
                 type->process_pkt = usbtouch_process_pkt;
 
-        usbtouch->data = usb_alloc_coherent(udev, type->rept_size,
+        usbtouch->data_size = type->rept_size;
+        if (type->get_pkt_len) {
+                /*
+                 * When dealing with variable-length packets we should
+                 * not request more than wMaxPacketSize bytes at once
+                 * as we do not know if there is more data coming or
+                 * we filled exactly wMaxPacketSize bytes and there is
+                 * nothing else.
+                 */
+                usbtouch->data_size = min(usbtouch->data_size,
+                                          usb_endpoint_maxp(endpoint));
+        }
+
+        usbtouch->data = usb_alloc_coherent(udev, usbtouch->data_size,
                                             GFP_KERNEL, &usbtouch->data_dma);
         if (!usbtouch->data)
                 goto out_free;
@@ -1626,12 +1640,12 @@ static int usbtouch_probe(struct usb_interface *intf,
         if (usb_endpoint_type(endpoint) == USB_ENDPOINT_XFER_INT)
                 usb_fill_int_urb(usbtouch->irq, udev,
                          usb_rcvintpipe(udev, endpoint->bEndpointAddress),
-                         usbtouch->data, type->rept_size,
+                         usbtouch->data, usbtouch->data_size,
                          usbtouch_irq, usbtouch, endpoint->bInterval);
         else
                 usb_fill_bulk_urb(usbtouch->irq, udev,
                          usb_rcvbulkpipe(udev, endpoint->bEndpointAddress),
-                         usbtouch->data, type->rept_size,
+                         usbtouch->data, usbtouch->data_size,
                          usbtouch_irq, usbtouch);
 
         usbtouch->irq->dev = udev;
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 1abfb5684ab7..e46a88700b68 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -392,7 +392,7 @@ struct arm_smmu_domain {
         struct arm_smmu_cfg             root_cfg;
         phys_addr_t                     output_mask;
 
-        spinlock_t                      lock;
+        struct mutex                    lock;
 };
 
 static DEFINE_SPINLOCK(arm_smmu_devices_lock);
@@ -900,7 +900,7 @@ static int arm_smmu_domain_init(struct iommu_domain *domain)
                 goto out_free_domain;
         smmu_domain->root_cfg.pgd = pgd;
 
-        spin_lock_init(&smmu_domain->lock);
+        mutex_init(&smmu_domain->lock);
         domain->priv = smmu_domain;
         return 0;
 
@@ -1137,7 +1137,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
          * Sanity check the domain. We don't currently support domains
          * that cross between different SMMU chains.
          */
-        spin_lock(&smmu_domain->lock);
+        mutex_lock(&smmu_domain->lock);
         if (!smmu_domain->leaf_smmu) {
                 /* Now that we have a master, we can finalise the domain */
                 ret = arm_smmu_init_domain_context(domain, dev);
@@ -1152,7 +1152,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
                         dev_name(device_smmu->dev));
                 goto err_unlock;
         }
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
 
         /* Looks ok, so add the device to the domain */
         master = find_smmu_master(smmu_domain->leaf_smmu, dev->of_node);
@@ -1162,7 +1162,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
         return arm_smmu_domain_add_master(smmu_domain, master);
 
 err_unlock:
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
         return ret;
 }
 
@@ -1394,7 +1394,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         if (paddr & ~output_mask)
                 return -ERANGE;
 
-        spin_lock(&smmu_domain->lock);
+        mutex_lock(&smmu_domain->lock);
         pgd += pgd_index(iova);
         end = iova + size;
         do {
@@ -1410,7 +1410,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         } while (pgd++, iova != end);
 
 out_unlock:
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
 
         /* Ensure new page tables are visible to the hardware walker */
         if (smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
@@ -1423,9 +1423,8 @@ static int arm_smmu_map(struct iommu_domain *domain, unsigned long iova,
                         phys_addr_t paddr, size_t size, int flags)
 {
         struct arm_smmu_domain *smmu_domain = domain->priv;
-        struct arm_smmu_device *smmu = smmu_domain->leaf_smmu;
 
-        if (!smmu_domain || !smmu)
+        if (!smmu_domain)
                 return -ENODEV;
 
         /* Check for silent address truncation up the SMMU chain. */
@@ -1449,44 +1448,34 @@ static size_t arm_smmu_unmap(struct iommu_domain *domain, unsigned long iova,
 static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
                                          dma_addr_t iova)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp, pgd;
+        pud_t pud;
+        pmd_t pmd;
+        pte_t pte;
         struct arm_smmu_domain *smmu_domain = domain->priv;
         struct arm_smmu_cfg *root_cfg = &smmu_domain->root_cfg;
-        struct arm_smmu_device *smmu = root_cfg->smmu;
 
-        spin_lock(&smmu_domain->lock);
-        pgd = root_cfg->pgd;
-        if (!pgd)
-                goto err_unlock;
+        pgdp = root_cfg->pgd;
+        if (!pgdp)
+                return 0;
 
-        pgd += pgd_index(iova);
-        if (pgd_none_or_clear_bad(pgd))
-                goto err_unlock;
+        pgd = *(pgdp + pgd_index(iova));
+        if (pgd_none(pgd))
+                return 0;
 
-        pud = pud_offset(pgd, iova);
-        if (pud_none_or_clear_bad(pud))
-                goto err_unlock;
+        pud = *pud_offset(&pgd, iova);
+        if (pud_none(pud))
+                return 0;
 
-        pmd = pmd_offset(pud, iova);
-        if (pmd_none_or_clear_bad(pmd))
-                goto err_unlock;
+        pmd = *pmd_offset(&pud, iova);
+        if (pmd_none(pmd))
+                return 0;
 
-        pte = pmd_page_vaddr(*pmd) + pte_index(iova);
+        pte = *(pmd_page_vaddr(pmd) + pte_index(iova));
         if (pte_none(pte))
-                goto err_unlock;
-
-        spin_unlock(&smmu_domain->lock);
-        return __pfn_to_phys(pte_pfn(*pte)) | (iova & ~PAGE_MASK);
+                return 0;
 
-err_unlock:
-        spin_unlock(&smmu_domain->lock);
-        dev_warn(smmu->dev,
-                 "invalid (corrupt?) page tables detected for iova 0x%llx\n",
-                 (unsigned long long)iova);
-        return -EINVAL;
+        return __pfn_to_phys(pte_pfn(pte)) | (iova & ~PAGE_MASK);
 }
 
 static int arm_smmu_domain_has_cap(struct iommu_domain *domain,
@@ -1863,6 +1852,7 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
                 dev_err(dev,
                         "found only %d context interrupt(s) but %d required\n",
                         smmu->num_context_irqs, smmu->num_context_banks);
+                err = -ENODEV;
                 goto out_put_parent;
         }
 
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 9031171c141b..341c6016812d 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -957,12 +957,13 @@ void __init gic_init_bases(unsigned int gic_nr, int irq_start,
         if (WARN_ON(!gic->domain))
                 return;
 
+        if (gic_nr == 0) {
 #ifdef CONFIG_SMP
-        set_smp_cross_call(gic_raise_softirq);
-        register_cpu_notifier(&gic_cpu_notifier);
+                set_smp_cross_call(gic_raise_softirq);
+                register_cpu_notifier(&gic_cpu_notifier);
 #endif
-
-        set_handle_irq(gic_handle_irq);
+                set_handle_irq(gic_handle_irq);
+        }
 
         gic_chip.flags |= gic_arch_extn.flags;
         gic_dist_init(gic);
diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
index 2848171b8576..b31d8e99c419 100644
--- a/drivers/leds/leds-pwm.c
+++ b/drivers/leds/leds-pwm.c
@@ -82,22 +82,12 @@ static inline size_t sizeof_pwm_leds_priv(int num_leds)
                       (sizeof(struct led_pwm_data) * num_leds);
 }
 
-static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
+static int led_pwm_create_of(struct platform_device *pdev,
+                             struct led_pwm_priv *priv)
 {
         struct device_node *node = pdev->dev.of_node;
         struct device_node *child;
-        struct led_pwm_priv *priv;
-        int count, ret;
-
-        /* count LEDs in this device, so we know how much to allocate */
-        count = of_get_child_count(node);
-        if (!count)
-                return NULL;
-
-        priv = devm_kzalloc(&pdev->dev, sizeof_pwm_leds_priv(count),
-                            GFP_KERNEL);
-        if (!priv)
-                return NULL;
+        int ret;
 
         for_each_child_of_node(node, child) {
                 struct led_pwm_data *led_dat = &priv->leds[priv->num_leds];
@@ -109,6 +99,7 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
                 if (IS_ERR(led_dat->pwm)) {
                         dev_err(&pdev->dev, "unable to request PWM for %s\n",
                                 led_dat->cdev.name);
+                        ret = PTR_ERR(led_dat->pwm);
                         goto err;
                 }
                 /* Get the period from PWM core when n*/
@@ -137,28 +128,36 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
                 priv->num_leds++;
         }
 
-        return priv;
+        return 0;
 err:
         while (priv->num_leds--)
                 led_classdev_unregister(&priv->leds[priv->num_leds].cdev);
 
-        return NULL;
+        return ret;
 }
 
 static int led_pwm_probe(struct platform_device *pdev)
 {
         struct led_pwm_platform_data *pdata = dev_get_platdata(&pdev->dev);
         struct led_pwm_priv *priv;
-        int i, ret = 0;
+        int count, i;
+        int ret = 0;
+
+        if (pdata)
+                count = pdata->num_leds;
+        else
+                count = of_get_child_count(pdev->dev.of_node);
+
+        if (!count)
+                return -EINVAL;
 
-        if (pdata && pdata->num_leds) {
-                priv = devm_kzalloc(&pdev->dev,
-                                    sizeof_pwm_leds_priv(pdata->num_leds),
-                                    GFP_KERNEL);
-                if (!priv)
-                        return -ENOMEM;
+        priv = devm_kzalloc(&pdev->dev, sizeof_pwm_leds_priv(count),
+                            GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
 
-                for (i = 0; i < pdata->num_leds; i++) {
+        if (pdata) {
+                for (i = 0; i < count; i++) {
                         struct led_pwm *cur_led = &pdata->leds[i];
                         struct led_pwm_data *led_dat = &priv->leds[i];
 
@@ -188,11 +187,11 @@ static int led_pwm_probe(struct platform_device *pdev)
                         if (ret < 0)
                                 goto err;
                 }
-                priv->num_leds = pdata->num_leds;
+                priv->num_leds = count;
         } else {
-                priv = led_pwm_create_of(pdev);
-                if (!priv)
-                        return -ENODEV;
+                ret = led_pwm_create_of(pdev, priv);
+                if (ret)
+                        return ret;
         }
 
         platform_set_drvdata(pdev, priv);
diff --git a/drivers/macintosh/Makefile b/drivers/macintosh/Makefile
index 6753b65f8ede..d2f0120bc878 100644
--- a/drivers/macintosh/Makefile
+++ b/drivers/macintosh/Makefile
@@ -40,6 +40,7 @@ obj-$(CONFIG_WINDFARM_RM31)     += windfarm_fcu_controls.o \
                                    windfarm_ad7417_sensor.o \
                                    windfarm_lm75_sensor.o \
                                    windfarm_lm87_sensor.o \
+                                   windfarm_max6690_sensor.o \
                                    windfarm_pid.o \
                                    windfarm_cpufreq_clamp.o \
                                    windfarm_rm31.o
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 173cbb20d104..54bdd923316f 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1717,6 +1717,11 @@ static int __init dm_bufio_init(void)
 {
         __u64 mem;
 
+        dm_bufio_allocated_kmem_cache = 0;
+        dm_bufio_allocated_get_free_pages = 0;
+        dm_bufio_allocated_vmalloc = 0;
+        dm_bufio_current_allocated = 0;
+
         memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
         memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
 
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 416b7b752a6e..64780ad73bb0 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -730,15 +730,18 @@ static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e,
         int r = 0;
         bool updated = updated_this_tick(mq, e);
 
-        requeue_and_update_tick(mq, e);
-
         if ((!discarded_oblock && updated) ||
-            !should_promote(mq, e, discarded_oblock, data_dir))
+            !should_promote(mq, e, discarded_oblock, data_dir)) {
+                requeue_and_update_tick(mq, e);
                 result->op = POLICY_MISS;
-        else if (!can_migrate)
+
+        } else if (!can_migrate)
                 r = -EWOULDBLOCK;
-        else
+
+        else {
+                requeue_and_update_tick(mq, e);
                 r = pre_cache_to_cache(mq, e, result);
+        }
 
         return r;
 }
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 9efcf1059b99..1b1469ebe5cb 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2755,7 +2755,7 @@ static int resize_cache_dev(struct cache *cache, dm_cblock_t new_size)
 {
         int r;
 
-        r = dm_cache_resize(cache->cmd, cache->cache_size);
+        r = dm_cache_resize(cache->cmd, new_size);
         if (r) {
                 DMERR("could not resize cache metadata");
                 return r;
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 496d5f3646a5..2f91d6d4a2cc 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -20,6 +20,7 @@
 struct delay_c {
         struct timer_list delay_timer;
         struct mutex timer_lock;
+        struct workqueue_struct *kdelayd_wq;
         struct work_struct flush_expired_bios;
         struct list_head delayed_bios;
         atomic_t may_delay;
@@ -45,14 +46,13 @@ struct dm_delay_info {
 
 static DEFINE_MUTEX(delayed_bios_lock);
 
-static struct workqueue_struct *kdelayd_wq;
 static struct kmem_cache *delayed_cache;
 
 static void handle_delayed_timer(unsigned long data)
 {
         struct delay_c *dc = (struct delay_c *)data;
 
-        queue_work(kdelayd_wq, &dc->flush_expired_bios);
+        queue_work(dc->kdelayd_wq, &dc->flush_expired_bios);
 }
 
 static void queue_timeout(struct delay_c *dc, unsigned long expires)
@@ -191,6 +191,12 @@ out:
                 goto bad_dev_write;
         }
 
+        dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
+        if (!dc->kdelayd_wq) {
+                DMERR("Couldn't start kdelayd");
+                goto bad_queue;
+        }
+
         setup_timer(&dc->delay_timer, handle_delayed_timer, (unsigned long)dc);
 
         INIT_WORK(&dc->flush_expired_bios, flush_expired_bios);
@@ -203,6 +209,8 @@ out:
         ti->private = dc;
         return 0;
 
+bad_queue:
+        mempool_destroy(dc->delayed_pool);
 bad_dev_write:
         if (dc->dev_write)
                 dm_put_device(ti, dc->dev_write);
@@ -217,7 +225,7 @@ static void delay_dtr(struct dm_target *ti)
 {
         struct delay_c *dc = ti->private;
 
-        flush_workqueue(kdelayd_wq);
+        destroy_workqueue(dc->kdelayd_wq);
 
         dm_put_device(ti, dc->dev_read);
 
@@ -350,12 +358,6 @@ static int __init dm_delay_init(void)
 {
         int r = -ENOMEM;
 
-        kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
-        if (!kdelayd_wq) {
-                DMERR("Couldn't start kdelayd");
-                goto bad_queue;
-        }
-
         delayed_cache = KMEM_CACHE(dm_delay_info, 0);
         if (!delayed_cache) {
                 DMERR("Couldn't create delayed bio cache.");
@@ -373,8 +375,6 @@ static int __init dm_delay_init(void)
 bad_register:
         kmem_cache_destroy(delayed_cache);
 bad_memcache:
-        destroy_workqueue(kdelayd_wq);
-bad_queue:
         return r;
 }
 
@@ -382,7 +382,6 @@ static void __exit dm_delay_exit(void)
 {
         dm_unregister_target(&delay_target);
         kmem_cache_destroy(delayed_cache);
-        destroy_workqueue(kdelayd_wq);
 }
 
 /* Module hooks */
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index aec57d76db5d..944690bafd93 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -66,6 +66,18 @@ struct dm_snapshot {
 
         atomic_t pending_exceptions_count;
 
+        /* Protected by "lock" */
+        sector_t exception_start_sequence;
+
+        /* Protected by kcopyd single-threaded callback */
+        sector_t exception_complete_sequence;
+
+        /*
+         * A list of pending exceptions that completed out of order.
+         * Protected by kcopyd single-threaded callback.
+         */
+        struct list_head out_of_order_list;
+
         mempool_t *pending_pool;
 
         struct dm_exception_table pending;
@@ -173,6 +185,14 @@ struct dm_snap_pending_exception {
          */
         int started;
 
+        /* There was copying error. */
+        int copy_error;
+
+        /* A sequence number, it is used for in-order completion. */
+        sector_t exception_sequence;
+
+        struct list_head out_of_order_entry;
+
         /*
          * For writing a complete chunk, bypassing the copy.
          */
@@ -1094,6 +1114,9 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         s->valid = 1;
         s->active = 0;
         atomic_set(&s->pending_exceptions_count, 0);
+        s->exception_start_sequence = 0;
+        s->exception_complete_sequence = 0;
+        INIT_LIST_HEAD(&s->out_of_order_list);
         init_rwsem(&s->lock);
         INIT_LIST_HEAD(&s->list);
         spin_lock_init(&s->pe_lock);
@@ -1443,6 +1466,19 @@ static void commit_callback(void *context, int success)
         pending_complete(pe, success);
 }
 
+static void complete_exception(struct dm_snap_pending_exception *pe)
+{
+        struct dm_snapshot *s = pe->snap;
+
+        if (unlikely(pe->copy_error))
+                pending_complete(pe, 0);
+
+        else
+                /* Update the metadata if we are persistent */
+                s->store->type->commit_exception(s->store, &pe->e,
+                                                 commit_callback, pe);
+}
+
 /*
  * Called when the copy I/O has finished.  kcopyd actually runs
  * this code so don't block.
@@ -1452,13 +1488,32 @@ static void copy_callback(int read_err, unsigned long write_err, void *context)
         struct dm_snap_pending_exception *pe = context;
         struct dm_snapshot *s = pe->snap;
 
-        if (read_err || write_err)
-                pending_complete(pe, 0);
+        pe->copy_error = read_err || write_err;
 
-        else
-                /* Update the metadata if we are persistent */
-                s->store->type->commit_exception(s->store, &pe->e,
-                                                 commit_callback, pe);
+        if (pe->exception_sequence == s->exception_complete_sequence) {
+                s->exception_complete_sequence++;
+                complete_exception(pe);
+
+                while (!list_empty(&s->out_of_order_list)) {
+                        pe = list_entry(s->out_of_order_list.next,
+                                        struct dm_snap_pending_exception, out_of_order_entry);
+                        if (pe->exception_sequence != s->exception_complete_sequence)
+                                break;
+                        s->exception_complete_sequence++;
+                        list_del(&pe->out_of_order_entry);
+                        complete_exception(pe);
+                }
+        } else {
+                struct list_head *lh;
+                struct dm_snap_pending_exception *pe2;
+
+                list_for_each_prev(lh, &s->out_of_order_list) {
+                        pe2 = list_entry(lh, struct dm_snap_pending_exception, out_of_order_entry);
+                        if (pe2->exception_sequence < pe->exception_sequence)
+                                break;
+                }
+                list_add(&pe->out_of_order_entry, lh);
+        }
 }
 
 /*
@@ -1553,6 +1608,8 @@ __find_pending_exception(struct dm_snapshot *s,
                 return NULL;
         }
 
+        pe->exception_sequence = s->exception_start_sequence++;
+
         dm_insert_exception(&s->pending, &pe->e);
 
         return pe;
@@ -2192,7 +2249,7 @@ static struct target_type origin_target = {
 
 static struct target_type snapshot_target = {
         .name    = "snapshot",
-        .version = {1, 11, 1},
+        .version = {1, 12, 0},
         .module  = THIS_MODULE,
         .ctr     = snapshot_ctr,
         .dtr     = snapshot_dtr,
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 3d404c1371ed..28a90122a5a8 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -964,6 +964,7 @@ int dm_stats_message(struct mapped_device *md, unsigned argc, char **argv,
 
 int __init dm_statistics_init(void)
 {
+        shared_memory_amount = 0;
         dm_stat_need_rcu_barrier = 0;
         return 0;
 }
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 465f08ca62b1..3ba6a3859ce3 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -200,6 +200,11 @@ int dm_table_create(struct dm_table **result, fmode_t mode,
 
         num_targets = dm_round_up(num_targets, KEYS_PER_NODE);
 
+        if (!num_targets) {
+                kfree(t);
+                return -ENOMEM;
+        }
+
         if (alloc_targets(t, num_targets)) {
                 kfree(t);
                 return -ENOMEM;
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 60bce435f4fa..8a30ad54bd46 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1697,6 +1697,14 @@ void dm_pool_metadata_read_only(struct dm_pool_metadata *pmd)
         up_write(&pmd->root_lock);
 }
 
+void dm_pool_metadata_read_write(struct dm_pool_metadata *pmd)
+{
+        down_write(&pmd->root_lock);
+        pmd->read_only = false;
+        dm_bm_set_read_write(pmd->bm);
+        up_write(&pmd->root_lock);
+}
+
 int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                         dm_block_t threshold,
                                         dm_sm_threshold_fn fn,
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 845ebbe589a9..7bcc0e1d6238 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -193,6 +193,7 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_siz
  * that nothing is changing.
  */
 void dm_pool_metadata_read_only(struct dm_pool_metadata *pmd);
+void dm_pool_metadata_read_write(struct dm_pool_metadata *pmd);
 
 int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                         dm_block_t threshold,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 2c0cf511ec23..ee29037ffc2e 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -640,7 +640,9 @@ static void process_prepared_mapping(struct dm_thin_new_mapping *m)
          */
         r = dm_thin_insert_block(tc->td, m->virt_block, m->data_block);
         if (r) {
-                DMERR_LIMIT("dm_thin_insert_block() failed");
+                DMERR_LIMIT("%s: dm_thin_insert_block() failed: error = %d",
+                            dm_device_name(pool->pool_md), r);
+                set_pool_mode(pool, PM_READ_ONLY);
                 cell_error(pool, m->cell);
                 goto out;
         }
@@ -881,32 +883,23 @@ static void schedule_zero(struct thin_c *tc, dm_block_t virt_block,
         }
 }
 
-static int commit(struct pool *pool)
-{
-        int r;
-
-        r = dm_pool_commit_metadata(pool->pmd);
-        if (r)
-                DMERR_LIMIT("%s: commit failed: error = %d",
-                            dm_device_name(pool->pool_md), r);
-
-        return r;
-}
-
 /*
  * A non-zero return indicates read_only or fail_io mode.
  * Many callers don't care about the return value.
  */
-static int commit_or_fallback(struct pool *pool)
+static int commit(struct pool *pool)
 {
         int r;
 
         if (get_pool_mode(pool) != PM_WRITE)
                 return -EINVAL;
 
-        r = commit(pool);
-        if (r)
+        r = dm_pool_commit_metadata(pool->pmd);
+        if (r) {
+                DMERR_LIMIT("%s: dm_pool_commit_metadata failed: error = %d",
+                            dm_device_name(pool->pool_md), r);
                 set_pool_mode(pool, PM_READ_ONLY);
+        }
 
         return r;
 }
@@ -943,7 +936,9 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                  * Try to commit to see if that will free up some
                  * more space.
                  */
-                (void) commit_or_fallback(pool);
+                r = commit(pool);
+                if (r)
+                        return r;
 
                 r = dm_pool_get_free_block_count(pool->pmd, &free_blocks);
                 if (r)
@@ -957,7 +952,7 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                  * table reload).
                  */
                 if (!free_blocks) {
-                        DMWARN("%s: no free space available.",
+                        DMWARN("%s: no free data space available.",
                                dm_device_name(pool->pool_md));
                         spin_lock_irqsave(&pool->lock, flags);
                         pool->no_free_space = 1;
@@ -967,8 +962,16 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
         }
 
         r = dm_pool_alloc_data_block(pool->pmd, result);
-        if (r)
+        if (r) {
+                if (r == -ENOSPC &&
+                    !dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks) &&
+                    !free_blocks) {
+                        DMWARN("%s: no free metadata space available.",
+                               dm_device_name(pool->pool_md));
+                        set_pool_mode(pool, PM_READ_ONLY);
+                }
                 return r;
+        }
 
         return 0;
 }
@@ -1349,7 +1352,7 @@ static void process_deferred_bios(struct pool *pool)
         if (bio_list_empty(&bios) && !need_commit_due_to_time(pool))
                 return;
 
-        if (commit_or_fallback(pool)) {
+        if (commit(pool)) {
                 while ((bio = bio_list_pop(&bios)))
                         bio_io_error(bio);
                 return;
@@ -1397,6 +1400,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode mode)
         case PM_FAIL:
                 DMERR("%s: switching pool to failure mode",
                       dm_device_name(pool->pool_md));
+                dm_pool_metadata_read_only(pool->pmd);
                 pool->process_bio = process_bio_fail;
                 pool->process_discard = process_bio_fail;
                 pool->process_prepared_mapping = process_prepared_mapping_fail;
@@ -1421,6 +1425,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode mode)
                 break;
 
         case PM_WRITE:
+                dm_pool_metadata_read_write(pool->pmd);
                 pool->process_bio = process_bio;
                 pool->process_discard = process_discard;
                 pool->process_prepared_mapping = process_prepared_mapping;
@@ -1637,12 +1642,19 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         struct pool_c *pt = ti->private;
 
         /*
-         * We want to make sure that degraded pools are never upgraded.
+         * We want to make sure that a pool in PM_FAIL mode is never upgraded.
          */
         enum pool_mode old_mode = pool->pf.mode;
         enum pool_mode new_mode = pt->adjusted_pf.mode;
 
-        if (old_mode > new_mode)
+        /*
+         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
+         * not going to recover without a thin_repair.  So we never let the
+         * pool move out of the old mode.  On the other hand a PM_READ_ONLY
+         * may have been due to a lack of metadata or data space, and may
+         * now work (ie. if the underlying devices have been resized).
+         */
+        if (old_mode == PM_FAIL)
                 new_mode = old_mode;
 
         pool->ti = ti;
@@ -2266,7 +2278,7 @@ static int pool_preresume(struct dm_target *ti)
                 return r;
 
         if (need_commit1 || need_commit2)
-                (void) commit_or_fallback(pool);
+                (void) commit(pool);
 
         return 0;
 }
@@ -2293,7 +2305,7 @@ static void pool_postsuspend(struct dm_target *ti)
 
         cancel_delayed_work(&pool->waker);
         flush_workqueue(pool->wq);
-        (void) commit_or_fallback(pool);
+        (void) commit(pool);
 }
 
 static int check_arg_count(unsigned argc, unsigned args_required)
@@ -2427,7 +2439,7 @@ static int process_reserve_metadata_snap_mesg(unsigned argc, char **argv, struct
         if (r)
                 return r;
 
-        (void) commit_or_fallback(pool);
+        (void) commit(pool);
 
         r = dm_pool_reserve_metadata_snap(pool->pmd);
         if (r)
@@ -2489,7 +2501,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv)
                 DMWARN("Unrecognised thin pool target message received: %s", argv[0]);
 
         if (!r)
-                (void) commit_or_fallback(pool);
+                (void) commit(pool);
 
         return r;
 }
@@ -2544,7 +2556,7 @@ static void pool_status(struct dm_target *ti, status_type_t type,
 
                 /* Commit to ensure statistics aren't out-of-date */
                 if (!(status_flags & DM_STATUS_NOFLUSH_FLAG) && !dm_suspended(ti))
-                        (void) commit_or_fallback(pool);
+                        (void) commit(pool);
 
                 r = dm_pool_get_metadata_transaction_id(pool->pmd, &transaction_id);
                 if (r) {
diff --git a/drivers/md/md.c b/drivers/md/md.c
index b6b7a2866c9e..21f4d7ff0da2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -776,16 +776,10 @@ void md_super_wait(struct mddev *mddev)
         finish_wait(&mddev->sb_wait, &wq);
 }
 
-static void bi_complete(struct bio *bio, int error)
-{
-        complete((struct completion*)bio->bi_private);
-}
-
 int sync_page_io(struct md_rdev *rdev, sector_t sector, int size,
                  struct page *page, int rw, bool metadata_op)
 {
         struct bio *bio = bio_alloc_mddev(GFP_NOIO, 1, rdev->mddev);
-        struct completion event;
         int ret;
 
         rw |= REQ_SYNC;
@@ -801,11 +795,7 @@ int sync_page_io(struct md_rdev *rdev, sector_t sector, int size,
         else
                 bio->bi_sector = sector + rdev->data_offset;
         bio_add_page(bio, page, size, 0);
-        init_completion(&event);
-        bio->bi_private = &event;
-        bio->bi_end_io = bi_complete;
-        submit_bio(rw, bio);
-        wait_for_completion(&event);
+        submit_bio_wait(rw, bio);
 
         ret = test_bit(BIO_UPTODATE, &bio->bi_flags);
         bio_put(bio);
@@ -7777,7 +7767,7 @@ void md_check_recovery(struct mddev *mddev)
         if (mddev->ro && !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
                 return;
         if ( ! (
-                (mddev->flags & ~ (1<<MD_CHANGE_PENDING)) ||
+                (mddev->flags & MD_UPDATE_SB_FLAGS & ~ (1<<MD_CHANGE_PENDING)) ||
                 test_bit(MD_RECOVERY_NEEDED, &mddev->recovery) ||
                 test_bit(MD_RECOVERY_DONE, &mddev->recovery) ||
                 (mddev->external == 0 && mddev->safemode == 1) ||
diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c
index af96e24ec328..1d75b1dc1e2e 100644
--- a/drivers/md/persistent-data/dm-array.c
+++ b/drivers/md/persistent-data/dm-array.c
@@ -317,8 +317,16 @@ static int shadow_ablock(struct dm_array_info *info, dm_block_t *root,
          * The shadow op will often be a noop.  Only insert if it really
          * copied data.
          */
-        if (dm_block_location(*block) != b)
+        if (dm_block_location(*block) != b) {
+                /*
+                 * dm_tm_shadow_block will have already decremented the old
+                 * block, but it is still referenced by the btree.  We
+                 * increment to stop the insert decrementing it below zero
+                 * when overwriting the old value.
+                 */
+                dm_tm_inc(info->btree_info.tm, b);
                 r = insert_ablock(info, index, *block, root);
+        }
 
         return r;
 }
diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c
index a7e8bf296388..064a3c271baa 100644
--- a/drivers/md/persistent-data/dm-block-manager.c
+++ b/drivers/md/persistent-data/dm-block-manager.c
@@ -626,6 +626,12 @@ void dm_bm_set_read_only(struct dm_block_manager *bm)
 }
 EXPORT_SYMBOL_GPL(dm_bm_set_read_only);
 
+void dm_bm_set_read_write(struct dm_block_manager *bm)
+{
+        bm->read_only = false;
+}
+EXPORT_SYMBOL_GPL(dm_bm_set_read_write);
+
 u32 dm_bm_checksum(const void *data, size_t len, u32 init_xor)
 {
         return crc32c(~(u32) 0, data, len) ^ init_xor;
diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h
index 9a82083a66b6..13cd58e1fe69 100644
--- a/drivers/md/persistent-data/dm-block-manager.h
+++ b/drivers/md/persistent-data/dm-block-manager.h
@@ -108,9 +108,9 @@ int dm_bm_unlock(struct dm_block *b);
 int dm_bm_flush_and_unlock(struct dm_block_manager *bm,
                            struct dm_block *superblock);
 
- /*
-  * Request data be prefetched into the cache.
-  */
+/*
+ * Request data is prefetched into the cache.
+ */
 void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b);
 
 /*
@@ -125,6 +125,7 @@ void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b);
  * be returned if you do.
  */
 void dm_bm_set_read_only(struct dm_block_manager *bm);
+void dm_bm_set_read_write(struct dm_block_manager *bm);
 
 u32 dm_bm_checksum(const void *data, size_t len, u32 init_xor);
 
diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
index 6058569fe86c..466a60bbd716 100644
--- a/drivers/md/persistent-data/dm-space-map-common.c
+++ b/drivers/md/persistent-data/dm-space-map-common.c
@@ -381,7 +381,7 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin,
 }
 
 static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
-                        uint32_t (*mutator)(void *context, uint32_t old),
+                        int (*mutator)(void *context, uint32_t old, uint32_t *new),
                         void *context, enum allocation_event *ev)
 {
         int r;
@@ -410,11 +410,17 @@ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
 
         if (old > 2) {
                 r = sm_ll_lookup_big_ref_count(ll, b, &old);
-                if (r < 0)
+                if (r < 0) {
+                        dm_tm_unlock(ll->tm, nb);
                         return r;
+                }
         }
 
-        ref_count = mutator(context, old);
+        r = mutator(context, old, &ref_count);
+        if (r) {
+                dm_tm_unlock(ll->tm, nb);
+                return r;
+        }
 
         if (ref_count <= 2) {
                 sm_set_bitmap(bm_le, bit, ref_count);
@@ -465,9 +471,10 @@ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
         return ll->save_ie(ll, index, &ie_disk);
 }
 
-static uint32_t set_ref_count(void *context, uint32_t old)
+static int set_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return *((uint32_t *) context);
+        *new = *((uint32_t *) context);
+        return 0;
 }
 
 int sm_ll_insert(struct ll_disk *ll, dm_block_t b,
@@ -476,9 +483,10 @@ int sm_ll_insert(struct ll_disk *ll, dm_block_t b,
         return sm_ll_mutate(ll, b, set_ref_count, &ref_count, ev);
 }
 
-static uint32_t inc_ref_count(void *context, uint32_t old)
+static int inc_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return old + 1;
+        *new = old + 1;
+        return 0;
 }
 
 int sm_ll_inc(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
@@ -486,9 +494,15 @@ int sm_ll_inc(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
         return sm_ll_mutate(ll, b, inc_ref_count, NULL, ev);
 }
 
-static uint32_t dec_ref_count(void *context, uint32_t old)
+static int dec_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return old - 1;
+        if (!old) {
+                DMERR_LIMIT("unable to decrement a reference count below 0");
+                return -EINVAL;
+        }
+
+        *new = old - 1;
+        return 0;
 }
 
 int sm_ll_dec(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 1c959684caef..58fc1eef7499 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -384,12 +384,16 @@ static int sm_metadata_new_block(struct dm_space_map *sm, dm_block_t *b)
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
 
         int r = sm_metadata_new_block_(sm, b);
-        if (r)
+        if (r) {
                 DMERR("unable to allocate new metadata block");
+                return r;
+        }
 
         r = sm_metadata_get_nr_free(sm, &count);
-        if (r)
+        if (r) {
                 DMERR("couldn't get free block count");
+                return r;
+        }
 
         check_threshold(&smm->threshold, count);
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 47da0af6322b..cc055da02e2a 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -678,26 +678,23 @@ get_active_stripe(struct r5conf *conf, sector_t sector,
                         } else
                                 init_stripe(sh, sector, previous);
                 } else {
+                        spin_lock(&conf->device_lock);
                         if (atomic_read(&sh->count)) {
                                 BUG_ON(!list_empty(&sh->lru)
                                     && !test_bit(STRIPE_EXPANDING, &sh->state)
                                     && !test_bit(STRIPE_ON_UNPLUG_LIST, &sh->state)
-                                    && !test_bit(STRIPE_ON_RELEASE_LIST, &sh->state));
+                                        );
                         } else {
-                                spin_lock(&conf->device_lock);
                                 if (!test_bit(STRIPE_HANDLE, &sh->state))
                                         atomic_inc(&conf->active_stripes);
-                                if (list_empty(&sh->lru) &&
-                                    !test_bit(STRIPE_ON_RELEASE_LIST, &sh->state) &&
-                                    !test_bit(STRIPE_EXPANDING, &sh->state))
-                                        BUG();
+                                BUG_ON(list_empty(&sh->lru));
                                 list_del_init(&sh->lru);
                                 if (sh->group) {
                                         sh->group->stripes_cnt--;
                                         sh->group = NULL;
                                 }
-                                spin_unlock(&conf->device_lock);
                         }
+                        spin_unlock(&conf->device_lock);
                 }
         } while (sh == NULL);
 
@@ -5471,7 +5468,7 @@ static int alloc_thread_groups(struct r5conf *conf, int cnt,
         for (i = 0; i < *group_cnt; i++) {
                 struct r5worker_group *group;
 
-                group = worker_groups[i];
+                group = &(*worker_groups)[i];
                 INIT_LIST_HEAD(&group->handle_list);
                 group->conf = conf;
                 group->workers = workers + i * cnt;
diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h
index d0799e323364..9c9063cd3208 100644
--- a/drivers/media/common/siano/smscoreapi.h
+++ b/drivers/media/common/siano/smscoreapi.h
@@ -955,7 +955,7 @@ struct sms_rx_stats {
         u32 modem_state;                /* from SMSHOSTLIB_DVB_MODEM_STATE_ET */
         s32 SNR;                /* dB */
         u32 ber;                /* Post Viterbi ber [1E-5] */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
         u32 ber_bit_count;      /* Total number of SYNC bits. */
         u32 ts_per;             /* Transport stream PER,
         0xFFFFFFFF indicate N/A */
@@ -981,7 +981,7 @@ struct sms_rx_stats_ex {
         u32 modem_state;                /* from SMSHOSTLIB_DVB_MODEM_STATE_ET */
         s32 SNR;                /* dB */
         u32 ber;                /* Post Viterbi ber [1E-5] */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
         u32 ber_bit_count;      /* Total number of SYNC bits. */
         u32 ts_per;             /* Transport stream PER,
         0xFFFFFFFF indicate N/A */
diff --git a/drivers/media/common/siano/smsdvb.h b/drivers/media/common/siano/smsdvb.h
index 92c413ba0c79..ae36d0ae0fb1 100644
--- a/drivers/media/common/siano/smsdvb.h
+++ b/drivers/media/common/siano/smsdvb.h
@@ -95,7 +95,7 @@ struct RECEPTION_STATISTICS_PER_SLICES_S {
         u32 is_demod_locked;    /* 0 - not locked, 1 - locked */
 
         u32 ber_bit_count;      /* Total number of SYNC bits. */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
 
         s32 MRC_SNR;            /* dB */
         s32 mrc_in_band_pwr;    /* In band power in dBM */
diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
index 58de4410c525..6c7ff0cdcd32 100644
--- a/drivers/media/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb-core/dvb_demux.c
@@ -435,7 +435,7 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                 dprintk_tscheck("TEI detected. "
                                 "PID=0x%x data1=0x%x\n",
                                 pid, buf[1]);
-                /* data in this packet cant be trusted - drop it unless
+                /* data in this packet can't be trusted - drop it unless
                  * module option dvb_demux_feed_err_pkts is set */
                 if (!dvb_demux_feed_err_pkts)
                         return;
@@ -1032,8 +1032,13 @@ static int dmx_section_feed_release_filter(struct dmx_section_feed *feed,
                 return -EINVAL;
         }
 
-        if (feed->is_filtering)
+        if (feed->is_filtering) {
+                /* release dvbdmx->mutex as far as it is
+                   acquired by stop_filtering() itself */
+                mutex_unlock(&dvbdmx->mutex);
                 feed->stop_filtering(feed);
+                mutex_lock(&dvbdmx->mutex);
+        }
 
         spin_lock_irq(&dvbdmx->lock);
         f = dvbdmxfeed->filter;
diff --git a/drivers/media/dvb-frontends/af9033.c b/drivers/media/dvb-frontends/af9033.c
index 30ee59052157..65728c25ea05 100644
--- a/drivers/media/dvb-frontends/af9033.c
+++ b/drivers/media/dvb-frontends/af9033.c
@@ -170,18 +170,18 @@ static int af9033_rd_reg_mask(struct af9033_state *state, u32 reg, u8 *val,
 static int af9033_wr_reg_val_tab(struct af9033_state *state,
                 const struct reg_val *tab, int tab_len)
 {
+#define MAX_TAB_LEN 212
         int ret, i, j;
-        u8 buf[MAX_XFER_SIZE];
+        u8 buf[1 + MAX_TAB_LEN];
+
+        dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
 
         if (tab_len > sizeof(buf)) {
-                dev_warn(&state->i2c->dev,
-                         "%s: i2c wr len=%d is too big!\n",
-                         KBUILD_MODNAME, tab_len);
+                dev_warn(&state->i2c->dev, "%s: tab len %d is too big\n",
+                                KBUILD_MODNAME, tab_len);
                 return -EINVAL;
         }
 
-        dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
-
         for (i = 0, j = 0; i < tab_len; i++) {
                 buf[j] = tab[i].val;
 
diff --git a/drivers/media/dvb-frontends/cxd2820r_c.c b/drivers/media/dvb-frontends/cxd2820r_c.c
index 125a44041011..5c6ab4921bf1 100644
--- a/drivers/media/dvb-frontends/cxd2820r_c.c
+++ b/drivers/media/dvb-frontends/cxd2820r_c.c
@@ -78,7 +78,7 @@ int cxd2820r_set_frontend_c(struct dvb_frontend *fe)
 
         num = if_freq / 1000; /* Hz => kHz */
         num *= 0x4000;
-        if_ctl = cxd2820r_div_u64_round_closest(num, 41000);
+        if_ctl = 0x4000 - cxd2820r_div_u64_round_closest(num, 41000);
         buf[0] = (if_ctl >> 8) & 0x3f;
         buf[1] = (if_ctl >> 0) & 0xff;
 
diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
index 90536147bf04..6dbbee453ee1 100644
--- a/drivers/media/dvb-frontends/dib8000.c
+++ b/drivers/media/dvb-frontends/dib8000.c
@@ -3048,7 +3048,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
                         dib8000_set_diversity_in(state->fe[0], state->diversity_onoff);
 
                         locks = (dib8000_read_word(state, 180) >> 6) & 0x3f; /* P_coff_winlen ? */
-                        /* coff should lock over P_coff_winlen ofdm symbols : give 3 times this lenght to lock */
+                        /* coff should lock over P_coff_winlen ofdm symbols : give 3 times this length to lock */
                         *timeout = dib8000_get_timeout(state, 2 * locks, SYMBOL_DEPENDENT_ON);
                         *tune_state = CT_DEMOD_STEP_5;
                         break;
@@ -3115,7 +3115,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
 
         case CT_DEMOD_STEP_9: /* 39 */
                         if ((state->revision == 0x8090) || ((dib8000_read_word(state, 1291) >> 9) & 0x1)) { /* fe capable of deinterleaving : esram */
-                                /* defines timeout for mpeg lock depending on interleaver lenght of longest layer */
+                                /* defines timeout for mpeg lock depending on interleaver length of longest layer */
                                 for (i = 0; i < 3; i++) {
                                         if (c->layer[i].interleaving >= deeper_interleaver) {
                                                 dprintk("layer%i: time interleaver = %d ", i, c->layer[i].interleaving);
diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c
index d416c15691da..bf29a3f0e6f0 100644
--- a/drivers/media/dvb-frontends/drxk_hard.c
+++ b/drivers/media/dvb-frontends/drxk_hard.c
@@ -1191,7 +1191,7 @@ static int mpegts_configure_pins(struct drxk_state *state, bool mpeg_enable)
                         goto error;
 
                 if (state->m_enable_parallel == true) {
-                        /* paralel -> enable MD1 to MD7 */
+                        /* parallel -> enable MD1 to MD7 */
                         status = write16(state, SIO_PDR_MD1_CFG__A,
                                          sio_pdr_mdx_cfg);
                         if (status < 0)
@@ -1428,7 +1428,7 @@ static int mpegts_stop(struct drxk_state *state)
 
         dprintk(1, "\n");
 
-        /* Gracefull shutdown (byte boundaries) */
+        /* Graceful shutdown (byte boundaries) */
         status = read16(state, FEC_OC_SNC_MODE__A, &fec_oc_snc_mode);
         if (status < 0)
                 goto error;
@@ -2021,7 +2021,7 @@ static int mpegts_dto_setup(struct drxk_state *state,
                 fec_oc_dto_burst_len = 204;
         }
 
-        /* Check serial or parrallel output */
+        /* Check serial or parallel output */
         fec_oc_reg_ipr_mode &= (~(FEC_OC_IPR_MODE_SERIAL__M));
         if (state->m_enable_parallel == false) {
                 /* MPEG data output is serial -> set ipr_mode[0] */
@@ -2908,7 +2908,7 @@ static int adc_synchronization(struct drxk_state *state)
                 goto error;
 
         if (count == 1) {
-                /* Try sampling on a diffrent edge */
+                /* Try sampling on a different edge */
                 u16 clk_neg = 0;
 
                 status = read16(state, IQM_AF_CLKNEG__A, &clk_neg);
@@ -3306,7 +3306,7 @@ static int dvbt_sc_command(struct drxk_state *state,
         if (status < 0)
                 goto error;
 
-        /* Retreive results parameters from SC */
+        /* Retrieve results parameters from SC */
         switch (cmd) {
                 /* All commands yielding 5 results */
                 /* All commands yielding 4 results */
@@ -3849,7 +3849,7 @@ static int set_dvbt(struct drxk_state *state, u16 intermediate_freqk_hz,
                 break;
         }
 #if 0
-        /* No hierachical channels support in BDA */
+        /* No hierarchical channels support in BDA */
         /* Priority (only for hierarchical channels) */
         switch (channel->priority) {
         case DRX_PRIORITY_LOW:
@@ -4081,7 +4081,7 @@ error:
 /*============================================================================*/
 
 /**
-* \brief Retreive lock status .
+* \brief Retrieve lock status .
 * \param demod    Pointer to demodulator instance.
 * \param lockStat Pointer to lock status structure.
 * \return DRXStatus_t.
@@ -6174,7 +6174,7 @@ static int init_drxk(struct drxk_state *state)
                         goto error;
 
                 /* Stamp driver version number in SCU data RAM in BCD code
-                        Done to enable field application engineers to retreive drxdriver version
+                        Done to enable field application engineers to retrieve drxdriver version
                         via I2C from SCU RAM.
                         Not using SCU command interface for SCU register access since no
                         microcode may be present.
@@ -6399,7 +6399,7 @@ static int drxk_set_parameters(struct dvb_frontend *fe)
         fe->ops.tuner_ops.get_if_frequency(fe, &IF);
         start(state, 0, IF);
 
-        /* After set_frontend, stats aren't avaliable */
+        /* After set_frontend, stats aren't available */
         p->strength.stat[0].scale = FE_SCALE_RELATIVE;
         p->cnr.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
         p->block_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c
index 7efb796c472c..50e8b63e5169 100644
--- a/drivers/media/dvb-frontends/rtl2830.c
+++ b/drivers/media/dvb-frontends/rtl2830.c
@@ -710,6 +710,7 @@ struct dvb_frontend *rtl2830_attach(const struct rtl2830_config *cfg,
                 sizeof(priv->tuner_i2c_adapter.name));
         priv->tuner_i2c_adapter.algo = &rtl2830_tuner_i2c_algo;
         priv->tuner_i2c_adapter.algo_data = NULL;
+        priv->tuner_i2c_adapter.dev.parent = &i2c->dev;
         i2c_set_adapdata(&priv->tuner_i2c_adapter, priv);
         if (i2c_add_adapter(&priv->tuner_i2c_adapter) < 0) {
                 dev_err(&i2c->dev,
diff --git a/drivers/media/i2c/adv7183_regs.h b/drivers/media/i2c/adv7183_regs.h
index 4a5b7d211d2f..b253d400e817 100644
--- a/drivers/media/i2c/adv7183_regs.h
+++ b/drivers/media/i2c/adv7183_regs.h
@@ -52,9 +52,9 @@
 #define ADV7183_VS_FIELD_CTRL_1    0x31 /* Vsync field control 1 */
 #define ADV7183_VS_FIELD_CTRL_2    0x32 /* Vsync field control 2 */
 #define ADV7183_VS_FIELD_CTRL_3    0x33 /* Vsync field control 3 */
-#define ADV7183_HS_POS_CTRL_1      0x34 /* Hsync positon control 1 */
-#define ADV7183_HS_POS_CTRL_2      0x35 /* Hsync positon control 2 */
-#define ADV7183_HS_POS_CTRL_3      0x36 /* Hsync positon control 3 */
+#define ADV7183_HS_POS_CTRL_1      0x34 /* Hsync position control 1 */
+#define ADV7183_HS_POS_CTRL_2      0x35 /* Hsync position control 2 */
+#define ADV7183_HS_POS_CTRL_3      0x36 /* Hsync position control 3 */
 #define ADV7183_POLARITY           0x37 /* Polarity */
 #define ADV7183_NTSC_COMB_CTRL     0x38 /* NTSC comb control */
 #define ADV7183_PAL_COMB_CTRL      0x39 /* PAL comb control */
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index fbfdd2fc2a36..a324106b9f11 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -877,7 +877,7 @@ static void configure_custom_video_timings(struct v4l2_subdev *sd,
                 break;
         case ADV7604_MODE_HDMI:
                 /* set default prim_mode/vid_std for HDMI
-                   accoring to [REF_03, c. 4.2] */
+                   according to [REF_03, c. 4.2] */
                 io_write(sd, 0x00, 0x02); /* video std */
                 io_write(sd, 0x01, 0x06); /* prim mode */
                 break;
diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index 22f729d66a96..b154f36740b4 100644
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -1013,7 +1013,7 @@ static void configure_custom_video_timings(struct v4l2_subdev *sd,
                 break;
         case ADV7842_MODE_HDMI:
                 /* set default prim_mode/vid_std for HDMI
-                   accoring to [REF_03, c. 4.2] */
+                   according to [REF_03, c. 4.2] */
                 io_write(sd, 0x00, 0x02); /* video std */
                 io_write(sd, 0x01, 0x06); /* prim mode */
                 break;
diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
index 82bf5679da30..99ee456700f4 100644
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -394,7 +394,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 
         if (!rc) {
                 /*
-                 * If platform_data doesn't specify rc_dev, initilize it
+                 * If platform_data doesn't specify rc_dev, initialize it
                  * internally
                  */
                 rc = rc_allocate_device();
diff --git a/drivers/media/i2c/m5mols/m5mols_controls.c b/drivers/media/i2c/m5mols/m5mols_controls.c
index f34429e452ab..a60931e66312 100644
--- a/drivers/media/i2c/m5mols/m5mols_controls.c
+++ b/drivers/media/i2c/m5mols/m5mols_controls.c
@@ -544,7 +544,7 @@ int m5mols_init_controls(struct v4l2_subdev *sd)
         u16 zoom_step;
         int ret;
 
-        /* Determine the firmware dependant control range and step values */
+        /* Determine the firmware dependent control range and step values */
         ret = m5mols_read_u16(sd, AE_MAX_GAIN_MON, &exposure_max);
         if (ret < 0)
                 return ret;
diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index 4734836fe5a4..1c2303d18bf4 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -19,6 +19,7 @@
 #include <linux/i2c.h>
 #include <linux/log2.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/of_gpio.h>
 #include <linux/pm.h>
 #include <linux/regulator/consumer.h>
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index 6fec9384d86e..e7f555cc827a 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -1460,7 +1460,7 @@ static int s5c73m3_oif_registered(struct v4l2_subdev *sd)
         mutex_unlock(&state->lock);
 
         v4l2_dbg(1, s5c73m3_dbg, sd, "%s: Booting %s (%d)\n",
-                 __func__, ret ? "failed" : "succeded", ret);
+                 __func__, ret ? "failed" : "succeeded", ret);
 
         return ret;
 }
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3.h b/drivers/media/i2c/s5c73m3/s5c73m3.h
index 9d2c08652246..9dfa516f6944 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3.h
+++ b/drivers/media/i2c/s5c73m3/s5c73m3.h
@@ -393,7 +393,7 @@ struct s5c73m3 {
 
         /* External master clock frequency */
         u32 mclk_frequency;
-        /* Video bus type - MIPI-CSI2/paralell */
+        /* Video bus type - MIPI-CSI2/parallel */
         enum v4l2_mbus_type bus_type;
 
         const struct s5c73m3_frame_size *sensor_pix_size[2];
diff --git a/drivers/media/i2c/saa7115.c b/drivers/media/i2c/saa7115.c
index 637d02634527..afdbcb045cee 100644
--- a/drivers/media/i2c/saa7115.c
+++ b/drivers/media/i2c/saa7115.c
@@ -1699,7 +1699,7 @@ static void saa711x_write_platform_data(struct saa711x_state *state,
  * the analog demod.
  * If the tuner is not found, it returns -ENODEV.
  * If auto-detection is disabled and the tuner doesn't match what it was
- *      requred, it returns -EINVAL and fills 'name'.
+ *      required, it returns -EINVAL and fills 'name'.
  * If the chip is found, it returns the chip ID and fills 'name'.
  */
 static int saa711x_detect_chip(struct i2c_client *client,
diff --git a/drivers/media/i2c/soc_camera/ov5642.c b/drivers/media/i2c/soc_camera/ov5642.c
index 0a5c5d4fedd6..d2daa6a8f272 100644
--- a/drivers/media/i2c/soc_camera/ov5642.c
+++ b/drivers/media/i2c/soc_camera/ov5642.c
@@ -642,7 +642,7 @@ static const struct ov5642_datafmt
 static int reg_read(struct i2c_client *client, u16 reg, u8 *val)
 {
         int ret;
-        /* We have 16-bit i2c addresses - care for endianess */
+        /* We have 16-bit i2c addresses - care for endianness */
         unsigned char data[2] = { reg >> 8, reg & 0xff };
 
         ret = i2c_master_send(client, data, 2);
diff --git a/drivers/media/i2c/ths7303.c b/drivers/media/i2c/ths7303.c
index 42276d93624c..ed9ae8875348 100644
--- a/drivers/media/i2c/ths7303.c
+++ b/drivers/media/i2c/ths7303.c
@@ -83,7 +83,8 @@ static int ths7303_write(struct v4l2_subdev *sd, u8 reg, u8 val)
 }
 
 /* following function is used to set ths7303 */
-int ths7303_setval(struct v4l2_subdev *sd, enum ths7303_filter_mode mode)
+static int ths7303_setval(struct v4l2_subdev *sd,
+                          enum ths7303_filter_mode mode)
 {
         struct i2c_client *client = v4l2_get_subdevdata(sd);
         struct ths7303_state *state = to_state(sd);
diff --git a/drivers/media/i2c/wm8775.c b/drivers/media/i2c/wm8775.c
index 3f584a7d0781..bee7946faa7c 100644
--- a/drivers/media/i2c/wm8775.c
+++ b/drivers/media/i2c/wm8775.c
@@ -130,12 +130,10 @@ static int wm8775_s_routing(struct v4l2_subdev *sd,
                 return -EINVAL;
         }
         state->input = input;
-        if (!v4l2_ctrl_g_ctrl(state->mute))
+        if (v4l2_ctrl_g_ctrl(state->mute))
                 return 0;
         if (!v4l2_ctrl_g_ctrl(state->vol))
                 return 0;
-        if (!v4l2_ctrl_g_ctrl(state->bal))
-                return 0;
         wm8775_set_audio(sd, 1);
         return 0;
 }
diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index a3b1ee9c00d7..92a06fd85865 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -4182,7 +4182,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
         }
         btv->std = V4L2_STD_PAL;
         init_irqreg(btv);
-        v4l2_ctrl_handler_setup(hdl);
+        if (!bttv_tvcards[btv->c.type].no_video)
+                v4l2_ctrl_handler_setup(hdl);
         if (hdl->error) {
                 result = hdl->error;
                 goto fail2;
diff --git a/drivers/media/pci/cx18/cx18-driver.h b/drivers/media/pci/cx18/cx18-driver.h
index 2767c64df0c8..57f4688ea55b 100644
--- a/drivers/media/pci/cx18/cx18-driver.h
+++ b/drivers/media/pci/cx18/cx18-driver.h
@@ -262,7 +262,7 @@ struct cx18_options {
 };
 
 /* per-mdl bit flags */
-#define CX18_F_M_NEED_SWAP  0   /* mdl buffer data must be endianess swapped */
+#define CX18_F_M_NEED_SWAP  0   /* mdl buffer data must be endianness swapped */
 
 /* per-stream, s_flags */
 #define CX18_F_S_CLAIMED        3       /* this stream is claimed */
diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
index e3fc2c71808a..95666eee7b27 100644
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -427,7 +427,7 @@ int mc417_register_read(struct cx23885_dev *dev, u16 address, u32 *value)
         cx_write(MC417_RWD, regval);
 
         /* Transition RD to effect read transaction across bus.
-         * Transtion 0x5000 -> 0x9000 correct (RD/RDY -> WR/RDY)?
+         * Transition 0x5000 -> 0x9000 correct (RD/RDY -> WR/RDY)?
          * Should it be 0x9000 -> 0xF000 (also why is RDY being set, its
          * input only...)
          */
diff --git a/drivers/media/pci/pluto2/pluto2.c b/drivers/media/pci/pluto2/pluto2.c
index 8164d74b46a4..655d6854a8d7 100644
--- a/drivers/media/pci/pluto2/pluto2.c
+++ b/drivers/media/pci/pluto2/pluto2.c
@@ -401,7 +401,7 @@ static int pluto_hw_init(struct pluto *pluto)
         /* set automatic LED control by FPGA */
         pluto_rw(pluto, REG_MISC, MISC_ALED, MISC_ALED);
 
-        /* set data endianess */
+        /* set data endianness */
 #ifdef __LITTLE_ENDIAN
         pluto_rw(pluto, REG_PIDn(0), PID0_END, PID0_END);
 #else
diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index 57ef5456f1e8..1bf06970ca3e 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -1354,9 +1354,11 @@ static int saa7164_initdev(struct pci_dev *pci_dev,
                 if (fw_debug) {
                         dev->kthread = kthread_run(saa7164_thread_function, dev,
                                 "saa7164 debug");
-                        if (!dev->kthread)
+                        if (IS_ERR(dev->kthread)) {
+                                dev->kthread = NULL;
                                 printk(KERN_ERR "%s() Failed to create "
                                         "debug kernel thread\n", __func__);
+                        }
                 }
 
         } /* != BOARD_UNKNOWN */
diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
index bd72fb97fea5..61f3dbcc259f 100644
--- a/drivers/media/platform/coda.c
+++ b/drivers/media/platform/coda.c
@@ -1434,7 +1434,7 @@ static void coda_buf_queue(struct vb2_buffer *vb)
         if (q_data->fourcc == V4L2_PIX_FMT_H264 &&
             vb->vb2_queue->type == V4L2_BUF_TYPE_VIDEO_OUTPUT) {
                 /*
-                 * For backwards compatiblity, queuing an empty buffer marks
+                 * For backwards compatibility, queuing an empty buffer marks
                  * the stream end
                  */
                 if (vb2_get_plane_payload(vb, 0) == 0)
diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
index 3d66d88ea3a1..f7915695c907 100644
--- a/drivers/media/platform/exynos4-is/fimc-core.c
+++ b/drivers/media/platform/exynos4-is/fimc-core.c
@@ -1039,7 +1039,7 @@ static int fimc_runtime_resume(struct device *dev)
 
         dbg("fimc%d: state: 0x%lx", fimc->id, fimc->state);
 
-        /* Enable clocks and perform basic initalization */
+        /* Enable clocks and perform basic initialization */
         clk_enable(fimc->clock[CLK_GATE]);
         fimc_hw_reset(fimc);
 
diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
index 7a4ee4c0449d..c1bce170df6f 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -759,7 +759,7 @@ static int fimc_md_register_platform_entity(struct fimc_md *fmd,
                 goto dev_unlock;
 
         drvdata = dev_get_drvdata(dev);
-        /* Some subdev didn't probe succesfully id drvdata is NULL */
+        /* Some subdev didn't probe successfully id drvdata is NULL */
         if (drvdata) {
                 switch (plat_entity) {
                 case IDX_FIMC:
diff --git a/drivers/media/platform/marvell-ccic/mmp-driver.c b/drivers/media/platform/marvell-ccic/mmp-driver.c
index 3458fa0e2fd5..054507f16734 100644
--- a/drivers/media/platform/marvell-ccic/mmp-driver.c
+++ b/drivers/media/platform/marvell-ccic/mmp-driver.c
@@ -142,12 +142,6 @@ static int mmpcam_power_up(struct mcam_camera *mcam)
         struct mmp_camera *cam = mcam_to_cam(mcam);
         struct mmp_camera_platform_data *pdata;
 
-        if (mcam->bus_type == V4L2_MBUS_CSI2) {
-                cam->mipi_clk = devm_clk_get(mcam->dev, "mipi");
-                if ((IS_ERR(cam->mipi_clk) && mcam->dphy[2] == 0))
-                        return PTR_ERR(cam->mipi_clk);
-        }
-
 /*
  * Turn on power and clocks to the controller.
  */
@@ -186,12 +180,6 @@ static void mmpcam_power_down(struct mcam_camera *mcam)
         gpio_set_value(pdata->sensor_power_gpio, 0);
         gpio_set_value(pdata->sensor_reset_gpio, 0);
 
-        if (mcam->bus_type == V4L2_MBUS_CSI2 && !IS_ERR(cam->mipi_clk)) {
-                if (cam->mipi_clk)
-                        devm_clk_put(mcam->dev, cam->mipi_clk);
-                cam->mipi_clk = NULL;
-        }
-
         mcam_clk_disable(mcam);
 }
 
@@ -292,8 +280,9 @@ void mmpcam_calc_dphy(struct mcam_camera *mcam)
                 return;
 
         /* get the escape clk, this is hard coded */
+        clk_prepare_enable(cam->mipi_clk);
         tx_clk_esc = (clk_get_rate(cam->mipi_clk) / 1000000) / 12;
-
+        clk_disable_unprepare(cam->mipi_clk);
         /*
          * dphy[2] - CSI2_DPHY6:
          * bit 0 ~ bit 7: CK Term Enable
@@ -325,19 +314,6 @@ static irqreturn_t mmpcam_irq(int irq, void *data)
         return IRQ_RETVAL(handled);
 }
 
-static void mcam_deinit_clk(struct mcam_camera *mcam)
-{
-        unsigned int i;
-
-        for (i = 0; i < NR_MCAM_CLK; i++) {
-                if (!IS_ERR(mcam->clk[i])) {
-                        if (mcam->clk[i])
-                                devm_clk_put(mcam->dev, mcam->clk[i]);
-                }
-                mcam->clk[i] = NULL;
-        }
-}
-
 static void mcam_init_clk(struct mcam_camera *mcam)
 {
         unsigned int i;
@@ -371,7 +347,6 @@ static int mmpcam_probe(struct platform_device *pdev)
         if (cam == NULL)
                 return -ENOMEM;
         cam->pdev = pdev;
-        cam->mipi_clk = NULL;
         INIT_LIST_HEAD(&cam->devlist);
 
         mcam = &cam->mcam;
@@ -387,6 +362,11 @@ static int mmpcam_probe(struct platform_device *pdev)
         mcam->mclk_div = pdata->mclk_div;
         mcam->bus_type = pdata->bus_type;
         mcam->dphy = pdata->dphy;
+        if (mcam->bus_type == V4L2_MBUS_CSI2) {
+                cam->mipi_clk = devm_clk_get(mcam->dev, "mipi");
+                if ((IS_ERR(cam->mipi_clk) && mcam->dphy[2] == 0))
+                        return PTR_ERR(cam->mipi_clk);
+        }
         mcam->mipi_enabled = false;
         mcam->lane = pdata->lane;
         mcam->chip_id = MCAM_ARMADA610;
@@ -444,7 +424,7 @@ static int mmpcam_probe(struct platform_device *pdev)
          */
         ret = mmpcam_power_up(mcam);
         if (ret)
-                goto out_deinit_clk;
+                return ret;
         ret = mccic_register(mcam);
         if (ret)
                 goto out_power_down;
@@ -469,8 +449,6 @@ out_unregister:
         mccic_shutdown(mcam);
 out_power_down:
         mmpcam_power_down(mcam);
-out_deinit_clk:
-        mcam_deinit_clk(mcam);
         return ret;
 }
 
@@ -478,18 +456,10 @@ out_deinit_clk:
 static int mmpcam_remove(struct mmp_camera *cam)
 {
         struct mcam_camera *mcam = &cam->mcam;
-        struct mmp_camera_platform_data *pdata;
 
         mmpcam_remove_device(cam);
         mccic_shutdown(mcam);
         mmpcam_power_down(mcam);
-        pdata = cam->pdev->dev.platform_data;
-        gpio_free(pdata->sensor_reset_gpio);
-        gpio_free(pdata->sensor_power_gpio);
-        mcam_deinit_clk(mcam);
-        iounmap(cam->power_regs);
-        iounmap(mcam->regs);
-        kfree(cam);
         return 0;
 }
 
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 1c3608039663..561bce8ffb1b 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -1673,7 +1673,7 @@ void omap3isp_print_status(struct isp_device *isp)
  * ISP clocks get disabled in suspend(). Similarly, the clocks are reenabled in
  * resume(), and the the pipelines are restarted in complete().
  *
- * TODO: PM dependencies between the ISP and sensors are not modeled explicitly
+ * TODO: PM dependencies between the ISP and sensors are not modelled explicitly
  * yet.
  */
 static int isp_pm_prepare(struct device *dev)
diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
index a908d006f527..f6304bb074f5 100644
--- a/drivers/media/platform/omap3isp/ispvideo.c
+++ b/drivers/media/platform/omap3isp/ispvideo.c
@@ -339,14 +339,11 @@ __isp_video_get_format(struct isp_video *video, struct v4l2_format *format)
         if (subdev == NULL)
                 return -EINVAL;
 
-        mutex_lock(&video->mutex);
-
         fmt.pad = pad;
         fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
-        ret = v4l2_subdev_call(subdev, pad, get_fmt, NULL, &fmt);
-        if (ret == -ENOIOCTLCMD)
-                ret = -EINVAL;
 
+        mutex_lock(&video->mutex);
+        ret = v4l2_subdev_call(subdev, pad, get_fmt, NULL, &fmt);
         mutex_unlock(&video->mutex);
 
         if (ret)
diff --git a/drivers/media/platform/s5p-mfc/regs-mfc.h b/drivers/media/platform/s5p-mfc/regs-mfc.h
index 9319e93599ae..6ccc3f8c122a 100644
--- a/drivers/media/platform/s5p-mfc/regs-mfc.h
+++ b/drivers/media/platform/s5p-mfc/regs-mfc.h
@@ -382,7 +382,7 @@
 #define S5P_FIMV_R2H_CMD_EDFU_INIT_RET          16
 #define S5P_FIMV_R2H_CMD_ERR_RET                32
 
