581 files changed, 5901 insertions, 3736 deletions
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 22327e6a7236..6efe2ac6902f 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -24,7 +24,7 @@ menuconfig ACPI
          are configured, ACPI is used.
          The project home page for the Linux ACPI subsystem is here:
-          <http://www.lesswatts.org/projects/acpi/>
+          <https://01.org/linux-acpi>
          Linux support for ACPI is based on Intel Corporation's ACPI
          Component Architecture (ACPI CA).  For more information on the
@@ -123,9 +123,9 @@ config ACPI_BUTTON
        default y
        help
          This driver handles events on the power, sleep, and lid buttons.
-          A daemon reads /proc/acpi/event and perform user-defined actions
+          A daemon reads events from input devices or via netlink and
-          such as shutting down the system.  This is necessary for
+          performs user-defined actions such as shutting down the system.
-          software-controlled poweroff.
+          This is necessary for software-controlled poweroff.
          To compile this driver as a module, choose M here:
          the module will be called button.
diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
index f40acef80269..a6977e12d574 100644
--- a/drivers/acpi/acpi_ipmi.c
+++ b/drivers/acpi/acpi_ipmi.c
@@ -39,6 +39,7 @@
 #include <linux/ipmi.h>
 #include <linux/device.h>
 #include <linux/pnp.h>
+#include <linux/spinlock.h>
 MODULE_AUTHOR("Zhao Yakui");
 MODULE_DESCRIPTION("ACPI IPMI Opregion driver");
@@ -57,7 +58,7 @@ struct acpi_ipmi_device {
        struct list_head head;
        /* the IPMI request message list */
        struct list_head tx_msg_list;
-        struct mutex    tx_msg_lock;
+        spinlock_t      tx_msg_lock;
        acpi_handle handle;
        struct pnp_dev *pnp_dev;
        ipmi_user_t     user_interface;
@@ -147,6 +148,7 @@ static void acpi_format_ipmi_msg(struct acpi_ipmi_msg *tx_msg,
        struct kernel_ipmi_msg *msg;
        struct acpi_ipmi_buffer *buffer;
        struct acpi_ipmi_device *device;
+        unsigned long flags;
        msg = &tx_msg->tx_message;
        /*
@@ -177,10 +179,10 @@ static void acpi_format_ipmi_msg(struct acpi_ipmi_msg *tx_msg,
        /* Get the msgid */
        device = tx_msg->device;
-        mutex_lock(&device->tx_msg_lock);
+        spin_lock_irqsave(&device->tx_msg_lock, flags);
        device->curr_msgid++;
        tx_msg->tx_msgid = device->curr_msgid;
-        mutex_unlock(&device->tx_msg_lock);
+        spin_unlock_irqrestore(&device->tx_msg_lock, flags);
 }
 static void acpi_format_ipmi_response(struct acpi_ipmi_msg *msg,
@@ -242,6 +244,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
        int msg_found = 0;
        struct acpi_ipmi_msg *tx_msg;
        struct pnp_dev *pnp_dev = ipmi_device->pnp_dev;
+        unsigned long flags;
        if (msg->user != ipmi_device->user_interface) {
                dev_warn(&pnp_dev->dev, "Unexpected response is returned. "
@@ -250,7 +253,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
                ipmi_free_recv_msg(msg);
                return;
        }
-        mutex_lock(&ipmi_device->tx_msg_lock);
+        spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
        list_for_each_entry(tx_msg, &ipmi_device->tx_msg_list, head) {
                if (msg->msgid == tx_msg->tx_msgid) {
                        msg_found = 1;
@@ -258,7 +261,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
                }
        }
-        mutex_unlock(&ipmi_device->tx_msg_lock);
+        spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
        if (!msg_found) {
                dev_warn(&pnp_dev->dev, "Unexpected response (msg id %ld) is "
                        "returned.\n", msg->msgid);
@@ -378,6 +381,7 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
        struct acpi_ipmi_device *ipmi_device = handler_context;
        int err, rem_time;
        acpi_status status;
+        unsigned long flags;
        /*
         * IPMI opregion message.
         * IPMI message is firstly written to the BMC and system software
@@ -395,9 +399,9 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
                return AE_NO_MEMORY;
        acpi_format_ipmi_msg(tx_msg, address, value);
-        mutex_lock(&ipmi_device->tx_msg_lock);
+        spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
        list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
-        mutex_unlock(&ipmi_device->tx_msg_lock);
+        spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
        err = ipmi_request_settime(ipmi_device->user_interface,
                                        &tx_msg->addr,
                                        tx_msg->tx_msgid,
@@ -413,9 +417,9 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
        status = AE_OK;
 end_label:
-        mutex_lock(&ipmi_device->tx_msg_lock);
+        spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
        list_del(&tx_msg->head);
-        mutex_unlock(&ipmi_device->tx_msg_lock);
+        spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
        kfree(tx_msg);
        return status;
 }
@@ -457,7 +461,7 @@ static void acpi_add_ipmi_device(struct acpi_ipmi_device *ipmi_device)
        INIT_LIST_HEAD(&ipmi_device->head);
-        mutex_init(&ipmi_device->tx_msg_lock);
+        spin_lock_init(&ipmi_device->tx_msg_lock);
        INIT_LIST_HEAD(&ipmi_device->tx_msg_list);
        ipmi_install_space_handler(ipmi_device);
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 59d3202f6b36..a94383d1f350 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1025,60 +1025,4 @@ void acpi_dev_pm_detach(struct device *dev, bool power_off)
        }
 }
 EXPORT_SYMBOL_GPL(acpi_dev_pm_detach);
-/**
- * acpi_dev_pm_add_dependent - Add physical device depending for PM.
- * @handle: Handle of ACPI device node.
- * @depdev: Device depending on that node for PM.
- */
-void acpi_dev_pm_add_dependent(acpi_handle handle, struct device *depdev)
-{
-        struct acpi_device_physical_node *dep;
-        struct acpi_device *adev;
-        if (!depdev || acpi_bus_get_device(handle, &adev))
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(dep, &adev->power_dependent, node)
-                if (dep->dev == depdev)
-                        goto out;
-        dep = kzalloc(sizeof(*dep), GFP_KERNEL);
-        if (dep) {
-                dep->dev = depdev;
-                list_add_tail(&dep->node, &adev->power_dependent);
-        }
- out:
-        mutex_unlock(&adev->physical_node_lock);
-}
-EXPORT_SYMBOL_GPL(acpi_dev_pm_add_dependent);
-/**
- * acpi_dev_pm_remove_dependent - Remove physical device depending for PM.
- * @handle: Handle of ACPI device node.
- * @depdev: Device depending on that node for PM.
- */
-void acpi_dev_pm_remove_dependent(acpi_handle handle, struct device *depdev)
-{
-        struct acpi_device_physical_node *dep;
-        struct acpi_device *adev;
-        if (!depdev || acpi_bus_get_device(handle, &adev))
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(dep, &adev->power_dependent, node)
-                if (dep->dev == depdev) {
-                        list_del(&dep->node);
-                        kfree(dep);
-                        break;
-                }
-        mutex_unlock(&adev->physical_node_lock);
-}
-EXPORT_SYMBOL_GPL(acpi_dev_pm_remove_dependent);
 #endif /* CONFIG_PM */
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 0dbe5cdf3396..c2ad391d8041 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -59,16 +59,9 @@ ACPI_MODULE_NAME("power");
 #define ACPI_POWER_RESOURCE_STATE_ON    0x01
 #define ACPI_POWER_RESOURCE_STATE_UNKNOWN 0xFF
-struct acpi_power_dependent_device {
-        struct list_head node;
-        struct acpi_device *adev;
-        struct work_struct work;
-};
 struct acpi_power_resource {
        struct acpi_device device;
        struct list_head list_node;
-        struct list_head dependent;
        char *name;
        u32 system_level;
        u32 order;
@@ -233,32 +226,6 @@ static int acpi_power_get_list_state(struct list_head *list, int *state)
        return 0;
 }
-static void acpi_power_resume_dependent(struct work_struct *work)
-{
-        struct acpi_power_dependent_device *dep;
-        struct acpi_device_physical_node *pn;
-        struct acpi_device *adev;
-        int state;
-        dep = container_of(work, struct acpi_power_dependent_device, work);
-        adev = dep->adev;
-        if (acpi_power_get_inferred_state(adev, &state))
-                return;
-        if (state > ACPI_STATE_D0)
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(pn, &adev->physical_node_list, node)
-                pm_request_resume(pn->dev);
-        list_for_each_entry(pn, &adev->power_dependent, node)
-                pm_request_resume(pn->dev);
-        mutex_unlock(&adev->physical_node_lock);
-}
 static int __acpi_power_on(struct acpi_power_resource *resource)
 {
        acpi_status status = AE_OK;
@@ -283,14 +250,8 @@ static int acpi_power_on_unlocked(struct acpi_power_resource *resource)
                                  resource->name));
        } else {
                result = __acpi_power_on(resource);
-                if (result) {
+                if (result)
                        resource->ref_count--;
-                } else {
-                        struct acpi_power_dependent_device *dep;
-                        list_for_each_entry(dep, &resource->dependent, node)
-                                schedule_work(&dep->work);
-                }
        }
        return result;
 }
@@ -390,52 +351,6 @@ static int acpi_power_on_list(struct list_head *list)
        return result;
 }
-static void acpi_power_add_dependent(struct acpi_power_resource *resource,
-                                     struct acpi_device *adev)
-{
-        struct acpi_power_dependent_device *dep;
-        mutex_lock(&resource->resource_lock);
-        list_for_each_entry(dep, &resource->dependent, node)
-                if (dep->adev == adev)
-                        goto out;
-        dep = kzalloc(sizeof(*dep), GFP_KERNEL);
-        if (!dep)
-                goto out;
-        dep->adev = adev;
-        INIT_WORK(&dep->work, acpi_power_resume_dependent);
-        list_add_tail(&dep->node, &resource->dependent);
- out:
-        mutex_unlock(&resource->resource_lock);
-}
-static void acpi_power_remove_dependent(struct acpi_power_resource *resource,
-                                        struct acpi_device *adev)
-{
-        struct acpi_power_dependent_device *dep;
-        struct work_struct *work = NULL;
-        mutex_lock(&resource->resource_lock);
-        list_for_each_entry(dep, &resource->dependent, node)
-                if (dep->adev == adev) {
-                        list_del(&dep->node);
-                        work = &dep->work;
-                        break;
-                }
-        mutex_unlock(&resource->resource_lock);
-        if (work) {
-                cancel_work_sync(work);
-                kfree(dep);
-        }
-}
 static struct attribute *attrs[] = {
        NULL,
 };
@@ -524,8 +439,6 @@ static void acpi_power_expose_hide(struct acpi_device *adev,
 void acpi_power_add_remove_device(struct acpi_device *adev, bool add)
 {
-        struct acpi_device_power_state *ps;
-        struct acpi_power_resource_entry *entry;
        int state;
        if (adev->wakeup.flags.valid)
@@ -535,16 +448,6 @@ void acpi_power_add_remove_device(struct acpi_device *adev, bool add)
        if (!adev->power.flags.power_resources)
                return;
-        ps = &adev->power.states[ACPI_STATE_D0];
-        list_for_each_entry(entry, &ps->resources, node) {
-                struct acpi_power_resource *resource = entry->resource;
-                if (add)
-                        acpi_power_add_dependent(resource, adev);
-                else
-                        acpi_power_remove_dependent(resource, adev);
-        }
        for (state = ACPI_STATE_D0; state <= ACPI_STATE_D3_HOT; state++)
                acpi_power_expose_hide(adev,
                                       &adev->power.states[state].resources,
@@ -882,7 +785,6 @@ int acpi_add_power_resource(acpi_handle handle)
        acpi_init_device_object(device, handle, ACPI_BUS_TYPE_POWER,
                                ACPI_STA_DEFAULT);
        mutex_init(&resource->resource_lock);
-        INIT_LIST_HEAD(&resource->dependent);
        INIT_LIST_HEAD(&resource->list_node);
        resource->name = device->pnp.bus_id;
        strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
@@ -936,8 +838,10 @@ void acpi_resume_power_resources(void)
                mutex_lock(&resource->resource_lock);
                result = acpi_power_get_state(resource->device.handle, &state);
-                if (result)
+                if (result) {
+                        mutex_unlock(&resource->resource_lock);
                        continue;
+                }
                if (state == ACPI_POWER_RESOURCE_STATE_OFF
                    && resource->ref_count) {
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index fbdb82e70d10..fee8a297c7d9 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -968,7 +968,7 @@ int acpi_bus_get_device(acpi_handle handle, struct acpi_device **device)
        }
        return 0;
 }
-EXPORT_SYMBOL_GPL(acpi_bus_get_device);
+EXPORT_SYMBOL(acpi_bus_get_device);
 int acpi_device_add(struct acpi_device *device,
                    void (*release)(struct device *))
@@ -999,7 +999,6 @@ int acpi_device_add(struct acpi_device *device,
        INIT_LIST_HEAD(&device->wakeup_list);
        INIT_LIST_HEAD(&device->physical_node_list);
        mutex_init(&device->physical_node_lock);
-        INIT_LIST_HEAD(&device->power_dependent);
        new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL);
        if (!new_bus_id) {
@@ -1121,7 +1120,7 @@ int acpi_bus_register_driver(struct acpi_driver *driver)
 EXPORT_SYMBOL(acpi_bus_register_driver);
 /**
- * acpi_bus_unregister_driver - unregisters a driver with the APIC bus
+ * acpi_bus_unregister_driver - unregisters a driver with the ACPI bus
 * @driver: driver to unregister
 *
 * Unregisters a driver with the ACPI bus.  Searches the namespace for all
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 4ba8b0405572..ab714d2ad978 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -1035,17 +1035,3 @@ void ata_acpi_on_disable(struct ata_device *dev)
 {
        ata_acpi_clear_gtf(dev);
 }
-void ata_scsi_acpi_bind(struct ata_device *dev)
-{
-        acpi_handle handle = ata_dev_acpi_handle(dev);
-        if (handle)
-                acpi_dev_pm_add_dependent(handle, &dev->sdev->sdev_gendev);
-}
-void ata_scsi_acpi_unbind(struct ata_device *dev)
-{
-        acpi_handle handle = ata_dev_acpi_handle(dev);
-        if (handle)
-                acpi_dev_pm_remove_dependent(handle, &dev->sdev->sdev_gendev);
-}
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 97a0cef12959..db6dfcfa3e2e 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3679,7 +3679,6 @@ void ata_scsi_scan_host(struct ata_port *ap, int sync)
                        if (!IS_ERR(sdev)) {
                                dev->sdev = sdev;
                                scsi_device_put(sdev);
-                                ata_scsi_acpi_bind(dev);
                        } else {
                                dev->sdev = NULL;
                        }
@@ -3767,8 +3766,6 @@ static void ata_scsi_remove_dev(struct ata_device *dev)
        struct scsi_device *sdev;
        unsigned long flags;
-        ata_scsi_acpi_unbind(dev);
        /* Alas, we need to grab scan_mutex to ensure SCSI device
         * state doesn't change underneath us and thus
         * scsi_device_get() always succeeds.  The mutex locking can
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index eeeb77845d48..45b5ab3a95d5 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -121,8 +121,6 @@ extern void ata_acpi_set_state(struct ata_port *ap, pm_message_t state);
 extern void ata_acpi_bind_port(struct ata_port *ap);
 extern void ata_acpi_bind_dev(struct ata_device *dev);
 extern acpi_handle ata_dev_acpi_handle(struct ata_device *dev);
-extern void ata_scsi_acpi_bind(struct ata_device *dev);
-extern void ata_scsi_acpi_unbind(struct ata_device *dev);
 #else
 static inline void ata_acpi_dissociate(struct ata_host *host) { }
 static inline int ata_acpi_on_suspend(struct ata_port *ap) { return 0; }
@@ -133,8 +131,6 @@ static inline void ata_acpi_set_state(struct ata_port *ap,
                                      pm_message_t state) { }
 static inline void ata_acpi_bind_port(struct ata_port *ap) {}
 static inline void ata_acpi_bind_dev(struct ata_device *dev) {}
-static inline void ata_scsi_acpi_bind(struct ata_device *dev) {}
-static inline void ata_scsi_acpi_unbind(struct ata_device *dev) {}
 #endif
 /* libata-scsi.c */
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 958ba2a420c3..97f4acb54ad6 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -2,7 +2,7 @@
 *  sata_promise.c - Promise SATA
 *
 *  Maintained by:  Tejun Heo <tj@kernel.org>
- *                  Mikael Pettersson <mikpe@it.uu.se>
+ *                  Mikael Pettersson
 *                  Please ALWAYS copy linux-ide@vger.kernel.org
 *                  on emails.
 *
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 449f6298dc89..8557adcd34ee 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -2865,15 +2865,4 @@ static struct pci_driver he_driver = {
        .id_table =     he_pci_tbl,
 };
-static int __init he_init(void)
+module_pci_driver(he_driver);
-{
-        return pci_register_driver(&he_driver);
-}
-static void __exit he_cleanup(void)
-{
-        pci_unregister_driver(&he_driver);
-}
-module_init(he_init);
-module_exit(he_cleanup);
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 409502a78e7e..5aca5f4c5458 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -778,7 +778,7 @@ static int ns_init_card(int i, struct pci_dev *pcidev)
                return error;
        }
-        if (mac[i] == NULL || mac_pton(mac[i], card->atmdev->esi)) {
+        if (mac[i] == NULL || !mac_pton(mac[i], card->atmdev->esi)) {
                nicstar_read_eprom(card->membase, NICSTAR_EPROM_MAC_ADDR_OFFSET,
                                   card->atmdev->esi, 6);
                if (memcmp(card->atmdev->esi, "\x00\x00\x00\x00\x00\x00", 6) ==
diff --git a/drivers/base/core.c b/drivers/base/core.c
index c7cfadcf6752..34abf4d8a45f 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2017,7 +2017,7 @@ EXPORT_SYMBOL_GPL(device_move);
 */
 void device_shutdown(void)
 {
-        struct device *dev;
+        struct device *dev, *parent;
        spin_lock(&devices_kset->list_lock);
        /*
@@ -2034,7 +2034,7 @@ void device_shutdown(void)
                 * prevent it from being freed because parent's
                 * lock is to be held
                 */
-                get_device(dev->parent);
+                parent = get_device(dev->parent);
                get_device(dev);
                /*
                 * Make sure the device is off the kset list, in the
@@ -2044,8 +2044,8 @@ void device_shutdown(void)
                spin_unlock(&devices_kset->list_lock);
                /* hold lock to avoid race with probe/release */
-                if (dev->parent)
+                if (parent)
-                        device_lock(dev->parent);
+                        device_lock(parent);
                device_lock(dev);
                /* Don't allow any more runtime suspends */
@@ -2063,11 +2063,11 @@ void device_shutdown(void)
                }
                device_unlock(dev);
-                if (dev->parent)
+                if (parent)
-                        device_unlock(dev->parent);
+                        device_unlock(parent);
                put_device(dev);
-                put_device(dev->parent);
+                put_device(parent);
                spin_lock(&devices_kset->list_lock);
        }
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 9e59f6535c44..bece691cb5d9 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -333,8 +333,10 @@ store_mem_state(struct device *dev,
                online_type = ONLINE_KEEP;
        else if (!strncmp(buf, "offline", min_t(int, count, 7)))
                online_type = -1;
-        else
+        else {
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err;
+        }
        switch (online_type) {
        case ONLINE_KERNEL:
@@ -357,6 +359,7 @@ store_mem_state(struct device *dev,
                ret = -EINVAL; /* should never happen */
        }
+err:
        unlock_device_hotplug();
        if (ret)
diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index c9fd6943ce45..50329d1057ed 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -210,25 +210,6 @@ static void bcma_core_pci_config_fixup(struct bcma_drv_pci *pc)
        }
 }
-static void bcma_core_pci_power_save(struct bcma_drv_pci *pc, bool up)
-{
-        u16 data;
-        if (pc->core->id.rev >= 15 && pc->core->id.rev <= 20) {
-                data = up ? 0x74 : 0x7C;
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7F64);
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
-        } else if (pc->core->id.rev >= 21 && pc->core->id.rev <= 22) {
-                data = up ? 0x75 : 0x7D;
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7E65);
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
-        }
-}
 /**************************************************
 * Init.
 **************************************************/
@@ -255,6 +236,32 @@ void bcma_core_pci_init(struct bcma_drv_pci *pc)
                bcma_core_pci_clientmode_init(pc);
 }
+void bcma_core_pci_power_save(struct bcma_bus *bus, bool up)
+{
+        struct bcma_drv_pci *pc;
+        u16 data;
+        if (bus->hosttype != BCMA_HOSTTYPE_PCI)
+                return;
+        pc = &bus->drv_pci[0];
+        if (pc->core->id.rev >= 15 && pc->core->id.rev <= 20) {
+                data = up ? 0x74 : 0x7C;
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7F64);
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
+        } else if (pc->core->id.rev >= 21 && pc->core->id.rev <= 22) {
+                data = up ? 0x75 : 0x7D;
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7E65);
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
+        }
+}
+EXPORT_SYMBOL_GPL(bcma_core_pci_power_save);
 int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
                          bool enable)
 {
@@ -310,8 +317,6 @@ void bcma_core_pci_up(struct bcma_bus *bus)
        pc = &bus->drv_pci[0];
-        bcma_core_pci_power_save(pc, true);
        bcma_core_pci_extend_L1timer(pc, true);
 }
 EXPORT_SYMBOL_GPL(bcma_core_pci_up);
@@ -326,7 +331,5 @@ void bcma_core_pci_down(struct bcma_bus *bus)
        pc = &bus->drv_pci[0];
        bcma_core_pci_extend_L1timer(pc, false);
-        bcma_core_pci_power_save(pc, false);
 }
 EXPORT_SYMBOL_GPL(bcma_core_pci_down);
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index cd6b20fce680..37768401d113 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -269,6 +269,8 @@ static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 core
        return NULL;
 }
+#define IS_ERR_VALUE_U32(x) ((x) >= (u32)-MAX_ERRNO)
 static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                              struct bcma_device_id *match, int core_num,
                              struct bcma_device *core)
@@ -351,11 +353,11 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
         * the main register space for the core
         */
        tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_SLAVE, 0);
-        if (tmp == 0 || IS_ERR_VALUE(tmp)) {
+        if (tmp == 0 || IS_ERR_VALUE_U32(tmp)) {
                /* Try again to see if it is a bridge */
                tmp = bcma_erom_get_addr_desc(bus, eromptr,
                                              SCAN_ADDR_TYPE_BRIDGE, 0);
-                if (tmp == 0 || IS_ERR_VALUE(tmp)) {
+                if (tmp == 0 || IS_ERR_VALUE_U32(tmp)) {
                        return -EILSEQ;
                } else {
                        bcma_info(bus, "Bridge found\n");
@@ -369,7 +371,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                for (j = 0; ; j++) {
                        tmp = bcma_erom_get_addr_desc(bus, eromptr,
                                SCAN_ADDR_TYPE_SLAVE, i);
-                        if (IS_ERR_VALUE(tmp)) {
+                        if (IS_ERR_VALUE_U32(tmp)) {
                                /* no more entries for port _i_ */
                                /* pr_debug("erom: slave port %d "
                                 * "has %d descriptors\n", i, j); */
@@ -386,7 +388,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                for (j = 0; ; j++) {
                        tmp = bcma_erom_get_addr_desc(bus, eromptr,
                                SCAN_ADDR_TYPE_MWRAP, i);
-                        if (IS_ERR_VALUE(tmp)) {
+                        if (IS_ERR_VALUE_U32(tmp)) {
                                /* no more entries for port _i_ */
                                /* pr_debug("erom: master wrapper %d "
                                 * "has %d descriptors\n", i, j); */
@@ -404,7 +406,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                for (j = 0; ; j++) {
                        tmp = bcma_erom_get_addr_desc(bus, eromptr,
                                SCAN_ADDR_TYPE_SWRAP, i + hack);
-                        if (IS_ERR_VALUE(tmp)) {
+                        if (IS_ERR_VALUE_U32(tmp)) {
                                /* no more entries for port _i_ */
                                /* pr_debug("erom: master wrapper %d "
                                 * has %d descriptors\n", i, j); */
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index d2d95ff5353b..edfa2515bc86 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1189,6 +1189,7 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
        int err;
        u32 cp;
+        memset(&arg64, 0, sizeof(arg64));
        err = 0;
        err |=
            copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 639d26b90b91..2b9440384536 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -1193,6 +1193,7 @@ out_passthru:
                ida_pci_info_struct pciinfo;
                if (!arg) return -EINVAL;
+                memset(&pciinfo, 0, sizeof(pciinfo));
                pciinfo.bus = host->pci_dev->bus->number;
                pciinfo.dev_fn = host->pci_dev->devfn;
                pciinfo.board_id = host->board_id;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index b22a7d0fe5b7..cb1db2979d3d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -931,12 +931,14 @@ static const char *rbd_dev_v1_snap_name(struct rbd_device *rbd_dev,
                                        u64 snap_id)
 {
        u32 which;
+        const char *snap_name;
        which = rbd_dev_snap_index(rbd_dev, snap_id);
        if (which == BAD_SNAP_INDEX)
-                return NULL;
+                return ERR_PTR(-ENOENT);
-        return _rbd_dev_v1_snap_name(rbd_dev, which);
+        snap_name = _rbd_dev_v1_snap_name(rbd_dev, which);
+        return snap_name ? snap_name : ERR_PTR(-ENOMEM);
 }
 static const char *rbd_snap_name(struct rbd_device *rbd_dev, u64 snap_id)
@@ -2812,7 +2814,7 @@ out_err:
        obj_request_done_set(obj_request);
 }
-static int rbd_obj_notify_ack(struct rbd_device *rbd_dev, u64 notify_id)
+static int rbd_obj_notify_ack_sync(struct rbd_device *rbd_dev, u64 notify_id)
 {
        struct rbd_obj_request *obj_request;
        struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
@@ -2827,16 +2829,17 @@ static int rbd_obj_notify_ack(struct rbd_device *rbd_dev, u64 notify_id)
        obj_request->osd_req = rbd_osd_req_create(rbd_dev, false, obj_request);
        if (!obj_request->osd_req)
                goto out;
-        obj_request->callback = rbd_obj_request_put;
        osd_req_op_watch_init(obj_request->osd_req, 0, CEPH_OSD_OP_NOTIFY_ACK,
                                        notify_id, 0, 0);
        rbd_osd_req_format_read(obj_request);
        ret = rbd_obj_request_submit(osdc, obj_request);
-out:
        if (ret)
-                rbd_obj_request_put(obj_request);
+                goto out;
+        ret = rbd_obj_request_wait(obj_request);
+out:
+        rbd_obj_request_put(obj_request);
        return ret;
 }
@@ -2856,7 +2859,7 @@ static void rbd_watch_cb(u64 ver, u64 notify_id, u8 opcode, void *data)
        if (ret)
                rbd_warn(rbd_dev, "header refresh error (%d)\n", ret);
-        rbd_obj_notify_ack(rbd_dev, notify_id);
+        rbd_obj_notify_ack_sync(rbd_dev, notify_id);
 }
 /*
@@ -3328,6 +3331,31 @@ static void rbd_exists_validate(struct rbd_device *rbd_dev)
                clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
 }
+static void rbd_dev_update_size(struct rbd_device *rbd_dev)
+{
+        sector_t size;
+        bool removing;
+        /*
+         * Don't hold the lock while doing disk operations,
+         * or lock ordering will conflict with the bdev mutex via:
+         * rbd_add() -> blkdev_get() -> rbd_open()
+         */
+        spin_lock_irq(&rbd_dev->lock);
+        removing = test_bit(RBD_DEV_FLAG_REMOVING, &rbd_dev->flags);
+        spin_unlock_irq(&rbd_dev->lock);
+        /*
+         * If the device is being removed, rbd_dev->disk has
+         * been destroyed, so don't try to update its size
+         */
+        if (!removing) {
+                size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
+                dout("setting size to %llu sectors", (unsigned long long)size);
+                set_capacity(rbd_dev->disk, size);
+                revalidate_disk(rbd_dev->disk);
+        }
+}
 static int rbd_dev_refresh(struct rbd_device *rbd_dev)
 {
        u64 mapping_size;
@@ -3347,12 +3375,7 @@ static int rbd_dev_refresh(struct rbd_device *rbd_dev)
        up_write(&rbd_dev->header_rwsem);
        if (mapping_size != rbd_dev->mapping.size) {
-                sector_t size;
+                rbd_dev_update_size(rbd_dev);
-                size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
-                dout("setting size to %llu sectors", (unsigned long long)size);
-                set_capacity(rbd_dev->disk, size);
-                revalidate_disk(rbd_dev->disk);
        }
        return ret;
@@ -4061,8 +4084,13 @@ static u64 rbd_v2_snap_id_by_name(struct rbd_device *rbd_dev, const char *name)
                snap_id = snapc->snaps[which];
                snap_name = rbd_dev_v2_snap_name(rbd_dev, snap_id);
-                if (IS_ERR(snap_name))
+                if (IS_ERR(snap_name)) {
-                        break;
+                        /* ignore no-longer existing snapshots */
+                        if (PTR_ERR(snap_name) == -ENOENT)
+                                continue;
+                        else
+                                break;
+                }
                found = !strcmp(name, snap_name);
                kfree(snap_name);
        }
@@ -4141,8 +4169,8 @@ static int rbd_dev_spec_update(struct rbd_device *rbd_dev)
        /* Look up the snapshot name, and make a copy */
        snap_name = rbd_snap_name(rbd_dev, spec->snap_id);
-        if (!snap_name) {
+        if (IS_ERR(snap_name)) {
-                ret = -ENOMEM;
+                ret = PTR_ERR(snap_name);
                goto out_err;
        }
@@ -5163,10 +5191,23 @@ static ssize_t rbd_remove(struct bus_type *bus,
        if (ret < 0 || already)
                return ret;
-        rbd_bus_del_dev(rbd_dev);
        ret = rbd_dev_header_watch_sync(rbd_dev, false);
        if (ret)
                rbd_warn(rbd_dev, "failed to cancel watch event (%d)\n", ret);
+        /*
+         * flush remaining watch callbacks - these must be complete
+         * before the osd_client is shutdown
+         */
+        dout("%s: flushing notifies", __func__);
+        ceph_osdc_flush_notifies(&rbd_dev->rbd_client->client->osdc);
+        /*
+         * Don't free anything from rbd_dev->disk until after all
+         * notifies are completely processed. Otherwise
+         * rbd_bus_del_dev() will race with rbd_watch_cb(), resulting
+         * in a potential use after free of rbd_dev->disk or rbd_dev.
+         */
+        rbd_bus_del_dev(rbd_dev);
        rbd_dev_image_release(rbd_dev);
        module_put(THIS_MODULE);
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a12b923bbaca..0a327f4154a2 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -85,6 +85,7 @@ static struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x04CA, 0x3008) },
        { USB_DEVICE(0x13d3, 0x3362) },
        { USB_DEVICE(0x0CF3, 0xE004) },
+        { USB_DEVICE(0x0CF3, 0xE005) },
        { USB_DEVICE(0x0930, 0x0219) },
        { USB_DEVICE(0x0489, 0xe057) },
        { USB_DEVICE(0x13d3, 0x3393) },
@@ -126,6 +127,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 8e16f0af6358..f3dfc0a88fdc 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
        /* Broadcom BCM20702A0 */
        { USB_DEVICE(0x0b05, 0x17b5) },
+        { USB_DEVICE(0x0b05, 0x17cb) },
        { USB_DEVICE(0x04ca, 0x2003) },
        { USB_DEVICE(0x0489, 0xe042) },
        { USB_DEVICE(0x413c, 0x8197) },
@@ -112,6 +113,9 @@ static struct usb_device_id btusb_table[] = {
        /*Broadcom devices with vendor specific id */
        { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
+        /* Belkin F8065bf - Broadcom based */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
        { }     /* Terminating entry */
 };
@@ -148,6 +152,7 @@ static struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
index 19ab6ff53d59..2394e9753ef5 100644
--- a/drivers/bus/mvebu-mbus.c
+++ b/drivers/bus/mvebu-mbus.c
@@ -700,6 +700,7 @@ static int __init mvebu_mbus_common_init(struct mvebu_mbus_state *mbus,
                                         phys_addr_t sdramwins_phys_base,
                                         size_t sdramwins_size)
 {
+        struct device_node *np;
        int win;
        mbus->mbuswins_base = ioremap(mbuswins_phys_base, mbuswins_size);
@@ -712,8 +713,11 @@ static int __init mvebu_mbus_common_init(struct mvebu_mbus_state *mbus,
                return -ENOMEM;
        }
-        if (of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric"))
+        np = of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric");
+        if (np) {
                mbus->hw_io_coherency = 1;
+                of_node_put(np);
+        }
        for (win = 0; win < mbus->soc->num_wins; win++)
                mvebu_mbus_disable_window(mbus, win);
@@ -861,11 +865,13 @@ static void __init mvebu_mbus_get_pcie_resources(struct device_node *np,
        int ret;
        /*
-         * These are optional, so we clear them and they'll
+         * These are optional, so we make sure that resource_size(x) will
-         * be zero if they are missing from the DT.
+         * return 0.
         */
        memset(mem, 0, sizeof(struct resource));
+        mem->end = -1;
        memset(io, 0, sizeof(struct resource));
+        io->end = -1;
        ret = of_property_read_u32_array(np, "pcie-mem-aperture", reg, ARRAY_SIZE(reg));
        if (!ret) {
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 7737b5bd26af..7a744d391756 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -640,7 +640,7 @@ struct timer_rand_state {
 */
 void add_device_randomness(const void *buf, unsigned int size)
 {
-        unsigned long time = get_cycles() ^ jiffies;
+        unsigned long time = random_get_entropy() ^ jiffies;
        mix_pool_bytes(&input_pool, buf, size, NULL);
        mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
@@ -677,7 +677,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
                goto out;
        sample.jiffies = jiffies;
-        sample.cycles = get_cycles();
+        sample.cycles = random_get_entropy();
        sample.num = num;
        mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
@@ -744,7 +744,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
        struct fast_pool        *fast_pool = &__get_cpu_var(irq_randomness);
        struct pt_regs          *regs = get_irq_regs();
        unsigned long           now = jiffies;
-        __u32                   input[4], cycles = get_cycles();
+        __u32                   input[4], cycles = random_get_entropy();
        input[0] = cycles ^ jiffies;
        input[1] = irq;
@@ -1459,12 +1459,11 @@ struct ctl_table random_table[] = {
 static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
-static int __init random_int_secret_init(void)
+int random_int_secret_init(void)
 {
        get_random_bytes(random_int_secret, sizeof(random_int_secret));
        return 0;
 }
-late_initcall(random_int_secret_init);
 /*
 * Get a random word for internal kernel use only. Similar to urandom but
@@ -1483,7 +1482,7 @@ unsigned int get_random_int(void)
        hash = get_cpu_var(get_random_int_hash);
-        hash[0] += current->pid + jiffies + get_cycles();
+        hash[0] += current->pid + jiffies + random_get_entropy();
        md5_transform(hash, random_int_secret);
        ret = hash[0];
        put_cpu_var(get_random_int_hash);
diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
index 7a7929ba2658..94c280d36e8b 100644
--- a/drivers/char/tpm/xen-tpmfront.c
+++ b/drivers/char/tpm/xen-tpmfront.c
@@ -10,6 +10,7 @@
 #include <linux/errno.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
+#include <xen/xen.h>
 #include <xen/events.h>
 #include <xen/interface/io/tpmif.h>
 #include <xen/grant_table.h>
@@ -142,32 +143,6 @@ static int vtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
        return length;
 }
-ssize_t tpm_show_locality(struct device *dev, struct device_attribute *attr,
-                          char *buf)
-{
-        struct tpm_chip *chip = dev_get_drvdata(dev);
-        struct tpm_private *priv = TPM_VPRIV(chip);
-        u8 locality = priv->shr->locality;
-        return sprintf(buf, "%d\n", locality);
-}
-ssize_t tpm_store_locality(struct device *dev, struct device_attribute *attr,
-                        const char *buf, size_t len)
-{
-        struct tpm_chip *chip = dev_get_drvdata(dev);
-        struct tpm_private *priv = TPM_VPRIV(chip);
-        u8 val;
-        int rv = kstrtou8(buf, 0, &val);
-        if (rv)
-                return rv;
-        priv->shr->locality = val;
-        return len;
-}
 static const struct file_operations vtpm_ops = {
        .owner = THIS_MODULE,
        .llseek = no_llseek,
@@ -188,8 +163,6 @@ static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
 static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
 static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
-static DEVICE_ATTR(locality, S_IRUGO | S_IWUSR, tpm_show_locality,
-                tpm_store_locality);
 static struct attribute *vtpm_attrs[] = {
        &dev_attr_pubek.attr,
@@ -202,7 +175,6 @@ static struct attribute *vtpm_attrs[] = {
        &dev_attr_cancel.attr,
        &dev_attr_durations.attr,
        &dev_attr_timeouts.attr,
-        &dev_attr_locality.attr,
        NULL,
 };
@@ -210,8 +182,6 @@ static struct attribute_group vtpm_attr_grp = {
        .attrs = vtpm_attrs,
 };
-#define TPM_LONG_TIMEOUT   (10 * 60 * HZ)
 static const struct tpm_vendor_specific tpm_vtpm = {
        .status = vtpm_status,
        .recv = vtpm_recv,
@@ -224,11 +194,6 @@ static const struct tpm_vendor_specific tpm_vtpm = {
        .miscdev = {
                .fops = &vtpm_ops,
        },
-        .duration = {
-                TPM_LONG_TIMEOUT,
-                TPM_LONG_TIMEOUT,
-                TPM_LONG_TIMEOUT,
-        },
 };
 static irqreturn_t tpmif_interrupt(int dummy, void *dev_id)
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 41c69469ce20..971d796e071d 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -26,6 +26,7 @@ config DW_APB_TIMER_OF
 config ARMADA_370_XP_TIMER
        bool
+        select CLKSRC_OF
 config ORION_TIMER
        select CLKSRC_OF
diff --git a/drivers/clocksource/clksrc-of.c b/drivers/clocksource/clksrc-of.c
index 37f5325bec95..b9ddd9e3a2f5 100644
--- a/drivers/clocksource/clksrc-of.c
+++ b/drivers/clocksource/clksrc-of.c
@@ -30,6 +30,9 @@ void __init clocksource_of_init(void)
        clocksource_of_init_fn init_func;
        for_each_matching_node_and_match(np, __clksrc_of_table, &match) {
+                if (!of_device_is_available(np))
+                        continue;
                init_func = match->data;
                init_func(np);
        }
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index b9c81b7c3a3b..3a5909c12d42 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -301,7 +301,7 @@ static void em_sti_register_clockevent(struct em_sti_priv *p)
        ced->name = dev_name(&p->pdev->dev);
        ced->features = CLOCK_EVT_FEAT_ONESHOT;
        ced->rating = 200;
-        ced->cpumask = cpumask_of(0);
+        ced->cpumask = cpu_possible_mask;
        ced->set_next_event = em_sti_clock_event_next;
        ced->set_mode = em_sti_clock_event_mode;
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 5b34768f4d7c..62b0de6a1837 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -428,7 +428,6 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
                                evt->irq);
                        return -EIO;
                }
-                irq_set_affinity(evt->irq, cpumask_of(cpu));
        } else {
                enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
        }
@@ -449,6 +448,7 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                                           unsigned long action, void *hcpu)
 {
        struct mct_clock_event_device *mevt;
+        unsigned int cpu;
        /*
         * Grab cpu pointer in each case to avoid spurious
@@ -459,6 +459,12 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                mevt = this_cpu_ptr(&percpu_mct_tick);
                exynos4_local_timer_setup(&mevt->evt);
                break;
+        case CPU_ONLINE:
+                cpu = (unsigned long)hcpu;
+                if (mct_int_type == MCT_INT_SPI)
+                        irq_set_affinity(mct_irqs[MCT_L0_IRQ + cpu],
+                                                cpumask_of(cpu));
+                break;
        case CPU_DYING:
                mevt = this_cpu_ptr(&percpu_mct_tick);
                exynos4_local_timer_stop(&mevt->evt);
@@ -500,6 +506,8 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
                                         &percpu_mct_tick);
                WARN(err, "MCT: can't request IRQ %d (%d)\n",
                     mct_irqs[MCT_L0_IRQ], err);
+        } else {
+                irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
        }
        err = register_cpu_notifier(&exynos4_mct_cpu_nb);
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index a1260b4549db..d2c3253e015e 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -986,6 +986,10 @@ static int __init acpi_cpufreq_init(void)
 {
        int ret;
+        /* don't keep reloading if cpufreq_driver exists */
+        if (cpufreq_get_current_driver())
+                return 0;
        if (acpi_disabled)
                return 0;
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index cbfffa91ebdd..c522a95c0e16 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -12,6 +12,7 @@
 #define pr_fmt(fmt)     KBUILD_MODNAME ": " fmt
 #include <linux/clk.h>
+#include <linux/cpu.h>
 #include <linux/cpufreq.h>
 #include <linux/err.h>
 #include <linux/module.h>
@@ -177,7 +178,11 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
        struct device_node *np;
        int ret;
-        cpu_dev = &pdev->dev;
+        cpu_dev = get_cpu_device(0);
+        if (!cpu_dev) {
+                pr_err("failed to get cpu0 device\n");
+                return -ENODEV;
+        }
        np = of_node_get(cpu_dev->of_node);
        if (!np) {
@@ -224,7 +229,7 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
        if (of_property_read_u32(np, "clock-latency", &transition_latency))
                transition_latency = CPUFREQ_ETERNAL;
-        if (cpu_reg) {
+        if (!IS_ERR(cpu_reg)) {
                struct opp *opp;
                unsigned long min_uV, max_uV;
                int i;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 43c24aa756f6..04548f7023af 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -952,9 +952,20 @@ static void update_policy_cpu(struct cpufreq_policy *policy, unsigned int cpu)
        if (cpu == policy->cpu)
                return;
+        /*
+         * Take direct locks as lock_policy_rwsem_write wouldn't work here.
+         * Also lock for last cpu is enough here as contention will happen only
+         * after policy->cpu is changed and after it is changed, other threads
+         * will try to acquire lock for new cpu. And policy is already updated
+         * by then.
+         */
+        down_write(&per_cpu(cpu_policy_rwsem, policy->cpu));
        policy->last_cpu = policy->cpu;
        policy->cpu = cpu;
+        up_write(&per_cpu(cpu_policy_rwsem, policy->last_cpu));
 #ifdef CONFIG_CPU_FREQ_TABLE
        cpufreq_frequency_table_update_policy_cpu(policy);
 #endif
@@ -1125,7 +1136,7 @@ static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
        int ret;
        /* first sibling now owns the new sysfs dir */
-        cpu_dev = get_cpu_device(cpumask_first(policy->cpus));
+        cpu_dev = get_cpu_device(cpumask_any_but(policy->cpus, old_cpu));
        /* Don't touch sysfs files during light-weight tear-down */
        if (frozen)
@@ -1189,12 +1200,9 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
                        policy->governor->name, CPUFREQ_NAME_LEN);
 #endif
-        WARN_ON(lock_policy_rwsem_write(cpu));
+        lock_policy_rwsem_read(cpu);
        cpus = cpumask_weight(policy->cpus);
+        unlock_policy_rwsem_read(cpu);
-        if (cpus > 1)
-                cpumask_clear_cpu(cpu, policy->cpus);
-        unlock_policy_rwsem_write(cpu);
        if (cpu != policy->cpu) {
                if (!frozen)
@@ -1203,9 +1211,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu, frozen);
                if (new_cpu >= 0) {
-                        WARN_ON(lock_policy_rwsem_write(cpu));
                        update_policy_cpu(policy, new_cpu);
-                        unlock_policy_rwsem_write(cpu);
                        if (!frozen) {
                                pr_debug("%s: policy Kobject moved to cpu: %d "
@@ -1237,9 +1243,12 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
                return -EINVAL;
        }
-        lock_policy_rwsem_read(cpu);
+        WARN_ON(lock_policy_rwsem_write(cpu));
        cpus = cpumask_weight(policy->cpus);
-        unlock_policy_rwsem_read(cpu);
+        if (cpus > 1)
+                cpumask_clear_cpu(cpu, policy->cpus);
+        unlock_policy_rwsem_write(cpu);
        /* If cpu is last user of policy, free policy */
        if (cpus == 1) {
@@ -1451,6 +1460,9 @@ unsigned int cpufreq_get(unsigned int cpu)
 {
        unsigned int ret_freq = 0;
+        if (cpufreq_disabled() || !cpufreq_driver)
+                return -ENOENT;
        if (!down_read_trylock(&cpufreq_rwsem))
                return 0;
@@ -2095,7 +2107,7 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
        write_lock_irqsave(&cpufreq_driver_lock, flags);
        if (cpufreq_driver) {
                write_unlock_irqrestore(&cpufreq_driver_lock, flags);
-                return -EBUSY;
+                return -EEXIST;
        }
        cpufreq_driver = driver_data;
        write_unlock_irqrestore(&cpufreq_driver_lock, flags);
diff --git a/drivers/cpufreq/exynos5440-cpufreq.c b/drivers/cpufreq/exynos5440-cpufreq.c
index d514c152fd1a..be5380ecdcd4 100644
--- a/drivers/cpufreq/exynos5440-cpufreq.c
+++ b/drivers/cpufreq/exynos5440-cpufreq.c
@@ -457,7 +457,7 @@ err_free_table:
        opp_free_cpufreq_table(dvfs_info->dev, &dvfs_info->freq_table);
 err_put_node:
        of_node_put(np);
-        dev_err(dvfs_info->dev, "%s: failed initialization\n", __func__);
+        dev_err(&pdev->dev, "%s: failed initialization\n", __func__);
        return ret;
 }
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 3e396543aea4..c3fd2a101ca0 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -7,6 +7,7 @@
 */
 #include <linux/clk.h>
+#include <linux/cpu.h>
 #include <linux/cpufreq.h>
 #include <linux/delay.h>
 #include <linux/err.h>
@@ -202,7 +203,11 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
        unsigned long min_volt, max_volt;
        int num, ret;
-        cpu_dev = &pdev->dev;
+        cpu_dev = get_cpu_device(0);
+        if (!cpu_dev) {
+                pr_err("failed to get cpu0 device\n");
+                return -ENODEV;
+        }
        np = of_node_get(cpu_dev->of_node);
        if (!np) {
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 9733f29ed148..badf6206b2b2 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -383,6 +383,7 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
 static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
 {
        int max_perf, min_perf;
+        u64 val;
        intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
@@ -394,8 +395,11 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
        trace_cpu_frequency(pstate * 100000, cpu->cpu);
        cpu->pstate.current_pstate = pstate;
-        wrmsrl(MSR_IA32_PERF_CTL, pstate << 8);
+        val = pstate << 8;
+        if (limits.no_turbo)
+                val |= (u64)1 << 32;
+        wrmsrl(MSR_IA32_PERF_CTL, val);
 }
 static inline void intel_pstate_pstate_increase(struct cpudata *cpu, int steps)
@@ -634,8 +638,8 @@ static int intel_pstate_cpu_exit(struct cpufreq_policy *policy)
 static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
 {
-        int rc, min_pstate, max_pstate;
        struct cpudata *cpu;
+        int rc;
        rc = intel_pstate_init_cpu(policy->cpu);
        if (rc)
@@ -649,9 +653,8 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
        else
                policy->policy = CPUFREQ_POLICY_POWERSAVE;
-        intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
+        policy->min = cpu->pstate.min_pstate * 100000;
-        policy->min = min_pstate * 100000;
+        policy->max = cpu->pstate.turbo_pstate * 100000;
-        policy->max = max_pstate * 100000;
        /* cpuinfo and default policy values */
        policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000;
diff --git a/drivers/cpufreq/s3c64xx-cpufreq.c b/drivers/cpufreq/s3c64xx-cpufreq.c
index 8a72b0c555f8..15631f92ab7d 100644
--- a/drivers/cpufreq/s3c64xx-cpufreq.c
+++ b/drivers/cpufreq/s3c64xx-cpufreq.c
@@ -166,7 +166,7 @@ static void __init s3c64xx_cpufreq_config_regulator(void)
                if (freq->frequency == CPUFREQ_ENTRY_INVALID)
                        continue;
-                dvfs = &s3c64xx_dvfs_table[freq->index];
+                dvfs = &s3c64xx_dvfs_table[freq->driver_data];
                found = 0;
                for (i = 0; i < count; i++) {
diff --git a/drivers/cpufreq/spear-cpufreq.c b/drivers/cpufreq/spear-cpufreq.c
index 19e364fa5955..3f418166ce02 100644
--- a/drivers/cpufreq/spear-cpufreq.c
+++ b/drivers/cpufreq/spear-cpufreq.c
@@ -113,7 +113,7 @@ static int spear_cpufreq_target(struct cpufreq_policy *policy,
                unsigned int target_freq, unsigned int relation)
 {
        struct cpufreq_freqs freqs;
-        unsigned long newfreq;
+        long newfreq;
        struct clk *srcclk;
        int index, ret, mult = 1;
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 526ec77c7ba0..f238cfd33847 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -198,6 +198,7 @@ config TI_EDMA
        depends on ARCH_DAVINCI || ARCH_OMAP
        select DMA_ENGINE
        select DMA_VIRTUAL_CHANNELS
+        select TI_PRIV_EDMA
        default n
        help
          Enable support for the TI EDMA controller. This DMA
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index ff50ff4c6a57..3519111c566b 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -306,6 +306,7 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                                                EDMA_SLOT_ANY);
                        if (echan->slot[i] < 0) {
                                dev_err(dev, "Failed to allocate slot\n");
+                                kfree(edesc);
                                return NULL;
                        }
                }
@@ -749,6 +750,6 @@ static void __exit edma_exit(void)
 }
 module_exit(edma_exit);
-MODULE_AUTHOR("Matt Porter <mporter@ti.com>");
+MODULE_AUTHOR("Matt Porter <matt.porter@linaro.org>");
 MODULE_DESCRIPTION("TI EDMA DMA engine driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index 78f8ca5fccee..55852c026791 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -437,17 +437,18 @@ static void dma_irq_handle_channel(struct imxdma_channel *imxdmac)
        struct imxdma_engine *imxdma = imxdmac->imxdma;
        int chno = imxdmac->channel;
        struct imxdma_desc *desc;
+        unsigned long flags;
-        spin_lock(&imxdma->lock);
+        spin_lock_irqsave(&imxdma->lock, flags);
        if (list_empty(&imxdmac->ld_active)) {
-                spin_unlock(&imxdma->lock);
+                spin_unlock_irqrestore(&imxdma->lock, flags);
                goto out;
        }
        desc = list_first_entry(&imxdmac->ld_active,
                                struct imxdma_desc,
                                node);
-        spin_unlock(&imxdma->lock);
+        spin_unlock_irqrestore(&imxdma->lock, flags);
        if (desc->sg) {
                u32 tmp;
@@ -519,7 +520,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
 {
        struct imxdma_channel *imxdmac = to_imxdma_chan(d->desc.chan);
        struct imxdma_engine *imxdma = imxdmac->imxdma;
-        unsigned long flags;
        int slot = -1;
        int i;
@@ -527,7 +527,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
        switch (d->type) {
        case IMXDMA_DESC_INTERLEAVED:
                /* Try to get a free 2D slot */
-                spin_lock_irqsave(&imxdma->lock, flags);
                for (i = 0; i < IMX_DMA_2D_SLOTS; i++) {
                        if ((imxdma->slots_2d[i].count > 0) &&
                        ((imxdma->slots_2d[i].xsr != d->x) ||
@@ -537,10 +536,8 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
                        slot = i;
                        break;
                }
-                if (slot < 0) {
+                if (slot < 0)
-                        spin_unlock_irqrestore(&imxdma->lock, flags);
                        return -EBUSY;
-                }
                imxdma->slots_2d[slot].xsr = d->x;
                imxdma->slots_2d[slot].ysr = d->y;
@@ -549,7 +546,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
                imxdmac->slot_2d = slot;
                imxdmac->enabled_2d = true;
-                spin_unlock_irqrestore(&imxdma->lock, flags);
                if (slot == IMX_DMA_2D_SLOT_A) {
                        d->config_mem &= ~CCR_MSEL_B;
@@ -625,18 +621,17 @@ static void imxdma_tasklet(unsigned long data)
        struct imxdma_channel *imxdmac = (void *)data;
        struct imxdma_engine *imxdma = imxdmac->imxdma;
        struct imxdma_desc *desc;
+        unsigned long flags;
-        spin_lock(&imxdma->lock);
+        spin_lock_irqsave(&imxdma->lock, flags);
        if (list_empty(&imxdmac->ld_active)) {
                /* Someone might have called terminate all */
-                goto out;
+                spin_unlock_irqrestore(&imxdma->lock, flags);
+                return;
        }
        desc = list_first_entry(&imxdmac->ld_active, struct imxdma_desc, node);
-        if (desc->desc.callback)
-                desc->desc.callback(desc->desc.callback_param);
        /* If we are dealing with a cyclic descriptor, keep it on ld_active
         * and dont mark the descriptor as complete.