-/* Dummy definition for MFCv6 compatibilty */
+/* Dummy definition for MFCv6 compatibility */
 #define S5P_FIMV_CODEC_H264_MVC_DEC             -1
 #define S5P_FIMV_R2H_CMD_FIELD_DONE_RET         -1
 #define S5P_FIMV_MFC_RESET                      -1
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 5f2c4ad6c2cb..e46067a57853 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -239,7 +239,7 @@ static void s5p_mfc_handle_frame_copy_time(struct s5p_mfc_ctx *ctx)
         frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_dec_frame_type, dev);
 
         /* Copy timestamp / timecode from decoded src to dst and set
-           appropraite flags */
+           appropriate flags */
         src_buf = list_entry(ctx->src_queue.next, struct s5p_mfc_buf, list);
         list_for_each_entry(dst_buf, &ctx->dst_queue, list) {
                 if (vb2_dma_contig_plane_dma_addr(dst_buf->b, 0) == dec_y_addr) {
@@ -428,7 +428,7 @@ static void s5p_mfc_handle_error(struct s5p_mfc_dev *dev,
                 case MFCINST_FINISHING:
                 case MFCINST_FINISHED:
                 case MFCINST_RUNNING:
-                        /* It is higly probable that an error occured
+                        /* It is highly probable that an error occurred
                          * while decoding a frame */
                         clear_work_bit(ctx);
                         ctx->state = MFCINST_ERROR;
@@ -611,7 +611,7 @@ static irqreturn_t s5p_mfc_irq(int irq, void *priv)
         mfc_debug(1, "Int reason: %d (err: %08x)\n", reason, err);
         switch (reason) {
         case S5P_MFC_R2H_CMD_ERR_RET:
-                /* An error has occured */
+                /* An error has occurred */
                 if (ctx->state == MFCINST_RUNNING &&
                         s5p_mfc_hw_call(dev->mfc_ops, err_dec, err) >=
                                 dev->warn_start)
@@ -840,7 +840,7 @@ static int s5p_mfc_open(struct file *file)
         mutex_unlock(&dev->mfc_mutex);
         mfc_debug_leave();
         return ret;
-        /* Deinit when failure occured */
+        /* Deinit when failure occurred */
 err_queue_init:
         if (dev->num_inst == 1)
                 s5p_mfc_deinit_hw(dev);
@@ -881,14 +881,14 @@ static int s5p_mfc_release(struct file *file)
         /* Mark context as idle */
         clear_work_bit_irqsave(ctx);
         /* If instance was initialised then
-         * return instance and free reosurces */
+         * return instance and free resources */
         if (ctx->inst_no != MFC_NO_INSTANCE_SET) {
                 mfc_debug(2, "Has to free instance\n");
                 ctx->state = MFCINST_RETURN_INST;
                 set_work_bit_irqsave(ctx);
                 s5p_mfc_clean_ctx_int_flags(ctx);
                 s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
-                /* Wait until instance is returned or timeout occured */
+                /* Wait until instance is returned or timeout occurred */
                 if (s5p_mfc_wait_for_done_ctx
                     (ctx, S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0)) {
                         s5p_mfc_clock_off();
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
index 7cab6849fb5b..2475a3c9a0a6 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
@@ -69,7 +69,7 @@ int s5p_mfc_alloc_firmware(struct s5p_mfc_dev *dev)
 
         } else {
                 /* In this case bank2 can point to the same address as bank1.
-                 * Firmware will always occupy the beggining of this area so it is
+                 * Firmware will always occupy the beginning of this area so it is
                  * impossible having a video frame buffer with zero address. */
                 dev->bank2 = dev->bank1;
         }
diff --git a/drivers/media/platform/s5p-tv/mixer.h b/drivers/media/platform/s5p-tv/mixer.h
index 04e6490a45be..fb2acc53112a 100644
--- a/drivers/media/platform/s5p-tv/mixer.h
+++ b/drivers/media/platform/s5p-tv/mixer.h
@@ -65,7 +65,7 @@ struct mxr_format {
         int num_subframes;
         /** specifies to which subframe belong given plane */
         int plane2subframe[MXR_MAX_PLANES];
-        /** internal code, driver dependant */
+        /** internal code, driver dependent */
         unsigned long cookie;
 };
 
diff --git a/drivers/media/platform/s5p-tv/mixer_video.c b/drivers/media/platform/s5p-tv/mixer_video.c
index 641b1f071e06..81b97db111d8 100644
--- a/drivers/media/platform/s5p-tv/mixer_video.c
+++ b/drivers/media/platform/s5p-tv/mixer_video.c
@@ -528,7 +528,7 @@ static int mxr_s_dv_timings(struct file *file, void *fh,
         mutex_lock(&mdev->mutex);
 
         /* timings change cannot be done while there is an entity
-         * dependant on output configuration
+         * dependent on output configuration
          */
         if (mdev->n_output > 0) {
                 mutex_unlock(&mdev->mutex);
@@ -585,7 +585,7 @@ static int mxr_s_std(struct file *file, void *fh, v4l2_std_id norm)
         mutex_lock(&mdev->mutex);
 
         /* standard change cannot be done while there is an entity
-         * dependant on output configuration
+         * dependent on output configuration
          */
         if (mdev->n_output > 0) {
                 mutex_unlock(&mdev->mutex);
diff --git a/drivers/media/platform/soc_camera/omap1_camera.c b/drivers/media/platform/soc_camera/omap1_camera.c
index 6769193c7c7b..74ce8b6b79fa 100644
--- a/drivers/media/platform/soc_camera/omap1_camera.c
+++ b/drivers/media/platform/soc_camera/omap1_camera.c
@@ -1495,7 +1495,7 @@ static int omap1_cam_set_bus_param(struct soc_camera_device *icd)
         if (ctrlclock & LCLK_EN)
                 CAM_WRITE(pcdev, CTRLCLOCK, ctrlclock);
 
-        /* select bus endianess */
+        /* select bus endianness */
         xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
         fmt = xlate->host_fmt;
 
diff --git a/drivers/media/platform/vivi.c b/drivers/media/platform/vivi.c
index 1d3f11965196..2d4e73b45c5e 100644
--- a/drivers/media/platform/vivi.c
+++ b/drivers/media/platform/vivi.c
@@ -1108,7 +1108,7 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
         return 0;
 }
 
-/* timeperframe is arbitrary and continous */
+/* timeperframe is arbitrary and continuous */
 static int vidioc_enum_frameintervals(struct file *file, void *priv,
                                              struct v4l2_frmivalenum *fival)
 {
@@ -1125,7 +1125,7 @@ static int vidioc_enum_frameintervals(struct file *file, void *priv,
 
         fival->type = V4L2_FRMIVAL_TYPE_CONTINUOUS;
 
-        /* fill in stepwise (step=1.0 is requred by V4L2 spec) */
+        /* fill in stepwise (step=1.0 is required by V4L2 spec) */
         fival->stepwise.min  = tpf_min;
         fival->stepwise.max  = tpf_max;
         fival->stepwise.step = (struct v4l2_fract) {1, 1};
diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
index 1c9e771aa15c..d16bf0f41e24 100644
--- a/drivers/media/platform/vsp1/vsp1_drv.c
+++ b/drivers/media/platform/vsp1/vsp1_drv.c
@@ -323,7 +323,7 @@ static void vsp1_clocks_disable(struct vsp1_device *vsp1)
  * Increment the VSP1 reference count and initialize the device if the first
  * reference is taken.
  *
- * Return a pointer to the VSP1 device or NULL if an error occured.
+ * Return a pointer to the VSP1 device or NULL if an error occurred.
  */
 struct vsp1_device *vsp1_device_get(struct vsp1_device *vsp1)
 {
diff --git a/drivers/media/platform/vsp1/vsp1_video.c b/drivers/media/platform/vsp1/vsp1_video.c
index 714c53ef6c11..4b0ac07af662 100644
--- a/drivers/media/platform/vsp1/vsp1_video.c
+++ b/drivers/media/platform/vsp1/vsp1_video.c
@@ -1026,8 +1026,10 @@ int vsp1_video_init(struct vsp1_video *video, struct vsp1_entity *rwpf)
 
         /* ... and the buffers queue... */
         video->alloc_ctx = vb2_dma_contig_init_ctx(video->vsp1->dev);
-        if (IS_ERR(video->alloc_ctx))
+        if (IS_ERR(video->alloc_ctx)) {
+                ret = PTR_ERR(video->alloc_ctx);
                 goto error;
+        }
 
         video->queue.type = video->type;
         video->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF;
diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c
index 3db8a8cfe1a8..050b3bb96fec 100644
--- a/drivers/media/radio/radio-shark.c
+++ b/drivers/media/radio/radio-shark.c
@@ -271,8 +271,7 @@ static void shark_unregister_leds(struct shark_device *shark)
         cancel_work_sync(&shark->led_work);
 }
 
-#ifdef CONFIG_PM
-static void shark_resume_leds(struct shark_device *shark)
+static inline void shark_resume_leds(struct shark_device *shark)
 {
         if (test_bit(BLUE_IS_PULSE, &shark->brightness_new))
                 set_bit(BLUE_PULSE_LED, &shark->brightness_new);
@@ -281,7 +280,6 @@ static void shark_resume_leds(struct shark_device *shark)
         set_bit(RED_LED, &shark->brightness_new);
         schedule_work(&shark->led_work);
 }
-#endif
 #else
 static int shark_register_leds(struct shark_device *shark, struct device *dev)
 {
diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
index d86d90dab8bf..8654e0dc5c95 100644
--- a/drivers/media/radio/radio-shark2.c
+++ b/drivers/media/radio/radio-shark2.c
@@ -237,8 +237,7 @@ static void shark_unregister_leds(struct shark_device *shark)
         cancel_work_sync(&shark->led_work);
 }
 
-#ifdef CONFIG_PM
-static void shark_resume_leds(struct shark_device *shark)
+static inline void shark_resume_leds(struct shark_device *shark)
 {
         int i;
 
@@ -247,7 +246,6 @@ static void shark_resume_leds(struct shark_device *shark)
 
         schedule_work(&shark->led_work);
 }
-#endif
 #else
 static int shark_register_leds(struct shark_device *shark, struct device *dev)
 {
diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
index 9c9084cb99f7..2fd9009f8663 100644
--- a/drivers/media/radio/radio-si476x.c
+++ b/drivers/media/radio/radio-si476x.c
@@ -268,8 +268,8 @@ struct si476x_radio;
  *
  * @tune_freq: Tune chip to a specific frequency
  * @seek_start: Star station seeking
- * @rsq_status: Get Recieved Signal Quality(RSQ) status
- * @rds_blckcnt: Get recived RDS blocks count
+ * @rsq_status: Get Received Signal Quality(RSQ) status
+ * @rds_blckcnt: Get received RDS blocks count
  * @phase_diversity: Change phase diversity mode of the tuner
  * @phase_div_status: Get phase diversity mode status
  * @acf_status: Get the status of Automatically Controlled
diff --git a/drivers/media/radio/radio-tea5764.c b/drivers/media/radio/radio-tea5764.c
index 036e2f54f4db..3ed1f5669f79 100644
--- a/drivers/media/radio/radio-tea5764.c
+++ b/drivers/media/radio/radio-tea5764.c
@@ -356,7 +356,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
                    So we keep it as-is. */
                 return -EINVAL;
         }
-        clamp(freq, FREQ_MIN * FREQ_MUL, FREQ_MAX * FREQ_MUL);
+        freq = clamp(freq, FREQ_MIN * FREQ_MUL, FREQ_MAX * FREQ_MUL);
         tea5764_power_up(radio);
         tea5764_tune(radio, (freq * 125) / 2);
         return 0;
diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
index 69e3245a58a0..a9319a24c7ef 100644
--- a/drivers/media/radio/tef6862.c
+++ b/drivers/media/radio/tef6862.c
@@ -112,7 +112,7 @@ static int tef6862_s_frequency(struct v4l2_subdev *sd, const struct v4l2_frequen
         if (f->tuner != 0)
                 return -EINVAL;
 
-        clamp(freq, TEF6862_LO_FREQ, TEF6862_HI_FREQ);
+        freq = clamp(freq, TEF6862_LO_FREQ, TEF6862_HI_FREQ);
         pll = 1964 + ((freq - TEF6862_LO_FREQ) * 20) / FREQ_MUL;
         i2cmsg[0] = (MSA_MODE_PRESET << MSA_MODE_SHIFT) | WM_SUB_PLLM;
         i2cmsg[1] = (pll >> 8) & 0xff;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 72e3fa652481..f329485c6629 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -1370,7 +1370,7 @@ static void imon_pad_to_keys(struct imon_context *ictx, unsigned char *buf)
          * 0x68nnnnB7 to 0x6AnnnnB7, the left mouse button generates
          * 0x688301b7 and the right one 0x688481b7. All other keys generate
          * 0x2nnnnnnn. Position coordinate is encoded in buf[1] and buf[2] with
-         * reversed endianess. Extract direction from buffer, rotate endianess,
+         * reversed endianness. Extract direction from buffer, rotate endianness,
          * adjust sign and feed the values into stabilize(). The resulting codes
          * will be 0x01008000, 0x01007F00, which match the newer devices.
          */
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 094484fac94c..a5d4f883d053 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -118,7 +118,7 @@ static int debug;
 #define RR3_IR_IO_LENGTH_FUZZ   0x04
 /* Timeout for end of signal detection */
 #define RR3_IR_IO_SIG_TIMEOUT   0x05
-/* Minumum value for pause recognition. */
+/* Minimum value for pause recognition. */
 #define RR3_IR_IO_MIN_PAUSE     0x06
 
 /* Clock freq. of EZ-USB chip */
diff --git a/drivers/media/tuners/mt2063.c b/drivers/media/tuners/mt2063.c
index 2e1a02e360ff..20cca405bf45 100644
--- a/drivers/media/tuners/mt2063.c
+++ b/drivers/media/tuners/mt2063.c
@@ -1195,7 +1195,7 @@ static u32 mt2063_set_dnc_output_enable(struct mt2063_state *state,
  *   DNC Output is selected, the other is always off)
  *
  * @state:      ptr to mt2063_state structure
- * @Mode:       desired reciever delivery system
+ * @Mode:       desired receiver delivery system
  *
  * Note: Register cache must be valid for it to work
  */
@@ -2119,7 +2119,7 @@ static int mt2063_set_analog_params(struct dvb_frontend *fe,
 
 /*
  * As defined on EN 300 429, the DVB-C roll-off factor is 0.15.
- * So, the amount of the needed bandwith is given by:
+ * So, the amount of the needed bandwidth is given by:
  *      Bw = Symbol_rate * (1 + 0.15)
  * As such, the maximum symbol rate supported by 6 MHz is given by:
  *      max_symbol_rate = 6 MHz / 1.15 = 5217391 Bauds
diff --git a/drivers/media/tuners/tuner-xc2028-types.h b/drivers/media/tuners/tuner-xc2028-types.h
index 74dc46a71f64..7e4798783db7 100644
--- a/drivers/media/tuners/tuner-xc2028-types.h
+++ b/drivers/media/tuners/tuner-xc2028-types.h
@@ -119,7 +119,7 @@
 #define V4L2_STD_A2             (V4L2_STD_A2_A    | V4L2_STD_A2_B)
 #define V4L2_STD_NICAM          (V4L2_STD_NICAM_A | V4L2_STD_NICAM_B)
 
-/* To preserve backward compatibilty,
+/* To preserve backward compatibility,
    (std & V4L2_STD_AUDIO) = 0 means that ALL audio stds are supported
  */
 
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
index e9d017bea377..528cce958a82 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1412,8 +1412,8 @@ err_v4l2:
         usb_set_intfdata(interface, NULL);
 err_if:
         usb_put_dev(udev);
-        kfree(dev);
         clear_bit(dev->devno, &cx231xx_devused);
+        kfree(dev);
         return retval;
 }
 
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index c8fcd78425bd..8f9b2cea88f0 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -131,7 +131,7 @@ static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
 {
         u8 wbuf[MAX_XFER_SIZE];
         u8 mbox = (reg >> 16) & 0xff;
-        struct usb_req req = { CMD_MEM_WR, mbox, sizeof(wbuf), wbuf, 0, NULL };
+        struct usb_req req = { CMD_MEM_WR, mbox, 6 + len, wbuf, 0, NULL };
 
         if (6 + len > sizeof(wbuf)) {
                 dev_warn(&d->udev->dev, "%s: i2c wr: len=%d is too big!\n",
@@ -238,14 +238,15 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                 } else {
                         /* I2C */
                         u8 buf[MAX_XFER_SIZE];
-                        struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
+                        struct usb_req req = { CMD_I2C_RD, 0, 5 + msg[0].len,
                                         buf, msg[1].len, msg[1].buf };
 
                         if (5 + msg[0].len > sizeof(buf)) {
                                 dev_warn(&d->udev->dev,
                                          "%s: i2c xfer: len=%d is too big!\n",
                                          KBUILD_MODNAME, msg[0].len);
-                                return -EOPNOTSUPP;
+                                ret = -EOPNOTSUPP;
+                                goto unlock;
                         }
                         req.mbox |= ((msg[0].addr & 0x80)  >>  3);
                         buf[0] = msg[1].len;
@@ -274,14 +275,15 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                 } else {
                         /* I2C */
                         u8 buf[MAX_XFER_SIZE];
-                        struct usb_req req = { CMD_I2C_WR, 0, sizeof(buf), buf,
-                                        0, NULL };
+                        struct usb_req req = { CMD_I2C_WR, 0, 5 + msg[0].len,
+                                        buf, 0, NULL };
 
                         if (5 + msg[0].len > sizeof(buf)) {
                                 dev_warn(&d->udev->dev,
                                          "%s: i2c xfer: len=%d is too big!\n",
                                          KBUILD_MODNAME, msg[0].len);
-                                return -EOPNOTSUPP;
+                                ret = -EOPNOTSUPP;
+                                goto unlock;
                         }
                         req.mbox |= ((msg[0].addr & 0x80)  >>  3);
                         buf[0] = msg[0].len;
@@ -319,6 +321,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                 ret = -EOPNOTSUPP;
         }
 
+unlock:
         mutex_unlock(&d->i2c_mutex);
 
         if (ret < 0)
@@ -1534,6 +1537,8 @@ static const struct usb_device_id af9035_id_table[] = {
         /* XXX: that same ID [0ccd:0099] is used by af9015 driver too */
         { DVB_USB_DEVICE(USB_VID_TERRATEC, 0x0099,
                 &af9035_props, "TerraTec Cinergy T Stick Dual RC (rev. 2)", NULL) },
+        { DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a05,
+                &af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) },
         { }
 };
 MODULE_DEVICE_TABLE(usb, af9035_id_table);
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 2627553f7de1..08240e498451 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -266,7 +266,7 @@ static int mxl111sf_adap_fe_init(struct dvb_frontend *fe)
         struct mxl111sf_adap_state *adap_state = &state->adap_state[fe->id];
         int err;
 
-        /* exit if we didnt initialize the driver yet */
+        /* exit if we didn't initialize the driver yet */
         if (!state->chip_id) {
                 mxl_debug("driver not yet initialized, exit.");
                 goto fail;
@@ -322,7 +322,7 @@ static int mxl111sf_adap_fe_sleep(struct dvb_frontend *fe)
         struct mxl111sf_adap_state *adap_state = &state->adap_state[fe->id];
         int err;
 
-        /* exit if we didnt initialize the driver yet */
+        /* exit if we didn't initialize the driver yet */
         if (!state->chip_id) {
                 mxl_debug("driver not yet initialized, exit.");
                 goto fail;
diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
index 40832a1aef6c..98d24aefb640 100644
--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
+++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
@@ -102,7 +102,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
         if (rxlen > 62) {
                 err("i2c RX buffer can't exceed 62 bytes (dev 0x%02x)",
                                 device_addr);
-                txlen = 62;
+                rxlen = 62;
         }
 
         b[0] = I2C_SPEED_100KHZ_BIT;
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index fc5d60efd4ab..dd19c9ff76e0 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -1664,8 +1664,8 @@ static int em28xx_v4l2_close(struct file *filp)
 
         em28xx_videodbg("users=%d\n", dev->users);
 
-        mutex_lock(&dev->lock);
         vb2_fop_release(filp);
+        mutex_lock(&dev->lock);
 
         if (dev->users == 1) {
                 /* the device is already disconnect,
diff --git a/drivers/media/usb/gspca/gl860/gl860.c b/drivers/media/usb/gspca/gl860/gl860.c
index cb1e64ca59c9..cea8d7f51c3c 100644
--- a/drivers/media/usb/gspca/gl860/gl860.c
+++ b/drivers/media/usb/gspca/gl860/gl860.c
@@ -438,7 +438,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
         s32 nToSkip =
                 sd->swapRB * (gspca_dev->cam.cam_mode[mode].bytesperline + 1);
 
-        /* Test only against 0202h, so endianess does not matter */
+        /* Test only against 0202h, so endianness does not matter */
         switch (*(s16 *) data) {
         case 0x0202:            /* End of frame, start a new one */
                 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
diff --git a/drivers/media/usb/gspca/pac207.c b/drivers/media/usb/gspca/pac207.c
index cd79c180f67b..07529e5a0c56 100644
--- a/drivers/media/usb/gspca/pac207.c
+++ b/drivers/media/usb/gspca/pac207.c
@@ -416,7 +416,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                         u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
         int ret = -EINVAL;
 
diff --git a/drivers/media/usb/gspca/pac7302.c b/drivers/media/usb/gspca/pac7302.c
index a91509643563..2fd1c5e31a0f 100644
--- a/drivers/media/usb/gspca/pac7302.c
+++ b/drivers/media/usb/gspca/pac7302.c
@@ -874,7 +874,7 @@ static int sd_dbg_s_register(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                         u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
         int ret = -EINVAL;
         u8 data0, data1;
diff --git a/drivers/media/usb/gspca/stk1135.c b/drivers/media/usb/gspca/stk1135.c
index 1fc80af2a189..48234c9a8b6c 100644
--- a/drivers/media/usb/gspca/stk1135.c
+++ b/drivers/media/usb/gspca/stk1135.c
@@ -361,6 +361,9 @@ static void stk1135_configure_clock(struct gspca_dev *gspca_dev)
 
         /* set serial interface clock divider (30MHz/0x1f*16+2) = 60240 kHz) */
         reg_w(gspca_dev, STK1135_REG_SICTL + 2, 0x1f);
+
+        /* wait a while for sensor to catch up */
+        udelay(1000);
 }
 
 static void stk1135_camera_disable(struct gspca_dev *gspca_dev)
diff --git a/drivers/media/usb/gspca/stv0680.c b/drivers/media/usb/gspca/stv0680.c
index 9c0827631b9c..7f94ec74282e 100644
--- a/drivers/media/usb/gspca/stv0680.c
+++ b/drivers/media/usb/gspca/stv0680.c
@@ -139,7 +139,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
         struct sd *sd = (struct sd *) gspca_dev;
         struct cam *cam = &gspca_dev->cam;
 
-        /* Give the camera some time to settle, otherwise initalization will
+        /* Give the camera some time to settle, otherwise initialization will
            fail on hotplug, and yes it really needs a full second. */
         msleep(1000);
 
diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
index a517d185febe..46c9f2229a18 100644
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -1027,6 +1027,7 @@ static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x055f, 0xc650), BS(SPCA533, 0)},
         {USB_DEVICE(0x05da, 0x1018), BS(SPCA504B, 0)},
         {USB_DEVICE(0x06d6, 0x0031), BS(SPCA533, 0)},
+        {USB_DEVICE(0x06d6, 0x0041), BS(SPCA504B, 0)},
         {USB_DEVICE(0x0733, 0x1311), BS(SPCA533, 0)},
         {USB_DEVICE(0x0733, 0x1314), BS(SPCA533, 0)},
         {USB_DEVICE(0x0733, 0x2211), BS(SPCA533, 0)},
diff --git a/drivers/media/usb/gspca/zc3xx.c b/drivers/media/usb/gspca/zc3xx.c
index 7b95d8e88a20..d3e1b6d8bf49 100644
--- a/drivers/media/usb/gspca/zc3xx.c
+++ b/drivers/media/usb/gspca/zc3xx.c
@@ -6905,7 +6905,7 @@ static int sd_get_jcomp(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                         u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
         if (len == 8 && data[4] == 1) {
                 input_report_key(gspca_dev->input_dev, KEY_CAMERA, 1);
diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c
index 77bbf7889659..78c9bc8e7f56 100644
--- a/drivers/media/usb/pwc/pwc-if.c
+++ b/drivers/media/usb/pwc/pwc-if.c
@@ -1039,7 +1039,7 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
         /* Set the leds off */
         pwc_set_leds(pdev, 0, 0);
 
-        /* Setup intial videomode */
+        /* Setup initial videomode */
         rc = pwc_set_video_mode(pdev, MAX_WIDTH, MAX_HEIGHT,
                                 V4L2_PIX_FMT_YUV420, 30, &compression, 1);
         if (rc)
diff --git a/drivers/media/usb/usbtv/usbtv.c b/drivers/media/usb/usbtv/usbtv.c
index 8a505a90d318..6222a4ab1e00 100644
--- a/drivers/media/usb/usbtv/usbtv.c
+++ b/drivers/media/usb/usbtv/usbtv.c
@@ -50,13 +50,8 @@
 #define USBTV_ISOC_TRANSFERS    16
 #define USBTV_ISOC_PACKETS      8
 
-#define USBTV_WIDTH             720
-#define USBTV_HEIGHT            480
-
 #define USBTV_CHUNK_SIZE        256
 #define USBTV_CHUNK             240
-#define USBTV_CHUNKS            (USBTV_WIDTH * USBTV_HEIGHT \
-                                        / 4 / USBTV_CHUNK)
 
 /* Chunk header. */
 #define USBTV_MAGIC_OK(chunk)   ((be32_to_cpu(chunk[0]) & 0xff000000) \
@@ -65,6 +60,27 @@
 #define USBTV_ODD(chunk)        ((be32_to_cpu(chunk[0]) & 0x0000f000) >> 15)
 #define USBTV_CHUNK_NO(chunk)   (be32_to_cpu(chunk[0]) & 0x00000fff)
 
+#define USBTV_TV_STD  (V4L2_STD_525_60 | V4L2_STD_PAL)
+
+/* parameters for supported TV norms */
+struct usbtv_norm_params {
+        v4l2_std_id norm;
+        int cap_width, cap_height;
+};
+
+static struct usbtv_norm_params norm_params[] = {
+        {
+                .norm = V4L2_STD_525_60,
+                .cap_width = 720,
+                .cap_height = 480,
+        },
+        {
+                .norm = V4L2_STD_PAL,
+                .cap_width = 720,
+                .cap_height = 576,
+        }
+};
+
 /* A single videobuf2 frame buffer. */
 struct usbtv_buf {
         struct vb2_buffer vb;
@@ -94,11 +110,38 @@ struct usbtv {
                 USBTV_COMPOSITE_INPUT,
                 USBTV_SVIDEO_INPUT,
         } input;
+        v4l2_std_id norm;
+        int width, height;
+        int n_chunks;
         int iso_size;
         unsigned int sequence;
         struct urb *isoc_urbs[USBTV_ISOC_TRANSFERS];
 };
 
+static int usbtv_configure_for_norm(struct usbtv *usbtv, v4l2_std_id norm)
+{
+        int i, ret = 0;
+        struct usbtv_norm_params *params = NULL;
+
+        for (i = 0; i < ARRAY_SIZE(norm_params); i++) {
+                if (norm_params[i].norm & norm) {
+                        params = &norm_params[i];
+                        break;
+                }
+        }
+
+        if (params) {
+                usbtv->width = params->cap_width;
+                usbtv->height = params->cap_height;
+                usbtv->n_chunks = usbtv->width * usbtv->height
+                                                / 4 / USBTV_CHUNK;
+                usbtv->norm = params->norm;
+        } else
+                ret = -EINVAL;
+
+        return ret;
+}
+
 static int usbtv_set_regs(struct usbtv *usbtv, const u16 regs[][2], int size)
 {
         int ret;
@@ -158,6 +201,57 @@ static int usbtv_select_input(struct usbtv *usbtv, int input)
         return ret;
 }
 
+static int usbtv_select_norm(struct usbtv *usbtv, v4l2_std_id norm)
+{
+        int ret;
+        static const u16 pal[][2] = {
+                { USBTV_BASE + 0x001a, 0x0068 },
+                { USBTV_BASE + 0x010e, 0x0072 },
+                { USBTV_BASE + 0x010f, 0x00a2 },
+                { USBTV_BASE + 0x0112, 0x00b0 },
+                { USBTV_BASE + 0x0117, 0x0001 },
+                { USBTV_BASE + 0x0118, 0x002c },
+                { USBTV_BASE + 0x012d, 0x0010 },
+                { USBTV_BASE + 0x012f, 0x0020 },
+                { USBTV_BASE + 0x024f, 0x0002 },
+                { USBTV_BASE + 0x0254, 0x0059 },
+                { USBTV_BASE + 0x025a, 0x0016 },
+                { USBTV_BASE + 0x025b, 0x0035 },
+                { USBTV_BASE + 0x0263, 0x0017 },
+                { USBTV_BASE + 0x0266, 0x0016 },
+                { USBTV_BASE + 0x0267, 0x0036 }
+        };
+
+        static const u16 ntsc[][2] = {
+                { USBTV_BASE + 0x001a, 0x0079 },
+                { USBTV_BASE + 0x010e, 0x0068 },
+                { USBTV_BASE + 0x010f, 0x009c },
+                { USBTV_BASE + 0x0112, 0x00f0 },
+                { USBTV_BASE + 0x0117, 0x0000 },
+                { USBTV_BASE + 0x0118, 0x00fc },
+                { USBTV_BASE + 0x012d, 0x0004 },
+                { USBTV_BASE + 0x012f, 0x0008 },
+                { USBTV_BASE + 0x024f, 0x0001 },
+                { USBTV_BASE + 0x0254, 0x005f },
+                { USBTV_BASE + 0x025a, 0x0012 },
+                { USBTV_BASE + 0x025b, 0x0001 },
+                { USBTV_BASE + 0x0263, 0x001c },
+                { USBTV_BASE + 0x0266, 0x0011 },
+                { USBTV_BASE + 0x0267, 0x0005 }
+        };
+
+        ret = usbtv_configure_for_norm(usbtv, norm);
+
+        if (!ret) {
+                if (norm & V4L2_STD_525_60)
+                        ret = usbtv_set_regs(usbtv, ntsc, ARRAY_SIZE(ntsc));
+                else if (norm & V4L2_STD_PAL)
+                        ret = usbtv_set_regs(usbtv, pal, ARRAY_SIZE(pal));
+        }
+
+        return ret;
+}
+
 static int usbtv_setup_capture(struct usbtv *usbtv)
 {
         int ret;
@@ -225,26 +319,11 @@ static int usbtv_setup_capture(struct usbtv *usbtv)
 
                 { USBTV_BASE + 0x0284, 0x0088 },
                 { USBTV_BASE + 0x0003, 0x0004 },
-                { USBTV_BASE + 0x001a, 0x0079 },
                 { USBTV_BASE + 0x0100, 0x00d3 },
-                { USBTV_BASE + 0x010e, 0x0068 },
-                { USBTV_BASE + 0x010f, 0x009c },
-                { USBTV_BASE + 0x0112, 0x00f0 },
                 { USBTV_BASE + 0x0115, 0x0015 },
-                { USBTV_BASE + 0x0117, 0x0000 },
-                { USBTV_BASE + 0x0118, 0x00fc },
-                { USBTV_BASE + 0x012d, 0x0004 },
-                { USBTV_BASE + 0x012f, 0x0008 },
                 { USBTV_BASE + 0x0220, 0x002e },
                 { USBTV_BASE + 0x0225, 0x0008 },
                 { USBTV_BASE + 0x024e, 0x0002 },
-                { USBTV_BASE + 0x024f, 0x0001 },
-                { USBTV_BASE + 0x0254, 0x005f },
-                { USBTV_BASE + 0x025a, 0x0012 },
-                { USBTV_BASE + 0x025b, 0x0001 },
-                { USBTV_BASE + 0x0263, 0x001c },
-                { USBTV_BASE + 0x0266, 0x0011 },
-                { USBTV_BASE + 0x0267, 0x0005 },
                 { USBTV_BASE + 0x024e, 0x0002 },
                 { USBTV_BASE + 0x024f, 0x0002 },
         };
@@ -253,6 +332,10 @@ static int usbtv_setup_capture(struct usbtv *usbtv)
         if (ret)
                 return ret;
 
+        ret = usbtv_select_norm(usbtv, usbtv->norm);
+        if (ret)
+                return ret;
+
         ret = usbtv_select_input(usbtv, usbtv->input);
         if (ret)
                 return ret;
@@ -296,7 +379,7 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
         frame_id = USBTV_FRAME_ID(chunk);
         odd = USBTV_ODD(chunk);
         chunk_no = USBTV_CHUNK_NO(chunk);
-        if (chunk_no >= USBTV_CHUNKS)
+        if (chunk_no >= usbtv->n_chunks)
                 return;
 
         /* Beginning of a frame. */
@@ -324,10 +407,10 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
         usbtv->chunks_done++;
 
         /* Last chunk in a frame, signalling an end */
-        if (odd && chunk_no == USBTV_CHUNKS-1) {
+        if (odd && chunk_no == usbtv->n_chunks-1) {
                 int size = vb2_plane_size(&buf->vb, 0);
                 enum vb2_buffer_state state = usbtv->chunks_done ==
-                                                USBTV_CHUNKS ?
+                                                usbtv->n_chunks ?
                                                 VB2_BUF_STATE_DONE :
                                                 VB2_BUF_STATE_ERROR;
 
@@ -500,6 +583,8 @@ static int usbtv_querycap(struct file *file, void *priv,
 static int usbtv_enum_input(struct file *file, void *priv,
                                         struct v4l2_input *i)
 {
+        struct usbtv *dev = video_drvdata(file);
+
         switch (i->index) {
         case USBTV_COMPOSITE_INPUT:
                 strlcpy(i->name, "Composite", sizeof(i->name));
@@ -512,7 +597,7 @@ static int usbtv_enum_input(struct file *file, void *priv,
         }
 
         i->type = V4L2_INPUT_TYPE_CAMERA;
-        i->std = V4L2_STD_525_60;
+        i->std = dev->vdev.tvnorms;
         return 0;
 }
 
@@ -531,23 +616,37 @@ static int usbtv_enum_fmt_vid_cap(struct file *file, void  *priv,
 static int usbtv_fmt_vid_cap(struct file *file, void *priv,
                                         struct v4l2_format *f)
 {
-        f->fmt.pix.width = USBTV_WIDTH;
-        f->fmt.pix.height = USBTV_HEIGHT;
+        struct usbtv *usbtv = video_drvdata(file);
+
+        f->fmt.pix.width = usbtv->width;
+        f->fmt.pix.height = usbtv->height;
         f->fmt.pix.pixelformat = V4L2_PIX_FMT_YUYV;
         f->fmt.pix.field = V4L2_FIELD_INTERLACED;
-        f->fmt.pix.bytesperline = USBTV_WIDTH * 2;
+        f->fmt.pix.bytesperline = usbtv->width * 2;
         f->fmt.pix.sizeimage = (f->fmt.pix.bytesperline * f->fmt.pix.height);
         f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
-        f->fmt.pix.priv = 0;
+
         return 0;
 }
 
 static int usbtv_g_std(struct file *file, void *priv, v4l2_std_id *norm)
 {
-        *norm = V4L2_STD_525_60;
+        struct usbtv *usbtv = video_drvdata(file);
+        *norm = usbtv->norm;
         return 0;
 }
 
+static int usbtv_s_std(struct file *file, void *priv, v4l2_std_id norm)
+{
+        int ret = -EINVAL;
+        struct usbtv *usbtv = video_drvdata(file);
+
+        if ((norm & V4L2_STD_525_60) || (norm & V4L2_STD_PAL))
+                ret = usbtv_select_norm(usbtv, norm);
+
+        return ret;
+}
+
 static int usbtv_g_input(struct file *file, void *priv, unsigned int *i)
 {
         struct usbtv *usbtv = video_drvdata(file);
@@ -561,13 +660,6 @@ static int usbtv_s_input(struct file *file, void *priv, unsigned int i)
         return usbtv_select_input(usbtv, i);
 }
 
-static int usbtv_s_std(struct file *file, void *priv, v4l2_std_id norm)
-{
-        if (norm & V4L2_STD_525_60)
-                return 0;
-        return -EINVAL;
-}
-
 struct v4l2_ioctl_ops usbtv_ioctl_ops = {
         .vidioc_querycap = usbtv_querycap,
         .vidioc_enum_input = usbtv_enum_input,
@@ -604,10 +696,12 @@ static int usbtv_queue_setup(struct vb2_queue *vq,
         const struct v4l2_format *v4l_fmt, unsigned int *nbuffers,
         unsigned int *nplanes, unsigned int sizes[], void *alloc_ctxs[])
 {
+        struct usbtv *usbtv = vb2_get_drv_priv(vq);
+
         if (*nbuffers < 2)
                 *nbuffers = 2;
         *nplanes = 1;
-        sizes[0] = USBTV_WIDTH * USBTV_HEIGHT / 2 * sizeof(u32);
+        sizes[0] = USBTV_CHUNK * usbtv->n_chunks * 2 * sizeof(u32);
 
         return 0;
 }
@@ -690,7 +784,11 @@ static int usbtv_probe(struct usb_interface *intf,
                 return -ENOMEM;
         usbtv->dev = dev;
         usbtv->udev = usb_get_dev(interface_to_usbdev(intf));
+
         usbtv->iso_size = size;
+
+        (void)usbtv_configure_for_norm(usbtv, V4L2_STD_525_60);
+
         spin_lock_init(&usbtv->buflock);
         mutex_init(&usbtv->v4l2_lock);
         mutex_init(&usbtv->vb2q_lock);
@@ -727,7 +825,7 @@ static int usbtv_probe(struct usb_interface *intf,
         usbtv->vdev.release = video_device_release_empty;
         usbtv->vdev.fops = &usbtv_fops;
         usbtv->vdev.ioctl_ops = &usbtv_ioctl_ops;
-        usbtv->vdev.tvnorms = V4L2_STD_525_60;
+        usbtv->vdev.tvnorms = USBTV_TV_STD;
         usbtv->vdev.queue = &usbtv->vb2q;
         usbtv->vdev.lock = &usbtv->v4l2_lock;
         set_bit(V4L2_FL_USE_FH_PRIO, &usbtv->vdev.flags);
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 899cb6d1c4a4..898c208889cd 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -556,7 +556,7 @@ static u16 uvc_video_clock_host_sof(const struct uvc_clock_sample *sample)
  *
  * SOF = ((SOF2 - SOF1) * PTS + SOF1 * STC2 - SOF2 * STC1) / (STC2 - STC1)   (1)
  *
- * to avoid loosing precision in the division. Similarly, the host timestamp is
+ * to avoid losing precision in the division. Similarly, the host timestamp is
  * computed with
  *
  * TS = ((TS2 - TS1) * PTS + TS1 * SOF2 - TS2 * SOF1) / (SOF2 - SOF1)        (2)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 60dcc0f3b32e..fb46790d0eca 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -420,7 +420,7 @@ const char * const *v4l2_ctrl_get_menu(u32 id)
                 "Advanced Simple",
                 "Core",
                 "Simple Scalable",
-                "Advanced Coding Efficency",
+                "Advanced Coding Efficiency",
                 NULL,
         };
 
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index b19b306c8f7f..0edc165f418d 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -145,6 +145,25 @@ static void __vb2_buf_dmabuf_put(struct vb2_buffer *vb)
 }
 
 /**
+ * __setup_lengths() - setup initial lengths for every plane in
+ * every buffer on the queue
+ */
+static void __setup_lengths(struct vb2_queue *q, unsigned int n)
+{
+        unsigned int buffer, plane;
+        struct vb2_buffer *vb;
+
+        for (buffer = q->num_buffers; buffer < q->num_buffers + n; ++buffer) {
+                vb = q->bufs[buffer];
+                if (!vb)
+                        continue;
+
+                for (plane = 0; plane < vb->num_planes; ++plane)
+                        vb->v4l2_planes[plane].length = q->plane_sizes[plane];
+        }
+}
+
+/**
  * __setup_offsets() - setup unique offsets ("cookies") for every plane in
  * every buffer on the queue
  */
@@ -169,7 +188,6 @@ static void __setup_offsets(struct vb2_queue *q, unsigned int n)
                         continue;
 
                 for (plane = 0; plane < vb->num_planes; ++plane) {
-                        vb->v4l2_planes[plane].length = q->plane_sizes[plane];
                         vb->v4l2_planes[plane].m.mem_offset = off;
 
                         dprintk(3, "Buffer %d, plane %d offset 0x%08lx\n",
@@ -241,6 +259,7 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum v4l2_memory memory,
                 q->bufs[q->num_buffers + buffer] = vb;
         }
 
+        __setup_lengths(q, buffer);
         if (memory == V4L2_MEMORY_MMAP)
                 __setup_offsets(q, buffer);
 
@@ -1824,8 +1843,8 @@ int vb2_expbuf(struct vb2_queue *q, struct v4l2_exportbuffer *eb)
                 return -EINVAL;
         }
 
-        if (eb->flags & ~O_CLOEXEC) {
-                dprintk(1, "Queue does support only O_CLOEXEC flag\n");
+        if (eb->flags & ~(O_CLOEXEC | O_ACCMODE)) {
+                dprintk(1, "Queue does support only O_CLOEXEC and access mode flags\n");
                 return -EINVAL;
         }
 
@@ -1848,14 +1867,14 @@ int vb2_expbuf(struct vb2_queue *q, struct v4l2_exportbuffer *eb)
 
         vb_plane = &vb->planes[eb->plane];
 
-        dbuf = call_memop(q, get_dmabuf, vb_plane->mem_priv);
+        dbuf = call_memop(q, get_dmabuf, vb_plane->mem_priv, eb->flags & O_ACCMODE);
         if (IS_ERR_OR_NULL(dbuf)) {
                 dprintk(1, "Failed to export buffer %d, plane %d\n",
                         eb->index, eb->plane);
                 return -EINVAL;
         }
 
-        ret = dma_buf_fd(dbuf, eb->flags);
+        ret = dma_buf_fd(dbuf, eb->flags & ~O_ACCMODE);
         if (ret < 0) {
                 dprintk(3, "buffer %d, plane %d failed to export (%d)\n",
                         eb->index, eb->plane, ret);
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index 646f08f4f504..33d3871d1e13 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -393,7 +393,7 @@ static struct sg_table *vb2_dc_get_base_sgt(struct vb2_dc_buf *buf)
         return sgt;
 }
 
-static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv)
+static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv, unsigned long flags)
 {
         struct vb2_dc_buf *buf = buf_priv;
         struct dma_buf *dbuf;
@@ -404,7 +404,7 @@ static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv)
         if (WARN_ON(!buf->sgt_base))
                 return NULL;
 
-        dbuf = dma_buf_export(buf, &vb2_dc_dmabuf_ops, buf->size, 0);
+        dbuf = dma_buf_export(buf, &vb2_dc_dmabuf_ops, buf->size, flags);
         if (IS_ERR(dbuf))
                 return NULL;
 
diff --git a/drivers/media/v4l2-core/videobuf2-dma-sg.c b/drivers/media/v4l2-core/videobuf2-dma-sg.c
index 2f860543912c..0d3a8ffe47a3 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c
@@ -178,7 +178,7 @@ static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
         buf->pages = kzalloc(buf->num_pages * sizeof(struct page *),
                              GFP_KERNEL);
         if (!buf->pages)
-                return NULL;
+                goto userptr_fail_alloc_pages;
 
         num_pages_from_user = get_user_pages(current, current->mm,
                                              vaddr & PAGE_MASK,
@@ -204,6 +204,7 @@ userptr_fail_get_user_pages:
         while (--num_pages_from_user >= 0)
                 put_page(buf->pages[num_pages_from_user]);
         kfree(buf->pages);
+userptr_fail_alloc_pages:
         kfree(buf);
         return NULL;
 }
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 62a60caa5d1f..dd671582c9a1 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -32,7 +32,7 @@ config MFD_AS3722
         select MFD_CORE
         select REGMAP_I2C
         select REGMAP_IRQ
-        depends on I2C && OF
+        depends on I2C=y && OF
         help
           The ams AS3722 is a compact system PMU suitable for mobile phones,
           tablets etc. It has 4 DC/DC step-down regulators, 3 DC/DC step-down
diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
index da1c6566d93d..37edf9e989b0 100644
--- a/drivers/mfd/lpc_ich.c
+++ b/drivers/mfd/lpc_ich.c
@@ -506,7 +506,7 @@ static struct lpc_ich_info lpc_chipset_info[] = {
                 .iTCO_version = 2,
         },
         [LPC_WPT_LP] = {
-                .name = "Lynx Point_LP",
+                .name = "Wildcat Point_LP",
                 .iTCO_version = 2,
         },
 };
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index 34c18fb8c089..54cc25546592 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -81,31 +81,31 @@ static struct of_device_id sec_dt_match[] = {
 
 int sec_reg_read(struct sec_pmic_dev *sec_pmic, u8 reg, void *dest)
 {
-        return regmap_read(sec_pmic->regmap, reg, dest);
+        return regmap_read(sec_pmic->regmap_pmic, reg, dest);
 }
 EXPORT_SYMBOL_GPL(sec_reg_read);
 
 int sec_bulk_read(struct sec_pmic_dev *sec_pmic, u8 reg, int count, u8 *buf)
 {
-        return regmap_bulk_read(sec_pmic->regmap, reg, buf, count);
+        return regmap_bulk_read(sec_pmic->regmap_pmic, reg, buf, count);
 }
 EXPORT_SYMBOL_GPL(sec_bulk_read);
 
 int sec_reg_write(struct sec_pmic_dev *sec_pmic, u8 reg, u8 value)
 {
-        return regmap_write(sec_pmic->regmap, reg, value);
+        return regmap_write(sec_pmic->regmap_pmic, reg, value);
 }
 EXPORT_SYMBOL_GPL(sec_reg_write);
 
 int sec_bulk_write(struct sec_pmic_dev *sec_pmic, u8 reg, int count, u8 *buf)
 {
-        return regmap_raw_write(sec_pmic->regmap, reg, buf, count);
+        return regmap_raw_write(sec_pmic->regmap_pmic, reg, buf, count);
 }
 EXPORT_SYMBOL_GPL(sec_bulk_write);
 
 int sec_reg_update(struct sec_pmic_dev *sec_pmic, u8 reg, u8 val, u8 mask)
 {
-        return regmap_update_bits(sec_pmic->regmap, reg, mask, val);
+        return regmap_update_bits(sec_pmic->regmap_pmic, reg, mask, val);
 }
 EXPORT_SYMBOL_GPL(sec_reg_update);
 
@@ -166,6 +166,11 @@ static struct regmap_config s5m8767_regmap_config = {
         .cache_type = REGCACHE_FLAT,
 };
 
+static const struct regmap_config sec_rtc_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+};
+
 #ifdef CONFIG_OF
 /*
  * Only the common platform data elements for s5m8767 are parsed here from the
@@ -266,9 +271,9 @@ static int sec_pmic_probe(struct i2c_client *i2c,
                 break;
         }
 
-        sec_pmic->regmap = devm_regmap_init_i2c(i2c, regmap);
-        if (IS_ERR(sec_pmic->regmap)) {
-                ret = PTR_ERR(sec_pmic->regmap);
+        sec_pmic->regmap_pmic = devm_regmap_init_i2c(i2c, regmap);
+        if (IS_ERR(sec_pmic->regmap_pmic)) {
+                ret = PTR_ERR(sec_pmic->regmap_pmic);
                 dev_err(&i2c->dev, "Failed to allocate register map: %d\n",
                         ret);
                 return ret;
@@ -277,6 +282,15 @@ static int sec_pmic_probe(struct i2c_client *i2c,
         sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
         i2c_set_clientdata(sec_pmic->rtc, sec_pmic);
 
+        sec_pmic->regmap_rtc = devm_regmap_init_i2c(sec_pmic->rtc,
+                        &sec_rtc_regmap_config);
+        if (IS_ERR(sec_pmic->regmap_rtc)) {
+                ret = PTR_ERR(sec_pmic->regmap_rtc);
+                dev_err(&i2c->dev, "Failed to allocate RTC register map: %d\n",
+                        ret);
+                return ret;
+        }
+
         if (pdata && pdata->cfg_pmic_irq)
                 pdata->cfg_pmic_irq();
 
diff --git a/drivers/mfd/sec-irq.c b/drivers/mfd/sec-irq.c
index 0dd84e99081e..b441b1be27cb 100644
--- a/drivers/mfd/sec-irq.c
+++ b/drivers/mfd/sec-irq.c
@@ -280,19 +280,19 @@ int sec_irq_init(struct sec_pmic_dev *sec_pmic)
 
         switch (type) {
         case S5M8763X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                   sec_pmic->irq_base, &s5m8763_irq_chip,
                                   &sec_pmic->irq_data);
                 break;
         case S5M8767X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                   sec_pmic->irq_base, &s5m8767_irq_chip,
                                   &sec_pmic->irq_data);
                 break;
         case S2MPS11X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                   sec_pmic->irq_base, &s2mps11_irq_chip,
                                   &sec_pmic->irq_data);
diff --git a/drivers/mfd/ti-ssp.c b/drivers/mfd/ti-ssp.c
index 71e3e0c5bf73..a5424579679c 100644
--- a/drivers/mfd/ti-ssp.c
+++ b/drivers/mfd/ti-ssp.c
@@ -32,6 +32,7 @@
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/io.h>
+#include <linux/sched.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/ti_ssp.h>
 
@@ -409,7 +410,6 @@ static int ti_ssp_probe(struct platform_device *pdev)
                 cells[id].id            = id;
                 cells[id].name          = data->dev_name;
                 cells[id].platform_data = data->pdata;
-                cells[id].data_size     = data->pdata_size;
         }
 
         error = mfd_add_devices(dev, 0, cells, 2, NULL, 0, NULL);
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index 0e8df41aaf14..2cf2bbc0b927 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -198,6 +198,13 @@ static void enclosure_remove_links(struct enclosure_component *cdev)
 {
         char name[ENCLOSURE_NAME_SIZE];
 
+        /*
+         * In odd circumstances, like multipath devices, something else may
+         * already have removed the links, so check for this condition first.
+         */
+        if (!cdev->dev->kobj.sd)
+                return;
+
         enclosure_link_name(cdev, name);
         sysfs_remove_link(&cdev->dev->kobj, name);
         sysfs_remove_link(&cdev->cdev.kobj, "device");
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 6c0fde55270d..66f411a6e8ea 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -109,9 +109,12 @@
 #define MEI_DEV_ID_PPT_2      0x1CBA  /* Panther Point */
 #define MEI_DEV_ID_PPT_3      0x1DBA  /* Panther Point */
 
-#define MEI_DEV_ID_LPT        0x8C3A  /* Lynx Point */
+#define MEI_DEV_ID_LPT_H      0x8C3A  /* Lynx Point H */
 #define MEI_DEV_ID_LPT_W      0x8D3A  /* Lynx Point - Wellsburg */
 #define MEI_DEV_ID_LPT_LP     0x9C3A  /* Lynx Point LP */
+#define MEI_DEV_ID_LPT_HR     0x8CBA  /* Lynx Point H Refresh */
+
+#define MEI_DEV_ID_WPT_LP     0x9CBA  /* Wildcat Point LP */
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 3bfae3843d95..7dfaa328e519 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -76,9 +76,11 @@ static DEFINE_PCI_DEVICE_TABLE(mei_me_pci_tbl) = {
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_1)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_2)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_3)},
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_H)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_W)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_LP)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_HR)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_WPT_LP)},
 
         /* required last entry */
         {0, }
diff --git a/drivers/misc/mic/card/mic_virtio.c b/drivers/misc/mic/card/mic_virtio.c
index 8aa42e738acc..653799b96bfa 100644
--- a/drivers/misc/mic/card/mic_virtio.c
+++ b/drivers/misc/mic/card/mic_virtio.c
@@ -154,14 +154,14 @@ static void mic_reset_inform_host(struct virtio_device *vdev)
 {
         struct mic_vdev *mvdev = to_micvdev(vdev);
         struct mic_device_ctrl __iomem *dc = mvdev->dc;
-        int retry = 100, i;
+        int retry;
 
         iowrite8(0, &dc->host_ack);
         iowrite8(1, &dc->vdev_reset);
         mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
 
         /* Wait till host completes all card accesses and acks the reset */
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                 if (ioread8(&dc->host_ack))
                         break;
                 msleep(100);
@@ -187,11 +187,12 @@ static void mic_reset(struct virtio_device *vdev)
 /*
  * The virtio_ring code calls this API when it wants to notify the Host.
  */
-static void mic_notify(struct virtqueue *vq)
+static bool mic_notify(struct virtqueue *vq)
 {
         struct mic_vdev *mvdev = vq->priv;
 
         mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
+        return true;
 }
 
 static void mic_del_vq(struct virtqueue *vq, int n)
@@ -247,17 +248,17 @@ static struct virtqueue *mic_find_vq(struct virtio_device *vdev,
         /* First assign the vring's allocated in host memory */
         vqconfig = mic_vq_config(mvdev->desc) + index;
         memcpy_fromio(&config, vqconfig, sizeof(config));
-        _vr_size = vring_size(config.num, MIC_VIRTIO_RING_ALIGN);
+        _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN);
         vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info));
-        va = mic_card_map(mvdev->mdev, config.address, vr_size);
+        va = mic_card_map(mvdev->mdev, le64_to_cpu(config.address), vr_size);
         if (!va)
                 return ERR_PTR(-ENOMEM);
         mvdev->vr[index] = va;
         memset_io(va, 0x0, _vr_size);
-        vq = vring_new_virtqueue(index,
-                                config.num, MIC_VIRTIO_RING_ALIGN, vdev,
-                                false,
-                                va, mic_notify, callback, name);
+        vq = vring_new_virtqueue(index, le16_to_cpu(config.num),
+                                 MIC_VIRTIO_RING_ALIGN, vdev, false,
+                                 (void __force *)va, mic_notify, callback,
+                                 name);
         if (!vq) {
                 err = -ENOMEM;
                 goto unmap;
@@ -272,7 +273,8 @@ static struct virtqueue *mic_find_vq(struct virtio_device *vdev,
 
         /* Allocate and reassign used ring now */
         mvdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
-                        sizeof(struct vring_used_elem) * config.num);
+                                             sizeof(struct vring_used_elem) *
+                                             le16_to_cpu(config.num));
         used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                         get_order(mvdev->used_size[index]));
         if (!used) {
@@ -309,7 +311,7 @@ static int mic_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
         struct mic_vdev *mvdev = to_micvdev(vdev);
         struct mic_device_ctrl __iomem *dc = mvdev->dc;
-        int i, err, retry = 100;
+        int i, err, retry;
 
         /* We must have this many virtqueues. */
         if (nvqs > ioread8(&mvdev->desc->num_vq))
@@ -331,7 +333,7 @@ static int mic_find_vqs(struct virtio_device *vdev, unsigned nvqs,
          * rings have been re-assigned.
          */
         mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                 if (!ioread8(&dc->used_address_updated))
                         break;
                 msleep(100);
@@ -519,8 +521,8 @@ static void mic_scan_devices(struct mic_driver *mdrv, bool remove)
         struct device *dev;
         int ret;
 
-        for (i = mic_aligned_size(struct mic_bootparam);
-                i < MIC_DP_SIZE; i += mic_total_desc_size(d)) {
+        for (i = sizeof(struct mic_bootparam); i < MIC_DP_SIZE;
+                i += mic_total_desc_size(d)) {
                 d = mdrv->dp + i;
                 dc = (void __iomem *)d + mic_aligned_desc_size(d);
                 /*
@@ -539,7 +541,8 @@ static void mic_scan_devices(struct mic_driver *mdrv, bool remove)
                         continue;
 
                 /* device already exists */
-                dev = device_find_child(mdrv->dev, d, mic_match_desc);
+                dev = device_find_child(mdrv->dev, (void __force *)d,
+                                        mic_match_desc);
                 if (dev) {
                         if (remove)
                                 iowrite8(MIC_VIRTIO_PARAM_DEV_REMOVE,
diff --git a/drivers/misc/mic/card/mic_virtio.h b/drivers/misc/mic/card/mic_virtio.h
index 2c5c22c93ba8..d0407ba53bb7 100644
--- a/drivers/misc/mic/card/mic_virtio.h
+++ b/drivers/misc/mic/card/mic_virtio.h
@@ -42,8 +42,8 @@
 
 static inline unsigned mic_desc_size(struct mic_device_desc __iomem *desc)
 {
-        return mic_aligned_size(*desc)
-                + ioread8(&desc->num_vq) * mic_aligned_size(struct mic_vqconfig)
+        return sizeof(*desc)
+                + ioread8(&desc->num_vq) * sizeof(struct mic_vqconfig)
                 + ioread8(&desc->feature_len) * 2
                 + ioread8(&desc->config_len);
 }
@@ -67,8 +67,7 @@ mic_vq_configspace(struct mic_device_desc __iomem *desc)
 }
 static inline unsigned mic_total_desc_size(struct mic_device_desc __iomem *desc)
 {
-        return mic_aligned_desc_size(desc) +
-                mic_aligned_size(struct mic_device_ctrl);
+        return mic_aligned_desc_size(desc) + sizeof(struct mic_device_ctrl);
 }
 
 int mic_devices_init(struct mic_driver *mdrv);
diff --git a/drivers/misc/mic/host/mic_boot.c b/drivers/misc/mic/host/mic_boot.c
index 7558d9186438..b75c6b5cc20f 100644
--- a/drivers/misc/mic/host/mic_boot.c
+++ b/drivers/misc/mic/host/mic_boot.c
@@ -62,7 +62,7 @@ void mic_bootparam_init(struct mic_device *mdev)
 {
         struct mic_bootparam *bootparam = mdev->dp;
 
-        bootparam->magic = MIC_MAGIC;
+        bootparam->magic = cpu_to_le32(MIC_MAGIC);
         bootparam->c2h_shutdown_db = mdev->shutdown_db;
         bootparam->h2c_shutdown_db = -1;
         bootparam->h2c_config_db = -1;
diff --git a/drivers/misc/mic/host/mic_virtio.c b/drivers/misc/mic/host/mic_virtio.c
index 8d3c21cd1d9c..752ff873f891 100644
--- a/drivers/misc/mic/host/mic_virtio.c
+++ b/drivers/misc/mic/host/mic_virtio.c
@@ -41,7 +41,7 @@ static int mic_virtio_copy_to_user(struct mic_vdev *mvdev,
          * We are copying from IO below an should ideally use something
          * like copy_to_user_fromio(..) if it existed.
          */
-        if (copy_to_user(ubuf, dbuf, len)) {
+        if (copy_to_user(ubuf, (void __force *)dbuf, len)) {
                 err = -EFAULT;
                 dev_err(mic_dev(mvdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
@@ -66,7 +66,7 @@ static int mic_virtio_copy_from_user(struct mic_vdev *mvdev,
          * We are copying to IO below and should ideally use something
          * like copy_from_user_toio(..) if it existed.
          */
-        if (copy_from_user(dbuf, ubuf, len)) {
+        if (copy_from_user((void __force *)dbuf, ubuf, len)) {
                 err = -EFAULT;
                 dev_err(mic_dev(mvdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
@@ -293,7 +293,7 @@ static void mic_virtio_init_post(struct mic_vdev *mvdev)
                         continue;
                 }
                 mvdev->mvr[i].vrh.vring.used =
-                        mvdev->mdev->aper.va +
+                        (void __force *)mvdev->mdev->aper.va +
                         le64_to_cpu(vqconfig[i].used_address);
         }
 
@@ -378,7 +378,7 @@ int mic_virtio_config_change(struct mic_vdev *mvdev,
                         void __user *argp)
 {
         DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
-        int ret = 0, retry = 100, i;
+        int ret = 0, retry, i;
         struct mic_bootparam *bootparam = mvdev->mdev->dp;
         s8 db = bootparam->h2c_config_db;
 
@@ -401,7 +401,7 @@ int mic_virtio_config_change(struct mic_vdev *mvdev,
         mvdev->dc->config_change = MIC_VIRTIO_PARAM_CONFIG_CHANGED;
         mvdev->mdev->ops->send_intr(mvdev->mdev, db);
 
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                 ret = wait_event_timeout(wake,
                         mvdev->dc->guest_ack, msecs_to_jiffies(100));
                 if (ret)
@@ -467,7 +467,7 @@ static int mic_copy_dp_entry(struct mic_vdev *mvdev,
         }
 
         /* Find the first free device page entry */
-        for (i = mic_aligned_size(struct mic_bootparam);
+        for (i = sizeof(struct mic_bootparam);
                 i < MIC_DP_SIZE - mic_total_desc_size(dd_config);
                 i += mic_total_desc_size(devp)) {
                 devp = mdev->dp + i;
@@ -525,6 +525,7 @@ int mic_virtio_add_device(struct mic_vdev *mvdev,
         char irqname[10];
         struct mic_bootparam *bootparam = mdev->dp;
         u16 num;
+        dma_addr_t vr_addr;
 
         mutex_lock(&mdev->mic_mutex);
 
@@ -559,17 +560,16 @@ int mic_virtio_add_device(struct mic_vdev *mvdev,
                 }
                 vr->len = vr_size;
                 vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN);
-                vr->info->magic = MIC_MAGIC + mvdev->virtio_id + i;
-                vqconfig[i].address = mic_map_single(mdev,
-                        vr->va, vr_size);
-                if (mic_map_error(vqconfig[i].address)) {
+                vr->info->magic = cpu_to_le32(MIC_MAGIC + mvdev->virtio_id + i);
+                vr_addr = mic_map_single(mdev, vr->va, vr_size);
+                if (mic_map_error(vr_addr)) {
                         free_pages((unsigned long)vr->va, get_order(vr_size));
                         ret = -ENOMEM;
                         dev_err(mic_dev(mvdev), "%s %d err %d\n",
                                 __func__, __LINE__, ret);
                         goto err;
                 }
-                vqconfig[i].address = cpu_to_le64(vqconfig[i].address);
+                vqconfig[i].address = cpu_to_le64(vr_addr);
 
                 vring_init(&vr->vr, num, vr->va, MIC_VIRTIO_RING_ALIGN);
                 ret = vringh_init_kern(&mvr->vrh,
@@ -639,7 +639,7 @@ void mic_virtio_del_device(struct mic_vdev *mvdev)
         struct mic_vdev *tmp_mvdev;
         struct mic_device *mdev = mvdev->mdev;
         DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
-        int i, ret, retry = 100;
+        int i, ret, retry;
         struct mic_vqconfig *vqconfig;
         struct mic_bootparam *bootparam = mdev->dp;
         s8 db;
@@ -652,16 +652,16 @@ void mic_virtio_del_device(struct mic_vdev *mvdev)
                 "Requesting hot remove id %d\n", mvdev->virtio_id);
         mvdev->dc->config_change = MIC_VIRTIO_PARAM_DEV_REMOVE;
         mdev->ops->send_intr(mdev, db);
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                 ret = wait_event_timeout(wake,
                         mvdev->dc->guest_ack, msecs_to_jiffies(100));
                 if (ret)
                         break;
         }
         dev_dbg(mdev->sdev->parent,
-                "Device id %d config_change %d guest_ack %d\n",
+                "Device id %d config_change %d guest_ack %d retry %d\n",
                 mvdev->virtio_id, mvdev->dc->config_change,
-                mvdev->dc->guest_ack);
+                mvdev->dc->guest_ack, retry);
         mvdev->dc->config_change = 0;
         mvdev->dc->guest_ack = 0;
 skip_hot_remove:
diff --git a/drivers/misc/mic/host/mic_x100.c b/drivers/misc/mic/host/mic_x100.c
index 6fccb13493a5..5562fdd3ef4e 100644
--- a/drivers/misc/mic/host/mic_x100.c
+++ b/drivers/misc/mic/host/mic_x100.c
@@ -400,8 +400,8 @@ mic_x100_load_ramdisk(struct mic_device *mdev)
          * so copy over the ramdisk @ 128M.
          */
         memcpy_toio(mdev->aper.va + (mdev->bootaddr << 1), fw->data, fw->size);
-        iowrite32(cpu_to_le32(mdev->bootaddr << 1), &bp->hdr.ramdisk_image);
-        iowrite32(cpu_to_le32(fw->size), &bp->hdr.ramdisk_size);
+        iowrite32(mdev->bootaddr << 1, &bp->hdr.ramdisk_image);
+        iowrite32(fw->size, &bp->hdr.ramdisk_size);
         release_firmware(fw);
 error:
         return rc;
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 0b10a9030f4e..98b6b6ef7e5c 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -22,6 +22,7 @@
 #include <linux/delay.h>
 #include <linux/spinlock.h>
 #include <linux/timer.h>
+#include <linux/of.h>
 #include <linux/omap-dma.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/card.h>
@@ -90,17 +91,6 @@
 #define OMAP_MMC_CMDTYPE_AC     2
 #define OMAP_MMC_CMDTYPE_ADTC   3
 
-#define OMAP_DMA_MMC_TX         21
-#define OMAP_DMA_MMC_RX         22
-#define OMAP_DMA_MMC2_TX        54
-#define OMAP_DMA_MMC2_RX        55
-
-#define OMAP24XX_DMA_MMC2_TX    47
-#define OMAP24XX_DMA_MMC2_RX    48
-#define OMAP24XX_DMA_MMC1_TX    61
-#define OMAP24XX_DMA_MMC1_RX    62
-
-
 #define DRIVER_NAME "mmci-omap"
 
 /* Specifies how often in millisecs to poll for card status changes
@@ -1330,7 +1320,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
         struct mmc_omap_host *host = NULL;
         struct resource *res;
         dma_cap_mask_t mask;
-        unsigned sig;
+        unsigned sig = 0;
         int i, ret = 0;
         int irq;
 
@@ -1340,7 +1330,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
         }
         if (pdata->nr_slots == 0) {
                 dev_err(&pdev->dev, "no slots\n");
-                return -ENXIO;
+                return -EPROBE_DEFER;
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1407,19 +1397,20 @@ static int mmc_omap_probe(struct platform_device *pdev)
         host->dma_tx_burst = -1;
         host->dma_rx_burst = -1;
 
-        if (mmc_omap2())
-                sig = host->id == 0 ? OMAP24XX_DMA_MMC1_TX : OMAP24XX_DMA_MMC2_TX;
-        else
-                sig = host->id == 0 ? OMAP_DMA_MMC_TX : OMAP_DMA_MMC2_TX;
-        host->dma_tx = dma_request_channel(mask, omap_dma_filter_fn, &sig);
+        res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
+        if (res)
+                sig = res->start;
+        host->dma_tx = dma_request_slave_channel_compat(mask,
+                                omap_dma_filter_fn, &sig, &pdev->dev, "tx");
         if (!host->dma_tx)
                 dev_warn(host->dev, "unable to obtain TX DMA engine channel %u\n",
                         sig);
-        if (mmc_omap2())
-                sig = host->id == 0 ? OMAP24XX_DMA_MMC1_RX : OMAP24XX_DMA_MMC2_RX;
-        else
-                sig = host->id == 0 ? OMAP_DMA_MMC_RX : OMAP_DMA_MMC2_RX;
-        host->dma_rx = dma_request_channel(mask, omap_dma_filter_fn, &sig);
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
+        if (res)
+                sig = res->start;
+        host->dma_rx = dma_request_slave_channel_compat(mask,
+                                omap_dma_filter_fn, &sig, &pdev->dev, "rx");
         if (!host->dma_rx)
                 dev_warn(host->dev, "unable to obtain RX DMA engine channel %u\n",
                         sig);
@@ -1512,12 +1503,20 @@ static int mmc_omap_remove(struct platform_device *pdev)
         return 0;
 }
 
+#if IS_BUILTIN(CONFIG_OF)
+static const struct of_device_id mmc_omap_match[] = {
+        { .compatible = "ti,omap2420-mmc", },
+        { },
+};
+#endif
+
 static struct platform_driver mmc_omap_driver = {
         .probe          = mmc_omap_probe,
         .remove         = mmc_omap_remove,
         .driver         = {
                 .name   = DRIVER_NAME,
                 .owner  = THIS_MODULE,
+                .of_match_table = of_match_ptr(mmc_omap_match),
         },
 };
 
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 4cabdc9fda90..4b3aaa898a8b 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -962,7 +962,7 @@ static int pxa3xx_nand_init_buff(struct pxa3xx_nand_info *info)
 static void pxa3xx_nand_free_buff(struct pxa3xx_nand_info *info)
 {
         struct platform_device *pdev = info->pdev;
-        if (use_dma) {
+        if (info->use_dma) {
                 pxa_free_dma(info->data_dma_ch);
                 dma_free_coherent(&pdev->dev, info->buf_size,
                                   info->data_buff, info->data_buff_phys);
@@ -1259,10 +1259,6 @@ static struct of_device_id pxa3xx_nand_dt_ids[] = {
                 .compatible = "marvell,pxa3xx-nand",
                 .data       = (void *)PXA3XX_NAND_VARIANT_PXA,
         },
-        {
-                .compatible = "marvell,armada370-nand",
-                .data       = (void *)PXA3XX_NAND_VARIANT_ARMADA370,
-        },
         {}
 };
 MODULE_DEVICE_TABLE(of, pxa3xx_nand_dt_ids);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4dd5ee2a34cc..398e299ee1bd 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4110,7 +4110,7 @@ static int bond_check_params(struct bond_params *params)
                 if (!miimon) {
                         pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure, speed and duplex which are essential for 802.3ad operation\n");
                         pr_warning("Forcing miimon to 100msec\n");
-                        miimon = 100;
+                        miimon = BOND_DEFAULT_MIIMON;
                 }
         }
 
@@ -4147,7 +4147,7 @@ static int bond_check_params(struct bond_params *params)
                 if (!miimon) {
                         pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure and link speed which are essential for TLB/ALB load balancing\n");
                         pr_warning("Forcing miimon to 100msec\n");
-                        miimon = 100;
+                        miimon = BOND_DEFAULT_MIIMON;
                 }
         }
 
@@ -4199,9 +4199,9 @@ static int bond_check_params(struct bond_params *params)
              (arp_ip_count < BOND_MAX_ARP_TARGETS) && arp_ip_target[i]; i++) {
                 /* not complete check, but should be good enough to
                    catch mistakes */
-                __be32 ip = in_aton(arp_ip_target[i]);
-                if (!isdigit(arp_ip_target[i][0]) || ip == 0 ||
-                    ip == htonl(INADDR_BROADCAST)) {
+                __be32 ip;
+                if (!in4_pton(arp_ip_target[i], -1, (u8 *)&ip, -1, NULL) ||
+                    IS_IP_TARGET_UNUSABLE_ADDRESS(ip)) {
                         pr_warning("Warning: bad arp_ip_target module parameter (%s), ARP monitoring will not be performed\n",
                                    arp_ip_target[i]);
                         arp_interval = 0;
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 9a5223c7b4d1..ea6f640782b7 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -45,10 +45,15 @@ int bond_option_mode_set(struct bonding *bond, int mode)
                 return -EPERM;
         }
 
-        if (BOND_MODE_IS_LB(mode) && bond->params.arp_interval) {
-                pr_err("%s: %s mode is incompatible with arp monitoring.\n",
-                       bond->dev->name, bond_mode_tbl[mode].modename);
-                return -EINVAL;
+        if (BOND_NO_USES_ARP(mode) && bond->params.arp_interval) {
+                pr_info("%s: %s mode is incompatible with arp monitoring, start mii monitoring\n",
+                        bond->dev->name, bond_mode_tbl[mode].modename);
+                /* disable arp monitoring */
+                bond->params.arp_interval = 0;
+                /* set miimon to default value */
+                bond->params.miimon = BOND_DEFAULT_MIIMON;
+                pr_info("%s: Setting MII monitoring interval to %d.\n",
+                        bond->dev->name, bond->params.miimon);
         }
 
         /* don't cache arp_validate between modes */
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 0ec2a7e8c8a9..0ae580bbc5db 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -523,9 +523,7 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                 ret = -EINVAL;
                 goto out;
         }
-        if (bond->params.mode == BOND_MODE_ALB ||
-            bond->params.mode == BOND_MODE_TLB ||
-            bond->params.mode == BOND_MODE_8023AD) {
+        if (BOND_NO_USES_ARP(bond->params.mode)) {
                 pr_info("%s: ARP monitoring cannot be used with ALB/TLB/802.3ad. Only MII monitoring is supported on %s.\n",
                         bond->dev->name, bond->dev->name);
                 ret = -EINVAL;
@@ -1637,12 +1635,12 @@ static ssize_t bonding_show_packets_per_slave(struct device *d,
                                               char *buf)
 {
         struct bonding *bond = to_bond(d);
-        int packets_per_slave = bond->params.packets_per_slave;
+        unsigned int packets_per_slave = bond->params.packets_per_slave;
 
         if (packets_per_slave > 1)
                 packets_per_slave = reciprocal_value(packets_per_slave);
 
-        return sprintf(buf, "%d\n", packets_per_slave);
+        return sprintf(buf, "%u\n", packets_per_slave);
 }
 
 static ssize_t bonding_store_packets_per_slave(struct device *d,
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index ca31286aa028..a9f4f9f4d8ce 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -35,6 +35,8 @@
 
 #define BOND_MAX_ARP_TARGETS    16
 
+#define BOND_DEFAULT_MIIMON     100
+
 #define IS_UP(dev)                                         \
               ((((dev)->flags & IFF_UP) == IFF_UP)      && \
                netif_running(dev)                       && \
@@ -55,6 +57,11 @@
                  ((mode) == BOND_MODE_TLB)          ||  \
                  ((mode) == BOND_MODE_ALB))
 
+#define BOND_NO_USES_ARP(mode)                          \
+                (((mode) == BOND_MODE_8023AD)   ||      \
+                 ((mode) == BOND_MODE_TLB)      ||      \
+                 ((mode) == BOND_MODE_ALB))
+
 #define TX_QUEUE_OVERRIDE(mode)                         \
                         (((mode) == BOND_MODE_ACTIVEBACKUP) ||  \
                          ((mode) == BOND_MODE_ROUNDROBIN))
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index e3fc07cf2f62..77061eebb034 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -712,22 +712,31 @@ static int c_can_set_mode(struct net_device *dev, enum can_mode mode)
         return 0;
 }
 
-static int c_can_get_berr_counter(const struct net_device *dev,
-                                        struct can_berr_counter *bec)
+static int __c_can_get_berr_counter(const struct net_device *dev,
+                                    struct can_berr_counter *bec)
 {
         unsigned int reg_err_counter;
         struct c_can_priv *priv = netdev_priv(dev);
 
-        c_can_pm_runtime_get_sync(priv);
-
         reg_err_counter = priv->read_reg(priv, C_CAN_ERR_CNT_REG);
         bec->rxerr = (reg_err_counter & ERR_CNT_REC_MASK) >>
                                 ERR_CNT_REC_SHIFT;
         bec->txerr = reg_err_counter & ERR_CNT_TEC_MASK;
 
+        return 0;
+}
+
+static int c_can_get_berr_counter(const struct net_device *dev,
+                                  struct can_berr_counter *bec)
+{
+        struct c_can_priv *priv = netdev_priv(dev);
+        int err;
+
+        c_can_pm_runtime_get_sync(priv);
+        err = __c_can_get_berr_counter(dev, bec);
         c_can_pm_runtime_put_sync(priv);
 
-        return 0;
+        return err;
 }
 
 /*
@@ -754,6 +763,7 @@ static void c_can_do_tx(struct net_device *dev)
                 if (!(val & (1 << (msg_obj_no - 1)))) {
                         can_get_echo_skb(dev,
                                         msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
+                        c_can_object_get(dev, 0, msg_obj_no, IF_COMM_ALL);
                         stats->tx_bytes += priv->read_reg(priv,
                                         C_CAN_IFACE(MSGCTRL_REG, 0))
                                         & IF_MCONT_DLC_MASK;
@@ -872,7 +882,7 @@ static int c_can_handle_state_change(struct net_device *dev,
         if (unlikely(!skb))
                 return 0;
 
-        c_can_get_berr_counter(dev, &bec);
+        __c_can_get_berr_counter(dev, &bec);
         reg_err_counter = priv->read_reg(priv, C_CAN_ERR_CNT_REG);
         rx_err_passive = (reg_err_counter & ERR_CNT_RP_MASK) >>
                                 ERR_CNT_RP_SHIFT;
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index ae08cf129ebb..aaed97bee471 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1020,13 +1020,13 @@ static int flexcan_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "no ipg clock defined\n");
                         return PTR_ERR(clk_ipg);
                 }
-                clock_freq = clk_get_rate(clk_ipg);
 
                 clk_per = devm_clk_get(&pdev->dev, "per");
                 if (IS_ERR(clk_per)) {
                         dev_err(&pdev->dev, "no per clock defined\n");
                         return PTR_ERR(clk_per);
                 }
+                clock_freq = clk_get_rate(clk_per);
         }
 
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 7164a999f50f..f17c3018b7c7 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -494,20 +494,20 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
         uint8_t isrc, status;
         int n = 0;
 
-        /* Shared interrupts and IRQ off? */
-        if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
-                return IRQ_NONE;
-
         if (priv->pre_irq)
                 priv->pre_irq(priv);
 
+        /* Shared interrupts and IRQ off? */
+        if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
+                goto out;
+
         while ((isrc = priv->read_reg(priv, SJA1000_IR)) &&
                (n < SJA1000_MAX_IRQ)) {
-                n++;
+
                 status = priv->read_reg(priv, SJA1000_SR);
                 /* check for absent controller due to hw unplug */
                 if (status == 0xFF && sja1000_is_absent(priv))
-                        return IRQ_NONE;
+                        goto out;
 
                 if (isrc & IRQ_WUI)
                         netdev_warn(dev, "wakeup interrupt\n");
@@ -535,7 +535,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                                 status = priv->read_reg(priv, SJA1000_SR);
                                 /* check for absent controller */
                                 if (status == 0xFF && sja1000_is_absent(priv))
-                                        return IRQ_NONE;
+                                        goto out;
                         }
                 }
                 if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
@@ -543,8 +543,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         if (sja1000_err(dev, isrc, status))
                                 break;
                 }
+                n++;
         }
-
+out:
         if (priv->post_irq)
                 priv->post_irq(priv);
 
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 50b853a79d77..46dfb1378c17 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -717,8 +717,7 @@ static int emac_open(struct net_device *dev)
         if (netif_msg_ifup(db))
                 dev_dbg(db->dev, "enabling %s\n", dev->name);
 
-        if (devm_request_irq(db->dev, dev->irq, &emac_interrupt,
-                             0, dev->name, dev))
+        if (request_irq(dev->irq, &emac_interrupt, 0, dev->name, dev))
                 return -EAGAIN;
 
         /* Initialize EMAC board */
@@ -774,6 +773,8 @@ static int emac_stop(struct net_device *ndev)
 
         emac_shutdown(ndev);
 
+        free_irq(ndev->irq, ndev);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 0216d592d0ce..2e46c28fc601 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -3114,6 +3114,11 @@ int bnx2x_sriov_configure(struct pci_dev *dev, int num_vfs_param)
 {
         struct bnx2x *bp = netdev_priv(pci_get_drvdata(dev));
 
+        if (!IS_SRIOV(bp)) {
+                BNX2X_ERR("failed to configure SR-IOV since vfdb was not allocated. Check dmesg for errors in probe stage\n");
+                return -EINVAL;
+        }
+
         DP(BNX2X_MSG_IOV, "bnx2x_sriov_configure called with %d, BNX2X_NR_VIRTFN(bp) was %d\n",
            num_vfs_param, BNX2X_NR_VIRTFN(bp));
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a9e068423ba0..f3dd93b4aeaa 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -8932,6 +8932,9 @@ static int tg3_chip_reset(struct tg3 *tp)
         void (*write_op)(struct tg3 *, u32, u32);
         int i, err;
 
+        if (!pci_device_is_present(tp->pdev))
+                return -ENODEV;
+
         tg3_nvram_lock(tp);
 
         tg3_ape_lock(tp, TG3_APE_LOCK_GRC);
@@ -10629,10 +10632,8 @@ static void tg3_sd_scan_scratchpad(struct tg3 *tp, struct tg3_ocir *ocir)
 static ssize_t tg3_show_temp(struct device *dev,
                              struct device_attribute *devattr, char *buf)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct tg3 *tp = netdev_priv(netdev);
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct tg3 *tp = dev_get_drvdata(dev);
         u32 temperature;
 
         spin_lock_bh(&tp->lock);
@@ -10650,29 +10651,25 @@ static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, tg3_show_temp, NULL,
 static SENSOR_DEVICE_ATTR(temp1_max, S_IRUGO, tg3_show_temp, NULL,
                           TG3_TEMP_MAX_OFFSET);
 
-static struct attribute *tg3_attributes[] = {
+static struct attribute *tg3_attrs[] = {
         &sensor_dev_attr_temp1_input.dev_attr.attr,
         &sensor_dev_attr_temp1_crit.dev_attr.attr,
         &sensor_dev_attr_temp1_max.dev_attr.attr,
         NULL
 };
-
-static const struct attribute_group tg3_group = {
-        .attrs = tg3_attributes,
-};
+ATTRIBUTE_GROUPS(tg3);
 
 static void tg3_hwmon_close(struct tg3 *tp)
 {
         if (tp->hwmon_dev) {
                 hwmon_device_unregister(tp->hwmon_dev);
                 tp->hwmon_dev = NULL;
-                sysfs_remove_group(&tp->pdev->dev.kobj, &tg3_group);
         }
 }
 
 static void tg3_hwmon_open(struct tg3 *tp)
 {
-        int i, err;
+        int i;
         u32 size = 0;
         struct pci_dev *pdev = tp->pdev;
         struct tg3_ocir ocirs[TG3_SD_NUM_RECS];
@@ -10690,18 +10687,11 @@ static void tg3_hwmon_open(struct tg3 *tp)
         if (!size)
                 return;
 
-        /* Register hwmon sysfs hooks */
-        err = sysfs_create_group(&pdev->dev.kobj, &tg3_group);
-        if (err) {
-                dev_err(&pdev->dev, "Cannot create sysfs group, aborting\n");
-                return;
-        }
-
-        tp->hwmon_dev = hwmon_device_register(&pdev->dev);
+        tp->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev, "tg3",
+                                                          tp, tg3_groups);
         if (IS_ERR(tp->hwmon_dev)) {
                 tp->hwmon_dev = NULL;
                 dev_err(&pdev->dev, "Cannot register hwmon device, aborting\n");
-                sysfs_remove_group(&pdev->dev.kobj, &tg3_group);
         }
 }
 
@@ -11594,10 +11584,11 @@ static int tg3_close(struct net_device *dev)
         memset(&tp->net_stats_prev, 0, sizeof(tp->net_stats_prev));
         memset(&tp->estats_prev, 0, sizeof(tp->estats_prev));
 
-        tg3_power_down_prepare(tp);
-
-        tg3_carrier_off(tp);
+        if (pci_device_is_present(tp->pdev)) {
+                tg3_power_down_prepare(tp);
 
+                tg3_carrier_off(tp);
+        }
         return 0;
 }
 
@@ -16512,6 +16503,9 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
         /* Clear this out for sanity. */
         tw32(TG3PCI_MEM_WIN_BASE_ADDR, 0);
 
+        /* Clear TG3PCI_REG_BASE_ADDR to prevent hangs. */
+        tw32(TG3PCI_REG_BASE_ADDR, 0);
+
         pci_read_config_dword(tp->pdev, TG3PCI_PCISTATE,
                               &pci_state_reg);
         if ((pci_state_reg & PCISTATE_CONV_PCI_MODE) == 0 &&
@@ -17739,10 +17733,12 @@ static int tg3_suspend(struct device *device)
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
         struct tg3 *tp = netdev_priv(dev);
-        int err;
+        int err = 0;
+
+        rtnl_lock();
 
         if (!netif_running(dev))
-                return 0;
+                goto unlock;
 
         tg3_reset_task_cancel(tp);
         tg3_phy_stop(tp);
@@ -17784,6 +17780,8 @@ out:
                         tg3_phy_start(tp);
         }
 
+unlock:
+        rtnl_unlock();
         return err;
 }
 
@@ -17792,10 +17790,12 @@ static int tg3_resume(struct device *device)
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
         struct tg3 *tp = netdev_priv(dev);
-        int err;
+        int err = 0;
+
+        rtnl_lock();
 
         if (!netif_running(dev))
-                return 0;
+                goto unlock;
 
         netif_device_attach(dev);
 
@@ -17819,6 +17819,8 @@ out:
         if (!err)
                 tg3_phy_start(tp);
 
+unlock:
+        rtnl_unlock();
         return err;
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ecd2fb3ef695..6c9308850453 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -49,13 +49,15 @@
 #include <asm/io.h>
 #include "cxgb4_uld.h"
 
-#define FW_VERSION_MAJOR 1
-#define FW_VERSION_MINOR 4
-#define FW_VERSION_MICRO 0
+#define T4FW_VERSION_MAJOR 0x01
+#define T4FW_VERSION_MINOR 0x06
+#define T4FW_VERSION_MICRO 0x18
+#define T4FW_VERSION_BUILD 0x00
 
-#define FW_VERSION_MAJOR_T5 0
-#define FW_VERSION_MINOR_T5 0
-#define FW_VERSION_MICRO_T5 0
+#define T5FW_VERSION_MAJOR 0x01
+#define T5FW_VERSION_MINOR 0x08
+#define T5FW_VERSION_MICRO 0x1C
+#define T5FW_VERSION_BUILD 0x00
 
 #define CH_WARN(adap, fmt, ...) dev_warn(adap->pdev_dev, fmt, ## __VA_ARGS__)
 
@@ -240,6 +242,26 @@ struct pci_params {
         unsigned char width;
 };
 
+#define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
+#define CHELSIO_CHIP_FPGA          0x100
+#define CHELSIO_CHIP_VERSION(code) (((code) >> 4) & 0xf)
+#define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
+
+#define CHELSIO_T4              0x4
+#define CHELSIO_T5              0x5
+
+enum chip_type {
+        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
+        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
+        T4_FIRST_REV    = T4_A1,
+        T4_LAST_REV     = T4_A2,
+
+        T5_A0 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
+        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 1),
+        T5_FIRST_REV    = T5_A0,
+        T5_LAST_REV     = T5_A1,
+};
+
 struct adapter_params {
         struct tp_params  tp;
         struct vpd_params vpd;
@@ -259,7 +281,7 @@ struct adapter_params {
 
         unsigned char nports;             /* # of ethernet ports */
         unsigned char portvec;
-        unsigned char rev;                /* chip revision */
+        enum chip_type chip;               /* chip code */
         unsigned char offload;
 
         unsigned char bypass;
@@ -267,6 +289,23 @@ struct adapter_params {
         unsigned int ofldq_wr_cred;
 };
 
+#include "t4fw_api.h"
+
+#define FW_VERSION(chip) ( \
+                FW_HDR_FW_VER_MAJOR_GET(chip##FW_VERSION_MAJOR) | \
+                FW_HDR_FW_VER_MINOR_GET(chip##FW_VERSION_MINOR) | \
+                FW_HDR_FW_VER_MICRO_GET(chip##FW_VERSION_MICRO) | \
+                FW_HDR_FW_VER_BUILD_GET(chip##FW_VERSION_BUILD))
+#define FW_INTFVER(chip, intf) (FW_HDR_INTFVER_##intf)
+
+struct fw_info {
+        u8 chip;
+        char *fs_name;
+        char *fw_mod_name;
+        struct fw_hdr fw_hdr;
+};
+
+
 struct trace_params {
         u32 data[TRACE_LEN / 4];
         u32 mask[TRACE_LEN / 4];
@@ -512,25 +551,6 @@ struct sge {
 
 struct l2t_data;
 
-#define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
-#define CHELSIO_CHIP_VERSION(code) ((code) >> 4)
-#define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
-
-#define CHELSIO_T4              0x4
-#define CHELSIO_T5              0x5
-
-enum chip_type {
-        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 0),
-        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
-        T4_A3 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
-        T4_FIRST_REV    = T4_A1,
-        T4_LAST_REV     = T4_A3,
-
-        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
-        T5_FIRST_REV    = T5_A1,
-        T5_LAST_REV     = T5_A1,
-};
-
 #ifdef CONFIG_PCI_IOV
 
 /* T4 supports SRIOV on PF0-3 and T5 on PF0-7.  However, the Serial
@@ -715,12 +735,12 @@ enum {
 
 static inline int is_t5(enum chip_type chip)
 {
-        return (chip >= T5_FIRST_REV && chip <= T5_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T5;
 }
 
 static inline int is_t4(enum chip_type chip)
 {
-        return (chip >= T4_FIRST_REV && chip <= T4_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T4;
 }
 
 static inline u32 t4_read_reg(struct adapter *adap, u32 reg_addr)
@@ -900,7 +920,11 @@ int get_vpd_params(struct adapter *adapter, struct vpd_params *p);
 int t4_load_fw(struct adapter *adapter, const u8 *fw_data, unsigned int size);
 unsigned int t4_flash_cfg_addr(struct adapter *adapter);
 int t4_load_cfg(struct adapter *adapter, const u8 *cfg_data, unsigned int size);
-int t4_check_fw_version(struct adapter *adapter);
+int t4_get_fw_version(struct adapter *adapter, u32 *vers);
+int t4_get_tp_version(struct adapter *adapter, u32 *vers);
+int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+               const u8 *fw_data, unsigned int fw_size,
+               struct fw_hdr *card_fw, enum dev_state state, int *reset);
 int t4_prep_adapter(struct adapter *adapter);
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf);
 void t4_fatal_err(struct adapter *adapter);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 8b929eeecd2d..d6b12e035a7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -276,9 +276,9 @@ static DEFINE_PCI_DEVICE_TABLE(cxgb4_pci_tbl) = {
         { 0, }
 };
 
-#define FW_FNAME "cxgb4/t4fw.bin"
+#define FW4_FNAME "cxgb4/t4fw.bin"
 #define FW5_FNAME "cxgb4/t5fw.bin"
-#define FW_CFNAME "cxgb4/t4-config.txt"
+#define FW4_CFNAME "cxgb4/t4-config.txt"
 #define FW5_CFNAME "cxgb4/t5-config.txt"
 
 MODULE_DESCRIPTION(DRV_DESC);
@@ -286,7 +286,7 @@ MODULE_AUTHOR("Chelsio Communications");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DEVICE_TABLE(pci, cxgb4_pci_tbl);
-MODULE_FIRMWARE(FW_FNAME);
+MODULE_FIRMWARE(FW4_FNAME);
 MODULE_FIRMWARE(FW5_FNAME);
 
 /*
@@ -1071,72 +1071,6 @@ freeout:	t4_free_sge_resources(adap);
 }
 
 /*
- * Returns 0 if new FW was successfully loaded, a positive errno if a load was
- * started but failed, and a negative errno if flash load couldn't start.
- */
-static int upgrade_fw(struct adapter *adap)
-{
-        int ret;
-        u32 vers, exp_major;
-        const struct fw_hdr *hdr;
-        const struct firmware *fw;
-        struct device *dev = adap->pdev_dev;
-        char *fw_file_name;
-
-        switch (CHELSIO_CHIP_VERSION(adap->chip)) {
-        case CHELSIO_T4:
-                fw_file_name = FW_FNAME;
-                exp_major = FW_VERSION_MAJOR;
-                break;
-        case CHELSIO_T5:
-                fw_file_name = FW5_FNAME;
-                exp_major = FW_VERSION_MAJOR_T5;
-                break;
-        default:
-                dev_err(dev, "Unsupported chip type, %x\n", adap->chip);
-                return -EINVAL;
-        }
-
-        ret = request_firmware(&fw, fw_file_name, dev);
-        if (ret < 0) {
-                dev_err(dev, "unable to load firmware image %s, error %d\n",
-                        fw_file_name, ret);
-                return ret;
-        }
-
-        hdr = (const struct fw_hdr *)fw->data;
-        vers = ntohl(hdr->fw_ver);
-        if (FW_HDR_FW_VER_MAJOR_GET(vers) != exp_major) {
-                ret = -EINVAL;              /* wrong major version, won't do */
-                goto out;
-        }
-
-        /*
-         * If the flash FW is unusable or we found something newer, load it.
-         */
-        if (FW_HDR_FW_VER_MAJOR_GET(adap->params.fw_vers) != exp_major ||
-            vers > adap->params.fw_vers) {
-                dev_info(dev, "upgrading firmware ...\n");
-                ret = t4_fw_upgrade(adap, adap->mbox, fw->data, fw->size,
-                                    /*force=*/false);
-                if (!ret)
-                        dev_info(dev,
-                                 "firmware upgraded to version %pI4 from %s\n",
-                                 &hdr->fw_ver, fw_file_name);
-                else
-                        dev_err(dev, "firmware upgrade failed! err=%d\n", -ret);
-        } else {
-                /*
-                 * Tell our caller that we didn't upgrade the firmware.
-                 */
-                ret = -EINVAL;
-        }
-
-out:    release_firmware(fw);
-        return ret;
-}
-
-/*
  * Allocate a chunk of memory using kmalloc or, if that fails, vmalloc.
  * The allocated memory is cleared.
  */
@@ -1415,7 +1349,7 @@ static int get_sset_count(struct net_device *dev, int sset)
 static int get_regs_len(struct net_device *dev)
 {
         struct adapter *adap = netdev2adap(dev);
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 return T4_REGMAP_SIZE;
         else
                 return T5_REGMAP_SIZE;
@@ -1499,7 +1433,7 @@ static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
         data += sizeof(struct port_stats) / sizeof(u64);
         collect_sge_port_stats(adapter, pi, (struct queue_port_stats *)data);
         data += sizeof(struct queue_port_stats) / sizeof(u64);
-        if (!is_t4(adapter->chip)) {
+        if (!is_t4(adapter->params.chip)) {
                 t4_write_reg(adapter, SGE_STAT_CFG, STATSOURCE_T5(7));
                 val1 = t4_read_reg(adapter, SGE_STAT_TOTAL);
                 val2 = t4_read_reg(adapter, SGE_STAT_MATCH);
@@ -1521,8 +1455,8 @@ static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
  */
 static inline unsigned int mk_adap_vers(const struct adapter *ap)
 {
-        return CHELSIO_CHIP_VERSION(ap->chip) |
-                (CHELSIO_CHIP_RELEASE(ap->chip) << 10) | (1 << 16);
+        return CHELSIO_CHIP_VERSION(ap->params.chip) |
+                (CHELSIO_CHIP_RELEASE(ap->params.chip) << 10) | (1 << 16);
 }
 
 static void reg_block_dump(struct adapter *ap, void *buf, unsigned int start,
@@ -2189,7 +2123,7 @@ static void get_regs(struct net_device *dev, struct ethtool_regs *regs,
         static const unsigned int *reg_ranges;
         int arr_size = 0, buf_size = 0;
 
-        if (is_t4(ap->chip)) {
+        if (is_t4(ap->params.chip)) {
                 reg_ranges = &t4_reg_ranges[0];
                 arr_size = ARRAY_SIZE(t4_reg_ranges);
                 buf_size = T4_REGMAP_SIZE;
@@ -2967,7 +2901,7 @@ static int setup_debugfs(struct adapter *adap)
                 size = t4_read_reg(adap, MA_EDRAM1_BAR);
                 add_debugfs_mem(adap, "edc1", MEM_EDC1, EDRAM_SIZE_GET(size));
         }
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 size = t4_read_reg(adap, MA_EXT_MEMORY_BAR);
                 if (i & EXT_MEM_ENABLE)
                         add_debugfs_mem(adap, "mc", MEM_MC,
@@ -3419,7 +3353,7 @@ unsigned int cxgb4_dbfifo_count(const struct net_device *dev, int lpfifo)
 
         v1 = t4_read_reg(adap, A_SGE_DBFIFO_STATUS);
         v2 = t4_read_reg(adap, SGE_DBFIFO_STATUS2);
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 lp_count = G_LP_COUNT(v1);
                 hp_count = G_HP_COUNT(v1);
         } else {
@@ -3588,7 +3522,7 @@ static void drain_db_fifo(struct adapter *adap, int usecs)
         do {
                 v1 = t4_read_reg(adap, A_SGE_DBFIFO_STATUS);
                 v2 = t4_read_reg(adap, SGE_DBFIFO_STATUS2);
-                if (is_t4(adap->chip)) {
+                if (is_t4(adap->params.chip)) {
                         lp_count = G_LP_COUNT(v1);
                         hp_count = G_HP_COUNT(v1);
                 } else {
@@ -3708,7 +3642,7 @@ static void process_db_drop(struct work_struct *work)
 
         adap = container_of(work, struct adapter, db_drop_task);
 
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 disable_dbs(adap);
                 notify_rdma_uld(adap, CXGB4_CONTROL_DB_DROP);
                 drain_db_fifo(adap, 1);
@@ -3753,7 +3687,7 @@ static void process_db_drop(struct work_struct *work)
 
 void t4_db_full(struct adapter *adap)
 {
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 t4_set_reg_field(adap, SGE_INT_ENABLE3,
                                  DBFIFO_HP_INT | DBFIFO_LP_INT, 0);
                 queue_work(workq, &adap->db_full_task);
@@ -3762,7 +3696,7 @@ void t4_db_full(struct adapter *adap)
 
 void t4_db_dropped(struct adapter *adap)
 {
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 queue_work(workq, &adap->db_drop_task);
 }
 
@@ -3789,7 +3723,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
         lli.nchan = adap->params.nports;
         lli.nports = adap->params.nports;
         lli.wr_cred = adap->params.ofldq_wr_cred;
-        lli.adapter_type = adap->params.rev;
+        lli.adapter_type = adap->params.chip;
         lli.iscsi_iolen = MAXRXDATA_GET(t4_read_reg(adap, TP_PARA_REG2));
         lli.udb_density = 1 << QUEUESPERPAGEPF0_GET(
                         t4_read_reg(adap, SGE_EGRESS_QUEUES_PER_PAGE_PF) >>
@@ -4483,7 +4417,7 @@ static void setup_memwin(struct adapter *adap)
         u32 bar0, mem_win0_base, mem_win1_base, mem_win2_base;
 
         bar0 = pci_resource_start(adap->pdev, 0);  /* truncation intentional */
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 mem_win0_base = bar0 + MEMWIN0_BASE;
                 mem_win1_base = bar0 + MEMWIN1_BASE;
                 mem_win2_base = bar0 + MEMWIN2_BASE;
@@ -4668,8 +4602,10 @@ static int adap_init0_config(struct adapter *adapter, int reset)
         const struct firmware *cf;
         unsigned long mtype = 0, maddr = 0;
         u32 finiver, finicsum, cfcsum;
-        int ret, using_flash;
+        int ret;
+        int config_issued = 0;
         char *fw_config_file, fw_config_file_path[256];
+        char *config_name = NULL;
 
         /*
          * Reset device if necessary.
@@ -4686,9 +4622,9 @@ static int adap_init0_config(struct adapter *adapter, int reset)
          * then use that.  Otherwise, use the configuration file stored
          * in the adapter flash ...
          */
-        switch (CHELSIO_CHIP_VERSION(adapter->chip)) {
+        switch (CHELSIO_CHIP_VERSION(adapter->params.chip)) {
         case CHELSIO_T4:
-                fw_config_file = FW_CFNAME;
+                fw_config_file = FW4_CFNAME;
                 break;
         case CHELSIO_T5:
                 fw_config_file = FW5_CFNAME;
@@ -4702,13 +4638,16 @@ static int adap_init0_config(struct adapter *adapter, int reset)
 
         ret = request_firmware(&cf, fw_config_file, adapter->pdev_dev);
         if (ret < 0) {
-                using_flash = 1;
+                config_name = "On FLASH";
                 mtype = FW_MEMTYPE_CF_FLASH;
                 maddr = t4_flash_cfg_addr(adapter);
         } else {
                 u32 params[7], val[7];
 
-                using_flash = 0;
+                sprintf(fw_config_file_path,
+                        "/lib/firmware/%s", fw_config_file);
+                config_name = fw_config_file_path;
+
                 if (cf->size >= FLASH_CFG_MAX_SIZE)
                         ret = -ENOMEM;
                 else {
@@ -4776,6 +4715,26 @@ static int adap_init0_config(struct adapter *adapter, int reset)
                       FW_LEN16(caps_cmd));
         ret = t4_wr_mbox(adapter, adapter->mbox, &caps_cmd, sizeof(caps_cmd),
                          &caps_cmd);
+
+        /* If the CAPS_CONFIG failed with an ENOENT (for a Firmware
+         * Configuration File in FLASH), our last gasp effort is to use the
+         * Firmware Configuration File which is embedded in the firmware.  A
+         * very few early versions of the firmware didn't have one embedded
+         * but we can ignore those.
+         */
+        if (ret == -ENOENT) {
+                memset(&caps_cmd, 0, sizeof(caps_cmd));
+                caps_cmd.op_to_write =
+                        htonl(FW_CMD_OP(FW_CAPS_CONFIG_CMD) |
+                                        FW_CMD_REQUEST |
+                                        FW_CMD_READ);
+                caps_cmd.cfvalid_to_len16 = htonl(FW_LEN16(caps_cmd));
+                ret = t4_wr_mbox(adapter, adapter->mbox, &caps_cmd,
+                                sizeof(caps_cmd), &caps_cmd);
+                config_name = "Firmware Default";
+        }
+
+        config_issued = 1;
         if (ret < 0)
                 goto bye;
 
@@ -4816,7 +4775,6 @@ static int adap_init0_config(struct adapter *adapter, int reset)
         if (ret < 0)
                 goto bye;
 
-        sprintf(fw_config_file_path, "/lib/firmware/%s", fw_config_file);
         /*
          * Return successfully and note that we're operating with parameters
          * not supplied by the driver, rather than from hard-wired
@@ -4824,11 +4782,8 @@ static int adap_init0_config(struct adapter *adapter, int reset)
          */
         adapter->flags |= USING_SOFT_PARAMS;
         dev_info(adapter->pdev_dev, "Successfully configured using Firmware "\
-                 "Configuration File %s, version %#x, computed checksum %#x\n",
-                 (using_flash
-                  ? "in device FLASH"
-                  : fw_config_file_path),
-                 finiver, cfcsum);
+                 "Configuration File \"%s\", version %#x, computed checksum %#x\n",
+                 config_name, finiver, cfcsum);
         return 0;
 
         /*
@@ -4837,9 +4792,9 @@ static int adap_init0_config(struct adapter *adapter, int reset)
          * want to issue a warning since this is fairly common.)
          */
 bye:
-        if (ret != -ENOENT)
-                dev_warn(adapter->pdev_dev, "Configuration file error %d\n",
-                         -ret);
+        if (config_issued && ret != -ENOENT)
+                dev_warn(adapter->pdev_dev, "\"%s\" configuration file error %d\n",
+                         config_name, -ret);
         return ret;
 }
 
@@ -5086,6 +5041,47 @@ bye:
         return ret;
 }
 
+static struct fw_info fw_info_array[] = {
+        {
+                .chip = CHELSIO_T4,
+                .fs_name = FW4_CFNAME,
+                .fw_mod_name = FW4_FNAME,
+                .fw_hdr = {
+                        .chip = FW_HDR_CHIP_T4,
+                        .fw_ver = __cpu_to_be32(FW_VERSION(T4)),
+                        .intfver_nic = FW_INTFVER(T4, NIC),
+                        .intfver_vnic = FW_INTFVER(T4, VNIC),
+                        .intfver_ri = FW_INTFVER(T4, RI),
+                        .intfver_iscsi = FW_INTFVER(T4, ISCSI),
+                        .intfver_fcoe = FW_INTFVER(T4, FCOE),
+                },
+        }, {
+                .chip = CHELSIO_T5,
+                .fs_name = FW5_CFNAME,
+                .fw_mod_name = FW5_FNAME,
+                .fw_hdr = {
+                        .chip = FW_HDR_CHIP_T5,
+                        .fw_ver = __cpu_to_be32(FW_VERSION(T5)),
+                        .intfver_nic = FW_INTFVER(T5, NIC),
+                        .intfver_vnic = FW_INTFVER(T5, VNIC),
+                        .intfver_ri = FW_INTFVER(T5, RI),
+                        .intfver_iscsi = FW_INTFVER(T5, ISCSI),
+                        .intfver_fcoe = FW_INTFVER(T5, FCOE),
+                },
+        }
+};
+
+static struct fw_info *find_fw_info(int chip)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(fw_info_array); i++) {
+                if (fw_info_array[i].chip == chip)
+                        return &fw_info_array[i];
+        }
+        return NULL;
+}
+
 /*
  * Phase 0 of initialization: contact FW, obtain config, perform basic init.
  */
@@ -5123,44 +5119,54 @@ static int adap_init0(struct adapter *adap)
          * later reporting and B. to warn if the currently loaded firmware
          * is excessively mismatched relative to the driver.)
          */
-        ret = t4_check_fw_version(adap);
-
-        /* The error code -EFAULT is returned by t4_check_fw_version() if
-         * firmware on adapter < supported firmware. If firmware on adapter
-         * is too old (not supported by driver) and we're the MASTER_PF set
-         * adapter state to DEV_STATE_UNINIT to force firmware upgrade
-         * and reinitialization.
-         */
-        if ((adap->flags & MASTER_PF) && ret == -EFAULT)
-                state = DEV_STATE_UNINIT;
+        t4_get_fw_version(adap, &adap->params.fw_vers);
+        t4_get_tp_version(adap, &adap->params.tp_vers);
         if ((adap->flags & MASTER_PF) && state != DEV_STATE_INIT) {
-                if (ret == -EINVAL || ret == -EFAULT || ret > 0) {
-                        if (upgrade_fw(adap) >= 0) {
-                                /*
-                                 * Note that the chip was reset as part of the
-                                 * firmware upgrade so we don't reset it again
-                                 * below and grab the new firmware version.
-                                 */
-                                reset = 0;
-                                ret = t4_check_fw_version(adap);
-                        } else
-                                if (ret == -EFAULT) {
-                                        /*
-                                         * Firmware is old but still might
-                                         * work if we force reinitialization
-                                         * of the adapter. Ignoring FW upgrade
-                                         * failure.
-                                         */
-                                        dev_warn(adap->pdev_dev,
-                                                 "Ignoring firmware upgrade "
-                                                 "failure, and forcing driver "
-                                                 "to reinitialize the "
-                                                 "adapter.\n");
-                                        ret = 0;
-                                }
+                struct fw_info *fw_info;
+                struct fw_hdr *card_fw;
+                const struct firmware *fw;
+                const u8 *fw_data = NULL;
+                unsigned int fw_size = 0;
+
+                /* This is the firmware whose headers the driver was compiled
+                 * against
+                 */
+                fw_info = find_fw_info(CHELSIO_CHIP_VERSION(adap->params.chip));
+                if (fw_info == NULL) {
+                        dev_err(adap->pdev_dev,
+                                "unable to get firmware info for chip %d.\n",
+                                CHELSIO_CHIP_VERSION(adap->params.chip));
+                        return -EINVAL;
                 }
+
+                /* allocate memory to read the header of the firmware on the
+                 * card
+                 */
+                card_fw = t4_alloc_mem(sizeof(*card_fw));
+
+                /* Get FW from from /lib/firmware/ */
+                ret = request_firmware(&fw, fw_info->fw_mod_name,
+                                       adap->pdev_dev);
+                if (ret < 0) {
+                        dev_err(adap->pdev_dev,
+                                "unable to load firmware image %s, error %d\n",
+                                fw_info->fw_mod_name, ret);
+                } else {
+                        fw_data = fw->data;
+                        fw_size = fw->size;
+                }
+
+                /* upgrade FW logic */
+                ret = t4_prep_fw(adap, fw_info, fw_data, fw_size, card_fw,
+                                 state, &reset);
+
+                /* Cleaning up */
+                if (fw != NULL)
+                        release_firmware(fw);
+                t4_free_mem(card_fw);
+
                 if (ret < 0)
-                        return ret;
+                        goto bye;
         }
 
         /*
@@ -5245,7 +5251,7 @@ static int adap_init0(struct adapter *adap)
                                 if (ret == -ENOENT) {
                                         dev_info(adap->pdev_dev,
                                             "No Configuration File present "
-                                            "on adapter.  Using hard-wired "
+                                            "on adapter. Using hard-wired "
                                             "configuration parameters.\n");
                                         ret = adap_init0_no_config(adap, reset);
                                 }
@@ -5787,7 +5793,7 @@ static void print_port_info(const struct net_device *dev)
 
         netdev_info(dev, "Chelsio %s rev %d %s %sNIC PCIe x%d%s%s\n",
                     adap->params.vpd.id,
-                    CHELSIO_CHIP_RELEASE(adap->params.rev), buf,
+                    CHELSIO_CHIP_RELEASE(adap->params.chip), buf,
                     is_offload(adap) ? "R" : "", adap->params.pci.width, spd,
                     (adap->flags & USING_MSIX) ? " MSI-X" :
                     (adap->flags & USING_MSI) ? " MSI" : "");
@@ -5910,7 +5916,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto out_unmap_bar0;
 
-        if (!is_t4(adapter->chip)) {
+        if (!is_t4(adapter->params.chip)) {
                 s_qpp = QUEUESPERPAGEPF1 * adapter->fn;
                 qpp = 1 << QUEUESPERPAGEPF0_GET(t4_read_reg(adapter,
                       SGE_EGRESS_QUEUES_PER_PAGE_PF) >> s_qpp);
@@ -6064,7 +6070,7 @@ sriov:
  out_free_dev:
         free_some_resources(adapter);
  out_unmap_bar:
-        if (!is_t4(adapter->chip))
+        if (!is_t4(adapter->params.chip))
                 iounmap(adapter->bar2);
  out_unmap_bar0:
         iounmap(adapter->regs);
@@ -6116,7 +6122,7 @@ static void remove_one(struct pci_dev *pdev)
 
                 free_some_resources(adapter);
                 iounmap(adapter->regs);
-                if (!is_t4(adapter->chip))
+                if (!is_t4(adapter->params.chip))
                         iounmap(adapter->bar2);
                 kfree(adapter);
                 pci_disable_pcie_error_reporting(pdev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ac311f5f3eb9..cc380c36e1a8 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -509,7 +509,7 @@ static inline void ring_fl_db(struct adapter *adap, struct sge_fl *q)
         u32 val;
         if (q->pend_cred >= 8) {
                 val = PIDX(q->pend_cred / 8);
-                if (!is_t4(adap->chip))
+                if (!is_t4(adap->params.chip))
                         val |= DBTYPE(1);
                 wmb();
                 t4_write_reg(adap, MYPF_REG(SGE_PF_KDOORBELL), DBPRIO(1) |
@@ -847,7 +847,7 @@ static inline void ring_tx_db(struct adapter *adap, struct sge_txq *q, int n)
         wmb();            /* write descriptors before telling HW */
         spin_lock(&q->db_lock);
         if (!q->db_disabled) {
-                if (is_t4(adap->chip)) {
+                if (is_t4(adap->params.chip)) {
                         t4_write_reg(adap, MYPF_REG(SGE_PF_KDOORBELL),
                                      QID(q->cntxt_id) | PIDX(n));
                 } else {
@@ -1596,7 +1596,7 @@ static noinline int handle_trace_pkt(struct adapter *adap,
                 return 0;
         }
 
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 __skb_pull(skb, sizeof(struct cpl_trace_pkt));
         else
                 __skb_pull(skb, sizeof(struct cpl_t5_trace_pkt));
@@ -1661,7 +1661,7 @@ int t4_ethrx_handler(struct sge_rspq *q, const __be64 *rsp,
         const struct cpl_rx_pkt *pkt;
         struct sge_eth_rxq *rxq = container_of(q, struct sge_eth_rxq, rspq);
         struct sge *s = &q->adap->sge;
-        int cpl_trace_pkt = is_t4(q->adap->chip) ?
+        int cpl_trace_pkt = is_t4(q->adap->params.chip) ?
                             CPL_TRACE_PKT : CPL_TRACE_PKT_T5;
 
         if (unlikely(*(u8 *)rsp == cpl_trace_pkt))
@@ -2182,7 +2182,7 @@ err:
 static void init_txq(struct adapter *adap, struct sge_txq *q, unsigned int id)
 {
         q->cntxt_id = id;
-        if (!is_t4(adap->chip)) {
+        if (!is_t4(adap->params.chip)) {
                 unsigned int s_qpp;
                 unsigned short udb_density;
                 unsigned long qpshift;
@@ -2641,7 +2641,7 @@ static int t4_sge_init_hard(struct adapter *adap)
          * Set up to drop DOORBELL writes when the DOORBELL FIFO overflows
          * and generate an interrupt when this occurs so we can recover.
          */
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 t4_set_reg_field(adap, A_SGE_DBFIFO_STATUS,
                                  V_HP_INT_THRESH(M_HP_INT_THRESH) |
                                  V_LP_INT_THRESH(M_LP_INT_THRESH),
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 4cbb2f9850be..74a6fce5a15a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -296,7 +296,7 @@ int t4_mc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
         u32 mc_bist_cmd, mc_bist_cmd_addr, mc_bist_cmd_len;
         u32 mc_bist_status_rdata, mc_bist_data_pattern;
 
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 mc_bist_cmd = MC_BIST_CMD;
                 mc_bist_cmd_addr = MC_BIST_CMD_ADDR;
                 mc_bist_cmd_len = MC_BIST_CMD_LEN;
@@ -349,7 +349,7 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
         u32 edc_bist_cmd, edc_bist_cmd_addr, edc_bist_cmd_len;
         u32 edc_bist_cmd_data_pattern, edc_bist_status_rdata;
 
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 edc_bist_cmd = EDC_REG(EDC_BIST_CMD, idx);
                 edc_bist_cmd_addr = EDC_REG(EDC_BIST_CMD_ADDR, idx);
                 edc_bist_cmd_len = EDC_REG(EDC_BIST_CMD_LEN, idx);
@@ -402,7 +402,7 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
 static int t4_mem_win_rw(struct adapter *adap, u32 addr, __be32 *data, int dir)
 {
         int i;
-        u32 win_pf = is_t4(adap->chip) ? 0 : V_PFNUM(adap->fn);
+        u32 win_pf = is_t4(adap->params.chip) ? 0 : V_PFNUM(adap->fn);
 
         /*
          * Setup offset into PCIE memory window.  Address must be a
@@ -863,104 +863,169 @@ unlock:
 }
 
 /**
- *      get_fw_version - read the firmware version
+ *      t4_get_fw_version - read the firmware version
  *      @adapter: the adapter
  *      @vers: where to place the version
  *
  *      Reads the FW version from flash.
  */
-static int get_fw_version(struct adapter *adapter, u32 *vers)
+int t4_get_fw_version(struct adapter *adapter, u32 *vers)
 {
-        return t4_read_flash(adapter, adapter->params.sf_fw_start +
-                             offsetof(struct fw_hdr, fw_ver), 1, vers, 0);
+        return t4_read_flash(adapter, FLASH_FW_START +
+                             offsetof(struct fw_hdr, fw_ver), 1,
+                             vers, 0);
 }
 
 /**
- *      get_tp_version - read the TP microcode version
+ *      t4_get_tp_version - read the TP microcode version
  *      @adapter: the adapter
  *      @vers: where to place the version
  *
  *      Reads the TP microcode version from flash.
  */
-static int get_tp_version(struct adapter *adapter, u32 *vers)
+int t4_get_tp_version(struct adapter *adapter, u32 *vers)
 {
-        return t4_read_flash(adapter, adapter->params.sf_fw_start +
+        return t4_read_flash(adapter, FLASH_FW_START +
                              offsetof(struct fw_hdr, tp_microcode_ver),
                              1, vers, 0);
 }
 
-/**
- *      t4_check_fw_version - check if the FW is compatible with this driver
- *      @adapter: the adapter
- *
- *      Checks if an adapter's FW is compatible with the driver.  Returns 0
- *      if there's exact match, a negative error if the version could not be
- *      read or there's a major version mismatch, and a positive value if the
- *      expected major version is found but there's a minor version mismatch.
+/* Is the given firmware API compatible with the one the driver was compiled
+ * with?
  */
-int t4_check_fw_version(struct adapter *adapter)
+static int fw_compatible(const struct fw_hdr *hdr1, const struct fw_hdr *hdr2)
 {
-        u32 api_vers[2];
-        int ret, major, minor, micro;
-        int exp_major, exp_minor, exp_micro;
 
-        ret = get_fw_version(adapter, &adapter->params.fw_vers);
-        if (!ret)
-                ret = get_tp_version(adapter, &adapter->params.tp_vers);
-        if (!ret)
-                ret = t4_read_flash(adapter, adapter->params.sf_fw_start +
-                                    offsetof(struct fw_hdr, intfver_nic),
-                                    2, api_vers, 1);
-        if (ret)
-                return ret;
+        /* short circuit if it's the exact same firmware version */
+        if (hdr1->chip == hdr2->chip && hdr1->fw_ver == hdr2->fw_ver)
+                return 1;
 
-        major = FW_HDR_FW_VER_MAJOR_GET(adapter->params.fw_vers);
-        minor = FW_HDR_FW_VER_MINOR_GET(adapter->params.fw_vers);
-        micro = FW_HDR_FW_VER_MICRO_GET(adapter->params.fw_vers);
+#define SAME_INTF(x) (hdr1->intfver_##x == hdr2->intfver_##x)
+        if (hdr1->chip == hdr2->chip && SAME_INTF(nic) && SAME_INTF(vnic) &&
+            SAME_INTF(ri) && SAME_INTF(iscsi) && SAME_INTF(fcoe))
+                return 1;
+#undef SAME_INTF
 
-        switch (CHELSIO_CHIP_VERSION(adapter->chip)) {
-        case CHELSIO_T4:
-                exp_major = FW_VERSION_MAJOR;
-                exp_minor = FW_VERSION_MINOR;
-                exp_micro = FW_VERSION_MICRO;
-                break;
-        case CHELSIO_T5:
-                exp_major = FW_VERSION_MAJOR_T5;
-                exp_minor = FW_VERSION_MINOR_T5;
-                exp_micro = FW_VERSION_MICRO_T5;
-                break;
-        default:
-                dev_err(adapter->pdev_dev, "Unsupported chip type, %x\n",
-                        adapter->chip);
-                return -EINVAL;
-        }
+        return 0;
+}
 
-        memcpy(adapter->params.api_vers, api_vers,
-               sizeof(adapter->params.api_vers));
+/* The firmware in the filesystem is usable, but should it be installed?
+ * This routine explains itself in detail if it indicates the filesystem
+ * firmware should be installed.
+ */
+static int should_install_fs_fw(struct adapter *adap, int card_fw_usable,
+                                int k, int c)
+{
+        const char *reason;
 
-        if (major < exp_major || (major == exp_major && minor < exp_minor) ||
-            (major == exp_major && minor == exp_minor && micro < exp_micro)) {
-                dev_err(adapter->pdev_dev,
-                        "Card has firmware version %u.%u.%u, minimum "
-                        "supported firmware is %u.%u.%u.\n", major, minor,
-                        micro, exp_major, exp_minor, exp_micro);
-                return -EFAULT;
+        if (!card_fw_usable) {
+                reason = "incompatible or unusable";
+                goto install;
         }
 
-        if (major != exp_major) {            /* major mismatch - fail */
-                dev_err(adapter->pdev_dev,
-                        "card FW has major version %u, driver wants %u\n",
-                        major, exp_major);
-                return -EINVAL;
+        if (k > c) {
+                reason = "older than the version supported with this driver";
+                goto install;
         }
 
-        if (minor == exp_minor && micro == exp_micro)
-                return 0;                                   /* perfect match */
+        return 0;
+
+install:
+        dev_err(adap->pdev_dev, "firmware on card (%u.%u.%u.%u) is %s, "
+                "installing firmware %u.%u.%u.%u on card.\n",
+                FW_HDR_FW_VER_MAJOR_GET(c), FW_HDR_FW_VER_MINOR_GET(c),
+                FW_HDR_FW_VER_MICRO_GET(c), FW_HDR_FW_VER_BUILD_GET(c), reason,
+                FW_HDR_FW_VER_MAJOR_GET(k), FW_HDR_FW_VER_MINOR_GET(k),
+                FW_HDR_FW_VER_MICRO_GET(k), FW_HDR_FW_VER_BUILD_GET(k));
 
-        /* Minor/micro version mismatch.  Report it but often it's OK. */
         return 1;
 }
 
+int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+               const u8 *fw_data, unsigned int fw_size,
+               struct fw_hdr *card_fw, enum dev_state state,
+               int *reset)
+{
+        int ret, card_fw_usable, fs_fw_usable;
+        const struct fw_hdr *fs_fw;
+        const struct fw_hdr *drv_fw;
+
+        drv_fw = &fw_info->fw_hdr;
+
+        /* Read the header of the firmware on the card */
+        ret = -t4_read_flash(adap, FLASH_FW_START,
+                            sizeof(*card_fw) / sizeof(uint32_t),
+                            (uint32_t *)card_fw, 1);
+        if (ret == 0) {
+                card_fw_usable = fw_compatible(drv_fw, (const void *)card_fw);
+        } else {
+                dev_err(adap->pdev_dev,
+                        "Unable to read card's firmware header: %d\n", ret);
+                card_fw_usable = 0;
+        }
+
+        if (fw_data != NULL) {
+                fs_fw = (const void *)fw_data;
+                fs_fw_usable = fw_compatible(drv_fw, fs_fw);
+        } else {
+                fs_fw = NULL;
+                fs_fw_usable = 0;
+        }
+
+        if (card_fw_usable && card_fw->fw_ver == drv_fw->fw_ver &&
+            (!fs_fw_usable || fs_fw->fw_ver == drv_fw->fw_ver)) {
+                /* Common case: the firmware on the card is an exact match and
+                 * the filesystem one is an exact match too, or the filesystem
+                 * one is absent/incompatible.
+                 */
+        } else if (fs_fw_usable && state == DEV_STATE_UNINIT &&
+                   should_install_fs_fw(adap, card_fw_usable,
+                                        be32_to_cpu(fs_fw->fw_ver),
+                                        be32_to_cpu(card_fw->fw_ver))) {
+                ret = -t4_fw_upgrade(adap, adap->mbox, fw_data,
+                                     fw_size, 0);
+                if (ret != 0) {
+                        dev_err(adap->pdev_dev,
+                                "failed to install firmware: %d\n", ret);
+                        goto bye;
+                }
+
+                /* Installed successfully, update the cached header too. */
+                memcpy(card_fw, fs_fw, sizeof(*card_fw));
+                card_fw_usable = 1;
+                *reset = 0;     /* already reset as part of load_fw */
+        }
+
+        if (!card_fw_usable) {
+                uint32_t d, c, k;
+
+                d = be32_to_cpu(drv_fw->fw_ver);
+                c = be32_to_cpu(card_fw->fw_ver);
+                k = fs_fw ? be32_to_cpu(fs_fw->fw_ver) : 0;
+
+                dev_err(adap->pdev_dev, "Cannot find a usable firmware: "
+                        "chip state %d, "
+                        "driver compiled with %d.%d.%d.%d, "
+                        "card has %d.%d.%d.%d, filesystem has %d.%d.%d.%d\n",
+                        state,
+                        FW_HDR_FW_VER_MAJOR_GET(d), FW_HDR_FW_VER_MINOR_GET(d),
+                        FW_HDR_FW_VER_MICRO_GET(d), FW_HDR_FW_VER_BUILD_GET(d),
+                        FW_HDR_FW_VER_MAJOR_GET(c), FW_HDR_FW_VER_MINOR_GET(c),
+                        FW_HDR_FW_VER_MICRO_GET(c), FW_HDR_FW_VER_BUILD_GET(c),
+                        FW_HDR_FW_VER_MAJOR_GET(k), FW_HDR_FW_VER_MINOR_GET(k),
+                        FW_HDR_FW_VER_MICRO_GET(k), FW_HDR_FW_VER_BUILD_GET(k));
+                ret = EINVAL;
+                goto bye;
+        }
+
+        /* We're using whatever's on the card and it's known to be good. */
+        adap->params.fw_vers = be32_to_cpu(card_fw->fw_ver);
+        adap->params.tp_vers = be32_to_cpu(card_fw->tp_microcode_ver);
+
+bye:
+        return ret;
+}
+
 /**
  *      t4_flash_erase_sectors - erase a range of flash sectors
  *      @adapter: the adapter
@@ -1368,7 +1433,7 @@ static void pcie_intr_handler(struct adapter *adapter)
                                     PCIE_CORE_UTL_PCI_EXPRESS_PORT_STATUS,
                                     pcie_port_intr_info) +
               t4_handle_intr_status(adapter, PCIE_INT_CAUSE,
-                                    is_t4(adapter->chip) ?
+                                    is_t4(adapter->params.chip) ?
                                     pcie_intr_info : t5_pcie_intr_info);
 
         if (fat)
@@ -1782,7 +1847,7 @@ static void xgmac_intr_handler(struct adapter *adap, int port)
 {
         u32 v, int_cause_reg;
 
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 int_cause_reg = PORT_REG(port, XGMAC_PORT_INT_CAUSE);
         else
                 int_cause_reg = T5_PORT_REG(port, MAC_PORT_INT_CAUSE);
@@ -2250,7 +2315,7 @@ void t4_get_port_stats(struct adapter *adap, int idx, struct port_stats *p)
 
 #define GET_STAT(name) \
         t4_read_reg64(adap, \
-        (is_t4(adap->chip) ? PORT_REG(idx, MPS_PORT_STAT_##name##_L) : \
+        (is_t4(adap->params.chip) ? PORT_REG(idx, MPS_PORT_STAT_##name##_L) : \
         T5_PORT_REG(idx, MPS_PORT_STAT_##name##_L)))
 #define GET_STAT_COM(name) t4_read_reg64(adap, MPS_STAT_##name##_L)
 
@@ -2332,7 +2397,7 @@ void t4_wol_magic_enable(struct adapter *adap, unsigned int port,
 {
         u32 mag_id_reg_l, mag_id_reg_h, port_cfg_reg;
 
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 mag_id_reg_l = PORT_REG(port, XGMAC_PORT_MAGIC_MACID_LO);
                 mag_id_reg_h = PORT_REG(port, XGMAC_PORT_MAGIC_MACID_HI);
                 port_cfg_reg = PORT_REG(port, XGMAC_PORT_CFG2);
@@ -2374,7 +2439,7 @@ int t4_wol_pat_enable(struct adapter *adap, unsigned int port, unsigned int map,
         int i;
         u32 port_cfg_reg;
 
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 port_cfg_reg = PORT_REG(port, XGMAC_PORT_CFG2);
         else
                 port_cfg_reg = T5_PORT_REG(port, MAC_PORT_CFG2);
@@ -2387,7 +2452,7 @@ int t4_wol_pat_enable(struct adapter *adap, unsigned int port, unsigned int map,
                 return -EINVAL;
 
 #define EPIO_REG(name) \
-        (is_t4(adap->chip) ? PORT_REG(port, XGMAC_PORT_EPIO_##name) : \
+        (is_t4(adap->params.chip) ? PORT_REG(port, XGMAC_PORT_EPIO_##name) : \
         T5_PORT_REG(port, MAC_PORT_EPIO_##name))
 
         t4_write_reg(adap, EPIO_REG(DATA1), mask0 >> 32);
@@ -2474,7 +2539,7 @@ int t4_fwaddrspace_write(struct adapter *adap, unsigned int mbox,
 int t4_mem_win_read_len(struct adapter *adap, u32 addr, __be32 *data, int len)
 {
         int i, off;
-        u32 win_pf = is_t4(adap->chip) ? 0 : V_PFNUM(adap->fn);
+        u32 win_pf = is_t4(adap->params.chip) ? 0 : V_PFNUM(adap->fn);
 
         /* Align on a 2KB boundary.
          */
@@ -3306,7 +3371,7 @@ int t4_alloc_mac_filt(struct adapter *adap, unsigned int mbox,
         int i, ret;
         struct fw_vi_mac_cmd c;
         struct fw_vi_mac_exact *p;
-        unsigned int max_naddr = is_t4(adap->chip) ?
+        unsigned int max_naddr = is_t4(adap->params.chip) ?
                                        NUM_MPS_CLS_SRAM_L_INSTANCES :
                                        NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
 
@@ -3368,7 +3433,7 @@ int t4_change_mac(struct adapter *adap, unsigned int mbox, unsigned int viid,
         int ret, mode;
         struct fw_vi_mac_cmd c;
         struct fw_vi_mac_exact *p = c.u.exact;
-        unsigned int max_mac_addr = is_t4(adap->chip) ?
+        unsigned int max_mac_addr = is_t4(adap->params.chip) ?
                                     NUM_MPS_CLS_SRAM_L_INSTANCES :
                                     NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
 
@@ -3699,13 +3764,14 @@ int t4_prep_adapter(struct adapter *adapter)
 {
         int ret, ver;
         uint16_t device_id;
+        u32 pl_rev;
 
         ret = t4_wait_dev_ready(adapter);
         if (ret < 0)
                 return ret;
 
         get_pci_mode(adapter, &adapter->params.pci);
-        adapter->params.rev = t4_read_reg(adapter, PL_REV);
+        pl_rev = G_REV(t4_read_reg(adapter, PL_REV));
 
         ret = get_flash_params(adapter);
         if (ret < 0) {
@@ -3717,14 +3783,13 @@ int t4_prep_adapter(struct adapter *adapter)
          */
         pci_read_config_word(adapter->pdev, PCI_DEVICE_ID, &device_id);
         ver = device_id >> 12;
+        adapter->params.chip = 0;
         switch (ver) {
         case CHELSIO_T4:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T4,
-                                                  adapter->params.rev);
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T4, pl_rev);
                 break;
         case CHELSIO_T5:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T5,
-                                                  adapter->params.rev);
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T5, pl_rev);
                 break;
         default:
                 dev_err(adapter->pdev_dev, "Device %d is not supported\n",
@@ -3732,9 +3797,6 @@ int t4_prep_adapter(struct adapter *adapter)
                 return -EINVAL;
         }
 
-        /* Reassign the updated revision field */
-        adapter->params.rev = adapter->chip;
-
         init_cong_ctrl(adapter->params.a_wnd, adapter->params.b_wnd);
 
         /*
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index ef146c0ba481..0a8205d69d2c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -1092,6 +1092,11 @@
 
 #define PL_REV 0x1943c
 
+#define S_REV    0
+#define M_REV    0xfU
+#define V_REV(x) ((x) << S_REV)
+#define G_REV(x) (((x) >> S_REV) & M_REV)
+
 #define LE_DB_CONFIG 0x19c04
 #define  HASHEN 0x00100000U
 
@@ -1199,4 +1204,13 @@
 #define EDC_STRIDE_T5 (EDC_T51_BASE_ADDR - EDC_T50_BASE_ADDR)
 #define EDC_REG_T5(reg, idx) (reg + EDC_STRIDE_T5 * idx)
 
+#define A_PL_VF_REV 0x4
+#define A_PL_VF_WHOAMI 0x0
+#define A_PL_VF_REVISION 0x8
+
+#define S_CHIPID    4
+#define M_CHIPID    0xfU
+#define V_CHIPID(x) ((x) << S_CHIPID)
+#define G_CHIPID(x) (((x) >> S_CHIPID) & M_CHIPID)
+
 #endif /* __T4_REGS_H */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
index 6f77ac487743..74fea74ce0aa 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
@@ -2157,7 +2157,7 @@ struct fw_debug_cmd {
 
 struct fw_hdr {
         u8 ver;
-        u8 reserved1;
+        u8 chip;                        /* terminator chip type */
         __be16  len512;                 /* bin length in units of 512-bytes */
         __be32  fw_ver;                 /* firmware version */
         __be32  tp_microcode_ver;
@@ -2176,6 +2176,11 @@ struct fw_hdr {
         __be32  reserved6[23];
 };
 
+enum fw_hdr_chip {
+        FW_HDR_CHIP_T4,
+        FW_HDR_CHIP_T5
+};
+
 #define FW_HDR_FW_VER_MAJOR_GET(x) (((x) >> 24) & 0xff)
 #define FW_HDR_FW_VER_MINOR_GET(x) (((x) >> 16) & 0xff)
 #define FW_HDR_FW_VER_MICRO_GET(x) (((x) >> 8) & 0xff)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index be5c7ef6ca93..68eaa9c88c7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -344,7 +344,6 @@ struct adapter {
         unsigned long registered_device_map;
         unsigned long open_device_map;
         unsigned long flags;
-        enum chip_type chip;
         struct adapter_params params;
 