         * Only in non-cyclic cases it would be marked as complete
@@ -663,7 +658,11 @@ static void imxdma_tasklet(unsigned long data)
                                 __func__, imxdmac->channel);
        }
 out:
-        spin_unlock(&imxdma->lock);
+        spin_unlock_irqrestore(&imxdma->lock, flags);
+        if (desc->desc.callback)
+                desc->desc.callback(desc->desc.callback_param);
 }
 static int imxdma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
@@ -883,7 +882,7 @@ static struct dma_async_tx_descriptor *imxdma_prep_dma_cyclic(
        kfree(imxdmac->sg_list);
        imxdmac->sg_list = kcalloc(periods + 1,
-                        sizeof(struct scatterlist), GFP_KERNEL);
+                        sizeof(struct scatterlist), GFP_ATOMIC);
        if (!imxdmac->sg_list)
                return NULL;
diff --git a/drivers/dma/sh/rcar-hpbdma.c b/drivers/dma/sh/rcar-hpbdma.c
index 45a520281ce1..ebad84591a6e 100644
--- a/drivers/dma/sh/rcar-hpbdma.c
+++ b/drivers/dma/sh/rcar-hpbdma.c
@@ -93,6 +93,7 @@ struct hpb_dmae_chan {
        void __iomem *base;
        const struct hpb_dmae_slave_config *cfg;
        char dev_id[16];                /* unique name per DMAC of channel */
+        dma_addr_t slave_addr;
 };
 struct hpb_dmae_device {
@@ -432,7 +433,6 @@ hpb_dmae_alloc_chan_resources(struct hpb_dmae_chan *hpb_chan,
                hpb_chan->xfer_mode = XFER_DOUBLE;
        } else {
                dev_err(hpb_chan->shdma_chan.dev, "DCR setting error");
-                shdma_free_irq(&hpb_chan->shdma_chan);
                return -EINVAL;
        }
@@ -446,7 +446,8 @@ hpb_dmae_alloc_chan_resources(struct hpb_dmae_chan *hpb_chan,
        return 0;
 }
-static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id, bool try)
+static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id,
+                              dma_addr_t slave_addr, bool try)
 {
        struct hpb_dmae_chan *chan = to_chan(schan);
        const struct hpb_dmae_slave_config *sc =
@@ -457,6 +458,7 @@ static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id, bool try)
        if (try)
                return 0;
        chan->cfg = sc;
+        chan->slave_addr = slave_addr ? : sc->addr;
        return hpb_dmae_alloc_chan_resources(chan, sc);
 }
@@ -468,7 +470,7 @@ static dma_addr_t hpb_dmae_slave_addr(struct shdma_chan *schan)
 {
        struct hpb_dmae_chan *chan = to_chan(schan);
-        return chan->cfg->addr;
+        return chan->slave_addr;
 }
 static struct shdma_desc *hpb_dmae_embedded_desc(void *buf, int i)
@@ -614,7 +616,6 @@ static void hpb_dmae_chan_remove(struct hpb_dmae_device *hpbdev)
        shdma_for_each_chan(schan, &hpbdev->shdma_dev, i) {
                BUG_ON(!schan);
-                shdma_free_irq(schan);
                shdma_chan_remove(schan);
        }
        dma_dev->chancnt = 0;
diff --git a/drivers/gpio/gpio-lynxpoint.c b/drivers/gpio/gpio-lynxpoint.c
index 2d9ca6055e5e..41b5913ddabe 100644
--- a/drivers/gpio/gpio-lynxpoint.c
+++ b/drivers/gpio/gpio-lynxpoint.c
@@ -248,14 +248,15 @@ static void lp_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
        struct lp_gpio *lg = irq_data_get_irq_handler_data(data);
        struct irq_chip *chip = irq_data_get_irq_chip(data);
        u32 base, pin, mask;
-        unsigned long reg, pending;
+        unsigned long reg, ena, pending;
        unsigned virq;
        /* check from GPIO controller which pin triggered the interrupt */
        for (base = 0; base < lg->chip.ngpio; base += 32) {
                reg = lp_gpio_reg(&lg->chip, base, LP_INT_STAT);
+                ena = lp_gpio_reg(&lg->chip, base, LP_INT_ENABLE);
-                while ((pending = inl(reg))) {
+                while ((pending = (inl(reg) & inl(ena)))) {
                        pin = __ffs(pending);
                        mask = BIT(pin);
                        /* Clear before handling so we don't lose an edge */
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 0ff43552d472..89675f862308 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -63,6 +63,7 @@ struct gpio_bank {
        struct gpio_chip chip;
        struct clk *dbck;
        u32 mod_usage;
+        u32 irq_usage;
        u32 dbck_enable_mask;
        bool dbck_enabled;
        struct device *dev;
@@ -86,6 +87,9 @@ struct gpio_bank {
 #define GPIO_BIT(bank, gpio) (1 << GPIO_INDEX(bank, gpio))
 #define GPIO_MOD_CTRL_BIT       BIT(0)
+#define BANK_USED(bank) (bank->mod_usage || bank->irq_usage)
+#define LINE_USED(line, offset) (line & (1 << offset))
 static int irq_to_gpio(struct gpio_bank *bank, unsigned int gpio_irq)
 {
        return bank->chip.base + gpio_irq;
@@ -420,15 +424,69 @@ static int _set_gpio_triggering(struct gpio_bank *bank, int gpio,
        return 0;
 }
+static void _enable_gpio_module(struct gpio_bank *bank, unsigned offset)
+{
+        if (bank->regs->pinctrl) {
+                void __iomem *reg = bank->base + bank->regs->pinctrl;
+                /* Claim the pin for MPU */
+                __raw_writel(__raw_readl(reg) | (1 << offset), reg);
+        }
+        if (bank->regs->ctrl && !BANK_USED(bank)) {
+                void __iomem *reg = bank->base + bank->regs->ctrl;
+                u32 ctrl;
+                ctrl = __raw_readl(reg);
+                /* Module is enabled, clocks are not gated */
+                ctrl &= ~GPIO_MOD_CTRL_BIT;
+                __raw_writel(ctrl, reg);
+                bank->context.ctrl = ctrl;
+        }
+}
+static void _disable_gpio_module(struct gpio_bank *bank, unsigned offset)
+{
+        void __iomem *base = bank->base;
+        if (bank->regs->wkup_en &&
+            !LINE_USED(bank->mod_usage, offset) &&
+            !LINE_USED(bank->irq_usage, offset)) {
+                /* Disable wake-up during idle for dynamic tick */
+                _gpio_rmw(base, bank->regs->wkup_en, 1 << offset, 0);
+                bank->context.wake_en =
+                        __raw_readl(bank->base + bank->regs->wkup_en);
+        }
+        if (bank->regs->ctrl && !BANK_USED(bank)) {
+                void __iomem *reg = bank->base + bank->regs->ctrl;
+                u32 ctrl;
+                ctrl = __raw_readl(reg);
+                /* Module is disabled, clocks are gated */
+                ctrl |= GPIO_MOD_CTRL_BIT;
+                __raw_writel(ctrl, reg);
+                bank->context.ctrl = ctrl;
+        }
+}
+static int gpio_is_input(struct gpio_bank *bank, int mask)
+{
+        void __iomem *reg = bank->base + bank->regs->direction;
+        return __raw_readl(reg) & mask;
+}
 static int gpio_irq_type(struct irq_data *d, unsigned type)
 {
        struct gpio_bank *bank = irq_data_get_irq_chip_data(d);
        unsigned gpio = 0;
        int retval;
        unsigned long flags;
+        unsigned offset;
-        if (WARN_ON(!bank->mod_usage))
+        if (!BANK_USED(bank))
-                return -EINVAL;
+                pm_runtime_get_sync(bank->dev);
 #ifdef CONFIG_ARCH_OMAP1
        if (d->irq > IH_MPUIO_BASE)
@@ -446,7 +504,17 @@ static int gpio_irq_type(struct irq_data *d, unsigned type)
                return -EINVAL;
        spin_lock_irqsave(&bank->lock, flags);
-        retval = _set_gpio_triggering(bank, GPIO_INDEX(bank, gpio), type);
+        offset = GPIO_INDEX(bank, gpio);
+        retval = _set_gpio_triggering(bank, offset, type);
+        if (!LINE_USED(bank->mod_usage, offset)) {
+                _enable_gpio_module(bank, offset);
+                _set_gpio_direction(bank, offset, 1);
+        } else if (!gpio_is_input(bank, 1 << offset)) {
+                spin_unlock_irqrestore(&bank->lock, flags);
+                return -EINVAL;
+        }
+        bank->irq_usage |= 1 << GPIO_INDEX(bank, gpio);
        spin_unlock_irqrestore(&bank->lock, flags);
        if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
@@ -603,35 +671,19 @@ static int omap_gpio_request(struct gpio_chip *chip, unsigned offset)
         * If this is the first gpio_request for the bank,
         * enable the bank module.
         */
-        if (!bank->mod_usage)
+        if (!BANK_USED(bank))
                pm_runtime_get_sync(bank->dev);
        spin_lock_irqsave(&bank->lock, flags);
        /* Set trigger to none. You need to enable the desired trigger with
-         * request_irq() or set_irq_type().
+         * request_irq() or set_irq_type(). Only do this if the IRQ line has
+         * not already been requested.
         */
-        _set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
+        if (!LINE_USED(bank->irq_usage, offset)) {
+                _set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
-        if (bank->regs->pinctrl) {
+                _enable_gpio_module(bank, offset);
-                void __iomem *reg = bank->base + bank->regs->pinctrl;
-                /* Claim the pin for MPU */
-                __raw_writel(__raw_readl(reg) | (1 << offset), reg);
-        }
-        if (bank->regs->ctrl && !bank->mod_usage) {
-                void __iomem *reg = bank->base + bank->regs->ctrl;
-                u32 ctrl;
-                ctrl = __raw_readl(reg);
-                /* Module is enabled, clocks are not gated */
-                ctrl &= ~GPIO_MOD_CTRL_BIT;
-                __raw_writel(ctrl, reg);
-                bank->context.ctrl = ctrl;
        }
        bank->mod_usage |= 1 << offset;
        spin_unlock_irqrestore(&bank->lock, flags);
        return 0;
@@ -640,31 +692,11 @@ static int omap_gpio_request(struct gpio_chip *chip, unsigned offset)
 static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
 {
        struct gpio_bank *bank = container_of(chip, struct gpio_bank, chip);
-        void __iomem *base = bank->base;
        unsigned long flags;
        spin_lock_irqsave(&bank->lock, flags);
-        if (bank->regs->wkup_en) {
-                /* Disable wake-up during idle for dynamic tick */
-                _gpio_rmw(base, bank->regs->wkup_en, 1 << offset, 0);
-                bank->context.wake_en =
-                        __raw_readl(bank->base + bank->regs->wkup_en);
-        }
        bank->mod_usage &= ~(1 << offset);
+        _disable_gpio_module(bank, offset);
-        if (bank->regs->ctrl && !bank->mod_usage) {
-                void __iomem *reg = bank->base + bank->regs->ctrl;
-                u32 ctrl;
-                ctrl = __raw_readl(reg);
-                /* Module is disabled, clocks are gated */
-                ctrl |= GPIO_MOD_CTRL_BIT;
-                __raw_writel(ctrl, reg);
-                bank->context.ctrl = ctrl;
-        }
        _reset_gpio(bank, bank->chip.base + offset);
        spin_unlock_irqrestore(&bank->lock, flags);
@@ -672,7 +704,7 @@ static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
         * If this is the last gpio to be freed in the bank,
         * disable the bank module.
         */
-        if (!bank->mod_usage)
+        if (!BANK_USED(bank))
                pm_runtime_put(bank->dev);
 }
@@ -762,10 +794,20 @@ static void gpio_irq_shutdown(struct irq_data *d)
        struct gpio_bank *bank = irq_data_get_irq_chip_data(d);
        unsigned int gpio = irq_to_gpio(bank, d->hwirq);
        unsigned long flags;
+        unsigned offset = GPIO_INDEX(bank, gpio);
        spin_lock_irqsave(&bank->lock, flags);
+        bank->irq_usage &= ~(1 << offset);
+        _disable_gpio_module(bank, offset);
        _reset_gpio(bank, gpio);
        spin_unlock_irqrestore(&bank->lock, flags);
+        /*
+         * If this is the last IRQ to be freed in the bank,
+         * disable the bank module.
+         */
+        if (!BANK_USED(bank))
+                pm_runtime_put(bank->dev);
 }
 static void gpio_ack_irq(struct irq_data *d)
@@ -897,13 +939,6 @@ static int gpio_input(struct gpio_chip *chip, unsigned offset)
        return 0;
 }
-static int gpio_is_input(struct gpio_bank *bank, int mask)
-{
-        void __iomem *reg = bank->base + bank->regs->direction;
-        return __raw_readl(reg) & mask;
-}
 static int gpio_get(struct gpio_chip *chip, unsigned offset)
 {
        struct gpio_bank *bank;
@@ -922,13 +957,22 @@ static int gpio_output(struct gpio_chip *chip, unsigned offset, int value)
 {
        struct gpio_bank *bank;
        unsigned long flags;
+        int retval = 0;
        bank = container_of(chip, struct gpio_bank, chip);
        spin_lock_irqsave(&bank->lock, flags);
+        if (LINE_USED(bank->irq_usage, offset)) {
+                        retval = -EINVAL;
+                        goto exit;
+        }
        bank->set_dataout(bank, offset, value);
        _set_gpio_direction(bank, offset, 0);
+exit:
        spin_unlock_irqrestore(&bank->lock, flags);
-        return 0;
+        return retval;
 }
 static int gpio_debounce(struct gpio_chip *chip, unsigned offset,
@@ -1400,7 +1444,7 @@ void omap2_gpio_prepare_for_idle(int pwr_mode)
        struct gpio_bank *bank;
        list_for_each_entry(bank, &omap_gpio_list, node) {
-                if (!bank->mod_usage || !bank->loses_context)
+                if (!BANK_USED(bank) || !bank->loses_context)
                        continue;
                bank->power_mode = pwr_mode;
@@ -1414,7 +1458,7 @@ void omap2_gpio_resume_after_idle(void)
        struct gpio_bank *bank;
        list_for_each_entry(bank, &omap_gpio_list, node) {
-                if (!bank->mod_usage || !bank->loses_context)
+                if (!BANK_USED(bank) || !bank->loses_context)
                        continue;
                pm_runtime_get_sync(bank->dev);
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index e3745eb07570..6038966ab045 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -293,10 +293,9 @@ static void gpio_rcar_parse_pdata(struct gpio_rcar_priv *p)
        if (pdata) {
                p->config = *pdata;
        } else if (IS_ENABLED(CONFIG_OF) && np) {
-                ret = of_parse_phandle_with_args(np, "gpio-ranges",
+                ret = of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, 0,
-                                "#gpio-range-cells", 0, &args);
+                                                       &args);
-                p->config.number_of_pins = ret == 0 && args.args_count == 3
+                p->config.number_of_pins = ret == 0 ? args.args[2]
-                                         ? args.args[2]
                                         : RCAR_MAX_GPIO_PER_BANK;
                p->config.gpio_base = -1;
        }
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 86ef3461ec06..0dee0e0c247a 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -136,7 +136,7 @@ static struct gpio_desc *gpio_to_desc(unsigned gpio)
 */
 static int desc_to_gpio(const struct gpio_desc *desc)
 {
-        return desc->chip->base + gpio_chip_hwgpio(desc);
+        return desc - &gpio_desc[0];
 }
@@ -1398,7 +1398,7 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
        int                     status = -EPROBE_DEFER;
        unsigned long           flags;
-        if (!desc || !desc->chip) {
+        if (!desc) {
                pr_warn("%s: invalid GPIO\n", __func__);
                return -EINVAL;
        }
@@ -1406,6 +1406,8 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
        spin_lock_irqsave(&gpio_lock, flags);
        chip = desc->chip;
+        if (chip == NULL)
+                goto done;
        if (!try_module_get(chip->owner))
                goto done;
diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index 796dbb212a41..8492b68e873c 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -177,7 +177,7 @@ uint8_t ast_get_index_reg_mask(struct ast_private *ast,
 static inline void ast_open_key(struct ast_private *ast)
 {
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xA1, 0xFF, 0x04);
+        ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0x80, 0xA8);
 }
 #define AST_VIDMEM_SIZE_8M    0x00800000
diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
index b4fb86d89850..224ff965bcf7 100644
--- a/drivers/gpu/drm/drm_context.c
+++ b/drivers/gpu/drm/drm_context.c
@@ -42,6 +42,10 @@
 #include <drm/drmP.h>
+/******************************************************************/
+/** \name Context bitmap support */
+/*@{*/
 /**
 * Free a handle from the context bitmap.
 *
@@ -52,48 +56,13 @@
 * in drm_device::ctx_idr, while holding the drm_device::struct_mutex
 * lock.
 */
-static void drm_ctxbitmap_free(struct drm_device * dev, int ctx_handle)
+void drm_ctxbitmap_free(struct drm_device * dev, int ctx_handle)
 {
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return;
        mutex_lock(&dev->struct_mutex);
        idr_remove(&dev->ctx_idr, ctx_handle);
        mutex_unlock(&dev->struct_mutex);
 }
-/******************************************************************/
-/** \name Context bitmap support */
-/*@{*/
-void drm_legacy_ctxbitmap_release(struct drm_device *dev,
-                                  struct drm_file *file_priv)
-{
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return;
-        mutex_lock(&dev->ctxlist_mutex);
-        if (!list_empty(&dev->ctxlist)) {
-                struct drm_ctx_list *pos, *n;
-                list_for_each_entry_safe(pos, n, &dev->ctxlist, head) {
-                        if (pos->tag == file_priv &&
-                            pos->handle != DRM_KERNEL_CONTEXT) {
-                                if (dev->driver->context_dtor)
-                                        dev->driver->context_dtor(dev,
-                                                                  pos->handle);
-                                drm_ctxbitmap_free(dev, pos->handle);
-                                list_del(&pos->head);
-                                kfree(pos);
-                                --dev->ctx_count;
-                        }
-                }
-        }
-        mutex_unlock(&dev->ctxlist_mutex);
-}
 /**
 * Context bitmap allocation.
 *
@@ -121,12 +90,10 @@ static int drm_ctxbitmap_next(struct drm_device * dev)
 *
 * Initialise the drm_device::ctx_idr
 */
-void drm_legacy_ctxbitmap_init(struct drm_device * dev)
+int drm_ctxbitmap_init(struct drm_device * dev)
 {
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return;
        idr_init(&dev->ctx_idr);
+        return 0;
 }
 /**
@@ -137,7 +104,7 @@ void drm_legacy_ctxbitmap_init(struct drm_device * dev)
 * Free all idr members using drm_ctx_sarea_free helper function
 * while holding the drm_device::struct_mutex lock.
 */
-void drm_legacy_ctxbitmap_cleanup(struct drm_device * dev)
+void drm_ctxbitmap_cleanup(struct drm_device * dev)
 {
        mutex_lock(&dev->struct_mutex);
        idr_destroy(&dev->ctx_idr);
@@ -169,9 +136,6 @@ int drm_getsareactx(struct drm_device *dev, void *data,
        struct drm_local_map *map;
        struct drm_map_list *_entry;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return -EINVAL;
        mutex_lock(&dev->struct_mutex);
        map = idr_find(&dev->ctx_idr, request->ctx_id);
@@ -216,9 +180,6 @@ int drm_setsareactx(struct drm_device *dev, void *data,
        struct drm_local_map *map = NULL;
        struct drm_map_list *r_list = NULL;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return -EINVAL;
        mutex_lock(&dev->struct_mutex);
        list_for_each_entry(r_list, &dev->maplist, head) {
                if (r_list->map
@@ -319,9 +280,6 @@ int drm_resctx(struct drm_device *dev, void *data,
        struct drm_ctx ctx;
        int i;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return -EINVAL;
        if (res->count >= DRM_RESERVED_CONTEXTS) {
                memset(&ctx, 0, sizeof(ctx));
                for (i = 0; i < DRM_RESERVED_CONTEXTS; i++) {
@@ -352,9 +310,6 @@ int drm_addctx(struct drm_device *dev, void *data,
        struct drm_ctx_list *ctx_entry;
        struct drm_ctx *ctx = data;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return -EINVAL;
        ctx->handle = drm_ctxbitmap_next(dev);
        if (ctx->handle == DRM_KERNEL_CONTEXT) {
                /* Skip kernel's context and get a new one. */
@@ -398,9 +353,6 @@ int drm_getctx(struct drm_device *dev, void *data, struct drm_file *file_priv)
 {
        struct drm_ctx *ctx = data;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return -EINVAL;
        /* This is 0, because we don't handle any context flags */
        ctx->flags = 0;
@@ -423,9 +375,6 @@ int drm_switchctx(struct drm_device *dev, void *data,
 {
        struct drm_ctx *ctx = data;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return -EINVAL;
        DRM_DEBUG("%d\n", ctx->handle);
        return drm_context_switch(dev, dev->last_context, ctx->handle);
 }
@@ -446,9 +395,6 @@ int drm_newctx(struct drm_device *dev, void *data,
 {
        struct drm_ctx *ctx = data;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return -EINVAL;
        DRM_DEBUG("%d\n", ctx->handle);
        drm_context_switch_complete(dev, file_priv, ctx->handle);
@@ -471,9 +417,6 @@ int drm_rmctx(struct drm_device *dev, void *data,
 {
        struct drm_ctx *ctx = data;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                return -EINVAL;
        DRM_DEBUG("%d\n", ctx->handle);
        if (ctx->handle != DRM_KERNEL_CONTEXT) {
                if (dev->driver->context_dtor)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 1688ff500513..830f7501cb4d 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -2925,6 +2925,8 @@ int drm_edid_to_speaker_allocation(struct edid *edid, u8 **sadb)
                        /* Speaker Allocation Data Block */
                        if (dbl == 3) {
                                *sadb = kmalloc(dbl, GFP_KERNEL);
+                                if (!*sadb)
+                                        return -ENOMEM;
                                memcpy(*sadb, &db[1], dbl);
                                count = dbl;
                                break;
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 4be8e09a32ef..3f84277d7036 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -439,7 +439,26 @@ int drm_release(struct inode *inode, struct file *filp)
        if (dev->driver->driver_features & DRIVER_GEM)
                drm_gem_release(dev, file_priv);
-        drm_legacy_ctxbitmap_release(dev, file_priv);
+        mutex_lock(&dev->ctxlist_mutex);
+        if (!list_empty(&dev->ctxlist)) {
+                struct drm_ctx_list *pos, *n;
+                list_for_each_entry_safe(pos, n, &dev->ctxlist, head) {
+                        if (pos->tag == file_priv &&
+                            pos->handle != DRM_KERNEL_CONTEXT) {
+                                if (dev->driver->context_dtor)
+                                        dev->driver->context_dtor(dev,
+                                                                  pos->handle);
+                                drm_ctxbitmap_free(dev, pos->handle);
+                                list_del(&pos->head);
+                                kfree(pos);
+                                --dev->ctx_count;
+                        }
+                }
+        }
+        mutex_unlock(&dev->ctxlist_mutex);
        mutex_lock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index e7eb0276f7f1..39d864576be4 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -292,7 +292,13 @@ int drm_fill_in_dev(struct drm_device *dev,
                        goto error_out_unreg;
        }
-        drm_legacy_ctxbitmap_init(dev);
+        retcode = drm_ctxbitmap_init(dev);
+        if (retcode) {
+                DRM_ERROR("Cannot allocate memory for context bitmap.\n");
+                goto error_out_unreg;
+        }
        if (driver->driver_features & DRIVER_GEM) {
                retcode = drm_gem_init(dev);
@@ -446,7 +452,7 @@ void drm_put_dev(struct drm_device *dev)
                drm_rmmap(dev, r_list->map);
        drm_ht_remove(&dev->map_hash);
-        drm_legacy_ctxbitmap_cleanup(dev);
+        drm_ctxbitmap_cleanup(dev);
        if (drm_core_check_feature(dev, DRIVER_MODESET))
                drm_put_minor(&dev->control);
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 4752f223e5b2..45b6ef595965 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -56,7 +56,7 @@ config DRM_EXYNOS_IPP
 config DRM_EXYNOS_FIMC
        bool "Exynos DRM FIMC"
-        depends on DRM_EXYNOS_IPP && MFD_SYSCON && OF
+        depends on DRM_EXYNOS_IPP && MFD_SYSCON
        help
          Choose this option if you want to use Exynos FIMC for DRM.
diff --git a/drivers/gpu/drm/exynos/exynos_drm_buf.c b/drivers/gpu/drm/exynos/exynos_drm_buf.c
index 3445a0f3a6b2..9c8088462c26 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_buf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_buf.c
@@ -63,7 +63,8 @@ static int lowlevel_buffer_allocate(struct drm_device *dev,
                        return -ENOMEM;
                }
-                buf->kvaddr = dma_alloc_attrs(dev->dev, buf->size,
+                buf->kvaddr = (void __iomem *)dma_alloc_attrs(dev->dev,
+                                        buf->size,
                                        &buf->dma_addr, GFP_KERNEL,
                                        &buf->dma_attrs);
                if (!buf->kvaddr) {
@@ -90,9 +91,9 @@ static int lowlevel_buffer_allocate(struct drm_device *dev,
        }
        buf->sgt = drm_prime_pages_to_sg(buf->pages, nr_pages);
-        if (!buf->sgt) {
+        if (IS_ERR(buf->sgt)) {
                DRM_ERROR("failed to get sg table.\n");
-                ret = -ENOMEM;
+                ret = PTR_ERR(buf->sgt);
                goto err_free_attrs;
        }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index 78e868bcf1ec..e7c2f2d07f19 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -99,12 +99,13 @@ static int exynos_drm_fbdev_update(struct drm_fb_helper *helper,
                if (is_drm_iommu_supported(dev)) {
                        unsigned int nr_pages = buffer->size >> PAGE_SHIFT;
-                        buffer->kvaddr = vmap(buffer->pages, nr_pages, VM_MAP,
+                        buffer->kvaddr = (void __iomem *) vmap(buffer->pages,
+                                        nr_pages, VM_MAP,
                                        pgprot_writecombine(PAGE_KERNEL));
                } else {
                        phys_addr_t dma_addr = buffer->dma_addr;
                        if (dma_addr)
-                                buffer->kvaddr = phys_to_virt(dma_addr);
+                                buffer->kvaddr = (void __iomem *)phys_to_virt(dma_addr);
                        else
                                buffer->kvaddr = (void __iomem *)NULL;
                }
diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c
index 92babac362ec..2db731f00930 100644
--- a/drivers/gpu/drm/gma500/gtt.c
+++ b/drivers/gpu/drm/gma500/gtt.c
@@ -204,6 +204,7 @@ static int psb_gtt_attach_pages(struct gtt_range *gt)
        if (IS_ERR(pages))
                return PTR_ERR(pages);
+        gt->npage = gt->gem.size / PAGE_SIZE;
        gt->pages = pages;
        return 0;
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index b1f8fc69023f..60e84043aa34 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -707,8 +707,7 @@ tda998x_encoder_dpms(struct drm_encoder *encoder, int mode)
                reg_write(encoder, REG_VIP_CNTRL_2, priv->vip_cntrl_2);
                break;
        case DRM_MODE_DPMS_OFF:
-                /* disable audio and video ports */
+                /* disable video ports */
-                reg_write(encoder, REG_ENA_AP, 0x00);
                reg_write(encoder, REG_ENA_VP_0, 0x00);
                reg_write(encoder, REG_ENA_VP_1, 0x00);
                reg_write(encoder, REG_ENA_VP_2, 0x00);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index c27a21034a5e..d5c784d48671 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1290,12 +1290,9 @@ static int i915_load_modeset_init(struct drm_device *dev)
         * then we do not take part in VGA arbitration and the
         * vga_client_register() fails with -ENODEV.
         */
-        if (!HAS_PCH_SPLIT(dev)) {
+        ret = vga_client_register(dev->pdev, dev, NULL, i915_vga_set_decode);
-                ret = vga_client_register(dev->pdev, dev, NULL,
+        if (ret && ret != -ENODEV)
-                                          i915_vga_set_decode);
+                goto out;
-                if (ret && ret != -ENODEV)
-                        goto out;
-        }
        intel_register_dsm_handler();
@@ -1351,12 +1348,6 @@ static int i915_load_modeset_init(struct drm_device *dev)
         */
        intel_fbdev_initial_config(dev);
-        /*
-         * Must do this after fbcon init so that
-         * vgacon_save_screen() works during the handover.
-         */
-        i915_disable_vga_mem(dev);
        /* Only enable hotplug handling once the fbdev is fully set up. */
        dev_priv->enable_hotplug_processing = true;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 8507c6d1e642..cdfb9da0e4ce 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1392,14 +1392,11 @@ out:
                if (i915_terminally_wedged(&dev_priv->gpu_error))
                        return VM_FAULT_SIGBUS;
        case -EAGAIN:
-                /* Give the error handler a chance to run and move the
+                /*
-                 * objects off the GPU active list. Next time we service the
+                 * EAGAIN means the gpu is hung and we'll wait for the error
-                 * fault, we should be able to transition the page into the
+                 * handler to reset everything when re-faulting in
-                 * GTT without touching the GPU (and so avoid further
+                 * i915_mutex_lock_interruptible.
-                 * EIO/EGAIN). If the GPU is wedged, then there is no issue
-                 * with coherency, just lost writes.
                 */
-                set_need_resched();
        case 0:
        case -ERESTARTSYS:
        case -EINTR:
@@ -4803,10 +4800,10 @@ i915_gem_inactive_count(struct shrinker *shrinker, struct shrink_control *sc)
        if (!mutex_trylock(&dev->struct_mutex)) {
                if (!mutex_is_locked_by(&dev->struct_mutex, current))
-                        return SHRINK_STOP;
+                        return 0;
                if (dev_priv->mm.shrinker_no_lock_stealing)
-                        return SHRINK_STOP;
+                        return 0;
                unlock = false;
        }
@@ -4904,10 +4901,10 @@ i915_gem_inactive_scan(struct shrinker *shrinker, struct shrink_control *sc)
        if (!mutex_trylock(&dev->struct_mutex)) {
                if (!mutex_is_locked_by(&dev->struct_mutex, current))
-                        return 0;
+                        return SHRINK_STOP;
                if (dev_priv->mm.shrinker_no_lock_stealing)
-                        return 0;
+                        return SHRINK_STOP;
                unlock = false;
        }
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index aba9d7498996..dae364f0028c 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -143,8 +143,10 @@ static void i915_error_vprintf(struct drm_i915_error_state_buf *e,
        /* Seek the first printf which is hits start position */
        if (e->pos < e->start) {
-                len = vsnprintf(NULL, 0, f, args);
+                va_list tmp;
-                if (!__i915_error_seek(e, len))
+                va_copy(tmp, args);
+                if (!__i915_error_seek(e, vsnprintf(NULL, 0, f, tmp)))
                        return;
        }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 83cce0cdb769..4b91228fd9bd 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1469,6 +1469,34 @@ static irqreturn_t ironlake_irq_handler(int irq, void *arg)
        return ret;
 }
+static void i915_error_wake_up(struct drm_i915_private *dev_priv,
+                               bool reset_completed)
+{
+        struct intel_ring_buffer *ring;
+        int i;
+        /*
+         * Notify all waiters for GPU completion events that reset state has
+         * been changed, and that they need to restart their wait after
+         * checking for potential errors (and bail out to drop locks if there is
+         * a gpu reset pending so that i915_error_work_func can acquire them).
+         */
+        /* Wake up __wait_seqno, potentially holding dev->struct_mutex. */
+        for_each_ring(ring, dev_priv, i)
+                wake_up_all(&ring->irq_queue);
+        /* Wake up intel_crtc_wait_for_pending_flips, holding crtc->mutex. */
+        wake_up_all(&dev_priv->pending_flip_queue);
+        /*
+         * Signal tasks blocked in i915_gem_wait_for_error that the pending
+         * reset state is cleared.
+         */
+        if (reset_completed)
+                wake_up_all(&dev_priv->gpu_error.reset_queue);
+}
 /**
 * i915_error_work_func - do process context error handling work
 * @work: work struct
@@ -1483,11 +1511,10 @@ static void i915_error_work_func(struct work_struct *work)
        drm_i915_private_t *dev_priv = container_of(error, drm_i915_private_t,
                                                    gpu_error);
        struct drm_device *dev = dev_priv->dev;
-        struct intel_ring_buffer *ring;
        char *error_event[] = { I915_ERROR_UEVENT "=1", NULL };
        char *reset_event[] = { I915_RESET_UEVENT "=1", NULL };
        char *reset_done_event[] = { I915_ERROR_UEVENT "=0", NULL };
-        int i, ret;
+        int ret;
        kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, error_event);
@@ -1506,8 +1533,16 @@ static void i915_error_work_func(struct work_struct *work)
                kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE,
                                   reset_event);
+                /*
+                 * All state reset _must_ be completed before we update the
+                 * reset counter, for otherwise waiters might miss the reset
+                 * pending state and not properly drop locks, resulting in
+                 * deadlocks with the reset work.
+                 */
                ret = i915_reset(dev);
+                intel_display_handle_reset(dev);
                if (ret == 0) {
                        /*
                         * After all the gem state is reset, increment the reset
@@ -1528,12 +1563,11 @@ static void i915_error_work_func(struct work_struct *work)
                        atomic_set(&error->reset_counter, I915_WEDGED);
                }
-                for_each_ring(ring, dev_priv, i)
+                /*
-                        wake_up_all(&ring->irq_queue);
+                 * Note: The wake_up also serves as a memory barrier so that
+                 * waiters see the update value of the reset counter atomic_t.
-                intel_display_handle_reset(dev);
+                 */
+                i915_error_wake_up(dev_priv, true);
-                wake_up_all(&dev_priv->gpu_error.reset_queue);
        }
 }
@@ -1642,8 +1676,6 @@ static void i915_report_and_clear_eir(struct drm_device *dev)
 void i915_handle_error(struct drm_device *dev, bool wedged)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_ring_buffer *ring;
-        int i;
        i915_capture_error_state(dev);
        i915_report_and_clear_eir(dev);
@@ -1653,11 +1685,19 @@ void i915_handle_error(struct drm_device *dev, bool wedged)
                                &dev_priv->gpu_error.reset_counter);
                /*
-                 * Wakeup waiting processes so that the reset work item
+                 * Wakeup waiting processes so that the reset work function
-                 * doesn't deadlock trying to grab various locks.
+                 * i915_error_work_func doesn't deadlock trying to grab various
+                 * locks. By bumping the reset counter first, the woken
+                 * processes will see a reset in progress and back off,
+                 * releasing their locks and then wait for the reset completion.
+                 * We must do this for _all_ gpu waiters that might hold locks
+                 * that the reset work needs to acquire.
+                 *
+                 * Note: The wake_up serves as the required memory barrier to
+                 * ensure that the waiters see the updated value of the reset
+                 * counter atomic_t.
                 */
-                for_each_ring(ring, dev_priv, i)
+                i915_error_wake_up(dev_priv, false);
-                        wake_up_all(&ring->irq_queue);
        }
        /*
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index c159e1a6810f..38f96f65d87a 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -3881,6 +3881,9 @@
 #define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG          0x9030
 #define  GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB       (1<<11)
+#define HSW_SCRATCH1                            0xb038
+#define  HSW_SCRATCH1_L3_DATA_ATOMICS_DISABLE   (1<<27)
 #define HSW_FUSE_STRAP          0x42014
 #define  HSW_CDCLK_LIMIT        (1 << 24)
@@ -4728,6 +4731,9 @@
 #define GEN7_ROW_CHICKEN2_GT2           0xf4f4
 #define   DOP_CLOCK_GATING_DISABLE      (1<<0)
+#define HSW_ROW_CHICKEN3                0xe49c
+#define  HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE    (1 << 6)
 #define G4X_AUD_VID_DID                 (dev_priv->info->display_mmio_offset + 0x62020)
 #define INTEL_AUDIO_DEVCL               0x808629FB
 #define INTEL_AUDIO_DEVBLC              0x80862801
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 63aca49d11a8..63de2701b974 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -778,7 +778,7 @@ void intel_ddi_enable_transcoder_func(struct drm_crtc *crtc)
                        /* Can only use the always-on power well for eDP when
                         * not using the panel fitter, and when not using motion
                          * blur mitigation (which we don't support). */
-                        if (intel_crtc->config.pch_pfit.size)
+                        if (intel_crtc->config.pch_pfit.enabled)
                                temp |= TRANS_DDI_EDP_INPUT_A_ONOFF;
                        else
                                temp |= TRANS_DDI_EDP_INPUT_A_ON;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2489d0b4c7d2..581fb4b2f766 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2249,7 +2249,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
                I915_WRITE(PIPESRC(intel_crtc->pipe),
                           ((crtc->mode.hdisplay - 1) << 16) |
                           (crtc->mode.vdisplay - 1));
-                if (!intel_crtc->config.pch_pfit.size &&
+                if (!intel_crtc->config.pch_pfit.enabled &&
                    (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS) ||
                     intel_pipe_has_type(crtc, INTEL_OUTPUT_EDP))) {
                        I915_WRITE(PF_CTL(intel_crtc->pipe), 0);
@@ -3203,7 +3203,7 @@ static void ironlake_pfit_enable(struct intel_crtc *crtc)
        struct drm_i915_private *dev_priv = dev->dev_private;
        int pipe = crtc->pipe;
-        if (crtc->config.pch_pfit.size) {
+        if (crtc->config.pch_pfit.enabled) {
                /* Force use of hard-coded filter coefficients
                 * as some pre-programmed values are broken,
                 * e.g. x201.
@@ -3428,7 +3428,7 @@ static void ironlake_pfit_disable(struct intel_crtc *crtc)
        /* To avoid upsetting the power well on haswell only disable the pfit if
         * it's in use. The hw state code will make sure we get this right. */
-        if (crtc->config.pch_pfit.size) {
+        if (crtc->config.pch_pfit.enabled) {
                I915_WRITE(PF_CTL(pipe), 0);
                I915_WRITE(PF_WIN_POS(pipe), 0);
                I915_WRITE(PF_WIN_SZ(pipe), 0);
@@ -3941,8 +3941,6 @@ static void intel_connector_check_state(struct intel_connector *connector)
 * consider. */
 void intel_connector_dpms(struct drm_connector *connector, int mode)
 {
-        struct intel_encoder *encoder = intel_attached_encoder(connector);
        /* All the simple cases only support two dpms states. */
        if (mode != DRM_MODE_DPMS_ON)
                mode = DRM_MODE_DPMS_OFF;
@@ -3953,10 +3951,8 @@ void intel_connector_dpms(struct drm_connector *connector, int mode)
        connector->dpms = mode;
        /* Only need to change hw state when actually enabled */
-        if (encoder->base.crtc)
+        if (connector->encoder)
-                intel_encoder_dpms(encoder, mode);
+                intel_encoder_dpms(to_intel_encoder(connector->encoder), mode);
-        else
-                WARN_ON(encoder->connectors_active != false);
        intel_modeset_check_state(connector->dev);
 }
@@ -4775,6 +4771,10 @@ static void i9xx_set_pipeconf(struct intel_crtc *intel_crtc)
        pipeconf = 0;
+        if (dev_priv->quirks & QUIRK_PIPEA_FORCE &&
+            I915_READ(PIPECONF(intel_crtc->pipe)) & PIPECONF_ENABLE)
+                pipeconf |= PIPECONF_ENABLE;
        if (intel_crtc->pipe == 0 && INTEL_INFO(dev)->gen < 4) {
                /* Enable pixel doubling when the dot clock is > 90% of the (display)
                 * core speed.
@@ -4877,9 +4877,6 @@ static int i9xx_crtc_mode_set(struct drm_crtc *crtc,
                return -EINVAL;
        }
-        /* Ensure that the cursor is valid for the new mode before changing... */
-        intel_crtc_update_cursor(crtc, true);
        if (is_lvds && dev_priv->lvds_downclock_avail) {
                /*
                 * Ensure we match the reduced clock's P to the target clock.
@@ -5768,9 +5765,6 @@ static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
                intel_crtc->config.dpll.p2 = clock.p2;
        }
-        /* Ensure that the cursor is valid for the new mode before changing... */
-        intel_crtc_update_cursor(crtc, true);
        /* CPU eDP is the only output that doesn't need a PCH PLL of its own. */
        if (intel_crtc->config.has_pch_encoder) {
                fp = i9xx_dpll_compute_fp(&intel_crtc->config.dpll);
@@ -5859,6 +5853,7 @@ static void ironlake_get_pfit_config(struct intel_crtc *crtc,
        tmp = I915_READ(PF_CTL(crtc->pipe));
        if (tmp & PF_ENABLE) {
+                pipe_config->pch_pfit.enabled = true;
                pipe_config->pch_pfit.pos = I915_READ(PF_WIN_POS(crtc->pipe));
                pipe_config->pch_pfit.size = I915_READ(PF_WIN_SZ(crtc->pipe));
@@ -6236,7 +6231,7 @@ static void haswell_modeset_global_resources(struct drm_device *dev)
                if (!crtc->base.enabled)
                        continue;
-                if (crtc->pipe != PIPE_A || crtc->config.pch_pfit.size ||
+                if (crtc->pipe != PIPE_A || crtc->config.pch_pfit.enabled ||
                    crtc->config.cpu_transcoder != TRANSCODER_EDP)
                        enable = true;
        }
@@ -6259,9 +6254,6 @@ static int haswell_crtc_mode_set(struct drm_crtc *crtc,
        if (!intel_ddi_pll_mode_set(crtc))
                return -EINVAL;
-        /* Ensure that the cursor is valid for the new mode before changing... */
-        intel_crtc_update_cursor(crtc, true);
        if (intel_crtc->config.has_dp_encoder)
                intel_dp_set_m_n(intel_crtc);
@@ -6494,15 +6486,15 @@ static void haswell_write_eld(struct drm_connector *connector,
        /* Set ELD valid state */
        tmp = I915_READ(aud_cntrl_st2);
-        DRM_DEBUG_DRIVER("HDMI audio: pin eld vld status=0x%8x\n", tmp);
+        DRM_DEBUG_DRIVER("HDMI audio: pin eld vld status=0x%08x\n", tmp);
        tmp |= (AUDIO_ELD_VALID_A << (pipe * 4));
        I915_WRITE(aud_cntrl_st2, tmp);
        tmp = I915_READ(aud_cntrl_st2);
-        DRM_DEBUG_DRIVER("HDMI audio: eld vld status=0x%8x\n", tmp);
+        DRM_DEBUG_DRIVER("HDMI audio: eld vld status=0x%08x\n", tmp);
        /* Enable HDMI mode */
        tmp = I915_READ(aud_config);
-        DRM_DEBUG_DRIVER("HDMI audio: audio conf: 0x%8x\n", tmp);
+        DRM_DEBUG_DRIVER("HDMI audio: audio conf: 0x%08x\n", tmp);
        /* clear N_programing_enable and N_value_index */
        tmp &= ~(AUD_CONFIG_N_VALUE_INDEX | AUD_CONFIG_N_PROG_ENABLE);
        I915_WRITE(aud_config, tmp);
@@ -6937,7 +6929,8 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        intel_crtc->cursor_width = width;
        intel_crtc->cursor_height = height;
-        intel_crtc_update_cursor(crtc, intel_crtc->cursor_bo != NULL);
+        if (intel_crtc->active)
+                intel_crtc_update_cursor(crtc, intel_crtc->cursor_bo != NULL);
        return 0;
 fail_unpin:
@@ -6956,7 +6949,8 @@ static int intel_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
        intel_crtc->cursor_x = x;
        intel_crtc->cursor_y = y;
-        intel_crtc_update_cursor(crtc, intel_crtc->cursor_bo != NULL);
+        if (intel_crtc->active)
+                intel_crtc_update_cursor(crtc, intel_crtc->cursor_bo != NULL);
        return 0;
 }
@@ -8205,9 +8199,10 @@ static void intel_dump_pipe_config(struct intel_crtc *crtc,
                      pipe_config->gmch_pfit.control,
                      pipe_config->gmch_pfit.pgm_ratios,
                      pipe_config->gmch_pfit.lvds_border_bits);
-        DRM_DEBUG_KMS("pch pfit: pos: 0x%08x, size: 0x%08x\n",
+        DRM_DEBUG_KMS("pch pfit: pos: 0x%08x, size: 0x%08x, %s\n",
                      pipe_config->pch_pfit.pos,
-                      pipe_config->pch_pfit.size);
+                      pipe_config->pch_pfit.size,
+                      pipe_config->pch_pfit.enabled ? "enabled" : "disabled");
        DRM_DEBUG_KMS("ips: %i\n", pipe_config->ips_enabled);
 }
@@ -8603,8 +8598,11 @@ intel_pipe_config_compare(struct drm_device *dev,
        if (INTEL_INFO(dev)->gen < 4)
                PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
        PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
-        PIPE_CONF_CHECK_I(pch_pfit.pos);
+        PIPE_CONF_CHECK_I(pch_pfit.enabled);
-        PIPE_CONF_CHECK_I(pch_pfit.size);
+        if (current_config->pch_pfit.enabled) {
+                PIPE_CONF_CHECK_I(pch_pfit.pos);
+                PIPE_CONF_CHECK_I(pch_pfit.size);
+        }
        PIPE_CONF_CHECK_I(ips_enabled);
@@ -10047,33 +10045,6 @@ static void i915_disable_vga(struct drm_device *dev)
        POSTING_READ(vga_reg);
 }
-static void i915_enable_vga_mem(struct drm_device *dev)
-{
-        /* Enable VGA memory on Intel HD */
-        if (HAS_PCH_SPLIT(dev)) {
-                vga_get_uninterruptible(dev->pdev, VGA_RSRC_LEGACY_IO);
-                outb(inb(VGA_MSR_READ) | VGA_MSR_MEM_EN, VGA_MSR_WRITE);
-                vga_set_legacy_decoding(dev->pdev, VGA_RSRC_LEGACY_IO |
-                                                   VGA_RSRC_LEGACY_MEM |
-                                                   VGA_RSRC_NORMAL_IO |
-                                                   VGA_RSRC_NORMAL_MEM);
-                vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
-        }
-}
-void i915_disable_vga_mem(struct drm_device *dev)
-{
-        /* Disable VGA memory on Intel HD */
-        if (HAS_PCH_SPLIT(dev)) {
-                vga_get_uninterruptible(dev->pdev, VGA_RSRC_LEGACY_IO);
-                outb(inb(VGA_MSR_READ) & ~VGA_MSR_MEM_EN, VGA_MSR_WRITE);
-                vga_set_legacy_decoding(dev->pdev, VGA_RSRC_LEGACY_IO |
-                                                   VGA_RSRC_NORMAL_IO |
-                                                   VGA_RSRC_NORMAL_MEM);
-                vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
-        }
-}
 void intel_modeset_init_hw(struct drm_device *dev)
 {
        intel_init_power_well(dev);
@@ -10352,7 +10323,6 @@ void i915_redisable_vga(struct drm_device *dev)
        if (I915_READ(vga_reg) != VGA_DISP_DISABLE) {
                DRM_DEBUG_KMS("Something enabled VGA plane, disabling it\n");
                i915_disable_vga(dev);
-                i915_disable_vga_mem(dev);
        }
 }
@@ -10566,8 +10536,6 @@ void intel_modeset_cleanup(struct drm_device *dev)
        intel_disable_fbc(dev);
-        i915_enable_vga_mem(dev);
        intel_disable_gt_powersave(dev);
        ironlake_teardown_rc6(dev);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 2151d13772b8..2c555f91bfae 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -588,7 +588,18 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
                        DRM_DEBUG_KMS("aux_ch native nack\n");
                        return -EREMOTEIO;
                case AUX_NATIVE_REPLY_DEFER:
-                        udelay(100);
+                        /*
+                         * For now, just give more slack to branch devices. We
+                         * could check the DPCD for I2C bit rate capabilities,
+                         * and if available, adjust the interval. We could also
+                         * be more careful with DP-to-Legacy adapters where a
+                         * long legacy cable may force very low I2C bit rates.
+                         */
+                        if (intel_dp->dpcd[DP_DOWNSTREAMPORT_PRESENT] &
+                            DP_DWN_STRM_PORT_PRESENT)
+                                usleep_range(500, 600);
+                        else
+                                usleep_range(300, 400);
                        continue;
                default:
                        DRM_ERROR("aux_ch invalid native reply 0x%02x\n",
@@ -1456,7 +1467,7 @@ static void intel_edp_psr_setup(struct intel_dp *intel_dp)
        /* Avoid continuous PSR exit by masking memup and hpd */
        I915_WRITE(EDP_PSR_DEBUG_CTL, EDP_PSR_DEBUG_MASK_MEMUP |
-                   EDP_PSR_DEBUG_MASK_HPD);
+                   EDP_PSR_DEBUG_MASK_HPD | EDP_PSR_DEBUG_MASK_LPSP);
        intel_dp->psr_setup_done = true;
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index a47799e832c6..9b7b68fd5d47 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -280,6 +280,7 @@ struct intel_crtc_config {
        struct {
                u32 pos;
                u32 size;
+                bool enabled;
        } pch_pfit;
        /* FDI configuration, only valid if has_pch_encoder is set. */
@@ -792,6 +793,5 @@ extern void hsw_pc8_disable_interrupts(struct drm_device *dev);
 extern void hsw_pc8_restore_interrupts(struct drm_device *dev);
 extern void intel_aux_display_runtime_get(struct drm_i915_private *dev_priv);
 extern void intel_aux_display_runtime_put(struct drm_i915_private *dev_priv);
-extern void i915_disable_vga_mem(struct drm_device *dev);
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 406303b509c1..7fa7df546c1e 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -263,6 +263,8 @@ static bool intel_dvo_compute_config(struct intel_encoder *encoder,
                C(vtotal);
                C(clock);
 #undef C
+                drm_mode_set_crtcinfo(adjusted_mode, 0);
        }
        if (intel_dvo->dev.dev_ops->mode_fixup)
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 42114ecbae0e..293564a2896a 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -112,6 +112,7 @@ intel_pch_panel_fitting(struct intel_crtc *intel_crtc,
 done:
        pipe_config->pch_pfit.pos = (x << 16) | y;
        pipe_config->pch_pfit.size = (width << 16) | height;
+        pipe_config->pch_pfit.enabled = pipe_config->pch_pfit.size != 0;
 }
 static void
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 0c115cc4899f..f4c5e95b2d6f 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2096,16 +2096,16 @@ static uint32_t ilk_pipe_pixel_rate(struct drm_device *dev,
                                    struct drm_crtc *crtc)
 {
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        uint32_t pixel_rate, pfit_size;
+        uint32_t pixel_rate;
        pixel_rate = intel_crtc->config.adjusted_mode.clock;
        /* We only use IF-ID interlacing. If we ever use PF-ID we'll need to
         * adjust the pixel_rate here. */
-        pfit_size = intel_crtc->config.pch_pfit.size;
+        if (intel_crtc->config.pch_pfit.enabled) {
-        if (pfit_size) {
                uint64_t pipe_w, pipe_h, pfit_w, pfit_h;
+                uint32_t pfit_size = intel_crtc->config.pch_pfit.size;
                pipe_w = intel_crtc->config.requested_mode.hdisplay;
                pipe_h = intel_crtc->config.requested_mode.vdisplay;
@@ -3864,8 +3864,6 @@ static void valleyview_enable_rps(struct drm_device *dev)
                                      dev_priv->rps.rpe_delay),
                         dev_priv->rps.rpe_delay);
-        INIT_DELAYED_WORK(&dev_priv->rps.vlv_work, vlv_rps_timer_work);
        valleyview_set_rps(dev_priv->dev, dev_priv->rps.rpe_delay);
        gen6_enable_rps_interrupts(dev);
@@ -4955,6 +4953,11 @@ static void haswell_init_clock_gating(struct drm_device *dev)
        I915_WRITE(GEN7_L3_CHICKEN_MODE_REGISTER,
                        GEN7_WA_L3_CHICKEN_MODE);
+        /* L3 caching of data atomics doesn't work -- disable it. */
+        I915_WRITE(HSW_SCRATCH1, HSW_SCRATCH1_L3_DATA_ATOMICS_DISABLE);
+        I915_WRITE(HSW_ROW_CHICKEN3,
+                   _MASKED_BIT_ENABLE(HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE));
        /* This is required by WaCatErrorRejectionIssue:hsw */
        I915_WRITE(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG,
                        I915_READ(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG) |
@@ -5681,5 +5684,7 @@ void intel_pm_init(struct drm_device *dev)
        INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                          intel_gen6_powersave_work);
+        INIT_DELAYED_WORK(&dev_priv->rps.vlv_work, vlv_rps_timer_work);
 }
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 85037b9d4934..49482fd5b76c 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -788,6 +788,8 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
        uint16_t h_sync_offset, v_sync_offset;
        int mode_clock;
+        memset(dtd, 0, sizeof(*dtd));
        width = mode->hdisplay;
        height = mode->vdisplay;
@@ -830,44 +832,51 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
        if (mode->flags & DRM_MODE_FLAG_PVSYNC)
                dtd->part2.dtd_flags |= DTD_FLAG_VSYNC_POSITIVE;
-        dtd->part2.sdvo_flags = 0;
        dtd->part2.v_sync_off_high = v_sync_offset & 0xc0;
-        dtd->part2.reserved = 0;
 }
-static void intel_sdvo_get_mode_from_dtd(struct drm_display_mode * mode,
+static void intel_sdvo_get_mode_from_dtd(struct drm_display_mode *pmode,
                                         const struct intel_sdvo_dtd *dtd)
 {
-        mode->hdisplay = dtd->part1.h_active;
+        struct drm_display_mode mode = {};
-        mode->hdisplay += ((dtd->part1.h_high >> 4) & 0x0f) << 8;
-        mode->hsync_start = mode->hdisplay + dtd->part2.h_sync_off;
+        mode.hdisplay = dtd->part1.h_active;
-        mode->hsync_start += (dtd->part2.sync_off_width_high & 0xc0) << 2;
+        mode.hdisplay += ((dtd->part1.h_high >> 4) & 0x0f) << 8;
-        mode->hsync_end = mode->hsync_start + dtd->part2.h_sync_width;
+        mode.hsync_start = mode.hdisplay + dtd->part2.h_sync_off;
-        mode->hsync_end += (dtd->part2.sync_off_width_high & 0x30) << 4;
+        mode.hsync_start += (dtd->part2.sync_off_width_high & 0xc0) << 2;
-        mode->htotal = mode->hdisplay + dtd->part1.h_blank;
+        mode.hsync_end = mode.hsync_start + dtd->part2.h_sync_width;
-        mode->htotal += (dtd->part1.h_high & 0xf) << 8;
+        mode.hsync_end += (dtd->part2.sync_off_width_high & 0x30) << 4;
+        mode.htotal = mode.hdisplay + dtd->part1.h_blank;
-        mode->vdisplay = dtd->part1.v_active;
+        mode.htotal += (dtd->part1.h_high & 0xf) << 8;
-        mode->vdisplay += ((dtd->part1.v_high >> 4) & 0x0f) << 8;
-        mode->vsync_start = mode->vdisplay;
+        mode.vdisplay = dtd->part1.v_active;
-        mode->vsync_start += (dtd->part2.v_sync_off_width >> 4) & 0xf;
+        mode.vdisplay += ((dtd->part1.v_high >> 4) & 0x0f) << 8;
-        mode->vsync_start += (dtd->part2.sync_off_width_high & 0x0c) << 2;
+        mode.vsync_start = mode.vdisplay;
-        mode->vsync_start += dtd->part2.v_sync_off_high & 0xc0;
+        mode.vsync_start += (dtd->part2.v_sync_off_width >> 4) & 0xf;
-        mode->vsync_end = mode->vsync_start +
+        mode.vsync_start += (dtd->part2.sync_off_width_high & 0x0c) << 2;
+        mode.vsync_start += dtd->part2.v_sync_off_high & 0xc0;
+        mode.vsync_end = mode.vsync_start +
                (dtd->part2.v_sync_off_width & 0xf);
-        mode->vsync_end += (dtd->part2.sync_off_width_high & 0x3) << 4;
+        mode.vsync_end += (dtd->part2.sync_off_width_high & 0x3) << 4;
-        mode->vtotal = mode->vdisplay + dtd->part1.v_blank;
+        mode.vtotal = mode.vdisplay + dtd->part1.v_blank;
-        mode->vtotal += (dtd->part1.v_high & 0xf) << 8;
+        mode.vtotal += (dtd->part1.v_high & 0xf) << 8;
-        mode->clock = dtd->part1.clock * 10;
+        mode.clock = dtd->part1.clock * 10;
-        mode->flags &= ~(DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC);
        if (dtd->part2.dtd_flags & DTD_FLAG_INTERLACE)
-                mode->flags |= DRM_MODE_FLAG_INTERLACE;
+                mode.flags |= DRM_MODE_FLAG_INTERLACE;
        if (dtd->part2.dtd_flags & DTD_FLAG_HSYNC_POSITIVE)
-                mode->flags |= DRM_MODE_FLAG_PHSYNC;
+                mode.flags |= DRM_MODE_FLAG_PHSYNC;
+        else
+                mode.flags |= DRM_MODE_FLAG_NHSYNC;
        if (dtd->part2.dtd_flags & DTD_FLAG_VSYNC_POSITIVE)
-                mode->flags |= DRM_MODE_FLAG_PVSYNC;
+                mode.flags |= DRM_MODE_FLAG_PVSYNC;
+        else
+                mode.flags |= DRM_MODE_FLAG_NVSYNC;
+        drm_mode_set_crtcinfo(&mode, 0);
+        drm_mode_copy(pmode, &mode);
 }
 static bool intel_sdvo_check_supp_encode(struct intel_sdvo *intel_sdvo)
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index f2c6d7909ae2..dd6f84bf6c22 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -916,6 +916,14 @@ intel_tv_compute_config(struct intel_encoder *encoder,
        DRM_DEBUG_KMS("forcing bpc to 8 for TV\n");
        pipe_config->pipe_bpp = 8*3;
+        /* TV has it's own notion of sync and other mode flags, so clear them. */
+        pipe_config->adjusted_mode.flags = 0;
+        /*
+         * FIXME: We don't check whether the input mode is actually what we want
+         * or whether userspace is doing something stupid.
+         */
        return true;
 }
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index a60584763b61..a0b9d8a95b16 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -124,6 +124,8 @@ void adreno_recover(struct msm_gpu *gpu)
        /* reset completed fence seqno, just discard anything pending: */
        adreno_gpu->memptrs->fence = gpu->submitted_fence;
+        adreno_gpu->memptrs->rptr  = 0;
+        adreno_gpu->memptrs->wptr  = 0;
        gpu->funcs->pm_resume(gpu);
        ret = gpu->funcs->hw_init(gpu);
@@ -229,7 +231,7 @@ void adreno_idle(struct msm_gpu *gpu)
                        return;
        } while(time_before(jiffies, t));
-        DRM_ERROR("timeout waiting for %s to drain ringbuffer!\n", gpu->name);
+        DRM_ERROR("%s: timeout waiting to drain ringbuffer!\n", gpu->name);
        /* TODO maybe we need to reset GPU here to recover from hang? */
 }
@@ -256,11 +258,17 @@ void adreno_wait_ring(struct msm_gpu *gpu, uint32_t ndwords)
 {
        struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
        uint32_t freedwords;
+        unsigned long t = jiffies + ADRENO_IDLE_TIMEOUT;
        do {
                uint32_t size = gpu->rb->size / 4;
                uint32_t wptr = get_wptr(gpu->rb);
                uint32_t rptr = adreno_gpu->memptrs->rptr;
                freedwords = (rptr + (size - 1) - wptr) % size;
+                if (time_after(jiffies, t)) {
+                        DRM_ERROR("%s: timeout waiting for ringbuffer space\n", gpu->name);
+                        break;
+                }
        } while(freedwords < ndwords);
 }
diff --git a/drivers/gpu/drm/msm/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
index 5db5bbaedae2..bc7fd11ad8be 100644
--- a/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
@@ -19,8 +19,6 @@
 #include "msm_drv.h"
 #include "mdp4_kms.h"
-#include <mach/iommu.h>
 static struct mdp4_platform_config *mdp4_get_config(struct platform_device *dev);
 static int mdp4_hw_init(struct msm_kms *kms)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 864c9773636b..b3a2f1629041 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -18,8 +18,6 @@
 #include "msm_drv.h"
 #include "msm_gpu.h"
-#include <mach/iommu.h>
 static void msm_fb_output_poll_changed(struct drm_device *dev)
 {
        struct msm_drm_private *priv = dev->dev_private;
@@ -62,6 +60,8 @@ int msm_iommu_attach(struct drm_device *dev, struct iommu_domain *iommu,
        int i, ret;
        for (i = 0; i < cnt; i++) {
+                /* TODO maybe some day msm iommu won't require this hack: */
+                struct device *msm_iommu_get_ctx(const char *ctx_name);
                struct device *ctx = msm_iommu_get_ctx(names[i]);
                if (!ctx)
                        continue;
@@ -199,7 +199,7 @@ static int msm_load(struct drm_device *dev, unsigned long flags)
                 * imx drm driver on iMX5
                 */
                dev_err(dev->dev, "failed to load kms\n");
-                ret = PTR_ERR(priv->kms);
+                ret = PTR_ERR(kms);
                goto fail;
        }
@@ -499,25 +499,41 @@ int msm_wait_fence_interruptable(struct drm_device *dev, uint32_t fence,
                struct timespec *timeout)
 {
        struct msm_drm_private *priv = dev->dev_private;
-        unsigned long timeout_jiffies = timespec_to_jiffies(timeout);
-        unsigned long start_jiffies = jiffies;
-        unsigned long remaining_jiffies;
        int ret;
-        if (time_after(start_jiffies, timeout_jiffies))
+        if (!priv->gpu)
-                remaining_jiffies = 0;
+                return 0;
-        else
-                remaining_jiffies = timeout_jiffies - start_jiffies;
+        if (fence > priv->gpu->submitted_fence) {
+                DRM_ERROR("waiting on invalid fence: %u (of %u)\n",
-        ret = wait_event_interruptible_timeout(priv->fence_event,
+                                fence, priv->gpu->submitted_fence);
-                        priv->completed_fence >= fence,
+                return -EINVAL;
-                        remaining_jiffies);
+        }
-        if (ret == 0) {
-                DBG("timeout waiting for fence: %u (completed: %u)",
+        if (!timeout) {
-                                fence, priv->completed_fence);
+                /* no-wait: */
-                ret = -ETIMEDOUT;
+                ret = fence_completed(dev, fence) ? 0 : -EBUSY;
-        } else if (ret != -ERESTARTSYS) {
+        } else {
-                ret = 0;
+                unsigned long timeout_jiffies = timespec_to_jiffies(timeout);
+                unsigned long start_jiffies = jiffies;
+                unsigned long remaining_jiffies;
+                if (time_after(start_jiffies, timeout_jiffies))
+                        remaining_jiffies = 0;
+                else
+                        remaining_jiffies = timeout_jiffies - start_jiffies;
+                ret = wait_event_interruptible_timeout(priv->fence_event,
+                                fence_completed(dev, fence),
+                                remaining_jiffies);
+                if (ret == 0) {
+                        DBG("timeout waiting for fence: %u (completed: %u)",
+                                        fence, priv->completed_fence);
+                        ret = -ETIMEDOUT;
+                } else if (ret != -ERESTARTSYS) {
+                        ret = 0;
+                }
        }
        return ret;
@@ -681,7 +697,7 @@ static struct drm_driver msm_driver = {
        .gem_vm_ops         = &vm_ops,
        .dumb_create        = msm_gem_dumb_create,
        .dumb_map_offset    = msm_gem_dumb_map_offset,
-        .dumb_destroy       = msm_gem_dumb_destroy,
+        .dumb_destroy       = drm_gem_dumb_destroy,
 #ifdef CONFIG_DEBUG_FS
        .debugfs_init       = msm_debugfs_init,
        .debugfs_cleanup    = msm_debugfs_cleanup,
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 80d75094bf0a..df8f1d084bc1 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -153,7 +153,7 @@ void *msm_gem_vaddr(struct drm_gem_object *obj);
 int msm_gem_queue_inactive_work(struct drm_gem_object *obj,
                struct work_struct *work);
 void msm_gem_move_to_active(struct drm_gem_object *obj,
-                struct msm_gpu *gpu, uint32_t fence);
+                struct msm_gpu *gpu, bool write, uint32_t fence);
 void msm_gem_move_to_inactive(struct drm_gem_object *obj);
 int msm_gem_cpu_prep(struct drm_gem_object *obj, uint32_t op,
                struct timespec *timeout);
@@ -191,6 +191,12 @@ u32 msm_readl(const void __iomem *addr);
 #define DBG(fmt, ...) DRM_DEBUG(fmt"\n", ##__VA_ARGS__)
 #define VERB(fmt, ...) if (0) DRM_DEBUG(fmt"\n", ##__VA_ARGS__)
+static inline bool fence_completed(struct drm_device *dev, uint32_t fence)
+{
+        struct msm_drm_private *priv = dev->dev_private;
+        return priv->completed_fence >= fence;
+}
 static inline int align_pitch(int width, int bpp)
 {
        int bytespp = (bpp + 7) / 8;
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 6b5a6c8c7658..2bae46c66a30 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -40,9 +40,9 @@ static struct page **get_pages(struct drm_gem_object *obj)
                }
                msm_obj->sgt = drm_prime_pages_to_sg(p, npages);
-                if (!msm_obj->sgt) {
+                if (IS_ERR(msm_obj->sgt)) {
                        dev_err(dev->dev, "failed to allocate sgt\n");
-                        return ERR_PTR(-ENOMEM);
+                        return ERR_CAST(msm_obj->sgt);
                }
                msm_obj->pages = p;
@@ -159,7 +159,6 @@ out_unlock:
 out:
        switch (ret) {
        case -EAGAIN:
-                set_need_resched();
        case 0:
        case -ERESTARTSYS:
        case -EINTR:
@@ -320,13 +319,6 @@ int msm_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
                        MSM_BO_SCANOUT | MSM_BO_WC, &args->handle);
 }
-int msm_gem_dumb_destroy(struct drm_file *file, struct drm_device *dev,
-                uint32_t handle)
-{
-        /* No special work needed, drop the reference and see what falls out */
-        return drm_gem_handle_delete(file, handle);
-}
 int msm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,
                uint32_t handle, uint64_t *offset)
 {
@@ -393,11 +385,14 @@ int msm_gem_queue_inactive_work(struct drm_gem_object *obj,
 }
 void msm_gem_move_to_active(struct drm_gem_object *obj,
-                struct msm_gpu *gpu, uint32_t fence)
+                struct msm_gpu *gpu, bool write, uint32_t fence)
 {
        struct msm_gem_object *msm_obj = to_msm_bo(obj);
        msm_obj->gpu = gpu;
-        msm_obj->fence = fence;
+        if (write)
+                msm_obj->write_fence = fence;
+        else
+                msm_obj->read_fence = fence;
        list_del_init(&msm_obj->mm_list);
        list_add_tail(&msm_obj->mm_list, &gpu->active_list);
 }
@@ -411,7 +406,8 @@ void msm_gem_move_to_inactive(struct drm_gem_object *obj)
        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
        msm_obj->gpu = NULL;
-        msm_obj->fence = 0;
+        msm_obj->read_fence = 0;
+        msm_obj->write_fence = 0;
        list_del_init(&msm_obj->mm_list);
        list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
@@ -433,8 +429,18 @@ int msm_gem_cpu_prep(struct drm_gem_object *obj, uint32_t op,
        struct msm_gem_object *msm_obj = to_msm_bo(obj);
        int ret = 0;
-        if (is_active(msm_obj) && !(op & MSM_PREP_NOSYNC))
+        if (is_active(msm_obj)) {
-                ret = msm_wait_fence_interruptable(dev, msm_obj->fence, timeout);
+                uint32_t fence = 0;
+                if (op & MSM_PREP_READ)
+                        fence = msm_obj->write_fence;
+                if (op & MSM_PREP_WRITE)
+                        fence = max(fence, msm_obj->read_fence);
+                if (op & MSM_PREP_NOSYNC)
+                        timeout = NULL;
+                ret = msm_wait_fence_interruptable(dev, fence, timeout);
+        }
        /* TODO cache maintenance */
@@ -455,9 +461,10 @@ void msm_gem_describe(struct drm_gem_object *obj, struct seq_file *m)
        uint64_t off = drm_vma_node_start(&obj->vma_node);
        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
-        seq_printf(m, "%08x: %c(%d) %2d (%2d) %08llx %p %d\n",
+        seq_printf(m, "%08x: %c(r=%u,w=%u) %2d (%2d) %08llx %p %d\n",
                        msm_obj->flags, is_active(msm_obj) ? 'A' : 'I',
-                        msm_obj->fence, obj->name, obj->refcount.refcount.counter,
+                        msm_obj->read_fence, msm_obj->write_fence,
+                        obj->name, obj->refcount.refcount.counter,
                        off, msm_obj->vaddr, obj->size);
 }
diff --git a/drivers/gpu/drm/msm/msm_gem.h b/drivers/gpu/drm/msm/msm_gem.h
index d746f13d283c..0676f32e2c6a 100644
--- a/drivers/gpu/drm/msm/msm_gem.h
+++ b/drivers/gpu/drm/msm/msm_gem.h
@@ -36,7 +36,7 @@ struct msm_gem_object {
         */
        struct list_head mm_list;
        struct msm_gpu *gpu;     /* non-null if active */
-        uint32_t fence;
+        uint32_t read_fence, write_fence;
        /* Transiently in the process of submit ioctl, objects associated
         * with the submit are on submit->bo_list.. this only lasts for
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 3e1ef3a00f60..5281d4bc37f7 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -78,7 +78,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                }
                if (submit_bo.flags & BO_INVALID_FLAGS) {
-                        DBG("invalid flags: %x", submit_bo.flags);
+                        DRM_ERROR("invalid flags: %x\n", submit_bo.flags);
                        ret = -EINVAL;
                        goto out_unlock;
                }
@@ -92,7 +92,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                 */
                obj = idr_find(&file->object_idr, submit_bo.handle);
                if (!obj) {
-                        DBG("invalid handle %u at index %u", submit_bo.handle, i);
+                        DRM_ERROR("invalid handle %u at index %u\n", submit_bo.handle, i);
                        ret = -EINVAL;
                        goto out_unlock;
                }
@@ -100,7 +100,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                msm_obj = to_msm_bo(obj);
                if (!list_empty(&msm_obj->submit_entry)) {
-                        DBG("handle %u at index %u already on submit list",
+                        DRM_ERROR("handle %u at index %u already on submit list\n",
                                        submit_bo.handle, i);
                        ret = -EINVAL;
                        goto out_unlock;
@@ -216,8 +216,9 @@ static int submit_bo(struct msm_gem_submit *submit, uint32_t idx,
                struct msm_gem_object **obj, uint32_t *iova, bool *valid)
 {
        if (idx >= submit->nr_bos) {
-                DBG("invalid buffer index: %u (out of %u)", idx, submit->nr_bos);
+                DRM_ERROR("invalid buffer index: %u (out of %u)\n",
-                return EINVAL;
+                                idx, submit->nr_bos);
+                return -EINVAL;
        }
        if (obj)
@@ -239,7 +240,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
        int ret;
        if (offset % 4) {
-                DBG("non-aligned cmdstream buffer: %u", offset);
+                DRM_ERROR("non-aligned cmdstream buffer: %u\n", offset);
                return -EINVAL;
        }
@@ -266,7 +267,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
                        return -EFAULT;
                if (submit_reloc.submit_offset % 4) {
-                        DBG("non-aligned reloc offset: %u",
+                        DRM_ERROR("non-aligned reloc offset: %u\n",
                                        submit_reloc.submit_offset);
                        return -EINVAL;
                }
@@ -276,7 +277,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
                if ((off >= (obj->base.size / 4)) ||
                                (off < last_offset)) {
-                        DBG("invalid offset %u at reloc %u", off, i);
+                        DRM_ERROR("invalid offset %u at reloc %u\n", off, i);
                        return -EINVAL;
                }
@@ -374,14 +375,15 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                        goto out;
                if (submit_cmd.size % 4) {
-                        DBG("non-aligned cmdstream buffer size: %u",
+                        DRM_ERROR("non-aligned cmdstream buffer size: %u\n",
                                        submit_cmd.size);
                        ret = -EINVAL;
                        goto out;
                }
-                if (submit_cmd.size >= msm_obj->base.size) {
+                if ((submit_cmd.size + submit_cmd.submit_offset) >=
-                        DBG("invalid cmdstream size: %u", submit_cmd.size);
+                                msm_obj->base.size) {
+                        DRM_ERROR("invalid cmdstream size: %u\n", submit_cmd.size);
                        ret = -EINVAL;
                        goto out;
                }
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index e1e1ec9321ff..3bab937965d1 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -29,13 +29,14 @@
 static void bs_init(struct msm_gpu *gpu, struct platform_device *pdev)
 {
        struct drm_device *dev = gpu->dev;
-        struct kgsl_device_platform_data *pdata = pdev->dev.platform_data;
+        struct kgsl_device_platform_data *pdata;
        if (!pdev) {
                dev_err(dev->dev, "could not find dtv pdata\n");
                return;
        }
+        pdata = pdev->dev.platform_data;
        if (pdata->bus_scale_table) {
                gpu->bsc = msm_bus_scale_register_client(pdata->bus_scale_table);
                DBG("bus scale client: %08x", gpu->bsc);
@@ -230,6 +231,8 @@ static void hangcheck_timer_reset(struct msm_gpu *gpu)
 static void hangcheck_handler(unsigned long data)
 {
        struct msm_gpu *gpu = (struct msm_gpu *)data;
+        struct drm_device *dev = gpu->dev;
+        struct msm_drm_private *priv = dev->dev_private;
        uint32_t fence = gpu->funcs->last_fence(gpu);
        if (fence != gpu->hangcheck_fence) {
@@ -237,14 +240,22 @@ static void hangcheck_handler(unsigned long data)
                gpu->hangcheck_fence = fence;
        } else if (fence < gpu->submitted_fence) {
                /* no progress and not done.. hung! */
-                struct msm_drm_private *priv = gpu->dev->dev_private;
                gpu->hangcheck_fence = fence;
+                dev_err(dev->dev, "%s: hangcheck detected gpu lockup!\n",
+                                gpu->name);
+                dev_err(dev->dev, "%s:     completed fence: %u\n",
+                                gpu->name, fence);
+                dev_err(dev->dev, "%s:     submitted fence: %u\n",
+                                gpu->name, gpu->submitted_fence);
                queue_work(priv->wq, &gpu->recover_work);
        }
        /* if still more pending work, reset the hangcheck timer: */
        if (gpu->submitted_fence > gpu->hangcheck_fence)
                hangcheck_timer_reset(gpu);
+        /* workaround for missing irq: */
+        queue_work(priv->wq, &gpu->retire_work);
 }
 /*
@@ -265,7 +276,8 @@ static void retire_worker(struct work_struct *work)
                obj = list_first_entry(&gpu->active_list,
                                struct msm_gem_object, mm_list);
-                if (obj->fence <= fence) {
+                if ((obj->read_fence <= fence) &&
+                                (obj->write_fence <= fence)) {
                        /* move to inactive: */
                        msm_gem_move_to_inactive(&obj->base);
                        msm_gem_put_iova(&obj->base, gpu->id);
@@ -321,7 +333,11 @@ int msm_gpu_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
                                        submit->gpu->id, &iova);
                }
-                msm_gem_move_to_active(&msm_obj->base, gpu, submit->fence);
+                if (submit->bos[i].flags & MSM_SUBMIT_BO_READ)
+                        msm_gem_move_to_active(&msm_obj->base, gpu, false, submit->fence);
+                if (submit->bos[i].flags & MSM_SUBMIT_BO_WRITE)
+                        msm_gem_move_to_active(&msm_obj->base, gpu, true, submit->fence);
        }
        hangcheck_timer_reset(gpu);
        mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
index 2e11ea02cf87..57cda2a1437b 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
@@ -579,8 +579,22 @@ static void
 init_reserved(struct nvbios_init *init)
 {
        u8 opcode = nv_ro08(init->bios, init->offset);
-        trace("RESERVED\t0x%02x\n", opcode);
+        u8 length, i;
-        init->offset += 1;
+        switch (opcode) {
+        case 0xaa:
+                length = 4;
+                break;
+        default:
+                length = 1;
+                break;
+        }
+        trace("RESERVED 0x%02x\t", opcode);
+        for (i = 1; i < length; i++)
+                cont(" 0x%02x", nv_ro08(init->bios, init->offset + i));
+        cont("\n");
+        init->offset += length;
 }
 /**
@@ -1437,7 +1451,7 @@ init_configure_mem(struct nvbios_init *init)
        data = init_rdvgai(init, 0x03c4, 0x01);
        init_wrvgai(init, 0x03c4, 0x01, data | 0x20);
-        while ((addr = nv_ro32(bios, sdata)) != 0xffffffff) {
+        for (; (addr = nv_ro32(bios, sdata)) != 0xffffffff; sdata += 4) {
                switch (addr) {
                case 0x10021c: /* CKE_NORMAL */
                case 0x1002d0: /* CMD_REFRESH */
@@ -2135,6 +2149,7 @@ static struct nvbios_init_opcode {
        [0x99] = { init_zm_auxch },
        [0x9a] = { init_i2c_long_if },
        [0xa9] = { init_gpio_ne },
+        [0xaa] = { init_reserved },
 };
 #define init_opcode_nr (sizeof(init_opcode) / sizeof(init_opcode[0]))
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
index 37712a6df923..e290cfa4acee 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
@@ -113,7 +113,7 @@ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
                pmc->use_msi = false;
                break;
        default:
-                pmc->use_msi = nouveau_boolopt(device->cfgopt, "NvMSI", true);
+                pmc->use_msi = nouveau_boolopt(device->cfgopt, "NvMSI", false);
                if (pmc->use_msi) {
                        pmc->use_msi = pci_enable_msi(device->pdev) == 0;
                        if (pmc->use_msi) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index d2712e6e5d31..7848590f5568 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -278,7 +278,6 @@ nouveau_display_create(struct drm_device *dev)
 {
        struct nouveau_drm *drm = nouveau_drm(dev);
        struct nouveau_display *disp;
-        u32 pclass = dev->pdev->class >> 8;
        int ret, gen;
        disp = drm->display = kzalloc(sizeof(*disp), GFP_KERNEL);
@@ -340,29 +339,25 @@ nouveau_display_create(struct drm_device *dev)
        drm_kms_helper_poll_init(dev);
        drm_kms_helper_poll_disable(dev);
-        if (nouveau_modeset == 1 ||
+        if (drm->vbios.dcb.entries) {
-            (nouveau_modeset < 0 && pclass == PCI_CLASS_DISPLAY_VGA)) {
+                if (nv_device(drm->device)->card_type < NV_50)
-                if (drm->vbios.dcb.entries) {
+                        ret = nv04_display_create(dev);
-                        if (nv_device(drm->device)->card_type < NV_50)
+                else
-                                ret = nv04_display_create(dev);
+                        ret = nv50_display_create(dev);
-                        else
+        } else {
-                                ret = nv50_display_create(dev);
+                ret = 0;
-                } else {
+        }
-                        ret = 0;
-                }
-                if (ret)
-                        goto disp_create_err;
-                if (dev->mode_config.num_crtc) {
+        if (ret)
-                        ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
+                goto disp_create_err;
-                        if (ret)
-                                goto vblank_err;
-                }
-                nouveau_backlight_init(dev);
+        if (dev->mode_config.num_crtc) {
+                ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
+                if (ret)
+                        goto vblank_err;
        }
+        nouveau_backlight_init(dev);
        return 0;
 vblank_err:
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 8f6d63d7edd3..a86ecf65c164 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -454,7 +454,8 @@ nouveau_fbcon_init(struct drm_device *dev)
        int preferred_bpp;
        int ret;
-        if (!dev->mode_config.num_crtc)
+        if (!dev->mode_config.num_crtc ||
+            (dev->pdev->class >> 8) != PCI_CLASS_DISPLAY_VGA)
                return 0;
        fbcon = kzalloc(sizeof(struct nouveau_fbdev), GFP_KERNEL);
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index ca5492ac2da5..0843ebc910d4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -104,9 +104,7 @@ nouveau_sgdma_create_ttm(struct ttm_bo_device *bdev,
        else
                nvbe->ttm.ttm.func = &nv50_sgdma_backend;
-        if (ttm_dma_tt_init(&nvbe->ttm, bdev, size, page_flags, dummy_read_page)) {
+        if (ttm_dma_tt_init(&nvbe->ttm, bdev, size, page_flags, dummy_read_page))
-                kfree(nvbe);
                return NULL;
-        }
        return &nvbe->ttm.ttm;
 }
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index dfac7965ea28..32923d2f6002 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -707,8 +707,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
        switch (connector->connector_type) {
        case DRM_MODE_CONNECTOR_DVII:
        case DRM_MODE_CONNECTOR_HDMIB: /* HDMI-B is basically DL-DVI; analog works fine */
-                if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
-                    radeon_audio)
+                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
                        return ATOM_ENCODER_MODE_HDMI;
                else if (radeon_connector->use_digital)
                        return ATOM_ENCODER_MODE_DVI;
@@ -718,8 +719,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
        case DRM_MODE_CONNECTOR_DVID:
        case DRM_MODE_CONNECTOR_HDMIA:
        default:
-                if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
-                    radeon_audio)
+                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
                        return ATOM_ENCODER_MODE_HDMI;
                else
                        return ATOM_ENCODER_MODE_DVI;
@@ -732,8 +734,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
                if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
                    (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
                        return ATOM_ENCODER_MODE_DP;
-                else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                else if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
-                         radeon_audio)
+                         (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                          (radeon_connector->audio == RADEON_AUDIO_AUTO)))
                        return ATOM_ENCODER_MODE_HDMI;
                else
                        return ATOM_ENCODER_MODE_DVI;
@@ -1647,8 +1650,12 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
                        atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-                        /* some early dce3.2 boards have a bug in their transmitter control table */
+                        /* some dce3.x boards have a bug in their transmitter control table.
-                        if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730))
+                         * ACTION_ENABLE_OUTPUT can probably be dropped since ACTION_ENABLE
+                         * does the same thing and more.