         /* queue and interrupt resources */
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index 5f90ec5f7519..0899c0983594 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -1064,7 +1064,7 @@ static inline unsigned int mk_adap_vers(const struct adapter *adapter)
         /*
          * Chip version 4, revision 0x3f (cxgb4vf).
          */
-        return CHELSIO_CHIP_VERSION(adapter->chip) | (0x3f << 10);
+        return CHELSIO_CHIP_VERSION(adapter->params.chip) | (0x3f << 10);
 }
 
 /*
@@ -1551,9 +1551,13 @@ static void cxgb4vf_get_regs(struct net_device *dev,
         reg_block_dump(adapter, regbuf,
                        T4VF_MPS_BASE_ADDR + T4VF_MOD_MAP_MPS_FIRST,
                        T4VF_MPS_BASE_ADDR + T4VF_MOD_MAP_MPS_LAST);
+
+        /* T5 adds new registers in the PL Register map.
+         */
         reg_block_dump(adapter, regbuf,
                        T4VF_PL_BASE_ADDR + T4VF_MOD_MAP_PL_FIRST,
-                       T4VF_PL_BASE_ADDR + T4VF_MOD_MAP_PL_LAST);
+                       T4VF_PL_BASE_ADDR + (is_t4(adapter->params.chip)
+                       ? A_PL_VF_WHOAMI : A_PL_VF_REVISION));
         reg_block_dump(adapter, regbuf,
                        T4VF_CIM_BASE_ADDR + T4VF_MOD_MAP_CIM_FIRST,
                        T4VF_CIM_BASE_ADDR + T4VF_MOD_MAP_CIM_LAST);
@@ -2087,6 +2091,7 @@ static int adap_init0(struct adapter *adapter)
         unsigned int ethqsets;
         int err;
         u32 param, val = 0;
+        unsigned int chipid;
 
         /*
          * Wait for the device to become ready before proceeding ...
@@ -2114,12 +2119,14 @@ static int adap_init0(struct adapter *adapter)
                 return err;
         }
 
+        adapter->params.chip = 0;
         switch (adapter->pdev->device >> 12) {
         case CHELSIO_T4:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T4, 0);
+                adapter->params.chip = CHELSIO_CHIP_CODE(CHELSIO_T4, 0);
                 break;
         case CHELSIO_T5:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T5, 0);
+                chipid = G_REV(t4_read_reg(adapter, A_PL_VF_REV));
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T5, chipid);
                 break;
         }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index 8475c4cda9e4..0a89963c48ce 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -537,7 +537,7 @@ static inline void ring_fl_db(struct adapter *adapter, struct sge_fl *fl)
          */
         if (fl->pend_cred >= FL_PER_EQ_UNIT) {
                 val = PIDX(fl->pend_cred / FL_PER_EQ_UNIT);
-                if (!is_t4(adapter->chip))
+                if (!is_t4(adapter->params.chip))
                         val |= DBTYPE(1);
                 wmb();
                 t4_write_reg(adapter, T4VF_SGE_BASE_ADDR + SGE_VF_KDOORBELL,
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 53cbfed21d0b..61362450d05b 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -39,21 +39,28 @@
 #include "../cxgb4/t4fw_api.h"
 
 #define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
-#define CHELSIO_CHIP_VERSION(code) ((code) >> 4)
+#define CHELSIO_CHIP_VERSION(code) (((code) >> 4) & 0xf)
 #define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
 
+/* All T4 and later chips have their PCI-E Device IDs encoded as 0xVFPP where:
+ *
+ *   V  = "4" for T4; "5" for T5, etc. or
+ *      = "a" for T4 FPGA; "b" for T4 FPGA, etc.
+ *   F  = "0" for PF 0..3; "4".."7" for PF4..7; and "8" for VFs
+ *   PP = adapter product designation
+ */
 #define CHELSIO_T4              0x4
 #define CHELSIO_T5              0x5
 
 enum chip_type {
-        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 0),
-        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
-        T4_A3 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
+        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
+        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
         T4_FIRST_REV    = T4_A1,
-        T4_LAST_REV     = T4_A3,
+        T4_LAST_REV     = T4_A2,
 
-        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
-        T5_FIRST_REV    = T5_A1,
+        T5_A0 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
+        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 1),
+        T5_FIRST_REV    = T5_A0,
         T5_LAST_REV     = T5_A1,
 };
 
@@ -203,6 +210,7 @@ struct adapter_params {
         struct vpd_params vpd;          /* Vital Product Data */
         struct rss_params rss;          /* Receive Side Scaling */
         struct vf_resources vfres;      /* Virtual Function Resource limits */
+        enum chip_type chip;            /* chip code */
         u8 nports;                      /* # of Ethernet "ports" */
 };
 
@@ -253,7 +261,7 @@ static inline int t4vf_wr_mbox_ns(struct adapter *adapter, const void *cmd,
 
 static inline int is_t4(enum chip_type chip)
 {
-        return (chip >= T4_FIRST_REV && chip <= T4_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T4;
 }
 
 int t4vf_wait_dev_ready(struct adapter *);
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index 9f96dc3bb112..d958c44341b5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -1027,7 +1027,7 @@ int t4vf_alloc_mac_filt(struct adapter *adapter, unsigned int viid, bool free,
         unsigned nfilters = 0;
         unsigned int rem = naddr;
         struct fw_vi_mac_cmd cmd, rpl;
-        unsigned int max_naddr = is_t4(adapter->chip) ?
+        unsigned int max_naddr = is_t4(adapter->params.chip) ?
                                  NUM_MPS_CLS_SRAM_L_INSTANCES :
                                  NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
 
@@ -1121,7 +1121,7 @@ int t4vf_change_mac(struct adapter *adapter, unsigned int viid,
         struct fw_vi_mac_exact *p = &cmd.u.exact[0];
         size_t len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
                                              u.exact[1]), 16);
-        unsigned int max_naddr = is_t4(adapter->chip) ?
+        unsigned int max_naddr = is_t4(adapter->params.chip) ?
                                  NUM_MPS_CLS_SRAM_L_INSTANCES :
                                  NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index f4825db5d179..5878df619b53 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -503,6 +503,7 @@ struct be_adapter {
 };
 
 #define be_physfn(adapter)              (!adapter->virtfn)
+#define be_virtfn(adapter)              (adapter->virtfn)
 #define sriov_enabled(adapter)          (adapter->num_vfs > 0)
 #define sriov_want(adapter)             (be_physfn(adapter) &&  \
                                          (num_vfs || pci_num_vf(adapter->pdev)))
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index dbcd5262c016..e0e8bc1ef14c 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1032,6 +1032,13 @@ int be_cmd_cq_create(struct be_adapter *adapter, struct be_queue_info *cq,
         } else {
                 req->hdr.version = 2;
                 req->page_size = 1; /* 1 for 4K */
+
+                /* coalesce-wm field in this cmd is not relevant to Lancer.
+                 * Lancer uses COMMON_MODIFY_CQ to set this field
+                 */
+                if (!lancer_chip(adapter))
+                        AMAP_SET_BITS(struct amap_cq_context_v2, coalescwm,
+                                      ctxt, coalesce_wm);
                 AMAP_SET_BITS(struct amap_cq_context_v2, nodelay, ctxt,
                                                                 no_delay);
                 AMAP_SET_BITS(struct amap_cq_context_v2, count, ctxt,
diff --git a/drivers/net/ethernet/emulex/benet/be_hw.h b/drivers/net/ethernet/emulex/benet/be_hw.h
index 3e2162121601..dc88782185f2 100644
--- a/drivers/net/ethernet/emulex/benet/be_hw.h
+++ b/drivers/net/ethernet/emulex/benet/be_hw.h
@@ -64,6 +64,9 @@
 #define SLIPORT_ERROR_NO_RESOURCE1      0x2
 #define SLIPORT_ERROR_NO_RESOURCE2      0x9
 
+#define SLIPORT_ERROR_FW_RESET1         0x2
+#define SLIPORT_ERROR_FW_RESET2         0x0
+
 /********* Memory BAR register ************/
 #define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET      0xfc
 /* Host Interrupt Enable, if set interrupts are enabled although "PCI Interrupt
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index abde97471636..0fde69d5cb6a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2464,8 +2464,16 @@ void be_detect_error(struct be_adapter *adapter)
          */
         if (sliport_status & SLIPORT_STATUS_ERR_MASK) {
                 adapter->hw_error = true;
-                dev_err(&adapter->pdev->dev,
-                        "Error detected in the card\n");
+                /* Do not log error messages if its a FW reset */
+                if (sliport_err1 == SLIPORT_ERROR_FW_RESET1 &&
+                    sliport_err2 == SLIPORT_ERROR_FW_RESET2) {
+                        dev_info(&adapter->pdev->dev,
+                                 "Firmware update in progress\n");
+                        return;
+                } else {
+                        dev_err(&adapter->pdev->dev,
+                                "Error detected in the card\n");
+                }
         }
 
         if (sliport_status & SLIPORT_STATUS_ERR_MASK) {
@@ -2658,8 +2666,8 @@ static int be_close(struct net_device *netdev)
 
         be_roce_dev_close(adapter);
 
-        for_all_evt_queues(adapter, eqo, i) {
-                if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
+        if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
+                for_all_evt_queues(adapter, eqo, i) {
                         napi_disable(&eqo->napi);
                         be_disable_busy_poll(eqo);
                 }
@@ -2932,28 +2940,35 @@ static void be_cancel_worker(struct be_adapter *adapter)
         }
 }
 
-static int be_clear(struct be_adapter *adapter)
+static void be_mac_clear(struct be_adapter *adapter)
 {
         int i;
 
+        if (adapter->pmac_id) {
+                for (i = 0; i < (adapter->uc_macs + 1); i++)
+                        be_cmd_pmac_del(adapter, adapter->if_handle,
+                                        adapter->pmac_id[i], 0);
+                adapter->uc_macs = 0;
+
+                kfree(adapter->pmac_id);
+                adapter->pmac_id = NULL;
+        }
+}
+
+static int be_clear(struct be_adapter *adapter)
+{
         be_cancel_worker(adapter);
 
         if (sriov_enabled(adapter))
                 be_vf_clear(adapter);
 
         /* delete the primary mac along with the uc-mac list */
-        for (i = 0; i < (adapter->uc_macs + 1); i++)
-                be_cmd_pmac_del(adapter, adapter->if_handle,
-                                adapter->pmac_id[i], 0);
-        adapter->uc_macs = 0;
+        be_mac_clear(adapter);
 
         be_cmd_if_destroy(adapter, adapter->if_handle,  0);
 
         be_clear_queues(adapter);
 
-        kfree(adapter->pmac_id);
-        adapter->pmac_id = NULL;
-
         be_msix_disable(adapter);
         return 0;
 }
@@ -3253,12 +3268,10 @@ static int be_mac_setup(struct be_adapter *adapter)
                 memcpy(mac, adapter->netdev->dev_addr, ETH_ALEN);
         }
 
-        /* On BE3 VFs this cmd may fail due to lack of privilege.
-         * Ignore the failure as in this case pmac_id is fetched
-         * in the IFACE_CREATE cmd.
-         */
-        be_cmd_pmac_add(adapter, mac, adapter->if_handle,
-                        &adapter->pmac_id[0], 0);
+        /* For BE3-R VFs, the PF programs the initial MAC address */
+        if (!(BEx_chip(adapter) && be_virtfn(adapter)))
+                be_cmd_pmac_add(adapter, mac, adapter->if_handle,
+                                &adapter->pmac_id[0], 0);
         return 0;
 }
 
@@ -3814,6 +3827,8 @@ static int lancer_fw_download(struct be_adapter *adapter,
         }
 
         if (change_status == LANCER_FW_RESET_NEEDED) {
+                dev_info(&adapter->pdev->dev,
+                         "Resetting adapter to activate new FW\n");
                 status = lancer_physdev_ctrl(adapter,
                                              PHYSDEV_CONTROL_FW_RESET_MASK);
                 if (status) {
@@ -4365,13 +4380,13 @@ static int lancer_recover_func(struct be_adapter *adapter)
                         goto err;
         }
 
-        dev_err(dev, "Error recovery successful\n");
+        dev_err(dev, "Adapter recovery successful\n");
         return 0;
 err:
         if (status == -EAGAIN)
                 dev_err(dev, "Waiting for resource provisioning\n");
         else
-                dev_err(dev, "Error recovery failed\n");
+                dev_err(dev, "Adapter recovery failed\n");
 
         return status;
 }
@@ -4599,6 +4614,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
         if (adapter->wol)
                 be_setup_wol(adapter, true);
 
+        be_intr_set(adapter, false);
         cancel_delayed_work_sync(&adapter->func_recovery_work);
 
         netif_device_detach(netdev);
@@ -4634,6 +4650,7 @@ static int be_resume(struct pci_dev *pdev)
         if (status)
                 return status;
 
+        be_intr_set(adapter, true);
         /* tell fw we're ready to fire cmds */
         status = be_cmd_fw_init(adapter);
         if (status)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 4cbebf3d80eb..e7c8b749c5a5 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -98,10 +98,6 @@ static void set_multicast_list(struct net_device *ndev);
  * detected as not set during a prior frame transmission, then the
  * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
  * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
- * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
- * detected as not set during a prior frame transmission, then the
- * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
- * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
  * frames not being transmitted until there is a 0-to-1 transition on
  * ENET_TDAR[TDAR].
  */
@@ -385,7 +381,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
          * data.
          */
         bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, bufaddr,
-                        FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
+                        skb->len, DMA_TO_DEVICE);
         if (dma_mapping_error(&fep->pdev->dev, bdp->cbd_bufaddr)) {
                 bdp->cbd_bufaddr = 0;
                 fep->tx_skbuff[index] = NULL;
@@ -779,11 +775,10 @@ fec_enet_tx(struct net_device *ndev)
                 else
                         index = bdp - fep->tx_bd_base;
 
-                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
-                bdp->cbd_bufaddr = 0;
-
                 skb = fep->tx_skbuff[index];
+                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr, skb->len,
+                                DMA_TO_DEVICE);
+                bdp->cbd_bufaddr = 0;
 
                 /* Check for errors. */
                 if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 2d1c6bdd3618..7628e0fd8455 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -3033,7 +3033,7 @@ static struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
 
         dev->hw_features = NETIF_F_SG | NETIF_F_TSO |
                       NETIF_F_IP_CSUM | NETIF_F_HW_VLAN_CTAG_TX;
-        dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_TSO |
+        dev->features = NETIF_F_SG | NETIF_F_TSO |
                       NETIF_F_HIGHDMA | NETIF_F_IP_CSUM |
                       NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX |
                       NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_RXCSUM;
diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h
index 58c147271a36..f9313b36c887 100644
--- a/drivers/net/ethernet/intel/e1000/e1000.h
+++ b/drivers/net/ethernet/intel/e1000/e1000.h
@@ -83,6 +83,11 @@ struct e1000_adapter;
 
 #define E1000_MAX_INTR                  10
 
+/*
+ * Count for polling __E1000_RESET condition every 10-20msec.
+ */
+#define E1000_CHECK_RESET_COUNT 50
+
 /* TX/RX descriptor defines */
 #define E1000_DEFAULT_TXD               256
 #define E1000_MAX_TXD                   256
@@ -312,8 +317,6 @@ struct e1000_adapter {
         struct delayed_work watchdog_task;
         struct delayed_work fifo_stall_task;
         struct delayed_work phy_info_task;
-
-        struct mutex mutex;
 };
 
 enum e1000_state_t {
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index e38622825fa7..46e6544ed1b7 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -494,13 +494,20 @@ static void e1000_down_and_stop(struct e1000_adapter *adapter)
 {
         set_bit(__E1000_DOWN, &adapter->flags);
 
-        /* Only kill reset task if adapter is not resetting */
-        if (!test_bit(__E1000_RESETTING, &adapter->flags))
-                cancel_work_sync(&adapter->reset_task);
-
         cancel_delayed_work_sync(&adapter->watchdog_task);
+
+        /*
+         * Since the watchdog task can reschedule other tasks, we should cancel
+         * it first, otherwise we can run into the situation when a work is
+         * still running after the adapter has been turned down.
+         */
+
         cancel_delayed_work_sync(&adapter->phy_info_task);
         cancel_delayed_work_sync(&adapter->fifo_stall_task);
+
+        /* Only kill reset task if adapter is not resetting */
+        if (!test_bit(__E1000_RESETTING, &adapter->flags))
+                cancel_work_sync(&adapter->reset_task);
 }
 
 void e1000_down(struct e1000_adapter *adapter)
@@ -544,21 +551,8 @@ void e1000_down(struct e1000_adapter *adapter)
         e1000_clean_all_rx_rings(adapter);
 }
 
-static void e1000_reinit_safe(struct e1000_adapter *adapter)
-{
-        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
-                msleep(1);
-        mutex_lock(&adapter->mutex);
-        e1000_down(adapter);
-        e1000_up(adapter);
-        mutex_unlock(&adapter->mutex);
-        clear_bit(__E1000_RESETTING, &adapter->flags);
-}
-
 void e1000_reinit_locked(struct e1000_adapter *adapter)
 {
-        /* if rtnl_lock is not held the call path is bogus */
-        ASSERT_RTNL();
         WARN_ON(in_interrupt());
         while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
                 msleep(1);
@@ -1316,7 +1310,6 @@ static int e1000_sw_init(struct e1000_adapter *adapter)
         e1000_irq_disable(adapter);
 
         spin_lock_init(&adapter->stats_lock);
-        mutex_init(&adapter->mutex);
 
         set_bit(__E1000_DOWN, &adapter->flags);
 
@@ -1440,6 +1433,10 @@ static int e1000_close(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
         struct e1000_hw *hw = &adapter->hw;
+        int count = E1000_CHECK_RESET_COUNT;
+
+        while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+                usleep_range(10000, 20000);
 
         WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
         e1000_down(adapter);
@@ -2325,11 +2322,8 @@ static void e1000_update_phy_info_task(struct work_struct *work)
         struct e1000_adapter *adapter = container_of(work,
                                                      struct e1000_adapter,
                                                      phy_info_task.work);
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
+
         e1000_phy_get_info(&adapter->hw, &adapter->phy_info);
-        mutex_unlock(&adapter->mutex);
 }
 
 /**
@@ -2345,9 +2339,6 @@ static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
         struct net_device *netdev = adapter->netdev;
         u32 tctl;
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
         if (atomic_read(&adapter->tx_fifo_stall)) {
                 if ((er32(TDT) == er32(TDH)) &&
                    (er32(TDFT) == er32(TDFH)) &&
@@ -2368,7 +2359,6 @@ static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
                         schedule_delayed_work(&adapter->fifo_stall_task, 1);
                 }
         }
-        mutex_unlock(&adapter->mutex);
 }
 
 bool e1000_has_link(struct e1000_adapter *adapter)
@@ -2422,10 +2412,6 @@ static void e1000_watchdog(struct work_struct *work)
         struct e1000_tx_ring *txdr = adapter->tx_ring;
         u32 link, tctl;
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-
-        mutex_lock(&adapter->mutex);
         link = e1000_has_link(adapter);
         if ((netif_carrier_ok(netdev)) && link)
                 goto link_up;
@@ -2516,7 +2502,7 @@ link_up:
                         adapter->tx_timeout_count++;
                         schedule_work(&adapter->reset_task);
                         /* exit immediately since reset is imminent */
-                        goto unlock;
+                        return;
                 }
         }
 
@@ -2544,9 +2530,6 @@ link_up:
         /* Reschedule the task */
         if (!test_bit(__E1000_DOWN, &adapter->flags))
                 schedule_delayed_work(&adapter->watchdog_task, 2 * HZ);
-
-unlock:
-        mutex_unlock(&adapter->mutex);
 }
 
 enum latency_range {
@@ -3495,10 +3478,8 @@ static void e1000_reset_task(struct work_struct *work)
         struct e1000_adapter *adapter =
                 container_of(work, struct e1000_adapter, reset_task);
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
         e_err(drv, "Reset adapter\n");
-        e1000_reinit_safe(adapter);
+        e1000_reinit_locked(adapter);
 }
 
 /**
@@ -4963,6 +4944,11 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
         netif_device_detach(netdev);
 
         if (netif_running(netdev)) {
+                int count = E1000_CHECK_RESET_COUNT;
+
+                while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+                        usleep_range(10000, 20000);
+
                 WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
                 e1000_down(adapter);
         }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index be15938ba213..12b0932204ba 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -354,6 +354,9 @@ static struct rtnl_link_stats64 *i40e_get_netdev_stats_struct(
         struct rtnl_link_stats64 *vsi_stats = i40e_get_vsi_stats_struct(vsi);
         int i;
 
+        if (!vsi->tx_rings)
+                return stats;
+
         rcu_read_lock();
         for (i = 0; i < vsi->num_queue_pairs; i++) {
                 struct i40e_ring *tx_ring, *rx_ring;
diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.c b/drivers/net/ethernet/intel/igb/e1000_phy.c
index c4c4fe332c7e..ad2b74d95138 100644
--- a/drivers/net/ethernet/intel/igb/e1000_phy.c
+++ b/drivers/net/ethernet/intel/igb/e1000_phy.c
@@ -1728,7 +1728,10 @@ s32 igb_phy_has_link(struct e1000_hw *hw, u32 iterations,
                          * ownership of the resources, wait and try again to
                          * see if they have relinquished the resources yet.
                          */
-                        udelay(usec_interval);
+                        if (usec_interval >= 1000)
+                                mdelay(usec_interval/1000);
+                        else
+                                udelay(usec_interval);
                 }
                 ret_val = hw->phy.ops.read_reg(hw, PHY_STATUS, &phy_status);
                 if (ret_val)
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index b0f3666b1d7f..c3143da497c8 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2062,14 +2062,15 @@ static void igb_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
 {
         struct igb_adapter *adapter = netdev_priv(netdev);
 
-        wol->supported = WAKE_UCAST | WAKE_MCAST |
-                         WAKE_BCAST | WAKE_MAGIC |
-                         WAKE_PHY;
         wol->wolopts = 0;
 
         if (!(adapter->flags & IGB_FLAG_WOL_SUPPORTED))
                 return;
 
+        wol->supported = WAKE_UCAST | WAKE_MCAST |
+                         WAKE_BCAST | WAKE_MAGIC |
+                         WAKE_PHY;
+
         /* apply any specific unsupported masks here */
         switch (adapter->hw.device_id) {
         default:
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 0c55079ebee3..cc06854296a3 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4251,8 +4251,8 @@ static void ixgbe_disable_fwd_ring(struct ixgbe_fwd_adapter *vadapter,
         rx_ring->l2_accel_priv = NULL;
 }
 
-int ixgbe_fwd_ring_down(struct net_device *vdev,
-                        struct ixgbe_fwd_adapter *accel)
+static int ixgbe_fwd_ring_down(struct net_device *vdev,
+                               struct ixgbe_fwd_adapter *accel)
 {
         struct ixgbe_adapter *adapter = accel->real_adapter;
         unsigned int rxbase = accel->rx_base_queue;
@@ -7986,10 +7986,9 @@ skip_sriov:
                            NETIF_F_TSO |
                            NETIF_F_TSO6 |
                            NETIF_F_RXHASH |
-                           NETIF_F_RXCSUM |
-                           NETIF_F_HW_L2FW_DOFFLOAD;
+                           NETIF_F_RXCSUM;
 
-        netdev->hw_features = netdev->features;
+        netdev->hw_features = netdev->features | NETIF_F_HW_L2FW_DOFFLOAD;
 
         switch (adapter->hw.mac.type) {
         case ixgbe_mac_82599EB:
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index e4c676006be9..39217e5ff7dc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -46,6 +46,7 @@ static bool ixgbe_get_i2c_data(u32 *i2cctl);
 static void ixgbe_i2c_bus_clear(struct ixgbe_hw *hw);
 static enum ixgbe_phy_type ixgbe_get_phy_type_from_id(u32 phy_id);
 static s32 ixgbe_get_phy_id(struct ixgbe_hw *hw);
+static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw);
 
 /**
  *  ixgbe_identify_phy_generic - Get physical layer module
@@ -1164,7 +1165,7 @@ err_read_i2c_eeprom:
  *
  * Searches for and identifies the QSFP module and assigns appropriate PHY type
  **/
-s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw)
+static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw)
 {
         struct ixgbe_adapter *adapter = hw->back;
         s32 status = IXGBE_ERR_PHY_ADDR_INVALID;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
index aae900a256da..fffcbdd2bf0e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
@@ -145,7 +145,6 @@ s32 ixgbe_get_phy_firmware_version_generic(struct ixgbe_hw *hw,
 s32 ixgbe_reset_phy_nl(struct ixgbe_hw *hw);
 s32 ixgbe_identify_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw);
-s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw,
                                         u16 *list_offset,
                                         u16 *data_offset);
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index b8e232b4ea2d..d5f0d72e5e33 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1378,7 +1378,7 @@ static void mvneta_rxq_drop_pkts(struct mvneta_port *pp,
 
                 dev_kfree_skb_any(skb);
                 dma_unmap_single(pp->dev->dev.parent, rx_desc->buf_phys_addr,
-                                 rx_desc->data_size, DMA_FROM_DEVICE);
+                                 MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
         }
 
         if (rx_done)
@@ -1424,7 +1424,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 }
 
                 dma_unmap_single(pp->dev->dev.parent, rx_desc->buf_phys_addr,
-                                 rx_desc->data_size, DMA_FROM_DEVICE);
+                                 MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
 
                 rx_bytes = rx_desc->data_size -
                         (ETH_FCS_LEN + MVNETA_MH_SIZE);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 40626690e8a8..c11d063473e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -140,7 +140,6 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        struct mlx4_en_tx_ring *tx_ring;
         int i, carrier_ok;
 
         memset(buf, 0, sizeof(u64) * MLX4_EN_NUM_SELF_TEST);
@@ -150,16 +149,10 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
                 carrier_ok = netif_carrier_ok(dev);
 
                 netif_carrier_off(dev);
-retry_tx:
                 /* Wait until all tx queues are empty.
                  * there should not be any additional incoming traffic
                  * since we turned the carrier off */
                 msleep(200);
-                for (i = 0; i < priv->tx_ring_num && carrier_ok; i++) {
-                        tx_ring = priv->tx_ring[i];
-                        if (tx_ring->prod != (tx_ring->cons + tx_ring->last_nr_txbb))
-                                goto retry_tx;
-                }
 
                 if (priv->mdev->dev->caps.flags &
                                         MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 5789ea2c934d..01fc6515384d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2635,6 +2635,8 @@ static int __init mlx4_init(void)
                 return -ENOMEM;
 
         ret = pci_register_driver(&mlx4_driver);
+        if (ret < 0)
+                destroy_workqueue(mlx4_wq);
         return ret < 0 ? ret : 0;
 }
 
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 2d045be4b5cf..1e8b9514718b 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -5150,8 +5150,10 @@ static void nv_self_test(struct net_device *dev, struct ethtool_test *test, u64
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
-        int result;
-        memset(buffer, 0, nv_get_sset_count(dev, ETH_SS_TEST)*sizeof(u64));
+        int result, count;
+
+        count = nv_get_sset_count(dev, ETH_SS_TEST);
+        memset(buffer, 0, count * sizeof(u64));
 
         if (!nv_link_test(dev)) {
                 test->flags |= ETH_TEST_FL_FAILED;
@@ -5195,7 +5197,7 @@ static void nv_self_test(struct net_device *dev, struct ethtool_test *test, u64
                         return;
                 }
 
-                if (!nv_loopback_test(dev)) {
+                if (count > NV_TEST_COUNT_BASE && !nv_loopback_test(dev)) {
                         test->flags |= ETH_TEST_FL_FAILED;
                         buffer[3] = 1;
                 }
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index 0c9c4e895595..03517478e589 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -18,7 +18,7 @@
  */
 #define DRV_NAME        "qlge"
 #define DRV_STRING      "QLogic 10 Gigabit PCI-E Ethernet Driver "
-#define DRV_VERSION     "1.00.00.33"
+#define DRV_VERSION     "1.00.00.34"
 
 #define WQ_ADDR_ALIGN   0x3     /* 4 byte alignment */
 
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c b/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
index 0780e039b271..8dee1beb9854 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
@@ -181,6 +181,7 @@ static const char ql_gstrings_test[][ETH_GSTRING_LEN] = {
 };
 #define QLGE_TEST_LEN (sizeof(ql_gstrings_test) / ETH_GSTRING_LEN)
 #define QLGE_STATS_LEN ARRAY_SIZE(ql_gstrings_stats)
+#define QLGE_RCV_MAC_ERR_STATS  7
 
 static int ql_update_ring_coalescing(struct ql_adapter *qdev)
 {
@@ -280,6 +281,9 @@ static void ql_update_stats(struct ql_adapter *qdev)
                 iter++;
         }
 
+        /* Update receive mac error statistics */
+        iter += QLGE_RCV_MAC_ERR_STATS;
+
         /*
          * Get Per-priority TX pause frame counter statistics.
          */
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index a245dc18d769..449f506d2e8f 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2376,14 +2376,6 @@ static netdev_features_t qlge_fix_features(struct net_device *ndev,
         netdev_features_t features)
 {
         int err;
-        /*
-         * Since there is no support for separate rx/tx vlan accel
-         * enable/disable make sure tx flag is always in same state as rx.
-         */
-        if (features & NETIF_F_HW_VLAN_CTAG_RX)
-                features |= NETIF_F_HW_VLAN_CTAG_TX;
-        else
-                features &= ~NETIF_F_HW_VLAN_CTAG_TX;
 
         /* Update the behavior of vlan accel in the adapter */
         err = qlge_update_hw_vlan_features(ndev, features);
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index f2a2128165dd..737c1a881f78 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -678,9 +678,6 @@ static void cp_tx (struct cp_private *cp)
                                  le32_to_cpu(txd->opts1) & 0xffff,
                                  PCI_DMA_TODEVICE);
 
-                bytes_compl += skb->len;
-                pkts_compl++;
-
                 if (status & LastFrag) {
                         if (status & (TxError | TxFIFOUnder)) {
                                 netif_dbg(cp, tx_err, cp->dev,
@@ -702,6 +699,8 @@ static void cp_tx (struct cp_private *cp)
                                 netif_dbg(cp, tx_done, cp->dev,
                                           "tx done, slot %d\n", tx_tail);
                         }
+                        bytes_compl += skb->len;
+                        pkts_compl++;
                         dev_kfree_skb_irq(skb);
                 }
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 799387570766..c737f0ea5de7 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3465,6 +3465,11 @@ static void rtl8168g_1_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x14, 0x9065);
         rtl_writephy(tp, 0x14, 0x1065);
 
+        /* Check ALDPS bit, disable it if enabled */
+        rtl_writephy(tp, 0x1f, 0x0a43);
+        if (rtl_readphy(tp, 0x10) & 0x0004)
+                rtl_w1w0_phy(tp, 0x10, 0x0000, 0x0004);
+
         rtl_writephy(tp, 0x1f, 0x0000);
 }
 
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 2e27837ce6a2..fd844b53e385 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -585,7 +585,7 @@ static void efx_start_datapath(struct efx_nic *efx)
                            EFX_MAX_FRAME_LEN(efx->net_dev->mtu) +
                            efx->type->rx_buffer_padding);
         rx_buf_len = (sizeof(struct efx_rx_page_state) +
-                      NET_IP_ALIGN + efx->rx_dma_len);
+                      efx->rx_ip_align + efx->rx_dma_len);
         if (rx_buf_len <= PAGE_SIZE) {
                 efx->rx_scatter = efx->type->always_rx_scatter;
                 efx->rx_buffer_order = 0;
@@ -645,6 +645,8 @@ static void efx_start_datapath(struct efx_nic *efx)
                 WARN_ON(channel->rx_pkt_n_frags);
         }
 
+        efx_ptp_start_datapath(efx);
+
         if (netif_device_present(efx->net_dev))
                 netif_tx_wake_all_queues(efx->net_dev);
 }
@@ -659,6 +661,8 @@ static void efx_stop_datapath(struct efx_nic *efx)
         EFX_ASSERT_RESET_SERIALISED(efx);
         BUG_ON(efx->port_enabled);
 
+        efx_ptp_stop_datapath(efx);
+
         /* Stop RX refill */
         efx_for_each_channel(channel, efx) {
                 efx_for_each_channel_rx_queue(rx_queue, channel)
@@ -2540,6 +2544,8 @@ static int efx_init_struct(struct efx_nic *efx,
 
         efx->net_dev = net_dev;
         efx->rx_prefix_size = efx->type->rx_prefix_size;
+        efx->rx_ip_align =
+                NET_IP_ALIGN ? (efx->rx_prefix_size + NET_IP_ALIGN) % 4 : 0;
         efx->rx_packet_hash_offset =
                 efx->type->rx_hash_offset - efx->type->rx_prefix_size;
         spin_lock_init(&efx->stats_lock);
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index 366c8e3e3784..4b0bd8a1514d 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -50,6 +50,7 @@ struct efx_mcdi_async_param {
 static void efx_mcdi_timeout_async(unsigned long context);
 static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                                bool *was_attached_out);
+static bool efx_mcdi_poll_once(struct efx_nic *efx);
 
 static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
 {
@@ -237,6 +238,21 @@ static void efx_mcdi_read_response_header(struct efx_nic *efx)
         }
 }
 
+static bool efx_mcdi_poll_once(struct efx_nic *efx)
+{
+        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
+
+        rmb();
+        if (!efx->type->mcdi_poll_response(efx))
+                return false;
+
+        spin_lock_bh(&mcdi->iface_lock);
+        efx_mcdi_read_response_header(efx);
+        spin_unlock_bh(&mcdi->iface_lock);
+
+        return true;
+}
+
 static int efx_mcdi_poll(struct efx_nic *efx)
 {
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
@@ -272,18 +288,13 @@ static int efx_mcdi_poll(struct efx_nic *efx)
 
                 time = jiffies;
 
-                rmb();
-                if (efx->type->mcdi_poll_response(efx))
+                if (efx_mcdi_poll_once(efx))
                         break;
 
                 if (time_after(time, finish))
                         return -ETIMEDOUT;
         }
 
-        spin_lock_bh(&mcdi->iface_lock);
-        efx_mcdi_read_response_header(efx);
-        spin_unlock_bh(&mcdi->iface_lock);
-
         /* Return rc=0 like wait_event_timeout() */
         return 0;
 }
@@ -619,6 +630,16 @@ int efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
                 rc = efx_mcdi_await_completion(efx);
 
         if (rc != 0) {
+                netif_err(efx, hw, efx->net_dev,
+                          "MC command 0x%x inlen %d mode %d timed out\n",
+                          cmd, (int)inlen, mcdi->mode);
+
+                if (mcdi->mode == MCDI_MODE_EVENTS && efx_mcdi_poll_once(efx)) {
+                        netif_err(efx, hw, efx->net_dev,
+                                  "MCDI request was completed without an event\n");
+                        rc = 0;
+                }
+
                 /* Close the race with efx_mcdi_ev_cpl() executing just too late
                  * and completing a request we've just cancelled, by ensuring
                  * that the seqno check therein fails.
@@ -627,11 +648,9 @@ int efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
                 ++mcdi->seqno;
                 ++mcdi->credits;
                 spin_unlock_bh(&mcdi->iface_lock);
+        }
 
-                netif_err(efx, hw, efx->net_dev,
-                          "MC command 0x%x inlen %d mode %d timed out\n",
-                          cmd, (int)inlen, mcdi->mode);
-        } else {
+        if (rc == 0) {
                 size_t hdr_len, data_len;
 
                 /* At the very least we need a memory barrier here to ensure
diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h
index 656a3277c2b2..15816cacb548 100644
--- a/drivers/net/ethernet/sfc/mcdi.h
+++ b/drivers/net/ethernet/sfc/mcdi.h
@@ -75,6 +75,8 @@ struct efx_mcdi_mon {
         unsigned long last_update;
         struct device *device;
         struct efx_mcdi_mon_attribute *attrs;
+        struct attribute_group group;
+        const struct attribute_group *groups[2];
         unsigned int n_attrs;
 };
 
diff --git a/drivers/net/ethernet/sfc/mcdi_mon.c b/drivers/net/ethernet/sfc/mcdi_mon.c
index 4cc5d95b2a5a..d72ad4fc3617 100644
--- a/drivers/net/ethernet/sfc/mcdi_mon.c
+++ b/drivers/net/ethernet/sfc/mcdi_mon.c
@@ -139,17 +139,10 @@ static int efx_mcdi_mon_update(struct efx_nic *efx)
         return rc;
 }
 
-static ssize_t efx_mcdi_mon_show_name(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
-{
-        return sprintf(buf, "%s\n", KBUILD_MODNAME);
-}
-
 static int efx_mcdi_mon_get_entry(struct device *dev, unsigned int index,
                                   efx_dword_t *entry)
 {
-        struct efx_nic *efx = dev_get_drvdata(dev);
+        struct efx_nic *efx = dev_get_drvdata(dev->parent);
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
         int rc;
 
@@ -263,7 +256,7 @@ static ssize_t efx_mcdi_mon_show_label(struct device *dev,
                        efx_mcdi_sensor_type[mon_attr->type].label);
 }
 
-static int
+static void
 efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
                       ssize_t (*reader)(struct device *,
                                         struct device_attribute *, char *),
@@ -272,7 +265,6 @@ efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
 {
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
         struct efx_mcdi_mon_attribute *attr = &hwmon->attrs[hwmon->n_attrs];
-        int rc;
 
         strlcpy(attr->name, name, sizeof(attr->name));
         attr->index = index;
@@ -286,10 +278,7 @@ efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
         attr->dev_attr.attr.name = attr->name;
         attr->dev_attr.attr.mode = S_IRUGO;
         attr->dev_attr.show = reader;
-        rc = device_create_file(&efx->pci_dev->dev, &attr->dev_attr);
-        if (rc == 0)
-                ++hwmon->n_attrs;
-        return rc;
+        hwmon->group.attrs[hwmon->n_attrs++] = &attr->dev_attr.attr;
 }
 
 int efx_mcdi_mon_probe(struct efx_nic *efx)
@@ -338,26 +327,22 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
         efx_mcdi_mon_update(efx);
 
         /* Allocate space for the maximum possible number of
-         * attributes for this set of sensors: name of the driver plus
+         * attributes for this set of sensors:
          * value, min, max, crit, alarm and label for each sensor.
          */
-        n_attrs = 1 + 6 * n_sensors;
+        n_attrs = 6 * n_sensors;
         hwmon->attrs = kcalloc(n_attrs, sizeof(*hwmon->attrs), GFP_KERNEL);
         if (!hwmon->attrs) {
                 rc = -ENOMEM;
                 goto fail;
         }
-
-        hwmon->device = hwmon_device_register(&efx->pci_dev->dev);
-        if (IS_ERR(hwmon->device)) {
-                rc = PTR_ERR(hwmon->device);
+        hwmon->group.attrs = kcalloc(n_attrs + 1, sizeof(struct attribute *),
+                                     GFP_KERNEL);
+        if (!hwmon->group.attrs) {
+                rc = -ENOMEM;
                 goto fail;
         }
 
-        rc = efx_mcdi_mon_add_attr(efx, "name", efx_mcdi_mon_show_name, 0, 0, 0);
-        if (rc)
-                goto fail;
-
         for (i = 0, j = -1, type = -1; ; i++) {
                 enum efx_hwmon_type hwmon_type;
                 const char *hwmon_prefix;
@@ -372,7 +357,7 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                                 page = type / 32;
                                 j = -1;
                                 if (page == n_pages)
-                                        return 0;
+                                        goto hwmon_register;
 
                                 MCDI_SET_DWORD(inbuf, SENSOR_INFO_EXT_IN_PAGE,
                                                page);
@@ -453,28 +438,22 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                 if (min1 != max1) {
                         snprintf(name, sizeof(name), "%s%u_input",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_value, i, type, 0);
-                        if (rc)
-                                goto fail;
 
                         if (hwmon_type != EFX_HWMON_POWER) {
                                 snprintf(name, sizeof(name), "%s%u_min",
                                          hwmon_prefix, hwmon_index);
-                                rc = efx_mcdi_mon_add_attr(
+                                efx_mcdi_mon_add_attr(
                                         efx, name, efx_mcdi_mon_show_limit,
                                         i, type, min1);
-                                if (rc)
-                                        goto fail;
                         }
 
                         snprintf(name, sizeof(name), "%s%u_max",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_limit,
                                 i, type, max1);
-                        if (rc)
-                                goto fail;
 
                         if (min2 != max2) {
                                 /* Assume max2 is critical value.
@@ -482,32 +461,38 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                                  */
                                 snprintf(name, sizeof(name), "%s%u_crit",
                                          hwmon_prefix, hwmon_index);
-                                rc = efx_mcdi_mon_add_attr(
+                                efx_mcdi_mon_add_attr(
                                         efx, name, efx_mcdi_mon_show_limit,
                                         i, type, max2);
-                                if (rc)
-                                        goto fail;
                         }
                 }
 
                 snprintf(name, sizeof(name), "%s%u_alarm",
                          hwmon_prefix, hwmon_index);
-                rc = efx_mcdi_mon_add_attr(
+                efx_mcdi_mon_add_attr(
                         efx, name, efx_mcdi_mon_show_alarm, i, type, 0);
-                if (rc)
-                        goto fail;
 
                 if (type < ARRAY_SIZE(efx_mcdi_sensor_type) &&
                     efx_mcdi_sensor_type[type].label) {
                         snprintf(name, sizeof(name), "%s%u_label",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_label, i, type, 0);
-                        if (rc)
-                                goto fail;
                 }
         }
 
+hwmon_register:
+        hwmon->groups[0] = &hwmon->group;
+        hwmon->device = hwmon_device_register_with_groups(&efx->pci_dev->dev,
+                                                          KBUILD_MODNAME, NULL,
+                                                          hwmon->groups);
+        if (IS_ERR(hwmon->device)) {
+                rc = PTR_ERR(hwmon->device);
+                goto fail;
+        }
+
+        return 0;
+
 fail:
         efx_mcdi_mon_remove(efx);
         return rc;
@@ -516,14 +501,11 @@ fail:
 void efx_mcdi_mon_remove(struct efx_nic *efx)
 {
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
-        unsigned int i;
 
-        for (i = 0; i < hwmon->n_attrs; i++)
-                device_remove_file(&efx->pci_dev->dev,
-                                   &hwmon->attrs[i].dev_attr);
-        kfree(hwmon->attrs);
         if (hwmon->device)
                 hwmon_device_unregister(hwmon->device);
+        kfree(hwmon->attrs);
+        kfree(hwmon->group.attrs);
         efx_nic_free_buffer(efx, &hwmon->dma_buf);
 }
 
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index b14a717ac3e8..542a0d252ae0 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -683,6 +683,8 @@ struct vfdi_status;
  * @n_channels: Number of channels in use
  * @n_rx_channels: Number of channels used for RX (= number of RX queues)
  * @n_tx_channels: Number of channels used for TX
+ * @rx_ip_align: RX DMA address offset to have IP header aligned in
+ *      in accordance with NET_IP_ALIGN
  * @rx_dma_len: Current maximum RX DMA length
  * @rx_buffer_order: Order (log2) of number of pages for each RX buffer
  * @rx_buffer_truesize: Amortised allocation size of an RX buffer,
@@ -816,6 +818,7 @@ struct efx_nic {
         unsigned rss_spread;
         unsigned tx_channel_offset;
         unsigned n_tx_channels;
+        unsigned int rx_ip_align;
         unsigned int rx_dma_len;
         unsigned int rx_buffer_order;
         unsigned int rx_buffer_truesize;
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 11b6112d9249..91c63ec79c5f 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -560,6 +560,8 @@ void efx_ptp_get_ts_info(struct efx_nic *efx, struct ethtool_ts_info *ts_info);
 bool efx_ptp_is_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
 int efx_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
 void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev);
+void efx_ptp_start_datapath(struct efx_nic *efx);
+void efx_ptp_stop_datapath(struct efx_nic *efx);
 
 extern const struct efx_nic_type falcon_a1_nic_type;
 extern const struct efx_nic_type falcon_b0_nic_type;
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index 03acf57df045..3dd39dcfe36b 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -220,6 +220,7 @@ struct efx_ptp_timeset {
  * @evt_list: List of MC receive events awaiting packets
  * @evt_free_list: List of free events
  * @evt_lock: Lock for manipulating evt_list and evt_free_list
+ * @evt_overflow: Boolean indicating that event list has overflowed
  * @rx_evts: Instantiated events (on evt_list and evt_free_list)
  * @workwq: Work queue for processing pending PTP operations
  * @work: Work task
@@ -270,6 +271,7 @@ struct efx_ptp_data {
         struct list_head evt_list;
         struct list_head evt_free_list;
         spinlock_t evt_lock;
+        bool evt_overflow;
         struct efx_ptp_event_rx rx_evts[MAX_RECEIVE_EVENTS];
         struct workqueue_struct *workwq;
         struct work_struct work;
@@ -635,6 +637,11 @@ static void efx_ptp_drop_time_expired_events(struct efx_nic *efx)
                         }
                 }
         }
+        /* If the event overflow flag is set and the event list is now empty
+         * clear the flag to re-enable the overflow warning message.
+         */
+        if (ptp->evt_overflow && list_empty(&ptp->evt_list))
+                ptp->evt_overflow = false;
         spin_unlock_bh(&ptp->evt_lock);
 }
 
@@ -676,6 +683,11 @@ static enum ptp_packet_state efx_ptp_match_rx(struct efx_nic *efx,
                         break;
                 }
         }
+        /* If the event overflow flag is set and the event list is now empty
+         * clear the flag to re-enable the overflow warning message.
+         */
+        if (ptp->evt_overflow && list_empty(&ptp->evt_list))
+                ptp->evt_overflow = false;
         spin_unlock_bh(&ptp->evt_lock);
 
         return rc;
@@ -705,8 +717,9 @@ static bool efx_ptp_process_events(struct efx_nic *efx, struct sk_buff_head *q)
                         __skb_queue_tail(q, skb);
                 } else if (time_after(jiffies, match->expiry)) {
                         match->state = PTP_PACKET_STATE_TIMED_OUT;
-                        netif_warn(efx, rx_err, efx->net_dev,
-                                   "PTP packet - no timestamp seen\n");
+                        if (net_ratelimit())
+                                netif_warn(efx, rx_err, efx->net_dev,
+                                           "PTP packet - no timestamp seen\n");
                         __skb_queue_tail(q, skb);
                 } else {
                         /* Replace unprocessed entry and stop */
@@ -788,9 +801,14 @@ fail:
 static int efx_ptp_stop(struct efx_nic *efx)
 {
         struct efx_ptp_data *ptp = efx->ptp_data;
-        int rc = efx_ptp_disable(efx);
         struct list_head *cursor;
         struct list_head *next;
+        int rc;
+
+        if (ptp == NULL)
+                return 0;
+
+        rc = efx_ptp_disable(efx);
 
         if (ptp->rxfilter_installed) {
                 efx_filter_remove_id_safe(efx, EFX_FILTER_PRI_REQUIRED,
@@ -809,11 +827,19 @@ static int efx_ptp_stop(struct efx_nic *efx)
         list_for_each_safe(cursor, next, &efx->ptp_data->evt_list) {
                 list_move(cursor, &efx->ptp_data->evt_free_list);
         }
+        ptp->evt_overflow = false;
         spin_unlock_bh(&efx->ptp_data->evt_lock);
 
         return rc;
 }
 
+static int efx_ptp_restart(struct efx_nic *efx)
+{
+        if (efx->ptp_data && efx->ptp_data->enabled)
+                return efx_ptp_start(efx);
+        return 0;
+}
+
 static void efx_ptp_pps_worker(struct work_struct *work)
 {
         struct efx_ptp_data *ptp =
@@ -901,6 +927,7 @@ static int efx_ptp_probe_channel(struct efx_channel *channel)
         spin_lock_init(&ptp->evt_lock);
         for (pos = 0; pos < MAX_RECEIVE_EVENTS; pos++)
                 list_add(&ptp->rx_evts[pos].link, &ptp->evt_free_list);
+        ptp->evt_overflow = false;
 
         ptp->phc_clock_info.owner = THIS_MODULE;
         snprintf(ptp->phc_clock_info.name,
@@ -989,7 +1016,11 @@ bool efx_ptp_is_ptp_tx(struct efx_nic *efx, struct sk_buff *skb)
                 skb->len >= PTP_MIN_LENGTH &&
                 skb->len <= MC_CMD_PTP_IN_TRANSMIT_PACKET_MAXNUM &&
                 likely(skb->protocol == htons(ETH_P_IP)) &&
+                skb_transport_header_was_set(skb) &&
+                skb_network_header_len(skb) >= sizeof(struct iphdr) &&
                 ip_hdr(skb)->protocol == IPPROTO_UDP &&
+                skb_headlen(skb) >=
+                skb_transport_offset(skb) + sizeof(struct udphdr) &&
                 udp_hdr(skb)->dest == htons(PTP_EVENT_PORT);
 }
 
@@ -1106,7 +1137,7 @@ static int efx_ptp_change_mode(struct efx_nic *efx, bool enable_wanted,
 {
         if ((enable_wanted != efx->ptp_data->enabled) ||
             (enable_wanted && (efx->ptp_data->mode != new_mode))) {
-                int rc;
+                int rc = 0;
 
                 if (enable_wanted) {
                         /* Change of mode requires disable */
@@ -1123,7 +1154,8 @@ static int efx_ptp_change_mode(struct efx_nic *efx, bool enable_wanted,
                          * succeed.
                          */
                         efx->ptp_data->mode = new_mode;
-                        rc = efx_ptp_start(efx);
+                        if (netif_running(efx->net_dev))
+                                rc = efx_ptp_start(efx);
                         if (rc == 0) {
                                 rc = efx_ptp_synchronize(efx,
                                                          PTP_SYNC_ATTEMPTS * 2);
@@ -1295,8 +1327,13 @@ static void ptp_event_rx(struct efx_nic *efx, struct efx_ptp_data *ptp)
                 list_add_tail(&evt->link, &ptp->evt_list);
 
                 queue_work(ptp->workwq, &ptp->work);
-        } else {
-                netif_err(efx, rx_err, efx->net_dev, "No free PTP event");
+        } else if (!ptp->evt_overflow) {
+                /* Log a warning message and set the event overflow flag.
+                 * The message won't be logged again until the event queue
+                 * becomes empty.
+                 */
+                netif_err(efx, rx_err, efx->net_dev, "PTP event queue overflow\n");
+                ptp->evt_overflow = true;
         }
         spin_unlock_bh(&ptp->evt_lock);
 }
@@ -1389,7 +1426,7 @@ static int efx_phc_adjfreq(struct ptp_clock_info *ptp, s32 delta)
         if (rc != 0)
                 return rc;
 
-        ptp_data->current_adjfreq = delta;
+        ptp_data->current_adjfreq = adjustment_ns;
         return 0;
 }
 
@@ -1404,7 +1441,7 @@ static int efx_phc_adjtime(struct ptp_clock_info *ptp, s64 delta)
 
         MCDI_SET_DWORD(inbuf, PTP_IN_OP, MC_CMD_PTP_OP_ADJUST);
         MCDI_SET_DWORD(inbuf, PTP_IN_PERIPH_ID, 0);
-        MCDI_SET_QWORD(inbuf, PTP_IN_ADJUST_FREQ, 0);
+        MCDI_SET_QWORD(inbuf, PTP_IN_ADJUST_FREQ, ptp_data->current_adjfreq);
         MCDI_SET_DWORD(inbuf, PTP_IN_ADJUST_SECONDS, (u32)delta_ts.tv_sec);
         MCDI_SET_DWORD(inbuf, PTP_IN_ADJUST_NANOSECONDS, (u32)delta_ts.tv_nsec);
         return efx_mcdi_rpc(efx, MC_CMD_PTP, inbuf, sizeof(inbuf),
@@ -1491,3 +1528,14 @@ void efx_ptp_probe(struct efx_nic *efx)
                 efx->extra_channel_type[EFX_EXTRA_CHANNEL_PTP] =
                         &efx_ptp_channel_type;
 }
+
+void efx_ptp_start_datapath(struct efx_nic *efx)
+{
+        if (efx_ptp_restart(efx))
+                netif_err(efx, drv, efx->net_dev, "Failed to restart PTP.\n");
+}
+
+void efx_ptp_stop_datapath(struct efx_nic *efx)
+{
+        efx_ptp_stop(efx);
+}
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 8f09e686fc23..42488df1f4ec 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -94,7 +94,7 @@ static inline void efx_sync_rx_buffer(struct efx_nic *efx,
 
 void efx_rx_config_page_split(struct efx_nic *efx)
 {
-        efx->rx_page_buf_step = ALIGN(efx->rx_dma_len + NET_IP_ALIGN,
+        efx->rx_page_buf_step = ALIGN(efx->rx_dma_len + efx->rx_ip_align,
                                       EFX_RX_BUF_ALIGNMENT);
         efx->rx_bufs_per_page = efx->rx_buffer_order ? 1 :
                 ((PAGE_SIZE - sizeof(struct efx_rx_page_state)) /
@@ -189,9 +189,9 @@ static int efx_init_rx_buffers(struct efx_rx_queue *rx_queue)
                 do {
                         index = rx_queue->added_count & rx_queue->ptr_mask;
                         rx_buf = efx_rx_buffer(rx_queue, index);
-                        rx_buf->dma_addr = dma_addr + NET_IP_ALIGN;
+                        rx_buf->dma_addr = dma_addr + efx->rx_ip_align;
                         rx_buf->page = page;
-                        rx_buf->page_offset = page_offset + NET_IP_ALIGN;
+                        rx_buf->page_offset = page_offset + efx->rx_ip_align;
                         rx_buf->len = efx->rx_dma_len;
                         rx_buf->flags = 0;
                         ++rx_queue->added_count;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 0c9b5d94154f..8bf29eb4a5a0 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -82,6 +82,7 @@ static const char version[] =
 #include <linux/mii.h>
 #include <linux/workqueue.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -2184,6 +2185,15 @@ static void smc_release_datacs(struct platform_device *pdev, struct net_device *
         }
 }
 
+#if IS_BUILTIN(CONFIG_OF)
+static const struct of_device_id smc91x_match[] = {
+        { .compatible = "smsc,lan91c94", },
+        { .compatible = "smsc,lan91c111", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, smc91x_match);
+#endif
+
 /*
  * smc_init(void)
  *   Input parameters:
@@ -2198,6 +2208,7 @@ static void smc_release_datacs(struct platform_device *pdev, struct net_device *
 static int smc_drv_probe(struct platform_device *pdev)
 {
         struct smc91x_platdata *pd = dev_get_platdata(&pdev->dev);
+        const struct of_device_id *match = NULL;
         struct smc_local *lp;
         struct net_device *ndev;
         struct resource *res, *ires;
@@ -2217,11 +2228,34 @@ static int smc_drv_probe(struct platform_device *pdev)
          */
 
         lp = netdev_priv(ndev);
+        lp->cfg.flags = 0;
 
         if (pd) {
                 memcpy(&lp->cfg, pd, sizeof(lp->cfg));
                 lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags);
-        } else {
+        }
+
+#if IS_BUILTIN(CONFIG_OF)
+        match = of_match_device(of_match_ptr(smc91x_match), &pdev->dev);
+        if (match) {
+                struct device_node *np = pdev->dev.of_node;
+                u32 val;
+
+                /* Combination of IO widths supported, default to 16-bit */
+                if (!of_property_read_u32(np, "reg-io-width", &val)) {
+                        if (val & 1)
+                                lp->cfg.flags |= SMC91X_USE_8BIT;
+                        if ((val == 0) || (val & 2))
+                                lp->cfg.flags |= SMC91X_USE_16BIT;
+                        if (val & 4)
+                                lp->cfg.flags |= SMC91X_USE_32BIT;
+                } else {
+                        lp->cfg.flags |= SMC91X_USE_16BIT;
+                }
+        }
+#endif
+
+        if (!pd && !match) {
                 lp->cfg.flags |= (SMC_CAN_USE_8BIT)  ? SMC91X_USE_8BIT  : 0;
                 lp->cfg.flags |= (SMC_CAN_USE_16BIT) ? SMC91X_USE_16BIT : 0;
                 lp->cfg.flags |= (SMC_CAN_USE_32BIT) ? SMC91X_USE_32BIT : 0;
@@ -2370,15 +2404,6 @@ static int smc_drv_resume(struct device *dev)
         return 0;
 }
 
-#ifdef CONFIG_OF
-static const struct of_device_id smc91x_match[] = {
-        { .compatible = "smsc,lan91c94", },
-        { .compatible = "smsc,lan91c111", },
-        {},
-};
-MODULE_DEVICE_TABLE(of, smc91x_match);
-#endif
-
 static struct dev_pm_ops smc_drv_pm_ops = {
         .suspend        = smc_drv_suspend,
         .resume         = smc_drv_resume,
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index c9d4c872e81d..749654b976bc 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -46,7 +46,8 @@
     defined(CONFIG_MACH_LITTLETON) ||\
     defined(CONFIG_MACH_ZYLONITE2) ||\
     defined(CONFIG_ARCH_VIPER) ||\
-    defined(CONFIG_MACH_STARGATE2)
+    defined(CONFIG_MACH_STARGATE2) ||\
+    defined(CONFIG_ARCH_VERSATILE)
 
 #include <asm/mach-types.h>
 
@@ -154,6 +155,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outl(v, a, r)       writel(v, (a) + (r))
 #define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
 #define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
+#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
 /* We actually can't write halfwords properly if not word aligned */
@@ -206,23 +209,6 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define RPC_LSA_DEFAULT         RPC_LED_TX_RX
 #define RPC_LSB_DEFAULT         RPC_LED_100_10
 
-#elif   defined(CONFIG_ARCH_VERSATILE)
-
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       1
-#define SMC_NOWAIT              1
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_inl(a, r)           readl((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_outl(v, a, r)       writel(v, (a) + (r))
-#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
-#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
-#define SMC_IRQ_FLAGS           (-1)    /* from resource */
-
 #elif defined(CONFIG_MN10300)
 
 /*
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index dd0dd6279b4e..4f1d2549130e 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -2019,7 +2019,6 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 ndev->features = NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_TSO
                     | NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX |
                     NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_RXCSUM
-                    /*| NETIF_F_FRAGLIST */
                     ;
                 ndev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
                         NETIF_F_TSO | NETIF_F_HW_VLAN_CTAG_TX;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 7536a4c01293..5120d9ce1dd4 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1151,6 +1151,12 @@ static int cpsw_ndo_open(struct net_device *ndev)
                  * receive descs
                  */
                 cpsw_info(priv, ifup, "submitted %d rx descriptors\n", i);
+
+                if (cpts_register(&priv->pdev->dev, priv->cpts,
+                                  priv->data.cpts_clock_mult,
+                                  priv->data.cpts_clock_shift))
+                        dev_err(priv->dev, "error registering cpts device\n");
+
         }
 
         /* Enable Interrupt pacing if configured */
@@ -1197,6 +1203,7 @@ static int cpsw_ndo_stop(struct net_device *ndev)
         netif_carrier_off(priv->ndev);
 
         if (cpsw_common_res_usage_state(priv) <= 1) {
+                cpts_unregister(priv->cpts);
                 cpsw_intr_disable(priv);
                 cpdma_ctlr_int_ctrl(priv->dma, false);
                 cpdma_ctlr_stop(priv->dma);
@@ -1816,6 +1823,8 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 }
 
                 i++;
+                if (i == data->slaves)
+                        break;
         }
 
         return 0;
@@ -1983,9 +1992,15 @@ static int cpsw_probe(struct platform_device *pdev)
                 goto clean_runtime_disable_ret;
         }
         priv->regs = ss_regs;
-        priv->version = __raw_readl(&priv->regs->id_ver);
         priv->host_port = HOST_PORT_NUM;
 
+        /* Need to enable clocks with runtime PM api to access module
+         * registers
+         */
+        pm_runtime_get_sync(&pdev->dev);
+        priv->version = readl(&priv->regs->id_ver);
+        pm_runtime_put_sync(&pdev->dev);
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         priv->wr_regs = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(priv->wr_regs)) {
@@ -2155,8 +2170,6 @@ static int cpsw_remove(struct platform_device *pdev)
                 unregister_netdev(cpsw_get_slave_ndev(priv, 1));
         unregister_netdev(ndev);
 
-        cpts_unregister(priv->cpts);
-
         cpsw_ale_destroy(priv->ale);
         cpdma_chan_destroy(priv->txch);
         cpdma_chan_destroy(priv->rxch);
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 41ba974bf37c..cd9b164a0434 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -61,6 +61,7 @@
 #include <linux/davinci_emac.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_device.h>
 #include <linux/of_irq.h>
 #include <linux/of_net.h>
 
@@ -1752,10 +1753,14 @@ static const struct net_device_ops emac_netdev_ops = {
 #endif
 };
 
+static const struct of_device_id davinci_emac_of_match[];
+
 static struct emac_platform_data *
 davinci_emac_of_get_pdata(struct platform_device *pdev, struct emac_priv *priv)
 {
         struct device_node *np;
+        const struct of_device_id *match;
+        const struct emac_platform_data *auxdata;
         struct emac_platform_data *pdata = NULL;
         const u8 *mac_addr;
 
@@ -1793,7 +1798,20 @@ davinci_emac_of_get_pdata(struct platform_device *pdev, struct emac_priv *priv)
 
         priv->phy_node = of_parse_phandle(np, "phy-handle", 0);
         if (!priv->phy_node)
-                pdata->phy_id = "";
+                pdata->phy_id = NULL;
+
+        auxdata = pdev->dev.platform_data;
+        if (auxdata) {
+                pdata->interrupt_enable = auxdata->interrupt_enable;
+                pdata->interrupt_disable = auxdata->interrupt_disable;
+        }
+
+        match = of_match_device(davinci_emac_of_match, &pdev->dev);
+        if (match && match->data) {
+                auxdata = match->data;
+                pdata->version = auxdata->version;
+                pdata->hw_ram_addr = auxdata->hw_ram_addr;
+        }
 
         pdev->dev.platform_data = pdata;
 
@@ -2020,8 +2038,14 @@ static const struct dev_pm_ops davinci_emac_pm_ops = {
 };
 
 #if IS_ENABLED(CONFIG_OF)
+static const struct emac_platform_data am3517_emac_data = {
+        .version                = EMAC_VERSION_2,
+        .hw_ram_addr            = 0x01e20000,
+};
+
 static const struct of_device_id davinci_emac_of_match[] = {
         {.compatible = "ti,davinci-dm6467-emac", },
+        {.compatible = "ti,am3517-emac", .data = &am3517_emac_data, },
         {},
 };
 MODULE_DEVICE_TABLE(of, davinci_emac_of_match);
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index d022bf936572..ad61d26a44f3 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -2172,16 +2172,13 @@ static int velocity_poll(struct napi_struct *napi, int budget)
         unsigned int rx_done;
         unsigned long flags;
 
-        spin_lock_irqsave(&vptr->lock, flags);
         /*
          * Do rx and tx twice for performance (taken from the VIA
          * out-of-tree driver).
          */
-        rx_done = velocity_rx_srv(vptr, budget / 2);
-        velocity_tx_srv(vptr);
-        rx_done += velocity_rx_srv(vptr, budget - rx_done);
+        rx_done = velocity_rx_srv(vptr, budget);
+        spin_lock_irqsave(&vptr->lock, flags);
         velocity_tx_srv(vptr);
-
         /* If budget not fully consumed, exit the polling mode */
         if (rx_done < budget) {
                 napi_complete(napi);
@@ -2342,6 +2339,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
                 if (ret < 0)
                         goto out_free_tmp_vptr_1;
 
+                napi_disable(&vptr->napi);
+
                 spin_lock_irqsave(&vptr->lock, flags);
 
                 netif_stop_queue(dev);
@@ -2362,6 +2361,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
 
                 velocity_give_many_rx_descs(vptr);
 
+                napi_enable(&vptr->napi);
+
                 mac_enable_int(vptr->mac_regs);
                 netif_start_queue(dev);
 
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 1f2364126323..2166e879a096 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1017,7 +1017,7 @@ static int temac_of_probe(struct platform_device *op)
         platform_set_drvdata(op, ndev);
         SET_NETDEV_DEV(ndev, &op->dev);
         ndev->flags &= ~IFF_MULTICAST;  /* clear multicast */
-        ndev->features = NETIF_F_SG | NETIF_F_FRAGLIST;
+        ndev->features = NETIF_F_SG;
         ndev->netdev_ops = &temac_netdev_ops;
         ndev->ethtool_ops = &temac_ethtool_ops;
 #if 0
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index b2ff038d6d20..f9293da19e26 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1486,7 +1486,7 @@ static int axienet_of_probe(struct platform_device *op)
 
         SET_NETDEV_DEV(ndev, &op->dev);
         ndev->flags &= ~IFF_MULTICAST;  /* clear multicast */
-        ndev->features = NETIF_F_SG | NETIF_F_FRAGLIST;
+        ndev->features = NETIF_F_SG;
         ndev->netdev_ops = &axienet_netdev_ops;
         ndev->ethtool_ops = &axienet_ethtool_ops;
 
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 74234a51c851..fefb8cd5eb65 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -163,26 +163,9 @@ static void xemaclite_enable_interrupts(struct net_local *drvdata)
         __raw_writel(reg_data | XEL_TSR_XMIT_IE_MASK,
                      drvdata->base_addr + XEL_TSR_OFFSET);
 
-        /* Enable the Tx interrupts for the second Buffer if
-         * configured in HW */
-        if (drvdata->tx_ping_pong != 0) {
-                reg_data = __raw_readl(drvdata->base_addr +
-                                   XEL_BUFFER_OFFSET + XEL_TSR_OFFSET);
-                __raw_writel(reg_data | XEL_TSR_XMIT_IE_MASK,
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_TSR_OFFSET);
-        }
-
         /* Enable the Rx interrupts for the first buffer */
         __raw_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr + XEL_RSR_OFFSET);
 
-        /* Enable the Rx interrupts for the second Buffer if
-         * configured in HW */
-        if (drvdata->rx_ping_pong != 0) {
-                __raw_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr +
-                             XEL_BUFFER_OFFSET + XEL_RSR_OFFSET);
-        }
-
         /* Enable the Global Interrupt Enable */
         __raw_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET);
 }
@@ -206,31 +189,10 @@ static void xemaclite_disable_interrupts(struct net_local *drvdata)
         __raw_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK),
                      drvdata->base_addr + XEL_TSR_OFFSET);
 