+                         */
+                        if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) &&
+                            (rdev->family != CHIP_RS880))
                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                }
                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 084e69414fd1..9b6950d9b3c0 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -1168,6 +1168,23 @@ static const struct radeon_blacklist_clocks btc_blacklist_clocks[] =
        { 25000, 30000, RADEON_SCLK_UP }
 };
+void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                     u32 *max_clock)
+{
+        u32 i, clock = 0;
+        if ((table == NULL) || (table->count == 0)) {
+                *max_clock = clock;
+                return;
+        }
+        for (i = 0; i < table->count; i++) {
+                if (clock < table->entries[i].clk)
+                        clock = table->entries[i].clk;
+        }
+        *max_clock = clock;
+}
 void btc_apply_voltage_dependency_rules(struct radeon_clock_voltage_dependency_table *table,
                                        u32 clock, u16 max_voltage, u16 *voltage)
 {
@@ -1913,7 +1930,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                        }
                        j++;
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        tmp = RREG32(MC_PMG_CMD_MRS);
@@ -1928,7 +1945,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                        }
                        j++;
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        break;
                case MC_SEQ_RESERVE_M >> 2:
@@ -1942,7 +1959,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                        }
                        j++;
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        break;
                default:
@@ -2080,6 +2097,7 @@ static void btc_apply_state_adjust_rules(struct radeon_device *rdev,
        bool disable_mclk_switching;
        u32 mclk, sclk;
        u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
            btc_dpm_vblank_too_short(rdev))
@@ -2121,6 +2139,39 @@ static void btc_apply_state_adjust_rules(struct radeon_device *rdev,
                        ps->low.vddci = max_limits->vddci;
        }
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+        if (max_sclk_vddc) {
+                if (ps->low.sclk > max_sclk_vddc)
+                        ps->low.sclk = max_sclk_vddc;
+                if (ps->medium.sclk > max_sclk_vddc)
+                        ps->medium.sclk = max_sclk_vddc;
+                if (ps->high.sclk > max_sclk_vddc)
+                        ps->high.sclk = max_sclk_vddc;
+        }
+        if (max_mclk_vddci) {
+                if (ps->low.mclk > max_mclk_vddci)
+                        ps->low.mclk = max_mclk_vddci;
+                if (ps->medium.mclk > max_mclk_vddci)
+                        ps->medium.mclk = max_mclk_vddci;
+                if (ps->high.mclk > max_mclk_vddci)
+                        ps->high.mclk = max_mclk_vddci;
+        }
+        if (max_mclk_vddc) {
+                if (ps->low.mclk > max_mclk_vddc)
+                        ps->low.mclk = max_mclk_vddc;
+                if (ps->medium.mclk > max_mclk_vddc)
+                        ps->medium.mclk = max_mclk_vddc;
+                if (ps->high.mclk > max_mclk_vddc)
+                        ps->high.mclk = max_mclk_vddc;
+        }
        /* XXX validate the min clocks required for display */
        if (disable_mclk_switching) {
@@ -2340,12 +2391,6 @@ int btc_dpm_set_power_state(struct radeon_device *rdev)
                return ret;
        }
-        ret = rv770_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("rv770_dpm_force_performance_level failed\n");
-                return ret;
-        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/btc_dpm.h b/drivers/gpu/drm/radeon/btc_dpm.h
index 1a15e0e41950..3b6f12b7760b 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.h
+++ b/drivers/gpu/drm/radeon/btc_dpm.h
@@ -46,6 +46,8 @@ void btc_adjust_clock_combinations(struct radeon_device *rdev,
                                   struct rv7xx_pl *pl);
 void btc_apply_voltage_dependency_rules(struct radeon_clock_voltage_dependency_table *table,
                                        u32 clock, u16 max_voltage, u16 *voltage);
+void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                     u32 *max_clock);
 void btc_apply_voltage_delta_rules(struct radeon_device *rdev,
                                   u16 max_vddc, u16 max_vddci,
                                   u16 *vddc, u16 *vddci);
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 3cce533397c6..51e947a97edf 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -146,6 +146,8 @@ static const struct ci_pt_config_reg didt_config_ci[] =
 };
 extern u8 rv770_get_memory_module_index(struct radeon_device *rdev);
+extern void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                            u32 *max_clock);
 extern int ni_copy_and_switch_arb_sets(struct radeon_device *rdev,
                                       u32 arb_freq_src, u32 arb_freq_dest);
 extern u8 si_get_ddr3_mclk_frequency_ratio(u32 memory_clock);
@@ -712,6 +714,7 @@ static void ci_apply_state_adjust_rules(struct radeon_device *rdev,
        struct radeon_clock_and_voltage_limits *max_limits;
        bool disable_mclk_switching;
        u32 sclk, mclk;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        int i;
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -739,6 +742,29 @@ static void ci_apply_state_adjust_rules(struct radeon_device *rdev,
                }
        }
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
        /* XXX validate the min clocks required for display */
        if (disable_mclk_switching) {
@@ -4748,12 +4774,6 @@ int ci_dpm_set_power_state(struct radeon_device *rdev)
        if (pi->pcie_performance_request)
                ci_notify_link_speed_change_after_state_change(rdev, new_ps, old_ps);
-        ret = ci_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("ci_dpm_force_performance_level failed\n");
-                return ret;
-        }
        cik_update_cg(rdev, (RADEON_CG_BLOCK_GFX |
                             RADEON_CG_BLOCK_MC |
                             RADEON_CG_BLOCK_SDMA |
diff --git a/drivers/gpu/drm/radeon/ci_smc.c b/drivers/gpu/drm/radeon/ci_smc.c
index 53b43dd3cf1e..252e10a41cf5 100644
--- a/drivers/gpu/drm/radeon/ci_smc.c
+++ b/drivers/gpu/drm/radeon/ci_smc.c
@@ -47,10 +47,11 @@ int ci_copy_bytes_to_smc(struct radeon_device *rdev,
                         u32 smc_start_address,
                         const u8 *src, u32 byte_count, u32 limit)
 {
+        unsigned long flags;
        u32 data, original_data;
        u32 addr;
        u32 extra_shift;
-        int ret;
+        int ret = 0;
        if (smc_start_address & 3)
                return -EINVAL;
@@ -59,13 +60,14 @@ int ci_copy_bytes_to_smc(struct radeon_device *rdev,
        addr = smc_start_address;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        while (byte_count >= 4) {
                /* SMC address space is BE */
                data = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3];
                ret = ci_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                WREG32(SMC_IND_DATA_0, data);
@@ -80,7 +82,7 @@ int ci_copy_bytes_to_smc(struct radeon_device *rdev,
                ret = ci_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                original_data = RREG32(SMC_IND_DATA_0);
@@ -97,11 +99,15 @@ int ci_copy_bytes_to_smc(struct radeon_device *rdev,
                ret = ci_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                WREG32(SMC_IND_DATA_0, data);
        }
-        return 0;
+done:
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
+        return ret;
 }
 void ci_start_smc(struct radeon_device *rdev)
@@ -197,6 +203,7 @@ PPSMC_Result ci_wait_for_smc_inactive(struct radeon_device *rdev)
 int ci_load_smc_ucode(struct radeon_device *rdev, u32 limit)
 {
+        unsigned long flags;
        u32 ucode_start_address;
        u32 ucode_size;
        const u8 *src;
@@ -219,6 +226,7 @@ int ci_load_smc_ucode(struct radeon_device *rdev, u32 limit)
                return -EINVAL;
        src = (const u8 *)rdev->smc_fw->data;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        WREG32(SMC_IND_INDEX_0, ucode_start_address);
        WREG32_P(SMC_IND_ACCESS_CNTL, AUTO_INCREMENT_IND_0, ~AUTO_INCREMENT_IND_0);
        while (ucode_size >= 4) {
@@ -231,6 +239,7 @@ int ci_load_smc_ucode(struct radeon_device *rdev, u32 limit)
                ucode_size -= 4;
        }
        WREG32_P(SMC_IND_ACCESS_CNTL, 0, ~AUTO_INCREMENT_IND_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
        return 0;
 }
@@ -238,25 +247,29 @@ int ci_load_smc_ucode(struct radeon_device *rdev, u32 limit)
 int ci_read_smc_sram_dword(struct radeon_device *rdev,
                           u32 smc_address, u32 *value, u32 limit)
 {
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        ret = ci_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
+        if (ret == 0)
-                return ret;
+                *value = RREG32(SMC_IND_DATA_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
-        *value = RREG32(SMC_IND_DATA_0);
+        return ret;
-        return 0;
 }
 int ci_write_smc_sram_dword(struct radeon_device *rdev,
                            u32 smc_address, u32 value, u32 limit)
 {
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        ret = ci_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
+        if (ret == 0)
-                return ret;
+                WREG32(SMC_IND_DATA_0, value);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
-        WREG32(SMC_IND_DATA_0, value);
+        return ret;
-        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index a3bba0587276..b874ccdf52f7 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -77,6 +77,10 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev);
 static void cik_program_aspm(struct radeon_device *rdev);
 static void cik_init_pg(struct radeon_device *rdev);
 static void cik_init_cg(struct radeon_device *rdev);
+static void cik_fini_pg(struct radeon_device *rdev);
+static void cik_fini_cg(struct radeon_device *rdev);
+static void cik_enable_gui_idle_interrupt(struct radeon_device *rdev,
+                                          bool enable);
 /* get temperature in millidegrees */
 int ci_get_temp(struct radeon_device *rdev)
@@ -120,20 +124,27 @@ int kv_get_temp(struct radeon_device *rdev)
 */
 u32 cik_pciep_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->pciep_idx_lock, flags);
        WREG32(PCIE_INDEX, reg);
        (void)RREG32(PCIE_INDEX);
        r = RREG32(PCIE_DATA);
+        spin_unlock_irqrestore(&rdev->pciep_idx_lock, flags);
        return r;
 }
 void cik_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->pciep_idx_lock, flags);
        WREG32(PCIE_INDEX, reg);
        (void)RREG32(PCIE_INDEX);
        WREG32(PCIE_DATA, v);
        (void)RREG32(PCIE_DATA);
+        spin_unlock_irqrestore(&rdev->pciep_idx_lock, flags);
 }
 static const u32 spectre_rlc_save_restore_register_list[] =
@@ -2722,7 +2733,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
                } else if ((rdev->pdev->device == 0x1309) ||
                           (rdev->pdev->device == 0x130A) ||
                           (rdev->pdev->device == 0x130D) ||
-                           (rdev->pdev->device == 0x1313)) {
+                           (rdev->pdev->device == 0x1313) ||
+                           (rdev->pdev->device == 0x131D)) {
                        rdev->config.cik.max_cu_per_sh = 6;
                        rdev->config.cik.max_backends_per_se = 2;
                } else if ((rdev->pdev->device == 0x1306) ||
@@ -2835,10 +2847,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
                rdev->config.cik.tile_config |= (3 << 0);
                break;
        }
-        if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
+        rdev->config.cik.tile_config |=
-                rdev->config.cik.tile_config |= 1 << 4;
+                ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
-        else
-                rdev->config.cik.tile_config |= 0 << 4;
        rdev->config.cik.tile_config |=
                ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
        rdev->config.cik.tile_config |=
@@ -4013,6 +4023,8 @@ static int cik_cp_resume(struct radeon_device *rdev)
 {
        int r;
+        cik_enable_gui_idle_interrupt(rdev, false);
        r = cik_cp_load_microcode(rdev);
        if (r)
                return r;
@@ -4024,6 +4036,8 @@ static int cik_cp_resume(struct radeon_device *rdev)
        if (r)
                return r;
+        cik_enable_gui_idle_interrupt(rdev, true);
        return 0;
 }
@@ -4173,6 +4187,10 @@ static void cik_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
        dev_info(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                 RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS));
+        /* disable CG/PG */
+        cik_fini_pg(rdev);
+        cik_fini_cg(rdev);
        /* stop the rlc */
        cik_rlc_stop(rdev);
@@ -4442,8 +4460,8 @@ static int cik_mc_init(struct radeon_device *rdev)
        rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
        rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
        /* size in MB on si */
-        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
+        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
-        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
+        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
        si_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
@@ -4721,12 +4739,13 @@ static void cik_vm_decode_fault(struct radeon_device *rdev,
        u32 mc_id = (status & MEMORY_CLIENT_ID_MASK) >> MEMORY_CLIENT_ID_SHIFT;
        u32 vmid = (status & FAULT_VMID_MASK) >> FAULT_VMID_SHIFT;
        u32 protections = (status & PROTECTIONS_MASK) >> PROTECTIONS_SHIFT;
-        char *block = (char *)&mc_client;
+        char block[5] = { mc_client >> 24, (mc_client >> 16) & 0xff,
+                (mc_client >> 8) & 0xff, mc_client & 0xff, 0 };
-        printk("VM fault (0x%02x, vmid %d) at page %u, %s from %s (%d)\n",
+        printk("VM fault (0x%02x, vmid %d) at page %u, %s from '%s' (0x%08x) (%d)\n",
               protections, vmid, addr,
               (status & MEMORY_CLIENT_RW_MASK) ? "write" : "read",
-               block, mc_id);
+               block, mc_client, mc_id);
 }
 /**
@@ -5376,7 +5395,9 @@ static void cik_enable_hdp_ls(struct radeon_device *rdev,
 void cik_update_cg(struct radeon_device *rdev,
                   u32 block, bool enable)
 {
        if (block & RADEON_CG_BLOCK_GFX) {
+                cik_enable_gui_idle_interrupt(rdev, false);
                /* order matters! */
                if (enable) {
                        cik_enable_mgcg(rdev, true);
@@ -5385,6 +5406,7 @@ void cik_update_cg(struct radeon_device *rdev,
                        cik_enable_cgcg(rdev, false);
                        cik_enable_mgcg(rdev, false);
                }
+                cik_enable_gui_idle_interrupt(rdev, true);
        }
        if (block & RADEON_CG_BLOCK_MC) {
@@ -5541,7 +5563,7 @@ static void cik_enable_gfx_cgpg(struct radeon_device *rdev,
 {
        u32 data, orig;
-        if (enable && (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG)) {
+        if (enable && (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG)) {
                orig = data = RREG32(RLC_PG_CNTL);
                data |= GFX_PG_ENABLE;
                if (orig != data)
@@ -5805,7 +5827,7 @@ static void cik_init_pg(struct radeon_device *rdev)
        if (rdev->pg_flags) {
                cik_enable_sck_slowdown_on_pu(rdev, true);
                cik_enable_sck_slowdown_on_pd(rdev, true);
-                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG) {
+                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG) {
                        cik_init_gfx_cgpg(rdev);
                        cik_enable_cp_pg(rdev, true);
                        cik_enable_gds_pg(rdev, true);
@@ -5819,7 +5841,7 @@ static void cik_fini_pg(struct radeon_device *rdev)
 {
        if (rdev->pg_flags) {
                cik_update_gfx_pg(rdev, false);
-                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG) {
+                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG) {
                        cik_enable_cp_pg(rdev, false);
                        cik_enable_gds_pg(rdev, false);
                }
@@ -5895,7 +5917,9 @@ static void cik_disable_interrupt_state(struct radeon_device *rdev)
        u32 tmp;
        /* gfx ring */
-        WREG32(CP_INT_CNTL_RING0, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        tmp = RREG32(CP_INT_CNTL_RING0) &
+                (CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        WREG32(CP_INT_CNTL_RING0, tmp);
        /* sdma */
        tmp = RREG32(SDMA0_CNTL + SDMA0_REGISTER_OFFSET) & ~TRAP_ENABLE;
        WREG32(SDMA0_CNTL + SDMA0_REGISTER_OFFSET, tmp);
@@ -6036,8 +6060,7 @@ static int cik_irq_init(struct radeon_device *rdev)
 */
 int cik_irq_set(struct radeon_device *rdev)
 {
-        u32 cp_int_cntl = CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE |
+        u32 cp_int_cntl;
-                PRIV_INSTR_INT_ENABLE | PRIV_REG_INT_ENABLE;
        u32 cp_m1p0, cp_m1p1, cp_m1p2, cp_m1p3;
        u32 cp_m2p0, cp_m2p1, cp_m2p2, cp_m2p3;
        u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
@@ -6058,6 +6081,10 @@ int cik_irq_set(struct radeon_device *rdev)
                return 0;
        }
+        cp_int_cntl = RREG32(CP_INT_CNTL_RING0) &
+                (CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        cp_int_cntl |= PRIV_INSTR_INT_ENABLE | PRIV_REG_INT_ENABLE;
        hpd1 = RREG32(DC_HPD1_INT_CONTROL) & ~DC_HPDx_INT_EN;
        hpd2 = RREG32(DC_HPD2_INT_CONTROL) & ~DC_HPDx_INT_EN;
        hpd3 = RREG32(DC_HPD3_INT_CONTROL) & ~DC_HPDx_INT_EN;
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index 95a66db08d9b..91bb470de0a3 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -2014,12 +2014,6 @@ int cypress_dpm_set_power_state(struct radeon_device *rdev)
        if (eg_pi->pcie_performance_request)
                cypress_notify_link_speed_change_after_state_change(rdev, new_ps, old_ps);
-        ret = rv770_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("rv770_dpm_force_performance_level failed\n");
-                return ret;
-        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 8953255e894b..85a69d2ea3d2 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -28,22 +28,30 @@
 static u32 dce6_endpoint_rreg(struct radeon_device *rdev,
                              u32 block_offset, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->end_idx_lock, flags);
        WREG32(AZ_F0_CODEC_ENDPOINT_INDEX + block_offset, reg);
        r = RREG32(AZ_F0_CODEC_ENDPOINT_DATA + block_offset);
+        spin_unlock_irqrestore(&rdev->end_idx_lock, flags);
        return r;
 }
 static void dce6_endpoint_wreg(struct radeon_device *rdev,
                               u32 block_offset, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->end_idx_lock, flags);
        if (ASIC_IS_DCE8(rdev))
                WREG32(AZ_F0_CODEC_ENDPOINT_INDEX + block_offset, reg);
        else
                WREG32(AZ_F0_CODEC_ENDPOINT_INDEX + block_offset,
                       AZ_ENDPOINT_REG_WRITE_EN | AZ_ENDPOINT_REG_INDEX(reg));
        WREG32(AZ_F0_CODEC_ENDPOINT_DATA + block_offset, v);
+        spin_unlock_irqrestore(&rdev->end_idx_lock, flags);
 }
 #define RREG32_ENDPOINT(block, reg) dce6_endpoint_rreg(rdev, (block), (reg))
@@ -86,12 +94,12 @@ void dce6_afmt_select_pin(struct drm_encoder *encoder)
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
        struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
        u32 offset = dig->afmt->offset;
-        u32 id = dig->afmt->pin->id;
        if (!dig->afmt->pin)
                return;
-        WREG32(AFMT_AUDIO_SRC_CONTROL + offset, AFMT_AUDIO_SRC_SELECT(id));
+        WREG32(AFMT_AUDIO_SRC_CONTROL + offset,
+               AFMT_AUDIO_SRC_SELECT(dig->afmt->pin->id));
 }
 void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 555164e270a7..b5c67a99dda9 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3131,7 +3131,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                rdev->config.evergreen.sx_max_export_size = 256;
                rdev->config.evergreen.sx_max_export_pos_size = 64;
                rdev->config.evergreen.sx_max_export_smx_size = 192;
-                rdev->config.evergreen.max_hw_contexts = 8;
+                rdev->config.evergreen.max_hw_contexts = 4;
                rdev->config.evergreen.sq_num_cf_insts = 2;
                rdev->config.evergreen.sc_prim_fifo_size = 0x40;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index f71ce390aebe..f815c20640bd 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -288,8 +288,7 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
        /* fglrx clears sth in AFMT_AUDIO_PACKET_CONTROL2 here */
        WREG32(HDMI_ACR_PACKET_CONTROL + offset,
-               HDMI_ACR_AUTO_SEND | /* allow hw to sent ACR packets when required */
+               HDMI_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
-               HDMI_ACR_SOURCE); /* select SW CTS value */
        evergreen_hdmi_update_ACR(encoder, mode->clock);
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 8768fd6a1e27..4f6d2962767d 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -1501,7 +1501,7 @@
 * 6. COMMAND [29:22] | BYTE_COUNT [20:0]
 */
 #              define PACKET3_CP_DMA_DST_SEL(x)    ((x) << 20)
-                /* 0 - SRC_ADDR
+                /* 0 - DST_ADDR
                 * 1 - GDS
                 */
 #              define PACKET3_CP_DMA_ENGINE(x)     ((x) << 27)
@@ -1516,7 +1516,7 @@
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
 #              define PACKET3_CP_DMA_DIS_WC        (1 << 21)
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                /* 0 - none
                 * 1 - 8 in 16
                 * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index ecd60809db4e..71399065db04 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -40,6 +40,7 @@ static int kv_calculate_dpm_settings(struct radeon_device *rdev);
 static void kv_enable_new_levels(struct radeon_device *rdev);
 static void kv_program_nbps_index_settings(struct radeon_device *rdev,
                                           struct radeon_ps *new_rps);
+static int kv_set_enabled_level(struct radeon_device *rdev, u32 level);
 static int kv_set_enabled_levels(struct radeon_device *rdev);
 static int kv_force_dpm_highest(struct radeon_device *rdev);
 static int kv_force_dpm_lowest(struct radeon_device *rdev);
@@ -519,7 +520,7 @@ static int kv_set_dpm_boot_state(struct radeon_device *rdev)
 static void kv_program_vc(struct radeon_device *rdev)
 {
-        WREG32_SMC(CG_FTV_0, 0x3FFFC000);
+        WREG32_SMC(CG_FTV_0, 0x3FFFC100);
 }
 static void kv_clear_vc(struct radeon_device *rdev)
@@ -638,7 +639,10 @@ static int kv_force_lowest_valid(struct radeon_device *rdev)
 static int kv_unforce_levels(struct radeon_device *rdev)
 {
-        return kv_notify_message_to_smu(rdev, PPSMC_MSG_NoForcedLevel);
+        if (rdev->family == CHIP_KABINI)
+                return kv_notify_message_to_smu(rdev, PPSMC_MSG_NoForcedLevel);
+        else
+                return kv_set_enabled_levels(rdev);
 }
 static int kv_update_sclk_t(struct radeon_device *rdev)
@@ -667,9 +671,8 @@ static int kv_program_bootup_state(struct radeon_device *rdev)
                &rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
        if (table && table->count) {
-                for (i = pi->graphics_dpm_level_count - 1; i >= 0; i--) {
+                for (i = pi->graphics_dpm_level_count - 1; i > 0; i--) {
-                        if ((table->entries[i].clk == pi->boot_pl.sclk) ||
+                        if (table->entries[i].clk == pi->boot_pl.sclk)
-                            (i == 0))
                                break;
                }
@@ -682,9 +685,8 @@ static int kv_program_bootup_state(struct radeon_device *rdev)
                if (table->num_max_dpm_entries == 0)
                        return -EINVAL;
-                for (i = pi->graphics_dpm_level_count - 1; i >= 0; i--) {
+                for (i = pi->graphics_dpm_level_count - 1; i > 0; i--) {
-                        if ((table->entries[i].sclk_frequency == pi->boot_pl.sclk) ||
+                        if (table->entries[i].sclk_frequency == pi->boot_pl.sclk)
-                            (i == 0))
                                break;
                }
@@ -1078,6 +1080,13 @@ static int kv_enable_ulv(struct radeon_device *rdev, bool enable)
                                        PPSMC_MSG_EnableULV : PPSMC_MSG_DisableULV);
 }
+static void kv_reset_acp_boot_level(struct radeon_device *rdev)
+{
+        struct kv_power_info *pi = kv_get_pi(rdev);
+        pi->acp_boot_level = 0xff;
+}
 static void kv_update_current_ps(struct radeon_device *rdev,
                                 struct radeon_ps *rps)
 {
@@ -1100,6 +1109,18 @@ static void kv_update_requested_ps(struct radeon_device *rdev,
        pi->requested_rps.ps_priv = &pi->requested_ps;
 }
+void kv_dpm_enable_bapm(struct radeon_device *rdev, bool enable)
+{
+        struct kv_power_info *pi = kv_get_pi(rdev);
+        int ret;
+        if (pi->bapm_enable) {
+                ret = kv_smc_bapm_enable(rdev, enable);
+                if (ret)
+                        DRM_ERROR("kv_smc_bapm_enable failed\n");
+        }
+}
 int kv_dpm_enable(struct radeon_device *rdev)
 {
        struct kv_power_info *pi = kv_get_pi(rdev);
@@ -1192,6 +1213,8 @@ int kv_dpm_enable(struct radeon_device *rdev)
                return ret;
        }
+        kv_reset_acp_boot_level(rdev);
        if (rdev->irq.installed &&
            r600_is_internal_thermal_sensor(rdev->pm.int_thermal_type)) {
                ret = kv_set_thermal_temperature_range(rdev, R600_TEMP_RANGE_MIN, R600_TEMP_RANGE_MAX);
@@ -1203,6 +1226,12 @@ int kv_dpm_enable(struct radeon_device *rdev)
                radeon_irq_set(rdev);
        }
+        ret = kv_smc_bapm_enable(rdev, false);
+        if (ret) {
+                DRM_ERROR("kv_smc_bapm_enable failed\n");
+                return ret;
+        }
        /* powerdown unused blocks for now */
        kv_dpm_powergate_acp(rdev, true);
        kv_dpm_powergate_samu(rdev, true);
@@ -1226,6 +1255,8 @@ void kv_dpm_disable(struct radeon_device *rdev)
                             RADEON_CG_BLOCK_BIF |
                             RADEON_CG_BLOCK_HDP), false);
+        kv_smc_bapm_enable(rdev, false);
        /* powerup blocks */
        kv_dpm_powergate_acp(rdev, false);
        kv_dpm_powergate_samu(rdev, false);
@@ -1450,6 +1481,39 @@ static int kv_update_samu_dpm(struct radeon_device *rdev, bool gate)
        return kv_enable_samu_dpm(rdev, !gate);
 }
+static u8 kv_get_acp_boot_level(struct radeon_device *rdev)
+{
+        u8 i;
+        struct radeon_clock_voltage_dependency_table *table =
+                &rdev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table;
+        for (i = 0; i < table->count; i++) {
+                if (table->entries[i].clk >= 0) /* XXX */
+                        break;
+        }
+        if (i >= table->count)
+                i = table->count - 1;
+        return i;
+}
+static void kv_update_acp_boot_level(struct radeon_device *rdev)
+{
+        struct kv_power_info *pi = kv_get_pi(rdev);
+        u8 acp_boot_level;
+        if (!pi->caps_stable_p_state) {
+                acp_boot_level = kv_get_acp_boot_level(rdev);
+                if (acp_boot_level != pi->acp_boot_level) {
+                        pi->acp_boot_level = acp_boot_level;
+                        kv_send_msg_to_smc_with_parameter(rdev,
+                                                          PPSMC_MSG_ACPDPM_SetEnabledMask,
+                                                          (1 << pi->acp_boot_level));
+                }
+        }
+}
 static int kv_update_acp_dpm(struct radeon_device *rdev, bool gate)
 {
        struct kv_power_info *pi = kv_get_pi(rdev);
@@ -1461,7 +1525,7 @@ static int kv_update_acp_dpm(struct radeon_device *rdev, bool gate)
                if (pi->caps_stable_p_state)
                        pi->acp_boot_level = table->count - 1;
                else
-                        pi->acp_boot_level = 0;
+                        pi->acp_boot_level = kv_get_acp_boot_level(rdev);
                ret = kv_copy_bytes_to_smc(rdev,
                                           pi->dpm_table_start +
@@ -1588,13 +1652,11 @@ static void kv_set_valid_clock_range(struct radeon_device *rdev,
                        }
                }
-                for (i = pi->graphics_dpm_level_count - 1; i >= 0; i--) {
+                for (i = pi->graphics_dpm_level_count - 1; i > 0; i--) {
-                        if ((table->entries[i].clk <= new_ps->levels[new_ps->num_levels -1].sclk) ||
+                        if (table->entries[i].clk <= new_ps->levels[new_ps->num_levels - 1].sclk)
-                            (i == 0)) {
-                                pi->highest_valid = i;
                                break;
-                        }
                }
+                pi->highest_valid = i;
                if (pi->lowest_valid > pi->highest_valid) {
                        if ((new_ps->levels[0].sclk - table->entries[pi->highest_valid].clk) >
@@ -1615,14 +1677,12 @@ static void kv_set_valid_clock_range(struct radeon_device *rdev,
                        }
                }
-                for (i = pi->graphics_dpm_level_count - 1; i >= 0; i--) {
+                for (i = pi->graphics_dpm_level_count - 1; i > 0; i--) {
                        if (table->entries[i].sclk_frequency <=
-                            new_ps->levels[new_ps->num_levels - 1].sclk ||
+                            new_ps->levels[new_ps->num_levels - 1].sclk)
-                            i == 0) {
-                                pi->highest_valid = i;
                                break;
-                        }
                }
+                pi->highest_valid = i;
                if (pi->lowest_valid > pi->highest_valid) {
                        if ((new_ps->levels[0].sclk -
@@ -1724,6 +1784,14 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                             RADEON_CG_BLOCK_BIF |
                             RADEON_CG_BLOCK_HDP), false);
+        if (pi->bapm_enable) {
+                ret = kv_smc_bapm_enable(rdev, rdev->pm.dpm.ac_power);
+                if (ret) {
+                        DRM_ERROR("kv_smc_bapm_enable failed\n");
+                        return ret;
+                }
+        }
        if (rdev->family == CHIP_KABINI) {
                if (pi->enable_dpm) {
                        kv_set_valid_clock_range(rdev, new_ps);
@@ -1775,6 +1843,7 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                                return ret;
                        }
 #endif
+                        kv_update_acp_boot_level(rdev);
                        kv_update_sclk_t(rdev);
                        kv_enable_nb_dpm(rdev);
                }
@@ -1785,7 +1854,6 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                             RADEON_CG_BLOCK_BIF |
                             RADEON_CG_BLOCK_HDP), true);
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
        return 0;
 }
@@ -1806,12 +1874,23 @@ void kv_dpm_setup_asic(struct radeon_device *rdev)
 void kv_dpm_reset_asic(struct radeon_device *rdev)
 {
-        kv_force_lowest_valid(rdev);
+        struct kv_power_info *pi = kv_get_pi(rdev);
-        kv_init_graphics_levels(rdev);
-        kv_program_bootup_state(rdev);
+        if (rdev->family == CHIP_KABINI) {
-        kv_upload_dpm_settings(rdev);
+                kv_force_lowest_valid(rdev);
-        kv_force_lowest_valid(rdev);
+                kv_init_graphics_levels(rdev);
-        kv_unforce_levels(rdev);
+                kv_program_bootup_state(rdev);
+                kv_upload_dpm_settings(rdev);
+                kv_force_lowest_valid(rdev);
+                kv_unforce_levels(rdev);
+        } else {
+                kv_init_graphics_levels(rdev);
+                kv_program_bootup_state(rdev);
+                kv_freeze_sclk_dpm(rdev, true);
+                kv_upload_dpm_settings(rdev);
+                kv_freeze_sclk_dpm(rdev, false);
+                kv_set_enabled_level(rdev, pi->graphics_boot_level);
+        }
 }
 //XXX use sumo_dpm_display_configuration_changed
@@ -1871,12 +1950,15 @@ static int kv_force_dpm_highest(struct radeon_device *rdev)
        if (ret)
                return ret;
-        for (i = SMU7_MAX_LEVELS_GRAPHICS - 1; i >= 0; i--) {
+        for (i = SMU7_MAX_LEVELS_GRAPHICS - 1; i > 0; i--) {
                if (enable_mask & (1 << i))
                        break;
        }
-        return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
+        if (rdev->family == CHIP_KABINI)
+                return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
+        else
+                return kv_set_enabled_level(rdev, i);
 }
 static int kv_force_dpm_lowest(struct radeon_device *rdev)
@@ -1893,7 +1975,10 @@ static int kv_force_dpm_lowest(struct radeon_device *rdev)
                        break;
        }
-        return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
+        if (rdev->family == CHIP_KABINI)
+                return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
+        else
+                return kv_set_enabled_level(rdev, i);
 }
 static u8 kv_get_sleep_divider_id_from_clock(struct radeon_device *rdev,
@@ -1911,9 +1996,9 @@ static u8 kv_get_sleep_divider_id_from_clock(struct radeon_device *rdev,
        if (!pi->caps_sclk_ds)
                return 0;
-        for (i = KV_MAX_DEEPSLEEP_DIVIDER_ID; i <= 0; i--) {
+        for (i = KV_MAX_DEEPSLEEP_DIVIDER_ID; i > 0; i--) {
                temp = sclk / sumo_get_sleep_divider_from_id(i);
-                if ((temp >= min) || (i == 0))
+                if (temp >= min)
                        break;
        }
@@ -2039,12 +2124,12 @@ static void kv_apply_state_adjust_rules(struct radeon_device *rdev,
                ps->dpmx_nb_ps_lo = 0x1;
                ps->dpmx_nb_ps_hi = 0x0;
        } else {
-                ps->dpm0_pg_nb_ps_lo = 0x1;
+                ps->dpm0_pg_nb_ps_lo = 0x3;
                ps->dpm0_pg_nb_ps_hi = 0x0;
-                ps->dpmx_nb_ps_lo = 0x2;
+                ps->dpmx_nb_ps_lo = 0x3;
-                ps->dpmx_nb_ps_hi = 0x1;
+                ps->dpmx_nb_ps_hi = 0x0;
-                if (pi->sys_info.nb_dpm_enable && pi->battery_state) {
+                if (pi->sys_info.nb_dpm_enable) {
                        force_high = (mclk >= pi->sys_info.nbp_memory_clock[3]) ||
                                pi->video_start || (rdev->pm.dpm.new_active_crtc_count >= 3) ||
                                pi->disable_nb_ps3_in_battery;
@@ -2210,6 +2295,15 @@ static void kv_enable_new_levels(struct radeon_device *rdev)
        }
 }
+static int kv_set_enabled_level(struct radeon_device *rdev, u32 level)
+{
+        u32 new_mask = (1 << level);
+        return kv_send_msg_to_smc_with_parameter(rdev,
+                                                 PPSMC_MSG_SCLKDPM_SetEnabledMask,
+                                                 new_mask);
+}
 static int kv_set_enabled_levels(struct radeon_device *rdev)
 {
        struct kv_power_info *pi = kv_get_pi(rdev);
diff --git a/drivers/gpu/drm/radeon/kv_dpm.h b/drivers/gpu/drm/radeon/kv_dpm.h
index 32bb079572d7..8cef7525d7a8 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.h
+++ b/drivers/gpu/drm/radeon/kv_dpm.h
@@ -192,6 +192,7 @@ int kv_send_msg_to_smc_with_parameter(struct radeon_device *rdev,
 int kv_read_smc_sram_dword(struct radeon_device *rdev, u32 smc_address,
                           u32 *value, u32 limit);
 int kv_smc_dpm_enable(struct radeon_device *rdev, bool enable);
+int kv_smc_bapm_enable(struct radeon_device *rdev, bool enable);
 int kv_copy_bytes_to_smc(struct radeon_device *rdev,
                         u32 smc_start_address,
                         const u8 *src, u32 byte_count, u32 limit);
diff --git a/drivers/gpu/drm/radeon/kv_smc.c b/drivers/gpu/drm/radeon/kv_smc.c
index 34a226d7e34a..0000b59a6d05 100644
--- a/drivers/gpu/drm/radeon/kv_smc.c
+++ b/drivers/gpu/drm/radeon/kv_smc.c
@@ -107,6 +107,14 @@ int kv_smc_dpm_enable(struct radeon_device *rdev, bool enable)
                return kv_notify_message_to_smu(rdev, PPSMC_MSG_DPM_Disable);
 }
+int kv_smc_bapm_enable(struct radeon_device *rdev, bool enable)
+{
+        if (enable)
+                return kv_notify_message_to_smu(rdev, PPSMC_MSG_EnableBAPM);
+        else
+                return kv_notify_message_to_smu(rdev, PPSMC_MSG_DisableBAPM);
+}
 int kv_copy_bytes_to_smc(struct radeon_device *rdev,
                         u32 smc_start_address,
                         const u8 *src, u32 byte_count, u32 limit)
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index f7b625c9e0e9..f26339028154 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -787,6 +787,7 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
        bool disable_mclk_switching;
        u32 mclk, sclk;
        u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        int i;
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -813,6 +814,29 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
                }
        }
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
        /* XXX validate the min clocks required for display */
        if (disable_mclk_switching) {
@@ -3865,12 +3889,6 @@ int ni_dpm_set_power_state(struct radeon_device *rdev)
                return ret;
        }
-        ret = ni_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("ni_dpm_force_performance_level failed\n");
-                return ret;
-        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/ppsmc.h b/drivers/gpu/drm/radeon/ppsmc.h
index 682842804bce..5670b8291285 100644
--- a/drivers/gpu/drm/radeon/ppsmc.h
+++ b/drivers/gpu/drm/radeon/ppsmc.h
@@ -163,6 +163,8 @@ typedef uint8_t PPSMC_Result;
 #define PPSMC_MSG_VCEPowerON                ((uint32_t) 0x10f)
 #define PPSMC_MSG_DCE_RemoveVoltageAdjustment   ((uint32_t) 0x11d)
 #define PPSMC_MSG_DCE_AllowVoltageAdjustment    ((uint32_t) 0x11e)
+#define PPSMC_MSG_EnableBAPM                ((uint32_t) 0x120)
+#define PPSMC_MSG_DisableBAPM               ((uint32_t) 0x121)
 #define PPSMC_MSG_UVD_DPM_Config            ((uint32_t) 0x124)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 9fc61dd68bc0..d71333033b2b 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2853,21 +2853,28 @@ static void r100_pll_errata_after_data(struct radeon_device *rdev)
 uint32_t r100_pll_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
        uint32_t data;
+        spin_lock_irqsave(&rdev->pll_idx_lock, flags);
        WREG8(RADEON_CLOCK_CNTL_INDEX, reg & 0x3f);
        r100_pll_errata_after_index(rdev);
        data = RREG32(RADEON_CLOCK_CNTL_DATA);
        r100_pll_errata_after_data(rdev);
+        spin_unlock_irqrestore(&rdev->pll_idx_lock, flags);
        return data;
 }
 void r100_pll_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->pll_idx_lock, flags);
        WREG8(RADEON_CLOCK_CNTL_INDEX, ((reg & 0x3f) | RADEON_PLL_WR_EN));
        r100_pll_errata_after_index(rdev);
        WREG32(RADEON_CLOCK_CNTL_DATA, v);
        r100_pll_errata_after_data(rdev);
+        spin_unlock_irqrestore(&rdev->pll_idx_lock, flags);
 }
 static void r100_set_safe_registers(struct radeon_device *rdev)
@@ -2926,9 +2933,11 @@ static int r100_debugfs_cp_ring_info(struct seq_file *m, void *data)
        seq_printf(m, "CP_RB_RPTR 0x%08x\n", rdp);
        seq_printf(m, "%u free dwords in ring\n", ring->ring_free_dw);
        seq_printf(m, "%u dwords in ring\n", count);
-        for (j = 0; j <= count; j++) {
+        if (ring->ready) {
-                i = (rdp + j) & ring->ptr_mask;
+                for (j = 0; j <= count; j++) {
-                seq_printf(m, "r[%04d]=0x%08x\n", i, ring->ring[i]);
+                        i = (rdp + j) & ring->ptr_mask;
+                        seq_printf(m, "r[%04d]=0x%08x\n", i, ring->ring[i]);
+                }
        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 4e796ecf9ea4..6edf2b3a52b4 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -160,18 +160,25 @@ void r420_pipes_init(struct radeon_device *rdev)
 u32 r420_mc_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(R_0001F8_MC_IND_INDEX, S_0001F8_MC_IND_ADDR(reg));
        r = RREG32(R_0001FC_MC_IND_DATA);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
        return r;
 }
 void r420_mc_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(R_0001F8_MC_IND_INDEX, S_0001F8_MC_IND_ADDR(reg) |
                S_0001F8_MC_IND_WR_EN(1));
        WREG32(R_0001FC_MC_IND_DATA, v);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 static void r420_debugfs(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index ea4d3734e6d9..2a1b1876b431 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -119,6 +119,11 @@ u32 r600_get_xclk(struct radeon_device *rdev)
        return rdev->clock.spll.reference_freq;
 }
+int r600_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
+{
+        return 0;
+}
 /* get temperature in millidegrees */
 int rv6xx_get_temp(struct radeon_device *rdev)
 {
@@ -1045,20 +1050,27 @@ int r600_mc_wait_for_idle(struct radeon_device *rdev)
 uint32_t rs780_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
        uint32_t r;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(R_0028F8_MC_INDEX, S_0028F8_MC_IND_ADDR(reg));
        r = RREG32(R_0028FC_MC_DATA);
        WREG32(R_0028F8_MC_INDEX, ~C_0028F8_MC_IND_ADDR);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
        return r;
 }
 void rs780_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(R_0028F8_MC_INDEX, S_0028F8_MC_IND_ADDR(reg) |
                S_0028F8_MC_IND_WR_EN(1));
        WREG32(R_0028FC_MC_DATA, v);
        WREG32(R_0028F8_MC_INDEX, 0x7F);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 static void r600_mc_program(struct radeon_device *rdev)
@@ -2092,20 +2104,27 @@ static void r600_gpu_init(struct radeon_device *rdev)
 */
 u32 r600_pciep_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->pciep_idx_lock, flags);
        WREG32(PCIE_PORT_INDEX, ((reg) & 0xff));
        (void)RREG32(PCIE_PORT_INDEX);
        r = RREG32(PCIE_PORT_DATA);
+        spin_unlock_irqrestore(&rdev->pciep_idx_lock, flags);
        return r;
 }
 void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->pciep_idx_lock, flags);
        WREG32(PCIE_PORT_INDEX, ((reg) & 0xff));
        (void)RREG32(PCIE_PORT_INDEX);
        WREG32(PCIE_PORT_DATA, (v));
        (void)RREG32(PCIE_PORT_DATA);
+        spin_unlock_irqrestore(&rdev->pciep_idx_lock, flags);
 }
 /*
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index fa0de46fcc0d..5513d8f06252 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -1084,7 +1084,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                                rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries[i].dclk =
                                        le16_to_cpu(uvd_clk->usDClkLow) | (uvd_clk->ucDClkHigh << 16);
                                rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries[i].v =
-                                        le16_to_cpu(limits->entries[i].usVoltage);
+                                        le16_to_cpu(entry->usVoltage);
                                entry = (ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record *)
                                        ((u8 *)entry + sizeof(ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record));
                        }
@@ -1219,30 +1219,20 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
 void r600_free_extended_power_table(struct radeon_device *rdev)
 {
-        if (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries)
+        struct radeon_dpm_dynamic_state *dyn_state = &rdev->pm.dpm.dyn_state;
-                kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries);
-        if (rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries)
+        kfree(dyn_state->vddc_dependency_on_sclk.entries);
-                kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries);
+        kfree(dyn_state->vddci_dependency_on_mclk.entries);
-        if (rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk.entries)
+        kfree(dyn_state->vddc_dependency_on_mclk.entries);
-                kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk.entries);
+        kfree(dyn_state->mvdd_dependency_on_mclk.entries);
-        if (rdev->pm.dpm.dyn_state.mvdd_dependency_on_mclk.entries)
+        kfree(dyn_state->cac_leakage_table.entries);
-                kfree(rdev->pm.dpm.dyn_state.mvdd_dependency_on_mclk.entries);
+        kfree(dyn_state->phase_shedding_limits_table.entries);
-        if (rdev->pm.dpm.dyn_state.cac_leakage_table.entries)
+        kfree(dyn_state->ppm_table);
-                kfree(rdev->pm.dpm.dyn_state.cac_leakage_table.entries);
+        kfree(dyn_state->cac_tdp_table);
-        if (rdev->pm.dpm.dyn_state.phase_shedding_limits_table.entries)
+        kfree(dyn_state->vce_clock_voltage_dependency_table.entries);
-                kfree(rdev->pm.dpm.dyn_state.phase_shedding_limits_table.entries);
+        kfree(dyn_state->uvd_clock_voltage_dependency_table.entries);
-        if (rdev->pm.dpm.dyn_state.ppm_table)
+        kfree(dyn_state->samu_clock_voltage_dependency_table.entries);
-                kfree(rdev->pm.dpm.dyn_state.ppm_table);
+        kfree(dyn_state->acp_clock_voltage_dependency_table.entries);
-        if (rdev->pm.dpm.dyn_state.cac_tdp_table)
-                kfree(rdev->pm.dpm.dyn_state.cac_tdp_table);
-        if (rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries);
-        if (rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries);
-        if (rdev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries);
-        if (rdev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries);
 }
 enum radeon_pcie_gen r600_get_pcie_gen_support(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index f443010ce90b..5b729319f27b 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -57,15 +57,15 @@ enum r600_hdmi_iec_status_bits {
 static const struct radeon_hdmi_acr r600_hdmi_predefined_acr[] = {
    /*       32kHz        44.1kHz       48kHz    */
    /* Clock      N     CTS      N     CTS      N     CTS */
-    {  25174,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
+    {  25175,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
    {  25200,  4096,  25200,  6272,  28000,  6144,  25200 }, /*  25.20       MHz */
    {  27000,  4096,  27000,  6272,  30000,  6144,  27000 }, /*  27.00       MHz */
    {  27027,  4096,  27027,  6272,  30030,  6144,  27027 }, /*  27.00*1.001 MHz */
    {  54000,  4096,  54000,  6272,  60000,  6144,  54000 }, /*  54.00       MHz */
    {  54054,  4096,  54054,  6272,  60060,  6144,  54054 }, /*  54.00*1.001 MHz */
-    {  74175, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
+    {  74176, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
    {  74250,  4096,  74250,  6272,  82500,  6144,  74250 }, /*  74.25       MHz */
-    { 148351, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
+    { 148352, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
    { 148500,  4096, 148500,  6272, 165000,  6144, 148500 }, /* 148.50       MHz */
    {      0,  4096,      0,  6272,      0,  6144,      0 }  /* Other */
 };
@@ -75,8 +75,15 @@ static const struct radeon_hdmi_acr r600_hdmi_predefined_acr[] = {
 */
 static void r600_hdmi_calc_cts(uint32_t clock, int *CTS, int N, int freq)
 {
-        if (*CTS == 0)
+        u64 n;
-                *CTS = clock * N / (128 * freq) * 1000;
+        u32 d;
+        if (*CTS == 0) {
+                n = (u64)clock * (u64)N * 1000ULL;
+                d = 128 * freq;
+                do_div(n, d);
+                *CTS = n;
+        }
        DRM_DEBUG("Using ACR timing N=%d CTS=%d for frequency %d\n",
                  N, *CTS, freq);
 }
@@ -257,10 +264,7 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
         */
-        if (ASIC_IS_DCE3(rdev)) {
+        if (ASIC_IS_DCE32(rdev)) {
-                /* according to the reg specs, this should DCE3.2 only, but in
-                 * practice it seems to cover DCE3.0 as well.
-                 */
                if (dig->dig_encoder == 0) {
                        dto_cntl = RREG32(DCCG_AUDIO_DTO0_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
                        dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
@@ -276,8 +280,21 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                        WREG32(DCCG_AUDIO_DTO1_MODULE, dto_modulo);
                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                }
+        } else if (ASIC_IS_DCE3(rdev)) {
+                /* according to the reg specs, this should DCE3.2 only, but in
+                 * practice it seems to cover DCE3.0/3.1 as well.
+                 */
+                if (dig->dig_encoder == 0) {
+                        WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
+                        WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
+                } else {
+                        WREG32(DCCG_AUDIO_DTO1_PHASE, base_rate * 100);
+                        WREG32(DCCG_AUDIO_DTO1_MODULE, clock * 100);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
+                }
        } else {
-                /* according to the reg specs, this should be DCE2.0 and DCE3.0 */
+                /* according to the reg specs, this should be DCE2.0 and DCE3.0/3.1 */
                WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
                       AUDIO_DTO_MODULE(clock / 10));
        }
@@ -434,8 +451,8 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
        }
        WREG32(HDMI0_ACR_PACKET_CONTROL + offset,
-               HDMI0_ACR_AUTO_SEND | /* allow hw to sent ACR packets when required */
+               HDMI0_ACR_SOURCE | /* select SW CTS value - XXX verify that hw CTS works on all families */
-               HDMI0_ACR_SOURCE); /* select SW CTS value */
+               HDMI0_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
        WREG32(HDMI0_VBI_PACKET_CONTROL + offset,
               HDMI0_NULL_SEND | /* send null packets when required */
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 454f90a849e4..7b3c7b5932c5 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -1040,7 +1040,7 @@
 #       define HDMI0_AVI_INFO_CONT   (1 << 1)
 #       define HDMI0_AUDIO_INFO_SEND (1 << 4)
 #       define HDMI0_AUDIO_INFO_CONT (1 << 5)
-#       define HDMI0_AUDIO_INFO_SOURCE (1 << 6) /* 0 - sound block; 1 - hmdi regs */
+#       define HDMI0_AUDIO_INFO_SOURCE (1 << 6) /* 0 - sound block; 1 - hdmi regs */
 #       define HDMI0_AUDIO_INFO_UPDATE (1 << 7)
 #       define HDMI0_MPEG_INFO_SEND  (1 << 8)
 #       define HDMI0_MPEG_INFO_CONT  (1 << 9)
@@ -1523,7 +1523,7 @@
 */
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                /* 0 - none
                 * 1 - 8 in 16
                 * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index ff8b564ce2b2..a400ac1c4147 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -181,7 +181,7 @@ extern int radeon_aspm;
 #define RADEON_CG_SUPPORT_HDP_MGCG              (1 << 16)
 /* PG flags */
-#define RADEON_PG_SUPPORT_GFX_CG                (1 << 0)
+#define RADEON_PG_SUPPORT_GFX_PG                (1 << 0)
 #define RADEON_PG_SUPPORT_GFX_SMG               (1 << 1)
 #define RADEON_PG_SUPPORT_GFX_DMG               (1 << 2)
 #define RADEON_PG_SUPPORT_UVD                   (1 << 3)
@@ -1778,6 +1778,7 @@ struct radeon_asic {
                int (*force_performance_level)(struct radeon_device *rdev, enum radeon_dpm_forced_level level);
                bool (*vblank_too_short)(struct radeon_device *rdev);
                void (*powergate_uvd)(struct radeon_device *rdev, bool gate);
+                void (*enable_bapm)(struct radeon_device *rdev, bool enable);
        } dpm;
        /* pageflipping */
        struct {
@@ -2110,6 +2111,28 @@ struct radeon_device {
        resource_size_t                 rmmio_size;
        /* protects concurrent MM_INDEX/DATA based register access */
        spinlock_t mmio_idx_lock;
+        /* protects concurrent SMC based register access */
+        spinlock_t smc_idx_lock;
+        /* protects concurrent PLL register access */
+        spinlock_t pll_idx_lock;
+        /* protects concurrent MC register access */
+        spinlock_t mc_idx_lock;
+        /* protects concurrent PCIE register access */
+        spinlock_t pcie_idx_lock;
+        /* protects concurrent PCIE_PORT register access */
+        spinlock_t pciep_idx_lock;
+        /* protects concurrent PIF register access */
+        spinlock_t pif_idx_lock;
+        /* protects concurrent CG register access */
+        spinlock_t cg_idx_lock;
+        /* protects concurrent UVD register access */
+        spinlock_t uvd_idx_lock;
+        /* protects concurrent RCU register access */
+        spinlock_t rcu_idx_lock;
+        /* protects concurrent DIDT register access */
+        spinlock_t didt_idx_lock;
+        /* protects concurrent ENDPOINT (audio) register access */
+        spinlock_t end_idx_lock;
        void __iomem                    *rmmio;
        radeon_rreg_t                   mc_rreg;
        radeon_wreg_t                   mc_wreg;
@@ -2277,123 +2300,179 @@ void cik_mm_wdoorbell(struct radeon_device *rdev, u32 offset, u32 v);
 */
 static inline uint32_t rv370_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
        uint32_t r;
+        spin_lock_irqsave(&rdev->pcie_idx_lock, flags);
        WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
        r = RREG32(RADEON_PCIE_DATA);
+        spin_unlock_irqrestore(&rdev->pcie_idx_lock, flags);
        return r;
 }
 static inline void rv370_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->pcie_idx_lock, flags);
        WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
        WREG32(RADEON_PCIE_DATA, (v));
+        spin_unlock_irqrestore(&rdev->pcie_idx_lock, flags);
 }
 static inline u32 tn_smc_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        WREG32(TN_SMC_IND_INDEX_0, (reg));
        r = RREG32(TN_SMC_IND_DATA_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
        return r;
 }
 static inline void tn_smc_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        WREG32(TN_SMC_IND_INDEX_0, (reg));
        WREG32(TN_SMC_IND_DATA_0, (v));
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 }
 static inline u32 r600_rcu_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->rcu_idx_lock, flags);
        WREG32(R600_RCU_INDEX, ((reg) & 0x1fff));
        r = RREG32(R600_RCU_DATA);
+        spin_unlock_irqrestore(&rdev->rcu_idx_lock, flags);
        return r;
 }
 static inline void r600_rcu_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->rcu_idx_lock, flags);
        WREG32(R600_RCU_INDEX, ((reg) & 0x1fff));
        WREG32(R600_RCU_DATA, (v));
+        spin_unlock_irqrestore(&rdev->rcu_idx_lock, flags);
 }
 static inline u32 eg_cg_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->cg_idx_lock, flags);
        WREG32(EVERGREEN_CG_IND_ADDR, ((reg) & 0xffff));
        r = RREG32(EVERGREEN_CG_IND_DATA);
+        spin_unlock_irqrestore(&rdev->cg_idx_lock, flags);
        return r;
 }
 static inline void eg_cg_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->cg_idx_lock, flags);
        WREG32(EVERGREEN_CG_IND_ADDR, ((reg) & 0xffff));
        WREG32(EVERGREEN_CG_IND_DATA, (v));
+        spin_unlock_irqrestore(&rdev->cg_idx_lock, flags);
 }
 static inline u32 eg_pif_phy0_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->pif_idx_lock, flags);
        WREG32(EVERGREEN_PIF_PHY0_INDEX, ((reg) & 0xffff));
        r = RREG32(EVERGREEN_PIF_PHY0_DATA);
+        spin_unlock_irqrestore(&rdev->pif_idx_lock, flags);
        return r;
 }
 static inline void eg_pif_phy0_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->pif_idx_lock, flags);
        WREG32(EVERGREEN_PIF_PHY0_INDEX, ((reg) & 0xffff));
        WREG32(EVERGREEN_PIF_PHY0_DATA, (v));
+        spin_unlock_irqrestore(&rdev->pif_idx_lock, flags);
 }
 static inline u32 eg_pif_phy1_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->pif_idx_lock, flags);
        WREG32(EVERGREEN_PIF_PHY1_INDEX, ((reg) & 0xffff));
        r = RREG32(EVERGREEN_PIF_PHY1_DATA);
+        spin_unlock_irqrestore(&rdev->pif_idx_lock, flags);
        return r;
 }
 static inline void eg_pif_phy1_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->pif_idx_lock, flags);
        WREG32(EVERGREEN_PIF_PHY1_INDEX, ((reg) & 0xffff));
        WREG32(EVERGREEN_PIF_PHY1_DATA, (v));
+        spin_unlock_irqrestore(&rdev->pif_idx_lock, flags);
 }
 static inline u32 r600_uvd_ctx_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->uvd_idx_lock, flags);
        WREG32(R600_UVD_CTX_INDEX, ((reg) & 0x1ff));
        r = RREG32(R600_UVD_CTX_DATA);
+        spin_unlock_irqrestore(&rdev->uvd_idx_lock, flags);
        return r;
 }
 static inline void r600_uvd_ctx_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->uvd_idx_lock, flags);
        WREG32(R600_UVD_CTX_INDEX, ((reg) & 0x1ff));
        WREG32(R600_UVD_CTX_DATA, (v));
+        spin_unlock_irqrestore(&rdev->uvd_idx_lock, flags);
 }
 static inline u32 cik_didt_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
        u32 r;
+        spin_lock_irqsave(&rdev->didt_idx_lock, flags);
        WREG32(CIK_DIDT_IND_INDEX, (reg));
        r = RREG32(CIK_DIDT_IND_DATA);
+        spin_unlock_irqrestore(&rdev->didt_idx_lock, flags);
        return r;
 }
 static inline void cik_didt_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->didt_idx_lock, flags);
        WREG32(CIK_DIDT_IND_INDEX, (reg));
        WREG32(CIK_DIDT_IND_DATA, (v));
+        spin_unlock_irqrestore(&rdev->didt_idx_lock, flags);
 }
 void r100_pll_errata_after_index(struct radeon_device *rdev);
@@ -2569,6 +2648,7 @@ void radeon_ring_write(struct radeon_ring *ring, uint32_t v);
 #define radeon_dpm_force_performance_level(rdev, l) rdev->asic->dpm.force_performance_level((rdev), (l))
 #define radeon_dpm_vblank_too_short(rdev) rdev->asic->dpm.vblank_too_short((rdev))
 #define radeon_dpm_powergate_uvd(rdev, g) rdev->asic->dpm.powergate_uvd((rdev), (g))
+#define radeon_dpm_enable_bapm(rdev, e) rdev->asic->dpm.enable_bapm((rdev), (e))
 /* Common functions */
 /* AGP */
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 630853b96841..8f7e04538fd6 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -1004,6 +1004,8 @@ static struct radeon_asic rv6xx_asic = {
                .wait_for_vblank = &avivo_wait_for_vblank,
                .set_backlight_level = &atombios_set_backlight_level,
                .get_backlight_level = &atombios_get_backlight_level,
+                .hdmi_enable = &r600_hdmi_enable,
+                .hdmi_setmode = &r600_hdmi_setmode,
        },
        .copy = {
                .blit = &r600_copy_cpdma,
@@ -1037,6 +1039,7 @@ static struct radeon_asic rv6xx_asic = {
                .set_pcie_lanes = &r600_set_pcie_lanes,
                .set_clock_gating = NULL,
                .get_temperature = &rv6xx_get_temp,
+                .set_uvd_clocks = &r600_set_uvd_clocks,
        },
        .dpm = {
                .init = &rv6xx_dpm_init,
@@ -1126,6 +1129,7 @@ static struct radeon_asic rs780_asic = {
                .set_pcie_lanes = NULL,
                .set_clock_gating = NULL,
                .get_temperature = &rv6xx_get_temp,
+                .set_uvd_clocks = &r600_set_uvd_clocks,
        },
        .dpm = {
                .init = &rs780_dpm_init,
@@ -1141,6 +1145,7 @@ static struct radeon_asic rs780_asic = {
                .get_mclk = &rs780_dpm_get_mclk,
                .print_power_state = &rs780_dpm_print_power_state,
                .debugfs_print_current_performance_level = &rs780_dpm_debugfs_print_current_performance_level,
+                .force_performance_level = &rs780_dpm_force_performance_level,
        },
        .pflip = {
                .pre_page_flip = &rs600_pre_page_flip,
@@ -1791,6 +1796,7 @@ static struct radeon_asic trinity_asic = {
                .print_power_state = &trinity_dpm_print_power_state,
                .debugfs_print_current_performance_level = &trinity_dpm_debugfs_print_current_performance_level,
                .force_performance_level = &trinity_dpm_force_performance_level,
+                .enable_bapm = &trinity_dpm_enable_bapm,
        },
        .pflip = {
                .pre_page_flip = &evergreen_pre_page_flip,
@@ -2166,6 +2172,7 @@ static struct radeon_asic kv_asic = {
                .debugfs_print_current_performance_level = &kv_dpm_debugfs_print_current_performance_level,
                .force_performance_level = &kv_dpm_force_performance_level,
                .powergate_uvd = &kv_dpm_powergate_uvd,
+                .enable_bapm = &kv_dpm_enable_bapm,
        },
        .pflip = {
                .pre_page_flip = &evergreen_pre_page_flip,
@@ -2390,7 +2397,7 @@ int radeon_asic_init(struct radeon_device *rdev)
                                RADEON_CG_SUPPORT_HDP_LS |
                                RADEON_CG_SUPPORT_HDP_MGCG;
                        rdev->pg_flags = 0 |
-                                /*RADEON_PG_SUPPORT_GFX_CG | */
+                                /*RADEON_PG_SUPPORT_GFX_PG | */
                                RADEON_PG_SUPPORT_SDMA;
                        break;
                case CHIP_OLAND:
@@ -2479,7 +2486,7 @@ int radeon_asic_init(struct radeon_device *rdev)
                                RADEON_CG_SUPPORT_HDP_LS |
                                RADEON_CG_SUPPORT_HDP_MGCG;
                        rdev->pg_flags = 0;
-                                /*RADEON_PG_SUPPORT_GFX_CG |
+                                /*RADEON_PG_SUPPORT_GFX_PG |
                                RADEON_PG_SUPPORT_GFX_SMG |
                                RADEON_PG_SUPPORT_GFX_DMG |
                                RADEON_PG_SUPPORT_UVD |
@@ -2507,7 +2514,7 @@ int radeon_asic_init(struct radeon_device *rdev)
                                RADEON_CG_SUPPORT_HDP_LS |
                                RADEON_CG_SUPPORT_HDP_MGCG;
                        rdev->pg_flags = 0;
-                                /*RADEON_PG_SUPPORT_GFX_CG |
+                                /*RADEON_PG_SUPPORT_GFX_PG |
                                RADEON_PG_SUPPORT_GFX_SMG |
                                RADEON_PG_SUPPORT_UVD |
                                RADEON_PG_SUPPORT_VCE |
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 818bbe6b884b..70c29d5e080d 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -389,6 +389,7 @@ int r600_mc_wait_for_idle(struct radeon_device *rdev);
 u32 r600_get_xclk(struct radeon_device *rdev);
 uint64_t r600_get_gpu_clock_counter(struct radeon_device *rdev);
 int rv6xx_get_temp(struct radeon_device *rdev);
+int r600_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk);
 int r600_dpm_pre_set_power_state(struct radeon_device *rdev);
 void r600_dpm_post_set_power_state(struct radeon_device *rdev);
 /* r600 dma */
@@ -428,6 +429,8 @@ void rs780_dpm_print_power_state(struct radeon_device *rdev,
                                 struct radeon_ps *ps);
 void rs780_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
                                                       struct seq_file *m);
+int rs780_dpm_force_performance_level(struct radeon_device *rdev,
+                                      enum radeon_dpm_forced_level level);
 /*
 * rv770,rv730,rv710,rv740
@@ -625,6 +628,7 @@ void trinity_dpm_debugfs_print_current_performance_level(struct radeon_device *r
                                                         struct seq_file *m);
 int trinity_dpm_force_performance_level(struct radeon_device *rdev,
                                        enum radeon_dpm_forced_level level);
+void trinity_dpm_enable_bapm(struct radeon_device *rdev, bool enable);
 /* DCE6 - SI */
 void dce6_bandwidth_update(struct radeon_device *rdev);
@@ -781,6 +785,7 @@ void kv_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
 int kv_dpm_force_performance_level(struct radeon_device *rdev,
                                   enum radeon_dpm_forced_level level);
 void kv_dpm_powergate_uvd(struct radeon_device *rdev, bool gate);
+void kv_dpm_enable_bapm(struct radeon_device *rdev, bool enable);
 /* uvd v1.0 */
 uint32_t uvd_v1_0_get_rptr(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 404e25d285ba..f79ee184ffd5 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1367,6 +1367,7 @@ bool radeon_atombios_get_ppll_ss_info(struct radeon_device *rdev,
        int index = GetIndexIntoMasterTable(DATA, PPLL_SS_Info);
        uint16_t data_offset, size;
        struct _ATOM_SPREAD_SPECTRUM_INFO *ss_info;
+        struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT *ss_assign;
        uint8_t frev, crev;
        int i, num_indices;
@@ -1378,18 +1379,21 @@ bool radeon_atombios_get_ppll_ss_info(struct radeon_device *rdev,
                num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                        sizeof(ATOM_SPREAD_SPECTRUM_ASSIGNMENT);
+                ss_assign = (struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT*)
+                        ((u8 *)&ss_info->asSS_Info[0]);
                for (i = 0; i < num_indices; i++) {
-                        if (ss_info->asSS_Info[i].ucSS_Id == id) {
+                        if (ss_assign->ucSS_Id == id) {
                                ss->percentage =
-                                        le16_to_cpu(ss_info->asSS_Info[i].usSpreadSpectrumPercentage);
+                                        le16_to_cpu(ss_assign->usSpreadSpectrumPercentage);
-                                ss->type = ss_info->asSS_Info[i].ucSpreadSpectrumType;
+                                ss->type = ss_assign->ucSpreadSpectrumType;
-                                ss->step = ss_info->asSS_Info[i].ucSS_Step;
+                                ss->step = ss_assign->ucSS_Step;
-                                ss->delay = ss_info->asSS_Info[i].ucSS_Delay;
+                                ss->delay = ss_assign->ucSS_Delay;
-                                ss->range = ss_info->asSS_Info[i].ucSS_Range;
+                                ss->range = ss_assign->ucSS_Range;
-                                ss->refdiv = ss_info->asSS_Info[i].ucRecommendedRef_Div;
+                                ss->refdiv = ss_assign->ucRecommendedRef_Div;
                                return true;
                        }
+                        ss_assign = (struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT*)
+                                ((u8 *)ss_assign + sizeof(struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT));
                }
        }
        return false;
@@ -1477,6 +1481,12 @@ union asic_ss_info {
        struct _ATOM_ASIC_INTERNAL_SS_INFO_V3 info_3;
 };
+union asic_ss_assignment {
+        struct _ATOM_ASIC_SS_ASSIGNMENT v1;
+        struct _ATOM_ASIC_SS_ASSIGNMENT_V2 v2;
+        struct _ATOM_ASIC_SS_ASSIGNMENT_V3 v3;
+};
 bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                                      struct radeon_atom_ss *ss,
                                      int id, u32 clock)
@@ -1485,6 +1495,7 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
        uint16_t data_offset, size;
        union asic_ss_info *ss_info;
+        union asic_ss_assignment *ss_assign;
        uint8_t frev, crev;
        int i, num_indices;
@@ -1509,45 +1520,52 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                        num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                sizeof(ATOM_ASIC_SS_ASSIGNMENT);
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info.asSpreadSpectrum[0]);
                        for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info.asSpreadSpectrum[i].ucClockIndication == id) &&
+                                if ((ss_assign->v1.ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                    (clock <= le32_to_cpu(ss_assign->v1.ulTargetClockRange))) {
                                        ss->percentage =
-                                                le16_to_cpu(ss_info->info.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
+                                                le16_to_cpu(ss_assign->v1.usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info.asSpreadSpectrum[i].ucSpreadSpectrumMode;
+                                        ss->type = ss_assign->v1.ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info.asSpreadSpectrum[i].usSpreadRateInKhz);
+                                        ss->rate = le16_to_cpu(ss_assign->v1.usSpreadRateInKhz);
                                        return true;
                                }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT));
                        }
                        break;
                case 2:
                        num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                sizeof(ATOM_ASIC_SS_ASSIGNMENT_V2);
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info_2.asSpreadSpectrum[0]);
                        for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info_2.asSpreadSpectrum[i].ucClockIndication == id) &&
+                                if ((ss_assign->v2.ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info_2.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                    (clock <= le32_to_cpu(ss_assign->v2.ulTargetClockRange))) {
                                        ss->percentage =
-                                                le16_to_cpu(ss_info->info_2.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
+                                                le16_to_cpu(ss_assign->v2.usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info_2.asSpreadSpectrum[i].ucSpreadSpectrumMode;
+                                        ss->type = ss_assign->v2.ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info_2.asSpreadSpectrum[i].usSpreadRateIn10Hz);
+                                        ss->rate = le16_to_cpu(ss_assign->v2.usSpreadRateIn10Hz);
                                        if ((crev == 2) &&
                                            ((id == ASIC_INTERNAL_ENGINE_SS) ||
                                             (id == ASIC_INTERNAL_MEMORY_SS)))
                                                ss->rate /= 100;
                                        return true;
                                }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT_V2));
                        }
                        break;
                case 3:
                        num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3);
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info_3.asSpreadSpectrum[0]);
                        for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info_3.asSpreadSpectrum[i].ucClockIndication == id) &&
+                                if ((ss_assign->v3.ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info_3.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                    (clock <= le32_to_cpu(ss_assign->v3.ulTargetClockRange))) {
                                        ss->percentage =
-                                                le16_to_cpu(ss_info->info_3.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
+                                                le16_to_cpu(ss_assign->v3.usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info_3.asSpreadSpectrum[i].ucSpreadSpectrumMode;
+                                        ss->type = ss_assign->v3.ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info_3.asSpreadSpectrum[i].usSpreadRateIn10Hz);
+                                        ss->rate = le16_to_cpu(ss_assign->v3.usSpreadRateIn10Hz);
                                        if ((id == ASIC_INTERNAL_ENGINE_SS) ||
                                            (id == ASIC_INTERNAL_MEMORY_SS))
                                                ss->rate /= 100;
@@ -1555,6 +1573,8 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                                                radeon_atombios_get_igp_ss_overrides(rdev, ss, id);
                                        return true;
                                }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3));
                        }
                        break;
                default:
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 2399f25ec037..79159b5da05b 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -396,6 +396,21 @@ static int radeon_connector_set_property(struct drm_connector *connector, struct
                }
        }
+        if (property == rdev->mode_info.audio_property) {
+                struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+                /* need to find digital encoder on connector */
+                encoder = radeon_find_encoder(connector, DRM_MODE_ENCODER_TMDS);
+                if (!encoder)
+                        return 0;
+                radeon_encoder = to_radeon_encoder(encoder);
+                if (radeon_connector->audio != val) {
+                        radeon_connector->audio = val;
+                        radeon_property_change_mode(&radeon_encoder->base);
+                }
+        }
        if (property == rdev->mode_info.underscan_property) {
                /* need to find digital encoder on connector */
                encoder = radeon_find_encoder(connector, DRM_MODE_ENCODER_TMDS);
@@ -1420,7 +1435,7 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                                if (radeon_dp_getdpcd(radeon_connector))
                                        ret = connector_status_connected;
                        } else {
-                                /* try non-aux ddc (DP to DVI/HMDI/etc. adapter) */
+                                /* try non-aux ddc (DP to DVI/HDMI/etc. adapter) */
                                if (radeon_ddc_probe(radeon_connector, false))
                                        ret = connector_status_connected;
                        }
@@ -1489,6 +1504,24 @@ static const struct drm_connector_funcs radeon_dp_connector_funcs = {
        .force = radeon_dvi_force,
 };
+static const struct drm_connector_funcs radeon_edp_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
+        .detect = radeon_dp_detect,
+        .fill_modes = drm_helper_probe_single_connector_modes,
+        .set_property = radeon_lvds_set_property,
+        .destroy = radeon_dp_connector_destroy,
+        .force = radeon_dvi_force,
+};
+static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
+        .detect = radeon_dp_detect,
+        .fill_modes = drm_helper_probe_single_connector_modes,
+        .set_property = radeon_lvds_set_property,
+        .destroy = radeon_dp_connector_destroy,
+        .force = radeon_dvi_force,
+};
 void
 radeon_add_atom_connector(struct drm_device *dev,
                          uint32_t connector_id,
@@ -1580,8 +1613,6 @@ radeon_add_atom_connector(struct drm_device *dev,
                        goto failed;
                radeon_dig_connector->igp_lane_info = igp_lane_info;
                radeon_connector->con_priv = radeon_dig_connector;
-                drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
-                drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
                if (i2c_bus->valid) {
                        /* add DP i2c bus */
                        if (connector_type == DRM_MODE_CONNECTOR_eDP)
@@ -1598,6 +1629,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                case DRM_MODE_CONNECTOR_VGA:
                case DRM_MODE_CONNECTOR_DVIA:
                default:
+                        drm_connector_init(dev, &radeon_connector->base,
+                                           &radeon_dp_connector_funcs, connector_type);
+                        drm_connector_helper_add(&radeon_connector->base,
+                                                 &radeon_dp_connector_helper_funcs);
                        connector->interlace_allowed = true;
                        connector->doublescan_allowed = true;
                        radeon_connector->dac_load_detect = true;
@@ -1610,6 +1645,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                case DRM_MODE_CONNECTOR_HDMIA:
                case DRM_MODE_CONNECTOR_HDMIB:
                case DRM_MODE_CONNECTOR_DisplayPort:
+                        drm_connector_init(dev, &radeon_connector->base,
+                                           &radeon_dp_connector_funcs, connector_type);
+                        drm_connector_helper_add(&radeon_connector->base,
+                                                 &radeon_dp_connector_helper_funcs);
                        drm_object_attach_property(&radeon_connector->base.base,
                                                      rdev->mode_info.underscan_property,
                                                      UNDERSCAN_OFF);
@@ -1619,6 +1658,9 @@ radeon_add_atom_connector(struct drm_device *dev,
                        drm_object_attach_property(&radeon_connector->base.base,
                                                      rdev->mode_info.underscan_vborder_property,
                                                      0);
+                        drm_object_attach_property(&radeon_connector->base.base,
+                                                   rdev->mode_info.audio_property,
+                                                   RADEON_AUDIO_DISABLE);
                        subpixel_order = SubPixelHorizontalRGB;
                        connector->interlace_allowed = true;
                        if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
@@ -1634,6 +1676,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                        break;
                case DRM_MODE_CONNECTOR_LVDS:
                case DRM_MODE_CONNECTOR_eDP:
+                        drm_connector_init(dev, &radeon_connector->base,
+                                           &radeon_lvds_bridge_connector_funcs, connector_type);
+                        drm_connector_helper_add(&radeon_connector->base,
+                                                 &radeon_dp_connector_helper_funcs);
                        drm_object_attach_property(&radeon_connector->base.base,
                                                      dev->mode_config.scaling_mode_property,
                                                      DRM_MODE_SCALE_FULLSCREEN);
@@ -1708,6 +1754,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
+                        if (ASIC_IS_DCE2(rdev)) {
+                                drm_object_attach_property(&radeon_connector->base.base,
+                                                              rdev->mode_info.audio_property,
+                                                              RADEON_AUDIO_DISABLE);
+                        }
                        if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                                radeon_connector->dac_load_detect = true;
                                drm_object_attach_property(&radeon_connector->base.base,
@@ -1748,6 +1799,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
+                        if (ASIC_IS_DCE2(rdev)) {
+                                drm_object_attach_property(&radeon_connector->base.base,
+                                                              rdev->mode_info.audio_property,
+                                                              RADEON_AUDIO_DISABLE);
+                        }
                        subpixel_order = SubPixelHorizontalRGB;
                        connector->interlace_allowed = true;
                        if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
@@ -1787,6 +1843,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
+                        if (ASIC_IS_DCE2(rdev)) {
+                                drm_object_attach_property(&radeon_connector->base.base,
+                                                              rdev->mode_info.audio_property,
+                                                              RADEON_AUDIO_DISABLE);
+                        }
                        connector->interlace_allowed = true;
                        /* in theory with a DP to VGA converter... */
                        connector->doublescan_allowed = false;
@@ -1797,7 +1858,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                                goto failed;
                        radeon_dig_connector->igp_lane_info = igp_lane_info;
                        radeon_connector->con_priv = radeon_dig_connector;
-                        drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
+                        drm_connector_init(dev, &radeon_connector->base, &radeon_edp_connector_funcs, connector_type);
                        drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
                        if (i2c_bus->valid) {
                                /* add DP i2c bus */
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index a56084410372..66c222836631 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -28,6 +28,7 @@
 #include <drm/radeon_drm.h>
 #include "radeon_reg.h"
 #include "radeon.h"
+#include "radeon_trace.h"
 static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
 {
@@ -80,10 +81,13 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                p->relocs[i].lobj.bo = p->relocs[i].robj;
                p->relocs[i].lobj.written = !!r->write_domain;
-                /* the first reloc of an UVD job is the
+                /* the first reloc of an UVD job is the msg and that must be in
-                   msg and that must be in VRAM */
+                   VRAM, also but everything into VRAM on AGP cards to avoid
-                if (p->ring == R600_RING_TYPE_UVD_INDEX && i == 0) {
+                   image corruptions */
-                        /* TODO: is this still needed for NI+ ? */
+                if (p->ring == R600_RING_TYPE_UVD_INDEX &&
+                    p->rdev->family < CHIP_PALM &&
+                    (i == 0 || drm_pci_device_is_agp(p->rdev->ddev))) {
                        p->relocs[i].lobj.domain =
                                RADEON_GEM_DOMAIN_VRAM;
@@ -559,6 +563,8 @@ int radeon_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                return r;
        }
+        trace_radeon_cs(&parser);
        r = radeon_cs_ib_chunk(rdev, &parser);
        if (r) {
                goto out;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 16cb8792b1e6..841d0e09be3e 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1249,6 +1249,17 @@ int radeon_device_init(struct radeon_device *rdev,
        /* Registers mapping */
        /* TODO: block userspace mapping of io register */
        spin_lock_init(&rdev->mmio_idx_lock);
+        spin_lock_init(&rdev->smc_idx_lock);
+        spin_lock_init(&rdev->pll_idx_lock);
+        spin_lock_init(&rdev->mc_idx_lock);
+        spin_lock_init(&rdev->pcie_idx_lock);
+        spin_lock_init(&rdev->pciep_idx_lock);
+        spin_lock_init(&rdev->pif_idx_lock);
+        spin_lock_init(&rdev->cg_idx_lock);
+        spin_lock_init(&rdev->uvd_idx_lock);
+        spin_lock_init(&rdev->rcu_idx_lock);
+        spin_lock_init(&rdev->didt_idx_lock);
+        spin_lock_init(&rdev->end_idx_lock);
        if (rdev->family >= CHIP_BONAIRE) {
                rdev->rmmio_base = pci_resource_start(rdev->pdev, 5);
                rdev->rmmio_size = pci_resource_len(rdev->pdev, 5);
@@ -1309,13 +1320,22 @@ int radeon_device_init(struct radeon_device *rdev,
                        return r;
        }
        if ((radeon_testing & 1)) {
-                radeon_test_moves(rdev);
+                if (rdev->accel_working)
+                        radeon_test_moves(rdev);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping move tests\n");
        }
        if ((radeon_testing & 2)) {
-                radeon_test_syncing(rdev);
+                if (rdev->accel_working)
+                        radeon_test_syncing(rdev);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping sync tests\n");
        }
        if (radeon_benchmarking) {
-                radeon_benchmark(rdev, radeon_benchmarking);
+                if (rdev->accel_working)
+                        radeon_benchmark(rdev, radeon_benchmarking);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping benchmarks\n");
        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index b055bddaa94c..0d1aa050d41d 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1172,6 +1172,12 @@ static struct drm_prop_enum_list radeon_underscan_enum_list[] =
        { UNDERSCAN_AUTO, "auto" },
 };
+static struct drm_prop_enum_list radeon_audio_enum_list[] =
+{       { RADEON_AUDIO_DISABLE, "off" },
+        { RADEON_AUDIO_ENABLE, "on" },
+        { RADEON_AUDIO_AUTO, "auto" },
+};
 static int radeon_modeset_create_props(struct radeon_device *rdev)
 {
        int sz;
@@ -1222,6 +1228,12 @@ static int radeon_modeset_create_props(struct radeon_device *rdev)
        if (!rdev->mode_info.underscan_vborder_property)
                return -ENOMEM;
+        sz = ARRAY_SIZE(radeon_audio_enum_list);
+        rdev->mode_info.audio_property =
+                drm_property_create_enum(rdev->ddev, 0,
+                                         "audio",
+                                         radeon_audio_enum_list, sz);
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index cb4445f55a96..cdd12dcd988b 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -153,7 +153,7 @@ int radeon_benchmarking = 0;
 int radeon_testing = 0;
 int radeon_connector_table = 0;
 int radeon_tv = 1;
-int radeon_audio = 0;
+int radeon_audio = 1;
 int radeon_disp_priority = 0;
 int radeon_hw_i2c = 0;
 int radeon_pcie_gen2 = -1;
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index d908d8d68f6b..ef63d3f00b2f 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -247,6 +247,8 @@ struct radeon_mode_info {
        struct drm_property *underscan_property;
        struct drm_property *underscan_hborder_property;
        struct drm_property *underscan_vborder_property;
+        /* audio */
+        struct drm_property *audio_property;
        /* hardcoded DFP edid from BIOS */
        struct edid *bios_hardcoded_edid;
        int bios_hardcoded_edid_size;
@@ -471,6 +473,12 @@ struct radeon_router {
        u8 cd_mux_state;
 };
+enum radeon_connector_audio {
+        RADEON_AUDIO_DISABLE = 0,
+        RADEON_AUDIO_ENABLE = 1,
+        RADEON_AUDIO_AUTO = 2
+};
 struct radeon_connector {
        struct drm_connector base;
        uint32_t connector_id;
@@ -489,6 +497,7 @@ struct radeon_connector {
        struct radeon_hpd hpd;
        struct radeon_router router;
        struct radeon_i2c_chan *router_bus;
+        enum radeon_connector_audio audio;
 };
 struct radeon_framebuffer {
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index d7555369a3e5..4f6b7fc7ad3c 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -67,7 +67,16 @@ int radeon_pm_get_type_index(struct radeon_device *rdev,
 void radeon_pm_acpi_event_handler(struct radeon_device *rdev)
 {
-        if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
+                mutex_lock(&rdev->pm.mutex);
+                if (power_supply_is_system_supplied() > 0)
+                        rdev->pm.dpm.ac_power = true;
+                else
+                        rdev->pm.dpm.ac_power = false;
+                if (rdev->asic->dpm.enable_bapm)
+                        radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
+                mutex_unlock(&rdev->pm.mutex);
+        } else if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                if (rdev->pm.profile == PM_PROFILE_AUTO) {
                        mutex_lock(&rdev->pm.mutex);
                        radeon_pm_update_profile(rdev);
@@ -333,7 +342,7 @@ static ssize_t radeon_get_pm_profile(struct device *dev,
                                     struct device_attribute *attr,
                                     char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        int cp = rdev->pm.profile;
@@ -349,7 +358,7 @@ static ssize_t radeon_set_pm_profile(struct device *dev,
                                     const char *buf,
                                     size_t count)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        mutex_lock(&rdev->pm.mutex);
@@ -383,7 +392,7 @@ static ssize_t radeon_get_pm_method(struct device *dev,
                                    struct device_attribute *attr,
                                    char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        int pm = rdev->pm.pm_method;
@@ -397,7 +406,7 @@ static ssize_t radeon_set_pm_method(struct device *dev,
                                    const char *buf,
                                    size_t count)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        /* we don't support the legacy modes with dpm */
@@ -433,7 +442,7 @@ static ssize_t radeon_get_dpm_state(struct device *dev,
                                    struct device_attribute *attr,
                                    char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        enum radeon_pm_state_type pm = rdev->pm.dpm.user_state;
@@ -447,7 +456,7 @@ static ssize_t radeon_set_dpm_state(struct device *dev,
                                    const char *buf,
                                    size_t count)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        mutex_lock(&rdev->pm.mutex);
@@ -472,7 +481,7 @@ static ssize_t radeon_get_dpm_forced_performance_level(struct device *dev,
                                                       struct device_attribute *attr,
                                                       char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level;
@@ -486,7 +495,7 @@ static ssize_t radeon_set_dpm_forced_performance_level(struct device *dev,
                                                       const char *buf,
                                                       size_t count)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        enum radeon_dpm_forced_level level;
        int ret = 0;
@@ -524,7 +533,7 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
                                      struct device_attribute *attr,
                                      char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
        int temp;
@@ -536,6 +545,23 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
        return snprintf(buf, PAGE_SIZE, "%d\n", temp);
 }
+static ssize_t radeon_hwmon_show_temp_thresh(struct device *dev,
+                                             struct device_attribute *attr,
+                                             char *buf)
+{
+        struct drm_device *ddev = dev_get_drvdata(dev);
+        struct radeon_device *rdev = ddev->dev_private;
+        int hyst = to_sensor_dev_attr(attr)->index;
+        int temp;
+        if (hyst)
+                temp = rdev->pm.dpm.thermal.min_temp;
+        else
+                temp = rdev->pm.dpm.thermal.max_temp;
+        return snprintf(buf, PAGE_SIZE, "%d\n", temp);
+}
 static ssize_t radeon_hwmon_show_name(struct device *dev,
                                      struct device_attribute *attr,
                                      char *buf)
@@ -544,16 +570,37 @@ static ssize_t radeon_hwmon_show_name(struct device *dev,
 }
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, radeon_hwmon_show_temp, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp1_crit_hyst, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 1);
 static SENSOR_DEVICE_ATTR(name, S_IRUGO, radeon_hwmon_show_name, NULL, 0);
 static struct attribute *hwmon_attributes[] = {
        &sensor_dev_attr_temp1_input.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr,
        &sensor_dev_attr_name.dev_attr.attr,
        NULL
 };
+static umode_t hwmon_attributes_visible(struct kobject *kobj,
+                                        struct attribute *attr, int index)
+{
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct drm_device *ddev = dev_get_drvdata(dev);
+        struct radeon_device *rdev = ddev->dev_private;
+        /* Skip limit attributes if DPM is not enabled */
+        if (rdev->pm.pm_method != PM_METHOD_DPM &&
+            (attr == &sensor_dev_attr_temp1_crit.dev_attr.attr ||
+             attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr))
+                return 0;
+        return attr->mode;
+}
 static const struct attribute_group hwmon_attrgroup = {
        .attrs = hwmon_attributes,
+        .is_visible = hwmon_attributes_visible,
 };
 static int radeon_hwmon_init(struct radeon_device *rdev)
@@ -870,10 +917,13 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
        radeon_dpm_post_set_power_state(rdev);
-        /* force low perf level for thermal */
+        if (rdev->asic->dpm.force_performance_level) {
-        if (rdev->pm.dpm.thermal_active &&
+                if (rdev->pm.dpm.thermal_active)
-            rdev->asic->dpm.force_performance_level) {
+                        /* force low perf level for thermal */
-                radeon_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_LOW);
+                        radeon_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_LOW);
+                else
+                        /* otherwise, enable auto */
+                        radeon_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
        }
 done:
@@ -895,6 +945,8 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
                if (enable) {
                        mutex_lock(&rdev->pm.mutex);
                        rdev->pm.dpm.uvd_active = true;
+                        /* disable this for now */
+#if 0
                        if ((rdev->pm.dpm.sd == 1) && (rdev->pm.dpm.hd == 0))
                                dpm_state = POWER_STATE_TYPE_INTERNAL_UVD_SD;
                        else if ((rdev->pm.dpm.sd == 2) && (rdev->pm.dpm.hd == 0))
@@ -904,6 +956,7 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
                        else if ((rdev->pm.dpm.sd == 0) && (rdev->pm.dpm.hd == 2))
                                dpm_state = POWER_STATE_TYPE_INTERNAL_UVD_HD2;
                        else
+#endif
                                dpm_state = POWER_STATE_TYPE_INTERNAL_UVD;
                        rdev->pm.dpm.state = dpm_state;
                        mutex_unlock(&rdev->pm.mutex);
@@ -952,7 +1005,7 @@ static void radeon_pm_resume_old(struct radeon_device *rdev)
 {
        /* set up the default clocks if the MC ucode is loaded */
        if ((rdev->family >= CHIP_BARTS) &&
-            (rdev->family <= CHIP_HAINAN) &&
+            (rdev->family <= CHIP_CAYMAN) &&
            rdev->mc_fw) {
                if (rdev->pm.default_vddc)
                        radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -996,7 +1049,7 @@ static void radeon_pm_resume_dpm(struct radeon_device *rdev)
        if (ret) {
                DRM_ERROR("radeon: dpm resume failed\n");
                if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                    rdev->mc_fw) {
                        if (rdev->pm.default_vddc)
                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -1047,7 +1100,7 @@ static int radeon_pm_init_old(struct radeon_device *rdev)
                radeon_pm_init_profile(rdev);
                /* set up the default clocks if the MC ucode is loaded */
                if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                    rdev->mc_fw) {
                        if (rdev->pm.default_vddc)
                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -1102,9 +1155,10 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev)
 {
        int ret;
-        /* default to performance state */
+        /* default to balanced state */
        rdev->pm.dpm.state = POWER_STATE_TYPE_BALANCED;
        rdev->pm.dpm.user_state = POWER_STATE_TYPE_BALANCED;
+        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
        rdev->pm.default_sclk = rdev->clock.default_sclk;
        rdev->pm.default_mclk = rdev->clock.default_mclk;
        rdev->pm.current_sclk = rdev->clock.default_sclk;
@@ -1132,7 +1186,7 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev)
        if (ret) {
                rdev->pm.dpm_enabled = false;
                if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                    rdev->mc_fw) {
                        if (rdev->pm.default_vddc)
                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 46a25f037b84..18254e1c3e71 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -839,9 +839,11 @@ static int radeon_debugfs_ring_info(struct seq_file *m, void *data)
         * packet that is the root issue
         */
        i = (ring->rptr + ring->ptr_mask + 1 - 32) & ring->ptr_mask;
-        for (j = 0; j <= (count + 32); j++) {
+        if (ring->ready) {
-                seq_printf(m, "r[%5d]=0x%08x\n", i, ring->ring[i]);
+                for (j = 0; j <= (count + 32); j++) {
-                i = (i + 1) & ring->ptr_mask;
+                        seq_printf(m, "r[%5d]=0x%08x\n", i, ring->ring[i]);
+                        i = (i + 1) & ring->ptr_mask;
+                }
        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index f4d6bcee9006..12e8099a0823 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -36,8 +36,8 @@ static void radeon_do_test_moves(struct radeon_device *rdev, int flag)
        struct radeon_bo *vram_obj = NULL;
        struct radeon_bo **gtt_obj = NULL;
        uint64_t gtt_addr, vram_addr;
-        unsigned i, n, size;
+        unsigned n, size;
-        int r, ring;
+        int i, r, ring;
        switch (flag) {
        case RADEON_TEST_COPY_DMA:
diff --git a/drivers/gpu/drm/radeon/radeon_trace.h b/drivers/gpu/drm/radeon/radeon_trace.h
index eafd8160a155..f7e367815964 100644
--- a/drivers/gpu/drm/radeon/radeon_trace.h
+++ b/drivers/gpu/drm/radeon/radeon_trace.h
@@ -27,6 +27,26 @@ TRACE_EVENT(radeon_bo_create,
            TP_printk("bo=%p, pages=%u", __entry->bo, __entry->pages)
 );
+TRACE_EVENT(radeon_cs,
+            TP_PROTO(struct radeon_cs_parser *p),
+            TP_ARGS(p),
+            TP_STRUCT__entry(
+                             __field(u32, ring)
+                             __field(u32, dw)
+                             __field(u32, fences)
+                             ),
+            TP_fast_assign(
+                           __entry->ring = p->ring;
+                           __entry->dw = p->chunks[p->chunk_ib_idx].length_dw;
+                           __entry->fences = radeon_fence_count_emitted(
+                                p->rdev, p->ring);
+                           ),
+            TP_printk("ring=%u, dw=%u, fences=%u",
+                      __entry->ring, __entry->dw,
+                      __entry->fences)
+);
 DECLARE_EVENT_CLASS(radeon_fence_request,
            TP_PROTO(struct drm_device *dev, u32 seqno),
@@ -53,13 +73,6 @@ DEFINE_EVENT(radeon_fence_request, radeon_fence_emit,
            TP_ARGS(dev, seqno)
 );
-DEFINE_EVENT(radeon_fence_request, radeon_fence_retire,
-            TP_PROTO(struct drm_device *dev, u32 seqno),
-            TP_ARGS(dev, seqno)
-);
 DEFINE_EVENT(radeon_fence_request, radeon_fence_wait_begin,
            TP_PROTO(struct drm_device *dev, u32 seqno),
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 1a01bbff9bfa..4f2e73f79638 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -476,8 +476,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                return -EINVAL;
        }
-        /* TODO: is this still necessary on NI+ ? */
+        if (p->rdev->family < CHIP_PALM && (cmd == 0 || cmd == 0x3) &&
-        if ((cmd == 0 || cmd == 0x3) &&
            (start >> 28) != (p->rdev->uvd.gpu_addr >> 28)) {
                DRM_ERROR("msg/fb buffer %LX-%LX out of 256MB segment!\n",
                          start, end);
@@ -799,7 +798,8 @@ void radeon_uvd_note_usage(struct radeon_device *rdev)
                    (rdev->pm.dpm.hd != hd)) {
                        rdev->pm.dpm.sd = sd;
                        rdev->pm.dpm.hd = hd;
-                        streams_changed = true;
+                        /* disable this for now */
+                        /*streams_changed = true;*/
                }
        }
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index b8074a8ec75a..9566b5940a5a 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -274,19 +274,26 @@ static void rs400_mc_init(struct radeon_device *rdev)
 uint32_t rs400_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
        uint32_t r;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(RS480_NB_MC_INDEX, reg & 0xff);
        r = RREG32(RS480_NB_MC_DATA);
        WREG32(RS480_NB_MC_INDEX, 0xff);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
        return r;
 }
 void rs400_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(RS480_NB_MC_INDEX, ((reg) & 0xff) | RS480_NB_MC_IND_WR_EN);
        WREG32(RS480_NB_MC_DATA, (v));
        WREG32(RS480_NB_MC_INDEX, 0xff);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 #if defined(CONFIG_DEBUG_FS)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 670b555d2ca2..6acba8017b9a 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -847,16 +847,26 @@ void rs600_bandwidth_update(struct radeon_device *rdev)
 uint32_t rs600_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
+        u32 r;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(R_000070_MC_IND_INDEX, S_000070_MC_IND_ADDR(reg) |
                S_000070_MC_IND_CITF_ARB0(1));
-        return RREG32(R_000074_MC_IND_DATA);
+        r = RREG32(R_000074_MC_IND_DATA);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
+        return r;
 }
 void rs600_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(R_000070_MC_IND_INDEX, S_000070_MC_IND_ADDR(reg) |
                S_000070_MC_IND_CITF_ARB0(1) | S_000070_MC_IND_WR_EN(1));
        WREG32(R_000074_MC_IND_DATA, v);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 static void rs600_debugfs(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index d8ddfb34545d..1447d794c22a 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -631,20 +631,27 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
 uint32_t rs690_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
        uint32_t r;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(R_000078_MC_INDEX, S_000078_MC_IND_ADDR(reg));
        r = RREG32(R_00007C_MC_DATA);
        WREG32(R_000078_MC_INDEX, ~C_000078_MC_IND_ADDR);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
        return r;
 }
 void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(R_000078_MC_INDEX, S_000078_MC_IND_ADDR(reg) |
                S_000078_MC_IND_WR_EN(1));
        WREG32(R_00007C_MC_DATA, v);
        WREG32(R_000078_MC_INDEX, 0x7F);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 static void rs690_mc_program(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs780_dpm.c b/drivers/gpu/drm/radeon/rs780_dpm.c
index d1a1ce73bd45..6af8505cf4d2 100644
--- a/drivers/gpu/drm/radeon/rs780_dpm.c
+++ b/drivers/gpu/drm/radeon/rs780_dpm.c
@@ -62,9 +62,7 @@ static void rs780_get_pm_mode_parameters(struct radeon_device *rdev)
                        radeon_crtc = to_radeon_crtc(crtc);
                        pi->crtc_id = radeon_crtc->crtc_id;
                        if (crtc->mode.htotal && crtc->mode.vtotal)
-                                pi->refresh_rate =
+                                pi->refresh_rate = drm_mode_vrefresh(&crtc->mode);
-                                        (crtc->mode.clock * 1000) /
-                                        (crtc->mode.htotal * crtc->mode.vtotal);
                        break;
                }
        }
@@ -376,9 +374,8 @@ static void rs780_disable_vbios_powersaving(struct radeon_device *rdev)
        WREG32_P(CG_INTGFX_MISC, 0, ~0xFFF00000);
 }
-static void rs780_force_voltage_to_high(struct radeon_device *rdev)
+static void rs780_force_voltage(struct radeon_device *rdev, u16 voltage)
 {
-        struct igp_power_info *pi = rs780_get_pi(rdev);
        struct igp_ps *current_state = rs780_get_ps(rdev->pm.dpm.current_ps);
        if ((current_state->max_voltage == RS780_VDDC_LEVEL_HIGH) &&
@@ -390,7 +387,7 @@ static void rs780_force_voltage_to_high(struct radeon_device *rdev)
        udelay(1);
        WREG32_P(FVTHROT_PWM_CTRL_REG0,
-                 STARTING_PWM_HIGHTIME(pi->max_voltage),
+                 STARTING_PWM_HIGHTIME(voltage),
                 ~STARTING_PWM_HIGHTIME_MASK);
        WREG32_P(FVTHROT_PWM_CTRL_REG0,
@@ -404,6 +401,26 @@ static void rs780_force_voltage_to_high(struct radeon_device *rdev)
        WREG32_P(GFX_MACRO_BYPASS_CNTL, 0, ~SPLL_BYPASS_CNTL);
 }
+static void rs780_force_fbdiv(struct radeon_device *rdev, u32 fb_div)
+{
+        struct igp_ps *current_state = rs780_get_ps(rdev->pm.dpm.current_ps);
+        if (current_state->sclk_low == current_state->sclk_high)
+                return;
+        WREG32_P(GFX_MACRO_BYPASS_CNTL, SPLL_BYPASS_CNTL, ~SPLL_BYPASS_CNTL);
+        WREG32_P(FVTHROT_FBDIV_REG2, FORCED_FEEDBACK_DIV(fb_div),
+                 ~FORCED_FEEDBACK_DIV_MASK);
+        WREG32_P(FVTHROT_FBDIV_REG1, STARTING_FEEDBACK_DIV(fb_div),
+                 ~STARTING_FEEDBACK_DIV_MASK);
+        WREG32_P(FVTHROT_FBDIV_REG1, FORCE_FEEDBACK_DIV, ~FORCE_FEEDBACK_DIV);
+        udelay(100);
+        WREG32_P(GFX_MACRO_BYPASS_CNTL, 0, ~SPLL_BYPASS_CNTL);
+}
 static int rs780_set_engine_clock_scaling(struct radeon_device *rdev,
                                          struct radeon_ps *new_ps,
                                          struct radeon_ps *old_ps)
@@ -432,17 +449,13 @@ static int rs780_set_engine_clock_scaling(struct radeon_device *rdev,
        if (ret)
                return ret;
-        WREG32_P(GFX_MACRO_BYPASS_CNTL, SPLL_BYPASS_CNTL, ~SPLL_BYPASS_CNTL);
+        if ((min_dividers.ref_div != max_dividers.ref_div) ||
+            (min_dividers.post_div != max_dividers.post_div) ||
-        WREG32_P(FVTHROT_FBDIV_REG2, FORCED_FEEDBACK_DIV(max_dividers.fb_div),
+            (max_dividers.ref_div != current_max_dividers.ref_div) ||
-                 ~FORCED_FEEDBACK_DIV_MASK);
+            (max_dividers.post_div != current_max_dividers.post_div))
-        WREG32_P(FVTHROT_FBDIV_REG1, STARTING_FEEDBACK_DIV(max_dividers.fb_div),
+                return -EINVAL;
-                 ~STARTING_FEEDBACK_DIV_MASK);
-        WREG32_P(FVTHROT_FBDIV_REG1, FORCE_FEEDBACK_DIV, ~FORCE_FEEDBACK_DIV);
-        udelay(100);
-        WREG32_P(GFX_MACRO_BYPASS_CNTL, 0, ~SPLL_BYPASS_CNTL);
+        rs780_force_fbdiv(rdev, max_dividers.fb_div);
        if (max_dividers.fb_div > min_dividers.fb_div) {
                WREG32_P(FVTHROT_FBDIV_REG0,
@@ -486,6 +499,9 @@ static void rs780_activate_engine_clk_scaling(struct radeon_device *rdev,
            (new_state->sclk_low == old_state->sclk_low))
                return;
+        if (new_state->sclk_high == new_state->sclk_low)
+                return;
        rs780_clk_scaling_enable(rdev, true);
 }
@@ -649,7 +665,7 @@ int rs780_dpm_set_power_state(struct radeon_device *rdev)
        rs780_set_uvd_clock_before_set_eng_clock(rdev, new_ps, old_ps);
        if (pi->voltage_control) {
-                rs780_force_voltage_to_high(rdev);
+                rs780_force_voltage(rdev, pi->max_voltage);
                mdelay(5);
        }
@@ -717,14 +733,18 @@ static void rs780_parse_pplib_non_clock_info(struct radeon_device *rdev,
        if (ATOM_PPLIB_NONCLOCKINFO_VER1 < table_rev) {
                rps->vclk = le32_to_cpu(non_clock_info->ulVCLK);
                rps->dclk = le32_to_cpu(non_clock_info->ulDCLK);
-        } else if (r600_is_uvd_state(rps->class, rps->class2)) {
-                rps->vclk = RS780_DEFAULT_VCLK_FREQ;
-                rps->dclk = RS780_DEFAULT_DCLK_FREQ;
        } else {
                rps->vclk = 0;
                rps->dclk = 0;
        }
+        if (r600_is_uvd_state(rps->class, rps->class2)) {
+                if ((rps->vclk == 0) || (rps->dclk == 0)) {
+                        rps->vclk = RS780_DEFAULT_VCLK_FREQ;
+                        rps->dclk = RS780_DEFAULT_DCLK_FREQ;
+                }
+        }
        if (rps->class & ATOM_PPLIB_CLASSIFICATION_BOOT)
                rdev->pm.dpm.boot_ps = rps;
        if (rps->class & ATOM_PPLIB_CLASSIFICATION_UVDSTATE)
@@ -986,3 +1006,55 @@ void rs780_dpm_debugfs_print_current_performance_level(struct radeon_device *rde
                seq_printf(m, "power level 1    sclk: %u vddc_index: %d\n",
                           ps->sclk_high, ps->max_voltage);
 }
+int rs780_dpm_force_performance_level(struct radeon_device *rdev,
+                                      enum radeon_dpm_forced_level level)
+{
+        struct igp_power_info *pi = rs780_get_pi(rdev);
+        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
+        struct igp_ps *ps = rs780_get_ps(rps);
+        struct atom_clock_dividers dividers;
+        int ret;
+        rs780_clk_scaling_enable(rdev, false);
+        rs780_voltage_scaling_enable(rdev, false);
+        if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
+                if (pi->voltage_control)
+                        rs780_force_voltage(rdev, pi->max_voltage);
+                ret = radeon_atom_get_clock_dividers(rdev, COMPUTE_ENGINE_PLL_PARAM,
+                                                     ps->sclk_high, false, &dividers);
+                if (ret)
+                        return ret;