-        /* Disable the Tx interrupts for the second Buffer
-         * if configured in HW */
-        if (drvdata->tx_ping_pong != 0) {
-                reg_data = __raw_readl(drvdata->base_addr + XEL_BUFFER_OFFSET +
-                                   XEL_TSR_OFFSET);
-                __raw_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK),
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_TSR_OFFSET);
-        }
-
         /* Disable the Rx interrupts for the first buffer */
         reg_data = __raw_readl(drvdata->base_addr + XEL_RSR_OFFSET);
         __raw_writel(reg_data & (~XEL_RSR_RECV_IE_MASK),
                      drvdata->base_addr + XEL_RSR_OFFSET);
-
-        /* Disable the Rx interrupts for the second buffer
-         * if configured in HW */
-        if (drvdata->rx_ping_pong != 0) {
-
-                reg_data = __raw_readl(drvdata->base_addr + XEL_BUFFER_OFFSET +
-                                   XEL_RSR_OFFSET);
-                __raw_writel(reg_data & (~XEL_RSR_RECV_IE_MASK),
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_RSR_OFFSET);
-        }
 }
 
 /**
@@ -258,6 +220,13 @@ static void xemaclite_aligned_write(void *src_ptr, u32 *dest_ptr,
                 *to_u16_ptr++ = *from_u16_ptr++;
                 *to_u16_ptr++ = *from_u16_ptr++;
 
+                /* This barrier resolves occasional issues seen around
+                 * cases where the data is not properly flushed out
+                 * from the processor store buffers to the destination
+                 * memory locations.
+                 */
+                wmb();
+
                 /* Output a word */
                 *to_u32_ptr++ = align_buffer;
         }
@@ -273,6 +242,12 @@ static void xemaclite_aligned_write(void *src_ptr, u32 *dest_ptr,
                 for (; length > 0; length--)
                         *to_u8_ptr++ = *from_u8_ptr++;
 
+                /* This barrier resolves occasional issues seen around
+                 * cases where the data is not properly flushed out
+                 * from the processor store buffers to the destination
+                 * memory locations.
+                 */
+                wmb();
                 *to_u32_ptr = align_buffer;
         }
 }
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index dc76670c2f2a..2a89da080317 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -744,7 +744,7 @@ err:
         rcu_read_lock();
         vlan = rcu_dereference(q->vlan);
         if (vlan)
-                vlan->dev->stats.tx_dropped++;
+                this_cpu_inc(vlan->pcpu_stats->tx_dropped);
         rcu_read_unlock();
 
         return err;
@@ -767,11 +767,10 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                                 const struct sk_buff *skb,
                                 const struct iovec *iv, int len)
 {
-        struct macvlan_dev *vlan;
         int ret;
         int vnet_hdr_len = 0;
         int vlan_offset = 0;
-        int copied;
+        int copied, total;
 
         if (q->flags & IFF_VNET_HDR) {
                 struct virtio_net_hdr vnet_hdr;
@@ -786,7 +785,8 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                 if (memcpy_toiovecend(iv, (void *)&vnet_hdr, 0, sizeof(vnet_hdr)))
                         return -EFAULT;
         }
-        copied = vnet_hdr_len;
+        total = copied = vnet_hdr_len;
+        total += skb->len;
 
         if (!vlan_tx_tag_present(skb))
                 len = min_t(int, skb->len, len);
@@ -801,6 +801,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 
                 vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
                 len = min_t(int, skb->len + VLAN_HLEN, len);
+                total += VLAN_HLEN;
 
                 copy = min_t(int, vlan_offset, len);
                 ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
@@ -818,19 +819,9 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
         }
 
         ret = skb_copy_datagram_const_iovec(skb, vlan_offset, iv, copied, len);
-        copied += len;
 
 done:
-        rcu_read_lock();
-        vlan = rcu_dereference(q->vlan);
-        if (vlan) {
-                preempt_disable();
-                macvlan_count_rx(vlan, copied - vnet_hdr_len, ret == 0, 0);
-                preempt_enable();
-        }
-        rcu_read_unlock();
-
-        return ret ? ret : copied;
+        return ret ? ret : total;
 }
 
 static ssize_t macvtap_do_read(struct macvtap_queue *q, struct kiocb *iocb,
@@ -885,7 +876,9 @@ static ssize_t macvtap_aio_read(struct kiocb *iocb, const struct iovec *iv,
         }
 
         ret = macvtap_do_read(q, iocb, iv, len, file->f_flags & O_NONBLOCK);
-        ret = min_t(ssize_t, ret, len); /* XXX copied from tun.c. Why? */
+        ret = min_t(ssize_t, ret, len);
+        if (ret > 0)
+                iocb->ki_pos = ret;
 out:
         return ret;
 }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 3ae28f420868..26fa05a472b4 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -336,6 +336,21 @@ static struct phy_driver ksphy_driver[] = {
         .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_KSZ8041RNLI,
+        .phy_id_mask    = 0x00fffff0,
+        .name           = "Micrel KSZ8041RNLI",
+        .features       = PHY_BASIC_FEATURES |
+                          SUPPORTED_Pause | SUPPORTED_Asym_Pause,
+        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = kszphy_ack_interrupt,
+        .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         .phy_id         = PHY_ID_KSZ8051,
         .phy_id_mask    = 0x00fffff0,
         .name           = "Micrel KSZ8051",
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 508e4359338b..14372c65a7e8 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -64,6 +64,7 @@
 
 #define PHY_ID_VSC8234                  0x000fc620
 #define PHY_ID_VSC8244                  0x000fc6c0
+#define PHY_ID_VSC8514                  0x00070670
 #define PHY_ID_VSC8574                  0x000704a0
 #define PHY_ID_VSC8662                  0x00070660
 #define PHY_ID_VSC8221                  0x000fc550
@@ -131,6 +132,7 @@ static int vsc82xx_config_intr(struct phy_device *phydev)
                 err = phy_write(phydev, MII_VSC8244_IMASK,
                         (phydev->drv->phy_id == PHY_ID_VSC8234 ||
                          phydev->drv->phy_id == PHY_ID_VSC8244 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8514 ||
                          phydev->drv->phy_id == PHY_ID_VSC8574) ?
                                 MII_VSC8244_IMASK_MASK :
                                 MII_VSC8221_IMASK_MASK);
@@ -246,6 +248,18 @@ static struct phy_driver vsc82xx_driver[] = {
         .config_intr    = &vsc82xx_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_VSC8514,
+        .name           = "Vitesse VSC8514",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         .phy_id         = PHY_ID_VSC8574,
         .name           = "Vitesse VSC8574",
         .phy_id_mask    = 0x000ffff0,
@@ -315,6 +329,7 @@ module_exit(vsc82xx_exit);
 static struct mdio_device_id __maybe_unused vitesse_tbl[] = {
         { PHY_ID_VSC8234, 0x000ffff0 },
         { PHY_ID_VSC8244, 0x000fffc0 },
+        { PHY_ID_VSC8514, 0x000ffff0 },
         { PHY_ID_VSC8574, 0x000ffff0 },
         { PHY_ID_VSC8662, 0x000ffff0 },
         { PHY_ID_VSC8221, 0x000ffff0 },
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 34b0de09d881..736050d6b451 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1366,6 +1366,8 @@ static int team_user_linkup_option_get(struct team *team,
         return 0;
 }
 
+static void __team_carrier_check(struct team *team);
+
 static int team_user_linkup_option_set(struct team *team,
                                        struct team_gsetter_ctx *ctx)
 {
@@ -1373,6 +1375,7 @@ static int team_user_linkup_option_set(struct team *team,
 
         port->user.linkup = ctx->data.bool_val;
         team_refresh_port_linkup(port);
+        __team_carrier_check(port->team);
         return 0;
 }
 
@@ -1392,6 +1395,7 @@ static int team_user_linkup_en_option_set(struct team *team,
 
         port->user.linkup_enabled = ctx->data.bool_val;
         team_refresh_port_linkup(port);
+        __team_carrier_check(port->team);
         return 0;
 }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 782e38bfc1ee..7c8343a4f918 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1184,7 +1184,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 {
         struct tun_pi pi = { 0, skb->protocol };
         ssize_t total = 0;
-        int vlan_offset = 0;
+        int vlan_offset = 0, copied;
 
         if (!(tun->flags & TUN_NO_PI)) {
                 if ((len -= sizeof(pi)) < 0)
@@ -1248,6 +1248,8 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 total += tun->vnet_hdr_sz;
         }
 
+        copied = total;
+        total += skb->len;
         if (!vlan_tx_tag_present(skb)) {
                 len = min_t(int, skb->len, len);
         } else {
@@ -1262,24 +1264,24 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 
                 vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
                 len = min_t(int, skb->len + VLAN_HLEN, len);
+                total += VLAN_HLEN;
 
                 copy = min_t(int, vlan_offset, len);
-                ret = skb_copy_datagram_const_iovec(skb, 0, iv, total, copy);
+                ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
                 len -= copy;
-                total += copy;
+                copied += copy;
                 if (ret || !len)
                         goto done;
 
                 copy = min_t(int, sizeof(veth), len);
-                ret = memcpy_toiovecend(iv, (void *)&veth, total, copy);
+                ret = memcpy_toiovecend(iv, (void *)&veth, copied, copy);
                 len -= copy;
-                total += copy;
+                copied += copy;
                 if (ret || !len)
                         goto done;
         }
 
-        skb_copy_datagram_const_iovec(skb, vlan_offset, iv, total, len);
-        total += len;
+        skb_copy_datagram_const_iovec(skb, vlan_offset, iv, copied, len);
 
 done:
         tun->dev->stats.tx_packets++;
@@ -1356,6 +1358,8 @@ static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
         ret = tun_do_read(tun, tfile, iocb, iv, len,
                           file->f_flags & O_NONBLOCK);
         ret = min_t(ssize_t, ret, len);
+        if (ret > 0)
+                iocb->ki_pos = ret;
 out:
         tun_put(tun);
         return ret;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7bab4de658a9..d208f8604981 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -299,35 +299,76 @@ static struct sk_buff *page_to_skb(struct receive_queue *rq,
         return skb;
 }
 
-static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
+static struct sk_buff *receive_small(void *buf, unsigned int len)
 {
-        struct skb_vnet_hdr *hdr = skb_vnet_hdr(head_skb);
+        struct sk_buff * skb = buf;
+
+        len -= sizeof(struct virtio_net_hdr);
+        skb_trim(skb, len);
+
+        return skb;
+}
+
+static struct sk_buff *receive_big(struct net_device *dev,
+                                   struct receive_queue *rq,
+                                   void *buf,
+                                   unsigned int len)
+{
+        struct page *page = buf;
+        struct sk_buff *skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
+
+        if (unlikely(!skb))
+                goto err;
+
+        return skb;
+
+err:
+        dev->stats.rx_dropped++;
+        give_pages(rq, page);
+        return NULL;
+}
+
+static struct sk_buff *receive_mergeable(struct net_device *dev,
+                                         struct receive_queue *rq,
+                                         void *buf,
+                                         unsigned int len)
+{
+        struct skb_vnet_hdr *hdr = buf;
+        int num_buf = hdr->mhdr.num_buffers;
+        struct page *page = virt_to_head_page(buf);
+        int offset = buf - page_address(page);
+        struct sk_buff *head_skb = page_to_skb(rq, page, offset, len,
+                                               MERGE_BUFFER_LEN);
         struct sk_buff *curr_skb = head_skb;
-        char *buf;
-        struct page *page;
-        int num_buf, len, offset;
 
-        num_buf = hdr->mhdr.num_buffers;
+        if (unlikely(!curr_skb))
+                goto err_skb;
+
         while (--num_buf) {
-                int num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
+                int num_skb_frags;
+
                 buf = virtqueue_get_buf(rq->vq, &len);
                 if (unlikely(!buf)) {
-                        pr_debug("%s: rx error: %d buffers missing\n",
-                                 head_skb->dev->name, hdr->mhdr.num_buffers);
-                        head_skb->dev->stats.rx_length_errors++;
-                        return -EINVAL;
+                        pr_debug("%s: rx error: %d buffers out of %d missing\n",
+                                 dev->name, num_buf, hdr->mhdr.num_buffers);
+                        dev->stats.rx_length_errors++;
+                        goto err_buf;
                 }
                 if (unlikely(len > MERGE_BUFFER_LEN)) {
                         pr_debug("%s: rx error: merge buffer too long\n",
-                                 head_skb->dev->name);
+                                 dev->name);
                         len = MERGE_BUFFER_LEN;
                 }
+
+                page = virt_to_head_page(buf);
+                --rq->num;
+
+                num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
                 if (unlikely(num_skb_frags == MAX_SKB_FRAGS)) {
                         struct sk_buff *nskb = alloc_skb(0, GFP_ATOMIC);
-                        if (unlikely(!nskb)) {
-                                head_skb->dev->stats.rx_dropped++;
-                                return -ENOMEM;
-                        }
+
+                        if (unlikely(!nskb))
+                                goto err_skb;
                         if (curr_skb == head_skb)
                                 skb_shinfo(curr_skb)->frag_list = nskb;
                         else
@@ -341,8 +382,7 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                         head_skb->len += len;
                         head_skb->truesize += MERGE_BUFFER_LEN;
                 }
-                page = virt_to_head_page(buf);
-                offset = buf - (char *)page_address(page);
+                offset = buf - page_address(page);
                 if (skb_can_coalesce(curr_skb, num_skb_frags, page, offset)) {
                         put_page(page);
                         skb_coalesce_rx_frag(curr_skb, num_skb_frags - 1,
@@ -351,9 +391,28 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                         skb_add_rx_frag(curr_skb, num_skb_frags, page,
                                         offset, len, MERGE_BUFFER_LEN);
                 }
+        }
+
+        return head_skb;
+
+err_skb:
+        put_page(page);
+        while (--num_buf) {
+                buf = virtqueue_get_buf(rq->vq, &len);
+                if (unlikely(!buf)) {
+                        pr_debug("%s: rx error: %d buffers missing\n",
+                                 dev->name, num_buf);
+                        dev->stats.rx_length_errors++;
+                        break;
+                }
+                page = virt_to_head_page(buf);
+                put_page(page);
                 --rq->num;
         }
-        return 0;
+err_buf:
+        dev->stats.rx_dropped++;
+        dev_kfree_skb(head_skb);
+        return NULL;
 }
 
 static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
@@ -362,48 +421,29 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
         struct net_device *dev = vi->dev;
         struct virtnet_stats *stats = this_cpu_ptr(vi->stats);
         struct sk_buff *skb;
-        struct page *page;
         struct skb_vnet_hdr *hdr;
 
         if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
                 pr_debug("%s: short packet %i\n", dev->name, len);
                 dev->stats.rx_length_errors++;
-                if (vi->big_packets)
-                        give_pages(rq, buf);
-                else if (vi->mergeable_rx_bufs)
+                if (vi->mergeable_rx_bufs)
                         put_page(virt_to_head_page(buf));
+                else if (vi->big_packets)
+                        give_pages(rq, buf);
                 else
                         dev_kfree_skb(buf);
                 return;
         }
 
-        if (!vi->mergeable_rx_bufs && !vi->big_packets) {
-                skb = buf;
-                len -= sizeof(struct virtio_net_hdr);
-                skb_trim(skb, len);
-        } else if (vi->mergeable_rx_bufs) {
-                struct page *page = virt_to_head_page(buf);
-                skb = page_to_skb(rq, page,
-                                  (char *)buf - (char *)page_address(page),
-                                  len, MERGE_BUFFER_LEN);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        put_page(page);
-                        return;
-                }
-                if (receive_mergeable(rq, skb)) {
-                        dev_kfree_skb(skb);
-                        return;
-                }
-        } else {
-                page = buf;
-                skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        give_pages(rq, page);
-                        return;
-                }
-        }
+        if (vi->mergeable_rx_bufs)
+                skb = receive_mergeable(dev, rq, buf, len);
+        else if (vi->big_packets)
+                skb = receive_big(dev, rq, buf, len);
+        else
+                skb = receive_small(buf, len);
+
+        if (unlikely(!skb))
+                return;
 
         hdr = skb_vnet_hdr(skb);
 
@@ -1084,7 +1124,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
                                   VIRTIO_NET_CTRL_MAC_TABLE_SET,
                                   sg, NULL))
-                dev_warn(&dev->dev, "Failed to set MAC fitler table.\n");
+                dev_warn(&dev->dev, "Failed to set MAC filter table.\n");
 
         kfree(buf);
 }
@@ -1327,6 +1367,11 @@ static void virtnet_config_changed(struct virtio_device *vdev)
 
 static void virtnet_free_queues(struct virtnet_info *vi)
 {
+        int i;
+
+        for (i = 0; i < vi->max_queue_pairs; i++)
+                netif_napi_del(&vi->rq[i].napi);
+
         kfree(vi->rq);
         kfree(vi->sq);
 }
@@ -1356,10 +1401,10 @@ static void free_unused_bufs(struct virtnet_info *vi)
                 struct virtqueue *vq = vi->rq[i].vq;
 
                 while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
-                        if (vi->big_packets)
-                                give_pages(&vi->rq[i], buf);
-                        else if (vi->mergeable_rx_bufs)
+                        if (vi->mergeable_rx_bufs)
                                 put_page(virt_to_head_page(buf));
+                        else if (vi->big_packets)
+                                give_pages(&vi->rq[i], buf);
                         else
                                 dev_kfree_skb(buf);
                         --vi->rq[i].num;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 0358c07f7669..249e01c5600c 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1668,7 +1668,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         netdev_dbg(dev, "circular route to %pI4\n",
                                    &dst->sin.sin_addr.s_addr);
                         dev->stats.collisions++;
-                        goto tx_error;
+                        goto rt_tx_error;
                 }
 
                 /* Bypass encapsulation if the destination is local */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 1ec52356b5a1..130657db5c43 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3984,18 +3984,20 @@ static void ar9003_hw_quick_drop_apply(struct ath_hw *ah, u16 freq)
         int quick_drop;
         s32 t[3], f[3] = {5180, 5500, 5785};
 
-        if (!(pBase->miscConfiguration & BIT(1)))
+        if (!(pBase->miscConfiguration & BIT(4)))
                 return;
 
-        if (freq < 4000)
-                quick_drop = eep->modalHeader2G.quick_drop;
-        else {
-                t[0] = eep->base_ext1.quick_drop_low;
-                t[1] = eep->modalHeader5G.quick_drop;
-                t[2] = eep->base_ext1.quick_drop_high;
-                quick_drop = ar9003_hw_power_interpolate(freq, f, t, 3);
+        if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9340(ah)) {
+                if (freq < 4000) {
+                        quick_drop = eep->modalHeader2G.quick_drop;
+                } else {
+                        t[0] = eep->base_ext1.quick_drop_low;
+                        t[1] = eep->modalHeader5G.quick_drop;
+                        t[2] = eep->base_ext1.quick_drop_high;
+                        quick_drop = ar9003_hw_power_interpolate(freq, f, t, 3);
+                }
+                REG_RMW_FIELD(ah, AR_PHY_AGC, AR_PHY_AGC_QUICK_DROP, quick_drop);
         }
-        REG_RMW_FIELD(ah, AR_PHY_AGC, AR_PHY_AGC_QUICK_DROP, quick_drop);
 }
 
 static void ar9003_hw_txend_to_xpa_off_apply(struct ath_hw *ah, bool is2ghz)
@@ -4035,7 +4037,7 @@ static void ar9003_hw_xlna_bias_strength_apply(struct ath_hw *ah, bool is2ghz)
         struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
         u8 bias;
 
-        if (!(eep->baseEepHeader.featureEnable & 0x40))
+        if (!(eep->baseEepHeader.miscConfiguration & 0x40))
                 return;
 
         if (!AR_SREV_9300(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 54b04155e43b..8918035da3a3 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -146,10 +146,9 @@ static void ath9k_hw_set_clockrate(struct ath_hw *ah)
         else
                 clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
 
-        if (IS_CHAN_HT40(chan))
-                clockrate *= 2;
-
-        if (ah->curchan) {
+        if (chan) {
+                if (IS_CHAN_HT40(chan))
+                        clockrate *= 2;
                 if (IS_CHAN_HALF_RATE(chan))
                         clockrate /= 2;
                 if (IS_CHAN_QUARTER_RATE(chan))
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 09cdbcd09739..b5a19e098f2d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1276,6 +1276,10 @@ static void ath_tx_fill_desc(struct ath_softc *sc, struct ath_buf *bf,
                                 if (!rts_thresh || (len > rts_thresh))
                                         rts = true;
                         }
+
+                        if (!aggr)
+                                len = fi->framelen;
+
                         ath_buf_set_rate(sc, bf, &info, len, rts);
                 }
 
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index de9eb2cfbf4b..366339421d4f 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2041,13 +2041,20 @@ static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
         case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
                 mutex_lock(&wcn->hal_ind_mutex);
                 msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
-                msg_ind->msg_len = len;
-                msg_ind->msg = kmalloc(len, GFP_KERNEL);
-                memcpy(msg_ind->msg, buf, len);
-                list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
-                queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
-                wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                if (msg_ind) {
+                        msg_ind->msg_len = len;
+                        msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                        memcpy(msg_ind->msg, buf, len);
+                        list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
+                        queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                }
                 mutex_unlock(&wcn->hal_ind_mutex);
+                if (msg_ind)
+                        break;
+                /* FIXME: Do something smarter then just printing an error. */
+                wcn36xx_err("Run out of memory while handling SMD_EVENT (%d)\n",
+                            msg_header->msg_type);
                 break;
         default:
                 wcn36xx_err("SMD_EVENT (%d) not supported\n",
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index b00a7e92225f..54e36fcb3954 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -5,6 +5,8 @@ config BRCMSMAC
         tristate "Broadcom IEEE802.11n PCIe SoftMAC WLAN driver"
         depends on MAC80211
         depends on BCMA
+        select NEW_LEDS if BCMA_DRIVER_GPIO
+        select LEDS_CLASS if BCMA_DRIVER_GPIO
         select BRCMUTIL
         select FW_LOADER
         select CRC_CCITT
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 905704e335d7..abc9ceca70f3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -109,6 +109,8 @@ static inline int brcmf_sdioh_f0_write_byte(struct brcmf_sdio_dev *sdiodev,
                                         brcmf_err("Disable F2 failed:%d\n",
                                                   err_ret);
                         }
+                } else {
+                        err_ret = -ENOENT;
                 }
         } else if ((regaddr == SDIO_CCCR_ABORT) ||
                    (regaddr == SDIO_CCCR_IENx)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 85879dbaa402..3c34a72a5d64 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -67,8 +67,8 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL7260_UCODE_API_MAX   7
-#define IWL3160_UCODE_API_MAX   7
+#define IWL7260_UCODE_API_MAX   8
+#define IWL3160_UCODE_API_MAX   8
 
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    7
@@ -130,6 +130,7 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
@@ -140,6 +141,7 @@ const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .high_temp = true,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl7260_2n_cfg = {
@@ -149,6 +151,7 @@ const struct iwl_cfg iwl7260_2n_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl7260_n_cfg = {
@@ -158,6 +161,7 @@ const struct iwl_cfg iwl7260_n_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl3160_2ac_cfg = {
@@ -167,6 +171,7 @@ const struct iwl_cfg iwl3160_2ac_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl3160_2n_cfg = {
@@ -176,6 +181,7 @@ const struct iwl_cfg iwl3160_2n_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl3160_n_cfg = {
@@ -185,6 +191,7 @@ const struct iwl_cfg iwl3160_n_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl7265_2ac_cfg = {
@@ -196,5 +203,23 @@ const struct iwl_cfg iwl7265_2ac_cfg = {
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
 };
 
+const struct iwl_cfg iwl7265_2n_cfg = {
+        .name = "Intel(R) Dual Band Wireless N 7265",
+        .fw_name_pre = IWL7265_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL7265_NVM_VERSION,
+        .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
+};
+
+const struct iwl_cfg iwl7265_n_cfg = {
+        .name = "Intel(R) Wireless N 7265",
+        .fw_name_pre = IWL7265_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL7265_NVM_VERSION,
+        .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
+};
+
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 18f232e8e812..03fd9aa8bfda 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -207,6 +207,8 @@ struct iwl_eeprom_params {
  * @rx_with_siso_diversity: 1x1 device with rx antenna diversity
  * @internal_wimax_coex: internal wifi/wimax combo device
  * @high_temp: Is this NIC is designated to be in high temperature.
+ * @host_interrupt_operation_mode: device needs host interrupt operation
+ *      mode set
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -235,6 +237,7 @@ struct iwl_cfg {
         enum iwl_led_mode led_mode;
         const bool rx_with_siso_diversity;
         const bool internal_wimax_coex;
+        const bool host_interrupt_operation_mode;
         bool high_temp;
 };
 
@@ -294,6 +297,8 @@ extern const struct iwl_cfg iwl3160_2ac_cfg;
 extern const struct iwl_cfg iwl3160_2n_cfg;
 extern const struct iwl_cfg iwl3160_n_cfg;
 extern const struct iwl_cfg iwl7265_2ac_cfg;
+extern const struct iwl_cfg iwl7265_2n_cfg;
+extern const struct iwl_cfg iwl7265_n_cfg;
 #endif /* CONFIG_IWLMVM */
 
 #endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 54a4fdc631b7..da4eca8b3007 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -495,14 +495,11 @@ enum secure_load_status_reg {
  * the CSR_INT_COALESCING is an 8 bit register in 32-usec unit
  *
  * default interrupt coalescing timer is 64 x 32 = 2048 usecs
- * default interrupt coalescing calibration timer is 16 x 32 = 512 usecs
  */
 #define IWL_HOST_INT_TIMEOUT_MAX        (0xFF)
 #define IWL_HOST_INT_TIMEOUT_DEF        (0x40)
 #define IWL_HOST_INT_TIMEOUT_MIN        (0x0)
-#define IWL_HOST_INT_CALIB_TIMEOUT_MAX  (0xFF)
-#define IWL_HOST_INT_CALIB_TIMEOUT_DEF  (0x10)
-#define IWL_HOST_INT_CALIB_TIMEOUT_MIN  (0x0)
+#define IWL_HOST_INT_OPER_MODE          BIT(31)
 
 /*****************************************************************************
  *                        7000/3000 series SHR DTS addresses                 *
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 5d066cbc5ac7..75b72a956552 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -391,7 +391,6 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                                             BT_VALID_LUT |
                                             BT_VALID_WIFI_RX_SW_PRIO_BOOST |
                                             BT_VALID_WIFI_TX_SW_PRIO_BOOST |
-                                            BT_VALID_MULTI_PRIO_LUT |
                                             BT_VALID_CORUN_LUT_20 |
                                             BT_VALID_CORUN_LUT_40 |
                                             BT_VALID_ANT_ISOLATION |
@@ -842,6 +841,11 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
 
         sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id],
                                         lockdep_is_held(&mvm->mutex));
+
+        /* This can happen if the station has been removed right now */
+        if (IS_ERR_OR_NULL(sta))
+                return;
+
         mvmsta = (void *)sta->drv_priv;
 
         data->num_bss_ifaces++;
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 6f45966817bb..b9b81e881dd0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -895,7 +895,7 @@ static int iwl_mvm_get_last_nonqos_seq(struct iwl_mvm *mvm,
                 /* new API returns next, not last-used seqno */
                 if (mvm->fw->ucode_capa.flags &
                                 IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API)
-                        err -= 0x10;
+                        err = (u16) (err - 0x10);
         }
 
         iwl_free_resp(&cmd);
@@ -1549,7 +1549,7 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm,
         if (gtkdata.unhandled_cipher)
                 return false;
         if (!gtkdata.num_keys)
-                return true;
+                goto out;
         if (!gtkdata.last_gtk)
                 return false;
 
@@ -1600,6 +1600,7 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm,
                                            (void *)&replay_ctr, GFP_KERNEL);
         }
 
+out:
         mvmvif->seqno_valid = true;
         /* +0x10 because the set API expects next-to-use, not last-used */
         mvmvif->seqno = le16_to_cpu(status->non_qos_seq_ctr) + 0x10;
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 9864d713eb2c..a8fe6b41f9a3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -119,6 +119,10 @@ static ssize_t iwl_dbgfs_sta_drain_write(struct file *file,
 
         if (sscanf(buf, "%d %d", &sta_id, &drain) != 2)
                 return -EINVAL;
+        if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT)
+                return -EINVAL;
+        if (drain < 0 || drain > 1)
+                return -EINVAL;
 
         mutex_lock(&mvm->mutex);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 33cf56fdfc41..95ce4b601fef 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -176,8 +176,11 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
          * P2P Device discoveribility, while there are other higher priority
          * events in the system).
          */
-        if (WARN_ONCE(!le32_to_cpu(notif->status),
-                      "Failed to schedule time event\n")) {
+        if (!le32_to_cpu(notif->status)) {
+                bool start = le32_to_cpu(notif->action) &
+                                TE_V2_NOTIF_HOST_EVENT_START;
+                IWL_WARN(mvm, "Time Event %s notification failure\n",
+                         start ? "start" : "end");
                 if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, NULL)) {
                         iwl_mvm_te_clear_data(mvm, te_data);
                         return;
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 941c0c88f982..86605027c41d 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -353,6 +353,27 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 
 /* 7265 Series */
         {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x500A, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5420, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5090, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
 
         {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index fa22639b63c9..051268c037b1 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -477,4 +477,12 @@ static inline bool iwl_is_rfkill_set(struct iwl_trans *trans)
                 CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
 }
 
+static inline void iwl_nic_error(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+        set_bit(STATUS_FW_ERROR, &trans_pcie->status);
+        iwl_op_mode_nic_error(trans->op_mode);
+}
+
 #endif /* __iwl_trans_int_pcie_h__ */
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 3f237b42eb36..be3995afa9d0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -489,6 +489,10 @@ static void iwl_pcie_rx_hw_init(struct iwl_trans *trans, struct iwl_rxq *rxq)
 
         /* Set interrupt coalescing timer to default (2048 usecs) */
         iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
+
+        /* W/A for interrupt coalescing bug in 7260 and 3160 */
+        if (trans->cfg->host_interrupt_operation_mode)
+                iwl_set_bit(trans, CSR_INT_COALESCING, IWL_HOST_INT_OPER_MODE);
 }
 
 static void iwl_pcie_rx_init_rxb_lists(struct iwl_rxq *rxq)
@@ -796,12 +800,13 @@ static void iwl_pcie_irq_handle_error(struct iwl_trans *trans)
         iwl_pcie_dump_csr(trans);
         iwl_dump_fh(trans, NULL);
 
+        /* set the ERROR bit before we wake up the caller */
         set_bit(STATUS_FW_ERROR, &trans_pcie->status);
         clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
         wake_up(&trans_pcie->wait_command_queue);
 
         local_bh_disable();
-        iwl_op_mode_nic_error(trans->op_mode);
+        iwl_nic_error(trans);
         local_bh_enable();
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 5d9337bec67a..cde9c16f6e4f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -279,9 +279,6 @@ static int iwl_pcie_nic_init(struct iwl_trans *trans)
         spin_lock_irqsave(&trans_pcie->irq_lock, flags);
         iwl_pcie_apm_init(trans);
 
-        /* Set interrupt coalescing calibration timer to default (512 usecs) */
-        iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
-
         spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
 
         iwl_pcie_set_pwr(trans, false);
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 059c5acad3a0..0adde919a258 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -207,7 +207,7 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                 IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
                         le32_to_cpu(txq->scratchbufs[i].scratch));
 
-        iwl_op_mode_nic_error(trans->op_mode);
+        iwl_nic_error(trans);
 }
 
 /*
@@ -1023,7 +1023,7 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
                 if (nfreed++ > 0) {
                         IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
                                 idx, q->write_ptr, q->read_ptr);
-                        iwl_op_mode_nic_error(trans->op_mode);
+                        iwl_nic_error(trans);
                 }
         }
 
@@ -1562,7 +1562,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                                        get_cmd_string(trans_pcie, cmd->id));
                         ret = -ETIMEDOUT;
 
-                        iwl_op_mode_nic_error(trans->op_mode);
+                        iwl_nic_error(trans);
 
                         goto cancel;
                 }
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9df7bc91a26f..c72438bb2faf 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -383,6 +383,14 @@ struct hwsim_radiotap_hdr {
         __le16 rt_chbitmask;
 } __packed;
 
+struct hwsim_radiotap_ack_hdr {
+        struct ieee80211_radiotap_header hdr;
+        u8 rt_flags;
+        u8 pad;
+        __le16 rt_channel;
+        __le16 rt_chbitmask;
+} __packed;
+
 /* MAC80211_HWSIM netlinf family */
 static struct genl_family hwsim_genl_family = {
         .id = GENL_ID_GENERATE,
@@ -500,7 +508,7 @@ static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
                                        const u8 *addr)
 {
         struct sk_buff *skb;
-        struct hwsim_radiotap_hdr *hdr;
+        struct hwsim_radiotap_ack_hdr *hdr;
         u16 flags;
         struct ieee80211_hdr *hdr11;
 
@@ -511,14 +519,14 @@ static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
         if (skb == NULL)
                 return;
 
-        hdr = (struct hwsim_radiotap_hdr *) skb_put(skb, sizeof(*hdr));
+        hdr = (struct hwsim_radiotap_ack_hdr *) skb_put(skb, sizeof(*hdr));
         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
         hdr->hdr.it_pad = 0;
         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
         hdr->rt_flags = 0;
-        hdr->rt_rate = 0;
+        hdr->pad = 0;
         hdr->rt_channel = cpu_to_le16(chan->center_freq);
         flags = IEEE80211_CHAN_2GHZ;
         hdr->rt_chbitmask = cpu_to_le16(flags);
@@ -1230,7 +1238,7 @@ static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
                                               HRTIMER_MODE_REL);
                 } else if (!info->enable_beacon) {
                         unsigned int count = 0;
-                        ieee80211_iterate_active_interfaces(
+                        ieee80211_iterate_active_interfaces_atomic(
                                 data->hw, IEEE80211_IFACE_ITER_NORMAL,
                                 mac80211_hwsim_bcn_en_iter, &count);
                         wiphy_debug(hw->wiphy, "  beaconing vifs remaining: %u",
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index c8e029df770e..a09398fe9e2a 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -319,8 +319,8 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                 if (bss_desc && bss_desc->ssid.ssid_len &&
                     (!mwifiex_ssid_cmp(&priv->curr_bss_params.bss_descriptor.
                                        ssid, &bss_desc->ssid))) {
-                        kfree(bss_desc);
-                        return 0;
+                        ret = 0;
+                        goto done;
                 }
 
                 /* Exit Adhoc mode first */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 2329cccf1fa6..870f1fa58370 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -368,11 +368,11 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
                    unsigned long rx_ring_ref, unsigned int tx_evtchn,
                    unsigned int rx_evtchn)
 {
+        struct task_struct *task;
         int err = -ENOMEM;
 
-        /* Already connected through? */
-        if (vif->tx_irq)
-                return 0;
+        BUG_ON(vif->tx_irq);
+        BUG_ON(vif->task);
 
         err = xenvif_map_frontend_rings(vif, tx_ring_ref, rx_ring_ref);
         if (err < 0)
@@ -411,14 +411,16 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
         }
 
         init_waitqueue_head(&vif->wq);
-        vif->task = kthread_create(xenvif_kthread,
-                                   (void *)vif, "%s", vif->dev->name);
-        if (IS_ERR(vif->task)) {
+        task = kthread_create(xenvif_kthread,
+                              (void *)vif, "%s", vif->dev->name);
+        if (IS_ERR(task)) {
                 pr_warn("Could not allocate kthread for %s\n", vif->dev->name);
-                err = PTR_ERR(vif->task);
+                err = PTR_ERR(task);
                 goto err_rx_unbind;
         }
 
+        vif->task = task;
+
         rtnl_lock();
         if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
                 dev_set_mtu(vif->dev, ETH_DATA_LEN);
@@ -461,8 +463,10 @@ void xenvif_disconnect(struct xenvif *vif)
         if (netif_carrier_ok(vif->dev))
                 xenvif_carrier_off(vif);
 
-        if (vif->task)
+        if (vif->task) {
                 kthread_stop(vif->task);
+                vif->task = NULL;
+        }
 
         if (vif->tx_irq) {
                 if (vif->tx_irq == vif->rx_irq)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 919b6509455c..e884ee1fe7ed 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -39,6 +39,7 @@
 #include <linux/udp.h>
 
 #include <net/tcp.h>
+#include <net/ip6_checksum.h>
 
 #include <xen/xen.h>
 #include <xen/events.h>
@@ -451,7 +452,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         }
 
         /* Set up a GSO prefix descriptor, if necessary */
-        if ((1 << skb_shinfo(skb)->gso_type) & vif->gso_prefix_mask) {
+        if ((1 << gso_type) & vif->gso_prefix_mask) {
                 req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                 meta = npo->meta + npo->meta_prod++;
                 meta->gso_type = gso_type;
@@ -1148,75 +1149,92 @@ static int xenvif_set_skb_gso(struct xenvif *vif,
         return 0;
 }
 
-static inline void maybe_pull_tail(struct sk_buff *skb, unsigned int len)
+static inline int maybe_pull_tail(struct sk_buff *skb, unsigned int len,
+                                  unsigned int max)
 {
-        if (skb_is_nonlinear(skb) && skb_headlen(skb) < len) {
-                /* If we need to pullup then pullup to the max, so we
-                 * won't need to do it again.
-                 */
-                int target = min_t(int, skb->len, MAX_TCP_HEADER);
-                __pskb_pull_tail(skb, target - skb_headlen(skb));
-        }
+        if (skb_headlen(skb) >= len)
+                return 0;
+
+        /* If we need to pullup then pullup to the max, so we
+         * won't need to do it again.
+         */
+        if (max > skb->len)
+                max = skb->len;
+
+        if (__pskb_pull_tail(skb, max - skb_headlen(skb)) == NULL)
+                return -ENOMEM;
+
+        if (skb_headlen(skb) < len)
+                return -EPROTO;
+
+        return 0;
 }
 
+/* This value should be large enough to cover a tagged ethernet header plus
+ * maximally sized IP and TCP or UDP headers.
+ */
+#define MAX_IP_HDR_LEN 128
+
 static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                              int recalculate_partial_csum)
 {
-        struct iphdr *iph = (void *)skb->data;
-        unsigned int header_size;
         unsigned int off;
-        int err = -EPROTO;
+        bool fragment;
+        int err;
 
-        off = sizeof(struct iphdr);
+        fragment = false;
 
-        header_size = skb->network_header + off + MAX_IPOPTLEN;
-        maybe_pull_tail(skb, header_size);
+        err = maybe_pull_tail(skb,
+                              sizeof(struct iphdr),
+                              MAX_IP_HDR_LEN);
+        if (err < 0)
+                goto out;
 
-        off = iph->ihl * 4;
+        if (ip_hdr(skb)->frag_off & htons(IP_OFFSET | IP_MF))
+                fragment = true;
 
-        switch (iph->protocol) {
+        off = ip_hdrlen(skb);
+
+        err = -EPROTO;
+
+        switch (ip_hdr(skb)->protocol) {
         case IPPROTO_TCP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct tcphdr),
+                                      MAX_IP_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
                 if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct tcphdr, check)))
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct tcphdr *tcph = tcp_hdr(skb);
-
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct tcphdr);
-                        maybe_pull_tail(skb, header_size);
-
-                        tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - off,
-                                                         IPPROTO_TCP, 0);
-                }
+                if (recalculate_partial_csum)
+                        tcp_hdr(skb)->check =
+                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                   ip_hdr(skb)->daddr,
+                                                   skb->len - off,
+                                                   IPPROTO_TCP, 0);
                 break;
         case IPPROTO_UDP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct udphdr),
+                                      MAX_IP_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
                 if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct udphdr, check)))
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct udphdr *udph = udp_hdr(skb);
-
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct udphdr);
-                        maybe_pull_tail(skb, header_size);
-
-                        udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - off,
-                                                         IPPROTO_UDP, 0);
-                }
+                if (recalculate_partial_csum)
+                        udp_hdr(skb)->check =
+                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                   ip_hdr(skb)->daddr,
+                                                   skb->len - off,
+                                                   IPPROTO_UDP, 0);
                 break;
         default:
-                if (net_ratelimit())
-                        netdev_err(vif->dev,
-                                   "Attempting to checksum a non-TCP/UDP packet, "
-                                   "dropping a protocol %d packet\n",
-                                   iph->protocol);
                 goto out;
         }
 
@@ -1226,121 +1244,138 @@ out:
         return err;
 }
 
+/* This value should be large enough to cover a tagged ethernet header plus
+ * an IPv6 header, all options, and a maximal TCP or UDP header.
+ */
+#define MAX_IPV6_HDR_LEN 256
+
+#define OPT_HDR(type, skb, off) \
+        (type *)(skb_network_header(skb) + (off))
+
 static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                                int recalculate_partial_csum)
 {
-        int err = -EPROTO;
-        struct ipv6hdr *ipv6h = (void *)skb->data;
+        int err;
         u8 nexthdr;
-        unsigned int header_size;
         unsigned int off;
+        unsigned int len;
         bool fragment;
         bool done;
 
+        fragment = false;
         done = false;
 
         off = sizeof(struct ipv6hdr);
 
-        header_size = skb->network_header + off;
-        maybe_pull_tail(skb, header_size);
+        err = maybe_pull_tail(skb, off, MAX_IPV6_HDR_LEN);
+        if (err < 0)
+                goto out;
 
-        nexthdr = ipv6h->nexthdr;
+        nexthdr = ipv6_hdr(skb)->nexthdr;
 
-        while ((off <= sizeof(struct ipv6hdr) + ntohs(ipv6h->payload_len)) &&
-               !done) {
+        len = sizeof(struct ipv6hdr) + ntohs(ipv6_hdr(skb)->payload_len);
+        while (off <= len && !done) {
                 switch (nexthdr) {
                 case IPPROTO_DSTOPTS:
                 case IPPROTO_HOPOPTS:
                 case IPPROTO_ROUTING: {
-                        struct ipv6_opt_hdr *hp = (void *)(skb->data + off);
+                        struct ipv6_opt_hdr *hp;
 
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct ipv6_opt_hdr);
-                        maybe_pull_tail(skb, header_size);
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct ipv6_opt_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
 
+                        hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
                         nexthdr = hp->nexthdr;
                         off += ipv6_optlen(hp);
                         break;
                 }
                 case IPPROTO_AH: {
-                        struct ip_auth_hdr *hp = (void *)(skb->data + off);
+                        struct ip_auth_hdr *hp;
 
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct ip_auth_hdr);
-                        maybe_pull_tail(skb, header_size);
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct ip_auth_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
 
+                        hp = OPT_HDR(struct ip_auth_hdr, skb, off);
                         nexthdr = hp->nexthdr;
-                        off += (hp->hdrlen+2)<<2;
+                        off += ipv6_authlen(hp);
+                        break;
+                }
+                case IPPROTO_FRAGMENT: {
+                        struct frag_hdr *hp;
+
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct frag_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
+
+                        hp = OPT_HDR(struct frag_hdr, skb, off);
+
+                        if (hp->frag_off & htons(IP6_OFFSET | IP6_MF))
+                                fragment = true;
+
+                        nexthdr = hp->nexthdr;
+                        off += sizeof(struct frag_hdr);
                         break;
                 }
-                case IPPROTO_FRAGMENT:
-                        fragment = true;
-                        /* fall through */
                 default:
                         done = true;
                         break;
                 }
         }
 
-        if (!done) {
-                if (net_ratelimit())
-                        netdev_err(vif->dev, "Failed to parse packet header\n");
-                goto out;
-        }
+        err = -EPROTO;
 
-        if (fragment) {
-                if (net_ratelimit())
-                        netdev_err(vif->dev, "Packet is a fragment!\n");
+        if (!done || fragment)
                 goto out;
-        }
 
         switch (nexthdr) {
         case IPPROTO_TCP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct tcphdr),
+                                      MAX_IPV6_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
                 if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct tcphdr, check)))
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct tcphdr *tcph = tcp_hdr(skb);
-
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct tcphdr);
-                        maybe_pull_tail(skb, header_size);
-
-                        tcph->check = ~csum_ipv6_magic(&ipv6h->saddr,
-                                                       &ipv6h->daddr,
-                                                       skb->len - off,
-                                                       IPPROTO_TCP, 0);
-                }
+                if (recalculate_partial_csum)
+                        tcp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 skb->len - off,
+                                                 IPPROTO_TCP, 0);
                 break;
         case IPPROTO_UDP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct udphdr),
+                                      MAX_IPV6_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
                 if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct udphdr, check)))
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct udphdr *udph = udp_hdr(skb);
-
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct udphdr);
-                        maybe_pull_tail(skb, header_size);
-
-                        udph->check = ~csum_ipv6_magic(&ipv6h->saddr,
-                                                       &ipv6h->daddr,
-                                                       skb->len - off,
-                                                       IPPROTO_UDP, 0);
-                }
+                if (recalculate_partial_csum)
+                        udp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 skb->len - off,
+                                                 IPPROTO_UDP, 0);
                 break;
         default:
-                if (net_ratelimit())
-                        netdev_err(vif->dev,
-                                   "Attempting to checksum a non-TCP/UDP packet, "
-                                   "dropping a protocol %d packet\n",
-                                   nexthdr);
                 goto out;
         }
 
@@ -1410,14 +1445,15 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
         return false;
 }
 
-static unsigned xenvif_tx_build_gops(struct xenvif *vif)
+static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget)
 {
         struct gnttab_copy *gop = vif->tx_copy_ops, *request_gop;
         struct sk_buff *skb;
         int ret;
 
         while ((nr_pending_reqs(vif) + XEN_NETBK_LEGACY_SLOTS_MAX
-                < MAX_PENDING_REQS)) {
+                < MAX_PENDING_REQS) &&
+               (skb_queue_len(&vif->tx_queue) < budget)) {
                 struct xen_netif_tx_request txreq;
                 struct xen_netif_tx_request txfrags[XEN_NETBK_LEGACY_SLOTS_MAX];
                 struct page *page;
@@ -1439,7 +1475,7 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif)
                         continue;
                 }
 
-                RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
+                work_to_do = RING_HAS_UNCONSUMED_REQUESTS(&vif->tx);
                 if (!work_to_do)
                         break;
 
@@ -1579,14 +1615,13 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif)
 }
 
 
-static int xenvif_tx_submit(struct xenvif *vif, int budget)
+static int xenvif_tx_submit(struct xenvif *vif)
 {
         struct gnttab_copy *gop = vif->tx_copy_ops;
         struct sk_buff *skb;
         int work_done = 0;
 
-        while (work_done < budget &&
-               (skb = __skb_dequeue(&vif->tx_queue)) != NULL) {
+        while ((skb = __skb_dequeue(&vif->tx_queue)) != NULL) {
                 struct xen_netif_tx_request *txp;
                 u16 pending_idx;
                 unsigned data_len;
@@ -1661,14 +1696,14 @@ int xenvif_tx_action(struct xenvif *vif, int budget)
         if (unlikely(!tx_work_todo(vif)))
                 return 0;
 
-        nr_gops = xenvif_tx_build_gops(vif);
+        nr_gops = xenvif_tx_build_gops(vif, budget);
 
         if (nr_gops == 0)
                 return 0;
 
         gnttab_batch_copy(vif->tx_copy_ops, nr_gops);
 
-        work_done = xenvif_tx_submit(vif, nr_gops);
+        work_done = xenvif_tx_submit(vif);
 
         return work_done;
 }
diff --git a/drivers/ntb/ntb_hw.c b/drivers/ntb/ntb_hw.c
index 1cb6e51e6bda..170e8e60cdb7 100644
--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -141,6 +141,24 @@ void ntb_unregister_event_callback(struct ntb_device *ndev)
         ndev->event_cb = NULL;
 }
 
+static void ntb_irq_work(unsigned long data)
+{
+        struct ntb_db_cb *db_cb = (struct ntb_db_cb *)data;
+        int rc;
+
+        rc = db_cb->callback(db_cb->data, db_cb->db_num);
+        if (rc)
+                tasklet_schedule(&db_cb->irq_work);
+        else {
+                struct ntb_device *ndev = db_cb->ndev;
+                unsigned long mask;
+
+                mask = readw(ndev->reg_ofs.ldb_mask);
+                clear_bit(db_cb->db_num * ndev->bits_per_vector, &mask);
+                writew(mask, ndev->reg_ofs.ldb_mask);
+        }
+}
+
 /**
  * ntb_register_db_callback() - register a callback for doorbell interrupt
  * @ndev: pointer to ntb_device instance
@@ -155,7 +173,7 @@ void ntb_unregister_event_callback(struct ntb_device *ndev)
  * RETURNS: An appropriate -ERRNO error value on error, or zero for success.
  */
 int ntb_register_db_callback(struct ntb_device *ndev, unsigned int idx,
-                             void *data, void (*func)(void *data, int db_num))
+                             void *data, int (*func)(void *data, int db_num))
 {
         unsigned long mask;
 
@@ -166,6 +184,10 @@ int ntb_register_db_callback(struct ntb_device *ndev, unsigned int idx,
 
         ndev->db_cb[idx].callback = func;
         ndev->db_cb[idx].data = data;
+        ndev->db_cb[idx].ndev = ndev;
+
+        tasklet_init(&ndev->db_cb[idx].irq_work, ntb_irq_work,
+                     (unsigned long) &ndev->db_cb[idx]);
 
         /* unmask interrupt */
         mask = readw(ndev->reg_ofs.ldb_mask);
@@ -194,6 +216,8 @@ void ntb_unregister_db_callback(struct ntb_device *ndev, unsigned int idx)
         set_bit(idx * ndev->bits_per_vector, &mask);
         writew(mask, ndev->reg_ofs.ldb_mask);
 
+        tasklet_disable(&ndev->db_cb[idx].irq_work);
+
         ndev->db_cb[idx].callback = NULL;
 }
 
@@ -678,6 +702,7 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                                 return -EINVAL;
 
                         ndev->limits.max_mw = SNB_ERRATA_MAX_MW;
+                        ndev->limits.max_db_bits = SNB_MAX_DB_BITS;
                         ndev->reg_ofs.spad_write = ndev->mw[1].vbase +
                                                    SNB_SPAD_OFFSET;
                         ndev->reg_ofs.rdb = ndev->mw[1].vbase +
@@ -688,8 +713,21 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                          */
                         writeq(ndev->mw[1].bar_sz + 0x1000, ndev->reg_base +
                                SNB_PBAR4LMT_OFFSET);
+                        /* HW errata on the Limit registers.  They can only be
+                         * written when the base register is 4GB aligned and
+                         * < 32bit.  This should already be the case based on the
+                         * driver defaults, but write the Limit registers first
+                         * just in case.
+                         */
                 } else {
                         ndev->limits.max_mw = SNB_MAX_MW;
+
+                        /* HW Errata on bit 14 of b2bdoorbell register.  Writes
+                         * will not be mirrored to the remote system.  Shrink
+                         * the number of bits by one, since bit 14 is the last
+                         * bit.
+                         */
+                        ndev->limits.max_db_bits = SNB_MAX_DB_BITS - 1;
                         ndev->reg_ofs.spad_write = ndev->reg_base +
                                                    SNB_B2B_SPAD_OFFSET;
                         ndev->reg_ofs.rdb = ndev->reg_base +
@@ -699,6 +737,12 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                          * something silly
                          */
                         writeq(0, ndev->reg_base + SNB_PBAR4LMT_OFFSET);
+                        /* HW errata on the Limit registers.  They can only be
+                         * written when the base register is 4GB aligned and
+                         * < 32bit.  This should already be the case based on the
+                         * driver defaults, but write the Limit registers first
+                         * just in case.
+                         */
                 }
 
                 /* The Xeon errata workaround requires setting SBAR Base
@@ -769,6 +813,7 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                  * have an equal amount.
                  */
                 ndev->limits.max_spads = SNB_MAX_COMPAT_SPADS / 2;
+                ndev->limits.max_db_bits = SNB_MAX_DB_BITS;
                 /* Note: The SDOORBELL is the cause of the errata.  You REALLY
                  * don't want to touch it.
                  */
@@ -793,6 +838,7 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                  * have an equal amount.
                  */
                 ndev->limits.max_spads = SNB_MAX_COMPAT_SPADS / 2;
+                ndev->limits.max_db_bits = SNB_MAX_DB_BITS;
                 ndev->reg_ofs.rdb = ndev->reg_base + SNB_PDOORBELL_OFFSET;
                 ndev->reg_ofs.ldb = ndev->reg_base + SNB_SDOORBELL_OFFSET;
                 ndev->reg_ofs.ldb_mask = ndev->reg_base + SNB_SDBMSK_OFFSET;
@@ -819,7 +865,6 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
         ndev->reg_ofs.lnk_stat = ndev->reg_base + SNB_SLINK_STATUS_OFFSET;
         ndev->reg_ofs.spci_cmd = ndev->reg_base + SNB_PCICMD_OFFSET;
 
-        ndev->limits.max_db_bits = SNB_MAX_DB_BITS;
         ndev->limits.msix_cnt = SNB_MSIX_CNT;
         ndev->bits_per_vector = SNB_DB_BITS_PER_VEC;
 
@@ -934,12 +979,16 @@ static irqreturn_t bwd_callback_msix_irq(int irq, void *data)
 {
         struct ntb_db_cb *db_cb = data;
         struct ntb_device *ndev = db_cb->ndev;
+        unsigned long mask;
 
         dev_dbg(&ndev->pdev->dev, "MSI-X irq %d received for DB %d\n", irq,
                 db_cb->db_num);
 
-        if (db_cb->callback)
-                db_cb->callback(db_cb->data, db_cb->db_num);
+        mask = readw(ndev->reg_ofs.ldb_mask);
+        set_bit(db_cb->db_num * ndev->bits_per_vector, &mask);
+        writew(mask, ndev->reg_ofs.ldb_mask);
+
+        tasklet_schedule(&db_cb->irq_work);
 
         /* No need to check for the specific HB irq, any interrupt means
          * we're connected.
@@ -955,12 +1004,16 @@ static irqreturn_t xeon_callback_msix_irq(int irq, void *data)
 {
         struct ntb_db_cb *db_cb = data;
         struct ntb_device *ndev = db_cb->ndev;
+        unsigned long mask;
 
         dev_dbg(&ndev->pdev->dev, "MSI-X irq %d received for DB %d\n", irq,
                 db_cb->db_num);
 
-        if (db_cb->callback)
-                db_cb->callback(db_cb->data, db_cb->db_num);
+        mask = readw(ndev->reg_ofs.ldb_mask);
+        set_bit(db_cb->db_num * ndev->bits_per_vector, &mask);
+        writew(mask, ndev->reg_ofs.ldb_mask);
+
+        tasklet_schedule(&db_cb->irq_work);
 
         /* On Sandybridge, there are 16 bits in the interrupt register
          * but only 4 vectors.  So, 5 bits are assigned to the first 3
@@ -986,7 +1039,7 @@ static irqreturn_t xeon_event_msix_irq(int irq, void *dev)
                 dev_err(&ndev->pdev->dev, "Error determining link status\n");
 
         /* bit 15 is always the link bit */
-        writew(1 << ndev->limits.max_db_bits, ndev->reg_ofs.ldb);
+        writew(1 << SNB_LINK_DB, ndev->reg_ofs.ldb);
 
         return IRQ_HANDLED;
 }
@@ -1075,6 +1128,10 @@ static int ntb_setup_msix(struct ntb_device *ndev)
                          "Only %d MSI-X vectors.  Limiting the number of queues to that number.\n",
                          rc);
                 msix_entries = rc;
+
+                rc = pci_enable_msix(pdev, ndev->msix_entries, msix_entries);
+                if (rc)
+                        goto err1;
         }
 
         for (i = 0; i < msix_entries; i++) {
@@ -1176,9 +1233,10 @@ static int ntb_setup_interrupts(struct ntb_device *ndev)
          */
         if (ndev->hw_type == BWD_HW)
                 writeq(~0, ndev->reg_ofs.ldb_mask);
-        else
-                writew(~(1 << ndev->limits.max_db_bits),
-                       ndev->reg_ofs.ldb_mask);
+        else {
+                u16 var = 1 << SNB_LINK_DB;
+                writew(~var, ndev->reg_ofs.ldb_mask);
+        }
 
         rc = ntb_setup_msix(ndev);
         if (!rc)
@@ -1286,6 +1344,39 @@ static void ntb_free_debugfs(struct ntb_device *ndev)
         }
 }
 
+static void ntb_hw_link_up(struct ntb_device *ndev)
+{
+        if (ndev->conn_type == NTB_CONN_TRANSPARENT)
+                ntb_link_event(ndev, NTB_LINK_UP);
+        else {
+                u32 ntb_cntl;
+
+                /* Let's bring the NTB link up */
+                ntb_cntl = readl(ndev->reg_ofs.lnk_cntl);
+                ntb_cntl &= ~(NTB_CNTL_LINK_DISABLE | NTB_CNTL_CFG_LOCK);
+                ntb_cntl |= NTB_CNTL_P2S_BAR23_SNOOP | NTB_CNTL_S2P_BAR23_SNOOP;
+                ntb_cntl |= NTB_CNTL_P2S_BAR45_SNOOP | NTB_CNTL_S2P_BAR45_SNOOP;
+                writel(ntb_cntl, ndev->reg_ofs.lnk_cntl);
+        }
+}
+
+static void ntb_hw_link_down(struct ntb_device *ndev)
+{
+        u32 ntb_cntl;
+
+        if (ndev->conn_type == NTB_CONN_TRANSPARENT) {
+                ntb_link_event(ndev, NTB_LINK_DOWN);
+                return;
+        }
+
+        /* Bring NTB link down */
+        ntb_cntl = readl(ndev->reg_ofs.lnk_cntl);
+        ntb_cntl &= ~(NTB_CNTL_P2S_BAR23_SNOOP | NTB_CNTL_S2P_BAR23_SNOOP);
+        ntb_cntl &= ~(NTB_CNTL_P2S_BAR45_SNOOP | NTB_CNTL_S2P_BAR45_SNOOP);
+        ntb_cntl |= NTB_CNTL_LINK_DISABLE | NTB_CNTL_CFG_LOCK;
+        writel(ntb_cntl, ndev->reg_ofs.lnk_cntl);
+}
+
 static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         struct ntb_device *ndev;
@@ -1374,9 +1465,7 @@ static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (rc)
                 goto err6;
 
-        /* Let's bring the NTB link up */
-        writel(NTB_CNTL_BAR23_SNOOP | NTB_CNTL_BAR45_SNOOP,
-               ndev->reg_ofs.lnk_cntl);
+        ntb_hw_link_up(ndev);
 
         return 0;
 
@@ -1406,12 +1495,8 @@ static void ntb_pci_remove(struct pci_dev *pdev)
 {
         struct ntb_device *ndev = pci_get_drvdata(pdev);
         int i;
-        u32 ntb_cntl;
 
-        /* Bring NTB link down */
-        ntb_cntl = readl(ndev->reg_ofs.lnk_cntl);
-        ntb_cntl |= NTB_CNTL_LINK_DISABLE;
-        writel(ntb_cntl, ndev->reg_ofs.lnk_cntl);
+        ntb_hw_link_down(ndev);
 
         ntb_transport_free(ndev->ntb_transport);
 
diff --git a/drivers/ntb/ntb_hw.h b/drivers/ntb/ntb_hw.h
index 0a31cedae7d4..bbdb7edca10c 100644
--- a/drivers/ntb/ntb_hw.h
+++ b/drivers/ntb/ntb_hw.h
@@ -106,10 +106,11 @@ struct ntb_mw {
 };
 
 struct ntb_db_cb {
-        void (*callback) (void *data, int db_num);
+        int (*callback)(void *data, int db_num);
         unsigned int db_num;
         void *data;
         struct ntb_device *ndev;
+        struct tasklet_struct irq_work;
 };
 
 struct ntb_device {
@@ -228,8 +229,8 @@ struct ntb_device *ntb_register_transport(struct pci_dev *pdev,
 void ntb_unregister_transport(struct ntb_device *ndev);
 void ntb_set_mw_addr(struct ntb_device *ndev, unsigned int mw, u64 addr);
 int ntb_register_db_callback(struct ntb_device *ndev, unsigned int idx,
-                             void *data, void (*db_cb_func) (void *data,
-                                                             int db_num));
+                             void *data, int (*db_cb_func)(void *data,
+                                                           int db_num));
 void ntb_unregister_db_callback(struct ntb_device *ndev, unsigned int idx);
 int ntb_register_event_callback(struct ntb_device *ndev,
                                 void (*event_cb_func) (void *handle,
diff --git a/drivers/ntb/ntb_regs.h b/drivers/ntb/ntb_regs.h
index aa4bdd393c58..9774506419d7 100644
--- a/drivers/ntb/ntb_regs.h
+++ b/drivers/ntb/ntb_regs.h
@@ -55,6 +55,7 @@
 #define SNB_MAX_COMPAT_SPADS    16
 /* Reserve the uppermost bit for link interrupt */
 #define SNB_MAX_DB_BITS         15
+#define SNB_LINK_DB             15
 #define SNB_DB_BITS_PER_VEC     5
 #define SNB_MAX_MW              2
 #define SNB_ERRATA_MAX_MW       1
@@ -75,9 +76,6 @@
 #define SNB_SBAR2XLAT_OFFSET    0x0030
 #define SNB_SBAR4XLAT_OFFSET    0x0038
 #define SNB_SBAR0BASE_OFFSET    0x0040
-#define SNB_SBAR0BASE_OFFSET    0x0040
-#define SNB_SBAR2BASE_OFFSET    0x0048
-#define SNB_SBAR4BASE_OFFSET    0x0050
 #define SNB_SBAR2BASE_OFFSET    0x0048
 #define SNB_SBAR4BASE_OFFSET    0x0050
 #define SNB_NTBCNTL_OFFSET      0x0058
@@ -145,11 +143,13 @@
 #define BWD_LTSSMSTATEJMP_FORCEDETECT   (1 << 2)
 #define BWD_IBIST_ERR_OFLOW     0x7FFF7FFF
 
-#define NTB_CNTL_CFG_LOCK       (1 << 0)
-#define NTB_CNTL_LINK_DISABLE   (1 << 1)
-#define NTB_CNTL_BAR23_SNOOP    (1 << 2)
-#define NTB_CNTL_BAR45_SNOOP    (1 << 6)
-#define BWD_CNTL_LINK_DOWN      (1 << 16)
+#define NTB_CNTL_CFG_LOCK               (1 << 0)
+#define NTB_CNTL_LINK_DISABLE           (1 << 1)
+#define NTB_CNTL_S2P_BAR23_SNOOP        (1 << 2)
+#define NTB_CNTL_P2S_BAR23_SNOOP        (1 << 4)
+#define NTB_CNTL_S2P_BAR45_SNOOP        (1 << 6)
+#define NTB_CNTL_P2S_BAR45_SNOOP        (1 << 8)
+#define BWD_CNTL_LINK_DOWN              (1 << 16)
 
 #define NTB_PPD_OFFSET          0x00D4
 #define SNB_PPD_CONN_TYPE       0x0003
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index d0222f13d154..3217f394d45b 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -119,7 +119,6 @@ struct ntb_transport_qp {
 
         void (*rx_handler) (struct ntb_transport_qp *qp, void *qp_data,
                             void *data, int len);
-        struct tasklet_struct rx_work;
         struct list_head rx_pend_q;
         struct list_head rx_free_q;
         spinlock_t ntb_rx_pend_q_lock;
@@ -584,11 +583,8 @@ static int ntb_set_mw(struct ntb_transport *nt, int num_mw, unsigned int size)
         return 0;
 }
 
-static void ntb_qp_link_cleanup(struct work_struct *work)
+static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp)
 {
-        struct ntb_transport_qp *qp = container_of(work,
-                                                   struct ntb_transport_qp,
-                                                   link_cleanup);
         struct ntb_transport *nt = qp->transport;
         struct pci_dev *pdev = ntb_query_pdev(nt->ndev);
 
@@ -602,6 +598,16 @@ static void ntb_qp_link_cleanup(struct work_struct *work)
 
         dev_info(&pdev->dev, "qp %d: Link Down\n", qp->qp_num);
         qp->qp_link = NTB_LINK_DOWN;
+}
+
+static void ntb_qp_link_cleanup_work(struct work_struct *work)
+{
+        struct ntb_transport_qp *qp = container_of(work,
+                                                   struct ntb_transport_qp,
+                                                   link_cleanup);
+        struct ntb_transport *nt = qp->transport;
+
+        ntb_qp_link_cleanup(qp);
 
         if (nt->transport_link == NTB_LINK_UP)
                 schedule_delayed_work(&qp->link_work,
@@ -613,22 +619,20 @@ static void ntb_qp_link_down(struct ntb_transport_qp *qp)
         schedule_work(&qp->link_cleanup);
 }
 
-static void ntb_transport_link_cleanup(struct work_struct *work)
+static void ntb_transport_link_cleanup(struct ntb_transport *nt)
 {
-        struct ntb_transport *nt = container_of(work, struct ntb_transport,
-                                                link_cleanup);
         int i;
 
+        /* Pass along the info to any clients */
+        for (i = 0; i < nt->max_qps; i++)
+                if (!test_bit(i, &nt->qp_bitmap))
+                        ntb_qp_link_cleanup(&nt->qps[i]);
+
         if (nt->transport_link == NTB_LINK_DOWN)
                 cancel_delayed_work_sync(&nt->link_work);
         else
                 nt->transport_link = NTB_LINK_DOWN;
 
-        /* Pass along the info to any clients */
-        for (i = 0; i < nt->max_qps; i++)
-                if (!test_bit(i, &nt->qp_bitmap))
-                        ntb_qp_link_down(&nt->qps[i]);
-
         /* The scratchpad registers keep the values if the remote side
          * goes down, blast them now to give them a sane value the next
          * time they are accessed
@@ -637,6 +641,14 @@ static void ntb_transport_link_cleanup(struct work_struct *work)
                 ntb_write_local_spad(nt->ndev, i, 0);
 }
 