+                rs780_force_fbdiv(rdev, dividers.fb_div);
+        } else if (level == RADEON_DPM_FORCED_LEVEL_LOW) {
+                ret = radeon_atom_get_clock_dividers(rdev, COMPUTE_ENGINE_PLL_PARAM,
+                                                     ps->sclk_low, false, &dividers);
+                if (ret)
+                        return ret;
+                rs780_force_fbdiv(rdev, dividers.fb_div);
+                if (pi->voltage_control)
+                        rs780_force_voltage(rdev, pi->min_voltage);
+        } else {
+                if (pi->voltage_control)
+                        rs780_force_voltage(rdev, pi->max_voltage);
+                if (ps->sclk_high != ps->sclk_low) {
+                        WREG32_P(FVTHROT_FBDIV_REG1, 0, ~FORCE_FEEDBACK_DIV);
+                        rs780_clk_scaling_enable(rdev, true);
+                }
+                if (pi->voltage_control) {
+                        rs780_voltage_scaling_enable(rdev, true);
+                        rs780_enable_voltage_scaling(rdev, rps);
+                }
+        }
+        rdev->pm.dpm.forced_level = level;
+        return 0;
+}
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 8ea1573ae820..873eb4b193b4 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -209,19 +209,27 @@ static void rv515_mc_init(struct radeon_device *rdev)
 uint32_t rv515_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
        uint32_t r;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(MC_IND_INDEX, 0x7f0000 | (reg & 0xffff));
        r = RREG32(MC_IND_DATA);
        WREG32(MC_IND_INDEX, 0);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
        return r;
 }
 void rv515_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
        WREG32(MC_IND_INDEX, 0xff0000 | ((reg) & 0xffff));
        WREG32(MC_IND_DATA, (v));
        WREG32(MC_IND_INDEX, 0);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 #if defined(CONFIG_DEBUG_FS)
diff --git a/drivers/gpu/drm/radeon/rv6xx_dpm.c b/drivers/gpu/drm/radeon/rv6xx_dpm.c
index ab1f2016f21e..5811d277a36a 100644
--- a/drivers/gpu/drm/radeon/rv6xx_dpm.c
+++ b/drivers/gpu/drm/radeon/rv6xx_dpm.c
@@ -1758,8 +1758,6 @@ int rv6xx_dpm_set_power_state(struct radeon_device *rdev)
        rv6xx_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps);
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 8cbb85dae5aa..913b025ae9b3 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2064,12 +2064,6 @@ int rv770_dpm_set_power_state(struct radeon_device *rdev)
                rv770_program_dcodt_after_state_switch(rdev, new_ps, old_ps);
        rv770_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps);
-        ret = rv770_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("rv770_dpm_force_performance_level failed\n");
-                return ret;
-        }
        return 0;
 }
@@ -2147,14 +2141,18 @@ static void rv7xx_parse_pplib_non_clock_info(struct radeon_device *rdev,
        if (ATOM_PPLIB_NONCLOCKINFO_VER1 < table_rev) {
                rps->vclk = le32_to_cpu(non_clock_info->ulVCLK);
                rps->dclk = le32_to_cpu(non_clock_info->ulDCLK);
-        } else if (r600_is_uvd_state(rps->class, rps->class2)) {
-                rps->vclk = RV770_DEFAULT_VCLK_FREQ;
-                rps->dclk = RV770_DEFAULT_DCLK_FREQ;
        } else {
                rps->vclk = 0;
                rps->dclk = 0;
        }
+        if (r600_is_uvd_state(rps->class, rps->class2)) {
+                if ((rps->vclk == 0) || (rps->dclk == 0)) {
+                        rps->vclk = RV770_DEFAULT_VCLK_FREQ;
+                        rps->dclk = RV770_DEFAULT_DCLK_FREQ;
+                }
+        }
        if (rps->class & ATOM_PPLIB_CLASSIFICATION_BOOT)
                rdev->pm.dpm.boot_ps = rps;
        if (rps->class & ATOM_PPLIB_CLASSIFICATION_UVDSTATE)
diff --git a/drivers/gpu/drm/radeon/rv770_smc.c b/drivers/gpu/drm/radeon/rv770_smc.c
index ab95da570215..b2a224407365 100644
--- a/drivers/gpu/drm/radeon/rv770_smc.c
+++ b/drivers/gpu/drm/radeon/rv770_smc.c
@@ -274,8 +274,8 @@ static const u8 cayman_smc_int_vectors[] =
        0x08, 0x72, 0x08, 0x72
 };
-int rv770_set_smc_sram_address(struct radeon_device *rdev,
+static int rv770_set_smc_sram_address(struct radeon_device *rdev,
-                               u16 smc_address, u16 limit)
+                                      u16 smc_address, u16 limit)
 {
        u32 addr;
@@ -296,9 +296,10 @@ int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
                            u16 smc_start_address, const u8 *src,
                            u16 byte_count, u16 limit)
 {
+        unsigned long flags;
        u32 data, original_data, extra_shift;
        u16 addr;
-        int ret;
+        int ret = 0;
        if (smc_start_address & 3)
                return -EINVAL;
@@ -307,13 +308,14 @@ int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
        addr = smc_start_address;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        while (byte_count >= 4) {
                /* SMC address space is BE */
                data = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3];
                ret = rv770_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                WREG32(SMC_SRAM_DATA, data);
@@ -328,7 +330,7 @@ int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
                ret = rv770_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                original_data = RREG32(SMC_SRAM_DATA);
@@ -346,12 +348,15 @@ int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
                ret = rv770_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                WREG32(SMC_SRAM_DATA, data);
        }
-        return 0;
+done:
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
+        return ret;
 }
 static int rv770_program_interrupt_vectors(struct radeon_device *rdev,
@@ -461,12 +466,15 @@ PPSMC_Result rv770_wait_for_smc_inactive(struct radeon_device *rdev)
 static void rv770_clear_smc_sram(struct radeon_device *rdev, u16 limit)
 {
+        unsigned long flags;
        u16 i;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        for (i = 0;  i < limit; i += 4) {
                rv770_set_smc_sram_address(rdev, i, limit);
                WREG32(SMC_SRAM_DATA, 0);
        }
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 }
 int rv770_load_smc_ucode(struct radeon_device *rdev,
@@ -595,27 +603,29 @@ int rv770_load_smc_ucode(struct radeon_device *rdev,
 int rv770_read_smc_sram_dword(struct radeon_device *rdev,
                              u16 smc_address, u32 *value, u16 limit)
 {
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        ret = rv770_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
+        if (ret == 0)
-                return ret;
+                *value = RREG32(SMC_SRAM_DATA);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
-        *value = RREG32(SMC_SRAM_DATA);
-        return 0;
+        return ret;
 }
 int rv770_write_smc_sram_dword(struct radeon_device *rdev,
                               u16 smc_address, u32 value, u16 limit)
 {
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        ret = rv770_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
+        if (ret == 0)
-                return ret;
+                WREG32(SMC_SRAM_DATA, value);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
-        WREG32(SMC_SRAM_DATA, value);
+        return ret;
-        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/rv770_smc.h b/drivers/gpu/drm/radeon/rv770_smc.h
index f78d92a4b325..3b2c963c4880 100644
--- a/drivers/gpu/drm/radeon/rv770_smc.h
+++ b/drivers/gpu/drm/radeon/rv770_smc.h
@@ -187,8 +187,6 @@ typedef struct RV770_SMC_STATETABLE RV770_SMC_STATETABLE;
 #define RV770_SMC_SOFT_REGISTER_uvd_enabled             0x9C
 #define RV770_SMC_SOFT_REGISTER_is_asic_lombok          0xA0
-int rv770_set_smc_sram_address(struct radeon_device *rdev,
-                               u16 smc_address, u16 limit);
 int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
                            u16 smc_start_address, const u8 *src,
                            u16 byte_count, u16 limit);
diff --git a/drivers/gpu/drm/radeon/rv770d.h b/drivers/gpu/drm/radeon/rv770d.h
index 9fe60e542922..1ae277152cc7 100644
--- a/drivers/gpu/drm/radeon/rv770d.h
+++ b/drivers/gpu/drm/radeon/rv770d.h
@@ -852,7 +852,7 @@
 #define AFMT_VBI_PACKET_CONTROL              0x7608
 #       define AFMT_GENERIC0_UPDATE          (1 << 2)
 #define AFMT_INFOFRAME_CONTROL0              0x760c
-#       define AFMT_AUDIO_INFO_SOURCE        (1 << 6) /* 0 - sound block; 1 - hmdi regs */
+#       define AFMT_AUDIO_INFO_SOURCE        (1 << 6) /* 0 - sound block; 1 - hdmi regs */
 #       define AFMT_AUDIO_INFO_UPDATE        (1 << 7)
 #       define AFMT_MPEG_INFO_UPDATE         (1 << 10)
 #define AFMT_GENERIC0_7                      0x7610
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 3e23b757dcfa..d4652af425b8 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -83,6 +83,11 @@ extern void si_dma_vm_set_page(struct radeon_device *rdev,
                               uint64_t pe,
                               uint64_t addr, unsigned count,
                               uint32_t incr, uint32_t flags);
+static void si_enable_gui_idle_interrupt(struct radeon_device *rdev,
+                                         bool enable);
+static void si_fini_pg(struct radeon_device *rdev);
+static void si_fini_cg(struct radeon_device *rdev);
+static void si_rlc_stop(struct radeon_device *rdev);
 static const u32 verde_rlc_save_restore_register_list[] =
 {
@@ -3386,6 +3391,8 @@ static int si_cp_resume(struct radeon_device *rdev)
        u32 rb_bufsz;
        int r;
+        si_enable_gui_idle_interrupt(rdev, false);
        WREG32(CP_SEM_WAIT_TIMER, 0x0);
        WREG32(CP_SEM_INCOMPLETE_TIMER_CNTL, 0x0);
@@ -3501,6 +3508,8 @@ static int si_cp_resume(struct radeon_device *rdev)
                rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
        }
+        si_enable_gui_idle_interrupt(rdev, true);
        return 0;
 }
@@ -3602,6 +3611,13 @@ static void si_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
        dev_info(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                 RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS));
+        /* disable PG/CG */
+        si_fini_pg(rdev);
+        si_fini_cg(rdev);
+        /* stop the rlc */
+        si_rlc_stop(rdev);
        /* Disable CP parsing/prefetching */
        WREG32(CP_ME_CNTL, CP_ME_HALT | CP_PFP_HALT | CP_CE_HALT);
@@ -4888,7 +4904,7 @@ static void si_enable_gfx_cgpg(struct radeon_device *rdev,
 {
        u32 tmp;
-        if (enable && (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG)) {
+        if (enable && (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG)) {
                tmp = RLC_PUD(0x10) | RLC_PDD(0x10) | RLC_TTPD(0x10) | RLC_MSD(0x10);
                WREG32(RLC_TTOP_D, tmp);
@@ -5250,6 +5266,7 @@ void si_update_cg(struct radeon_device *rdev,
                  u32 block, bool enable)
 {
        if (block & RADEON_CG_BLOCK_GFX) {
+                si_enable_gui_idle_interrupt(rdev, false);
                /* order matters! */
                if (enable) {
                        si_enable_mgcg(rdev, true);
@@ -5258,6 +5275,7 @@ void si_update_cg(struct radeon_device *rdev,
                        si_enable_cgcg(rdev, false);
                        si_enable_mgcg(rdev, false);
                }
+                si_enable_gui_idle_interrupt(rdev, true);
        }
        if (block & RADEON_CG_BLOCK_MC) {
@@ -5408,7 +5426,7 @@ static void si_init_pg(struct radeon_device *rdev)
                        si_init_dma_pg(rdev);
                }
                si_init_ao_cu_mask(rdev);
-                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG) {
+                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG) {
                        si_init_gfx_cgpg(rdev);
                }
                si_enable_dma_pg(rdev, true);
@@ -5560,7 +5578,9 @@ static void si_disable_interrupt_state(struct radeon_device *rdev)
 {
        u32 tmp;
-        WREG32(CP_INT_CNTL_RING0, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        tmp = RREG32(CP_INT_CNTL_RING0) &
+                (CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        WREG32(CP_INT_CNTL_RING0, tmp);
        WREG32(CP_INT_CNTL_RING1, 0);
        WREG32(CP_INT_CNTL_RING2, 0);
        tmp = RREG32(DMA_CNTL + DMA0_REGISTER_OFFSET) & ~TRAP_ENABLE;
@@ -5685,7 +5705,7 @@ static int si_irq_init(struct radeon_device *rdev)
 int si_irq_set(struct radeon_device *rdev)
 {
-        u32 cp_int_cntl = CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE;
+        u32 cp_int_cntl;
        u32 cp_int_cntl1 = 0, cp_int_cntl2 = 0;
        u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
        u32 hpd1 = 0, hpd2 = 0, hpd3 = 0, hpd4 = 0, hpd5 = 0, hpd6 = 0;
@@ -5706,6 +5726,9 @@ int si_irq_set(struct radeon_device *rdev)
                return 0;
        }
+        cp_int_cntl = RREG32(CP_INT_CNTL_RING0) &
+                (CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
        if (!ASIC_IS_NODCE(rdev)) {
                hpd1 = RREG32(DC_HPD1_INT_CONTROL) & ~DC_HPDx_INT_EN;
                hpd2 = RREG32(DC_HPD2_INT_CONTROL) & ~DC_HPDx_INT_EN;
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 5be9b4e72350..2332aa1bf93c 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2910,6 +2910,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
        bool disable_sclk_switching = false;
        u32 mclk, sclk;
        u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        int i;
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -2943,6 +2944,29 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                }
        }
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
        /* XXX validate the min clocks required for display */
        if (disable_mclk_switching) {
@@ -5184,7 +5208,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                        table->mc_reg_table_entry[k].mc_data[j] |= 0x100;
                        }
                        j++;
-                        if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        if (!pi->mem_gddr5) {
@@ -5194,7 +5218,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                        table->mc_reg_table_entry[k].mc_data[j] =
                                                (table->mc_reg_table_entry[k].mc_data[i] & 0xffff0000) >> 16;
                                j++;
-                                if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                                if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                        return -EINVAL;
                        }
                        break;
@@ -5207,7 +5231,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                        (temp_reg & 0xffff0000) |
                                        (table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff);
                        j++;
-                        if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                return -EINVAL;
                        break;
                default:
@@ -6075,12 +6099,6 @@ int si_dpm_set_power_state(struct radeon_device *rdev)
                return ret;
        }
-        ret = si_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("si_dpm_force_performance_level failed\n");
-                return ret;
-        }
        si_update_cg(rdev, (RADEON_CG_BLOCK_GFX |
                            RADEON_CG_BLOCK_MC |
                            RADEON_CG_BLOCK_SDMA |
diff --git a/drivers/gpu/drm/radeon/si_smc.c b/drivers/gpu/drm/radeon/si_smc.c
index 5f524c0a541e..d422a1cbf727 100644
--- a/drivers/gpu/drm/radeon/si_smc.c
+++ b/drivers/gpu/drm/radeon/si_smc.c
@@ -29,8 +29,8 @@
 #include "ppsmc.h"
 #include "radeon_ucode.h"
-int si_set_smc_sram_address(struct radeon_device *rdev,
+static int si_set_smc_sram_address(struct radeon_device *rdev,
-                            u32 smc_address, u32 limit)
+                                   u32 smc_address, u32 limit)
 {
        if (smc_address & 3)
                return -EINVAL;
@@ -47,7 +47,8 @@ int si_copy_bytes_to_smc(struct radeon_device *rdev,
                         u32 smc_start_address,
                         const u8 *src, u32 byte_count, u32 limit)
 {
-        int ret;
+        unsigned long flags;
+        int ret = 0;
        u32 data, original_data, addr, extra_shift;
        if (smc_start_address & 3)
@@ -57,13 +58,14 @@ int si_copy_bytes_to_smc(struct radeon_device *rdev,
        addr = smc_start_address;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        while (byte_count >= 4) {
                /* SMC address space is BE */
                data = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3];
                ret = si_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                WREG32(SMC_IND_DATA_0, data);
@@ -78,7 +80,7 @@ int si_copy_bytes_to_smc(struct radeon_device *rdev,
                ret = si_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                original_data = RREG32(SMC_IND_DATA_0);
@@ -96,11 +98,15 @@ int si_copy_bytes_to_smc(struct radeon_device *rdev,
                ret = si_set_smc_sram_address(rdev, addr, limit);
                if (ret)
-                        return ret;
+                        goto done;
                WREG32(SMC_IND_DATA_0, data);
        }
-        return 0;
+done:
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
+        return ret;
 }
 void si_start_smc(struct radeon_device *rdev)
@@ -203,6 +209,7 @@ PPSMC_Result si_wait_for_smc_inactive(struct radeon_device *rdev)
 int si_load_smc_ucode(struct radeon_device *rdev, u32 limit)
 {
+        unsigned long flags;
        u32 ucode_start_address;
        u32 ucode_size;
        const u8 *src;
@@ -241,6 +248,7 @@ int si_load_smc_ucode(struct radeon_device *rdev, u32 limit)
                return -EINVAL;
        src = (const u8 *)rdev->smc_fw->data;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        WREG32(SMC_IND_INDEX_0, ucode_start_address);
        WREG32_P(SMC_IND_ACCESS_CNTL, AUTO_INCREMENT_IND_0, ~AUTO_INCREMENT_IND_0);
        while (ucode_size >= 4) {
@@ -253,6 +261,7 @@ int si_load_smc_ucode(struct radeon_device *rdev, u32 limit)
                ucode_size -= 4;
        }
        WREG32_P(SMC_IND_ACCESS_CNTL, 0, ~AUTO_INCREMENT_IND_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
        return 0;
 }
@@ -260,25 +269,29 @@ int si_load_smc_ucode(struct radeon_device *rdev, u32 limit)
 int si_read_smc_sram_dword(struct radeon_device *rdev, u32 smc_address,
                           u32 *value, u32 limit)
 {
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        ret = si_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
+        if (ret == 0)
-                return ret;
+                *value = RREG32(SMC_IND_DATA_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
-        *value = RREG32(SMC_IND_DATA_0);
+        return ret;
-        return 0;
 }
 int si_write_smc_sram_dword(struct radeon_device *rdev, u32 smc_address,
                            u32 value, u32 limit)
 {
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
        ret = si_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
+        if (ret == 0)
-                return ret;
+                WREG32(SMC_IND_DATA_0, value);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
-        WREG32(SMC_IND_DATA_0, value);
+        return ret;
-        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 52d2ab6b67a0..7e2e0ea66a00 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -1553,7 +1553,7 @@
 * 6. COMMAND [30:21] | BYTE_COUNT [20:0]
 */
 #              define PACKET3_CP_DMA_DST_SEL(x)    ((x) << 20)
-                /* 0 - SRC_ADDR
+                /* 0 - DST_ADDR
                 * 1 - GDS
                 */
 #              define PACKET3_CP_DMA_ENGINE(x)     ((x) << 27)
@@ -1568,7 +1568,7 @@
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
 #              define PACKET3_CP_DMA_DIS_WC        (1 << 21)
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                /* 0 - none
                 * 1 - 8 in 16
                 * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index 864761c0120e..96ea6db8bf57 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1319,8 +1319,6 @@ int sumo_dpm_set_power_state(struct radeon_device *rdev)
        if (pi->enable_dpm)
                sumo_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps);
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index b07b7b8f1aff..9364129ba292 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1068,6 +1068,17 @@ static void trinity_update_requested_ps(struct radeon_device *rdev,
        pi->requested_rps.ps_priv = &pi->requested_ps;
 }
+void trinity_dpm_enable_bapm(struct radeon_device *rdev, bool enable)
+{
+        struct trinity_power_info *pi = trinity_get_pi(rdev);
+        if (pi->enable_bapm) {
+                trinity_acquire_mutex(rdev);
+                trinity_dpm_bapm_enable(rdev, enable);
+                trinity_release_mutex(rdev);
+        }
+}
 int trinity_dpm_enable(struct radeon_device *rdev)
 {
        struct trinity_power_info *pi = trinity_get_pi(rdev);
@@ -1091,6 +1102,7 @@ int trinity_dpm_enable(struct radeon_device *rdev)
        trinity_program_sclk_dpm(rdev);
        trinity_start_dpm(rdev);
        trinity_wait_for_dpm_enabled(rdev);
+        trinity_dpm_bapm_enable(rdev, false);
        trinity_release_mutex(rdev);
        if (rdev->irq.installed &&
@@ -1116,6 +1128,7 @@ void trinity_dpm_disable(struct radeon_device *rdev)
                trinity_release_mutex(rdev);
                return;
        }
+        trinity_dpm_bapm_enable(rdev, false);
        trinity_disable_clock_power_gating(rdev);
        sumo_clear_vc(rdev);
        trinity_wait_for_level_0(rdev);
@@ -1212,6 +1225,8 @@ int trinity_dpm_set_power_state(struct radeon_device *rdev)
        trinity_acquire_mutex(rdev);
        if (pi->enable_dpm) {
+                if (pi->enable_bapm)
+                        trinity_dpm_bapm_enable(rdev, rdev->pm.dpm.ac_power);
                trinity_set_uvd_clock_before_set_eng_clock(rdev, new_ps, old_ps);
                trinity_enable_power_level_0(rdev);
                trinity_force_level_0(rdev);
@@ -1221,7 +1236,6 @@ int trinity_dpm_set_power_state(struct radeon_device *rdev)
                trinity_force_level_0(rdev);
                trinity_unforce_levels(rdev);
                trinity_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps);
-                rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
        }
        trinity_release_mutex(rdev);
@@ -1854,6 +1868,7 @@ int trinity_dpm_init(struct radeon_device *rdev)
        for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
                pi->at[i] = TRINITY_AT_DFLT;
+        pi->enable_bapm = false;
        pi->enable_nbps_policy = true;
        pi->enable_sclk_ds = true;
        pi->enable_gfx_power_gating = true;
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.h b/drivers/gpu/drm/radeon/trinity_dpm.h
index e82df071f8b3..c261657750ca 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.h
+++ b/drivers/gpu/drm/radeon/trinity_dpm.h
@@ -108,6 +108,7 @@ struct trinity_power_info {
        bool enable_auto_thermal_throttling;
        bool enable_dpm;
        bool enable_sclk_ds;
+        bool enable_bapm;
        bool uvd_dpm;
        struct radeon_ps current_rps;
        struct trinity_ps current_ps;
@@ -118,6 +119,7 @@ struct trinity_power_info {
 #define TRINITY_AT_DFLT            30
 /* trinity_smc.c */
+int trinity_dpm_bapm_enable(struct radeon_device *rdev, bool enable);
 int trinity_dpm_config(struct radeon_device *rdev, bool enable);
 int trinity_uvd_dpm_config(struct radeon_device *rdev);
 int trinity_dpm_force_state(struct radeon_device *rdev, u32 n);
diff --git a/drivers/gpu/drm/radeon/trinity_smc.c b/drivers/gpu/drm/radeon/trinity_smc.c
index a42d89f1830c..9672bcbc7312 100644
--- a/drivers/gpu/drm/radeon/trinity_smc.c
+++ b/drivers/gpu/drm/radeon/trinity_smc.c
@@ -56,6 +56,14 @@ static int trinity_notify_message_to_smu(struct radeon_device *rdev, u32 id)
        return 0;
 }
+int trinity_dpm_bapm_enable(struct radeon_device *rdev, bool enable)
+{
+        if (enable)
+                return trinity_notify_message_to_smu(rdev, PPSMC_MSG_EnableBAPM);
+        else
+                return trinity_notify_message_to_smu(rdev, PPSMC_MSG_DisableBAPM);
+}
 int trinity_dpm_config(struct radeon_device *rdev, bool enable)
 {
        if (enable)
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index 7266805d9786..3100fa9cb52f 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -212,8 +212,8 @@ int uvd_v1_0_start(struct radeon_device *rdev)
        /* enable VCPU clock */
        WREG32(UVD_VCPU_CNTL,  1 << 9);
-        /* enable UMC */
+        /* enable UMC and NC0 */
-        WREG32_P(UVD_LMI_CTRL2, 0, ~(1 << 8));
+        WREG32_P(UVD_LMI_CTRL2, 1 << 13, ~((1 << 8) | (1 << 13)));
        /* boot up the VCPU */
        WREG32(UVD_SOFT_RESET, 0);
diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c
index 58a5f3261c0b..a868176c258a 100644
--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -218,7 +218,7 @@ struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file *tfile,
                                               uint32_t key)
 {
        struct ttm_object_device *tdev = tfile->tdev;
-        struct ttm_base_object *base;
+        struct ttm_base_object *uninitialized_var(base);
        struct drm_hash_item *hash;
        int ret;
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index 5e93a52d4f2c..210d50365162 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -170,7 +170,7 @@ void ttm_tt_destroy(struct ttm_tt *ttm)
                ttm_tt_unbind(ttm);
        }
-        if (likely(ttm->pages != NULL)) {
+        if (ttm->state == tt_unbound) {
                ttm->bdev->driver->ttm_tt_unpopulate(ttm);
        }
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index 8dbe9d0ae9a7..8bf646183bac 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -97,7 +97,6 @@ int udl_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        ret = vm_insert_page(vma, (unsigned long)vmf->virtual_address, page);
        switch (ret) {
        case -EAGAIN:
-                set_need_resched();
        case 0:
        case -ERESTARTSYS:
                return VM_FAULT_NOPAGE;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 71b70e3a7a71..c91d547191dd 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -241,6 +241,7 @@ config HID_HOLTEK
          - Sharkoon Drakonia / Perixx MX-2000 gaming mice
          - Tracer Sniper TRM-503 / NOVA Gaming Slider X200 /
            Zalman ZM-GM1
+          - SHARKOON DarkGlider Gaming mouse
 config HOLTEK_FF
        bool "Holtek On Line Grip force feedback support"
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index ae88a97f976e..5a8c01112a23 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -94,7 +94,6 @@ EXPORT_SYMBOL_GPL(hid_register_report);
 static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values)
 {
        struct hid_field *field;
-        int i;
        if (report->maxfield == HID_MAX_FIELDS) {
                hid_err(report->device, "too many fields in report\n");
@@ -113,9 +112,6 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned
        field->value = (s32 *)(field->usage + usages);
        field->report = report;
-        for (i = 0; i < usages; i++)
-                field->usage[i].usage_index = i;
        return field;
 }
@@ -226,9 +222,9 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
 {
        struct hid_report *report;
        struct hid_field *field;
-        int usages;
+        unsigned usages;
        unsigned offset;
-        int i;
+        unsigned i;
        report = hid_register_report(parser->device, report_type, parser->global.report_id);
        if (!report) {
@@ -255,7 +251,8 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
        if (!parser->local.usage_index) /* Ignore padding fields */
                return 0;
-        usages = max_t(int, parser->local.usage_index, parser->global.report_count);
+        usages = max_t(unsigned, parser->local.usage_index,
+                                 parser->global.report_count);
        field = hid_register_field(report, usages, parser->global.report_count);
        if (!field)
@@ -266,13 +263,14 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
        field->application = hid_lookup_collection(parser, HID_COLLECTION_APPLICATION);
        for (i = 0; i < usages; i++) {
-                int j = i;
+                unsigned j = i;
                /* Duplicate the last usage we parsed if we have excess values */
                if (i >= parser->local.usage_index)
                        j = parser->local.usage_index - 1;
                field->usage[i].hid = parser->local.usage[j];
                field->usage[i].collection_index =
                        parser->local.collection_index[j];
+                field->usage[i].usage_index = i;
        }
        field->maxusage = usages;
@@ -801,6 +799,64 @@ int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size)
 }
 EXPORT_SYMBOL_GPL(hid_parse_report);
+static const char * const hid_report_names[] = {
+        "HID_INPUT_REPORT",
+        "HID_OUTPUT_REPORT",
+        "HID_FEATURE_REPORT",
+};
+/**
+ * hid_validate_values - validate existing device report's value indexes
+ *
+ * @device: hid device
+ * @type: which report type to examine
+ * @id: which report ID to examine (0 for first)
+ * @field_index: which report field to examine
+ * @report_counts: expected number of values
+ *
+ * Validate the number of values in a given field of a given report, after
+ * parsing.
+ */
+struct hid_report *hid_validate_values(struct hid_device *hid,
+                                       unsigned int type, unsigned int id,
+                                       unsigned int field_index,
+                                       unsigned int report_counts)
+{
+        struct hid_report *report;
+        if (type > HID_FEATURE_REPORT) {
+                hid_err(hid, "invalid HID report type %u\n", type);
+                return NULL;
+        }
+        if (id >= HID_MAX_IDS) {
+                hid_err(hid, "invalid HID report id %u\n", id);
+                return NULL;
+        }
+        /*
+         * Explicitly not using hid_get_report() here since it depends on
+         * ->numbered being checked, which may not always be the case when
+         * drivers go to access report values.
+         */
+        report = hid->report_enum[type].report_id_hash[id];
+        if (!report) {
+                hid_err(hid, "missing %s %u\n", hid_report_names[type], id);
+                return NULL;
+        }
+        if (report->maxfield <= field_index) {
+                hid_err(hid, "not enough fields in %s %u\n",
+                        hid_report_names[type], id);
+                return NULL;
+        }
+        if (report->field[field_index]->report_count < report_counts) {
+                hid_err(hid, "not enough values in %s %u field %u\n",
+                        hid_report_names[type], id, field_index);
+                return NULL;
+        }
+        return report;
+}
+EXPORT_SYMBOL_GPL(hid_validate_values);
 /**
 * hid_open_report - open a driver-specific device report
 *
@@ -1296,7 +1352,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
                        goto out;
        }
-        if (hid->claimed != HID_CLAIMED_HIDRAW) {
+        if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) {
                for (a = 0; a < report->maxfield; a++)
                        hid_input_field(hid, report->field[a], cdata, interrupt);
                hdrv = hid->driver;
@@ -1659,6 +1715,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_580) },
        { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
index 7e6db3cf46f9..e696566cde46 100644
--- a/drivers/hid/hid-holtek-mouse.c
+++ b/drivers/hid/hid-holtek-mouse.c
@@ -27,6 +27,7 @@
 * - USB ID 04d9:a067, sold as Sharkoon Drakonia and Perixx MX-2000
 * - USB ID 04d9:a04a, sold as Tracer Sniper TRM-503, NOVA Gaming Slider X200
 *   and Zalman ZM-GM1
+ * - USB ID 04d9:a081, sold as SHARKOON DarkGlider Gaming mouse
 */
 static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -46,6 +47,7 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                        }
                        break;
                case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A:
+                case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081:
                        if (*rsize >= 113 && rdesc[106] == 0xff && rdesc[107] == 0x7f
                                        && rdesc[111] == 0xff && rdesc[112] == 0x7f) {
                                hid_info(hdev, "Fixing up report descriptor\n");
@@ -63,6 +65,8 @@ static const struct hid_device_id holtek_mouse_devices[] = {
                        USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
                        USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
+                        USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, holtek_mouse_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index e60e8d530697..9cbc7ab07dfa 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -450,6 +450,7 @@
 #define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD       0xa055
 #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067     0xa067
 #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A     0xa04a
+#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081     0xa081
 #define USB_VENDOR_ID_IMATION           0x0718
 #define USB_DEVICE_ID_DISC_STAKKA       0xd000
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index b420f4a0fd28..8741d953dcc8 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -485,6 +485,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
        if (field->flags & HID_MAIN_ITEM_CONSTANT)
                goto ignore;
+        /* Ignore if report count is out of bounds. */
+        if (field->report_count < 1)
+                goto ignore;
        /* only LED usages are supported in output fields */
        if (field->report_type == HID_OUTPUT_REPORT &&
                        (usage->hid & HID_USAGE_PAGE) != HID_UP_LED) {
@@ -1236,7 +1240,11 @@ static void report_features(struct hid_device *hid)
        rep_enum = &hid->report_enum[HID_FEATURE_REPORT];
        list_for_each_entry(rep, &rep_enum->report_list, list)
-                for (i = 0; i < rep->maxfield; i++)
+                for (i = 0; i < rep->maxfield; i++) {
+                        /* Ignore if report count is out of bounds. */
+                        if (rep->field[i]->report_count < 1)
+                                continue;
                        for (j = 0; j < rep->field[i]->maxusage; j++) {
                                /* Verify if Battery Strength feature is available */
                                hidinput_setup_battery(hid, HID_FEATURE_REPORT, rep->field[i]);
@@ -1245,6 +1253,7 @@ static void report_features(struct hid_device *hid)
                                        drv->feature_mapping(hid, rep->field[i],
                                                             rep->field[i]->usage + j);
                        }
+                }
 }
 static struct hid_input *hidinput_allocate(struct hid_device *hid)
diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c
index 07837f5a4eb8..31cf29a6ba17 100644
--- a/drivers/hid/hid-lenovo-tpkbd.c
+++ b/drivers/hid/hid-lenovo-tpkbd.c
@@ -339,7 +339,15 @@ static int tpkbd_probe_tp(struct hid_device *hdev)
        struct tpkbd_data_pointer *data_pointer;
        size_t name_sz = strlen(dev_name(dev)) + 16;
        char *name_mute, *name_micmute;
-        int ret;
+        int i, ret;
+        /* Validate required reports. */
+        for (i = 0; i < 4; i++) {
+                if (!hid_validate_values(hdev, HID_FEATURE_REPORT, 4, i, 1))
+                        return -ENODEV;
+        }
+        if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 3, 0, 2))
+                return -ENODEV;
        if (sysfs_create_group(&hdev->dev.kobj,
                                &tpkbd_attr_group_pointer)) {
@@ -406,22 +414,27 @@ static int tpkbd_probe(struct hid_device *hdev,
        ret = hid_parse(hdev);
        if (ret) {
                hid_err(hdev, "hid_parse failed\n");
-                goto err_free;
+                goto err;
        }
        ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
        if (ret) {
                hid_err(hdev, "hid_hw_start failed\n");
-                goto err_free;
+                goto err;
        }
        uhdev = (struct usbhid_device *) hdev->driver_data;
-        if (uhdev->ifnum == 1)
+        if (uhdev->ifnum == 1) {
-                return tpkbd_probe_tp(hdev);
+                ret = tpkbd_probe_tp(hdev);
+                if (ret)
+                        goto err_hid;
+        }
        return 0;
-err_free:
+err_hid:
+        hid_hw_stop(hdev);
+err:
        return ret;
 }
diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c
index b3cd1507dda2..1a42eaa6ca02 100644
--- a/drivers/hid/hid-lg2ff.c
+++ b/drivers/hid/hid-lg2ff.c
@@ -64,26 +64,13 @@ int lg2ff_init(struct hid_device *hid)
        struct hid_report *report;
        struct hid_input *hidinput = list_entry(hid->inputs.next,
                                                struct hid_input, list);
-        struct list_head *report_list =
-                        &hid->report_enum[HID_OUTPUT_REPORT].report_list;
        struct input_dev *dev = hidinput->input;
        int error;
-        if (list_empty(report_list)) {
+        /* Check that the report looks ok */
-                hid_err(hid, "no output report found\n");
+        report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7);
+        if (!report)
                return -ENODEV;
-        }
-        report = list_entry(report_list->next, struct hid_report, list);
-        if (report->maxfield < 1) {
-                hid_err(hid, "output report is empty\n");
-                return -ENODEV;
-        }
-        if (report->field[0]->report_count < 7) {
-                hid_err(hid, "not enough values in the field\n");
-                return -ENODEV;
-        }
        lg2ff = kmalloc(sizeof(struct lg2ff_device), GFP_KERNEL);
        if (!lg2ff)
diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c
index e52f181f6aa1..8c2da183d3bc 100644
--- a/drivers/hid/hid-lg3ff.c
+++ b/drivers/hid/hid-lg3ff.c
@@ -66,10 +66,11 @@ static int hid_lg3ff_play(struct input_dev *dev, void *data,
        int x, y;
 /*
- * Maxusage should always be 63 (maximum fields)
+ * Available values in the field should always be 63, but we only use up to
- * likely a better way to ensure this data is clean
+ * 35. Instead, clear the entire area, however big it is.
 */
-        memset(report->field[0]->value, 0, sizeof(__s32)*report->field[0]->maxusage);
+        memset(report->field[0]->value, 0,
+               sizeof(__s32) * report->field[0]->report_count);
        switch (effect->type) {
        case FF_CONSTANT:
@@ -129,32 +130,14 @@ static const signed short ff3_joystick_ac[] = {
 int lg3ff_init(struct hid_device *hid)
 {
        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
        struct input_dev *dev = hidinput->input;
-        struct hid_report *report;
-        struct hid_field *field;
        const signed short *ff_bits = ff3_joystick_ac;
        int error;
        int i;
-        /* Find the report to use */
-        if (list_empty(report_list)) {
-                hid_err(hid, "No output report found\n");
-                return -1;
-        }
        /* Check that the report looks ok */
-        report = list_entry(report_list->next, struct hid_report, list);
+        if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35))
-        if (!report) {
+                return -ENODEV;
-                hid_err(hid, "NULL output report\n");
-                return -1;
-        }
-        field = report->field[0];
-        if (!field) {
-                hid_err(hid, "NULL field\n");
-                return -1;
-        }
        /* Assume single fixed device G940 */
        for (i = 0; ff_bits[i] >= 0; i++)
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index 0ddae2a00d59..8782fe1aaa07 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -484,34 +484,16 @@ static enum led_brightness lg4ff_led_get_brightness(struct led_classdev *led_cde
 int lg4ff_init(struct hid_device *hid)
 {
        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
        struct input_dev *dev = hidinput->input;
-        struct hid_report *report;
-        struct hid_field *field;
        struct lg4ff_device_entry *entry;
        struct lg_drv_data *drv_data;
        struct usb_device_descriptor *udesc;
        int error, i, j;
        __u16 bcdDevice, rev_maj, rev_min;
-        /* Find the report to use */
-        if (list_empty(report_list)) {
-                hid_err(hid, "No output report found\n");
-                return -1;
-        }
        /* Check that the report looks ok */
-        report = list_entry(report_list->next, struct hid_report, list);
+        if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
-        if (!report) {
-                hid_err(hid, "NULL output report\n");
                return -1;
-        }
-        field = report->field[0];
-        if (!field) {
-                hid_err(hid, "NULL field\n");
-                return -1;
-        }
        /* Check what wheel has been connected */
        for (i = 0; i < ARRAY_SIZE(lg4ff_devices); i++) {
diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c
index d7ea8c845b40..e1394af0ae7b 100644
--- a/drivers/hid/hid-lgff.c
+++ b/drivers/hid/hid-lgff.c
@@ -128,27 +128,14 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude)
 int lgff_init(struct hid_device* hid)
 {
        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
        struct input_dev *dev = hidinput->input;
-        struct hid_report *report;
-        struct hid_field *field;
        const signed short *ff_bits = ff_joystick;
        int error;
        int i;
-        /* Find the report to use */
-        if (list_empty(report_list)) {
-                hid_err(hid, "No output report found\n");
-                return -1;
-        }
        /* Check that the report looks ok */
-        report = list_entry(report_list->next, struct hid_report, list);
+        if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
-        field = report->field[0];
+                return -ENODEV;
-        if (!field) {
-                hid_err(hid, "NULL field\n");
-                return -1;
-        }
        for (i = 0; i < ARRAY_SIZE(devices); i++) {
                if (dev->id.vendor == devices[i].idVendor &&
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 7800b1410562..2e5302462efb 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -461,7 +461,7 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
        struct hid_report *report;
        struct hid_report_enum *output_report_enum;
        u8 *data = (u8 *)(&dj_report->device_index);
-        int i;
+        unsigned int i;
        output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT];
        report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
@@ -471,7 +471,7 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
                return -ENODEV;
        }
-        for (i = 0; i < report->field[0]->report_count; i++)
+        for (i = 0; i < DJREPORT_SHORT_LENGTH - 1; i++)
                report->field[0]->value[i] = data[i];
        hid_hw_request(hdev, report, HID_REQ_SET_REPORT);
@@ -791,6 +791,12 @@ static int logi_dj_probe(struct hid_device *hdev,
                goto hid_parse_fail;
        }
+        if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, REPORT_ID_DJ_SHORT,
+                                 0, DJREPORT_SHORT_LENGTH - 1)) {
+                retval = -ENODEV;
+                goto hid_parse_fail;
+        }
        /* Starts the usb device and connects to upper interfaces hiddev and
         * hidraw */
        retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index ac28f08c3866..5e5fe1b8eebb 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -101,9 +101,9 @@ struct mt_device {
        unsigned last_slot_field;       /* the last field of a slot */
        unsigned mt_report_id;  /* the report ID of the multitouch device */
        unsigned pen_report_id; /* the report ID of the pen device */
-        __s8 inputmode;         /* InputMode HID feature, -1 if non-existent */
+        __s16 inputmode;        /* InputMode HID feature, -1 if non-existent */
-        __s8 inputmode_index;   /* InputMode HID feature index in the report */
+        __s16 inputmode_index;  /* InputMode HID feature index in the report */
-        __s8 maxcontact_report_id;      /* Maximum Contact Number HID feature,
+        __s16 maxcontact_report_id;     /* Maximum Contact Number HID feature,
                                   -1 if non-existent */
        __u8 num_received;      /* how many contacts we received */
        __u8 num_expected;      /* expected last contact index */
@@ -312,20 +312,18 @@ static void mt_feature_mapping(struct hid_device *hdev,
                struct hid_field *field, struct hid_usage *usage)
 {
        struct mt_device *td = hid_get_drvdata(hdev);
-        int i;
        switch (usage->hid) {
        case HID_DG_INPUTMODE:
-                td->inputmode = field->report->id;
+                /* Ignore if value index is out of bounds. */
-                td->inputmode_index = 0; /* has to be updated below */
+                if (usage->usage_index >= field->report_count) {
+                        dev_err(&hdev->dev, "HID_DG_INPUTMODE out of range\n");
-                for (i=0; i < field->maxusage; i++) {
+                        break;
-                        if (field->usage[i].hid == usage->hid) {
-                                td->inputmode_index = i;
-                                break;
-                        }
                }
+                td->inputmode = field->report->id;
+                td->inputmode_index = usage->usage_index;
                break;
        case HID_DG_CONTACTMAX:
                td->maxcontact_report_id = field->report->id;
@@ -511,6 +509,10 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                        mt_store_field(usage, td, hi);
                        return 1;
                case HID_DG_CONTACTCOUNT:
+                        /* Ignore if indexes are out of bounds. */
+                        if (field->index >= field->report->maxfield ||
+                            usage->usage_index >= field->report_count)
+                                return 1;
                        td->cc_index = field->index;
                        td->cc_value_index = usage->usage_index;
                        return 1;
diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 602c188e9d86..6101816a7ddd 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -382,7 +382,7 @@ static ssize_t kone_sysfs_write_profilex(struct file *fp,
 }
 #define PROFILE_ATTR(number)                                    \
 static struct bin_attribute bin_attr_profile##number = {        \
-        .attr = { .name = "profile##number", .mode = 0660 },    \
+        .attr = { .name = "profile" #number, .mode = 0660 },    \
        .size = sizeof(struct kone_profile),                    \
        .read = kone_sysfs_read_profilex,                       \
        .write = kone_sysfs_write_profilex,                     \
diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
index 5ddf605b6b89..5e99fcdc71b9 100644
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -229,13 +229,13 @@ static ssize_t koneplus_sysfs_read_profilex_buttons(struct file *fp,
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
        .size = KONEPLUS_SIZE_PROFILE_SETTINGS,                         \
        .read = koneplus_sysfs_read_profilex_settings,                  \
        .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
        .size = KONEPLUS_SIZE_PROFILE_BUTTONS,                          \
        .read = koneplus_sysfs_read_profilex_buttons,                   \
        .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
index 515bc03136c0..0c8e1ef0b67d 100644
--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -257,13 +257,13 @@ static ssize_t kovaplus_sysfs_read_profilex_buttons(struct file *fp,
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
        .size = KOVAPLUS_SIZE_PROFILE_SETTINGS,                         \
        .read = kovaplus_sysfs_read_profilex_settings,                  \
        .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
        .size = KOVAPLUS_SIZE_PROFILE_BUTTONS,                          \
        .read = kovaplus_sysfs_read_profilex_buttons,                   \
        .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
index 5a6dbbeee790..1a07e07d99a0 100644
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -225,13 +225,13 @@ static ssize_t pyra_sysfs_read_profilex_buttons(struct file *fp,
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
        .size = PYRA_SIZE_PROFILE_SETTINGS,                             \
        .read = pyra_sysfs_read_profilex_settings,                      \
        .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
        .size = PYRA_SIZE_PROFILE_BUTTONS,                              \
        .read = pyra_sysfs_read_profilex_buttons,                       \
        .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 30dbb6b40bbf..b18320db5f7d 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -537,6 +537,10 @@ static int buzz_init(struct hid_device *hdev)
        drv_data = hid_get_drvdata(hdev);
        BUG_ON(!(drv_data->quirks & BUZZ_CONTROLLER));
+        /* Validate expected report characteristics. */
+        if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 7))
+                return -ENODEV;
        buzz = kzalloc(sizeof(*buzz), GFP_KERNEL);
        if (!buzz) {
                hid_err(hdev, "Insufficient memory, cannot allocate driver data\n");
diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
index d16491192112..29f328f411fb 100644
--- a/drivers/hid/hid-steelseries.c
+++ b/drivers/hid/hid-steelseries.c
@@ -249,6 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
                goto err_free;
        }
+        if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) {
+                ret = -ENODEV;
+                goto err_free;
+        }
        ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
        if (ret) {
                hid_err(hdev, "hw start failed\n");
diff --git a/drivers/hid/hid-wiimote-modules.c b/drivers/hid/hid-wiimote-modules.c
index 2e7d644dba18..71adf9e60b13 100644
--- a/drivers/hid/hid-wiimote-modules.c
+++ b/drivers/hid/hid-wiimote-modules.c
@@ -119,12 +119,22 @@ static const struct wiimod_ops wiimod_keys = {
 * the rumble motor, this flag shouldn't be set.
 */
+/* used by wiimod_rumble and wiipro_rumble */
+static void wiimod_rumble_worker(struct work_struct *work)
+{
+        struct wiimote_data *wdata = container_of(work, struct wiimote_data,
+                                                  rumble_worker);
+        spin_lock_irq(&wdata->state.lock);
+        wiiproto_req_rumble(wdata, wdata->state.cache_rumble);
+        spin_unlock_irq(&wdata->state.lock);
+}
 static int wiimod_rumble_play(struct input_dev *dev, void *data,
                              struct ff_effect *eff)
 {
        struct wiimote_data *wdata = input_get_drvdata(dev);
        __u8 value;
-        unsigned long flags;
        /*
         * The wiimote supports only a single rumble motor so if any magnitude
@@ -137,9 +147,10 @@ static int wiimod_rumble_play(struct input_dev *dev, void *data,
        else
                value = 0;
-        spin_lock_irqsave(&wdata->state.lock, flags);
+        /* Locking state.lock here might deadlock with input_event() calls.
-        wiiproto_req_rumble(wdata, value);
+         * schedule_work acts as barrier. Merging multiple changes is fine. */
-        spin_unlock_irqrestore(&wdata->state.lock, flags);
+        wdata->state.cache_rumble = value;
+        schedule_work(&wdata->rumble_worker);
        return 0;
 }
@@ -147,6 +158,8 @@ static int wiimod_rumble_play(struct input_dev *dev, void *data,
 static int wiimod_rumble_probe(const struct wiimod_ops *ops,
                               struct wiimote_data *wdata)
 {
+        INIT_WORK(&wdata->rumble_worker, wiimod_rumble_worker);
        set_bit(FF_RUMBLE, wdata->input->ffbit);
        if (input_ff_create_memless(wdata->input, NULL, wiimod_rumble_play))
                return -ENOMEM;
@@ -159,6 +172,8 @@ static void wiimod_rumble_remove(const struct wiimod_ops *ops,
 {
        unsigned long flags;
+        cancel_work_sync(&wdata->rumble_worker);
        spin_lock_irqsave(&wdata->state.lock, flags);
        wiiproto_req_rumble(wdata, 0);
        spin_unlock_irqrestore(&wdata->state.lock, flags);
@@ -1731,7 +1746,6 @@ static int wiimod_pro_play(struct input_dev *dev, void *data,
 {
        struct wiimote_data *wdata = input_get_drvdata(dev);
        __u8 value;
-        unsigned long flags;
        /*
         * The wiimote supports only a single rumble motor so if any magnitude
@@ -1744,9 +1758,10 @@ static int wiimod_pro_play(struct input_dev *dev, void *data,
        else
                value = 0;
-        spin_lock_irqsave(&wdata->state.lock, flags);
+        /* Locking state.lock here might deadlock with input_event() calls.
-        wiiproto_req_rumble(wdata, value);
+         * schedule_work acts as barrier. Merging multiple changes is fine. */
-        spin_unlock_irqrestore(&wdata->state.lock, flags);
+        wdata->state.cache_rumble = value;
+        schedule_work(&wdata->rumble_worker);
        return 0;
 }
@@ -1756,6 +1771,8 @@ static int wiimod_pro_probe(const struct wiimod_ops *ops,
 {
        int ret, i;
+        INIT_WORK(&wdata->rumble_worker, wiimod_rumble_worker);
        wdata->extension.input = input_allocate_device();
        if (!wdata->extension.input)
                return -ENOMEM;
@@ -1817,12 +1834,13 @@ static void wiimod_pro_remove(const struct wiimod_ops *ops,
        if (!wdata->extension.input)
                return;
+        input_unregister_device(wdata->extension.input);
+        wdata->extension.input = NULL;
+        cancel_work_sync(&wdata->rumble_worker);
        spin_lock_irqsave(&wdata->state.lock, flags);
        wiiproto_req_rumble(wdata, 0);
        spin_unlock_irqrestore(&wdata->state.lock, flags);
-        input_unregister_device(wdata->extension.input);
-        wdata->extension.input = NULL;
 }
 static const struct wiimod_ops wiimod_pro = {
diff --git a/drivers/hid/hid-wiimote.h b/drivers/hid/hid-wiimote.h
index f1474f372c0b..75db0c400037 100644
--- a/drivers/hid/hid-wiimote.h
+++ b/drivers/hid/hid-wiimote.h
@@ -133,13 +133,15 @@ struct wiimote_state {
        __u8 *cmd_read_buf;
        __u8 cmd_read_size;
-        /* calibration data */
+        /* calibration/cache data */
        __u16 calib_bboard[4][3];
+        __u8 cache_rumble;
 };
 struct wiimote_data {
        struct hid_device *hdev;
        struct input_dev *input;
+        struct work_struct rumble_worker;
        struct led_classdev *leds[4];
        struct input_dev *accel;
        struct input_dev *ir;
diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c
index 6ec28a37c146..a29756c6ca02 100644
--- a/drivers/hid/hid-zpff.c
+++ b/drivers/hid/hid-zpff.c
@@ -68,21 +68,13 @@ static int zpff_init(struct hid_device *hid)
        struct hid_report *report;
        struct hid_input *hidinput = list_entry(hid->inputs.next,
                                                struct hid_input, list);
-        struct list_head *report_list =
-                        &hid->report_enum[HID_OUTPUT_REPORT].report_list;
        struct input_dev *dev = hidinput->input;
-        int error;
+        int i, error;
-        if (list_empty(report_list)) {
+        for (i = 0; i < 4; i++) {
-                hid_err(hid, "no output report found\n");
+                report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1);
-                return -ENODEV;
+                if (!report)
-        }
+                        return -ENODEV;
-        report = list_entry(report_list->next, struct hid_report, list);
-        if (report->maxfield < 4) {
-                hid_err(hid, "not enough fields in report\n");
-                return -ENODEV;
        }
        zpff = kzalloc(sizeof(struct zpff_device), GFP_KERNEL);
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 8918dd12bb69..6a6dd5cd7833 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -308,18 +308,25 @@ static int hidraw_fasync(int fd, struct file *file, int on)
 static void drop_ref(struct hidraw *hidraw, int exists_bit)
 {
        if (exists_bit) {
-                hid_hw_close(hidraw->hid);
                hidraw->exist = 0;
-                if (hidraw->open)
+                if (hidraw->open) {
+                        hid_hw_close(hidraw->hid);
                        wake_up_interruptible(&hidraw->wait);
+                }
        } else {
                --hidraw->open;
        }
+        if (!hidraw->open) {
-        if (!hidraw->open && !hidraw->exist) {
+                if (!hidraw->exist) {
-                device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+                        device_destroy(hidraw_class,
-                hidraw_table[hidraw->minor] = NULL;
+                                        MKDEV(hidraw_major, hidraw->minor));
-                kfree(hidraw);
+                        hidraw_table[hidraw->minor] = NULL;
+                        kfree(hidraw);
+                } else {
+                        /* close device for last reader */
+                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
+                        hid_hw_close(hidraw->hid);
+                }
        }
 }
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 5bf2fb785844..93b00d76374c 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -615,7 +615,7 @@ static const struct file_operations uhid_fops = {
 static struct miscdevice uhid_misc = {
        .fops           = &uhid_fops,
-        .minor          = MISC_DYNAMIC_MINOR,
+        .minor          = UHID_MINOR,
        .name           = UHID_NAME,
 };
@@ -634,4 +634,5 @@ module_exit(uhid_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
+MODULE_ALIAS_MISCDEV(UHID_MINOR);
 MODULE_ALIAS("devname:" UHID_NAME);
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index 8f4743ab5fb2..936093e0271e 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -195,7 +195,7 @@ int vmbus_connect(void)
        do {
                ret = vmbus_negotiate_version(msginfo, version);
-                if (ret)
+                if (ret == -ETIMEDOUT)
                        goto cleanup;
                if (vmbus_connection.conn_state == CONNECTED)
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index 28b03325b872..09988b289622 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -32,13 +32,17 @@
 /*
 * Pre win8 version numbers used in ws2008 and ws 2008 r2 (win7)
 */
+#define WS2008_SRV_MAJOR        1
+#define WS2008_SRV_MINOR        0
+#define WS2008_SRV_VERSION     (WS2008_SRV_MAJOR << 16 | WS2008_SRV_MINOR)
 #define WIN7_SRV_MAJOR   3
 #define WIN7_SRV_MINOR   0
-#define WIN7_SRV_MAJOR_MINOR     (WIN7_SRV_MAJOR << 16 | WIN7_SRV_MINOR)
+#define WIN7_SRV_VERSION     (WIN7_SRV_MAJOR << 16 | WIN7_SRV_MINOR)
 #define WIN8_SRV_MAJOR   4
 #define WIN8_SRV_MINOR   0
-#define WIN8_SRV_MAJOR_MINOR     (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR)
+#define WIN8_SRV_VERSION     (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR)
 /*
 * Global state maintained for transaction that is being processed.
@@ -587,6 +591,8 @@ void hv_kvp_onchannelcallback(void *context)
        struct icmsg_hdr *icmsghdrp;
        struct icmsg_negotiate *negop = NULL;
+        int util_fw_version;
+        int kvp_srv_version;
        if (kvp_transaction.active) {
                /*
@@ -606,17 +612,26 @@ void hv_kvp_onchannelcallback(void *context)
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                        /*
-                         * We start with win8 version and if the host cannot
+                         * Based on the host, select appropriate
-                         * support that we use the previous version.
+                         * framework and service versions we will
+                         * negotiate.
                         */
-                        if (vmbus_prep_negotiate_resp(icmsghdrp, negop,
+                        switch (vmbus_proto_version) {
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
+                        case (VERSION_WS2008):
-                                 WIN8_SRV_MAJOR_MINOR))
+                                util_fw_version = UTIL_WS2K8_FW_VERSION;
-                                goto done;
+                                kvp_srv_version = WS2008_SRV_VERSION;
+                                break;
+                        case (VERSION_WIN7):
+                                util_fw_version = UTIL_FW_VERSION;
+                                kvp_srv_version = WIN7_SRV_VERSION;
+                                break;
+                        default:
+                                util_fw_version = UTIL_FW_VERSION;
+                                kvp_srv_version = WIN8_SRV_VERSION;
+                        }
                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
+                                 recv_buffer, util_fw_version,
-                                 WIN7_SRV_MAJOR_MINOR);
+                                 kvp_srv_version);
                } else {
                        kvp_msg = (struct hv_kvp_msg *)&recv_buffer[
@@ -649,7 +664,6 @@ void hv_kvp_onchannelcallback(void *context)
                        return;
                }
-done:
                icmsghdrp->icflags = ICMSGHDRFLAG_TRANSACTION
                        | ICMSGHDRFLAG_RESPONSE;
diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index e4572f3f2834..0c3546224376 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -26,7 +26,7 @@
 #define VSS_MAJOR  5
 #define VSS_MINOR  0
-#define VSS_MAJOR_MINOR    (VSS_MAJOR << 16 | VSS_MINOR)
+#define VSS_VERSION    (VSS_MAJOR << 16 | VSS_MINOR)
@@ -190,8 +190,8 @@ void hv_vss_onchannelcallback(void *context)
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
+                                 recv_buffer, UTIL_FW_VERSION,
-                                 VSS_MAJOR_MINOR);
+                                 VSS_VERSION);
                } else {
                        vss_msg = (struct hv_vss_msg *)&recv_buffer[
                                sizeof(struct vmbuspipe_hdr) +
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index cb82233541b1..273e3ddb3a20 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -28,17 +28,32 @@
 #include <linux/reboot.h>
 #include <linux/hyperv.h>
-#define SHUTDOWN_MAJOR  3
-#define SHUTDOWN_MINOR  0
-#define SHUTDOWN_MAJOR_MINOR    (SHUTDOWN_MAJOR << 16 | SHUTDOWN_MINOR)
-#define TIMESYNCH_MAJOR 3
+#define SD_MAJOR        3
-#define TIMESYNCH_MINOR 0
+#define SD_MINOR        0
-#define TIMESYNCH_MAJOR_MINOR   (TIMESYNCH_MAJOR << 16 | TIMESYNCH_MINOR)
+#define SD_VERSION      (SD_MAJOR << 16 | SD_MINOR)
-#define HEARTBEAT_MAJOR 3
+#define SD_WS2008_MAJOR         1
-#define HEARTBEAT_MINOR 0
+#define SD_WS2008_VERSION       (SD_WS2008_MAJOR << 16 | SD_MINOR)
-#define HEARTBEAT_MAJOR_MINOR   (HEARTBEAT_MAJOR << 16 | HEARTBEAT_MINOR)
+#define TS_MAJOR        3
+#define TS_MINOR        0
+#define TS_VERSION      (TS_MAJOR << 16 | TS_MINOR)
+#define TS_WS2008_MAJOR         1
+#define TS_WS2008_VERSION       (TS_WS2008_MAJOR << 16 | TS_MINOR)
+#define HB_MAJOR        3
+#define HB_MINOR 0
+#define HB_VERSION      (HB_MAJOR << 16 | HB_MINOR)
+#define HB_WS2008_MAJOR 1
+#define HB_WS2008_VERSION       (HB_WS2008_MAJOR << 16 | HB_MINOR)
+static int sd_srv_version;
+static int ts_srv_version;
+static int hb_srv_version;
+static int util_fw_version;
 static void shutdown_onchannelcallback(void *context);
 static struct hv_util_service util_shutdown = {
@@ -99,8 +114,8 @@ static void shutdown_onchannelcallback(void *context)
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                        shut_txf_buf, UTIL_FW_MAJOR_MINOR,
+                                        shut_txf_buf, util_fw_version,
-                                        SHUTDOWN_MAJOR_MINOR);
+                                        sd_srv_version);
                } else {
                        shutdown_msg =
                                (struct shutdown_msg_data *)&shut_txf_buf[
@@ -216,6 +231,7 @@ static void timesync_onchannelcallback(void *context)
        struct icmsg_hdr *icmsghdrp;
        struct ictimesync_data *timedatap;
        u8 *time_txf_buf = util_timesynch.recv_buffer;
+        struct icmsg_negotiate *negop = NULL;
        vmbus_recvpacket(channel, time_txf_buf,
                         PAGE_SIZE, &recvlen, &requestid);
@@ -225,9 +241,10 @@ static void timesync_onchannelcallback(void *context)
                                sizeof(struct vmbuspipe_hdr)];
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
-                        vmbus_prep_negotiate_resp(icmsghdrp, NULL, time_txf_buf,
+                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                                UTIL_FW_MAJOR_MINOR,
+                                                time_txf_buf,
-                                                TIMESYNCH_MAJOR_MINOR);
+                                                util_fw_version,
+                                                ts_srv_version);
                } else {
                        timedatap = (struct ictimesync_data *)&time_txf_buf[
                                sizeof(struct vmbuspipe_hdr) +
@@ -257,6 +274,7 @@ static void heartbeat_onchannelcallback(void *context)
        struct icmsg_hdr *icmsghdrp;
        struct heartbeat_msg_data *heartbeat_msg;
        u8 *hbeat_txf_buf = util_heartbeat.recv_buffer;
+        struct icmsg_negotiate *negop = NULL;
        vmbus_recvpacket(channel, hbeat_txf_buf,
                         PAGE_SIZE, &recvlen, &requestid);
@@ -266,9 +284,9 @@ static void heartbeat_onchannelcallback(void *context)
                                sizeof(struct vmbuspipe_hdr)];
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
-                        vmbus_prep_negotiate_resp(icmsghdrp, NULL,
+                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                hbeat_txf_buf, UTIL_FW_MAJOR_MINOR,
+                                hbeat_txf_buf, util_fw_version,
-                                HEARTBEAT_MAJOR_MINOR);
+                                hb_srv_version);
                } else {
                        heartbeat_msg =
                                (struct heartbeat_msg_data *)&hbeat_txf_buf[
@@ -321,6 +339,25 @@ static int util_probe(struct hv_device *dev,
                goto error;
        hv_set_drvdata(dev, srv);
+        /*
+         * Based on the host; initialize the framework and
+         * service version numbers we will negotiate.
+         */
+        switch (vmbus_proto_version) {
+        case (VERSION_WS2008):
+                util_fw_version = UTIL_WS2K8_FW_VERSION;
+                sd_srv_version = SD_WS2008_VERSION;
+                ts_srv_version = TS_WS2008_VERSION;
+                hb_srv_version = HB_WS2008_VERSION;
+                break;
+        default:
+                util_fw_version = UTIL_FW_VERSION;
+                sd_srv_version = SD_VERSION;
+                ts_srv_version = TS_VERSION;
+                hb_srv_version = HB_VERSION;
+        }
        return 0;
 error:
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 62c2e32e25ef..3288f13d2d87 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -230,6 +230,7 @@ static int send_argument(const char *key)
 static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
 {
+        u8 status, data = 0;
        int i;
        if (send_command(cmd) || send_argument(key)) {
@@ -237,6 +238,7 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
                return -EIO;
        }
+        /* This has no effect on newer (2012) SMCs */
        if (send_byte(len, APPLESMC_DATA_PORT)) {
                pr_warn("%.4s: read len fail\n", key);
                return -EIO;
@@ -250,6 +252,17 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
                buffer[i] = inb(APPLESMC_DATA_PORT);
        }
+        /* Read the data port until bit0 is cleared */
+        for (i = 0; i < 16; i++) {
+                udelay(APPLESMC_MIN_WAIT);
+                status = inb(APPLESMC_CMD_PORT);
+                if (!(status & 0x01))
+                        break;
+                data = inb(APPLESMC_DATA_PORT);
+        }
+        if (i)
+                pr_warn("flushed %d bytes, last value is: %d\n", i, data);
        return 0;
 }
@@ -525,16 +538,25 @@ static int applesmc_init_smcreg_try(void)
 {
        struct applesmc_registers *s = &smcreg;
        bool left_light_sensor, right_light_sensor;
+        unsigned int count;
        u8 tmp[1];
        int ret;
        if (s->init_complete)
                return 0;
-        ret = read_register_count(&s->key_count);
+        ret = read_register_count(&count);
        if (ret)
                return ret;
+        if (s->cache && s->key_count != count) {
+                pr_warn("key count changed from %d to %d\n",
+                        s->key_count, count);
+                kfree(s->cache);
+                s->cache = NULL;
+        }
+        s->key_count = count;
        if (!s->cache)
                s->cache = kcalloc(s->key_count, sizeof(*s->cache), GFP_KERNEL);
        if (!s->cache)
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index dbecf08399f8..5888feef1ac5 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -98,6 +98,8 @@
 #define DW_IC_ERR_TX_ABRT       0x1
+#define DW_IC_TAR_10BITADDR_MASTER BIT(12)
 /*
 * status codes
 */
@@ -388,22 +390,34 @@ static int i2c_dw_wait_bus_not_busy(struct dw_i2c_dev *dev)
 static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
 {
        struct i2c_msg *msgs = dev->msgs;
-        u32 ic_con;
+        u32 ic_con, ic_tar = 0;
        /* Disable the adapter */
        __i2c_dw_enable(dev, false);
-        /* set the slave (target) address */
-        dw_writel(dev, msgs[dev->msg_write_idx].addr, DW_IC_TAR);
        /* if the slave address is ten bit address, enable 10BITADDR */
        ic_con = dw_readl(dev, DW_IC_CON);
-        if (msgs[dev->msg_write_idx].flags & I2C_M_TEN)
+        if (msgs[dev->msg_write_idx].flags & I2C_M_TEN) {
                ic_con |= DW_IC_CON_10BITADDR_MASTER;
-        else
+                /*
+                 * If I2C_DYNAMIC_TAR_UPDATE is set, the 10-bit addressing
+                 * mode has to be enabled via bit 12 of IC_TAR register.
+                 * We set it always as I2C_DYNAMIC_TAR_UPDATE can't be
+                 * detected from registers.
+                 */
+                ic_tar = DW_IC_TAR_10BITADDR_MASTER;
+        } else {
                ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
+        }
        dw_writel(dev, ic_con, DW_IC_CON);
+        /*
+         * Set the slave (target) address and enable 10-bit addressing mode
+         * if applicable.
+         */
+        dw_writel(dev, msgs[dev->msg_write_idx].addr | ic_tar, DW_IC_TAR);
        /* Enable the adapter */
        __i2c_dw_enable(dev, true);
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 4c1b60539a25..0aa01136f8d9 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -270,7 +270,8 @@ static SIMPLE_DEV_PM_OPS(dw_i2c_dev_pm_ops, dw_i2c_suspend, dw_i2c_resume);
 MODULE_ALIAS("platform:i2c_designware");
 static struct platform_driver dw_i2c_driver = {
-        .remove         = dw_i2c_remove,
+        .probe = dw_i2c_probe,
+        .remove = dw_i2c_remove,
        .driver         = {
                .name   = "i2c_designware",
                .owner  = THIS_MODULE,
@@ -282,7 +283,7 @@ static struct platform_driver dw_i2c_driver = {
 static int __init dw_i2c_init_driver(void)
 {
-        return platform_driver_probe(&dw_i2c_driver, dw_i2c_probe);
+        return platform_driver_register(&dw_i2c_driver);
 }
 subsys_initcall(dw_i2c_init_driver);
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index ccf46656bdad..1d7efa3169cd 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -365,7 +365,7 @@ static void i2c_imx_stop(struct imx_i2c_struct *i2c_imx)
        clk_disable_unprepare(i2c_imx->clk);
 }
-static void __init i2c_imx_set_clk(struct imx_i2c_struct *i2c_imx,
+static void i2c_imx_set_clk(struct imx_i2c_struct *i2c_imx,
                                                        unsigned int rate)
 {
        struct imx_i2c_clk_pair *i2c_clk_div = i2c_imx->hwdata->clk_div;
@@ -589,7 +589,7 @@ static struct i2c_algorithm i2c_imx_algo = {
        .functionality  = i2c_imx_func,
 };
-static int __init i2c_imx_probe(struct platform_device *pdev)
+static int i2c_imx_probe(struct platform_device *pdev)
 {
        const struct of_device_id *of_id = of_match_device(i2c_imx_dt_ids,
                                                           &pdev->dev);
@@ -697,7 +697,7 @@ static int __init i2c_imx_probe(struct platform_device *pdev)
        return 0;   /* Return OK */
 }
-static int __exit i2c_imx_remove(struct platform_device *pdev)
+static int i2c_imx_remove(struct platform_device *pdev)
 {
        struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev);
@@ -715,7 +715,8 @@ static int __exit i2c_imx_remove(struct platform_device *pdev)
 }
 static struct platform_driver i2c_imx_driver = {
-        .remove         = __exit_p(i2c_imx_remove),
+        .probe = i2c_imx_probe,
+        .remove = i2c_imx_remove,
        .driver = {
                .name   = DRIVER_NAME,
                .owner  = THIS_MODULE,
@@ -726,7 +727,7 @@ static struct platform_driver i2c_imx_driver = {
 static int __init i2c_adap_imx_init(void)
 {
-        return platform_driver_probe(&i2c_imx_driver, i2c_imx_probe);
+        return platform_driver_register(&i2c_imx_driver);
 }
 subsys_initcall(i2c_adap_imx_init);
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index 8ed79a086f85..1672effbcebb 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -393,6 +393,9 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr,
        desc = &priv->hw[priv->head];
+        /* Initialize the DMA buffer */
+        memset(priv->dma_buffer, 0, sizeof(priv->dma_buffer));
        /* Initialize the descriptor */
        memset(desc, 0, sizeof(struct ismt_desc));
        desc->tgtaddr_rw = ISMT_DESC_ADDR_RW(addr, read_write);
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 7f3a47443494..d3e9cc3153a9 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -234,9 +234,9 @@ static int mv64xxx_i2c_offload_msg(struct mv64xxx_i2c_data *drv_data)
                ctrl_reg |= MV64XXX_I2C_BRIDGE_CONTROL_WR |
                    (msg->len - 1) << MV64XXX_I2C_BRIDGE_CONTROL_TX_SIZE_SHIFT;
-                writel_relaxed(data_reg_lo,
+                writel(data_reg_lo,
                        drv_data->reg_base + MV64XXX_I2C_REG_TX_DATA_LO);
-                writel_relaxed(data_reg_hi,
+                writel(data_reg_hi,
                        drv_data->reg_base + MV64XXX_I2C_REG_TX_DATA_HI);
        } else {
@@ -697,6 +697,7 @@ static const struct of_device_id mv64xxx_i2c_of_match_table[] = {
 MODULE_DEVICE_TABLE(of, mv64xxx_i2c_of_match_table);
 #ifdef CONFIG_OF
+#ifdef CONFIG_HAVE_CLK
 static int
 mv64xxx_calc_freq(const int tclk, const int n, const int m)
 {
@@ -726,16 +727,12 @@ mv64xxx_find_baud_factors(const u32 req_freq, const u32 tclk, u32 *best_n,
                return false;
        return true;
 }
+#endif /* CONFIG_HAVE_CLK */
 static int
 mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
                  struct device *dev)
 {
-        const struct of_device_id *device;
-        struct device_node *np = dev->of_node;
-        u32 bus_freq, tclk;
-        int rc = 0;
        /* CLK is mandatory when using DT to describe the i2c bus. We
         * need to know tclk in order to calculate bus clock
         * factors.
@@ -744,6 +741,11 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
        /* Have OF but no CLK */
        return -ENODEV;
 #else
+        const struct of_device_id *device;
+        struct device_node *np = dev->of_node;
+        u32 bus_freq, tclk;
+        int rc = 0;
        if (IS_ERR(drv_data->clk)) {
                rc = -ENODEV;
                goto out;
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index f4a01675fa71..b7c857774708 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -780,12 +780,13 @@ static struct platform_driver mxs_i2c_driver = {
                   .owner = THIS_MODULE,
                   .of_match_table = mxs_i2c_dt_ids,
                   },
+        .probe = mxs_i2c_probe,
        .remove = mxs_i2c_remove,
 };
 static int __init mxs_i2c_init(void)
 {
-        return platform_driver_probe(&mxs_i2c_driver, mxs_i2c_probe);
+        return platform_driver_register(&mxs_i2c_driver);
 }
 subsys_initcall(mxs_i2c_init);
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 6d8308d5dc4e..9967a6f9c2ff 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -939,6 +939,9 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                /*
                 * ProDB0017052: Clear ARDY bit twice
                 */
+                if (stat & OMAP_I2C_STAT_ARDY)
+                        omap_i2c_ack_stat(dev, OMAP_I2C_STAT_ARDY);
                if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK |
                                        OMAP_I2C_STAT_AL)) {
                        omap_i2c_ack_stat(dev, (OMAP_I2C_STAT_RRDY |
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 3535f3c0f7b4..3747b9bf67d6 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -1178,8 +1178,6 @@ static int s3c24xx_i2c_remove(struct platform_device *pdev)
        i2c_del_adapter(&i2c->adap);
-        clk_disable_unprepare(i2c->clk);
        if (pdev->dev.of_node && IS_ERR(i2c->pctrl))
                s3c24xx_i2c_dt_gpio_free(i2c);
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index f8f6f2e552db..04a17b9b38bb 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -859,8 +859,7 @@ static const struct i2c_algorithm stu300_algo = {
        .functionality  = stu300_func,
 };
-static int __init
+static int stu300_probe(struct platform_device *pdev)
-stu300_probe(struct platform_device *pdev)
 {
        struct stu300_dev *dev;
        struct i2c_adapter *adap;
@@ -966,8 +965,7 @@ static SIMPLE_DEV_PM_OPS(stu300_pm, stu300_suspend, stu300_resume);
 #define STU300_I2C_PM   NULL
 #endif
-static int __exit
+static int stu300_remove(struct platform_device *pdev)
-stu300_remove(struct platform_device *pdev)
 {
        struct stu300_dev *dev = platform_get_drvdata(pdev);
@@ -989,13 +987,14 @@ static struct platform_driver stu300_i2c_driver = {
                .pm     = STU300_I2C_PM,
                .of_match_table = stu300_dt_match,
        },
-        .remove         = __exit_p(stu300_remove),
+        .probe = stu300_probe,
+        .remove = stu300_remove,
 };
 static int __init stu300_init(void)
 {
-        return platform_driver_probe(&stu300_i2c_driver, stu300_probe);
+        return platform_driver_register(&stu300_i2c_driver);
 }
 static void __exit stu300_exit(void)
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 29d3f045a2bf..3be58f89ac77 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1134,6 +1134,9 @@ static void acpi_i2c_register_devices(struct i2c_adapter *adap)
        acpi_handle handle;
        acpi_status status;
+        if (!adap->dev.parent)
+                return;
        handle = ACPI_HANDLE(adap->dev.parent);
        if (!handle)
                return;
diff --git a/drivers/i2c/muxes/i2c-arb-gpio-challenge.c b/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
index 74b41ae690f3..928656e241dd 100644
--- a/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
+++ b/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
@@ -200,7 +200,7 @@ static int i2c_arbitrator_probe(struct platform_device *pdev)
        arb->parent = of_find_i2c_adapter_by_node(parent_np);
        if (!arb->parent) {
                dev_err(dev, "Cannot find parent bus\n");
-                return -EINVAL;
+                return -EPROBE_DEFER;
        }
        /* Actually add the mux adapter */
diff --git a/drivers/i2c/muxes/i2c-mux-gpio.c b/drivers/i2c/muxes/i2c-mux-gpio.c
index 5d4a99ba743e..a764da777f08 100644
--- a/drivers/i2c/muxes/i2c-mux-gpio.c
+++ b/drivers/i2c/muxes/i2c-mux-gpio.c
@@ -66,7 +66,7 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
        struct device_node *adapter_np, *child;
        struct i2c_adapter *adapter;
        unsigned *values, *gpios;
-        int i = 0;
+        int i = 0, ret;
        if (!np)
                return -ENODEV;
@@ -79,7 +79,7 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
        adapter = of_find_i2c_adapter_by_node(adapter_np);
        if (!adapter) {
                dev_err(&pdev->dev, "Cannot find parent bus\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        mux->data.parent = i2c_adapter_id(adapter);
        put_device(&adapter->dev);
@@ -116,8 +116,12 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
                return -ENOMEM;
        }
-        for (i = 0; i < mux->data.n_gpios; i++)
+        for (i = 0; i < mux->data.n_gpios; i++) {
-                gpios[i] = of_get_named_gpio(np, "mux-gpios", i);
+                ret = of_get_named_gpio(np, "mux-gpios", i);
+                if (ret < 0)
+                        return ret;
+                gpios[i] = ret;
+        }
        mux->data.gpios = gpios;
@@ -177,7 +181,7 @@ static int i2c_mux_gpio_probe(struct platform_device *pdev)
        if (!parent) {
                dev_err(&pdev->dev, "Parent adapter (%d) not found\n",
                        mux->data.parent);
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        mux->parent = parent;
diff --git a/drivers/i2c/muxes/i2c-mux-pinctrl.c b/drivers/i2c/muxes/i2c-mux-pinctrl.c
index 69a91732ae65..68a37157377d 100644
--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
@@ -113,7 +113,7 @@ static int i2c_mux_pinctrl_parse_dt(struct i2c_mux_pinctrl *mux,
        adapter = of_find_i2c_adapter_by_node(adapter_np);
        if (!adapter) {
                dev_err(mux->dev, "Cannot find parent bus\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        mux->pdata->parent_bus_num = i2c_adapter_id(adapter);
        put_device(&adapter->dev);
@@ -211,7 +211,7 @@ static int i2c_mux_pinctrl_probe(struct platform_device *pdev)
        if (!mux->parent) {
                dev_err(&pdev->dev, "Parent adapter (%d) not found\n",
                        mux->pdata->parent_bus_num);
-                ret = -ENODEV;
+                ret = -EPROBE_DEFER;
                goto err;
        }
diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index 12e32e6b4103..81e3dc260993 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -620,7 +620,7 @@ static int bma180_remove(struct i2c_client *client)
 #ifdef CONFIG_PM_SLEEP
 static int bma180_suspend(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
        struct bma180_data *data = iio_priv(indio_dev);
        int ret;
@@ -633,7 +633,7 @@ static int bma180_suspend(struct device *dev)
 static int bma180_resume(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
        struct bma180_data *data = iio_priv(indio_dev);
        int ret;
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 84be63bdf038..0f16b553e063 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -556,7 +556,7 @@ static const struct iio_info at91_adc_info = {
 static int at91_adc_probe(struct platform_device *pdev)
 {
-        unsigned int prsc, mstrclk, ticks, adc_clk, shtim;
+        unsigned int prsc, mstrclk, ticks, adc_clk, adc_clk_khz, shtim;
        int ret;
        struct iio_dev *idev;
        struct at91_adc_state *st;
@@ -649,6 +649,7 @@ static int at91_adc_probe(struct platform_device *pdev)
         */
        mstrclk = clk_get_rate(st->clk);
        adc_clk = clk_get_rate(st->adc_clk);
+        adc_clk_khz = adc_clk / 1000;
        prsc = (mstrclk / (2 * adc_clk)) - 1;
        if (!st->startup_time) {
@@ -662,15 +663,15 @@ static int at91_adc_probe(struct platform_device *pdev)
         * defined in the electrical characteristics of the board, divided by 8.
         * The formula thus is : Startup Time = (ticks + 1) * 8 / ADC Clock
         */
-        ticks = round_up((st->startup_time * adc_clk /
+        ticks = round_up((st->startup_time * adc_clk_khz /
-                          1000000) - 1, 8) / 8;
+                          1000) - 1, 8) / 8;
        /*
         * a minimal Sample and Hold Time is necessary for the ADC to guarantee
         * the best converted final value between two channels selection
         * The formula thus is : Sample and Hold Time = (shtim + 1) / ADCClock
         */
-        shtim = round_up((st->sample_hold_time * adc_clk /
+        shtim = round_up((st->sample_hold_time * adc_clk_khz /
-                          1000000) - 1, 1);
+                          1000) - 1, 1);
        reg = AT91_ADC_PRESCAL_(prsc) & st->registers->mr_prescal_mask;
        reg |= AT91_ADC_STARTUP_(ticks) & st->registers->mr_startup_mask;
diff --git a/drivers/iio/amplifiers/ad8366.c b/drivers/iio/amplifiers/ad8366.c
index d0a79a4bce1c..ba6f6a91dfff 100644
--- a/drivers/iio/amplifiers/ad8366.c
+++ b/drivers/iio/amplifiers/ad8366.c
@@ -185,10 +185,8 @@ static int ad8366_remove(struct spi_device *spi)
        iio_device_unregister(indio_dev);
-        if (!IS_ERR(reg)) {
+        if (!IS_ERR(reg))
                regulator_disable(reg);
-                regulator_put(reg);
-        }
        return 0;
 }
diff --git a/drivers/iio/buffer_cb.c b/drivers/iio/buffer_cb.c
index 9d19ba74f22b..415f3c6efd72 100644
--- a/drivers/iio/buffer_cb.c
+++ b/drivers/iio/buffer_cb.c
@@ -41,6 +41,8 @@ struct iio_cb_buffer *iio_channel_get_all_cb(struct device *dev,
                goto error_ret;
        }
+        iio_buffer_init(&cb_buff->buffer);
        cb_buff->private = private;
        cb_buff->cb = cb;
        cb_buff->buffer.access = &iio_cb_access;
diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c
index 1f4a48e6a82c..1397b6e0e414 100644
--- a/drivers/iio/dac/mcp4725.c
+++ b/drivers/iio/dac/mcp4725.c
@@ -37,21 +37,21 @@ struct mcp4725_data {
 static int mcp4725_suspend(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct mcp4725_data *data = iio_priv(i2c_get_clientdata(
-        struct mcp4725_data *data = iio_priv(indio_dev);
+                to_i2c_client(dev)));
        u8 outbuf[2];
        outbuf[0] = (data->powerdown_mode + 1) << 4;
        outbuf[1] = 0;
        data->powerdown = true;
-        return i2c_master_send(to_i2c_client(dev), outbuf, 2);
+        return i2c_master_send(data->client, outbuf, 2);
 }
 static int mcp4725_resume(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct mcp4725_data *data = iio_priv(i2c_get_clientdata(
-        struct mcp4725_data *data = iio_priv(indio_dev);
+                to_i2c_client(dev)));
        u8 outbuf[2];
        /* restore previous DAC value */
@@ -59,7 +59,7 @@ static int mcp4725_resume(struct device *dev)
        outbuf[1] = data->dac_value & 0xff;
        data->powerdown = false;
-        return i2c_master_send(to_i2c_client(dev), outbuf, 2);
+        return i2c_master_send(data->client, outbuf, 2);
 }
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c
index a7b30be86ae0..52605c0ea3a6 100644
--- a/drivers/iio/frequency/adf4350.c
+++ b/drivers/iio/frequency/adf4350.c
@@ -525,8 +525,10 @@ static int adf4350_probe(struct spi_device *spi)
        }
        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
-        if (indio_dev == NULL)
+        if (indio_dev == NULL) {
-                return -ENOMEM;
+                ret =  -ENOMEM;
+                goto error_disable_clk;
+        }
        st = iio_priv(indio_dev);
diff --git a/drivers/iio/iio_core.h b/drivers/iio/iio_core.h
index 05c1b74502a3..9b32253b824b 100644
--- a/drivers/iio/iio_core.h
+++ b/drivers/iio/iio_core.h
@@ -49,11 +49,15 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
 #define iio_buffer_poll_addr (&iio_buffer_poll)
 #define iio_buffer_read_first_n_outer_addr (&iio_buffer_read_first_n_outer)
+void iio_disable_all_buffers(struct iio_dev *indio_dev);
 #else
 #define iio_buffer_poll_addr NULL
 #define iio_buffer_read_first_n_outer_addr NULL
+static inline void iio_disable_all_buffers(struct iio_dev *indio_dev) {}
 #endif
 int iio_device_register_eventset(struct iio_dev *indio_dev);
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index e73033f3839a..2db7dcd826b9 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -460,6 +460,28 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev, const long *mask,
        return bytes;
 }
+void iio_disable_all_buffers(struct iio_dev *indio_dev)
+{
+        struct iio_buffer *buffer, *_buffer;
+        if (list_empty(&indio_dev->buffer_list))
+                return;
+        if (indio_dev->setup_ops->predisable)
+                indio_dev->setup_ops->predisable(indio_dev);
+        list_for_each_entry_safe(buffer, _buffer,
+                        &indio_dev->buffer_list, buffer_list)
+                list_del_init(&buffer->buffer_list);
+        indio_dev->currentmode = INDIO_DIRECT_MODE;
+        if (indio_dev->setup_ops->postdisable)
+                indio_dev->setup_ops->postdisable(indio_dev);
+        if (indio_dev->available_scan_masks == NULL)
+                kfree(indio_dev->active_scan_mask);
+}
 int iio_update_buffers(struct iio_dev *indio_dev,
                       struct iio_buffer *insert_buffer,
                       struct iio_buffer *remove_buffer)
@@ -528,8 +550,15 @@ int iio_update_buffers(struct iio_dev *indio_dev,
                         * Note can only occur when adding a buffer.
                         */
                        list_del(&insert_buffer->buffer_list);
-                        indio_dev->active_scan_mask = old_mask;
+                        if (old_mask) {
-                        success = -EINVAL;
+                                indio_dev->active_scan_mask = old_mask;
+                                success = -EINVAL;
+                        }
+                        else {
+                                kfree(compound_mask);
+                                ret = -EINVAL;
+                                goto error_ret;
+                        }
                }
        } else {
                indio_dev->active_scan_mask = compound_mask;
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 97f0297b120f..f95c6979efd8 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -848,13 +848,10 @@ static void iio_device_unregister_sysfs(struct iio_dev *indio_dev)
 static void iio_dev_release(struct device *device)
 {
        struct iio_dev *indio_dev = dev_to_iio_dev(device);
-        if (indio_dev->chrdev.dev)
-                cdev_del(&indio_dev->chrdev);
        if (indio_dev->modes & INDIO_BUFFER_TRIGGERED)
                iio_device_unregister_trigger_consumer(indio_dev);
        iio_device_unregister_eventset(indio_dev);
        iio_device_unregister_sysfs(indio_dev);
-        iio_device_unregister_debugfs(indio_dev);
        ida_simple_remove(&iio_ida, indio_dev->id);
        kfree(indio_dev);
@@ -970,6 +967,8 @@ static int iio_chrdev_open(struct inode *inode, struct file *filp)
        if (test_and_set_bit(IIO_BUSY_BIT_POS, &indio_dev->flags))
                return -EBUSY;
+        iio_device_get(indio_dev);
        filp->private_data = indio_dev;
        return 0;
@@ -983,6 +982,8 @@ static int iio_chrdev_release(struct inode *inode, struct file *filp)
        struct iio_dev *indio_dev = container_of(inode->i_cdev,
                                                struct iio_dev, chrdev);
        clear_bit(IIO_BUSY_BIT_POS, &indio_dev->flags);
+        iio_device_put(indio_dev);
        return 0;
 }
@@ -1052,18 +1053,20 @@ int iio_device_register(struct iio_dev *indio_dev)
                indio_dev->setup_ops == NULL)
                indio_dev->setup_ops = &noop_ring_setup_ops;
-        ret = device_add(&indio_dev->dev);
-        if (ret < 0)
-                goto error_unreg_eventset;
        cdev_init(&indio_dev->chrdev, &iio_buffer_fileops);
        indio_dev->chrdev.owner = indio_dev->info->driver_module;
+        indio_dev->chrdev.kobj.parent = &indio_dev->dev.kobj;
        ret = cdev_add(&indio_dev->chrdev, indio_dev->dev.devt, 1);
        if (ret < 0)
-                goto error_del_device;
+                goto error_unreg_eventset;
-        return 0;
-error_del_device:
+        ret = device_add(&indio_dev->dev);
-        device_del(&indio_dev->dev);
+        if (ret < 0)
+                goto error_cdev_del;
+        return 0;
+error_cdev_del:
+        cdev_del(&indio_dev->chrdev);
 error_unreg_eventset:
        iio_device_unregister_eventset(indio_dev);
 error_free_sysfs:
@@ -1078,9 +1081,17 @@ EXPORT_SYMBOL(iio_device_register);
 void iio_device_unregister(struct iio_dev *indio_dev)
 {
        mutex_lock(&indio_dev->info_exist_lock);
+        device_del(&indio_dev->dev);
+        if (indio_dev->chrdev.dev)
+                cdev_del(&indio_dev->chrdev);
+        iio_device_unregister_debugfs(indio_dev);
+        iio_disable_all_buffers(indio_dev);
        indio_dev->info = NULL;
        mutex_unlock(&indio_dev->info_exist_lock);
-        device_del(&indio_dev->dev);
 }
 EXPORT_SYMBOL(iio_device_unregister);
 subsys_initcall(iio_init);
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
index 10aa9ef86cec..6be65ef5faa9 100644
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -72,7 +72,8 @@ EXPORT_SYMBOL(iio_push_event);
 static unsigned int iio_event_poll(struct file *filep,
                             struct poll_table_struct *wait)
 {
-        struct iio_event_interface *ev_int = filep->private_data;
+        struct iio_dev *indio_dev = filep->private_data;
+        struct iio_event_interface *ev_int = indio_dev->event_interface;
        unsigned int events = 0;
        poll_wait(filep, &ev_int->wait, wait);
@@ -90,7 +91,8 @@ static ssize_t iio_event_chrdev_read(struct file *filep,
                                     size_t count,
                                     loff_t *f_ps)
 {
-        struct iio_event_interface *ev_int = filep->private_data;
+        struct iio_dev *indio_dev = filep->private_data;
+        struct iio_event_interface *ev_int = indio_dev->event_interface;
        unsigned int copied;
        int ret;
@@ -121,7 +123,8 @@ error_unlock:
 static int iio_event_chrdev_release(struct inode *inode, struct file *filep)
 {
-        struct iio_event_interface *ev_int = filep->private_data;
+        struct iio_dev *indio_dev = filep->private_data;
+        struct iio_event_interface *ev_int = indio_dev->event_interface;
        spin_lock_irq(&ev_int->wait.lock);
        __clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
@@ -133,6 +136,8 @@ static int iio_event_chrdev_release(struct inode *inode, struct file *filep)
        kfifo_reset_out(&ev_int->det_events);
        spin_unlock_irq(&ev_int->wait.lock);
+        iio_device_put(indio_dev);
        return 0;
 }
@@ -158,12 +163,15 @@ int iio_event_getfd(struct iio_dev *indio_dev)
                return -EBUSY;
        }
        spin_unlock_irq(&ev_int->wait.lock);
-        fd = anon_inode_getfd("iio:event",
+        iio_device_get(indio_dev);
-                                &iio_event_chrdev_fileops, ev_int, O_RDONLY);
+        fd = anon_inode_getfd("iio:event", &iio_event_chrdev_fileops,
+                                indio_dev, O_RDONLY);
        if (fd < 0) {
                spin_lock_irq(&ev_int->wait.lock);
                __clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
                spin_unlock_irq(&ev_int->wait.lock);
+                iio_device_put(indio_dev);
        }
        return fd;
 }
@@ -276,7 +284,7 @@ static int iio_device_add_event_sysfs(struct iio_dev *indio_dev,
                        goto error_ret;
                }
                if (chan->modified)
-                        mask = IIO_MOD_EVENT_CODE(chan->type, 0, chan->channel,
+                        mask = IIO_MOD_EVENT_CODE(chan->type, 0, chan->channel2,
                                                  i/IIO_EV_DIR_MAX,
                                                  i%IIO_EV_DIR_MAX);
                else if (chan->differential)
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index e8d2849cc81d..cab3bc7494a2 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -29,9 +29,9 @@
 #define ST_MAGN_NUMBER_DATA_CHANNELS            3
 /* DEFAULT VALUE FOR SENSORS */
-#define ST_MAGN_DEFAULT_OUT_X_L_ADDR            0X04
+#define ST_MAGN_DEFAULT_OUT_X_H_ADDR            0X03
-#define ST_MAGN_DEFAULT_OUT_Y_L_ADDR            0X08
+#define ST_MAGN_DEFAULT_OUT_Y_H_ADDR            0X07
-#define ST_MAGN_DEFAULT_OUT_Z_L_ADDR            0X06
+#define ST_MAGN_DEFAULT_OUT_Z_H_ADDR            0X05
 /* FULLSCALE */
 #define ST_MAGN_FS_AVL_1300MG                   1300
@@ -117,16 +117,16 @@
 static const struct iio_chan_spec st_magn_16bit_channels[] = {
        ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                        BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_X, 1, IIO_MOD_X, 's', IIO_LE, 16, 16,
+                        ST_SENSORS_SCAN_X, 1, IIO_MOD_X, 's', IIO_BE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_X_L_ADDR),
+                        ST_MAGN_DEFAULT_OUT_X_H_ADDR),
        ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                        BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_Y, 1, IIO_MOD_Y, 's', IIO_LE, 16, 16,
+                        ST_SENSORS_SCAN_Y, 1, IIO_MOD_Y, 's', IIO_BE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_Y_L_ADDR),
+                        ST_MAGN_DEFAULT_OUT_Y_H_ADDR),
        ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                        BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_Z, 1, IIO_MOD_Z, 's', IIO_LE, 16, 16,
+                        ST_SENSORS_SCAN_Z, 1, IIO_MOD_Z, 's', IIO_BE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_Z_L_ADDR),
+                        ST_MAGN_DEFAULT_OUT_Z_H_ADDR),
        IIO_CHAN_SOFT_TIMESTAMP(3)
 };
diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
index 64ccde3f1f7a..6d63883da1ab 100644
--- a/drivers/iio/temperature/tmp006.c
+++ b/drivers/iio/temperature/tmp006.c
@@ -255,12 +255,14 @@ static int tmp006_remove(struct i2c_client *client)
 #ifdef CONFIG_PM_SLEEP
 static int tmp006_suspend(struct device *dev)
 {
-        return tmp006_powerdown(iio_priv(dev_to_iio_dev(dev)));
+        struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
+        return tmp006_powerdown(iio_priv(indio_dev));
 }
 static int tmp006_resume(struct device *dev)
 {
-        struct tmp006_data *data = iio_priv(dev_to_iio_dev(dev));
+        struct tmp006_data *data = iio_priv(i2c_get_clientdata(
+                to_i2c_client(dev)));
        return i2c_smbus_write_word_swapped(data->client, TMP006_CONFIG,
                data->config | TMP006_CONFIG_MOD_MASK);
 }
diff --git a/drivers/infiniband/hw/amso1100/c2_ae.c b/drivers/infiniband/hw/amso1100/c2_ae.c
index d5d1929753e4..cedda25232be 100644
--- a/drivers/infiniband/hw/amso1100/c2_ae.c
+++ b/drivers/infiniband/hw/amso1100/c2_ae.c
@@ -141,7 +141,7 @@ static const char *to_qp_state_str(int state)
                return "C2_QP_STATE_ERROR";
        default:
                return "<invalid QP state>";
-        };
+        }
 }
 void c2_ae_event(struct c2_dev *c2dev, u32 mq_index)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 3f831de9a4d8..b1a6cb3a2809 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -164,6 +164,7 @@ int mlx5_vector2eqn(struct mlx5_ib_dev *dev, int vector, int *eqn, int *irqn)
 static int alloc_comp_eqs(struct mlx5_ib_dev *dev)
 {
        struct mlx5_eq_table *table = &dev->mdev.priv.eq_table;
+        char name[MLX5_MAX_EQ_NAME];
        struct mlx5_eq *eq, *n;
        int ncomp_vec;
        int nent;
@@ -180,11 +181,10 @@ static int alloc_comp_eqs(struct mlx5_ib_dev *dev)
                        goto clean;
                }
-                snprintf(eq->name, MLX5_MAX_EQ_NAME, "mlx5_comp%d", i);
+                snprintf(name, MLX5_MAX_EQ_NAME, "mlx5_comp%d", i);
                err = mlx5_create_map_eq(&dev->mdev, eq,
                                         i + MLX5_EQ_VEC_COMP_BASE, nent, 0,
-                                         eq->name,
+                                         name, &dev->mdev.priv.uuari.uars[0]);
-                                         &dev->mdev.priv.uuari.uars[0]);
                if (err) {
                        kfree(eq);
                        goto clean;
@@ -301,9 +301,8 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
        props->max_srq_sge         = max_rq_sg - 1;
        props->max_fast_reg_page_list_len = (unsigned int)-1;
        props->local_ca_ack_delay  = dev->mdev.caps.local_ca_ack_delay;
-        props->atomic_cap          = dev->mdev.caps.flags & MLX5_DEV_CAP_FLAG_ATOMIC ?