+static void ntb_transport_link_cleanup_work(struct work_struct *work)
+{
+        struct ntb_transport *nt = container_of(work, struct ntb_transport,
+                                                link_cleanup);
+
+        ntb_transport_link_cleanup(nt);
+}
+
 static void ntb_transport_event_callback(void *data, enum ntb_hw_event event)
 {
         struct ntb_transport *nt = data;
@@ -880,7 +892,7 @@ static int ntb_transport_init_queue(struct ntb_transport *nt,
         }
 
         INIT_DELAYED_WORK(&qp->link_work, ntb_qp_link_work);
-        INIT_WORK(&qp->link_cleanup, ntb_qp_link_cleanup);
+        INIT_WORK(&qp->link_cleanup, ntb_qp_link_cleanup_work);
 
         spin_lock_init(&qp->ntb_rx_pend_q_lock);
         spin_lock_init(&qp->ntb_rx_free_q_lock);
@@ -936,7 +948,7 @@ int ntb_transport_init(struct pci_dev *pdev)
         }
 
         INIT_DELAYED_WORK(&nt->link_work, ntb_transport_link_work);
-        INIT_WORK(&nt->link_cleanup, ntb_transport_link_cleanup);
+        INIT_WORK(&nt->link_cleanup, ntb_transport_link_cleanup_work);
 
         rc = ntb_register_event_callback(nt->ndev,
                                          ntb_transport_event_callback);
@@ -972,7 +984,7 @@ void ntb_transport_free(void *transport)
         struct ntb_device *ndev = nt->ndev;
         int i;
 
-        nt->transport_link = NTB_LINK_DOWN;
+        ntb_transport_link_cleanup(nt);
 
         /* verify that all the qp's are freed */
         for (i = 0; i < nt->max_qps; i++) {
@@ -1188,11 +1200,14 @@ err:
         goto out;
 }
 
-static void ntb_transport_rx(unsigned long data)
+static int ntb_transport_rxc_db(void *data, int db_num)
 {
-        struct ntb_transport_qp *qp = (struct ntb_transport_qp *)data;
+        struct ntb_transport_qp *qp = data;
         int rc, i;
 
+        dev_dbg(&ntb_query_pdev(qp->ndev)->dev, "%s: doorbell %d received\n",
+                __func__, db_num);
+
         /* Limit the number of packets processed in a single interrupt to
          * provide fairness to others
          */
@@ -1204,16 +1219,8 @@ static void ntb_transport_rx(unsigned long data)
 
         if (qp->dma_chan)
                 dma_async_issue_pending(qp->dma_chan);
-}
-
-static void ntb_transport_rxc_db(void *data, int db_num)
-{
-        struct ntb_transport_qp *qp = data;
-
-        dev_dbg(&ntb_query_pdev(qp->ndev)->dev, "%s: doorbell %d received\n",
-                __func__, db_num);
 
-        tasklet_schedule(&qp->rx_work);
+        return i;
 }
 
 static void ntb_tx_copy_callback(void *data)
@@ -1432,11 +1439,12 @@ ntb_transport_create_queue(void *data, struct pci_dev *pdev,
         qp->tx_handler = handlers->tx_handler;
         qp->event_handler = handlers->event_handler;
 
+        dmaengine_get();
         qp->dma_chan = dma_find_channel(DMA_MEMCPY);
-        if (!qp->dma_chan)
+        if (!qp->dma_chan) {
+                dmaengine_put();
                 dev_info(&pdev->dev, "Unable to allocate DMA channel, using CPU instead\n");
-        else
-                dmaengine_get();
+        }
 
         for (i = 0; i < NTB_QP_DEF_NUM_ENTRIES; i++) {
                 entry = kzalloc(sizeof(struct ntb_queue_entry), GFP_ATOMIC);
@@ -1458,25 +1466,23 @@ ntb_transport_create_queue(void *data, struct pci_dev *pdev,
                              &qp->tx_free_q);
         }
 
-        tasklet_init(&qp->rx_work, ntb_transport_rx, (unsigned long) qp);
-
         rc = ntb_register_db_callback(qp->ndev, free_queue, qp,
                                       ntb_transport_rxc_db);
         if (rc)
-                goto err3;
+                goto err2;
 
         dev_info(&pdev->dev, "NTB Transport QP %d created\n", qp->qp_num);
 
         return qp;
 
-err3:
-        tasklet_disable(&qp->rx_work);
 err2:
         while ((entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q)))
                 kfree(entry);
 err1:
         while ((entry = ntb_list_rm(&qp->ntb_rx_free_q_lock, &qp->rx_free_q)))
                 kfree(entry);
+        if (qp->dma_chan)
+                dmaengine_put();
         set_bit(free_queue, &nt->qp_bitmap);
 err:
         return NULL;
@@ -1515,7 +1521,6 @@ void ntb_transport_free_queue(struct ntb_transport_qp *qp)
         }
 
         ntb_unregister_db_callback(qp->ndev, qp->qp_num);
-        tasklet_disable(&qp->rx_work);
 
         cancel_delayed_work_sync(&qp->link_work);
 
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index c269e430c760..2aa7b77c7c88 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -447,6 +447,11 @@ static int mvebu_sw_pci_bridge_read(struct mvebu_pcie_port *port,
                 *value = 0;
                 break;
 
+        case PCI_INTERRUPT_LINE:
+                /* LINE PIN MIN_GNT MAX_LAT */
+                *value = 0;
+                break;
+
         default:
                 *value = 0xffffffff;
                 return PCIBIOS_BAD_REGISTER_NUMBER;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 9042fdbd7244..25f0bc659164 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -19,6 +19,7 @@
 #include <linux/cpu.h>
 #include <linux/pm_runtime.h>
 #include <linux/suspend.h>
+#include <linux/kexec.h>
 #include "pci.h"
 
 struct pci_dynid {
@@ -288,12 +289,27 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
         int error, node;
         struct drv_dev_and_id ddi = { drv, dev, id };
 
-        /* Execute driver initialization on node where the device's
-           bus is attached to.  This way the driver likely allocates
-           its local memory on the right node without any need to
-           change it. */
+        /*
+         * Execute driver initialization on node where the device is
+         * attached.  This way the driver likely allocates its local memory
+         * on the right node.
+         */
         node = dev_to_node(&dev->dev);
-        if (node >= 0) {
+
+        /*
+         * On NUMA systems, we are likely to call a PF probe function using
+         * work_on_cpu().  If that probe calls pci_enable_sriov() (which
+         * adds the VF devices via pci_bus_add_device()), we may re-enter
+         * this function to call the VF probe function.  Calling
+         * work_on_cpu() again will cause a lockdep warning.  Since VFs are
+         * always on the same node as the PF, we can work around this by
+         * avoiding work_on_cpu() when we're already on the correct node.
+         *
+         * Preemption is enabled, so it's theoretically unsafe to use
+         * numa_node_id(), but even if we run the probe function on the
+         * wrong node, it should be functionally correct.
+         */
+        if (node >= 0 && node != numa_node_id()) {
                 int cpu;
 
                 get_online_cpus();
@@ -305,6 +321,7 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
                 put_online_cpus();
         } else
                 error = local_pci_probe(&ddi);
+
         return error;
 }
 
@@ -399,12 +416,17 @@ static void pci_device_shutdown(struct device *dev)
         pci_msi_shutdown(pci_dev);
         pci_msix_shutdown(pci_dev);
 
+#ifdef CONFIG_KEXEC
         /*
-         * Turn off Bus Master bit on the device to tell it to not
-         * continue to do DMA. Don't touch devices in D3cold or unknown states.
+         * If this is a kexec reboot, turn off Bus Master bit on the
+         * device to tell it to not continue to do DMA. Don't touch
+         * devices in D3cold or unknown states.
+         * If it is not a kexec reboot, firmware will hit the PCI
+         * devices with big hammer and stop their DMA any way.
          */
-        if (pci_dev->current_state <= PCI_D3hot)
+        if (kexec_in_progress && (pci_dev->current_state <= PCI_D3hot))
                 pci_clear_master(pci_dev);
+#endif
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 33120d156668..07369f32e8bb 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -4165,6 +4165,14 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode,
         return 0;
 }
 
+bool pci_device_is_present(struct pci_dev *pdev)
+{
+        u32 v;
+
+        return pci_bus_read_dev_vendor_id(pdev->bus, pdev->devfn, &v, 0);
+}
+EXPORT_SYMBOL_GPL(pci_device_is_present);
+
 #define RESOURCE_ALIGNMENT_PARAM_SIZE COMMAND_LINE_SIZE
 static char resource_alignment_param[RESOURCE_ALIGNMENT_PARAM_SIZE] = {0};
 static DEFINE_SPINLOCK(resource_alignment_lock);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b3b1b9aa8863..3a02717473ad 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -9,10 +9,6 @@
  *
  *  Init/reset quirks for USB host controllers should be in the
  *  USB quirks file, where their drivers can access reuse it.
- *
- *  The bridge optimization stuff has been removed. If you really
- *  have a silly BIOS which is unable to set your host bridge right,
- *  use the PowerTweak utility (see http://powertweak.sourceforge.net).
  */
 
 #include <linux/types.h>
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index 1576851028db..cc9337a71529 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -24,7 +24,7 @@ static void pci_stop_dev(struct pci_dev *dev)
         if (dev->is_added) {
                 pci_proc_detach_device(dev);
                 pci_remove_sysfs_dev_files(dev);
-                device_del(&dev->dev);
+                device_release_driver(&dev->dev);
                 dev->is_added = 0;
         }
 
@@ -34,6 +34,8 @@ static void pci_stop_dev(struct pci_dev *dev)
 
 static void pci_destroy_dev(struct pci_dev *dev)
 {
+        device_del(&dev->dev);
+
         down_write(&pci_bus_sem);
         list_del(&dev->bus_list);
         up_write(&pci_bus_sem);
diff --git a/drivers/pinctrl/pinctrl-abx500.c b/drivers/pinctrl/pinctrl-abx500.c
index 4780959e11d4..5183e7bb8de3 100644
--- a/drivers/pinctrl/pinctrl-abx500.c
+++ b/drivers/pinctrl/pinctrl-abx500.c
@@ -418,7 +418,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                         ret = abx500_gpio_set_bits(chip,
                                         AB8500_GPIO_ALTFUN_REG,
                                         af.alt_bit1,
-                                        !!(af.alta_val && BIT(0)));
+                                        !!(af.alta_val & BIT(0)));
                         if (ret < 0)
                                 goto out;
 
@@ -439,7 +439,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                         goto out;
 
                 ret = abx500_gpio_set_bits(chip, AB8500_GPIO_ALTFUN_REG,
-                                af.alt_bit1, !!(af.altb_val && BIT(0)));
+                                af.alt_bit1, !!(af.altb_val & BIT(0)));
                 if (ret < 0)
                         goto out;
 
@@ -462,7 +462,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                         goto out;
 
                 ret = abx500_gpio_set_bits(chip, AB8500_GPIO_ALTFUN_REG,
-                                af.alt_bit2, !!(af.altc_val && BIT(1)));
+                                af.alt_bit2, !!(af.altc_val & BIT(1)));
                 break;
 
         default:
diff --git a/drivers/pinctrl/pinctrl-abx500.h b/drivers/pinctrl/pinctrl-abx500.h
index eeca8f973999..82293806e842 100644
--- a/drivers/pinctrl/pinctrl-abx500.h
+++ b/drivers/pinctrl/pinctrl-abx500.h
@@ -1,4 +1,4 @@
-#ifndef PINCTRL_PINCTRL_ABx5O0_H
+#ifndef PINCTRL_PINCTRL_ABx500_H
 #define PINCTRL_PINCTRL_ABx500_H
 
 /* Package definitions */
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index e939c28cbf1f..46dddc159286 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -504,6 +504,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank,
                         data |= (3 << bit);
                         break;
                 default:
+                        spin_unlock_irqrestore(&bank->slock, flags);
                         dev_err(info->dev, "unsupported pull setting %d\n",
                                 pull);
                         return -EINVAL;
@@ -1453,8 +1454,8 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
         if (ctrl->type == RK3188) {
                 res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
                 info->reg_pull = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(info->reg_base))
-                        return PTR_ERR(info->reg_base);
+                if (IS_ERR(info->reg_pull))
+                        return PTR_ERR(info->reg_pull);
         }
 
         ret = rockchip_gpiolib_register(pdev, info);
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index 009174d07767..bc5eb453a45c 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -3720,7 +3720,7 @@ static void __iomem *r8a7740_pinmux_portcr(struct sh_pfc *pfc, unsigned int pin)
                 const struct r8a7740_portcr_group *group =
                         &r8a7740_portcr_offsets[i];
 
-                if (i <= group->end_pin)
+                if (pin <= group->end_pin)
                         return pfc->window->virt + group->offset + pin;
         }
 
diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7372.c b/drivers/pinctrl/sh-pfc/pfc-sh7372.c
index 70b522d34821..cc097b693820 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7372.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7372.c
@@ -2584,7 +2584,7 @@ static void __iomem *sh7372_pinmux_portcr(struct sh_pfc *pfc, unsigned int pin)
                 const struct sh7372_portcr_group *group =
                         &sh7372_portcr_offsets[i];
 
-                if (i <= group->end_pin)
+                if (pin <= group->end_pin)
                         return pfc->window->virt + group->offset + pin;
         }
 
diff --git a/drivers/platform/Kconfig b/drivers/platform/Kconfig
index 69616aeaa966..09fde58b12e0 100644
--- a/drivers/platform/Kconfig
+++ b/drivers/platform/Kconfig
@@ -5,3 +5,4 @@ if GOLDFISH
 source "drivers/platform/goldfish/Kconfig"
 endif
 
+source "drivers/platform/chrome/Kconfig"
diff --git a/drivers/platform/Makefile b/drivers/platform/Makefile
index 8a44a4cd6d1e..3656b7b17b99 100644
--- a/drivers/platform/Makefile
+++ b/drivers/platform/Makefile
@@ -5,3 +5,4 @@
 obj-$(CONFIG_X86)               += x86/
 obj-$(CONFIG_OLPC)              += olpc/
 obj-$(CONFIG_GOLDFISH)          += goldfish/
+obj-$(CONFIG_CHROME_PLATFORMS)  += chrome/
diff --git a/drivers/platform/chrome/Kconfig b/drivers/platform/chrome/Kconfig
new file mode 100644
index 000000000000..b13303e75a34
--- /dev/null
+++ b/drivers/platform/chrome/Kconfig
@@ -0,0 +1,28 @@
+#
+# Platform support for Chrome OS hardware (Chromebooks and Chromeboxes)
+#
+
+menuconfig CHROME_PLATFORMS
+        bool "Platform support for Chrome hardware"
+        depends on X86
+        ---help---
+          Say Y here to get to see options for platform support for
+          various Chromebooks and Chromeboxes. This option alone does
+          not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
+
+if CHROME_PLATFORMS
+
+config CHROMEOS_LAPTOP
+        tristate "Chrome OS Laptop"
+        depends on I2C
+        depends on DMI
+        ---help---
+          This driver instantiates i2c and smbus devices such as
+          light sensors and touchpads.
+
+          If you have a supported Chromebook, choose Y or M here.
+          The module will be called chromeos_laptop.
+
+endif # CHROMEOS_PLATFORMS
diff --git a/drivers/platform/chrome/Makefile b/drivers/platform/chrome/Makefile
new file mode 100644
index 000000000000..015e9195e226
--- /dev/null
+++ b/drivers/platform/chrome/Makefile
@@ -0,0 +1,2 @@
+
+obj-$(CONFIG_CHROMEOS_LAPTOP)   += chromeos_laptop.o
diff --git a/drivers/platform/x86/chromeos_laptop.c b/drivers/platform/chrome/chromeos_laptop.c
index 3e5b4497a1d0..3e5b4497a1d0 100644
--- a/drivers/platform/x86/chromeos_laptop.c
+++ b/drivers/platform/chrome/chromeos_laptop.c
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index b51a7460cc49..d9dcd37b5a52 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -79,17 +79,6 @@ config ASUS_LAPTOP
 
           If you have an ACPI-compatible ASUS laptop, say Y or M here.
 
-config CHROMEOS_LAPTOP
-        tristate "Chrome OS Laptop"
-        depends on I2C
-        depends on DMI
-        ---help---
-          This driver instantiates i2c and smbus devices such as
-          light sensors and touchpads.
-
-          If you have a supported Chromebook, choose Y or M here.
-          The module will be called chromeos_laptop.
-
 config DELL_LAPTOP
         tristate "Dell Laptop Extras"
         depends on X86
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index 5dbe19324351..f0e6aa407ffb 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -50,7 +50,6 @@ obj-$(CONFIG_INTEL_MID_POWER_BUTTON)	+= intel_mid_powerbtn.o
 obj-$(CONFIG_INTEL_OAKTRAIL)    += intel_oaktrail.o
 obj-$(CONFIG_SAMSUNG_Q10)       += samsung-q10.o
 obj-$(CONFIG_APPLE_GMUX)        += apple-gmux.o
-obj-$(CONFIG_CHROMEOS_LAPTOP)   += chromeos_laptop.o
 obj-$(CONFIG_INTEL_RST)         += intel-rst.o
 obj-$(CONFIG_INTEL_SMARTCONNECT)        += intel-smartconnect.o
 
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 0e9c169b42f8..594323a926cf 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -1494,10 +1494,9 @@ static int asus_input_init(struct asus_laptop *asus)
         int error;
 
         input = input_allocate_device();
-        if (!input) {
-                pr_warn("Unable to allocate input device\n");
+        if (!input)
                 return -ENOMEM;
-        }
+
         input->name = "Asus Laptop extra buttons";
         input->phys = ASUS_LAPTOP_FILE "/input0";
         input->id.bustype = BUS_HOST;
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index bb77e18b3dd4..c608b1d33f4a 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -21,6 +21,7 @@
 #include <linux/err.h>
 #include <linux/dmi.h>
 #include <linux/io.h>
+#include <linux/rfkill.h>
 #include <linux/power_supply.h>
 #include <linux/acpi.h>
 #include <linux/mm.h>
@@ -89,6 +90,13 @@ static struct platform_driver platform_driver = {
 
 static struct platform_device *platform_device;
 static struct backlight_device *dell_backlight_device;
+static struct rfkill *wifi_rfkill;
+static struct rfkill *bluetooth_rfkill;
+static struct rfkill *wwan_rfkill;
+static bool force_rfkill;
+
+module_param(force_rfkill, bool, 0444);
+MODULE_PARM_DESC(force_rfkill, "enable rfkill on non whitelisted models");
 
 static const struct dmi_system_id dell_device_table[] __initconst = {
         {
@@ -355,6 +363,108 @@ dell_send_request(struct calling_interface_buffer *buffer, int class,
         return buffer;
 }
 
+/* Derived from information in DellWirelessCtl.cpp:
+   Class 17, select 11 is radio control. It returns an array of 32-bit values.
+
+   Input byte 0 = 0: Wireless information
+
+   result[0]: return code
+   result[1]:
+     Bit 0:      Hardware switch supported
+     Bit 1:      Wifi locator supported
+     Bit 2:      Wifi is supported
+     Bit 3:      Bluetooth is supported
+     Bit 4:      WWAN is supported
+     Bit 5:      Wireless keyboard supported
+     Bits 6-7:   Reserved
+     Bit 8:      Wifi is installed
+     Bit 9:      Bluetooth is installed
+     Bit 10:     WWAN is installed
+     Bits 11-15: Reserved
+     Bit 16:     Hardware switch is on
+     Bit 17:     Wifi is blocked
+     Bit 18:     Bluetooth is blocked
+     Bit 19:     WWAN is blocked
+     Bits 20-31: Reserved
+   result[2]: NVRAM size in bytes
+   result[3]: NVRAM format version number
+
+   Input byte 0 = 2: Wireless switch configuration
+   result[0]: return code
+   result[1]:
+     Bit 0:      Wifi controlled by switch
+     Bit 1:      Bluetooth controlled by switch
+     Bit 2:      WWAN controlled by switch
+     Bits 3-6:   Reserved
+     Bit 7:      Wireless switch config locked
+     Bit 8:      Wifi locator enabled
+     Bits 9-14:  Reserved
+     Bit 15:     Wifi locator setting locked
+     Bits 16-31: Reserved
+*/
+
+static int dell_rfkill_set(void *data, bool blocked)
+{
+        int disable = blocked ? 1 : 0;
+        unsigned long radio = (unsigned long)data;
+        int hwswitch_bit = (unsigned long)data - 1;
+
+        get_buffer();
+        dell_send_request(buffer, 17, 11);
+
+        /* If the hardware switch controls this radio, and the hardware
+           switch is disabled, always disable the radio */
+        if ((hwswitch_state & BIT(hwswitch_bit)) &&
+            !(buffer->output[1] & BIT(16)))
+                disable = 1;
+
+        buffer->input[0] = (1 | (radio<<8) | (disable << 16));
+        dell_send_request(buffer, 17, 11);
+
+        release_buffer();
+        return 0;
+}
+
+/* Must be called with the buffer held */
+static void dell_rfkill_update_sw_state(struct rfkill *rfkill, int radio,
+                                        int status)
+{
+        if (status & BIT(0)) {
+                /* Has hw-switch, sync sw_state to BIOS */
+                int block = rfkill_blocked(rfkill);
+                buffer->input[0] = (1 | (radio << 8) | (block << 16));
+                dell_send_request(buffer, 17, 11);
+        } else {
+                /* No hw-switch, sync BIOS state to sw_state */
+                rfkill_set_sw_state(rfkill, !!(status & BIT(radio + 16)));
+        }
+}
+
+static void dell_rfkill_update_hw_state(struct rfkill *rfkill, int radio,
+                                        int status)
+{
+        if (hwswitch_state & (BIT(radio - 1)))
+                rfkill_set_hw_state(rfkill, !(status & BIT(16)));
+}
+
+static void dell_rfkill_query(struct rfkill *rfkill, void *data)
+{
+        int status;
+
+        get_buffer();
+        dell_send_request(buffer, 17, 11);
+        status = buffer->output[1];
+
+        dell_rfkill_update_hw_state(rfkill, (unsigned long)data, status);
+
+        release_buffer();
+}
+
+static const struct rfkill_ops dell_rfkill_ops = {
+        .set_block = dell_rfkill_set,
+        .query = dell_rfkill_query,
+};
+
 static struct dentry *dell_laptop_dir;
 
 static int dell_debugfs_show(struct seq_file *s, void *data)
@@ -424,6 +534,136 @@ static const struct file_operations dell_debugfs_fops = {
         .release = single_release,
 };
 
+static void dell_update_rfkill(struct work_struct *ignored)
+{
+        int status;
+
+        get_buffer();
+        dell_send_request(buffer, 17, 11);
+        status = buffer->output[1];
+
+        if (wifi_rfkill) {
+                dell_rfkill_update_hw_state(wifi_rfkill, 1, status);
+                dell_rfkill_update_sw_state(wifi_rfkill, 1, status);
+        }
+        if (bluetooth_rfkill) {
+                dell_rfkill_update_hw_state(bluetooth_rfkill, 2, status);
+                dell_rfkill_update_sw_state(bluetooth_rfkill, 2, status);
+        }
+        if (wwan_rfkill) {
+                dell_rfkill_update_hw_state(wwan_rfkill, 3, status);
+                dell_rfkill_update_sw_state(wwan_rfkill, 3, status);
+        }
+
+        release_buffer();
+}
+static DECLARE_DELAYED_WORK(dell_rfkill_work, dell_update_rfkill);
+
+
+static int __init dell_setup_rfkill(void)
+{
+        int status;
+        int ret;
+        const char *product;
+
+        /*
+         * rfkill causes trouble on various non Latitudes, according to Dell
+         * actually testing the rfkill functionality is only done on Latitudes.
+         */
+        product = dmi_get_system_info(DMI_PRODUCT_NAME);
+        if (!force_rfkill && (!product || strncmp(product, "Latitude", 8)))
+                return 0;
+
+        get_buffer();
+        dell_send_request(buffer, 17, 11);
+        status = buffer->output[1];
+        buffer->input[0] = 0x2;
+        dell_send_request(buffer, 17, 11);
+        hwswitch_state = buffer->output[1];
+        release_buffer();
+
+        if (!(status & BIT(0))) {
+                if (force_rfkill) {
+                        /* No hwsitch, clear all hw-controlled bits */
+                        hwswitch_state &= ~7;
+                } else {
+                        /* rfkill is only tested on laptops with a hwswitch */
+                        return 0;
+                }
+        }
+
+        if ((status & (1<<2|1<<8)) == (1<<2|1<<8)) {
+                wifi_rfkill = rfkill_alloc("dell-wifi", &platform_device->dev,
+                                           RFKILL_TYPE_WLAN,
+                                           &dell_rfkill_ops, (void *) 1);
+                if (!wifi_rfkill) {
+                        ret = -ENOMEM;
+                        goto err_wifi;
+                }
+                ret = rfkill_register(wifi_rfkill);
+                if (ret)
+                        goto err_wifi;
+        }
+
+        if ((status & (1<<3|1<<9)) == (1<<3|1<<9)) {
+                bluetooth_rfkill = rfkill_alloc("dell-bluetooth",
+                                                &platform_device->dev,
+                                                RFKILL_TYPE_BLUETOOTH,
+                                                &dell_rfkill_ops, (void *) 2);
+                if (!bluetooth_rfkill) {
+                        ret = -ENOMEM;
+                        goto err_bluetooth;
+                }
+                ret = rfkill_register(bluetooth_rfkill);
+                if (ret)
+                        goto err_bluetooth;
+        }
+
+        if ((status & (1<<4|1<<10)) == (1<<4|1<<10)) {
+                wwan_rfkill = rfkill_alloc("dell-wwan",
+                                           &platform_device->dev,
+                                           RFKILL_TYPE_WWAN,
+                                           &dell_rfkill_ops, (void *) 3);
+                if (!wwan_rfkill) {
+                        ret = -ENOMEM;
+                        goto err_wwan;
+                }
+                ret = rfkill_register(wwan_rfkill);
+                if (ret)
+                        goto err_wwan;
+        }
+
+        return 0;
+err_wwan:
+        rfkill_destroy(wwan_rfkill);
+        if (bluetooth_rfkill)
+                rfkill_unregister(bluetooth_rfkill);
+err_bluetooth:
+        rfkill_destroy(bluetooth_rfkill);
+        if (wifi_rfkill)
+                rfkill_unregister(wifi_rfkill);
+err_wifi:
+        rfkill_destroy(wifi_rfkill);
+
+        return ret;
+}
+
+static void dell_cleanup_rfkill(void)
+{
+        if (wifi_rfkill) {
+                rfkill_unregister(wifi_rfkill);
+                rfkill_destroy(wifi_rfkill);
+        }
+        if (bluetooth_rfkill) {
+                rfkill_unregister(bluetooth_rfkill);
+                rfkill_destroy(bluetooth_rfkill);
+        }
+        if (wwan_rfkill) {
+                rfkill_unregister(wwan_rfkill);
+                rfkill_destroy(wwan_rfkill);
+        }
+}
+
 static int dell_send_intensity(struct backlight_device *bd)
 {
         int ret = 0;
@@ -515,6 +755,30 @@ static void touchpad_led_exit(void)
         led_classdev_unregister(&touchpad_led);
 }
 
+static bool dell_laptop_i8042_filter(unsigned char data, unsigned char str,
+                              struct serio *port)
+{
+        static bool extended;
+
+        if (str & 0x20)
+                return false;
+
+        if (unlikely(data == 0xe0)) {
+                extended = true;
+                return false;
+        } else if (unlikely(extended)) {
+                switch (data) {
+                case 0x8:
+                        schedule_delayed_work(&dell_rfkill_work,
+                                              round_jiffies_relative(HZ / 4));
+                        break;
+                }
+                extended = false;
+        }
+
+        return false;
+}
+
 static int __init dell_init(void)
 {
         int max_intensity = 0;
@@ -557,10 +821,26 @@ static int __init dell_init(void)
         }
         buffer = page_address(bufferpage);
 
+        ret = dell_setup_rfkill();
+
+        if (ret) {
+                pr_warn("Unable to setup rfkill\n");
+                goto fail_rfkill;
+        }
+
+        ret = i8042_install_filter(dell_laptop_i8042_filter);
+        if (ret) {
+                pr_warn("Unable to install key filter\n");
+                goto fail_filter;
+        }
+
         if (quirks && quirks->touchpad_led)
                 touchpad_led_init(&platform_device->dev);
 
         dell_laptop_dir = debugfs_create_dir("dell_laptop", NULL);
+        if (dell_laptop_dir != NULL)
+                debugfs_create_file("rfkill", 0444, dell_laptop_dir, NULL,
+                                    &dell_debugfs_fops);
 
 #ifdef CONFIG_ACPI
         /* In the event of an ACPI backlight being available, don't
@@ -603,6 +883,11 @@ static int __init dell_init(void)
         return 0;
 
 fail_backlight:
+        i8042_remove_filter(dell_laptop_i8042_filter);
+        cancel_delayed_work_sync(&dell_rfkill_work);
+fail_filter:
+        dell_cleanup_rfkill();
+fail_rfkill:
         free_page((unsigned long)bufferpage);
 fail_buffer:
         platform_device_del(platform_device);
@@ -620,7 +905,10 @@ static void __exit dell_exit(void)
         debugfs_remove_recursive(dell_laptop_dir);
         if (quirks && quirks->touchpad_led)
                 touchpad_led_exit();
+        i8042_remove_filter(dell_laptop_i8042_filter);
+        cancel_delayed_work_sync(&dell_rfkill_work);
         backlight_device_unregister(dell_backlight_device);
+        dell_cleanup_rfkill();
         if (platform_device) {
                 platform_device_unregister(platform_device);
                 platform_driver_unregister(&platform_driver);
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index fa9a2171cc13..60e0900bc117 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -130,7 +130,8 @@ static const u16 bios_to_linux_keycode[256] __initconst = {
         KEY_BRIGHTNESSUP,       KEY_UNKNOWN,    KEY_KBDILLUMTOGGLE,
         KEY_UNKNOWN,    KEY_SWITCHVIDEOMODE,    KEY_UNKNOWN, KEY_UNKNOWN,
         KEY_SWITCHVIDEOMODE,    KEY_UNKNOWN,    KEY_UNKNOWN, KEY_PROG2,
-        KEY_UNKNOWN, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        KEY_UNKNOWN,    KEY_UNKNOWN,    KEY_UNKNOWN,    KEY_UNKNOWN,
+        KEY_UNKNOWN,    KEY_UNKNOWN,    KEY_UNKNOWN,    KEY_MICMUTE,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
@@ -139,8 +140,8 @@ static const u16 bios_to_linux_keycode[256] __initconst = {
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-        KEY_PROG3
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, KEY_PROG3
 };
 
 static struct input_dev *dell_wmi_input_dev;
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index aefcc32e5634..dec68e7a99c7 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -1203,10 +1203,8 @@ static int eeepc_input_init(struct eeepc_laptop *eeepc)
         int error;
 
         input = input_allocate_device();
-        if (!input) {
-                pr_info("Unable to allocate input device\n");
+        if (!input)
                 return -ENOMEM;
-        }
 
         input->name = "Asus EeePC extra buttons";
         input->phys = EEEPC_LAPTOP_FILE "/input0";
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 1c86fa0857c8..8ba8956b5a48 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -54,6 +54,7 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_HARDWARE_QUERY 0x4
 #define HPWMI_WIRELESS_QUERY 0x5
 #define HPWMI_HOTKEY_QUERY 0xc
+#define HPWMI_FEATURE_QUERY 0xd
 #define HPWMI_WIRELESS2_QUERY 0x1b
 #define HPWMI_POSTCODEERROR_QUERY 0x2a
 
@@ -292,6 +293,17 @@ static int hp_wmi_tablet_state(void)
         return (state & 0x4) ? 1 : 0;
 }
 
+static int hp_wmi_bios_2009_later(void)
+{
+        int state = 0;
+        int ret = hp_wmi_perform_query(HPWMI_FEATURE_QUERY, 0, &state,
+                                       sizeof(state), sizeof(state));
+        if (ret)
+                return ret;
+
+        return (state & 0x10) ? 1 : 0;
+}
+
 static int hp_wmi_set_block(void *data, bool blocked)
 {
         enum hp_wmi_radio r = (enum hp_wmi_radio) data;
@@ -871,7 +883,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
         gps_rfkill = NULL;
         rfkill2_count = 0;
 
-        if (hp_wmi_rfkill_setup(device))
+        if (hp_wmi_bios_2009_later() || hp_wmi_rfkill_setup(device))
                 hp_wmi_rfkill2_setup(device);
 
         err = device_create_file(&device->dev, &dev_attr_display);
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 6788acc22ab9..19ec95147f69 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -570,10 +570,8 @@ static int ideapad_input_init(struct ideapad_private *priv)
         int error;
 
         inputdev = input_allocate_device();
-        if (!inputdev) {
-                pr_info("Unable to allocate input device\n");
+        if (!inputdev)
                 return -ENOMEM;
-        }
 
         inputdev->name = "Ideapad extra buttons";
         inputdev->phys = "ideapad/input0";
diff --git a/drivers/platform/x86/intel_mid_powerbtn.c b/drivers/platform/x86/intel_mid_powerbtn.c
index 6b18aba82cfa..8d6775266d66 100644
--- a/drivers/platform/x86/intel_mid_powerbtn.c
+++ b/drivers/platform/x86/intel_mid_powerbtn.c
@@ -66,10 +66,8 @@ static int mfld_pb_probe(struct platform_device *pdev)
                 return -EINVAL;
 
         input = input_allocate_device();
-        if (!input) {
-                dev_err(&pdev->dev, "Input device allocation error\n");
+        if (!input)
                 return -ENOMEM;
-        }
 
         input->name = pdev->name;
         input->phys = "power-button/input0";
diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
index d654f831410d..60ea476a9130 100644
--- a/drivers/platform/x86/intel_scu_ipc.c
+++ b/drivers/platform/x86/intel_scu_ipc.c
@@ -58,12 +58,56 @@
  *    message handler is called within firmware.
  */
 
-#define IPC_BASE_ADDR     0xFF11C000    /* IPC1 base register address */
-#define IPC_MAX_ADDR      0x100         /* Maximum IPC regisers */
 #define IPC_WWBUF_SIZE    20            /* IPC Write buffer Size */
 #define IPC_RWBUF_SIZE    20            /* IPC Read buffer Size */
-#define IPC_I2C_BASE      0xFF12B000    /* I2C control register base address */
-#define IPC_I2C_MAX_ADDR  0x10          /* Maximum I2C regisers */
+#define IPC_IOC           0x100         /* IPC command register IOC bit */
+
+enum {
+        SCU_IPC_LINCROFT,
+        SCU_IPC_PENWELL,
+        SCU_IPC_CLOVERVIEW,
+        SCU_IPC_TANGIER,
+};
+
+/* intel scu ipc driver data*/
+struct intel_scu_ipc_pdata_t {
+        u32 ipc_base;
+        u32 i2c_base;
+        u32 ipc_len;
+        u32 i2c_len;
+        u8 irq_mode;
+};
+
+static struct intel_scu_ipc_pdata_t intel_scu_ipc_pdata[] = {
+        [SCU_IPC_LINCROFT] = {
+                .ipc_base = 0xff11c000,
+                .i2c_base = 0xff12b000,
+                .ipc_len = 0x100,
+                .i2c_len = 0x10,
+                .irq_mode = 0,
+        },
+        [SCU_IPC_PENWELL] = {
+                .ipc_base = 0xff11c000,
+                .i2c_base = 0xff12b000,
+                .ipc_len = 0x100,
+                .i2c_len = 0x10,
+                .irq_mode = 1,
+        },
+        [SCU_IPC_CLOVERVIEW] = {
+                .ipc_base = 0xff11c000,
+                .i2c_base = 0xff12b000,
+                .ipc_len = 0x100,
+                .i2c_len = 0x10,
+                .irq_mode = 1,
+        },
+        [SCU_IPC_TANGIER] = {
+                .ipc_base = 0xff009000,
+                .i2c_base  = 0xff00d000,
+                .ipc_len  = 0x100,
+                .i2c_len = 0x10,
+                .irq_mode = 0,
+        },
+};
 
 static int ipc_probe(struct pci_dev *dev, const struct pci_device_id *id);
 static void ipc_remove(struct pci_dev *pdev);
@@ -72,6 +116,8 @@ struct intel_scu_ipc_dev {
         struct pci_dev *pdev;
         void __iomem *ipc_base;
         void __iomem *i2c_base;
+        struct completion cmd_complete;
+        u8 irq_mode;
 };
 
 static struct intel_scu_ipc_dev  ipcdev; /* Only one for now */
@@ -98,6 +144,10 @@ static DEFINE_MUTEX(ipclock); /* lock used to prevent multiple call to SCU */
  */
 static inline void ipc_command(u32 cmd) /* Send ipc command */
 {
+        if (ipcdev.irq_mode) {
+                reinit_completion(&ipcdev.cmd_complete);
+                writel(cmd | IPC_IOC, ipcdev.ipc_base);
+        }
         writel(cmd, ipcdev.ipc_base);
 }
 
@@ -156,6 +206,30 @@ static inline int busy_loop(void) /* Wait till scu status is busy */
         return 0;
 }
 
+/* Wait till ipc ioc interrupt is received or timeout in 3 HZ */
+static inline int ipc_wait_for_interrupt(void)
+{
+        int status;
+
+        if (!wait_for_completion_timeout(&ipcdev.cmd_complete, 3 * HZ)) {
+                struct device *dev = &ipcdev.pdev->dev;
+                dev_err(dev, "IPC timed out\n");
+                return -ETIMEDOUT;
+        }
+
+        status = ipc_read_status();
+
+        if ((status >> 1) & 1)
+                return -EIO;
+
+        return 0;
+}
+
+int intel_scu_ipc_check_status(void)
+{
+        return ipcdev.irq_mode ? ipc_wait_for_interrupt() : busy_loop();
+}
+
 /* Read/Write power control(PMIC in Langwell, MSIC in PenWell) registers */
 static int pwr_reg_rdwr(u16 *addr, u8 *data, u32 count, u32 op, u32 id)
 {
@@ -196,8 +270,8 @@ static int pwr_reg_rdwr(u16 *addr, u8 *data, u32 count, u32 op, u32 id)
                 ipc_command(4 << 16 |  id << 12 | 0 << 8 | op);
         }
 
-        err = busy_loop();
-        if (id == IPC_CMD_PCNTRL_R) { /* Read rbuf */
+        err = intel_scu_ipc_check_status();
+        if (!err && id == IPC_CMD_PCNTRL_R) { /* Read rbuf */
                 /* Workaround: values are read as 0 without memcpy_fromio */
                 memcpy_fromio(cbuf, ipcdev.ipc_base + 0x90, 16);
                 for (nc = 0; nc < count; nc++)
@@ -391,7 +465,7 @@ int intel_scu_ipc_simple_command(int cmd, int sub)
                 return -ENODEV;
         }
         ipc_command(sub << 12 | cmd);
-        err = busy_loop();
+        err = intel_scu_ipc_check_status();
         mutex_unlock(&ipclock);
         return err;
 }
@@ -425,10 +499,12 @@ int intel_scu_ipc_command(int cmd, int sub, u32 *in, int inlen,
                 ipc_data_writel(*in++, 4 * i);
 
         ipc_command((inlen << 16) | (sub << 12) | cmd);
-        err = busy_loop();
+        err = intel_scu_ipc_check_status();
 
-        for (i = 0; i < outlen; i++)
-                *out++ = ipc_data_readl(4 * i);
+        if (!err) {
+                for (i = 0; i < outlen; i++)
+                        *out++ = ipc_data_readl(4 * i);
+        }
 
         mutex_unlock(&ipclock);
         return err;
@@ -491,6 +567,9 @@ EXPORT_SYMBOL(intel_scu_ipc_i2c_cntrl);
  */
 static irqreturn_t ioc(int irq, void *dev_id)
 {
+        if (ipcdev.irq_mode)
+                complete(&ipcdev.cmd_complete);
+
         return IRQ_HANDLED;
 }
 
@@ -504,13 +583,18 @@ static irqreturn_t ioc(int irq, void *dev_id)
  */
 static int ipc_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
-        int err;
+        int err, pid;
+        struct intel_scu_ipc_pdata_t *pdata;
         resource_size_t pci_resource;
 
         if (ipcdev.pdev)                /* We support only one SCU */
                 return -EBUSY;
 
+        pid = id->driver_data;
+        pdata = &intel_scu_ipc_pdata[pid];
+
         ipcdev.pdev = pci_dev_get(dev);
+        ipcdev.irq_mode = pdata->irq_mode;
 
         err = pci_enable_device(dev);
         if (err)
@@ -524,14 +608,16 @@ static int ipc_probe(struct pci_dev *dev, const struct pci_device_id *id)
         if (!pci_resource)
                 return -ENOMEM;
 
+        init_completion(&ipcdev.cmd_complete);
+
         if (request_irq(dev->irq, ioc, 0, "intel_scu_ipc", &ipcdev))
                 return -EBUSY;
 
-        ipcdev.ipc_base = ioremap_nocache(IPC_BASE_ADDR, IPC_MAX_ADDR);
+        ipcdev.ipc_base = ioremap_nocache(pdata->ipc_base, pdata->ipc_len);
         if (!ipcdev.ipc_base)
                 return -ENOMEM;
 
-        ipcdev.i2c_base = ioremap_nocache(IPC_I2C_BASE, IPC_I2C_MAX_ADDR);
+        ipcdev.i2c_base = ioremap_nocache(pdata->i2c_base, pdata->i2c_len);
         if (!ipcdev.i2c_base) {
                 iounmap(ipcdev.ipc_base);
                 return -ENOMEM;
@@ -564,7 +650,10 @@ static void ipc_remove(struct pci_dev *pdev)
 }
 
 static DEFINE_PCI_DEVICE_TABLE(pci_ids) = {
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x082a)},
+        {PCI_VDEVICE(INTEL, 0x082a), SCU_IPC_LINCROFT},
+        {PCI_VDEVICE(INTEL, 0x080e), SCU_IPC_PENWELL},
+        {PCI_VDEVICE(INTEL, 0x08ea), SCU_IPC_CLOVERVIEW},
+        {PCI_VDEVICE(INTEL, 0x11a0), SCU_IPC_TANGIER},
         { 0,}
 };
 MODULE_DEVICE_TABLE(pci, pci_ids);
diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
index 10d12b221601..3008fd20572e 100644
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -490,11 +490,8 @@ static int acpi_pcc_init_input(struct pcc_acpi *pcc)
         int error;
 
         input_dev = input_allocate_device();
-        if (!input_dev) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
-                                  "Couldn't allocate input device for hotkey"));
+        if (!input_dev)
                 return -ENOMEM;
-        }
 
         input_dev->name = ACPI_PCC_DRIVER_NAME;
         input_dev->phys = ACPI_PCC_INPUT_PHYS;
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 47caab0ea7a1..fb233ae7bb0e 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -140,12 +140,12 @@ MODULE_PARM_DESC(kbd_backlight_timeout,
                  "on the model (default: no change from current value)");
 
 #ifdef CONFIG_PM_SLEEP
-static void sony_nc_kbd_backlight_resume(void);
 static void sony_nc_thermal_resume(void);
 #endif
 static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
                 unsigned int handle);
-static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd);
+static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd,
+                unsigned int handle);
 
 static int sony_nc_battery_care_setup(struct platform_device *pd,
                 unsigned int handle);
@@ -304,8 +304,8 @@ static int sony_laptop_input_keycode_map[] = {
         KEY_FN_F10,     /* 14 SONYPI_EVENT_FNKEY_F10 */
         KEY_FN_F11,     /* 15 SONYPI_EVENT_FNKEY_F11 */
         KEY_FN_F12,     /* 16 SONYPI_EVENT_FNKEY_F12 */
-        KEY_FN_F1,      /* 17 SONYPI_EVENT_FNKEY_1 */
-        KEY_FN_F2,      /* 18 SONYPI_EVENT_FNKEY_2 */
+        KEY_FN_1,       /* 17 SONYPI_EVENT_FNKEY_1 */
+        KEY_FN_2,       /* 18 SONYPI_EVENT_FNKEY_2 */
         KEY_FN_D,       /* 19 SONYPI_EVENT_FNKEY_D */
         KEY_FN_E,       /* 20 SONYPI_EVENT_FNKEY_E */
         KEY_FN_F,       /* 21 SONYPI_EVENT_FNKEY_F */
@@ -1444,7 +1444,7 @@ static void sony_nc_function_cleanup(struct platform_device *pd)
                 case 0x014b:
                 case 0x014c:
                 case 0x0163:
-                        sony_nc_kbd_backlight_cleanup(pd);
+                        sony_nc_kbd_backlight_cleanup(pd, handle);
                         break;
                 default:
                         continue;
@@ -1486,13 +1486,6 @@ static void sony_nc_function_resume(void)
                 case 0x0135:
                         sony_nc_rfkill_update();
                         break;
-                case 0x0137:
-                case 0x0143:
-                case 0x014b:
-                case 0x014c:
-                case 0x0163:
-                        sony_nc_kbd_backlight_resume();
-                        break;
                 default:
                         continue;
                 }
@@ -1822,6 +1815,12 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
         int result;
         int ret = 0;
 
+        if (kbdbl_ctl) {
+                pr_warn("handle 0x%.4x: keyboard backlight setup already done for 0x%.4x\n",
+                                handle, kbdbl_ctl->handle);
+                return -EBUSY;
+        }
+
         /* verify the kbd backlight presence, these handles are not used for
          * keyboard backlight only
          */
@@ -1881,9 +1880,10 @@ outkzalloc:
         return ret;
 }
 
-static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
+static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd,
+                unsigned int handle)
 {
-        if (kbdbl_ctl) {
+        if (kbdbl_ctl && handle == kbdbl_ctl->handle) {
                 device_remove_file(&pd->dev, &kbdbl_ctl->mode_attr);
                 device_remove_file(&pd->dev, &kbdbl_ctl->timeout_attr);
                 kfree(kbdbl_ctl);
@@ -1891,25 +1891,6 @@ static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
         }
 }
 
-#ifdef CONFIG_PM_SLEEP
-static void sony_nc_kbd_backlight_resume(void)
-{
-        int ignore = 0;
-
-        if (!kbdbl_ctl)
-                return;
-
-        if (kbdbl_ctl->mode == 0)
-                sony_call_snc_handle(kbdbl_ctl->handle, kbdbl_ctl->base,
-                                &ignore);
-
-        if (kbdbl_ctl->timeout != 0)
-                sony_call_snc_handle(kbdbl_ctl->handle,
-                                (kbdbl_ctl->base + 0x200) |
-                                (kbdbl_ctl->timeout << 0x10), &ignore);
-}
-#endif
-
 struct battery_care_control {
         struct device_attribute attrs[2];
         unsigned int handle;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 05e046aa5e31..58b0274d24cc 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -6438,7 +6438,12 @@ static struct ibm_struct brightness_driver_data = {
 #define TPACPI_ALSA_SHRTNAME "ThinkPad Console Audio Control"
 #define TPACPI_ALSA_MIXERNAME TPACPI_ALSA_SHRTNAME
 
-static int alsa_index = ~((1 << (SNDRV_CARDS - 3)) - 1); /* last three slots */
+#if SNDRV_CARDS <= 32
+#define DEFAULT_ALSA_IDX                ~((1 << (SNDRV_CARDS - 3)) - 1)
+#else
+#define DEFAULT_ALSA_IDX                ~((1 << (32 - 3)) - 1)
+#endif
+static int alsa_index = DEFAULT_ALSA_IDX; /* last three slots */
 static char *alsa_id = "ThinkPadEC";
 static bool alsa_enable = SNDRV_DEFAULT_ENABLE1;
 
@@ -9163,7 +9168,6 @@ static int __init thinkpad_acpi_module_init(void)
         mutex_init(&tpacpi_inputdev_send_mutex);
         tpacpi_inputdev = input_allocate_device();
         if (!tpacpi_inputdev) {
-                pr_err("unable to allocate input device\n");
                 thinkpad_acpi_module_exit();
                 return -ENOMEM;
         } else {
diff --git a/drivers/platform/x86/topstar-laptop.c b/drivers/platform/x86/topstar-laptop.c
index 67897c8740ba..e597de05e6c2 100644
--- a/drivers/platform/x86/topstar-laptop.c
+++ b/drivers/platform/x86/topstar-laptop.c
@@ -97,10 +97,8 @@ static int acpi_topstar_init_hkey(struct topstar_hkey *hkey)
         int error;
 
         input = input_allocate_device();
-        if (!input) {
-                pr_err("Unable to allocate input device\n");
+        if (!input)
                 return -ENOMEM;
-        }
 
         input->name = "Topstar Laptop extra buttons";
         input->phys = "topstar/input0";
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 0cfadb65f7c6..7fce391818d3 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -975,10 +975,8 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev)
         u32 hci_result;
 
         dev->hotkey_dev = input_allocate_device();
-        if (!dev->hotkey_dev) {
-                pr_info("Unable to register input device\n");
+        if (!dev->hotkey_dev)
                 return -ENOMEM;
-        }
 
         dev->hotkey_dev->name = "Toshiba input device";
         dev->hotkey_dev->phys = "toshiba_acpi/input0";
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 62e8c221d01e..c2e7b2657aeb 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -672,8 +672,10 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
         struct wmi_block *wblock;
 
         wblock = dev_get_drvdata(dev);
-        if (!wblock)
-                return -ENOMEM;
+        if (!wblock) {
+                strcat(buf, "\n");
+                return strlen(buf);
+        }
 
         wmi_gtoa(wblock->gblock.guid, guid_string);
 
diff --git a/drivers/pnp/driver.c b/drivers/pnp/driver.c
index 6936e0acedcd..f748cc8cbb03 100644
--- a/drivers/pnp/driver.c
+++ b/drivers/pnp/driver.c
@@ -197,6 +197,11 @@ static int pnp_bus_freeze(struct device *dev)
         return __pnp_bus_suspend(dev, PMSG_FREEZE);
 }
 
+static int pnp_bus_poweroff(struct device *dev)
+{
+        return __pnp_bus_suspend(dev, PMSG_HIBERNATE);
+}
+
 static int pnp_bus_resume(struct device *dev)
 {
         struct pnp_dev *pnp_dev = to_pnp_dev(dev);
@@ -234,9 +239,14 @@ static int pnp_bus_resume(struct device *dev)
 }
 
 static const struct dev_pm_ops pnp_bus_dev_pm_ops = {
+        /* Suspend callbacks */
         .suspend = pnp_bus_suspend,
-        .freeze = pnp_bus_freeze,
         .resume = pnp_bus_resume,
+        /* Hibernate callbacks */
+        .freeze = pnp_bus_freeze,
+        .thaw = pnp_bus_resume,
+        .poweroff = pnp_bus_poweroff,
+        .restore = pnp_bus_resume,
 };
 
 struct bus_type pnp_bus_type = {
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 8d0fe431dbdd..84419af16f77 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -377,9 +377,14 @@ static void create_power_zone_common_attributes(
         if (power_zone->ops->get_max_energy_range_uj)
                 power_zone->zone_dev_attrs[count++] =
                                         &dev_attr_max_energy_range_uj.attr;
-        if (power_zone->ops->get_energy_uj)
+        if (power_zone->ops->get_energy_uj) {
+                if (power_zone->ops->reset_energy_uj)
+                        dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
+                else
+                        dev_attr_energy_uj.attr.mode = S_IRUGO;
                 power_zone->zone_dev_attrs[count++] =
                                         &dev_attr_energy_uj.attr;
+        }
         if (power_zone->ops->get_power_uw)
                 power_zone->zone_dev_attrs[count++] =
                                         &dev_attr_power_uw.attr;
diff --git a/drivers/regulator/arizona-micsupp.c b/drivers/regulator/arizona-micsupp.c
index 724706a97dc4..fd3154d86901 100644
--- a/drivers/regulator/arizona-micsupp.c
+++ b/drivers/regulator/arizona-micsupp.c
@@ -174,6 +174,33 @@ static const struct regulator_desc arizona_micsupp = {
         .owner = THIS_MODULE,
 };
 
+static const struct regulator_linear_range arizona_micsupp_ext_ranges[] = {
+        REGULATOR_LINEAR_RANGE(900000,  0,    0x14, 25000),
+        REGULATOR_LINEAR_RANGE(1500000, 0x15, 0x27, 100000),
+};
+
+static const struct regulator_desc arizona_micsupp_ext = {
+        .name = "MICVDD",
+        .supply_name = "CPVDD",
+        .type = REGULATOR_VOLTAGE,
+        .n_voltages = 40,
+        .ops = &arizona_micsupp_ops,
+
+        .vsel_reg = ARIZONA_LDO2_CONTROL_1,
+        .vsel_mask = ARIZONA_LDO2_VSEL_MASK,
+        .enable_reg = ARIZONA_MIC_CHARGE_PUMP_1,
+        .enable_mask = ARIZONA_CPMIC_ENA,
+        .bypass_reg = ARIZONA_MIC_CHARGE_PUMP_1,
+        .bypass_mask = ARIZONA_CPMIC_BYPASS,
+
+        .linear_ranges = arizona_micsupp_ext_ranges,
+        .n_linear_ranges = ARRAY_SIZE(arizona_micsupp_ext_ranges),
+
+        .enable_time = 3000,
+
+        .owner = THIS_MODULE,
+};
+
 static const struct regulator_init_data arizona_micsupp_default = {
         .constraints = {
                 .valid_ops_mask = REGULATOR_CHANGE_STATUS |
@@ -186,9 +213,22 @@ static const struct regulator_init_data arizona_micsupp_default = {
         .num_consumer_supplies = 1,
 };
 
+static const struct regulator_init_data arizona_micsupp_ext_default = {
+        .constraints = {
+                .valid_ops_mask = REGULATOR_CHANGE_STATUS |
+                                REGULATOR_CHANGE_VOLTAGE |
+                                REGULATOR_CHANGE_BYPASS,
+                .min_uV = 900000,
+                .max_uV = 3300000,
+        },
+
+        .num_consumer_supplies = 1,
+};
+
 static int arizona_micsupp_probe(struct platform_device *pdev)
 {
         struct arizona *arizona = dev_get_drvdata(pdev->dev.parent);
+        const struct regulator_desc *desc;
         struct regulator_config config = { };
         struct arizona_micsupp *micsupp;
         int ret;
@@ -207,7 +247,17 @@ static int arizona_micsupp_probe(struct platform_device *pdev)
          * default init_data for it.  This will be overridden with
          * platform data if provided.
          */
-        micsupp->init_data = arizona_micsupp_default;
+        switch (arizona->type) {
+        case WM5110:
+                desc = &arizona_micsupp_ext;
+                micsupp->init_data = arizona_micsupp_ext_default;
+                break;
+        default:
+                desc = &arizona_micsupp;
+                micsupp->init_data = arizona_micsupp_default;
+                break;
+        }
+
         micsupp->init_data.consumer_supplies = &micsupp->supply;
         micsupp->supply.supply = "MICVDD";
         micsupp->supply.dev_name = dev_name(arizona->dev);
@@ -226,7 +276,7 @@ static int arizona_micsupp_probe(struct platform_device *pdev)
                            ARIZONA_CPMIC_BYPASS, 0);
 
         micsupp->regulator = devm_regulator_register(&pdev->dev,
-                                                     &arizona_micsupp,
+                                                     desc,
                                                      &config);
         if (IS_ERR(micsupp->regulator)) {
                 ret = PTR_ERR(micsupp->regulator);
diff --git a/drivers/regulator/as3722-regulator.c b/drivers/regulator/as3722-regulator.c
index 5917fe3dc983..b9f1d24c6812 100644
--- a/drivers/regulator/as3722-regulator.c
+++ b/drivers/regulator/as3722-regulator.c
@@ -590,8 +590,8 @@ static int as3722_sd016_set_current_limit(struct regulator_dev *rdev,
         default:
                 return -EINVAL;
         }
+        ret <<= ffs(mask) - 1;
         val = ret & mask;
-        val <<= ffs(mask) - 1;
         return as3722_update_bits(as3722, reg, mask, val);
 }
 
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 6382f0af353b..d85f31385b24 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -119,6 +119,11 @@ static const char *rdev_get_name(struct regulator_dev *rdev)
                 return "";
 }
 
+static bool have_full_constraints(void)
+{
+        return has_full_constraints || of_have_populated_dt();
+}
+
 /**
  * of_get_regulator - get a regulator device node based on supply name
  * @dev: Device pointer for the consumer (of regulator) device
@@ -1340,7 +1345,7 @@ static struct regulator *_regulator_get(struct device *dev, const char *id,
          * Assume that a regulator is physically present and enabled
          * even if it isn't hooked up and just provide a dummy.
          */
-        if (has_full_constraints && allow_dummy) {
+        if (have_full_constraints() && allow_dummy) {
                 pr_warn("%s supply %s not found, using dummy regulator\n",
                         devname, id);
 
@@ -2184,6 +2189,9 @@ int regulator_list_voltage(struct regulator *regulator, unsigned selector)
         struct regulator_ops    *ops = rdev->desc->ops;
         int                     ret;
 
+        if (rdev->desc->fixed_uV && rdev->desc->n_voltages == 1 && !selector)
+                return rdev->desc->fixed_uV;
+
         if (!ops->list_voltage || selector >= rdev->desc->n_voltages)
                 return -EINVAL;
 
@@ -3624,7 +3632,7 @@ int regulator_suspend_finish(void)
                         if (error)
                                 ret = error;
                 } else {
-                        if (!has_full_constraints)
+                        if (!have_full_constraints())
                                 goto unlock;
                         if (!ops->disable)
                                 goto unlock;
@@ -3822,7 +3830,7 @@ static int __init regulator_init_complete(void)
                 if (!enabled)
                         goto unlock;
 
-                if (has_full_constraints) {
+                if (have_full_constraints()) {
                         /* We log since this may kill the system if it
                          * goes wrong. */
                         rdev_info(rdev, "disabling\n");
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index 04406a918c04..234960dc9607 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -139,6 +139,7 @@ of_get_gpio_regulator_config(struct device *dev, struct device_node *np)
         struct property *prop;
         const char *regtype;
         int proplen, gpio, i;
+        int ret;
 
         config = devm_kzalloc(dev,
                         sizeof(struct gpio_regulator_config),
@@ -202,7 +203,11 @@ of_get_gpio_regulator_config(struct device *dev, struct device_node *np)
         }
         config->nr_states = i;
 
-        of_property_read_string(np, "regulator-type", &regtype);
+        ret = of_property_read_string(np, "regulator-type", &regtype);
+        if (ret < 0) {
+                dev_err(dev, "Missing 'regulator-type' property\n");
+                return ERR_PTR(-EINVAL);
+        }
 
         if (!strncmp("voltage", regtype, 7))
                 config->type = REGULATOR_VOLTAGE;
diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index ba67b2c4e2e7..8b5e4c712a01 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -38,7 +38,7 @@
 
 #define PFUZE100_DEVICEID       0x0
 #define PFUZE100_REVID          0x3
-#define PFUZE100_FABID          0x3
+#define PFUZE100_FABID          0x4
 
 #define PFUZE100_SW1ABVOL       0x20
 #define PFUZE100_SW1CVOL        0x2e
@@ -308,9 +308,15 @@ static int pfuze_identify(struct pfuze_chip *pfuze_chip)
         if (ret)
                 return ret;
 
-        if (value & 0x0f) {
-                dev_warn(pfuze_chip->dev, "Illegal ID: %x\n", value);
-                return -ENODEV;
+        switch (value & 0x0f) {
+                /* Freescale misprogrammed 1-3% of parts prior to week 8 of 2013 as ID=8 */
+                case 0x8:
+                        dev_info(pfuze_chip->dev, "Assuming misprogrammed ID=0x8");
+                case 0x0:
+                        break;
+                default:
+                        dev_warn(pfuze_chip->dev, "Illegal ID: %x\n", value);
+                        return -ENODEV;
         }
 
         ret = regmap_read(pfuze_chip->regmap, PFUZE100_REVID, &value);
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index cbf91e25cf7f..aeb40aad0ae7 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -925,7 +925,7 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
                 config.dev = s5m8767->dev;
                 config.init_data = pdata->regulators[i].initdata;
                 config.driver_data = s5m8767;
-                config.regmap = iodev->regmap;
+                config.regmap = iodev->regmap_pmic;
                 config.of_node = pdata->regulators[i].reg_node;
 
                 rdev[i] = devm_regulator_register(&pdev->dev, &regulators[id],
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index c0da95e95702..3281c90691c3 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -220,6 +220,8 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
 
         at91_alarm_year = tm.tm_year;
 
+        tm.tm_mon = alrm->time.tm_mon;
+        tm.tm_mday = alrm->time.tm_mday;
         tm.tm_hour = alrm->time.tm_hour;
         tm.tm_min = alrm->time.tm_min;
         tm.tm_sec = alrm->time.tm_sec;
diff --git a/drivers/rtc/rtc-s5m.c b/drivers/rtc/rtc-s5m.c
index b7fd02bc0a14..ae8119dc2846 100644
--- a/drivers/rtc/rtc-s5m.c
+++ b/drivers/rtc/rtc-s5m.c
@@ -28,10 +28,20 @@
 #include <linux/mfd/samsung/irq.h>
 #include <linux/mfd/samsung/rtc.h>
 
+/*
+ * Maximum number of retries for checking changes in UDR field
+ * of SEC_RTC_UDR_CON register (to limit possible endless loop).
+ *
+ * After writing to RTC registers (setting time or alarm) read the UDR field
+ * in SEC_RTC_UDR_CON register. UDR is auto-cleared when data have
+ * been transferred.
+ */
+#define UDR_READ_RETRY_CNT      5
+
 struct s5m_rtc_info {
         struct device *dev;
         struct sec_pmic_dev *s5m87xx;
-        struct regmap *rtc;
+        struct regmap *regmap;
         struct rtc_device *rtc_dev;
         int irq;
         int device_type;
@@ -84,12 +94,31 @@ static int s5m8767_tm_to_data(struct rtc_time *tm, u8 *data)
         }
 }
 
+/*
+ * Read RTC_UDR_CON register and wait till UDR field is cleared.
+ * This indicates that time/alarm update ended.
+ */
+static inline int s5m8767_wait_for_udr_update(struct s5m_rtc_info *info)
+{
+        int ret, retry = UDR_READ_RETRY_CNT;
+        unsigned int data;
+
+        do {
+                ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
+        } while (--retry && (data & RTC_UDR_MASK) && !ret);
+
+        if (!retry)
+                dev_err(info->dev, "waiting for UDR update, reached max number of retries\n");
+
+        return ret;
+}
+
 static inline int s5m8767_rtc_set_time_reg(struct s5m_rtc_info *info)
 {
         int ret;
         unsigned int data;
 
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
         if (ret < 0) {
                 dev_err(info->dev, "failed to read update reg(%d)\n", ret);
                 return ret;
@@ -98,15 +127,13 @@ static inline int s5m8767_rtc_set_time_reg(struct s5m_rtc_info *info)
         data |= RTC_TIME_EN_MASK;
         data |= RTC_UDR_MASK;
 
-        ret = regmap_write(info->rtc, SEC_RTC_UDR_CON, data);
+        ret = regmap_write(info->regmap, SEC_RTC_UDR_CON, data);
         if (ret < 0) {
                 dev_err(info->dev, "failed to write update reg(%d)\n", ret);
                 return ret;
         }
 
-        do {
-                ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
-        } while ((data & RTC_UDR_MASK) && !ret);
+        ret = s5m8767_wait_for_udr_update(info);
 
         return ret;
 }
@@ -116,7 +143,7 @@ static inline int s5m8767_rtc_set_alarm_reg(struct s5m_rtc_info *info)
         int ret;
         unsigned int data;
 
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
         if (ret < 0) {
                 dev_err(info->dev, "%s: fail to read update reg(%d)\n",
                         __func__, ret);
@@ -126,16 +153,14 @@ static inline int s5m8767_rtc_set_alarm_reg(struct s5m_rtc_info *info)
         data &= ~RTC_TIME_EN_MASK;
         data |= RTC_UDR_MASK;
 
-        ret = regmap_write(info->rtc, SEC_RTC_UDR_CON, data);
+        ret = regmap_write(info->regmap, SEC_RTC_UDR_CON, data);
         if (ret < 0) {
                 dev_err(info->dev, "%s: fail to write update reg(%d)\n",
                         __func__, ret);
                 return ret;
         }
 
-        do {
-                ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
-        } while ((data & RTC_UDR_MASK) && !ret);
+        ret = s5m8767_wait_for_udr_update(info);
 
         return ret;
 }
@@ -178,7 +203,7 @@ static int s5m_rtc_read_time(struct device *dev, struct rtc_time *tm)
         u8 data[8];
         int ret;
 
-        ret = regmap_bulk_read(info->rtc, SEC_RTC_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_RTC_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -226,7 +251,7 @@ static int s5m_rtc_set_time(struct device *dev, struct rtc_time *tm)
                 1900 + tm->tm_year, 1 + tm->tm_mon, tm->tm_mday,
                 tm->tm_hour, tm->tm_min, tm->tm_sec, tm->tm_wday);
 
-        ret = regmap_raw_write(info->rtc, SEC_RTC_SEC, data, 8);
+        ret = regmap_raw_write(info->regmap, SEC_RTC_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -242,20 +267,20 @@ static int s5m_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
         unsigned int val;
         int ret, i;
 
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
         switch (info->device_type) {
         case S5M8763X:
                 s5m8763_data_to_tm(data, &alrm->time);
-                ret = regmap_read(info->rtc, SEC_ALARM0_CONF, &val);
+                ret = regmap_read(info->regmap, SEC_ALARM0_CONF, &val);
                 if (ret < 0)
                         return ret;
 
                 alrm->enabled = !!val;
 
-                ret = regmap_read(info->rtc, SEC_RTC_STATUS, &val);
+                ret = regmap_read(info->regmap, SEC_RTC_STATUS, &val);
                 if (ret < 0)
                         return ret;
 
@@ -278,7 +303,7 @@ static int s5m_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
                 }
 
                 alrm->pending = 0;
-                ret = regmap_read(info->rtc, SEC_RTC_STATUS, &val);
+                ret = regmap_read(info->regmap, SEC_RTC_STATUS, &val);
                 if (ret < 0)
                         return ret;
                 break;
@@ -301,7 +326,7 @@ static int s5m_rtc_stop_alarm(struct s5m_rtc_info *info)
         int ret, i;
         struct rtc_time tm;
 
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -312,14 +337,14 @@ static int s5m_rtc_stop_alarm(struct s5m_rtc_info *info)
 
         switch (info->device_type) {
         case S5M8763X:
-                ret = regmap_write(info->rtc, SEC_ALARM0_CONF, 0);
+                ret = regmap_write(info->regmap, SEC_ALARM0_CONF, 0);
                 break;
 
         case S5M8767X:
                 for (i = 0; i < 7; i++)
                         data[i] &= ~ALARM_ENABLE_MASK;
 
-                ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+                ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
                 if (ret < 0)
                         return ret;
 
@@ -341,7 +366,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
         u8 alarm0_conf;
         struct rtc_time tm;
 
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -353,7 +378,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
         switch (info->device_type) {
         case S5M8763X:
                 alarm0_conf = 0x77;
-                ret = regmap_write(info->rtc, SEC_ALARM0_CONF, alarm0_conf);
+                ret = regmap_write(info->regmap, SEC_ALARM0_CONF, alarm0_conf);
                 break;
 
         case S5M8767X:
@@ -368,7 +393,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
                 if (data[RTC_YEAR1] & 0x7f)
                         data[RTC_YEAR1] |= ALARM_ENABLE_MASK;
 
-                ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+                ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
                 if (ret < 0)
                         return ret;
                 ret = s5m8767_rtc_set_alarm_reg(info);
@@ -410,7 +435,7 @@ static int s5m_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
         if (ret < 0)
                 return ret;
 
-        ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -455,7 +480,7 @@ static const struct rtc_class_ops s5m_rtc_ops = {
 static void s5m_rtc_enable_wtsr(struct s5m_rtc_info *info, bool enable)
 {
         int ret;
-        ret = regmap_update_bits(info->rtc, SEC_WTSR_SMPL_CNTL,
+        ret = regmap_update_bits(info->regmap, SEC_WTSR_SMPL_CNTL,
                                  WTSR_ENABLE_MASK,
                                  enable ? WTSR_ENABLE_MASK : 0);
         if (ret < 0)
@@ -466,7 +491,7 @@ static void s5m_rtc_enable_wtsr(struct s5m_rtc_info *info, bool enable)
 static void s5m_rtc_enable_smpl(struct s5m_rtc_info *info, bool enable)
 {
         int ret;
-        ret = regmap_update_bits(info->rtc, SEC_WTSR_SMPL_CNTL,
+        ret = regmap_update_bits(info->regmap, SEC_WTSR_SMPL_CNTL,
                                  SMPL_ENABLE_MASK,
                                  enable ? SMPL_ENABLE_MASK : 0);
         if (ret < 0)
@@ -481,7 +506,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
         int ret;
         struct rtc_time tm;
 
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &tp_read);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &tp_read);
         if (ret < 0) {
                 dev_err(info->dev, "%s: fail to read control reg(%d)\n",
                         __func__, ret);
@@ -493,7 +518,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
         data[1] = (0 << BCD_EN_SHIFT) | (1 << MODEL24_SHIFT);
 
         info->rtc_24hr_mode = 1;
-        ret = regmap_raw_write(info->rtc, SEC_ALARM0_CONF, data, 2);
+        ret = regmap_raw_write(info->regmap, SEC_ALARM0_CONF, data, 2);
         if (ret < 0) {
                 dev_err(info->dev, "%s: fail to write controlm reg(%d)\n",
                         __func__, ret);
@@ -515,7 +540,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
                 ret = s5m_rtc_set_time(info->dev, &tm);
         }
 
-        ret = regmap_update_bits(info->rtc, SEC_RTC_UDR_CON,
+        ret = regmap_update_bits(info->regmap, SEC_RTC_UDR_CON,
                                  RTC_TCON_MASK, tp_read | RTC_TCON_MASK);
         if (ret < 0)
                 dev_err(info->dev, "%s: fail to update TCON reg(%d)\n",
@@ -542,17 +567,19 @@ static int s5m_rtc_probe(struct platform_device *pdev)
 
         info->dev = &pdev->dev;
         info->s5m87xx = s5m87xx;
-        info->rtc = s5m87xx->rtc;
+        info->regmap = s5m87xx->regmap_rtc;
         info->device_type = s5m87xx->device_type;
         info->wtsr_smpl = s5m87xx->wtsr_smpl;
 
         switch (pdata->device_type) {
         case S5M8763X:
-                info->irq = s5m87xx->irq_base + S5M8763_IRQ_ALARM0;
+                info->irq = regmap_irq_get_virq(s5m87xx->irq_data,
+                                S5M8763_IRQ_ALARM0);
                 break;
 
         case S5M8767X:
-                info->irq = s5m87xx->irq_base + S5M8767_IRQ_RTCA1;
+                info->irq = regmap_irq_get_virq(s5m87xx->irq_data,
+                                S5M8767_IRQ_RTCA1);
                 break;
 
         default:
@@ -596,7 +623,7 @@ static void s5m_rtc_shutdown(struct platform_device *pdev)
         if (info->wtsr_smpl) {
                 for (i = 0; i < 3; i++) {
                         s5m_rtc_enable_wtsr(info, false);
-                        regmap_read(info->rtc, SEC_WTSR_SMPL_CNTL, &val);
+                        regmap_read(info->regmap, SEC_WTSR_SMPL_CNTL, &val);
                         pr_debug("%s: WTSR_SMPL reg(0x%02x)\n", __func__, val);
                         if (val & WTSR_ENABLE_MASK)
                                 pr_emerg("%s: fail to disable WTSR\n",
@@ -612,6 +639,30 @@ static void s5m_rtc_shutdown(struct platform_device *pdev)
         s5m_rtc_enable_smpl(info, false);
 }
 
+static int s5m_rtc_resume(struct device *dev)
+{
+        struct s5m_rtc_info *info = dev_get_drvdata(dev);
+        int ret = 0;
+
+        if (device_may_wakeup(dev))
+                ret = disable_irq_wake(info->irq);
+
+        return ret;
+}
+
+static int s5m_rtc_suspend(struct device *dev)
+{
+        struct s5m_rtc_info *info = dev_get_drvdata(dev);
+        int ret = 0;
+
+        if (device_may_wakeup(dev))
+                ret = enable_irq_wake(info->irq);
+
+        return ret;
+}
+
+static SIMPLE_DEV_PM_OPS(s5m_rtc_pm_ops, s5m_rtc_suspend, s5m_rtc_resume);
+
 static const struct platform_device_id s5m_rtc_id[] = {
         { "s5m-rtc", 0 },
 };
@@ -620,6 +671,7 @@ static struct platform_driver s5m_rtc_driver = {
         .driver         = {
                 .name   = "s5m-rtc",
                 .owner  = THIS_MODULE,
+                .pm     = &s5m_rtc_pm_ops,
         },
         .probe          = s5m_rtc_probe,
         .shutdown       = s5m_rtc_shutdown,
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index cee7e2708a1f..95e45782692f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3224,6 +3224,8 @@ static struct dasd_ccw_req *dasd_eckd_build_cp(struct dasd_device *startdev,
 
         fcx_multitrack = private->features.feature[40] & 0x20;
         data_size = blk_rq_bytes(req);
+        if (data_size % blksize)
+                return ERR_PTR(-EINVAL);
         /* tpm write request add CBC data on each track boundary */
         if (rq_data_dir(req) == WRITE)
                 data_size += (last_trk - first_trk) * 4;
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index f64921756ad6..f224d59c4b6b 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -87,7 +87,6 @@ void dasd_gendisk_free(struct dasd_block *block)
 {
         if (block->gdp) {
                 del_gendisk(block->gdp);
-                block->gdp->queue = NULL;
                 block->gdp->private_data = NULL;
                 put_disk(block->gdp);
                 block->gdp = NULL;
diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
index f7aa080e9b28..1465e9563101 100644
--- a/drivers/s390/char/sclp_early.c
+++ b/drivers/s390/char/sclp_early.c
@@ -35,7 +35,6 @@ struct read_info_sccb {
         u8      _reserved5[4096 - 112]; /* 112-4095 */
 } __packed __aligned(PAGE_SIZE);
 
-static __initdata struct init_sccb early_event_mask_sccb __aligned(PAGE_SIZE);
 static __initdata struct read_info_sccb early_read_info_sccb;
 static __initdata char sccb_early[PAGE_SIZE] __aligned(PAGE_SIZE);
 static unsigned long sclp_hsa_size;
@@ -113,7 +112,7 @@ static void __init sclp_facilities_detect(void)
 
 bool __init sclp_has_linemode(void)
 {
-        struct init_sccb *sccb = &early_event_mask_sccb;
+        struct init_sccb *sccb = (void *) &sccb_early;
 
         if (sccb->header.response_code != 0x20)
                 return 0;
@@ -126,7 +125,7 @@ bool __init sclp_has_linemode(void)
 
 bool __init sclp_has_vt220(void)
 {
-        struct init_sccb *sccb = &early_event_mask_sccb;
+        struct init_sccb *sccb = (void *) &sccb_early;
 
         if (sccb->header.response_code != 0x20)
                 return 0;
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index 5e1e12c0cf42..0a7325361d29 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -2025,7 +2025,8 @@ static struct scsi_host_template driver_template = {
         .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,
         .use_clustering         = ENABLE_CLUSTERING,
         .shost_attrs            = twa_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
index c845bdbeb6c0..4de346017e9f 100644
--- a/drivers/scsi/3w-sas.c
+++ b/drivers/scsi/3w-sas.c
@@ -1600,7 +1600,8 @@ static struct scsi_host_template driver_template = {
         .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,
         .use_clustering         = ENABLE_CLUSTERING,
         .shost_attrs            = twl_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index b9276d10b25c..752624e6bc00 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -2279,7 +2279,8 @@ static struct scsi_host_template driver_template = {
         .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,  
         .use_clustering         = ENABLE_CLUSTERING,
         .shost_attrs            = tw_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index f0d432c139d0..4921ed19a027 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1081,6 +1081,7 @@ static struct scsi_host_template aac_driver_template = {
 #endif
         .use_clustering                 = ENABLE_CLUSTERING,
         .emulated                       = 1,
+        .no_write_same                  = 1,
 };
 
 static void __aac_shutdown(struct aac_dev * aac)
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 97fd450aff09..4f6a30b8e5f9 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -137,6 +137,7 @@ static struct scsi_host_template arcmsr_scsi_host_template = {
         .cmd_per_lun            = ARCMSR_MAX_CMD_PERLUN,
         .use_clustering         = ENABLE_CLUSTERING,
         .shost_attrs            = arcmsr_host_attrs,
+        .no_write_same          = 1,
 };
 static struct pci_device_id arcmsr_device_id_table[] = {
         {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1110)},
diff --git a/drivers/scsi/bfa/bfa_fcs.h b/drivers/scsi/bfa/bfa_fcs.h
index 94d5d0102f7d..42bcb970445a 100644
--- a/drivers/scsi/bfa/bfa_fcs.h
+++ b/drivers/scsi/bfa/bfa_fcs.h
@@ -296,6 +296,7 @@ wwn_t bfa_fcs_lport_get_rport(struct bfa_fcs_lport_s *port, wwn_t wwn,
 struct bfa_fcs_lport_s *bfa_fcs_lookup_port(struct bfa_fcs_s *fcs,
                                             u16 vf_id, wwn_t lpwwn);
 
+void bfa_fcs_lport_set_symname(struct bfa_fcs_lport_s *port, char *symname);
 void bfa_fcs_lport_get_info(struct bfa_fcs_lport_s *port,
                             struct bfa_lport_info_s *port_info);
 void bfa_fcs_lport_get_attr(struct bfa_fcs_lport_s *port,
diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
index 2f61a5af3658..f5e4e61a0fd7 100644
--- a/drivers/scsi/bfa/bfa_fcs_lport.c
+++ b/drivers/scsi/bfa/bfa_fcs_lport.c
@@ -1097,6 +1097,17 @@ bfa_fcs_lport_init(struct bfa_fcs_lport_s *lport,
         bfa_sm_send_event(lport, BFA_FCS_PORT_SM_CREATE);
 }
 
+void
+bfa_fcs_lport_set_symname(struct bfa_fcs_lport_s *port,
+                                char *symname)
+{
+        strcpy(port->port_cfg.sym_name.symname, symname);
+
+        if (bfa_sm_cmp_state(port, bfa_fcs_lport_sm_online))
+                bfa_fcs_lport_ns_util_send_rspn_id(
+                        BFA_FCS_GET_NS_FROM_PORT(port), NULL);
+}
+
 /*
  *  fcs_lport_api
  */
@@ -5140,9 +5151,6 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced)
         u8 *psymbl = &symbl[0];
         int len;
 
-        if (!bfa_sm_cmp_state(port, bfa_fcs_lport_sm_online))
-                return;
-
         /* Avoid sending RSPN in the following states. */
         if (bfa_sm_cmp_state(ns, bfa_fcs_lport_ns_sm_offline) ||
             bfa_sm_cmp_state(ns, bfa_fcs_lport_ns_sm_plogi_sending) ||
diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
index e9a681d31223..40be670a1cbc 100644
--- a/drivers/scsi/bfa/bfad_attr.c
+++ b/drivers/scsi/bfa/bfad_attr.c
@@ -593,11 +593,8 @@ bfad_im_vport_set_symbolic_name(struct fc_vport *fc_vport)
                 return;
 
         spin_lock_irqsave(&bfad->bfad_lock, flags);
-        if (strlen(sym_name) > 0) {
-                strcpy(fcs_vport->lport.port_cfg.sym_name.symname, sym_name);
-                bfa_fcs_lport_ns_util_send_rspn_id(
-                        BFA_FCS_GET_NS_FROM_PORT((&fcs_vport->lport)), NULL);
-        }
+        if (strlen(sym_name) > 0)
+                bfa_fcs_lport_set_symname(&fcs_vport->lport, sym_name);
         spin_unlock_irqrestore(&bfad->bfad_lock, flags);
 }
 
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index ee4fa40a50b1..ce5ef0190bad 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -4684,6 +4684,7 @@ static struct scsi_host_template gdth_template = {
         .cmd_per_lun            = GDTH_MAXC_P_L,
         .unchecked_isa_dma      = 1,
         .use_clustering         = ENABLE_CLUSTERING,
+        .no_write_same          = 1,
 };
 
 #ifdef CONFIG_ISA
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index f334859024c0..f2c5005f312a 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -395,6 +395,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
         shost->use_clustering = sht->use_clustering;
         shost->ordered_tag = sht->ordered_tag;
         shost->eh_deadline = shost_eh_deadline * HZ;
+        shost->no_write_same = sht->no_write_same;
 
         if (sht->supported_mode == MODE_UNKNOWN)
                 /* means we didn't set it ... default to INITIATOR */
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 22f6432eb475..20a5e6ecf945 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -561,6 +561,7 @@ static struct scsi_host_template hpsa_driver_template = {
         .sdev_attrs = hpsa_sdev_attrs,
         .shost_attrs = hpsa_shost_attrs,
         .max_sectors = 8192,
+        .no_write_same = 1,
 };
 
 
@@ -1288,7 +1289,7 @@ static void complete_scsi_command(struct CommandList *cp)
                                         "has check condition: aborted command: "
                                         "ASC: 0x%x, ASCQ: 0x%x\n",
                                         cp, asc, ascq);
-                                cmd->result = DID_SOFT_ERROR << 16;
+                                cmd->result |= DID_SOFT_ERROR << 16;
                                 break;
                         }
                         /* Must be some other type of check condition */
@@ -4925,7 +4926,7 @@ reinit_after_soft_reset:
         hpsa_hba_inquiry(h);
         hpsa_register_scsi(h);  /* hook ourselves into SCSI subsystem */
         start_controller_lockup_detector(h);
-        return 1;
+        return 0;
 
 clean4:
         hpsa_free_sg_chain_blocks(h);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 36ac1c34ce97..573f4128b6b6 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6305,7 +6305,8 @@ static struct scsi_host_template driver_template = {
         .use_clustering = ENABLE_CLUSTERING,
         .shost_attrs = ipr_ioa_attrs,
         .sdev_attrs = ipr_dev_attrs,
-        .proc_name = IPR_NAME
+        .proc_name = IPR_NAME,
+        .no_write_same = 1,
 };
 
 /**
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index 8d5ea8a1e5a6..52a216f21ae5 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -374,6 +374,7 @@ static struct scsi_host_template ips_driver_template = {
         .sg_tablesize           = IPS_MAX_SG,
         .cmd_per_lun            = 3,
         .use_clustering         = ENABLE_CLUSTERING,
+        .no_write_same          = 1,
 };
 
 
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 161c98efade9..d2895836f9fa 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -211,7 +211,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
                 qc->tf.nsect = 0;
         }
 
-        ata_tf_to_fis(&qc->tf, 1, 0, (u8*)&task->ata_task.fis);
+        ata_tf_to_fis(&qc->tf, qc->dev->link->pmp, 1, (u8 *)&task->ata_task.fis);
         task->uldd_task = qc;
         if (ata_is_atapi(qc->tf.protocol)) {
                 memcpy(task->ata_task.atapi_packet, qc->cdb, qc->dev->cdb_len);
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 90c95a3385d1..816db12ef5d5 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4244,6 +4244,7 @@ static struct scsi_host_template megaraid_template = {
         .eh_device_reset_handler        = megaraid_reset,
         .eh_bus_reset_handler           = megaraid_reset,
         .eh_host_reset_handler          = megaraid_reset,
+        .no_write_same                  = 1,
 };
 
 static int
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index d1a4b82836ea..e2237a97cb9d 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -367,6 +367,7 @@ static struct scsi_host_template megaraid_template_g = {
         .eh_host_reset_handler          = megaraid_reset_handler,
         .change_queue_depth             = megaraid_change_queue_depth,
         .use_clustering                 = ENABLE_CLUSTERING,
+        .no_write_same                  = 1,
         .sdev_attrs                     = megaraid_sdev_attrs,
         .shost_attrs                    = megaraid_shost_attrs,
 };
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 0a743a5d1647..c99812bf2a73 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -2148,6 +2148,7 @@ static struct scsi_host_template megasas_template = {
         .bios_param = megasas_bios_param,
         .use_clustering = ENABLE_CLUSTERING,
         .change_queue_depth = megasas_change_queue_depth,
+        .no_write_same = 1,
 };
 
 /**
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index f16ece91b94a..0a1296a87d66 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -3403,6 +3403,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
         unsigned long flags;
         u8 deviceType = pPayload->sas_identify.dev_type;
         port->port_state =  portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPC;
         PM8001_MSG_DBG(pm8001_ha,
                 pm8001_printk("HW_EVENT_SAS_PHY_UP port id = %d, phy id = %d\n",
                 port_id, phy_id));
@@ -3483,6 +3484,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
                 pm8001_printk("HW_EVENT_SATA_PHY_UP port id = %d,"
                 " phy id = %d\n", port_id, phy_id));
         port->port_state =  portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPC;
         port->port_attached = 1;
         pm8001_get_lrate_mode(phy, link_rate);
         phy->phy_type |= PORT_TYPE_SATA;
diff --git a/drivers/scsi/pm8001/pm8001_hwi.h b/drivers/scsi/pm8001/pm8001_hwi.h
index 6d91e2446542..e4867e690c84 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.h
+++ b/drivers/scsi/pm8001/pm8001_hwi.h
@@ -131,6 +131,10 @@
 #define LINKRATE_30                     (0x02 << 8)
 #define LINKRATE_60                     (0x04 << 8)
 
+/* for phy state */
+
+#define PHY_STATE_LINK_UP_SPC           0x1
+
 /* for new SPC controllers MEMBASE III is shared between BIOS and DATA */
 #define GSM_SM_BASE                     0x4F0000
 struct mpi_msg_hdr{
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 34f5f5ffef05..73a120d81b4d 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -175,20 +175,16 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha)
 static void pm8001_tasklet(unsigned long opaque)
 {
         struct pm8001_hba_info *pm8001_ha;
-        u32 vec;
-        pm8001_ha = (struct pm8001_hba_info *)opaque;
+        struct isr_param *irq_vector;
+
+        irq_vector = (struct isr_param *)opaque;
+        pm8001_ha = irq_vector->drv_inst;
         if (unlikely(!pm8001_ha))
                 BUG_ON(1);
-        vec = pm8001_ha->int_vector;
-        PM8001_CHIP_DISP->isr(pm8001_ha, vec);
+        PM8001_CHIP_DISP->isr(pm8001_ha, irq_vector->irq_id);
 }
 #endif
 
-static struct  pm8001_hba_info *outq_to_hba(u8 *outq)
-{
-        return container_of((outq - *outq), struct pm8001_hba_info, outq[0]);
-}
-
 /**
  * pm8001_interrupt_handler_msix - main MSIX interrupt handler.
  * It obtains the vector number and calls the equivalent bottom
@@ -198,18 +194,20 @@ static struct  pm8001_hba_info *outq_to_hba(u8 *outq)
  */
 static irqreturn_t pm8001_interrupt_handler_msix(int irq, void *opaque)
 {
-        struct pm8001_hba_info *pm8001_ha = outq_to_hba(opaque);
-        u8 outq = *(u8 *)opaque;
+        struct isr_param *irq_vector;
+        struct pm8001_hba_info *pm8001_ha;
         irqreturn_t ret = IRQ_HANDLED;
+        irq_vector = (struct isr_param *)opaque;
+        pm8001_ha = irq_vector->drv_inst;
+
         if (unlikely(!pm8001_ha))
                 return IRQ_NONE;
         if (!PM8001_CHIP_DISP->is_our_interupt(pm8001_ha))
                 return IRQ_NONE;
-        pm8001_ha->int_vector = outq;
 #ifdef PM8001_USE_TASKLET
-        tasklet_schedule(&pm8001_ha->tasklet);
+        tasklet_schedule(&pm8001_ha->tasklet[irq_vector->irq_id]);
 #else
-        ret = PM8001_CHIP_DISP->isr(pm8001_ha, outq);
+        ret = PM8001_CHIP_DISP->isr(pm8001_ha, irq_vector->irq_id);
 #endif
         return ret;
 }
@@ -230,9 +228,8 @@ static irqreturn_t pm8001_interrupt_handler_intx(int irq, void *dev_id)
         if (!PM8001_CHIP_DISP->is_our_interupt(pm8001_ha))
                 return IRQ_NONE;
 
-        pm8001_ha->int_vector = 0;
 #ifdef PM8001_USE_TASKLET
-        tasklet_schedule(&pm8001_ha->tasklet);
+        tasklet_schedule(&pm8001_ha->tasklet[0]);
 #else
         ret = PM8001_CHIP_DISP->isr(pm8001_ha, 0);
 #endif
@@ -457,7 +454,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
 {
         struct pm8001_hba_info *pm8001_ha;
         struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
-
+        int j;
 
         pm8001_ha = sha->lldd_ha;
         if (!pm8001_ha)
@@ -480,12 +477,14 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
                 pm8001_ha->iomb_size = IOMB_SIZE_SPC;
 
 #ifdef PM8001_USE_TASKLET
-        /**
-        * default tasklet for non msi-x interrupt handler/first msi-x
-        * interrupt handler
-        **/
-        tasklet_init(&pm8001_ha->tasklet, pm8001_tasklet,
-                        (unsigned long)pm8001_ha);
+        /* Tasklet for non msi-x interrupt handler */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_init(&pm8001_ha->tasklet[0], pm8001_tasklet,
+                        (unsigned long)&(pm8001_ha->irq_vector[0]));
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_init(&pm8001_ha->tasklet[j], pm8001_tasklet,
+                                (unsigned long)&(pm8001_ha->irq_vector[j]));
 #endif
         pm8001_ioremap(pm8001_ha);
         if (!pm8001_alloc(pm8001_ha, ent))
@@ -733,19 +732,20 @@ static u32 pm8001_setup_msix(struct pm8001_hba_info *pm8001_ha)
                         "pci_enable_msix request ret:%d no of intr %d\n",
                                         rc, pm8001_ha->number_of_intr));
 
-                for (i = 0; i < number_of_intr; i++)
-                        pm8001_ha->outq[i] = i;
 
                 for (i = 0; i < number_of_intr; i++) {
                         snprintf(intr_drvname[i], sizeof(intr_drvname[0]),
                                         DRV_NAME"%d", i);
+                        pm8001_ha->irq_vector[i].irq_id = i;
+                        pm8001_ha->irq_vector[i].drv_inst = pm8001_ha;
+
                         if (request_irq(pm8001_ha->msix_entries[i].vector,
                                 pm8001_interrupt_handler_msix, flag,
-                                intr_drvname[i], &pm8001_ha->outq[i])) {
+                                intr_drvname[i], &(pm8001_ha->irq_vector[i]))) {
                                 for (j = 0; j < i; j++)
                                         free_irq(
                                         pm8001_ha->msix_entries[j].vector,
-                                        &pm8001_ha->outq[j]);
+                                        &(pm8001_ha->irq_vector[i]));
                                 pci_disable_msix(pm8001_ha->pdev);
                                 break;
                         }
@@ -907,7 +907,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
 {
         struct sas_ha_struct *sha = pci_get_drvdata(pdev);
         struct pm8001_hba_info *pm8001_ha;
-        int i;
+        int i, j;
         pm8001_ha = sha->lldd_ha;
         sas_unregister_ha(sha);
         sas_remove_host(pm8001_ha->shost);
@@ -921,13 +921,18 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
                 synchronize_irq(pm8001_ha->msix_entries[i].vector);
         for (i = 0; i < pm8001_ha->number_of_intr; i++)
                 free_irq(pm8001_ha->msix_entries[i].vector,
-                                &pm8001_ha->outq[i]);
+                                &(pm8001_ha->irq_vector[i]));
         pci_disable_msix(pdev);
 #else
         free_irq(pm8001_ha->irq, sha);
 #endif
 #ifdef PM8001_USE_TASKLET
-        tasklet_kill(&pm8001_ha->tasklet);
+        /* For non-msix and msix interrupts */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_kill(&pm8001_ha->tasklet[0]);
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_kill(&pm8001_ha->tasklet[j]);
 #endif
         pm8001_free(pm8001_ha);
         kfree(sha->sas_phy);
@@ -948,7 +953,7 @@ static int pm8001_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct sas_ha_struct *sha = pci_get_drvdata(pdev);
         struct pm8001_hba_info *pm8001_ha;
-        int i;
+        int  i, j;
         u32 device_state;
         pm8001_ha = sha->lldd_ha;
         flush_workqueue(pm8001_wq);
@@ -964,13 +969,18 @@ static int pm8001_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                 synchronize_irq(pm8001_ha->msix_entries[i].vector);
         for (i = 0; i < pm8001_ha->number_of_intr; i++)
                 free_irq(pm8001_ha->msix_entries[i].vector,
-                                &pm8001_ha->outq[i]);
+                                &(pm8001_ha->irq_vector[i]));
         pci_disable_msix(pdev);
 #else
         free_irq(pm8001_ha->irq, sha);
 #endif
 #ifdef PM8001_USE_TASKLET
-        tasklet_kill(&pm8001_ha->tasklet);
+        /* For non-msix and msix interrupts */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_kill(&pm8001_ha->tasklet[0]);
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_kill(&pm8001_ha->tasklet[j]);
 #endif
         device_state = pci_choose_state(pdev, state);
         pm8001_printk("pdev=0x%p, slot=%s, entering "
@@ -993,7 +1003,7 @@ static int pm8001_pci_resume(struct pci_dev *pdev)
         struct sas_ha_struct *sha = pci_get_drvdata(pdev);
         struct pm8001_hba_info *pm8001_ha;
         int rc;
-        u8 i = 0;
+        u8 i = 0, j;
         u32 device_state;
         pm8001_ha = sha->lldd_ha;
         device_state = pdev->current_state;
@@ -1033,10 +1043,14 @@ static int pm8001_pci_resume(struct pci_dev *pdev)
         if (rc)
                 goto err_out_disable;
 #ifdef PM8001_USE_TASKLET
-        /* default tasklet for non msi-x interrupt handler/first msi-x
-        * interrupt handler */
-        tasklet_init(&pm8001_ha->tasklet, pm8001_tasklet,
-                        (unsigned long)pm8001_ha);
+        /*  Tasklet for non msi-x interrupt handler */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_init(&pm8001_ha->tasklet[0], pm8001_tasklet,
+                        (unsigned long)&(pm8001_ha->irq_vector[0]));
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_init(&pm8001_ha->tasklet[j], pm8001_tasklet,
+                                (unsigned long)&(pm8001_ha->irq_vector[j]));
 #endif
         PM8001_CHIP_DISP->interrupt_enable(pm8001_ha, 0);
         if (pm8001_ha->chip_id != chip_8001) {
@@ -1169,6 +1183,7 @@ module_exit(pm8001_exit);
 MODULE_AUTHOR("Jack Wang <jack_wang@usish.com>");
 MODULE_AUTHOR("Anand Kumar Santhanam <AnandKumar.Santhanam@pmcs.com>");
 MODULE_AUTHOR("Sangeetha Gnanasekaran <Sangeetha.Gnanasekaran@pmcs.com>");
+MODULE_AUTHOR("Nikith Ganigarakoppal <Nikith.Ganigarakoppal@pmcs.com>");
 MODULE_DESCRIPTION(
                 "PMC-Sierra PM8001/8081/8088/8089/8074/8076/8077 "
                 "SAS/SATA controller driver");
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index f4eb18e51631..f50ac44b950e 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -1098,15 +1098,17 @@ int pm8001_lu_reset(struct domain_device *dev, u8 *lun)
         struct pm8001_tmf_task tmf_task;
         struct pm8001_device *pm8001_dev = dev->lldd_dev;
         struct pm8001_hba_info *pm8001_ha = pm8001_find_ha_by_dev(dev);
+        DECLARE_COMPLETION_ONSTACK(completion_setstate);
         if (dev_is_sata(dev)) {
                 struct sas_phy *phy = sas_get_local_phy(dev);
                 rc = pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev ,
                         dev, 1, 0);
                 rc = sas_phy_reset(phy, 1);
                 sas_put_local_phy(phy);
+                pm8001_dev->setds_completion = &completion_setstate;
                 rc = PM8001_CHIP_DISP->set_dev_state_req(pm8001_ha,
                         pm8001_dev, 0x01);
-                msleep(2000);
+                wait_for_completion(&completion_setstate);
         } else {
                 tmf_task.tmf = TMF_LU_RESET;
                 rc = pm8001_issue_ssp_tmf(dev, lun, &tmf_task);
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
index 6037d477a183..6c5fd5ee22d3 100644
--- a/drivers/scsi/pm8001/pm8001_sas.h
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -466,6 +466,10 @@ struct pm8001_hba_memspace {
         u64                     membase;
         u32                     memsize;
 };
+struct isr_param {
+        struct pm8001_hba_info *drv_inst;
+        u32 irq_id;
+};
 struct pm8001_hba_info {
         char                    name[PM8001_NAME_LENGTH];
         struct list_head        list;
@@ -519,14 +523,13 @@ struct pm8001_hba_info {
         int                     number_of_intr;/*will be used in remove()*/
 #endif
 #ifdef PM8001_USE_TASKLET
-        struct tasklet_struct   tasklet;
+        struct tasklet_struct   tasklet[PM8001_MAX_MSIX_VEC];
 #endif
         u32                     logging_level;
         u32                     fw_status;
         u32                     smp_exp_mode;
-        u32                     int_vector;
         const struct firmware   *fw_image;
-        u8                      outq[PM8001_MAX_MSIX_VEC];
+        struct isr_param irq_vector[PM8001_MAX_MSIX_VEC];
 };
 
 struct pm8001_work {
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 8987b1706216..c950dc5c9943 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -2894,6 +2894,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
         unsigned long flags;
         u8 deviceType = pPayload->sas_identify.dev_type;
         port->port_state = portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPCV;
         PM8001_MSG_DBG(pm8001_ha, pm8001_printk(
                 "portid:%d; phyid:%d; linkrate:%d; "
                 "portstate:%x; devicetype:%x\n",
@@ -2978,6 +2979,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
                                 port_id, phy_id, link_rate, portstate));
 
         port->port_state = portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPCV;
         port->port_attached = 1;
         pm8001_get_lrate_mode(phy, link_rate);
         phy->phy_type |= PORT_TYPE_SATA;
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
index c86816bea424..9970a385795d 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.h
+++ b/drivers/scsi/pm8001/pm80xx_hwi.h
@@ -215,6 +215,8 @@
 #define SAS_DOPNRJT_RTRY_TMO            128
 #define SAS_COPNRJT_RTRY_TMO            128
 
+/* for phy state */
+#define PHY_STATE_LINK_UP_SPCV          0x2
 /*
   Making ORR bigger than IT NEXUS LOSS which is 2000000us = 2 second.
   Assuming a bigger value 3 second, 3000000/128 = 23437.5 where 128
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index bd6f743d87a7..be8ce54f99b2 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -1404,11 +1404,22 @@ enum {
 };
 #define PMCRAID_AEN_CMD_MAX (__PMCRAID_AEN_CMD_MAX - 1)
 
+static struct genl_multicast_group pmcraid_mcgrps[] = {
+        { .name = "events", /* not really used - see ID discussion below */ },
+};
+
 static struct genl_family pmcraid_event_family = {
-        .id = GENL_ID_GENERATE,
+        /*
+         * Due to prior multicast group abuse (the code having assumed that
+         * the family ID can be used as a multicast group ID) we need to
+         * statically allocate a family (and thus group) ID.
+         */
+        .id = GENL_ID_PMCRAID,
         .name = "pmcraid",
         .version = 1,
-        .maxattr = PMCRAID_AEN_ATTR_MAX
+        .maxattr = PMCRAID_AEN_ATTR_MAX,
+        .mcgrps = pmcraid_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(pmcraid_mcgrps),
 };
 
 /**
@@ -1511,9 +1522,8 @@ static int pmcraid_notify_aen(
                 return result;
         }
 
-        result =
-                genlmsg_multicast(&pmcraid_event_family, skb, 0,
-                                  pmcraid_event_family.id, GFP_ATOMIC);
+        result = genlmsg_multicast(&pmcraid_event_family, skb,
+                                   0, 0, GFP_ATOMIC);
 
         /* If there are no listeners, genlmsg_multicast may return non-zero
          * value.
@@ -4315,6 +4325,7 @@ static struct scsi_host_template pmcraid_host_template = {
         .this_id = -1,
         .sg_tablesize = PMCRAID_MAX_IOADLS,
         .max_sectors = PMCRAID_IOA_MAX_SECTORS,
+        .no_write_same = 1,
         .cmd_per_lun = PMCRAID_MAX_CMD_PER_LUN,
         .use_clustering = ENABLE_CLUSTERING,
         .shost_attrs = pmcraid_host_attrs,
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e6c4bff04339..69725f7c32c1 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2659,6 +2659,12 @@ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer)
 {
         struct scsi_device *sdev = sdkp->device;
 
+        if (sdev->host->no_write_same) {
+                sdev->no_write_same = 1;
+
+                return;
+        }
+
         if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, INQUIRY) < 0) {
                 /* too large values might cause issues with arcmsr */
                 int vpd_buf_len = 64;
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 1a28f5632797..17d740427240 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1697,6 +1697,7 @@ static struct scsi_host_template scsi_driver = {
         .use_clustering =       DISABLE_CLUSTERING,
         /* Make sure we dont get a sg segment crosses a page boundary */
         .dma_boundary =         PAGE_SIZE-1,
+        .no_write_same =        1,
 };
 
 enum {
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 3ed666fe840a..9025edd7dc45 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -377,7 +377,7 @@ out_master_put:
 
 static int bcm2835_spi_remove(struct platform_device *pdev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+        struct spi_master *master = platform_get_drvdata(pdev);
         struct bcm2835_spi *bs = spi_master_get_devdata(master);
 
         free_irq(bs->irq, master);
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 80d56b214eb5..469ecd876358 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -435,7 +435,7 @@ out:
 
 static int bcm63xx_spi_remove(struct platform_device *pdev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+        struct spi_master *master = platform_get_drvdata(pdev);
         struct bcm63xx_spi *bs = spi_master_get_devdata(master);
 
         /* reset spi block */
diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
index 9602bbd8d7ea..87676587d783 100644
--- a/drivers/spi/spi-mpc512x-psc.c
+++ b/drivers/spi/spi-mpc512x-psc.c
@@ -557,7 +557,7 @@ free_master:
 
 static int mpc512x_psc_spi_do_remove(struct device *dev)
 {
-        struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
+        struct spi_master *master = dev_get_drvdata(dev);
         struct mpc512x_psc_spi *mps = spi_master_get_devdata(master);
 
         clk_disable_unprepare(mps->clk_mclk);
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index 73afb56c08cc..3adebfa22e3d 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -565,7 +565,7 @@ static int mxs_spi_remove(struct platform_device *pdev)
         struct mxs_spi *spi;
         struct mxs_ssp *ssp;
 
-        master = spi_master_get(platform_get_drvdata(pdev));
+        master = platform_get_drvdata(pdev);
         spi = spi_master_get_devdata(master);
         ssp = &spi->ssp;
 
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index cb0e1f1137ad..7765b1999537 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1073,6 +1073,8 @@ pxa2xx_spi_acpi_get_pdata(struct platform_device *pdev)
 static struct acpi_device_id pxa2xx_spi_acpi_match[] = {
         { "INT33C0", 0 },
         { "INT33C1", 0 },
+        { "INT3430", 0 },
+        { "INT3431", 0 },
         { "80860F0E", 0 },
         { },
 };
@@ -1291,6 +1293,9 @@ static int pxa2xx_spi_resume(struct device *dev)
         /* Enable the SSP clock */
         clk_prepare_enable(ssp->clk);
 
+        /* Restore LPSS private register bits */
+        lpss_ssp_setup(drv_data);
+
         /* Start the queue running */
         status = spi_master_resume(drv_data->master);
         if (status != 0) {
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 58449ad4ad0d..9e829cee7357 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -885,14 +885,13 @@ static void rspi_release_dma(struct rspi_data *rspi)
 
 static int rspi_remove(struct platform_device *pdev)
 {
-        struct rspi_data *rspi = spi_master_get(platform_get_drvdata(pdev));
+        struct rspi_data *rspi = platform_get_drvdata(pdev);
 
         spi_unregister_master(rspi->master);
         rspi_release_dma(rspi);
         free_irq(platform_get_irq(pdev, 0), rspi);
         clk_put(rspi->clk);
         iounmap(rspi->addr);
-        spi_master_put(rspi->master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 0b71270fbf67..4396bd448540 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -161,7 +161,7 @@ static int ti_qspi_setup(struct spi_device *spi)
                         qspi->spi_max_frequency, clk_div);
 
         ret = pm_runtime_get_sync(qspi->dev);
-        if (ret) {
+        if (ret < 0) {
                 dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
                 return ret;
         }
@@ -459,11 +459,10 @@ static int ti_qspi_probe(struct platform_device *pdev)
         if (!of_property_read_u32(np, "num-cs", &num_cs))
                 master->num_chipselect = num_cs;
 
-        platform_set_drvdata(pdev, master);
-
         qspi = spi_master_get_devdata(master);
         qspi->master = master;
         qspi->dev = &pdev->dev;
+        platform_set_drvdata(pdev, qspi);
 
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 
@@ -517,10 +516,26 @@ free_master:
 
 static int ti_qspi_remove(struct platform_device *pdev)
 {
-        struct  ti_qspi *qspi = platform_get_drvdata(pdev);
+        struct spi_master *master;
+        struct ti_qspi *qspi;
+        int ret;
+
+        master = platform_get_drvdata(pdev);
+        qspi = spi_master_get_devdata(master);
+
+        ret = pm_runtime_get_sync(qspi->dev);
+        if (ret < 0) {
+                dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
+                return ret;
+        }
 
         ti_qspi_write(qspi, QSPI_WC_INT_DISABLE, QSPI_INTR_ENABLE_CLEAR_REG);
 
+        pm_runtime_put(qspi->dev);
+        pm_runtime_disable(&pdev->dev);
+
+        spi_unregister_master(master);
+
         return 0;
 }
 
diff --git a/drivers/spi/spi-txx9.c b/drivers/spi/spi-txx9.c
index 637cce2b8bdd..18c9bb2b5f39 100644
--- a/drivers/spi/spi-txx9.c
+++ b/drivers/spi/spi-txx9.c
@@ -425,7 +425,7 @@ exit:
 
 static int txx9spi_remove(struct platform_device *dev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(dev));
+        struct spi_master *master = platform_get_drvdata(dev);
         struct txx9spi *c = spi_master_get_devdata(master);
 
         destroy_workqueue(c->workqueue);
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 18cc625d887f..349ebba4b199 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1415,7 +1415,7 @@ int devm_spi_register_master(struct device *dev, struct spi_master *master)
                 return -ENOMEM;
 
         ret = spi_register_master(master);
-        if (ret != 0) {
+        if (!ret) {
                 *ptr = master;
                 devres_add(dev, ptr);
         } else {
diff --git a/drivers/staging/btmtk_usb/btmtk_usb.c b/drivers/staging/btmtk_usb/btmtk_usb.c
index 7a9bf3b57810..9a5ebd6cc512 100644
--- a/drivers/staging/btmtk_usb/btmtk_usb.c
+++ b/drivers/staging/btmtk_usb/btmtk_usb.c
@@ -1284,9 +1284,8 @@ done:
         kfree_skb(skb);
 }
 
-static int btmtk_usb_send_frame(struct sk_buff *skb)
+static int btmtk_usb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_dev *hdev = (struct hci_dev *)skb->dev;
         struct btmtk_usb_data *data = hci_get_drvdata(hdev);
         struct usb_ctrlrequest *dr;
         struct urb *urb;
diff --git a/drivers/staging/comedi/drivers/pcl730.c b/drivers/staging/comedi/drivers/pcl730.c
index d041b714db29..2baaf1db6fbf 100644
--- a/drivers/staging/comedi/drivers/pcl730.c
+++ b/drivers/staging/comedi/drivers/pcl730.c
@@ -173,11 +173,11 @@ static int pcl730_do_insn_bits(struct comedi_device *dev,
         if (mask) {
                 if (mask & 0x00ff)
                         outb(s->state & 0xff, dev->iobase + reg);
-                if ((mask & 0xff00) & (s->n_chan > 8))
+                if ((mask & 0xff00) && (s->n_chan > 8))
                         outb((s->state >> 8) & 0xff, dev->iobase + reg + 1);
-                if ((mask & 0xff0000) & (s->n_chan > 16))
+                if ((mask & 0xff0000) && (s->n_chan > 16))
                         outb((s->state >> 16) & 0xff, dev->iobase + reg + 2);
-                if ((mask & 0xff000000) & (s->n_chan > 24))
+                if ((mask & 0xff000000) && (s->n_chan > 24))
                         outb((s->state >> 24) & 0xff, dev->iobase + reg + 3);
         }
 
diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
index 6815cfe2664e..b486099b543d 100644
--- a/drivers/staging/comedi/drivers/s626.c
+++ b/drivers/staging/comedi/drivers/s626.c
@@ -494,7 +494,7 @@ static void s626_send_dac(struct comedi_device *dev, uint32_t val)
  * Private helper function: Write setpoint to an application DAC channel.
  */
 static void s626_set_dac(struct comedi_device *dev, uint16_t chan,
-                         unsigned short dacdata)
+                         int16_t dacdata)
 {
         struct s626_private *devpriv = dev->private;
         uint16_t signmask;
diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 933b01a0f03d..0adf3cffddb0 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -465,7 +465,7 @@ static int vmk80xx_do_insn_bits(struct comedi_device *dev,
         unsigned char *rx_buf = devpriv->usb_rx_buf;
         unsigned char *tx_buf = devpriv->usb_tx_buf;
         int reg, cmd;
-        int ret;
+        int ret = 0;
 
         if (devpriv->model == VMK8061_MODEL) {
                 reg = VMK8061_DO_REG;
diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_download.c b/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
index 68ded17c0f5c..12f333fa59b5 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
@@ -578,7 +578,7 @@ static int request_code_segment(struct ft1000_usb *ft1000dev, u16 **s_file,
                  u8 **c_file, const u8 *endpoint, bool boot_case)
 {
         long word_length;
-        int status;
+        int status = 0;
 
         /*DEBUG("FT1000:REQUEST_CODE_SEGMENT\n");i*/
         word_length = get_request_value(ft1000dev);
@@ -1074,4 +1074,3 @@ int scram_dnldr(struct ft1000_usb *ft1000dev, void *pFileStart,
 
         return status;
 }
-
diff --git a/drivers/staging/iio/magnetometer/Kconfig b/drivers/staging/iio/magnetometer/Kconfig
index a3ea69e9d800..34634da1f9f7 100644
--- a/drivers/staging/iio/magnetometer/Kconfig
+++ b/drivers/staging/iio/magnetometer/Kconfig
@@ -6,6 +6,8 @@ menu "Magnetometer sensors"
 config SENSORS_HMC5843
         tristate "Honeywell HMC5843/5883/5883L 3-Axis Magnetometer"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say Y here to add support for the Honeywell HMC5843, HMC5883 and
           HMC5883L 3-Axis Magnetometer (digital compass).
diff --git a/drivers/staging/imx-drm/Makefile b/drivers/staging/imx-drm/Makefile
index 2c3a9e178fb5..8742432d7b01 100644
--- a/drivers/staging/imx-drm/Makefile
+++ b/drivers/staging/imx-drm/Makefile
@@ -8,4 +8,6 @@ obj-$(CONFIG_DRM_IMX_TVE) += imx-tve.o
 obj-$(CONFIG_DRM_IMX_LDB) += imx-ldb.o
 obj-$(CONFIG_DRM_IMX_FB_HELPER) += imx-fbdev.o
 obj-$(CONFIG_DRM_IMX_IPUV3_CORE) += ipu-v3/
-obj-$(CONFIG_DRM_IMX_IPUV3)     += ipuv3-crtc.o ipuv3-plane.o
+
+imx-ipuv3-crtc-objs  := ipuv3-crtc.o ipuv3-plane.o
+obj-$(CONFIG_DRM_IMX_IPUV3)     += imx-ipuv3-crtc.o
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 51aa9772f959..6bd015ac9d68 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -72,6 +72,7 @@ int imx_drm_crtc_id(struct imx_drm_crtc *crtc)
 {
         return crtc->pipe;
 }
+EXPORT_SYMBOL_GPL(imx_drm_crtc_id);
 
 static void imx_drm_driver_lastclose(struct drm_device *drm)
 {
diff --git a/drivers/staging/lustre/lustre/ptlrpc/pinger.c b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
index 5dec771d70ee..4d340f4a2198 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/pinger.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
@@ -409,8 +409,8 @@ int ptlrpc_stop_pinger(void)
         struct l_wait_info lwi = { 0 };
         int rc = 0;
 
-        if (!thread_is_init(&pinger_thread) &&
-            !thread_is_stopped(&pinger_thread))
+        if (thread_is_init(&pinger_thread) ||
+            thread_is_stopped(&pinger_thread))
                 return -EALREADY;
 
         ptlrpc_pinger_remove_timeouts();
diff --git a/drivers/staging/media/go7007/go7007-usb.c b/drivers/staging/media/go7007/go7007-usb.c
index 58684da45e6c..b658c2316df3 100644
--- a/drivers/staging/media/go7007/go7007-usb.c
+++ b/drivers/staging/media/go7007/go7007-usb.c
@@ -15,6 +15,8 @@
  * Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -661,7 +663,7 @@ static int go7007_usb_interface_reset(struct go7007 *go)
 
         if (usb->board->flags & GO7007_USB_EZUSB) {
                 /* Reset buffer in EZ-USB */
-                dev_dbg(go->dev, "resetting EZ-USB buffers\n");
+                pr_debug("resetting EZ-USB buffers\n");
                 if (go7007_usb_vendor_request(go, 0x10, 0, 0, NULL, 0, 0) < 0 ||
                     go7007_usb_vendor_request(go, 0x10, 0, 0, NULL, 0, 0) < 0)
                         return -1;
@@ -689,7 +691,7 @@ static int go7007_usb_ezusb_write_interrupt(struct go7007 *go,
         u16 status_reg = 0;
         int timeout = 500;
 
-        dev_dbg(go->dev, "WriteInterrupt: %04x %04x\n", addr, data);
+        pr_debug("WriteInterrupt: %04x %04x\n", addr, data);
 
         for (i = 0; i < 100; ++i) {
                 r = usb_control_msg(usb->usbdev,
@@ -734,7 +736,7 @@ static int go7007_usb_onboard_write_interrupt(struct go7007 *go,
         int r;
         int timeout = 500;
 
-        dev_dbg(go->dev, "WriteInterrupt: %04x %04x\n", addr, data);
+        pr_debug("WriteInterrupt: %04x %04x\n", addr, data);
 
         go->usb_buf[0] = data & 0xff;
         go->usb_buf[1] = data >> 8;
@@ -771,7 +773,7 @@ static void go7007_usb_readinterrupt_complete(struct urb *urb)
                 go->interrupt_available = 1;
                 go->interrupt_data = __le16_to_cpu(regs[0]);
                 go->interrupt_value = __le16_to_cpu(regs[1]);
-                dev_dbg(go->dev, "ReadInterrupt: %04x %04x\n",
+                pr_debug("ReadInterrupt: %04x %04x\n",
                                 go->interrupt_value, go->interrupt_data);
         }
 
@@ -891,7 +893,7 @@ static int go7007_usb_send_firmware(struct go7007 *go, u8 *data, int len)
         int transferred, pipe;
         int timeout = 500;
 
-        dev_dbg(go->dev, "DownloadBuffer sending %d bytes\n", len);
+        pr_debug("DownloadBuffer sending %d bytes\n", len);
 
         if (usb->board->flags & GO7007_USB_EZUSB)
                 pipe = usb_sndbulkpipe(usb->usbdev, 2);
@@ -977,7 +979,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                                 !(msgs[i].flags & I2C_M_RD) &&
                                 (msgs[i + 1].flags & I2C_M_RD)) {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c write/read %d/%d bytes on %02x\n",
+                        pr_debug("i2c write/read %d/%d bytes on %02x\n",
                                 msgs[i].len, msgs[i + 1].len, msgs[i].addr);
 #endif
                         buf[0] = 0x01;
@@ -988,7 +990,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                         buf[buf_len++] = msgs[++i].len;
                 } else if (msgs[i].flags & I2C_M_RD) {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c read %d bytes on %02x\n",
+                        pr_debug("i2c read %d bytes on %02x\n",
                                         msgs[i].len, msgs[i].addr);
 #endif
                         buf[0] = 0x01;
@@ -998,7 +1000,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                         buf_len = 4;
                 } else {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c write %d bytes on %02x\n",
+                        pr_debug("i2c write %d bytes on %02x\n",
                                         msgs[i].len, msgs[i].addr);
 #endif
                         buf[0] = 0x00;
@@ -1057,7 +1059,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
         char *name;
         int video_pipe, i, v_urb_len;
 
-        dev_dbg(go->dev, "probing new GO7007 USB board\n");
+        pr_debug("probing new GO7007 USB board\n");
 
         switch (id->driver_info) {
         case GO7007_BOARDID_MATRIX_II:
@@ -1097,13 +1099,13 @@ static int go7007_usb_probe(struct usb_interface *intf,
                 board = &board_px_tv402u;
                 break;
         case GO7007_BOARDID_LIFEVIEW_LR192:
-                dev_err(go->dev, "The Lifeview TV Walker Ultra is not supported. Sorry!\n");
+                dev_err(&intf->dev, "The Lifeview TV Walker Ultra is not supported. Sorry!\n");
                 return -ENODEV;
                 name = "Lifeview TV Walker Ultra";
                 board = &board_lifeview_lr192;
                 break;
         case GO7007_BOARDID_SENSORAY_2250:
-                dev_info(go->dev, "Sensoray 2250 found\n");
+                dev_info(&intf->dev, "Sensoray 2250 found\n");
                 name = "Sensoray 2250/2251";
                 board = &board_sensoray_2250;
                 break;
@@ -1112,7 +1114,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
                 board = &board_ads_usbav_709;
                 break;
         default:
-                dev_err(go->dev, "unknown board ID %d!\n",
+                dev_err(&intf->dev, "unknown board ID %d!\n",
                                 (unsigned int)id->driver_info);
                 return -ENODEV;
         }
@@ -1247,7 +1249,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
                                         sizeof(go->name));
                         break;
                 default:
-                        dev_dbg(go->dev, "unable to detect tuner type!\n");
+                        pr_debug("unable to detect tuner type!\n");
                         break;
                 }
                 /* Configure tuner mode selection inputs connected
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 3066ee2e753b..49ea76b3435d 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -681,7 +681,8 @@ static irqreturn_t nvec_interrupt(int irq, void *dev)
                         dev_err(nvec->dev,
                                 "RX buffer overflow on %p: "
                                 "Trying to write byte %u of %u\n",
-                                nvec->rx, nvec->rx->pos, NVEC_MSG_SIZE);
+                                nvec->rx, nvec->rx ? nvec->rx->pos : 0,
+                                NVEC_MSG_SIZE);
                 break;
         default:
                 nvec->state = 0;
diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
index 2c678f409573..2f548ebada59 100644
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -1115,6 +1115,9 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
                         return _FAIL;
         }
 
+        /* fix bug of flush_cam_entry at STOP AP mode */
+        psta->state |= WIFI_AP_STATE;
+        rtw_indicate_connect(padapter);
         pmlmepriv->cur_network.join_res = true;/* for check if already set beacon */
         return ret;
 }
diff --git a/drivers/staging/tidspbridge/Kconfig b/drivers/staging/tidspbridge/Kconfig
index 165b918b8171..1b6d581c438b 100644
--- a/drivers/staging/tidspbridge/Kconfig
+++ b/drivers/staging/tidspbridge/Kconfig
@@ -4,7 +4,7 @@
 
 menuconfig TIDSPBRIDGE
         tristate "DSP Bridge driver"
-        depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM
+        depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM && BROKEN
         select MAILBOX
         select OMAP2PLUS_MBOX
         help
diff --git a/drivers/staging/tidspbridge/rmgr/drv_interface.c b/drivers/staging/tidspbridge/rmgr/drv_interface.c
index 1aa4a3fd0f1b..56e355b3e7fa 100644
--- a/drivers/staging/tidspbridge/rmgr/drv_interface.c
+++ b/drivers/staging/tidspbridge/rmgr/drv_interface.c
@@ -258,7 +258,8 @@ err:
 /* This function maps kernel space memory to user space memory. */
 static int bridge_mmap(struct file *filp, struct vm_area_struct *vma)
 {
-        u32 status;
+        struct omap_dsp_platform_data *pdata =
+                                        omap_dspbridge_dev->dev.platform_data;
 
         /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by remap_pfn_range() */
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
@@ -268,13 +269,9 @@ static int bridge_mmap(struct file *filp, struct vm_area_struct *vma)
                 vma->vm_start, vma->vm_end, vma->vm_page_prot,
                 vma->vm_flags);
 
-        status = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-                                 vma->vm_end - vma->vm_start,
-                                 vma->vm_page_prot);
-        if (status != 0)
-                status = -EAGAIN;
-
-        return status;
+        return vm_iomap_memory(vma,
+                               pdata->phys_mempool_base,
+                               pdata->phys_mempool_size);
 }
 
 static const struct file_operations bridge_fops = {
diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
index aab0012bba92..ab8b2ba6eedd 100644
--- a/drivers/staging/vt6655/hostap.c
+++ b/drivers/staging/vt6655/hostap.c
@@ -143,7 +143,8 @@ static int hostap_disable_hostapd(PSDevice pDevice, int rtnl_locked)
                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n",
                         pDevice->dev->name, pDevice->apdev->name);
         }
-        free_netdev(pDevice->apdev);
+        if (pDevice->apdev)
+                free_netdev(pDevice->apdev);
         pDevice->apdev = NULL;
         pDevice->bEnable8021x = false;
         pDevice->bEnableHostWEP = false;
diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
index 1e8b8412e67e..4aa5ef54b683 100644
--- a/drivers/staging/vt6656/baseband.c
+++ b/drivers/staging/vt6656/baseband.c
@@ -939,6 +939,7 @@ int BBbVT3184Init(struct vnt_private *pDevice)
     u8 *                   pbyAgc;
     u16                    wLengthAgc;
     u8                    abyArray[256];
+        u8 data;
 
     ntStatus = CONTROLnsRequestIn(pDevice,
                                   MESSAGE_TYPE_READ,
@@ -1104,6 +1105,16 @@ else {
     ControlvWriteByte(pDevice,MESSAGE_REQUEST_BBREG,0x0D,0x01);
 
     RFbRFTableDownload(pDevice);
+
+        /* Fix for TX USB resets from vendors driver */
+        CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, USB_REG4,
+                MESSAGE_REQUEST_MEM, sizeof(data), &data);
+
+        data |= 0x2;
+
+        CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, USB_REG4,
+                MESSAGE_REQUEST_MEM, sizeof(data), &data);
+
     return true;//ntStatus;
 }
 
diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
index ae1676d190c5..67ba48b9a8d9 100644
--- a/drivers/staging/vt6656/hostap.c
+++ b/drivers/staging/vt6656/hostap.c
@@ -133,7 +133,8 @@ static int hostap_disable_hostapd(struct vnt_private *pDevice, int rtnl_locked)
             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n",
                        pDevice->dev->name, pDevice->apdev->name);
         }
-        free_netdev(pDevice->apdev);
+        if (pDevice->apdev)
+                free_netdev(pDevice->apdev);
         pDevice->apdev = NULL;
     pDevice->bEnable8021x = false;
     pDevice->bEnableHostWEP = false;
diff --git a/drivers/staging/vt6656/rndis.h b/drivers/staging/vt6656/rndis.h
index 5e073062017a..5cf5e732a36f 100644
--- a/drivers/staging/vt6656/rndis.h
+++ b/drivers/staging/vt6656/rndis.h
@@ -66,6 +66,8 @@
 
 #define VIAUSB20_PACKET_HEADER          0x04
 
+#define USB_REG4        0x604
+
 typedef struct _CMD_MESSAGE
 {
     u8        byData[256];
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index 79ce363b2ea9..3277d9838f4e 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -652,21 +652,30 @@ static ssize_t reset_store(struct device *dev,
                 return -ENOMEM;
 
         /* Do not reset an active device! */
-        if (bdev->bd_holders)
-                return -EBUSY;
+        if (bdev->bd_holders) {
+                ret = -EBUSY;
+                goto out;
+        }
 
         ret = kstrtou16(buf, 10, &do_reset);
         if (ret)
-                return ret;
+                goto out;
 
-        if (!do_reset)
-                return -EINVAL;
+        if (!do_reset) {
+                ret = -EINVAL;
+                goto out;
+        }
 
         /* Make sure all pending I/O is finished */
         fsync_bdev(bdev);
+        bdput(bdev);
 
         zram_reset_device(zram, true);
         return len;
+
+out:
+        bdput(bdev);
+        return ret;
 }
 
 static void __zram_make_request(struct zram *zram, struct bio *bio, int rw)
diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c
index 1a67537dbc56..3b950e5a918f 100644
--- a/drivers/staging/zsmalloc/zsmalloc-main.c
+++ b/drivers/staging/zsmalloc/zsmalloc-main.c
@@ -430,7 +430,12 @@ static struct page *get_next_page(struct page *page)
         return next;
 }
 
-/* Encode <page, obj_idx> as a single handle value */
+/*
+ * Encode <page, obj_idx> as a single handle value.
+ * On hardware platforms with physical memory starting at 0x0 the pfn
+ * could be 0 so we ensure that the handle will never be 0 by adjusting the
+ * encoded obj_idx value before encoding.
+ */
 static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
 {
         unsigned long handle;
@@ -441,17 +446,21 @@ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
         }
 
         handle = page_to_pfn(page) << OBJ_INDEX_BITS;
-        handle |= (obj_idx & OBJ_INDEX_MASK);
+        handle |= ((obj_idx + 1) & OBJ_INDEX_MASK);
 
         return (void *)handle;
 }
 
-/* Decode <page, obj_idx> pair from the given object handle */
+/*
+ * Decode <page, obj_idx> pair from the given object handle. We adjust the
+ * decoded obj_idx back to its original value since it was adjusted in
+ * obj_location_to_handle().
+ */
 static void obj_handle_to_location(unsigned long handle, struct page **page,
                                 unsigned long *obj_idx)
 {
         *page = pfn_to_page(handle >> OBJ_INDEX_BITS);
-        *obj_idx = handle & OBJ_INDEX_MASK;
+        *obj_idx = (handle & OBJ_INDEX_MASK) - 1;
 }
 
 static unsigned long obj_idx_to_offset(struct page *page,
diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c
index 2b86f8e0fb58..71630a2af42c 100644
--- a/drivers/tty/amiserial.c
+++ b/drivers/tty/amiserial.c
@@ -1855,6 +1855,9 @@ static struct console sercons = {
  */
 static int __init amiserial_console_init(void)
 {
+        if (!MACH_IS_AMIGA)
+                return -ENODEV;
+
         register_console(&sercons);
         return 0;
 }
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 7cdd1eb9406c..268b62768f2b 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -768,7 +768,7 @@ static size_t __process_echoes(struct tty_struct *tty)
          * data at the tail to prevent a subsequent overrun */
         while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
                 if (echo_buf(ldata, tail) == ECHO_OP_START) {
-                        if (echo_buf(ldata, tail) == ECHO_OP_ERASE_TAB)
+                        if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB)
                                 tail += 3;
                         else
                                 tail += 2;
@@ -810,7 +810,8 @@ static void process_echoes(struct tty_struct *tty)
         struct n_tty_data *ldata = tty->disc_data;
         size_t echoed;
 
-        if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_tail)
+        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
+            ldata->echo_commit == ldata->echo_tail)
                 return;
 
         mutex_lock(&ldata->output_lock);
@@ -825,7 +826,8 @@ static void flush_echoes(struct tty_struct *tty)
 {
         struct n_tty_data *ldata = tty->disc_data;
 
-        if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_head)
+        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
+            ldata->echo_commit == ldata->echo_head)
                 return;
 
         mutex_lock(&ldata->output_lock);
@@ -1998,7 +2000,10 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
                 found = 1;
 
         size = N_TTY_BUF_SIZE - tail;
-        n = (found + eol + size) & (N_TTY_BUF_SIZE - 1);
+        n = eol - tail;
+        if (n > 4096)
+                n += 4096;
+        n += found;
         c = n;
 
         if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
@@ -2243,18 +2248,19 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                 if (time)
                         timeout = time;
         }
-        mutex_unlock(&ldata->atomic_read_lock);
-        remove_wait_queue(&tty->read_wait, &wait);
+        n_tty_set_room(tty);
+        up_read(&tty->termios_rwsem);
 
+        remove_wait_queue(&tty->read_wait, &wait);
         if (!waitqueue_active(&tty->read_wait))
                 ldata->minimum_to_wake = minimum;
 
+        mutex_unlock(&ldata->atomic_read_lock);
+
         __set_current_state(TASK_RUNNING);
         if (b - buf)
                 retval = b - buf;
 
-        n_tty_set_room(tty);
-        up_read(&tty->termios_rwsem);
         return retval;
 }
 
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index f3b306efaa59..23329918f229 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -41,7 +41,7 @@ config SERIAL_8250_DEPRECATED_OPTIONS
           accept kernel parameters in both forms like 8250_core.nr_uarts=4 and
           8250.nr_uarts=4. We now renamed the module back to 8250, but if
           anybody noticed in 3.7 and changed their userspace we still have to
-          keep the 8350_core.* options around until they revert the changes
+          keep the 8250_core.* options around until they revert the changes
           they already did.
 
           If 8250 is built as a module, this adds 8250_core alias instead. 
diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index 481b781b26e3..e9d420ff3931 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -2052,6 +2052,9 @@ static int __init pmz_console_init(void)
         /* Probe ports */
         pmz_probe();
 
+        if (pmz_ports_count == 0)
+                return -ENODEV;
+
         /* TODO: Autoprobe console based on OF */
         /* pmz_console.index = i; */
         register_console(&pmz_console);
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 3a1a01af9a80..c74a00ad7add 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2086,6 +2086,7 @@ retry_open:
                         filp->f_op = &tty_fops;
                 goto retry_open;
         }
+        clear_bit(TTY_HUPPED, &tty->flags);
         tty_unlock(tty);
 
 
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 67beb8444930..f7beb6eb40c7 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -653,6 +653,8 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
                 return -EINVAL;
         mem = idev->info->mem + mi;
 
+        if (mem->addr & ~PAGE_MASK)
+                return -ENODEV;
         if (vma->vm_end - vma->vm_start > mem->size)
                 return -EINVAL;
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 3e7560f004f8..e8404319ca68 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1515,6 +1515,8 @@ static int acm_reset_resume(struct usb_interface *intf)
 
 static const struct usb_device_id acm_ids[] = {
         /* quirky and broken devices */
+        { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
+        .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
         { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a7c04e24ca48..bd9dc3504b51 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4832,8 +4832,9 @@ static void hub_events(void)
                                         hub->ports[i - 1]->child;
 
                                 dev_dbg(hub_dev, "warm reset port %d\n", i);
-                                if (!udev || !(portstatus &
-                                                USB_PORT_STAT_CONNECTION)) {
+                                if (!udev ||
+                                    !(portstatus & USB_PORT_STAT_CONNECTION) ||
+                                    udev->state == USB_STATE_NOTATTACHED) {
                                         status = hub_port_reset(hub, i,
                                                         NULL, HUB_BH_RESET_TIME,
                                                         true);
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 95f7649c71a7..21a352079bc2 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -459,6 +459,8 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
                         dep = dwc3_wIndex_to_dep(dwc, wIndex);
                         if (!dep)
                                 return -EINVAL;
+                        if (set == 0 && (dep->flags & DWC3_EP_WEDGE))
+                                break;
                         ret = __dwc3_gadget_ep_set_halt(dep, set);
                         if (ret)
                                 return -EINVAL;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 5452c0fce360..02e44fcaf205 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1200,9 +1200,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
                 else
                         dep->flags |= DWC3_EP_STALL;
         } else {
-                if (dep->flags & DWC3_EP_WEDGE)
-                        return 0;
-
                 ret = dwc3_send_gadget_ep_cmd(dwc, dep->number,
                         DWC3_DEPCMD_CLEARSTALL, &params);
                 if (ret)
@@ -1210,7 +1207,7 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
                                         value ? "set" : "clear",
                                         dep->name);
                 else
-                        dep->flags &= ~DWC3_EP_STALL;
+                        dep->flags &= ~(DWC3_EP_STALL | DWC3_EP_WEDGE);
         }
 
         return ret;
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index a91e6422f930..f66d96ad1f51 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -682,6 +682,7 @@ config USB_CONFIGFS_PHONET
 config USB_CONFIGFS_MASS_STORAGE
         boolean "Mass storage"
         depends on USB_CONFIGFS
+        depends on BLOCK
         select USB_F_MASS_STORAGE
         help
           The Mass Storage Gadget acts as a USB Mass Storage disk drive.
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 3e7ae707f691..2018ba1a2172 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -593,6 +593,7 @@ static void reset_config(struct usb_composite_dev *cdev)
                 bitmap_zero(f->endpoints, 32);
         }
         cdev->config = NULL;
+        cdev->delayed_status = 0;
 }
 
 static int set_config(struct usb_composite_dev *cdev,
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 774e8b89cdb5..241fc873ffa4 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1304,7 +1304,7 @@ static struct ffs_data *ffs_data_new(void)
 {
         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
         if (unlikely(!ffs))
-                return 0;
+                return NULL;
 
         ENTER();
 
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index a03ba2c83589..b96393908860 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -523,7 +523,7 @@ static int fsg_setup(struct usb_function *f,
                  */
                 DBG(fsg, "bulk reset request\n");
                 raise_exception(fsg->common, FSG_STATE_RESET);
-                return DELAYED_STATUS;
+                return USB_GADGET_DELAYED_STATUS;
 
         case US_BULK_GET_MAX_LUN:
                 if (ctrl->bRequestType !=
@@ -602,13 +602,14 @@ static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
         return true;
 }
 
-static int sleep_thread(struct fsg_common *common)
+static int sleep_thread(struct fsg_common *common, bool can_freeze)
 {
         int     rc = 0;
 
         /* Wait until a signal arrives or we are woken up */
         for (;;) {
-                try_to_freeze();
+                if (can_freeze)
+                        try_to_freeze();
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (signal_pending(current)) {
                         rc = -EINTR;
@@ -682,7 +683,7 @@ static int do_read(struct fsg_common *common)
                 /* Wait for the next buffer to become available */
                 bh = common->next_buffhd_to_fill;
                 while (bh->state != BUF_STATE_EMPTY) {
-                        rc = sleep_thread(common);
+                        rc = sleep_thread(common, false);
                         if (rc)
                                 return rc;
                 }
@@ -937,7 +938,7 @@ static int do_write(struct fsg_common *common)
                 }
 
                 /* Wait for something to happen */
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, false);
                 if (rc)
                         return rc;
         }
@@ -1504,7 +1505,7 @@ static int throw_away_data(struct fsg_common *common)
                 }
 
                 /* Otherwise wait for something to happen */
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -1625,7 +1626,7 @@ static int send_status(struct fsg_common *common)
         /* Wait for the next buffer to become available */
         bh = common->next_buffhd_to_fill;
         while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -1828,7 +1829,7 @@ static int do_scsi_command(struct fsg_common *common)
         bh = common->next_buffhd_to_fill;
         common->next_buffhd_to_drain = bh;
         while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -2174,7 +2175,7 @@ static int get_next_command(struct fsg_common *common)
         /* Wait for the next buffer to become available */
         bh = common->next_buffhd_to_fill;
         while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -2193,7 +2194,7 @@ static int get_next_command(struct fsg_common *common)
 
         /* Wait for the CBW to arrive */
         while (bh->state != BUF_STATE_FULL) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -2379,7 +2380,7 @@ static void handle_exception(struct fsg_common *common)
                         }
                         if (num_active == 0)
                                 break;
-                        if (sleep_thread(common))
+                        if (sleep_thread(common, true))
                                 return;
                 }
 
@@ -2516,7 +2517,7 @@ static int fsg_main_thread(void *common_)
                 }
 
                 if (!common->running) {
-                        sleep_thread(common);
+                        sleep_thread(common, true);
                         continue;
                 }
 
@@ -3111,7 +3112,7 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
                                           fsg->common->can_stall);
                 if (ret)
                         return ret;
-                fsg_common_set_inquiry_string(fsg->common, 0, 0);
+                fsg_common_set_inquiry_string(fsg->common, NULL, NULL);
                 ret = fsg_common_run_thread(fsg->common);
                 if (ret)
                         return ret;
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index 0ac6064aa3b8..409a3c45a36a 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -54,6 +54,7 @@
  */
 #ifdef CONFIG_ARCH_PXA
 #include <mach/pxa25x-udc.h>
+#include <mach/hardware.h>
 #endif
 
 #ifdef CONFIG_ARCH_LUBBOCK
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 9875d9c0823f..e20bc109fdd7 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -1180,6 +1180,7 @@ static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
 }
 
 static void s3c_hsotg_enqueue_setup(struct s3c_hsotg *hsotg);
+static void s3c_hsotg_disconnect(struct s3c_hsotg *hsotg);
 
 /**
  * s3c_hsotg_process_control - process a control request
@@ -1221,6 +1222,7 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
         if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
                 switch (ctrl->bRequest) {
                 case USB_REQ_SET_ADDRESS:
+                        s3c_hsotg_disconnect(hsotg);
                         dcfg = readl(hsotg->regs + DCFG);
                         dcfg &= ~DCFG_DevAddr_MASK;
                         dcfg |= ctrl->wValue << DCFG_DevAddr_SHIFT;
@@ -1245,7 +1247,9 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
         /* as a fallback, try delivering it to the driver to deal with */
 
         if (ret == 0 && hsotg->driver) {
+                spin_unlock(&hsotg->lock);
                 ret = hsotg->driver->setup(&hsotg->gadget, ctrl);
+                spin_lock(&hsotg->lock);
                 if (ret < 0)
                         dev_dbg(hsotg->dev, "driver->setup() ret %d\n", ret);
         }
@@ -1308,10 +1312,12 @@ static void s3c_hsotg_complete_setup(struct usb_ep *ep,
                 return;
         }
 
+        spin_lock(&hsotg->lock);
         if (req->actual == 0)
                 s3c_hsotg_enqueue_setup(hsotg);
         else
                 s3c_hsotg_process_control(hsotg, req->buf);
+        spin_unlock(&hsotg->lock);
 }
 
 /**
@@ -2533,7 +2539,6 @@ irq_retry:
                 writel(GINTSTS_USBSusp, hsotg->regs + GINTSTS);
 
                 call_gadget(hsotg, suspend);
-                s3c_hsotg_disconnect(hsotg);
         }
 
         if (gintsts & GINTSTS_WkUpInt) {
diff --git a/drivers/usb/gadget/storage_common.h b/drivers/usb/gadget/storage_common.h
index c74c2fdbd56e..70c891469f57 100644
--- a/drivers/usb/gadget/storage_common.h
+++ b/drivers/usb/gadget/storage_common.h
@@ -119,10 +119,6 @@ static inline bool fsg_lun_is_open(struct fsg_lun *curlun)
         return curlun->filp != NULL;
 }
 
-/* Big enough to hold our biggest descriptor */
-#define EP0_BUFSIZE     256
-#define DELAYED_STATUS  (EP0_BUFSIZE + 999)     /* An impossibly large value */
-
 /* Default size of buffer length. */
 #define FSG_BUFLEN      ((u32)16384)
 
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
index 6c3d7950d2a9..0f8aad78b54f 100644
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -370,7 +370,7 @@ err:
         return -ENOMEM;
 }
 
-void bot_cleanup_old_alt(struct f_uas *fu)
+static void bot_cleanup_old_alt(struct f_uas *fu)
 {
         if (!(fu->flags & USBG_ENABLED))
                 return;
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 0dd07ae1555d..f49b0b61ecc8 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -91,17 +91,17 @@ static struct usb_zero_options gzero_options = {
  * functional coverage for the "USBCV" test harness from USB-IF.
  * It's always set if OTG mode is enabled.
  */
-unsigned autoresume = DEFAULT_AUTORESUME;
+static unsigned autoresume = DEFAULT_AUTORESUME;
 module_param(autoresume, uint, S_IRUGO);
 MODULE_PARM_DESC(autoresume, "zero, or seconds before remote wakeup");
 
 /* Maximum Autoresume time */
-unsigned max_autoresume;
+static unsigned max_autoresume;
 module_param(max_autoresume, uint, S_IRUGO);
 MODULE_PARM_DESC(max_autoresume, "maximum seconds before remote wakeup");
 
 /* Interval between two remote wakeups */
-unsigned autoresume_interval_ms;
+static unsigned autoresume_interval_ms;
 module_param(autoresume_interval_ms, uint, S_IRUGO);
 MODULE_PARM_DESC(autoresume_interval_ms,
                 "milliseconds to increase successive wakeup delays");
diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
index e89ac4d4b87e..9b7435f0dcd6 100644
--- a/drivers/usb/host/ohci-pxa27x.c
+++ b/drivers/usb/host/ohci-pxa27x.c
@@ -21,6 +21,7 @@
 
 #include <linux/clk.h>
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 1e2f3f495843..53c2e296467f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2973,8 +2973,58 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
         }
 
         while (1) {
-                if (room_on_ring(xhci, ep_ring, num_trbs))
-                        break;
+                if (room_on_ring(xhci, ep_ring, num_trbs)) {
+                        union xhci_trb *trb = ep_ring->enqueue;
+                        unsigned int usable = ep_ring->enq_seg->trbs +
+                                        TRBS_PER_SEGMENT - 1 - trb;
+                        u32 nop_cmd;
+
+                        /*
+                         * Section 4.11.7.1 TD Fragments states that a link
+                         * TRB must only occur at the boundary between
+                         * data bursts (eg 512 bytes for 480M).
+                         * While it is possible to split a large fragment
+                         * we don't know the size yet.
+                         * Simplest solution is to fill the trb before the
+                         * LINK with nop commands.
+                         */
+                        if (num_trbs == 1 || num_trbs <= usable || usable == 0)
+                                break;
+
+                        if (ep_ring->type != TYPE_BULK)
+                                /*
+                                 * While isoc transfers might have a buffer that
+                                 * crosses a 64k boundary it is unlikely.
+                                 * Since we can't add NOPs without generating
+                                 * gaps in the traffic just hope it never
+                                 * happens at the end of the ring.
+                                 * This could be fixed by writing a LINK TRB
+                                 * instead of the first NOP - however the
+                                 * TRB_TYPE_LINK_LE32() calls would all need
+                                 * changing to check the ring length.
+                                 */
+                                break;
+
+                        if (num_trbs >= TRBS_PER_SEGMENT) {
+                                xhci_err(xhci, "Too many fragments %d, max %d\n",
+                                                num_trbs, TRBS_PER_SEGMENT - 1);
+                                return -ENOMEM;
+                        }
+
+                        nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
+                                        ep_ring->cycle_state);
+                        ep_ring->num_trbs_free -= usable;
+                        do {
+                                trb->generic.field[0] = 0;
+                                trb->generic.field[1] = 0;
+                                trb->generic.field[2] = 0;
+                                trb->generic.field[3] = nop_cmd;
+                                trb++;
+                        } while (--usable);
+                        ep_ring->enqueue = trb;
+                        if (room_on_ring(xhci, ep_ring, num_trbs))
+                                break;
+                }
 
                 if (ep_ring == xhci->cmd_ring) {
                         xhci_err(xhci, "Do not support expand command ring\n");
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 0a43329569d1..4d4499b80449 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1809,7 +1809,6 @@ static void musb_free(struct musb *musb)
                         disable_irq_wake(musb->nIrq);
                 free_irq(musb->nIrq, musb);
         }
-        cancel_work_sync(&musb->irq_work);
 
         musb_host_free(musb);
 }
@@ -1896,6 +1895,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         musb_platform_disable(musb);
         musb_generic_disable(musb);
 
+        /* Init IRQ workqueue before request_irq */
+        INIT_WORK(&musb->irq_work, musb_irq_work);
+
         /* setup musb parts of the core (especially endpoints) */
         status = musb_core_init(plat->config->multipoint
                         ? MUSB_CONTROLLER_MHDRC
@@ -1905,9 +1907,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
 
         setup_timer(&musb->otg_timer, musb_otg_timer_func, (unsigned long) musb);
 
-        /* Init IRQ workqueue before request_irq */
-        INIT_WORK(&musb->irq_work, musb_irq_work);
-
         /* attach to the IRQ */
         if (request_irq(nIrq, musb->isr, 0, dev_name(dev), musb)) {
                 dev_err(dev, "request_irq %d failed!\n", nIrq);
@@ -1981,6 +1980,7 @@ fail4:
         musb_host_cleanup(musb);
 
 fail3:
+        cancel_work_sync(&musb->irq_work);
         if (musb->dma_controller)
                 dma_controller_destroy(musb->dma_controller);
 fail2_5:
@@ -2043,6 +2043,7 @@ static int musb_remove(struct platform_device *pdev)
         if (musb->dma_controller)
                 dma_controller_destroy(musb->dma_controller);
 
+        cancel_work_sync(&musb->irq_work);
         musb_free(musb);
         device_init_wakeup(dev, 0);
         return 0;
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index ff9d6de2b746..a12bd30401e0 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -38,6 +38,7 @@ struct cppi41_dma_channel {
         u32 prog_len;
         u32 transferred;
         u32 packet_sz;
+        struct list_head tx_check;
 };
 
 #define MUSB_DMA_NUM_CHANNELS 15
@@ -47,6 +48,8 @@ struct cppi41_dma_controller {
         struct cppi41_dma_channel rx_channel[MUSB_DMA_NUM_CHANNELS];
         struct cppi41_dma_channel tx_channel[MUSB_DMA_NUM_CHANNELS];
         struct musb *musb;
+        struct hrtimer early_tx;
+        struct list_head early_tx_list;
         u32 rx_mode;
         u32 tx_mode;
         u32 auto_req;
@@ -96,31 +99,27 @@ static void update_rx_toggle(struct cppi41_dma_channel *cppi41_channel)
         cppi41_channel->usb_toggle = toggle;
 }
 
-static void cppi41_dma_callback(void *private_data)
+static bool musb_is_tx_fifo_empty(struct musb_hw_ep *hw_ep)
 {
-        struct dma_channel *channel = private_data;
-        struct cppi41_dma_channel *cppi41_channel = channel->private_data;
-        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
-        struct musb *musb = hw_ep->musb;
-        unsigned long flags;
-        struct dma_tx_state txstate;
-        u32 transferred;
+        u8              epnum = hw_ep->epnum;
+        struct musb     *musb = hw_ep->musb;
+        void __iomem    *epio = musb->endpoints[epnum].regs;
+        u16             csr;
 
-        spin_lock_irqsave(&musb->lock, flags);
+        csr = musb_readw(epio, MUSB_TXCSR);
+        if (csr & MUSB_TXCSR_TXPKTRDY)
+                return false;
+        return true;
+}
 
-        dmaengine_tx_status(cppi41_channel->dc, cppi41_channel->cookie,
-                        &txstate);
-        transferred = cppi41_channel->prog_len - txstate.residue;
-        cppi41_channel->transferred += transferred;
+static void cppi41_dma_callback(void *private_data);
 
-        dev_dbg(musb->controller, "DMA transfer done on hw_ep=%d bytes=%d/%d\n",
-                hw_ep->epnum, cppi41_channel->transferred,
-                cppi41_channel->total_len);
+static void cppi41_trans_done(struct cppi41_dma_channel *cppi41_channel)
+{
+        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+        struct musb *musb = hw_ep->musb;
 
-        update_rx_toggle(cppi41_channel);
-
-        if (cppi41_channel->transferred == cppi41_channel->total_len ||
-                        transferred < cppi41_channel->packet_sz) {
+        if (!cppi41_channel->prog_len) {
 
                 /* done, complete */
                 cppi41_channel->channel.actual_len =
@@ -150,13 +149,11 @@ static void cppi41_dma_callback(void *private_data)
                                 remain_bytes,
                                 direction,
                                 DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                if (WARN_ON(!dma_desc)) {
-                        spin_unlock_irqrestore(&musb->lock, flags);
+                if (WARN_ON(!dma_desc))
                         return;
-                }
 
                 dma_desc->callback = cppi41_dma_callback;
-                dma_desc->callback_param = channel;
+                dma_desc->callback_param = &cppi41_channel->channel;
                 cppi41_channel->cookie = dma_desc->tx_submit(dma_desc);
                 dma_async_issue_pending(dc);
 
@@ -166,6 +163,117 @@ static void cppi41_dma_callback(void *private_data)
                         musb_writew(epio, MUSB_RXCSR, csr);
                 }
         }
+}
+
+static enum hrtimer_restart cppi41_recheck_tx_req(struct hrtimer *timer)
+{
+        struct cppi41_dma_controller *controller;
+        struct cppi41_dma_channel *cppi41_channel, *n;
+        struct musb *musb;
+        unsigned long flags;
+        enum hrtimer_restart ret = HRTIMER_NORESTART;
+
+        controller = container_of(timer, struct cppi41_dma_controller,
+                        early_tx);
+        musb = controller->musb;
+
+        spin_lock_irqsave(&musb->lock, flags);
+        list_for_each_entry_safe(cppi41_channel, n, &controller->early_tx_list,
+                        tx_check) {
+                bool empty;
+                struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+
+                empty = musb_is_tx_fifo_empty(hw_ep);
+                if (empty) {
+                        list_del_init(&cppi41_channel->tx_check);
+                        cppi41_trans_done(cppi41_channel);
+                }
+        }
+
+        if (!list_empty(&controller->early_tx_list)) {
+                ret = HRTIMER_RESTART;
+                hrtimer_forward_now(&controller->early_tx,
+                                ktime_set(0, 150 * NSEC_PER_USEC));
+        }
+
+        spin_unlock_irqrestore(&musb->lock, flags);
+        return ret;
+}
+
+static void cppi41_dma_callback(void *private_data)
+{
+        struct dma_channel *channel = private_data;
+        struct cppi41_dma_channel *cppi41_channel = channel->private_data;
+        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+        struct musb *musb = hw_ep->musb;
+        unsigned long flags;
+        struct dma_tx_state txstate;
+        u32 transferred;
+        bool empty;
+
+        spin_lock_irqsave(&musb->lock, flags);
+
+        dmaengine_tx_status(cppi41_channel->dc, cppi41_channel->cookie,
+                        &txstate);
+        transferred = cppi41_channel->prog_len - txstate.residue;
+        cppi41_channel->transferred += transferred;
+
+        dev_dbg(musb->controller, "DMA transfer done on hw_ep=%d bytes=%d/%d\n",
+                hw_ep->epnum, cppi41_channel->transferred,
+                cppi41_channel->total_len);
+
+        update_rx_toggle(cppi41_channel);
+
+        if (cppi41_channel->transferred == cppi41_channel->total_len ||
+                        transferred < cppi41_channel->packet_sz)
+                cppi41_channel->prog_len = 0;
+
+        empty = musb_is_tx_fifo_empty(hw_ep);
+        if (empty) {
+                cppi41_trans_done(cppi41_channel);
+        } else {
+                struct cppi41_dma_controller *controller;
+                /*
+                 * On AM335x it has been observed that the TX interrupt fires
+                 * too early that means the TXFIFO is not yet empty but the DMA
+                 * engine says that it is done with the transfer. We don't
+                 * receive a FIFO empty interrupt so the only thing we can do is
+                 * to poll for the bit. On HS it usually takes 2us, on FS around
+                 * 110us - 150us depending on the transfer size.
+                 * We spin on HS (no longer than than 25us and setup a timer on
+                 * FS to check for the bit and complete the transfer.
+                 */
+                controller = cppi41_channel->controller;
+
+                if (musb->g.speed == USB_SPEED_HIGH) {
+                        unsigned wait = 25;
+
+                        do {
+                                empty = musb_is_tx_fifo_empty(hw_ep);
+                                if (empty)
+                                        break;
+                                wait--;
+                                if (!wait)
+                                        break;
+                                udelay(1);
+                        } while (1);
+
+                        empty = musb_is_tx_fifo_empty(hw_ep);
+                        if (empty) {
+                                cppi41_trans_done(cppi41_channel);
+                                goto out;
+                        }
+                }
+                list_add_tail(&cppi41_channel->tx_check,
+                                &controller->early_tx_list);
+                if (!hrtimer_active(&controller->early_tx)) {
+                        hrtimer_start_range_ns(&controller->early_tx,
+                                ktime_set(0, 140 * NSEC_PER_USEC),
+                                40 * NSEC_PER_USEC,
+                                HRTIMER_MODE_REL);
+                }
+        }
+out:
         spin_unlock_irqrestore(&musb->lock, flags);
 }
 
@@ -364,6 +472,8 @@ static int cppi41_is_compatible(struct dma_channel *channel, u16 maxpacket,
                 WARN_ON(1);
                 return 1;
         }
+        if (cppi41_channel->hw_ep->ep_in.type != USB_ENDPOINT_XFER_BULK)
+                return 0;
         if (cppi41_channel->is_tx)
                 return 1;
         /* AM335x Advisory 1.0.13. No workaround for device RX mode */
@@ -388,6 +498,7 @@ static int cppi41_dma_channel_abort(struct dma_channel *channel)
         if (cppi41_channel->channel.status == MUSB_DMA_STATUS_FREE)
                 return 0;
 
+        list_del_init(&cppi41_channel->tx_check);
         if (is_tx) {
                 csr = musb_readw(epio, MUSB_TXCSR);
                 csr &= ~MUSB_TXCSR_DMAENAB;
@@ -495,6 +606,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
                 cppi41_channel->controller = controller;
                 cppi41_channel->port_num = port;
                 cppi41_channel->is_tx = is_tx;
+                INIT_LIST_HEAD(&cppi41_channel->tx_check);
 
                 musb_dma = &cppi41_channel->channel;
                 musb_dma->private_data = cppi41_channel;
@@ -520,6 +632,7 @@ void dma_controller_destroy(struct dma_controller *c)
         struct cppi41_dma_controller *controller = container_of(c,
                         struct cppi41_dma_controller, controller);
 
+        hrtimer_cancel(&controller->early_tx);
         cppi41_dma_controller_stop(controller);
         kfree(controller);
 }
@@ -539,6 +652,9 @@ struct dma_controller *dma_controller_create(struct musb *musb,
         if (!controller)
                 goto kzalloc_fail;
 
+        hrtimer_init(&controller->early_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        controller->early_tx.function = cppi41_recheck_tx_req;
+        INIT_LIST_HEAD(&controller->early_tx_list);
         controller->musb = musb;
 
         controller->controller.channel_alloc = cppi41_dma_channel_allocate;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index d2d3a173b315..32fb057c03f5 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1796,7 +1796,11 @@ int musb_gadget_setup(struct musb *musb)
 
         /* this "gadget" abstracts/virtualizes the controller */
         musb->g.name = musb_driver_name;
+#if IS_ENABLED(CONFIG_USB_MUSB_DUAL_ROLE)
         musb->g.is_otg = 1;
+#elif IS_ENABLED(CONFIG_USB_MUSB_GADGET)
+        musb->g.is_otg = 0;
+#endif
 
         musb_g_init_endpoints(musb);
 
diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
index 6370e50649d7..0e3c60cb669a 100644
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -52,8 +52,7 @@ static int am335x_phy_probe(struct platform_device *pdev)
                 return am_phy->id;
         }
 
-        ret = usb_phy_gen_create_phy(dev, &am_phy->usb_phy_gen,
-                        USB_PHY_TYPE_USB2, 0, false);
+        ret = usb_phy_gen_create_phy(dev, &am_phy->usb_phy_gen, NULL);
         if (ret)
                 return ret;
 
@@ -66,8 +65,6 @@ static int am335x_phy_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, am_phy);
 
         return 0;
-
-        return ret;
 }
 
 static int am335x_phy_remove(struct platform_device *pdev)
diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
index fce3a9e9bb5d..aa6d37b3378a 100644
--- a/drivers/usb/phy/phy-generic.c
+++ b/drivers/usb/phy/phy-generic.c
@@ -48,8 +48,9 @@ void usb_nop_xceiv_register(void)
         if (pd)
                 return;
         pd = platform_device_register_simple("usb_phy_gen_xceiv", -1, NULL, 0);
-        if (!pd) {
+        if (IS_ERR(pd)) {
                 pr_err("Unable to register generic usb transceiver\n");
+                pd = NULL;
                 return;
         }
 }
@@ -150,10 +151,40 @@ static int nop_set_host(struct usb_otg *otg, struct usb_bus *host)
 }
 
 int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
-                enum usb_phy_type type, u32 clk_rate, bool needs_vcc)
+                struct usb_phy_gen_xceiv_platform_data *pdata)
 {
+        enum usb_phy_type type = USB_PHY_TYPE_USB2;
         int err;
 
+        u32 clk_rate = 0;
+        bool needs_vcc = false;
+
+        nop->reset_active_low = true;   /* default behaviour */
+
+        if (dev->of_node) {
+                struct device_node *node = dev->of_node;
+                enum of_gpio_flags flags = 0;
+
+                if (of_property_read_u32(node, "clock-frequency", &clk_rate))
+                        clk_rate = 0;
+
+                needs_vcc = of_property_read_bool(node, "vcc-supply");
+                nop->gpio_reset = of_get_named_gpio_flags(node, "reset-gpios",
+                                                                0, &flags);
+                if (nop->gpio_reset == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+
+                nop->reset_active_low = flags & OF_GPIO_ACTIVE_LOW;
+
+        } else if (pdata) {
+                type = pdata->type;
+                clk_rate = pdata->clk_rate;
+                needs_vcc = pdata->needs_vcc;
+                nop->gpio_reset = pdata->gpio_reset;
+        } else {
+                nop->gpio_reset = -1;
+        }
+
         nop->phy.otg = devm_kzalloc(dev, sizeof(*nop->phy.otg),
                         GFP_KERNEL);
         if (!nop->phy.otg)
@@ -218,43 +249,14 @@ EXPORT_SYMBOL_GPL(usb_phy_gen_create_phy);
 static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
-        struct usb_phy_gen_xceiv_platform_data *pdata =
-                        dev_get_platdata(&pdev->dev);
         struct usb_phy_gen_xceiv        *nop;
-        enum usb_phy_type       type = USB_PHY_TYPE_USB2;
         int err;
-        u32 clk_rate = 0;
-        bool needs_vcc = false;
 
         nop = devm_kzalloc(dev, sizeof(*nop), GFP_KERNEL);
         if (!nop)
                 return -ENOMEM;
 
-        nop->reset_active_low = true;   /* default behaviour */
-
-        if (dev->of_node) {
-                struct device_node *node = dev->of_node;
-                enum of_gpio_flags flags;
-
-                if (of_property_read_u32(node, "clock-frequency", &clk_rate))
-                        clk_rate = 0;
-
-                needs_vcc = of_property_read_bool(node, "vcc-supply");
-                nop->gpio_reset = of_get_named_gpio_flags(node, "reset-gpios",
-                                                                0, &flags);
-                if (nop->gpio_reset == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-
-                nop->reset_active_low = flags & OF_GPIO_ACTIVE_LOW;
-
-        } else if (pdata) {
-                type = pdata->type;
-                clk_rate = pdata->clk_rate;
-                needs_vcc = pdata->needs_vcc;
-                nop->gpio_reset = pdata->gpio_reset;
-        }
-
-        err = usb_phy_gen_create_phy(dev, nop, type, clk_rate, needs_vcc);
+        err = usb_phy_gen_create_phy(dev, nop, dev_get_platdata(&pdev->dev));
         if (err)
                 return err;
 
@@ -271,8 +273,6 @@ static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, nop);
 
         return 0;
-
-        return err;
 }
 
 static int usb_phy_gen_xceiv_remove(struct platform_device *pdev)
diff --git a/drivers/usb/phy/phy-generic.h b/drivers/usb/phy/phy-generic.h
index d2a220d81734..38a81f307b82 100644
--- a/drivers/usb/phy/phy-generic.h
+++ b/drivers/usb/phy/phy-generic.h
@@ -1,6 +1,8 @@
 #ifndef _PHY_GENERIC_H_
 #define _PHY_GENERIC_H_
 
+#include <linux/usb/usb_phy_gen_xceiv.h>
+
 struct usb_phy_gen_xceiv {
         struct usb_phy phy;
         struct device *dev;
@@ -14,6 +16,6 @@ int usb_gen_phy_init(struct usb_phy *phy);
 void usb_gen_phy_shutdown(struct usb_phy *phy);
 
 int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
-                enum usb_phy_type type, u32 clk_rate, bool needs_vcc);
+                struct usb_phy_gen_xceiv_platform_data *pdata);
 
 #endif
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index fdd33b44dbd3..545844b7e796 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -164,7 +164,7 @@ static int mxs_phy_probe(struct platform_device *pdev)
 
         mxs_phy->clk = clk;
 
-        platform_set_drvdata(pdev, &mxs_phy->phy);
+        platform_set_drvdata(pdev, mxs_phy);
 
         ret = usb_add_phy_dev(&mxs_phy->phy);
         if (ret)
diff --git a/drivers/usb/phy/phy-rcar-gen2-usb.c b/drivers/usb/phy/phy-rcar-gen2-usb.c
index a99a6953f11c..db3ab34cddb4 100644
--- a/drivers/usb/phy/phy-rcar-gen2-usb.c
+++ b/drivers/usb/phy/phy-rcar-gen2-usb.c
@@ -107,10 +107,10 @@ static void __rcar_gen2_usb_phy_init(struct rcar_gen2_usb_phy_priv *priv)
         clk_prepare_enable(priv->clk);
 
         /* Set USB channels in the USBHS UGCTRL2 register */
-        val = ioread32(priv->base);
+        val = ioread32(priv->base + USBHS_UGCTRL2_REG);
         val &= ~(USBHS_UGCTRL2_USB0_HS | USBHS_UGCTRL2_USB2_SS);
         val |= priv->ugctrl2;
-        iowrite32(val, priv->base);
+        iowrite32(val, priv->base + USBHS_UGCTRL2_REG);
 }
 
 /* Shutdown USB channels */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 9ced8937a8f3..fb0d537435eb 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2123,6 +2123,20 @@ static void ftdi_set_termios(struct tty_struct *tty,
                 termios->c_cflag |= CRTSCTS;
         }
 
+        /*
+         * All FTDI UART chips are limited to CS7/8. We won't pretend to
+         * support CS5/6 and revert the CSIZE setting instead.
+         */
+        if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) {
+                dev_warn(ddev, "requested CSIZE setting not supported\n");
+
+                termios->c_cflag &= ~CSIZE;
+                if (old_termios)
+                        termios->c_cflag |= old_termios->c_cflag & CSIZE;
+                else
+                        termios->c_cflag |= CS8;
+        }
+
         cflag = termios->c_cflag;
 
         if (!old_termios)
@@ -2159,19 +2173,16 @@ no_skip:
         } else {
                 urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
         }
-        if (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
-                case CS7:
-                        urb_value |= 7;
-                        dev_dbg(ddev, "Setting CS7\n");
-                        break;
-                case CS8:
-                        urb_value |= 8;
-                        dev_dbg(ddev, "Setting CS8\n");
-                        break;
-                default:
-                        dev_err(ddev, "CSIZE was set but not CS7-CS8\n");
-                }
+        switch (cflag & CSIZE) {
+        case CS7:
+                urb_value |= 7;
+                dev_dbg(ddev, "Setting CS7\n");
+                break;
+        default:
+        case CS8:
+                urb_value |= 8;
+                dev_dbg(ddev, "Setting CS8\n");
+                break;
         }
 
         /* This is needed by the break command since it uses the same command
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 2b01ec8651c2..b63ce023f96f 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -173,16 +173,8 @@ retry:
                 clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
                 return result;
         }
-        /*
-         * Try sending off another urb, unless called from completion handler
-         * (in which case there will be no free urb or no data).
-         */
-        if (mem_flags != GFP_ATOMIC)
-                goto retry;
 
-        clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
-
-        return 0;
+        goto retry;     /* try sending off another urb */
 }
 EXPORT_SYMBOL_GPL(usb_serial_generic_write_start);
 
@@ -208,7 +200,7 @@ int usb_serial_generic_write(struct tty_struct *tty,
                 return 0;
 
         count = kfifo_in_locked(&port->write_fifo, buf, count, &port->lock);
-        result = usb_serial_generic_write_start(port, GFP_KERNEL);
+        result = usb_serial_generic_write_start(port, GFP_ATOMIC);
         if (result)
                 return result;
 
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index e5bdd987b9e8..a69da83604c0 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1813,25 +1813,25 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
         iflag = tty->termios.c_iflag;
 
         /* Change the number of bits */
-        if (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
-                case CS5:
-                        lData = LCR_BITS_5;
-                        break;
+        switch (cflag & CSIZE) {
+        case CS5:
+                lData = LCR_BITS_5;
+                break;
 
-                case CS6:
-                        lData = LCR_BITS_6;
-                        break;
+        case CS6:
+                lData = LCR_BITS_6;
+                break;
 
-                case CS7:
-                        lData = LCR_BITS_7;
-                        break;
-                default:
-                case CS8:
-                        lData = LCR_BITS_8;
-                        break;
-                }
+        case CS7:
+                lData = LCR_BITS_7;
+                break;
+
+        default:
+        case CS8:
+                lData = LCR_BITS_8;
+                break;
         }
+
         /* Change the Parity bit */
         if (cflag & PARENB) {
                 if (cflag & PARODD) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c3d94853b4ab..496b7e39d5be 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -85,6 +85,7 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_K4605                    0x14C6
+#define HUAWEI_PRODUCT_E173S6                   0x1C07
 
 #define QUANTA_VENDOR_ID                        0x0408
 #define QUANTA_PRODUCT_Q101                     0xEA02
@@ -572,6 +573,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173S6, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t) &net_intf2_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
@@ -634,6 +637,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x7A) },
@@ -688,6 +695,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7A) },
@@ -742,6 +753,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7A) },
@@ -796,6 +811,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7A) },
@@ -850,6 +869,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7A) },
@@ -904,6 +927,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7A) },
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 1e6de4cd079d..1e3318dfa1cb 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -361,23 +361,21 @@ static void pl2303_set_termios(struct tty_struct *tty,
                             0, 0, buf, 7, 100);
         dev_dbg(&port->dev, "0xa1:0x21:0:0  %d - %7ph\n", i, buf);
 
-        if (C_CSIZE(tty)) {
-                switch (C_CSIZE(tty)) {
-                case CS5:
-                        buf[6] = 5;
-                        break;
-                case CS6:
-                        buf[6] = 6;
-                        break;
-                case CS7:
-                        buf[6] = 7;
-                        break;
-                default:
-                case CS8:
-                        buf[6] = 8;
-                }
-                dev_dbg(&port->dev, "data bits = %d\n", buf[6]);
+        switch (C_CSIZE(tty)) {
+        case CS5:
+                buf[6] = 5;
+                break;
+        case CS6:
+                buf[6] = 6;
+                break;
+        case CS7:
+                buf[6] = 7;
+                break;
+        default:
+        case CS8:
+                buf[6] = 8;
         }
+        dev_dbg(&port->dev, "data bits = %d\n", buf[6]);
 
         /* For reference buf[0]:buf[3] baud rate value */
         pl2303_encode_baudrate(tty, port, &buf[0]);
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 4abac28b5992..5b793c352267 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -348,22 +348,20 @@ static void spcp8x5_set_termios(struct tty_struct *tty,
         }
 
         /* Set Data Length : 00:5bit, 01:6bit, 10:7bit, 11:8bit */
-        if (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
-                case CS5:
-                        buf[1] |= SET_UART_FORMAT_SIZE_5;
-                        break;
-                case CS6:
-                        buf[1] |= SET_UART_FORMAT_SIZE_6;
-                        break;
-                case CS7:
-                        buf[1] |= SET_UART_FORMAT_SIZE_7;
-                        break;
-                default:
-                case CS8:
-                        buf[1] |= SET_UART_FORMAT_SIZE_8;
-                        break;
-                }
+        switch (cflag & CSIZE) {
+        case CS5:
+                buf[1] |= SET_UART_FORMAT_SIZE_5;
+                break;
+        case CS6:
+                buf[1] |= SET_UART_FORMAT_SIZE_6;
+                break;
+        case CS7:
+                buf[1] |= SET_UART_FORMAT_SIZE_7;
+                break;
+        default:
+        case CS8:
+                buf[1] |= SET_UART_FORMAT_SIZE_8;
+                break;
         }
 
         /* Set Stop bit2 : 0:1bit 1:2bit */
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index e538b72c4e3a..f14e7929ba22 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -97,18 +97,12 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work);
 
 static void wusb_dev_free(struct wusb_dev *wusb_dev)
 {
-        if (wusb_dev) {
-                kfree(wusb_dev->set_gtk_req);
-                usb_free_urb(wusb_dev->set_gtk_urb);
-                kfree(wusb_dev);
-        }
+        kfree(wusb_dev);
 }
 
 static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 {
         struct wusb_dev *wusb_dev;
-        struct urb *urb;
-        struct usb_ctrlrequest *req;
 
         wusb_dev = kzalloc(sizeof(*wusb_dev), GFP_KERNEL);
         if (wusb_dev == NULL)
@@ -118,22 +112,6 @@ static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 
         INIT_WORK(&wusb_dev->devconnect_acked_work, wusbhc_devconnect_acked_work);
 
-        urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (urb == NULL)
-                goto err;
-        wusb_dev->set_gtk_urb = urb;
-
-        req = kmalloc(sizeof(*req), GFP_KERNEL);
-        if (req == NULL)
-                goto err;
-        wusb_dev->set_gtk_req = req;
-
-        req->bRequestType = USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
-        req->bRequest = USB_REQ_SET_DESCRIPTOR;
-        req->wValue = cpu_to_le16(USB_DT_KEY << 8 | wusbhc->gtk_index);
-        req->wIndex = 0;
-        req->wLength = cpu_to_le16(wusbhc->gtk.descr.bLength);
-
         return wusb_dev;
 err:
         wusb_dev_free(wusb_dev);
@@ -411,9 +389,6 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
 /*
  * Refresh the list of keep alives to emit in the MMC
  *
- * Some devices don't respond to keep alives unless they've been
- * authenticated, so skip unauthenticated devices.
- *
  * We only publish the first four devices that have a coming timeout
  * condition. Then when we are done processing those, we go for the
  * next ones. We ignore the ones that have timed out already (they'll
@@ -448,7 +423,7 @@ static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
 
                 if (wusb_dev == NULL)
                         continue;
-                if (wusb_dev->usb_dev == NULL || !wusb_dev->usb_dev->authenticated)
+                if (wusb_dev->usb_dev == NULL)
                         continue;
 
                 if (time_after(jiffies, wusb_dev->entry_ts + tt)) {
@@ -524,11 +499,19 @@ static struct wusb_dev *wusbhc_find_dev_by_addr(struct wusbhc *wusbhc, u8 addr)
  *
  * @wusbhc shall be referenced and unlocked
  */
-static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
+static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, u8 srcaddr)
 {
+        struct wusb_dev *wusb_dev;
+
         mutex_lock(&wusbhc->mutex);
-        wusb_dev->entry_ts = jiffies;
-        __wusbhc_keep_alive(wusbhc);
+        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
+        if (wusb_dev == NULL) {
+                dev_dbg(wusbhc->dev, "ignoring DN_Alive from unconnected device %02x\n",
+                        srcaddr);
+        } else {
+                wusb_dev->entry_ts = jiffies;
+                __wusbhc_keep_alive(wusbhc);
+        }
         mutex_unlock(&wusbhc->mutex);
 }
 
@@ -582,14 +565,22 @@ static void wusbhc_handle_dn_connect(struct wusbhc *wusbhc,
  *
  * @wusbhc shall be referenced and unlocked
  */
-static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
+static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, u8 srcaddr)
 {
         struct device *dev = wusbhc->dev;
-
-        dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n", wusb_dev->addr);
+        struct wusb_dev *wusb_dev;
 
         mutex_lock(&wusbhc->mutex);
-        __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, wusb_dev->port_idx));
+        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
+        if (wusb_dev == NULL) {
+                dev_dbg(dev, "ignoring DN DISCONNECT from unconnected device %02x\n",
+                        srcaddr);
+        } else {
+                dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n",
+                        wusb_dev->addr);
+                __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc,
+                        wusb_dev->port_idx));
+        }
         mutex_unlock(&wusbhc->mutex);
 }
 
@@ -611,30 +602,21 @@ void wusbhc_handle_dn(struct wusbhc *wusbhc, u8 srcaddr,
                       struct wusb_dn_hdr *dn_hdr, size_t size)
 {
         struct device *dev = wusbhc->dev;
-        struct wusb_dev *wusb_dev;
 
         if (size < sizeof(struct wusb_dn_hdr)) {
                 dev_err(dev, "DN data shorter than DN header (%d < %d)\n",
                         (int)size, (int)sizeof(struct wusb_dn_hdr));
                 return;
         }
-
-        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
-        if (wusb_dev == NULL && dn_hdr->bType != WUSB_DN_CONNECT) {
-                dev_dbg(dev, "ignoring DN %d from unconnected device %02x\n",
-                        dn_hdr->bType, srcaddr);
-                return;
-        }
-
         switch (dn_hdr->bType) {
         case WUSB_DN_CONNECT:
                 wusbhc_handle_dn_connect(wusbhc, dn_hdr, size);
                 break;
         case WUSB_DN_ALIVE:
-                wusbhc_handle_dn_alive(wusbhc, wusb_dev);
+                wusbhc_handle_dn_alive(wusbhc, srcaddr);
                 break;
         case WUSB_DN_DISCONNECT:
-                wusbhc_handle_dn_disconnect(wusbhc, wusb_dev);
+                wusbhc_handle_dn_disconnect(wusbhc, srcaddr);
                 break;
         case WUSB_DN_MASAVAILCHANGED:
         case WUSB_DN_RWAKE:
diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c
index dd88441c8f78..4c40d0dbf53d 100644
--- a/drivers/usb/wusbcore/security.c
+++ b/drivers/usb/wusbcore/security.c
@@ -29,19 +29,16 @@
 #include <linux/export.h>
 #include "wusbhc.h"
 
-static void wusbhc_set_gtk_callback(struct urb *urb);
-static void wusbhc_gtk_rekey_done_work(struct work_struct *work);
+static void wusbhc_gtk_rekey_work(struct work_struct *work);
 
 int wusbhc_sec_create(struct wusbhc *wusbhc)
 {
         wusbhc->gtk.descr.bLength = sizeof(wusbhc->gtk.descr) + sizeof(wusbhc->gtk.data);
         wusbhc->gtk.descr.bDescriptorType = USB_DT_KEY;
         wusbhc->gtk.descr.bReserved = 0;
+        wusbhc->gtk_index = 0;
 
-        wusbhc->gtk_index = wusb_key_index(0, WUSB_KEY_INDEX_TYPE_GTK,
-                                           WUSB_KEY_INDEX_ORIGINATOR_HOST);
-
-        INIT_WORK(&wusbhc->gtk_rekey_done_work, wusbhc_gtk_rekey_done_work);
+        INIT_WORK(&wusbhc->gtk_rekey_work, wusbhc_gtk_rekey_work);
 
         return 0;
 }
@@ -113,7 +110,7 @@ int wusbhc_sec_start(struct wusbhc *wusbhc)
         wusbhc_generate_gtk(wusbhc);
 
         result = wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid,
-                                 &wusbhc->gtk.descr.bKeyData, key_size);
+                                &wusbhc->gtk.descr.bKeyData, key_size);
         if (result < 0)
                 dev_err(wusbhc->dev, "cannot set GTK for the host: %d\n",
                         result);
@@ -129,7 +126,7 @@ int wusbhc_sec_start(struct wusbhc *wusbhc)
  */
 void wusbhc_sec_stop(struct wusbhc *wusbhc)
 {
-        cancel_work_sync(&wusbhc->gtk_rekey_done_work);
+        cancel_work_sync(&wusbhc->gtk_rekey_work);
 }
 
 
@@ -185,12 +182,14 @@ static int wusb_dev_set_encryption(struct usb_device *usb_dev, int value)
 static int wusb_dev_set_gtk(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
 {
         struct usb_device *usb_dev = wusb_dev->usb_dev;
+        u8 key_index = wusb_key_index(wusbhc->gtk_index,
+                WUSB_KEY_INDEX_TYPE_GTK, WUSB_KEY_INDEX_ORIGINATOR_HOST);
 
         return usb_control_msg(
                 usb_dev, usb_sndctrlpipe(usb_dev, 0),
                 USB_REQ_SET_DESCRIPTOR,
                 USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
-                USB_DT_KEY << 8 | wusbhc->gtk_index, 0,
+                USB_DT_KEY << 8 | key_index, 0,
                 &wusbhc->gtk.descr, wusbhc->gtk.descr.bLength,
                 1000);
 }
@@ -520,24 +519,55 @@ error_kzalloc:
  * Once all connected and authenticated devices have received the new
  * GTK, switch the host to using it.
  */
-static void wusbhc_gtk_rekey_done_work(struct work_struct *work)
+static void wusbhc_gtk_rekey_work(struct work_struct *work)
 {
-        struct wusbhc *wusbhc = container_of(work, struct wusbhc, gtk_rekey_done_work);
+        struct wusbhc *wusbhc = container_of(work,
+                                        struct wusbhc, gtk_rekey_work);
         size_t key_size = sizeof(wusbhc->gtk.data);
+        int port_idx;
+        struct wusb_dev *wusb_dev, *wusb_dev_next;
+        LIST_HEAD(rekey_list);
 
         mutex_lock(&wusbhc->mutex);
+        /* generate the new key */
+        wusbhc_generate_gtk(wusbhc);
+        /* roll the gtk index. */
+        wusbhc->gtk_index = (wusbhc->gtk_index + 1) % (WUSB_KEY_INDEX_MAX + 1);
+        /*
+         * Save all connected devices on a list while holding wusbhc->mutex and
+         * take a reference to each one.  Then submit the set key request to
+         * them after releasing the lock in order to avoid a deadlock.
+         */
+        for (port_idx = 0; port_idx < wusbhc->ports_max; port_idx++) {
+                wusb_dev = wusbhc->port[port_idx].wusb_dev;
+                if (!wusb_dev || !wusb_dev->usb_dev
+                        || !wusb_dev->usb_dev->authenticated)
+                        continue;
 
-        if (--wusbhc->pending_set_gtks == 0)
-                wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid, &wusbhc->gtk.descr.bKeyData, key_size);
-
+                wusb_dev_get(wusb_dev);
+                list_add_tail(&wusb_dev->rekey_node, &rekey_list);
+        }
         mutex_unlock(&wusbhc->mutex);
-}
 
-static void wusbhc_set_gtk_callback(struct urb *urb)
-{
-        struct wusbhc *wusbhc = urb->context;
+        /* Submit the rekey requests without holding wusbhc->mutex. */
+        list_for_each_entry_safe(wusb_dev, wusb_dev_next, &rekey_list,
+                rekey_node) {
+                list_del_init(&wusb_dev->rekey_node);
+                dev_dbg(&wusb_dev->usb_dev->dev, "%s: rekey device at port %d\n",
+                        __func__, wusb_dev->port_idx);
+
+                if (wusb_dev_set_gtk(wusbhc, wusb_dev) < 0) {
+                        dev_err(&wusb_dev->usb_dev->dev, "%s: rekey device at port %d failed\n",
+                                __func__, wusb_dev->port_idx);
+                }
+                wusb_dev_put(wusb_dev);
+        }
 
-        queue_work(wusbd, &wusbhc->gtk_rekey_done_work);
+        /* Switch the host controller to use the new GTK. */
+        mutex_lock(&wusbhc->mutex);
+        wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid,
+                &wusbhc->gtk.descr.bKeyData, key_size);
+        mutex_unlock(&wusbhc->mutex);
 }
 
 /**
@@ -553,26 +583,12 @@ static void wusbhc_set_gtk_callback(struct urb *urb)
  */
 void wusbhc_gtk_rekey(struct wusbhc *wusbhc)
 {
-        static const size_t key_size = sizeof(wusbhc->gtk.data);
-        int p;
-
-        wusbhc_generate_gtk(wusbhc);
-
-        for (p = 0; p < wusbhc->ports_max; p++) {
-                struct wusb_dev *wusb_dev;
-
-                wusb_dev = wusbhc->port[p].wusb_dev;
-                if (!wusb_dev || !wusb_dev->usb_dev || !wusb_dev->usb_dev->authenticated)
-                        continue;
-
-                usb_fill_control_urb(wusb_dev->set_gtk_urb, wusb_dev->usb_dev,
-                                     usb_sndctrlpipe(wusb_dev->usb_dev, 0),
-                                     (void *)wusb_dev->set_gtk_req,
-                                     &wusbhc->gtk.descr, wusbhc->gtk.descr.bLength,
-                                     wusbhc_set_gtk_callback, wusbhc);
-                if (usb_submit_urb(wusb_dev->set_gtk_urb, GFP_KERNEL) == 0)
-                        wusbhc->pending_set_gtks++;
-        }
-        if (wusbhc->pending_set_gtks == 0)
-                wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid, &wusbhc->gtk.descr.bKeyData, key_size);
+        /*
+         * We need to submit a URB to the downstream WUSB devices in order to
+         * change the group key.  This can't be done while holding the
+         * wusbhc->mutex since that is also taken in the urb_enqueue routine
+         * and will cause a deadlock.  Instead, queue a work item to do
+         * it when the lock is not held
+         */
+        queue_work(wusbd, &wusbhc->gtk_rekey_work);
 }
diff --git a/drivers/usb/wusbcore/wusbhc.h b/drivers/usb/wusbcore/wusbhc.h
index 711b1952b114..6bd3b819a6b5 100644
--- a/drivers/usb/wusbcore/wusbhc.h
+++ b/drivers/usb/wusbcore/wusbhc.h
@@ -97,6 +97,7 @@ struct wusb_dev {
         struct kref refcnt;
         struct wusbhc *wusbhc;
         struct list_head cack_node;     /* Connect-Ack list */
+        struct list_head rekey_node;    /* GTK rekey list */
         u8 port_idx;
         u8 addr;
         u8 beacon_type:4;
@@ -107,8 +108,6 @@ struct wusb_dev {
         struct usb_wireless_cap_descriptor *wusb_cap_descr;
         struct uwb_mas_bm availability;
         struct work_struct devconnect_acked_work;
-        struct urb *set_gtk_urb;
-        struct usb_ctrlrequest *set_gtk_req;
         struct usb_device *usb_dev;
 };
 
@@ -296,8 +295,7 @@ struct wusbhc {
         } __attribute__((packed)) gtk;
         u8 gtk_index;
         u32 gtk_tkid;
-        struct work_struct gtk_rekey_done_work;
-        int pending_set_gtks;
+        struct work_struct gtk_rekey_work;
 
         struct usb_encryption_descriptor *ccm1_etd;
 };
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 8521051cf946..cd961622f9c1 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -131,6 +131,7 @@ static const struct platform_device_id atmel_lcdfb_devtypes[] = {
                 /* terminator */
         }
 };
+MODULE_DEVICE_TABLE(platform, atmel_lcdfb_devtypes);
 
 static struct atmel_lcdfb_config *
 atmel_lcdfb_get_config(struct platform_device *pdev)
diff --git a/drivers/video/kyro/fbdev.c b/drivers/video/kyro/fbdev.c
index 50c857477e4f..65041e15fd59 100644
--- a/drivers/video/kyro/fbdev.c
+++ b/drivers/video/kyro/fbdev.c
@@ -624,15 +624,15 @@ static int kyrofb_ioctl(struct fb_info *info,
                         return -EINVAL;
                 }
         case KYRO_IOCTL_UVSTRIDE:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(deviceInfo.ulOverlayUVStride)))
                         return -EFAULT;
                 break;
         case KYRO_IOCTL_STRIDE:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(deviceInfo.ulOverlayStride)))
                         return -EFAULT;
                 break;
         case KYRO_IOCTL_OVERLAY_OFFSET:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(deviceInfo.ulOverlayOffset)))
                         return -EFAULT;
                 break;
         }
diff --git a/drivers/video/offb.c b/drivers/video/offb.c
index 9dbea2223401..7d44d669d5b6 100644
--- a/drivers/video/offb.c
+++ b/drivers/video/offb.c
@@ -91,6 +91,15 @@ extern boot_infos_t *boot_infos;
 #define AVIVO_DC_LUTB_WHITE_OFFSET_GREEN        0x6cd4
 #define AVIVO_DC_LUTB_WHITE_OFFSET_RED          0x6cd8
 
+#define FB_RIGHT_POS(p, bpp)         (fb_be_math(p) ? 0 : (32 - (bpp)))
+
+static inline u32 offb_cmap_byteswap(struct fb_info *info, u32 value)
+{
+        u32 bpp = info->var.bits_per_pixel;
+
+        return cpu_to_be32(value) >> FB_RIGHT_POS(info, bpp);
+}
+
     /*
      *  Set a single color register. The values supplied are already
      *  rounded down to the hardware's capabilities (according to the
@@ -120,7 +129,7 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                         mask <<= info->var.transp.offset;
                         value |= mask;
                 }
-                pal[regno] = value;
+                pal[regno] = offb_cmap_byteswap(info, value);
                 return 0;
         }
 
@@ -301,7 +310,7 @@ static struct fb_ops offb_ops = {
 static void __iomem *offb_map_reg(struct device_node *np, int index,
                                   unsigned long offset, unsigned long size)
 {
-        const u32 *addrp;
+        const __be32 *addrp;
         u64 asize, taddr;
         unsigned int flags;
 
@@ -369,7 +378,11 @@ static void offb_init_palette_hacks(struct fb_info *info, struct device_node *dp
                 }
                 of_node_put(pciparent);
         } else if (dp && of_device_is_compatible(dp, "qemu,std-vga")) {
-                const u32 io_of_addr[3] = { 0x01000000, 0x0, 0x0 };
+#ifdef __BIG_ENDIAN
+                const __be32 io_of_addr[3] = { 0x01000000, 0x0, 0x0 };
+#else
+                const __be32 io_of_addr[3] = { 0x00000001, 0x0, 0x0 };
+#endif
                 u64 io_addr = of_translate_address(dp, io_of_addr);
                 if (io_addr != OF_BAD_ADDR) {
                         par->cmap_adr = ioremap(io_addr + 0x3c8, 2);
@@ -535,7 +548,7 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
         unsigned int flags, rsize, addr_prop = 0;
         unsigned long max_size = 0;
         u64 rstart, address = OF_BAD_ADDR;
-        const u32 *pp, *addrp, *up;
+        const __be32 *pp, *addrp, *up;
         u64 asize;
         int foreign_endian = 0;
 
@@ -551,25 +564,25 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
         if (pp == NULL)
                 pp = of_get_property(dp, "depth", &len);
         if (pp && len == sizeof(u32))
-                depth = *pp;
+                depth = be32_to_cpup(pp);
 
         pp = of_get_property(dp, "linux,bootx-width", &len);
         if (pp == NULL)
                 pp = of_get_property(dp, "width", &len);
         if (pp && len == sizeof(u32))
-                width = *pp;
+                width = be32_to_cpup(pp);
 
         pp = of_get_property(dp, "linux,bootx-height", &len);
         if (pp == NULL)
                 pp = of_get_property(dp, "height", &len);
         if (pp && len == sizeof(u32))
-                height = *pp;
+                height = be32_to_cpup(pp);
 
         pp = of_get_property(dp, "linux,bootx-linebytes", &len);
         if (pp == NULL)
                 pp = of_get_property(dp, "linebytes", &len);
         if (pp && len == sizeof(u32) && (*pp != 0xffffffffu))
-                pitch = *pp;
+                pitch = be32_to_cpup(pp);
         else
                 pitch = width * ((depth + 7) / 8);
 
diff --git a/drivers/video/omap2/displays-new/panel-sony-acx565akm.c b/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
index e6d56f714ae4..d94f35dbd536 100644
--- a/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
+++ b/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
@@ -526,6 +526,8 @@ static int acx565akm_panel_power_on(struct omap_dss_device *dssdev)
         struct omap_dss_device *in = ddata->in;
         int r;
 
+        mutex_lock(&ddata->mutex);
+
         dev_dbg(&ddata->spi->dev, "%s\n", __func__);
 
         in->ops.sdi->set_timings(in, &ddata->videomode);
@@ -614,10 +616,7 @@ static int acx565akm_enable(struct omap_dss_device *dssdev)
         if (omapdss_device_is_enabled(dssdev))
                 return 0;
 
-        mutex_lock(&ddata->mutex);
         r = acx565akm_panel_power_on(dssdev);
-        mutex_unlock(&ddata->mutex);
-
         if (r)
                 return r;
 
diff --git a/drivers/video/sh_mobile_meram.c b/drivers/video/sh_mobile_meram.c
index e0f098562a74..a297de5cc859 100644
--- a/drivers/video/sh_mobile_meram.c
+++ b/drivers/video/sh_mobile_meram.c
@@ -569,6 +569,7 @@ EXPORT_SYMBOL_GPL(sh_mobile_meram_cache_update);
  * Power management
  */
 
+#if defined(CONFIG_PM_SLEEP) || defined(CONFIG_PM_RUNTIME)
 static int sh_mobile_meram_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -611,6 +612,7 @@ static int sh_mobile_meram_resume(struct device *dev)
                 meram_write_reg(priv->base, common_regs[i], priv->regs[i]);
         return 0;
 }
+#endif /* CONFIG_PM_SLEEP || CONFIG_PM_RUNTIME */
 
 static UNIVERSAL_DEV_PM_OPS(sh_mobile_meram_dev_pm_ops,
                             sh_mobile_meram_suspend,
diff --git a/drivers/video/vt8500lcdfb.c b/drivers/video/vt8500lcdfb.c
index b30e5a439d1f..a8f2b280f796 100644
--- a/drivers/video/vt8500lcdfb.c
+++ b/drivers/video/vt8500lcdfb.c
@@ -293,8 +293,7 @@ static int vt8500lcd_probe(struct platform_device *pdev)
                         + sizeof(u32) * 16, GFP_KERNEL);
         if (!fbi) {
                 dev_err(&pdev->dev, "Failed to initialize framebuffer device\n");
-                ret = -ENOMEM;
-                goto failed;
+                return -ENOMEM;
         }
 
         strcpy(fbi->fb.fix.id, "VT8500 LCD");
@@ -327,15 +326,13 @@ static int vt8500lcd_probe(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (res == NULL) {
                 dev_err(&pdev->dev, "no I/O memory resource defined\n");
-                ret = -ENODEV;
-                goto failed_fbi;
+                return -ENODEV;
         }
 
         res = request_mem_region(res->start, resource_size(res), "vt8500lcd");
         if (res == NULL) {
                 dev_err(&pdev->dev, "failed to request I/O memory\n");
-                ret = -EBUSY;
-                goto failed_fbi;
+                return -EBUSY;
         }
 
         fbi->regbase = ioremap(res->start, resource_size(res));
@@ -346,17 +343,19 @@ static int vt8500lcd_probe(struct platform_device *pdev)
         }
 
         disp_timing = of_get_display_timings(pdev->dev.of_node);
-        if (!disp_timing)
-                return -EINVAL;
+        if (!disp_timing) {
+                ret = -EINVAL;
+                goto failed_free_io;
+        }
 
         ret = of_get_fb_videomode(pdev->dev.of_node, &of_mode,
                                                         OF_USE_NATIVE_MODE);
         if (ret)
-                return ret;
+                goto failed_free_io;
 
         ret = of_property_read_u32(pdev->dev.of_node, "bits-per-pixel", &bpp);
         if (ret)
-                return ret;
+                goto failed_free_io;
 
         /* try allocating the framebuffer */
         fb_mem_len = of_mode.xres * of_mode.yres * 2 * (bpp / 8);
@@ -364,7 +363,8 @@ static int vt8500lcd_probe(struct platform_device *pdev)
                                 GFP_KERNEL);
         if (!fb_mem_virt) {
                 pr_err("%s: Failed to allocate framebuffer\n", __func__);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto failed_free_io;
         }
 
         fbi->fb.fix.smem_start  = fb_mem_phys;
@@ -447,9 +447,6 @@ failed_free_io:
         iounmap(fbi->regbase);
 failed_free_res:
         release_mem_region(res->start, resource_size(res));
-failed_fbi:
-        kfree(fbi);
-failed:
         return ret;
 }
 
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index a6a2cebb2587..cafa973c43be 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -19,7 +19,6 @@
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
 #include <linux/of_address.h>
-#include <linux/miscdevice.h>
 
 #define PM_RSTC                         0x1c
 #define PM_WDOG                         0x24
diff --git a/drivers/watchdog/ep93xx_wdt.c b/drivers/watchdog/ep93xx_wdt.c
index 833e81311848..d1d07f2f69df 100644
--- a/drivers/watchdog/ep93xx_wdt.c
+++ b/drivers/watchdog/ep93xx_wdt.c
@@ -28,7 +28,6 @@
 
 #include <linux/platform_device.h>
 #include <linux/module.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/timer.h>
 #include <linux/io.h>
diff --git a/drivers/watchdog/ie6xx_wdt.c b/drivers/watchdog/ie6xx_wdt.c
index 70a240297c6d..07f88f54e5c0 100644
--- a/drivers/watchdog/ie6xx_wdt.c
+++ b/drivers/watchdog/ie6xx_wdt.c
@@ -28,7 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/watchdog.h>
-#include <linux/miscdevice.h>
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
diff --git a/drivers/watchdog/jz4740_wdt.c b/drivers/watchdog/jz4740_wdt.c
index 2de486a7eea1..3aa50cfa335f 100644
--- a/drivers/watchdog/jz4740_wdt.c
+++ b/drivers/watchdog/jz4740_wdt.c
@@ -17,7 +17,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c
index a1a3638c579c..20dc73844737 100644
--- a/drivers/watchdog/kempld_wdt.c
+++ b/drivers/watchdog/kempld_wdt.c
@@ -26,7 +26,6 @@
 
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/miscdevice.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/max63xx_wdt.c b/drivers/watchdog/max63xx_wdt.c
index 6d4f3998e1f6..bdb3f4a5b27c 100644
--- a/drivers/watchdog/max63xx_wdt.c
+++ b/drivers/watchdog/max63xx_wdt.c
@@ -19,7 +19,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/bitops.h>
diff --git a/drivers/watchdog/orion_wdt.c b/drivers/watchdog/orion_wdt.c
index 44edca66d564..f7722a424676 100644
--- a/drivers/watchdog/orion_wdt.c
+++ b/drivers/watchdog/orion_wdt.c
@@ -16,7 +16,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/platform_device.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 1bdcc313e1d9..5bec20f5dc2d 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -23,7 +23,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
index 53d37fea183e..d92c2d5859ce 100644
--- a/drivers/watchdog/rt2880_wdt.c
+++ b/drivers/watchdog/rt2880_wdt.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/watchdog.h>
-#include <linux/miscdevice.h>
 #include <linux/moduleparam.h>
 #include <linux/platform_device.h>
 
diff --git a/drivers/watchdog/sc1200wdt.c b/drivers/watchdog/sc1200wdt.c
index 3b9fff9dcf65..131193a7acdf 100644
--- a/drivers/watchdog/sc1200wdt.c
+++ b/drivers/watchdog/sc1200wdt.c
@@ -409,8 +409,9 @@ static int __init sc1200wdt_init(void)
 #if defined CONFIG_PNP
         /* now that the user has specified an IO port and we haven't detected
          * any devices, disable pnp support */
+        if (isapnp)
+                pnp_unregister_driver(&scl200wdt_pnp_driver);
         isapnp = 0;
-        pnp_unregister_driver(&scl200wdt_pnp_driver);
 #endif
 
         if (!request_region(io, io_len, SC1200_MODULE_NAME)) {
diff --git a/drivers/watchdog/shwdt.c b/drivers/watchdog/shwdt.c
index f9b8e06f3558..af3528f84d65 100644
--- a/drivers/watchdog/shwdt.c
+++ b/drivers/watchdog/shwdt.c
@@ -26,7 +26,6 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/spinlock.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/pm_runtime.h>
 #include <linux/fs.h>
diff --git a/drivers/watchdog/softdog.c b/drivers/watchdog/softdog.c
index ef2638fee4a8..c04a1aa158e2 100644
--- a/drivers/watchdog/softdog.c
+++ b/drivers/watchdog/softdog.c
@@ -42,7 +42,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/timer.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/notifier.h>
 #include <linux/reboot.h>
diff --git a/drivers/watchdog/stmp3xxx_rtc_wdt.c b/drivers/watchdog/stmp3xxx_rtc_wdt.c
index d667f6b51d35..bb64ae3f47da 100644
--- a/drivers/watchdog/stmp3xxx_rtc_wdt.c
+++ b/drivers/watchdog/stmp3xxx_rtc_wdt.c
@@ -12,7 +12,6 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
 #include <linux/stmp3xxx_rtc_wdt.h>
diff --git a/drivers/watchdog/txx9wdt.c b/drivers/watchdog/txx9wdt.c
index 0fd0e8ae62a8..6a447e321dd0 100644
--- a/drivers/watchdog/txx9wdt.c
+++ b/drivers/watchdog/txx9wdt.c
@@ -13,7 +13,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/types.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/ux500_wdt.c b/drivers/watchdog/ux500_wdt.c
index e029b5768f2c..5aed9d7ad47e 100644
--- a/drivers/watchdog/ux500_wdt.c
+++ b/drivers/watchdog/ux500_wdt.c
@@ -12,7 +12,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/moduleparam.h>
-#include <linux/miscdevice.h>
 #include <linux/err.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 62ccf5424ba8..028387192b60 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -930,9 +930,10 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
                 ret = m2p_add_override(mfn, pages[i], kmap_ops ?
                                        &kmap_ops[i] : NULL);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
+ out:
         if (lazy)
                 arch_leave_lazy_mmu_mode();
 
@@ -969,9 +970,10 @@ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
                 ret = m2p_remove_override(pages[i], kmap_ops ?
                                        &kmap_ops[i] : NULL);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
+ out:
         if (lazy)
                 arch_leave_lazy_mmu_mode();
 
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index a224bc74b6b9..1eac0731c349 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -555,6 +555,11 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl,
                                 sg_dma_len(sgl) = 0;
                                 return 0;
                         }
+                        xen_dma_map_page(hwdev, pfn_to_page(map >> PAGE_SHIFT),
+                                                map & ~PAGE_MASK,
+                                                sg->length,
+                                                dir,
+                                                attrs);
                         sg->dma_address = xen_phys_to_bus(map);
                 } else {
                         /* we are not interested in the dma_addr returned by