+        props->atomic_cap          = IB_ATOMIC_NONE;
-                IB_ATOMIC_HCA : IB_ATOMIC_NONE;
+        props->masked_atomic_cap   = IB_ATOMIC_NONE;
-        props->masked_atomic_cap   = IB_ATOMIC_HCA;
        props->max_pkeys           = be16_to_cpup((__be16 *)(out_mad->data + 28));
        props->max_mcast_grp       = 1 << dev->mdev.caps.log_max_mcg;
        props->max_mcast_qp_attach = dev->mdev.caps.max_qp_mcg;
@@ -1006,6 +1005,11 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, enum mlx5_dev_event event,
        ibev.device           = &ibdev->ib_dev;
        ibev.element.port_num = port;
+        if (port < 1 || port > ibdev->num_ports) {
+                mlx5_ib_warn(ibdev, "warning: event on port %d\n", port);
+                return;
+        }
        if (ibdev->ib_active)
                ib_dispatch_event(&ibev);
 }
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index bd41df95b6f0..3453580b1eb2 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -42,6 +42,10 @@ enum {
        DEF_CACHE_SIZE  = 10,
 };
+enum {
+        MLX5_UMR_ALIGN  = 2048
+};
 static __be64 *mr_align(__be64 *ptr, int align)
 {
        unsigned long mask = align - 1;
@@ -61,13 +65,11 @@ static int order2idx(struct mlx5_ib_dev *dev, int order)
 static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
        struct mlx5_mr_cache *cache = &dev->cache;
        struct mlx5_cache_ent *ent = &cache->ent[c];
        struct mlx5_create_mkey_mbox_in *in;
        struct mlx5_ib_mr *mr;
        int npages = 1 << ent->order;
-        int size = sizeof(u64) * npages;
        int err = 0;
        int i;
@@ -83,21 +85,6 @@ static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
                }
                mr->order = ent->order;
                mr->umred = 1;
-                mr->pas = kmalloc(size + 0x3f, GFP_KERNEL);
-                if (!mr->pas) {
-                        kfree(mr);
-                        err = -ENOMEM;
-                        goto out;
-                }
-                mr->dma = dma_map_single(ddev, mr_align(mr->pas, 0x40), size,
-                                         DMA_TO_DEVICE);
-                if (dma_mapping_error(ddev, mr->dma)) {
-                        kfree(mr->pas);
-                        kfree(mr);
-                        err = -ENOMEM;
-                        goto out;
-                }
                in->seg.status = 1 << 6;
                in->seg.xlt_oct_size = cpu_to_be32((npages + 1) / 2);
                in->seg.qpn_mkey7_0 = cpu_to_be32(0xffffff << 8);
@@ -108,8 +95,6 @@ static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
                                            sizeof(*in));
                if (err) {
                        mlx5_ib_warn(dev, "create mkey failed %d\n", err);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
                        kfree(mr);
                        goto out;
                }
@@ -129,11 +114,9 @@ out:
 static void remove_keys(struct mlx5_ib_dev *dev, int c, int num)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
        struct mlx5_mr_cache *cache = &dev->cache;
        struct mlx5_cache_ent *ent = &cache->ent[c];
        struct mlx5_ib_mr *mr;
-        int size;
        int err;
        int i;
@@ -149,14 +132,10 @@ static void remove_keys(struct mlx5_ib_dev *dev, int c, int num)
                ent->size--;
                spin_unlock(&ent->lock);
                err = mlx5_core_destroy_mkey(&dev->mdev, &mr->mmr);
-                if (err) {
+                if (err)
                        mlx5_ib_warn(dev, "failed destroy mkey\n");
-                } else {
+                else
-                        size = ALIGN(sizeof(u64) * (1 << mr->order), 0x40);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
                        kfree(mr);
-                }
        }
 }
@@ -408,13 +387,12 @@ static void free_cached_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 static void clean_keys(struct mlx5_ib_dev *dev, int c)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
        struct mlx5_mr_cache *cache = &dev->cache;
        struct mlx5_cache_ent *ent = &cache->ent[c];
        struct mlx5_ib_mr *mr;
-        int size;
        int err;
+        cancel_delayed_work(&ent->dwork);
        while (1) {
                spin_lock(&ent->lock);
                if (list_empty(&ent->head)) {
@@ -427,14 +405,10 @@ static void clean_keys(struct mlx5_ib_dev *dev, int c)
                ent->size--;
                spin_unlock(&ent->lock);
                err = mlx5_core_destroy_mkey(&dev->mdev, &mr->mmr);
-                if (err) {
+                if (err)
                        mlx5_ib_warn(dev, "failed destroy mkey\n");
-                } else {
+                else
-                        size = ALIGN(sizeof(u64) * (1 << mr->order), 0x40);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
                        kfree(mr);
-                }
        }
 }
@@ -540,13 +514,15 @@ int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev)
        int i;
        dev->cache.stopped = 1;
-        destroy_workqueue(dev->cache.wq);
+        flush_workqueue(dev->cache.wq);
        mlx5_mr_cache_debugfs_cleanup(dev);
        for (i = 0; i < MAX_MR_CACHE_ENTRIES; i++)
                clean_keys(dev, i);
+        destroy_workqueue(dev->cache.wq);
        return 0;
 }
@@ -675,10 +651,12 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
                                  int page_shift, int order, int access_flags)
 {
        struct mlx5_ib_dev *dev = to_mdev(pd->device);
+        struct device *ddev = dev->ib_dev.dma_device;
        struct umr_common *umrc = &dev->umrc;
        struct ib_send_wr wr, *bad;
        struct mlx5_ib_mr *mr;
        struct ib_sge sg;
+        int size = sizeof(u64) * npages;
        int err;
        int i;
@@ -697,7 +675,22 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
        if (!mr)
                return ERR_PTR(-EAGAIN);
-        mlx5_ib_populate_pas(dev, umem, page_shift, mr_align(mr->pas, 0x40), 1);
+        mr->pas = kmalloc(size + MLX5_UMR_ALIGN - 1, GFP_KERNEL);
+        if (!mr->pas) {
+                err = -ENOMEM;
+                goto error;
+        }
+        mlx5_ib_populate_pas(dev, umem, page_shift,
+                             mr_align(mr->pas, MLX5_UMR_ALIGN), 1);
+        mr->dma = dma_map_single(ddev, mr_align(mr->pas, MLX5_UMR_ALIGN), size,
+                                 DMA_TO_DEVICE);
+        if (dma_mapping_error(ddev, mr->dma)) {
+                kfree(mr->pas);
+                err = -ENOMEM;
+                goto error;
+        }
        memset(&wr, 0, sizeof(wr));
        wr.wr_id = (u64)(unsigned long)mr;
@@ -718,6 +711,9 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
        wait_for_completion(&mr->done);
        up(&umrc->sem);
+        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
+        kfree(mr->pas);
        if (mr->status != IB_WC_SUCCESS) {
                mlx5_ib_warn(dev, "reg umr failed\n");
                err = -EFAULT;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 045f8cdbd303..5659ea880741 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -203,7 +203,7 @@ static int sq_overhead(enum ib_qp_type qp_type)
        switch (qp_type) {
        case IB_QPT_XRC_INI:
-                size = sizeof(struct mlx5_wqe_xrc_seg);
+                size += sizeof(struct mlx5_wqe_xrc_seg);
                /* fall through */
        case IB_QPT_RC:
                size += sizeof(struct mlx5_wqe_ctrl_seg) +
@@ -211,20 +211,23 @@ static int sq_overhead(enum ib_qp_type qp_type)
                        sizeof(struct mlx5_wqe_raddr_seg);
                break;
+        case IB_QPT_XRC_TGT:
+                return 0;
        case IB_QPT_UC:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                        sizeof(struct mlx5_wqe_raddr_seg);
                break;
        case IB_QPT_UD:
        case IB_QPT_SMI:
        case IB_QPT_GSI:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                        sizeof(struct mlx5_wqe_datagram_seg);
                break;
        case MLX5_IB_QPT_REG_UMR:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                        sizeof(struct mlx5_wqe_umr_ctrl_seg) +
                        sizeof(struct mlx5_mkey_seg);
                break;
@@ -270,7 +273,8 @@ static int calc_sq_size(struct mlx5_ib_dev *dev, struct ib_qp_init_attr *attr,
                return wqe_size;
        if (wqe_size > dev->mdev.caps.max_sq_desc_sz) {
-                mlx5_ib_dbg(dev, "\n");
+                mlx5_ib_dbg(dev, "wqe_size(%d) > max_sq_desc_sz(%d)\n",
+                            wqe_size, dev->mdev.caps.max_sq_desc_sz);
                return -EINVAL;
        }
@@ -280,9 +284,15 @@ static int calc_sq_size(struct mlx5_ib_dev *dev, struct ib_qp_init_attr *attr,
        wq_size = roundup_pow_of_two(attr->cap.max_send_wr * wqe_size);
        qp->sq.wqe_cnt = wq_size / MLX5_SEND_WQE_BB;
+        if (qp->sq.wqe_cnt > dev->mdev.caps.max_wqes) {
+                mlx5_ib_dbg(dev, "wqe count(%d) exceeds limits(%d)\n",
+                            qp->sq.wqe_cnt, dev->mdev.caps.max_wqes);
+                return -ENOMEM;
+        }
        qp->sq.wqe_shift = ilog2(MLX5_SEND_WQE_BB);
        qp->sq.max_gs = attr->cap.max_send_sge;
-        qp->sq.max_post = 1 << ilog2(wq_size / wqe_size);
+        qp->sq.max_post = wq_size / wqe_size;
+        attr->cap.max_send_wr = qp->sq.max_post;
        return wq_size;
 }
@@ -1280,6 +1290,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
                                          MLX5_QP_OPTPAR_Q_KEY,
                        [MLX5_QP_ST_MLX] = MLX5_QP_OPTPAR_PKEY_INDEX    |
                                           MLX5_QP_OPTPAR_Q_KEY,
+                        [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
+                                          MLX5_QP_OPTPAR_RRE            |
+                                          MLX5_QP_OPTPAR_RAE            |
+                                          MLX5_QP_OPTPAR_RWE            |
+                                          MLX5_QP_OPTPAR_PKEY_INDEX,
                },
        },
        [MLX5_QP_STATE_RTR] = {
@@ -1314,6 +1329,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
                [MLX5_QP_STATE_RTS] = {
                        [MLX5_QP_ST_UD]  = MLX5_QP_OPTPAR_Q_KEY,
                        [MLX5_QP_ST_MLX] = MLX5_QP_OPTPAR_Q_KEY,
+                        [MLX5_QP_ST_UC]  = MLX5_QP_OPTPAR_RWE,
+                        [MLX5_QP_ST_RC]  = MLX5_QP_OPTPAR_RNR_TIMEOUT   |
+                                           MLX5_QP_OPTPAR_RWE           |
+                                           MLX5_QP_OPTPAR_RAE           |
+                                           MLX5_QP_OPTPAR_RRE,
                },
        },
 };
@@ -1651,29 +1671,6 @@ static __always_inline void set_raddr_seg(struct mlx5_wqe_raddr_seg *rseg,
        rseg->reserved = 0;
 }
-static void set_atomic_seg(struct mlx5_wqe_atomic_seg *aseg, struct ib_send_wr *wr)
-{
-        if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP) {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.swap);
-                aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add);
-        } else if (wr->opcode == IB_WR_MASKED_ATOMIC_FETCH_AND_ADD) {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
-                aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add_mask);
-        } else {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
-                aseg->compare  = 0;
-        }
-}
-static void set_masked_atomic_seg(struct mlx5_wqe_masked_atomic_seg *aseg,
-                                  struct ib_send_wr *wr)
-{
-        aseg->swap_add          = cpu_to_be64(wr->wr.atomic.swap);
-        aseg->swap_add_mask     = cpu_to_be64(wr->wr.atomic.swap_mask);
-        aseg->compare           = cpu_to_be64(wr->wr.atomic.compare_add);
-        aseg->compare_mask      = cpu_to_be64(wr->wr.atomic.compare_add_mask);
-}
 static void set_datagram_seg(struct mlx5_wqe_datagram_seg *dseg,
                             struct ib_send_wr *wr)
 {
@@ -2063,28 +2060,11 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                        case IB_WR_ATOMIC_CMP_AND_SWP:
                        case IB_WR_ATOMIC_FETCH_AND_ADD:
-                                set_raddr_seg(seg, wr->wr.atomic.remote_addr,
-                                              wr->wr.atomic.rkey);
-                                seg  += sizeof(struct mlx5_wqe_raddr_seg);
-                                set_atomic_seg(seg, wr);
-                                seg  += sizeof(struct mlx5_wqe_atomic_seg);
-                                size += (sizeof(struct mlx5_wqe_raddr_seg) +
-                                         sizeof(struct mlx5_wqe_atomic_seg)) / 16;
-                                break;
                        case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
-                                set_raddr_seg(seg, wr->wr.atomic.remote_addr,
+                                mlx5_ib_warn(dev, "Atomic operations are not supported yet\n");
-                                              wr->wr.atomic.rkey);
+                                err = -ENOSYS;
-                                seg  += sizeof(struct mlx5_wqe_raddr_seg);
+                                *bad_wr = wr;
+                                goto out;
-                                set_masked_atomic_seg(seg, wr);
-                                seg  += sizeof(struct mlx5_wqe_masked_atomic_seg);
-                                size += (sizeof(struct mlx5_wqe_raddr_seg) +
-                                         sizeof(struct mlx5_wqe_masked_atomic_seg)) / 16;
-                                break;
                        case IB_WR_LOCAL_INV:
                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 84d297afd6a9..0aa478bc291a 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -295,7 +295,7 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
        mlx5_vfree(in);
        if (err) {
                mlx5_ib_dbg(dev, "create SRQ failed, err %d\n", err);
-                goto err_srq;
+                goto err_usr_kern_srq;
        }
        mlx5_ib_dbg(dev, "create SRQ with srqn 0x%x\n", srq->msrq.srqn);
@@ -316,6 +316,8 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 err_core:
        mlx5_core_destroy_srq(&dev->mdev, &srq->msrq);
+err_usr_kern_srq:
        if (pd->uobject)
                destroy_srq_user(pd, srq);
        else
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 7c9d35f39d75..690201738993 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -357,7 +357,7 @@ static int mthca_eq_int(struct mthca_dev *dev, struct mthca_eq *eq)
                        mthca_warn(dev, "Unhandled event %02x(%02x) on EQ %d\n",
                                   eqe->type, eqe->subtype, eq->eqn);
                        break;
-                };
+                }
                set_eqe_hw(eqe);
                ++eq->cons_index;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 4ed8235d2d36..50219ab2279d 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -150,7 +150,7 @@ enum ib_qp_state get_ibqp_state(enum ocrdma_qp_state qps)
                return IB_QPS_SQE;
        case OCRDMA_QPS_ERR:
                return IB_QPS_ERR;
-        };
+        }
        return IB_QPS_ERR;
 }
@@ -171,7 +171,7 @@ static enum ocrdma_qp_state get_ocrdma_qp_state(enum ib_qp_state qps)
                return OCRDMA_QPS_SQE;
        case IB_QPS_ERR:
                return OCRDMA_QPS_ERR;
-        };
+        }
        return OCRDMA_QPS_ERR;
 }
@@ -1982,7 +1982,7 @@ int ocrdma_mbx_create_qp(struct ocrdma_qp *qp, struct ib_qp_init_attr *attrs,
                break;
        default:
                return -EINVAL;
-        };
+        }
        cmd = ocrdma_init_emb_mqe(OCRDMA_CMD_CREATE_QP, sizeof(*cmd));
        if (!cmd)
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 56e004940f18..0ce7674621ea 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -531,7 +531,7 @@ static void ocrdma_event_handler(struct ocrdma_dev *dev, u32 event)
        case BE_DEV_DOWN:
                ocrdma_close(dev);
                break;
-        };
+        }
 }
 static struct ocrdma_driver ocrdma_drv = {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 6e982bb43c31..69f1d1221a6b 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -141,7 +141,7 @@ static inline void get_link_speed_and_width(struct ocrdma_dev *dev,
                /* Unsupported */
                *ib_speed = IB_SPEED_SDR;
                *ib_width = IB_WIDTH_1X;
-        };
+        }
 }
@@ -2331,7 +2331,7 @@ static enum ib_wc_status ocrdma_to_ibwc_err(u16 status)
        default:
                ibwc_status = IB_WC_GENERAL_ERR;
                break;
-        };
+        }
        return ibwc_status;
 }
@@ -2370,7 +2370,7 @@ static void ocrdma_update_wc(struct ocrdma_qp *qp, struct ib_wc *ibwc,
                pr_err("%s() invalid opcode received = 0x%x\n",
                       __func__, hdr->cw & OCRDMA_WQE_OPCODE_MASK);
                break;
-        };
+        }
 }
 static void ocrdma_set_cqe_status_flushed(struct ocrdma_qp *qp,
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 653ac6bfc57a..6c923c7039a1 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1588,7 +1588,7 @@ static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
        int resp_data_len;
        int resp_len;
-        resp_data_len = (rsp_code == SRP_TSK_MGMT_SUCCESS) ? 0 : 4;
+        resp_data_len = 4;
        resp_len = sizeof(*srp_rsp) + resp_data_len;
        srp_rsp = ioctx->ioctx.buf;
@@ -1600,11 +1600,9 @@ static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
                                    + atomic_xchg(&ch->req_lim_delta, 0));
        srp_rsp->tag = tag;
-        if (rsp_code != SRP_TSK_MGMT_SUCCESS) {
+        srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
-                srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
+        srp_rsp->resp_data_len = cpu_to_be32(resp_data_len);
-                srp_rsp->resp_data_len = cpu_to_be32(resp_data_len);
+        srp_rsp->data[3] = rsp_code;
-                srp_rsp->data[3] = rsp_code;
-        }
        return resp_len;
 }
@@ -2358,6 +2356,8 @@ static void srpt_release_channel_work(struct work_struct *w)
        transport_deregister_session(se_sess);
        ch->sess = NULL;
+        ib_destroy_cm_id(ch->cm_id);
        srpt_destroy_ch_ib(ch);
        srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring,
@@ -2368,8 +2368,6 @@ static void srpt_release_channel_work(struct work_struct *w)
        list_del(&ch->list);
        spin_unlock_irq(&sdev->spinlock);
-        ib_destroy_cm_id(ch->cm_id);
        if (ch->release_done)
                complete(ch->release_done);
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index fe302e33f72e..c880ebaf1553 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -52,7 +52,7 @@ config AMD_IOMMU
        select PCI_PRI
        select PCI_PASID
        select IOMMU_API
-        depends on X86_64 && PCI && ACPI && X86_IO_APIC
+        depends on X86_64 && PCI && ACPI
        ---help---
          With this option you can enable support for AMD IOMMU hardware in
          your system. An IOMMU is a hardware component which provides
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index f417e89e1e7e..181c9ba929cd 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -377,6 +377,7 @@ struct arm_smmu_cfg {
        u32                             cbar;
        pgd_t                           *pgd;
 };
+#define INVALID_IRPTNDX                 0xff
 #define ARM_SMMU_CB_ASID(cfg)           ((cfg)->cbndx)
 #define ARM_SMMU_CB_VMID(cfg)           ((cfg)->cbndx + 1)
@@ -840,7 +841,7 @@ static int arm_smmu_init_domain_context(struct iommu_domain *domain,
        if (IS_ERR_VALUE(ret)) {
                dev_err(smmu->dev, "failed to request context IRQ %d (%u)\n",
                        root_cfg->irptndx, irq);
-                root_cfg->irptndx = -1;
+                root_cfg->irptndx = INVALID_IRPTNDX;
                goto out_free_context;
        }
@@ -869,7 +870,7 @@ static void arm_smmu_destroy_domain_context(struct iommu_domain *domain)
        writel_relaxed(0, cb_base + ARM_SMMU_CB_SCTLR);
        arm_smmu_tlb_inv_context(root_cfg);
-        if (root_cfg->irptndx != -1) {
+        if (root_cfg->irptndx != INVALID_IRPTNDX) {
                irq = smmu->irqs[smmu->num_global_irqs + root_cfg->irptndx];
                free_irq(irq, domain);
        }
@@ -1857,8 +1858,6 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
                goto out_put_parent;
        }
-        arm_smmu_device_reset(smmu);
        for (i = 0; i < smmu->num_global_irqs; ++i) {
                err = request_irq(smmu->irqs[i],
                                  arm_smmu_global_fault,
@@ -1876,6 +1875,8 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
        spin_lock(&arm_smmu_devices_lock);
        list_add(&smmu->list, &arm_smmu_devices);
        spin_unlock(&arm_smmu_devices_lock);
+        arm_smmu_device_reset(smmu);
        return 0;
 out_free_irqs:
@@ -1966,10 +1967,10 @@ static int __init arm_smmu_init(void)
                return ret;
        /* Oh, for a proper bus abstraction */
-        if (!iommu_present(&platform_bus_type));
+        if (!iommu_present(&platform_bus_type))
                bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
-        if (!iommu_present(&amba_bustype));
+        if (!iommu_present(&amba_bustype))
                bus_set_iommu(&amba_bustype, &arm_smmu_ops);
        return 0;
diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index 7f910c76ca0a..3c92780bda09 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -2295,8 +2295,8 @@ _hfcpci_softirq(struct device *dev, void *arg)
 static void
 hfcpci_softirq(void *arg)
 {
-        (void) driver_for_each_device(&hfc_driver.driver, NULL, arg,
+        WARN_ON_ONCE(driver_for_each_device(&hfc_driver.driver, NULL, arg,
-                                      _hfcpci_softirq);
+                                      _hfcpci_softirq) != 0);
        /* if next event would be in the past ... */
        if ((s32)(hfc_jiffies + tics - jiffies) <= 0)
diff --git a/drivers/isdn/hisax/amd7930_fn.c b/drivers/isdn/hisax/amd7930_fn.c
index 1063babe1d3a..36817e0a0b94 100644
--- a/drivers/isdn/hisax/amd7930_fn.c
+++ b/drivers/isdn/hisax/amd7930_fn.c
@@ -314,7 +314,7 @@ Amd7930_empty_Dfifo(struct IsdnCardState *cs, int flag)
                                                        t += sprintf(t, "Amd7930: empty_Dfifo cnt: %d |", cs->rcvidx);
                                                        QuickHex(t, cs->rcvbuf, cs->rcvidx);
-                                                        debugl1(cs, cs->dlog);
+                                                        debugl1(cs, "%s", cs->dlog);
                                                }
                                                /* moves received data in sk-buffer */
                                                memcpy(skb_put(skb, cs->rcvidx), cs->rcvbuf, cs->rcvidx);
@@ -406,7 +406,7 @@ Amd7930_fill_Dfifo(struct IsdnCardState *cs)
                t += sprintf(t, "Amd7930: fill_Dfifo cnt: %d |", count);
                QuickHex(t, deb_ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
        /* AMD interrupts on */
        AmdIrqOn(cs);
diff --git a/drivers/isdn/hisax/avm_pci.c b/drivers/isdn/hisax/avm_pci.c
index ee9b9a03cffa..d1427bd6452d 100644
--- a/drivers/isdn/hisax/avm_pci.c
+++ b/drivers/isdn/hisax/avm_pci.c
@@ -285,7 +285,7 @@ hdlc_empty_fifo(struct BCState *bcs, int count)
                t += sprintf(t, "hdlc_empty_fifo %c cnt %d",
                             bcs->channel ? 'B' : 'A', count);
                QuickHex(t, p, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
@@ -345,7 +345,7 @@ hdlc_fill_fifo(struct BCState *bcs)
                t += sprintf(t, "hdlc_fill_fifo %c cnt %d",
                             bcs->channel ? 'B' : 'A', count);
                QuickHex(t, p, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index bf04d2a3cf4a..b33f53b3ca93 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -1896,7 +1896,7 @@ static void EChannel_proc_rcv(struct hisax_d_if *d_if)
                                ptr--;
                                *ptr++ = '\n';
                                *ptr = 0;
-                                HiSax_putstatus(cs, NULL, cs->dlog);
+                                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
                        } else
                                HiSax_putstatus(cs, "LogEcho: ",
                                                "warning Frame too big (%d)",
diff --git a/drivers/isdn/hisax/diva.c b/drivers/isdn/hisax/diva.c
index 8d0cf6e4dc00..4fc90de68d18 100644
--- a/drivers/isdn/hisax/diva.c
+++ b/drivers/isdn/hisax/diva.c
@@ -427,7 +427,7 @@ Memhscx_empty_fifo(struct BCState *bcs, int count)
                t += sprintf(t, "hscx_empty_fifo %c cnt %d",
                             bcs->hw.hscx.hscx ? 'B' : 'A', count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
@@ -469,7 +469,7 @@ Memhscx_fill_fifo(struct BCState *bcs)
                t += sprintf(t, "hscx_fill_fifo %c cnt %d",
                             bcs->hw.hscx.hscx ? 'B' : 'A', count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
diff --git a/drivers/isdn/hisax/elsa.c b/drivers/isdn/hisax/elsa.c
index 1df6f9a56ca2..2be1c8a3bb5f 100644
--- a/drivers/isdn/hisax/elsa.c
+++ b/drivers/isdn/hisax/elsa.c
@@ -535,7 +535,7 @@ check_arcofi(struct IsdnCardState *cs)
                t = tmp;
                t += sprintf(tmp, "Arcofi data");
                QuickHex(t, p, cs->dc.isac.mon_rxp);
-                debugl1(cs, tmp);
+                debugl1(cs, "%s", tmp);
                if ((cs->dc.isac.mon_rxp == 2) && (cs->dc.isac.mon_rx[0] == 0xa0)) {
                        switch (cs->dc.isac.mon_rx[1]) {
                        case 0x80:
diff --git a/drivers/isdn/hisax/elsa_ser.c b/drivers/isdn/hisax/elsa_ser.c
index d4c98d330bfe..3f84dd8f1757 100644
--- a/drivers/isdn/hisax/elsa_ser.c
+++ b/drivers/isdn/hisax/elsa_ser.c
@@ -344,7 +344,7 @@ static inline void receive_chars(struct IsdnCardState *cs,
                t += sprintf(t, "modem read cnt %d", cs->hw.elsa.rcvcnt);
                QuickHex(t, cs->hw.elsa.rcvbuf, cs->hw.elsa.rcvcnt);
-                debugl1(cs, tmp);
+                debugl1(cs, "%s", tmp);
        }
        cs->hw.elsa.rcvcnt = 0;
 }
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 3ccd724ff8c2..497bd026c237 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -901,7 +901,7 @@ Begin:
                                        ptr--;
                                        *ptr++ = '\n';
                                        *ptr = 0;
-                                        HiSax_putstatus(cs, NULL, cs->dlog);
+                                        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
                                } else
                                        HiSax_putstatus(cs, "LogEcho: ", "warning Frame too big (%d)", total - 3);
                        }
diff --git a/drivers/isdn/hisax/hfc_sx.c b/drivers/isdn/hisax/hfc_sx.c
index dc4574f735ef..fa1fefd711cd 100644
--- a/drivers/isdn/hisax/hfc_sx.c
+++ b/drivers/isdn/hisax/hfc_sx.c
@@ -674,7 +674,7 @@ receive_emsg(struct IsdnCardState *cs)
                                        ptr--;
                                        *ptr++ = '\n';
                                        *ptr = 0;
-                                        HiSax_putstatus(cs, NULL, cs->dlog);
+                                        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
                                } else
                                        HiSax_putstatus(cs, "LogEcho: ", "warning Frame too big (%d)", skb->len);
                        }
diff --git a/drivers/isdn/hisax/hscx_irq.c b/drivers/isdn/hisax/hscx_irq.c
index f398d4838937..a8d6188402c6 100644
--- a/drivers/isdn/hisax/hscx_irq.c
+++ b/drivers/isdn/hisax/hscx_irq.c
@@ -75,7 +75,7 @@ hscx_empty_fifo(struct BCState *bcs, int count)
                t += sprintf(t, "hscx_empty_fifo %c cnt %d",
                             bcs->hw.hscx.hscx ? 'B' : 'A', count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
@@ -115,7 +115,7 @@ hscx_fill_fifo(struct BCState *bcs)
                t += sprintf(t, "hscx_fill_fifo %c cnt %d",
                             bcs->hw.hscx.hscx ? 'B' : 'A', count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
diff --git a/drivers/isdn/hisax/icc.c b/drivers/isdn/hisax/icc.c
index db5321f6379b..51dae9167238 100644
--- a/drivers/isdn/hisax/icc.c
+++ b/drivers/isdn/hisax/icc.c
@@ -134,7 +134,7 @@ icc_empty_fifo(struct IsdnCardState *cs, int count)
                t += sprintf(t, "icc_empty_fifo cnt %d", count);
                QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
 }
@@ -176,7 +176,7 @@ icc_fill_fifo(struct IsdnCardState *cs)
                t += sprintf(t, "icc_fill_fifo cnt %d", count);
                QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
 }
diff --git a/drivers/isdn/hisax/ipacx.c b/drivers/isdn/hisax/ipacx.c
index 74feb5c83067..5faa5de24305 100644
--- a/drivers/isdn/hisax/ipacx.c
+++ b/drivers/isdn/hisax/ipacx.c
@@ -260,7 +260,7 @@ dch_empty_fifo(struct IsdnCardState *cs, int count)
                t += sprintf(t, "dch_empty_fifo() cnt %d", count);
                QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
 }
@@ -307,7 +307,7 @@ dch_fill_fifo(struct IsdnCardState *cs)
                t += sprintf(t, "dch_fill_fifo() cnt %d", count);
                QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
 }
@@ -539,7 +539,7 @@ bch_empty_fifo(struct BCState *bcs, int count)
                t += sprintf(t, "bch_empty_fifo() B-%d cnt %d", hscx, count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
@@ -582,7 +582,7 @@ bch_fill_fifo(struct BCState *bcs)
                t += sprintf(t, "chb_fill_fifo() B-%d cnt %d", hscx, count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
diff --git a/drivers/isdn/hisax/isac.c b/drivers/isdn/hisax/isac.c
index a365ccc1c99c..7fdf78f46433 100644
--- a/drivers/isdn/hisax/isac.c
+++ b/drivers/isdn/hisax/isac.c
@@ -137,7 +137,7 @@ isac_empty_fifo(struct IsdnCardState *cs, int count)
                t += sprintf(t, "isac_empty_fifo cnt %d", count);
                QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
 }
@@ -179,7 +179,7 @@ isac_fill_fifo(struct IsdnCardState *cs)
                t += sprintf(t, "isac_fill_fifo cnt %d", count);
                QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
 }
diff --git a/drivers/isdn/hisax/isar.c b/drivers/isdn/hisax/isar.c
index 7fdf34704fe5..f4956c73aa11 100644
--- a/drivers/isdn/hisax/isar.c
+++ b/drivers/isdn/hisax/isar.c
@@ -74,7 +74,7 @@ sendmsg(struct IsdnCardState *cs, u_char his, u_char creg, u_char len,
                                t = tmp;
                                t += sprintf(t, "sendmbox cnt %d", len);
                                QuickHex(t, &msg[len-i], (i > 64) ? 64 : i);
-                                debugl1(cs, tmp);
+                                debugl1(cs, "%s", tmp);
                                i -= 64;
                        }
                }
@@ -105,7 +105,7 @@ rcv_mbox(struct IsdnCardState *cs, struct isar_reg *ireg, u_char *msg)
                                t = tmp;
                                t += sprintf(t, "rcv_mbox cnt %d", ireg->clsb);
                                QuickHex(t, &msg[ireg->clsb - i], (i > 64) ? 64 : i);
-                                debugl1(cs, tmp);
+                                debugl1(cs, "%s", tmp);
                                i -= 64;
                        }
                }
@@ -1248,7 +1248,7 @@ isar_int_main(struct IsdnCardState *cs)
                        tp += sprintf(debbuf, "msg iis(%x) msb(%x)",
                                      ireg->iis, ireg->cmsb);
                        QuickHex(tp, (u_char *)ireg->par, ireg->clsb);
-                        debugl1(cs, debbuf);
+                        debugl1(cs, "%s", debbuf);
                }
                break;
        case ISAR_IIS_INVMSG:
diff --git a/drivers/isdn/hisax/jade.c b/drivers/isdn/hisax/jade.c
index f946c58d8ab1..e2ae7871a209 100644
--- a/drivers/isdn/hisax/jade.c
+++ b/drivers/isdn/hisax/jade.c
@@ -81,10 +81,7 @@ modejade(struct BCState *bcs, int mode, int bc)
        int jade = bcs->hw.hscx.hscx;
        if (cs->debug & L1_DEB_HSCX) {
-                char tmp[40];
+                debugl1(cs, "jade %c mode %d ichan %d", 'A' + jade, mode, bc);
-                sprintf(tmp, "jade %c mode %d ichan %d",
-                        'A' + jade, mode, bc);
-                debugl1(cs, tmp);
        }
        bcs->mode = mode;
        bcs->channel = bc;
@@ -257,23 +254,18 @@ void
 clear_pending_jade_ints(struct IsdnCardState *cs)
 {
        int val;
-        char tmp[64];
        cs->BC_Write_Reg(cs, 0, jade_HDLC_IMR, 0x00);
        cs->BC_Write_Reg(cs, 1, jade_HDLC_IMR, 0x00);
        val = cs->BC_Read_Reg(cs, 1, jade_HDLC_ISR);
-        sprintf(tmp, "jade B ISTA %x", val);
+        debugl1(cs, "jade B ISTA %x", val);
-        debugl1(cs, tmp);
        val = cs->BC_Read_Reg(cs, 0, jade_HDLC_ISR);
-        sprintf(tmp, "jade A ISTA %x", val);
+        debugl1(cs, "jade A ISTA %x", val);
-        debugl1(cs, tmp);
        val = cs->BC_Read_Reg(cs, 1, jade_HDLC_STAR);
-        sprintf(tmp, "jade B STAR %x", val);
+        debugl1(cs, "jade B STAR %x", val);
-        debugl1(cs, tmp);
        val = cs->BC_Read_Reg(cs, 0, jade_HDLC_STAR);
-        sprintf(tmp, "jade A STAR %x", val);
+        debugl1(cs, "jade A STAR %x", val);
-        debugl1(cs, tmp);
        /* Unmask ints */
        cs->BC_Write_Reg(cs, 0, jade_HDLC_IMR, 0xF8);
        cs->BC_Write_Reg(cs, 1, jade_HDLC_IMR, 0xF8);
diff --git a/drivers/isdn/hisax/jade_irq.c b/drivers/isdn/hisax/jade_irq.c
index f521fc83dc76..b930da9b5aa6 100644
--- a/drivers/isdn/hisax/jade_irq.c
+++ b/drivers/isdn/hisax/jade_irq.c
@@ -65,7 +65,7 @@ jade_empty_fifo(struct BCState *bcs, int count)
                t += sprintf(t, "jade_empty_fifo %c cnt %d",
                             bcs->hw.hscx.hscx ? 'B' : 'A', count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
@@ -105,7 +105,7 @@ jade_fill_fifo(struct BCState *bcs)
                t += sprintf(t, "jade_fill_fifo %c cnt %d",
                             bcs->hw.hscx.hscx ? 'B' : 'A', count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
diff --git a/drivers/isdn/hisax/l3_1tr6.c b/drivers/isdn/hisax/l3_1tr6.c
index 4c1bca5caa1d..875402e76d0a 100644
--- a/drivers/isdn/hisax/l3_1tr6.c
+++ b/drivers/isdn/hisax/l3_1tr6.c
@@ -63,7 +63,7 @@ l3_1tr6_error(struct l3_process *pc, u_char *msg, struct sk_buff *skb)
 {
        dev_kfree_skb(skb);
        if (pc->st->l3.debug & L3_DEB_WARN)
-                l3_debug(pc->st, msg);
+                l3_debug(pc->st, "%s", msg);
        l3_1tr6_release_req(pc, 0, NULL);
 }
@@ -161,7 +161,6 @@ l3_1tr6_setup(struct l3_process *pc, u_char pr, void *arg)
 {
        u_char *p;
        int bcfound = 0;
-        char tmp[80];
        struct sk_buff *skb = arg;
        /* Channel Identification */
@@ -214,10 +213,9 @@ l3_1tr6_setup(struct l3_process *pc, u_char pr, void *arg)
        /* Signal all services, linklevel takes care of Service-Indicator */
        if (bcfound) {
                if ((pc->para.setup.si1 != 7) && (pc->st->l3.debug & L3_DEB_WARN)) {
-                        sprintf(tmp, "non-digital call: %s -> %s",
+                        l3_debug(pc->st, "non-digital call: %s -> %s",
                                pc->para.setup.phone,
                                pc->para.setup.eazmsn);
-                        l3_debug(pc->st, tmp);
                }
                newl3state(pc, 6);
                pc->st->l3.l3l4(pc->st, CC_SETUP | INDICATION, pc);
@@ -301,7 +299,7 @@ l3_1tr6_info(struct l3_process *pc, u_char pr, void *arg)
 {
        u_char *p;
        int i, tmpcharge = 0;
-        char a_charge[8], tmp[32];
+        char a_charge[8];
        struct sk_buff *skb = arg;
        p = skb->data;
@@ -316,8 +314,8 @@ l3_1tr6_info(struct l3_process *pc, u_char pr, void *arg)
                        pc->st->l3.l3l4(pc->st, CC_CHARGE | INDICATION, pc);
                }
                if (pc->st->l3.debug & L3_DEB_CHARGE) {
-                        sprintf(tmp, "charging info %d", pc->para.chargeinfo);
+                        l3_debug(pc->st, "charging info %d",
-                        l3_debug(pc->st, tmp);
+                                 pc->para.chargeinfo);
                }
        } else if (pc->st->l3.debug & L3_DEB_CHARGE)
                l3_debug(pc->st, "charging info not found");
@@ -399,7 +397,7 @@ l3_1tr6_disc(struct l3_process *pc, u_char pr, void *arg)
        struct sk_buff *skb = arg;
        u_char *p;
        int i, tmpcharge = 0;
-        char a_charge[8], tmp[32];
+        char a_charge[8];
        StopAllL3Timer(pc);
        p = skb->data;
@@ -414,8 +412,8 @@ l3_1tr6_disc(struct l3_process *pc, u_char pr, void *arg)
                        pc->st->l3.l3l4(pc->st, CC_CHARGE | INDICATION, pc);
                }
                if (pc->st->l3.debug & L3_DEB_CHARGE) {
-                        sprintf(tmp, "charging info %d", pc->para.chargeinfo);
+                        l3_debug(pc->st, "charging info %d",
-                        l3_debug(pc->st, tmp);
+                                 pc->para.chargeinfo);
                }
        } else if (pc->st->l3.debug & L3_DEB_CHARGE)
                l3_debug(pc->st, "charging info not found");
@@ -746,7 +744,6 @@ up1tr6(struct PStack *st, int pr, void *arg)
        int i, mt, cr;
        struct l3_process *proc;
        struct sk_buff *skb = arg;
-        char tmp[80];
        switch (pr) {
        case (DL_DATA | INDICATION):
@@ -762,26 +759,23 @@ up1tr6(struct PStack *st, int pr, void *arg)
        }
        if (skb->len < 4) {
                if (st->l3.debug & L3_DEB_PROTERR) {
-                        sprintf(tmp, "up1tr6 len only %d", skb->len);
+                        l3_debug(st, "up1tr6 len only %d", skb->len);
-                        l3_debug(st, tmp);
                }
                dev_kfree_skb(skb);
                return;
        }
        if ((skb->data[0] & 0xfe) != PROTO_DIS_N0) {
                if (st->l3.debug & L3_DEB_PROTERR) {
-                        sprintf(tmp, "up1tr6%sunexpected discriminator %x message len %d",
+                        l3_debug(st, "up1tr6%sunexpected discriminator %x message len %d",
                                (pr == (DL_DATA | INDICATION)) ? " " : "(broadcast) ",
                                skb->data[0], skb->len);
-                        l3_debug(st, tmp);
                }
                dev_kfree_skb(skb);
                return;
        }
        if (skb->data[1] != 1) {
                if (st->l3.debug & L3_DEB_PROTERR) {
-                        sprintf(tmp, "up1tr6 CR len not 1");
+                        l3_debug(st, "up1tr6 CR len not 1");
-                        l3_debug(st, tmp);
                }
                dev_kfree_skb(skb);
                return;
@@ -791,9 +785,8 @@ up1tr6(struct PStack *st, int pr, void *arg)
        if (skb->data[0] == PROTO_DIS_N0) {
                dev_kfree_skb(skb);
                if (st->l3.debug & L3_DEB_STATE) {
-                        sprintf(tmp, "up1tr6%s N0 mt %x unhandled",
+                        l3_debug(st, "up1tr6%s N0 mt %x unhandled",
                                (pr == (DL_DATA | INDICATION)) ? " " : "(broadcast) ", mt);
-                        l3_debug(st, tmp);
                }
        } else if (skb->data[0] == PROTO_DIS_N1) {
                if (!(proc = getl3proc(st, cr))) {
@@ -801,8 +794,7 @@ up1tr6(struct PStack *st, int pr, void *arg)
                                if (cr < 128) {
                                        if (!(proc = new_l3_process(st, cr))) {
                                                if (st->l3.debug & L3_DEB_PROTERR) {
-                                                        sprintf(tmp, "up1tr6 no roc mem");
+                                                        l3_debug(st, "up1tr6 no roc mem");
-                                                        l3_debug(st, tmp);
                                                }
                                                dev_kfree_skb(skb);
                                                return;
@@ -821,8 +813,7 @@ up1tr6(struct PStack *st, int pr, void *arg)
                        } else {
                                if (!(proc = new_l3_process(st, cr))) {
                                        if (st->l3.debug & L3_DEB_PROTERR) {
-                                                sprintf(tmp, "up1tr6 no roc mem");
+                                                l3_debug(st, "up1tr6 no roc mem");
-                                                l3_debug(st, tmp);
                                        }
                                        dev_kfree_skb(skb);
                                        return;
@@ -837,18 +828,16 @@ up1tr6(struct PStack *st, int pr, void *arg)
                if (i == ARRAY_SIZE(datastln1)) {
                        dev_kfree_skb(skb);
                        if (st->l3.debug & L3_DEB_STATE) {
-                                sprintf(tmp, "up1tr6%sstate %d mt %x unhandled",
+                                l3_debug(st, "up1tr6%sstate %d mt %x unhandled",
                                        (pr == (DL_DATA | INDICATION)) ? " " : "(broadcast) ",
                                        proc->state, mt);
-                                l3_debug(st, tmp);
                        }
                        return;
                } else {
                        if (st->l3.debug & L3_DEB_STATE) {
-                                sprintf(tmp, "up1tr6%sstate %d mt %x",
+                                l3_debug(st, "up1tr6%sstate %d mt %x",
                                        (pr == (DL_DATA | INDICATION)) ? " " : "(broadcast) ",
                                        proc->state, mt);
-                                l3_debug(st, tmp);
                        }
                        datastln1[i].rout(proc, pr, skb);
                }
@@ -861,7 +850,6 @@ down1tr6(struct PStack *st, int pr, void *arg)
        int i, cr;
        struct l3_process *proc;
        struct Channel *chan;
-        char tmp[80];
        if ((DL_ESTABLISH | REQUEST) == pr) {
                l3_msg(st, pr, NULL);
@@ -888,15 +876,13 @@ down1tr6(struct PStack *st, int pr, void *arg)
                        break;
        if (i == ARRAY_SIZE(downstl)) {
                if (st->l3.debug & L3_DEB_STATE) {
-                        sprintf(tmp, "down1tr6 state %d prim %d unhandled",
+                        l3_debug(st, "down1tr6 state %d prim %d unhandled",
                                proc->state, pr);
-                        l3_debug(st, tmp);
                }
        } else {
                if (st->l3.debug & L3_DEB_STATE) {
-                        sprintf(tmp, "down1tr6 state %d prim %d",
+                        l3_debug(st, "down1tr6 state %d prim %d",
                                proc->state, pr);
-                        l3_debug(st, tmp);
                }
                downstl[i].rout(proc, pr, arg);
        }
diff --git a/drivers/isdn/hisax/netjet.c b/drivers/isdn/hisax/netjet.c
index b646eed379df..233e432e06f6 100644
--- a/drivers/isdn/hisax/netjet.c
+++ b/drivers/isdn/hisax/netjet.c
@@ -176,7 +176,7 @@ static void printframe(struct IsdnCardState *cs, u_char *buf, int count, char *s
                else
                        j = i;
                QuickHex(t, p, j);
-                debugl1(cs, tmp);
+                debugl1(cs, "%s", tmp);
                p += j;
                i -= j;
                t = tmp;
diff --git a/drivers/isdn/hisax/q931.c b/drivers/isdn/hisax/q931.c
index 041bf52d9d0a..af1b020a81f1 100644
--- a/drivers/isdn/hisax/q931.c
+++ b/drivers/isdn/hisax/q931.c
@@ -1179,7 +1179,7 @@ LogFrame(struct IsdnCardState *cs, u_char *buf, int size)
                dp--;
                *dp++ = '\n';
                *dp = 0;
-                HiSax_putstatus(cs, NULL, cs->dlog);
+                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
        } else
                HiSax_putstatus(cs, "LogFrame: ", "warning Frame too big (%d)", size);
 }
@@ -1246,7 +1246,7 @@ dlogframe(struct IsdnCardState *cs, struct sk_buff *skb, int dir)
        }
        if (finish) {
                *dp = 0;
-                HiSax_putstatus(cs, NULL, cs->dlog);
+                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
                return;
        }
        if ((0xfe & buf[0]) == PROTO_DIS_N0) {  /* 1TR6 */
@@ -1509,5 +1509,5 @@ dlogframe(struct IsdnCardState *cs, struct sk_buff *skb, int dir)
                dp += sprintf(dp, "Unknown protocol %x!", buf[0]);
        }
        *dp = 0;
-        HiSax_putstatus(cs, NULL, cs->dlog);
+        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
 }
diff --git a/drivers/isdn/hisax/w6692.c b/drivers/isdn/hisax/w6692.c
index d8cac6935818..a85895585d90 100644
--- a/drivers/isdn/hisax/w6692.c
+++ b/drivers/isdn/hisax/w6692.c
@@ -154,7 +154,7 @@ W6692_empty_fifo(struct IsdnCardState *cs, int count)
                t += sprintf(t, "W6692_empty_fifo cnt %d", count);
                QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
 }
@@ -196,7 +196,7 @@ W6692_fill_fifo(struct IsdnCardState *cs)
                t += sprintf(t, "W6692_fill_fifo cnt %d", count);
                QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
        }
 }
@@ -226,7 +226,7 @@ W6692B_empty_fifo(struct BCState *bcs, int count)
                t += sprintf(t, "W6692B_empty_fifo %c cnt %d",
                             bcs->channel + '1', count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
@@ -264,7 +264,7 @@ W6692B_fill_fifo(struct BCState *bcs)
                t += sprintf(t, "W6692B_fill_fifo %c cnt %d",
                             bcs->channel + '1', count);
                QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
        }
 }
diff --git a/drivers/mailbox/mailbox-omap2.c b/drivers/mailbox/mailbox-omap2.c
index eba380d7b17f..42d2b893ea67 100644
--- a/drivers/mailbox/mailbox-omap2.c
+++ b/drivers/mailbox/mailbox-omap2.c
@@ -325,7 +325,6 @@ static int omap2_mbox_remove(struct platform_device *pdev)
        kfree(privblk);
        kfree(mboxblk);
        kfree(list);
-        platform_set_drvdata(pdev, NULL);
        return 0;
 }
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index b39f6f0b45f2..0f12382aa35d 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -498,7 +498,7 @@ struct cached_dev {
         */
        atomic_t                has_dirty;
-        struct ratelimit        writeback_rate;
+        struct bch_ratelimit    writeback_rate;
        struct delayed_work     writeback_rate_update;
        /*
@@ -507,10 +507,9 @@ struct cached_dev {
         */
        sector_t                last_read;
-        /* Number of writeback bios in flight */
+        /* Limit number of writeback bios in flight */
-        atomic_t                in_flight;
+        struct semaphore        in_flight;
        struct closure_with_timer writeback;
-        struct closure_waitlist writeback_wait;
        struct keybuf           writeback_keys;
diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
index 8010eed06a51..22d1ae72c282 100644
--- a/drivers/md/bcache/bset.c
+++ b/drivers/md/bcache/bset.c
@@ -926,28 +926,45 @@ struct bkey *bch_next_recurse_key(struct btree *b, struct bkey *search)
 /* Mergesort */
+static void sort_key_next(struct btree_iter *iter,
+                          struct btree_iter_set *i)
+{
+        i->k = bkey_next(i->k);
+        if (i->k == i->end)
+                *i = iter->data[--iter->used];
+}
 static void btree_sort_fixup(struct btree_iter *iter)
 {
        while (iter->used > 1) {
                struct btree_iter_set *top = iter->data, *i = top + 1;
-                struct bkey *k;
                if (iter->used > 2 &&
                    btree_iter_cmp(i[0], i[1]))
                        i++;
-                for (k = i->k;
+                if (bkey_cmp(top->k, &START_KEY(i->k)) <= 0)
-                     k != i->end && bkey_cmp(top->k, &START_KEY(k)) > 0;
-                     k = bkey_next(k))
-                        if (top->k > i->k)
-                                __bch_cut_front(top->k, k);
-                        else if (KEY_SIZE(k))
-                                bch_cut_back(&START_KEY(k), top->k);
-                if (top->k < i->k || k == i->k)
                        break;
-                heap_sift(iter, i - top, btree_iter_cmp);
+                if (!KEY_SIZE(i->k)) {
+                        sort_key_next(iter, i);
+                        heap_sift(iter, i - top, btree_iter_cmp);
+                        continue;
+                }
+                if (top->k > i->k) {
+                        if (bkey_cmp(top->k, i->k) >= 0)
+                                sort_key_next(iter, i);
+                        else
+                                bch_cut_front(top->k, i->k);
+                        heap_sift(iter, i - top, btree_iter_cmp);
+                } else {
+                        /* can't happen because of comparison func */
+                        BUG_ON(!bkey_cmp(&START_KEY(top->k), &START_KEY(i->k)));
+                        bch_cut_back(&START_KEY(i->k), top->k);
+                }
        }
 }
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index f9764e61978b..f42fc7ed9cd6 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -255,7 +255,7 @@ void bch_btree_node_read(struct btree *b)
        return;
 err:
-        bch_cache_set_error(b->c, "io error reading bucket %lu",
+        bch_cache_set_error(b->c, "io error reading bucket %zu",
                            PTR_BUCKET_NR(b->c, &b->key, 0));
 }
@@ -612,7 +612,7 @@ static unsigned long bch_mca_scan(struct shrinker *shrink,
                return SHRINK_STOP;
        /* Return -1 if we can't do anything right now */
-        if (sc->gfp_mask & __GFP_WAIT)
+        if (sc->gfp_mask & __GFP_IO)
                mutex_lock(&c->bucket_lock);
        else if (!mutex_trylock(&c->bucket_lock))
                return -1;
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index ba95ab84b2be..8435f81e5d85 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -153,7 +153,8 @@ int bch_journal_read(struct cache_set *c, struct list_head *list,
                bitmap_zero(bitmap, SB_JOURNAL_BUCKETS);
                pr_debug("%u journal buckets", ca->sb.njournal_buckets);
-                /* Read journal buckets ordered by golden ratio hash to quickly
+                /*
+                 * Read journal buckets ordered by golden ratio hash to quickly
                 * find a sequence of buckets with valid journal entries
                 */
                for (i = 0; i < ca->sb.njournal_buckets; i++) {
@@ -166,18 +167,20 @@ int bch_journal_read(struct cache_set *c, struct list_head *list,
                                goto bsearch;
                }
-                /* If that fails, check all the buckets we haven't checked
+                /*
+                 * If that fails, check all the buckets we haven't checked
                 * already
                 */
                pr_debug("falling back to linear search");
-                for (l = 0; l < ca->sb.njournal_buckets; l++) {
+                for (l = find_first_zero_bit(bitmap, ca->sb.njournal_buckets);
-                        if (test_bit(l, bitmap))
+                     l < ca->sb.njournal_buckets;
-                                continue;
+                     l = find_next_zero_bit(bitmap, ca->sb.njournal_buckets, l + 1))
                        if (read_bucket(l))
                                goto bsearch;
-                }
+                if (list_empty(list))
+                        continue;
 bsearch:
                /* Binary search */
                m = r = find_next_bit(bitmap, ca->sb.njournal_buckets, l + 1);
@@ -197,10 +200,12 @@ bsearch:
                                r = m;
                }
-                /* Read buckets in reverse order until we stop finding more
+                /*
+                 * Read buckets in reverse order until we stop finding more
                 * journal entries
                 */
-                pr_debug("finishing up");
+                pr_debug("finishing up: m %u njournal_buckets %u",
+                         m, ca->sb.njournal_buckets);
                l = m;
                while (1) {
@@ -228,9 +233,10 @@ bsearch:
                        }
        }
-        c->journal.seq = list_entry(list->prev,
+        if (!list_empty(list))
-                                    struct journal_replay,
+                c->journal.seq = list_entry(list->prev,
-                                    list)->j.seq;
+                                            struct journal_replay,
+                                            list)->j.seq;
        return 0;
 #undef read_bucket
@@ -428,7 +434,7 @@ static void do_journal_discard(struct cache *ca)
                return;
        }
-        switch (atomic_read(&ja->discard_in_flight) == DISCARD_IN_FLIGHT) {
+        switch (atomic_read(&ja->discard_in_flight)) {
        case DISCARD_IN_FLIGHT:
                return;
@@ -689,6 +695,7 @@ void bch_journal_meta(struct cache_set *c, struct closure *cl)
                if (cl)
                        BUG_ON(!closure_wait(&w->wait, cl));
+                closure_flush(&c->journal.io);
                __journal_try_write(c, true);
        }
 }
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 786a1a4f74d8..b6a74bcbb08f 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -996,17 +996,19 @@ static void request_write(struct cached_dev *dc, struct search *s)
                closure_bio_submit(bio, cl, s->d);
        } else {
                bch_writeback_add(dc);
+                s->op.cache_bio = bio;
-                if (s->op.flush_journal) {
+                if (bio->bi_rw & REQ_FLUSH) {
                        /* Also need to send a flush to the backing device */
-                        s->op.cache_bio = bio_clone_bioset(bio, GFP_NOIO,
+                        struct bio *flush = bio_alloc_bioset(0, GFP_NOIO,
-                                                           dc->disk.bio_split);
+                                                             dc->disk.bio_split);
-                        bio->bi_size = 0;
+                        flush->bi_rw    = WRITE_FLUSH;
-                        bio->bi_vcnt = 0;
+                        flush->bi_bdev  = bio->bi_bdev;
-                        closure_bio_submit(bio, cl, s->d);
+                        flush->bi_end_io = request_endio;
-                } else {
+                        flush->bi_private = cl;
-                        s->op.cache_bio = bio;
+                        closure_bio_submit(flush, cl, s->d);
                }
        }
 out:
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 4fe6ab2fbe2e..924dcfdae111 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -223,8 +223,13 @@ STORE(__cached_dev)
        }
        if (attr == &sysfs_label) {
-                /* note: endlines are preserved */
+                if (size > SB_LABEL_SIZE)
-                memcpy(dc->sb.label, buf, SB_LABEL_SIZE);
+                        return -EINVAL;
+                memcpy(dc->sb.label, buf, size);
+                if (size < SB_LABEL_SIZE)
+                        dc->sb.label[size] = '\0';
+                if (size && dc->sb.label[size - 1] == '\n')
+                        dc->sb.label[size - 1] = '\0';
                bch_write_bdev_super(dc, NULL);
                if (dc->disk.c) {
                        memcpy(dc->disk.c->uuids[dc->disk.id].label,
diff --git a/drivers/md/bcache/util.c b/drivers/md/bcache/util.c
index 98eb81159a22..420dad545c7d 100644
--- a/drivers/md/bcache/util.c
+++ b/drivers/md/bcache/util.c
@@ -190,7 +190,16 @@ void bch_time_stats_update(struct time_stats *stats, uint64_t start_time)
        stats->last = now ?: 1;
 }
-unsigned bch_next_delay(struct ratelimit *d, uint64_t done)
+/**
+ * bch_next_delay() - increment @d by the amount of work done, and return how
+ * long to delay until the next time to do some work.
+ *
+ * @d - the struct bch_ratelimit to update
+ * @done - the amount of work done, in arbitrary units
+ *
+ * Returns the amount of time to delay by, in jiffies
+ */
+uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done)
 {
        uint64_t now = local_clock();
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index 1ae2a73ad85f..ea345c6896f4 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -450,17 +450,23 @@ read_attribute(name ## _last_ ## frequency_units)
        (ewma) >> factor;                                               \
 })
-struct ratelimit {
+struct bch_ratelimit {
+        /* Next time we want to do some work, in nanoseconds */
        uint64_t                next;
+        /*
+         * Rate at which we want to do work, in units per nanosecond
+         * The units here correspond to the units passed to bch_next_delay()
+         */
        unsigned                rate;
 };
-static inline void ratelimit_reset(struct ratelimit *d)
+static inline void bch_ratelimit_reset(struct bch_ratelimit *d)
 {
        d->next = local_clock();
 }
-unsigned bch_next_delay(struct ratelimit *d, uint64_t done);
+uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done);
 #define __DIV_SAFE(n, d, zero)                                          \
 ({                                                                      \
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 22cbff551628..ba3ee48320f2 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -94,11 +94,15 @@ static void update_writeback_rate(struct work_struct *work)
 static unsigned writeback_delay(struct cached_dev *dc, unsigned sectors)
 {
+        uint64_t ret;
        if (atomic_read(&dc->disk.detaching) ||
            !dc->writeback_percent)
                return 0;
-        return bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
+        ret = bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
+        return min_t(uint64_t, ret, HZ);
 }
 /* Background writeback */
@@ -208,7 +212,7 @@ normal_refill:
        up_write(&dc->writeback_lock);
-        ratelimit_reset(&dc->writeback_rate);
+        bch_ratelimit_reset(&dc->writeback_rate);
        /* Punt to workqueue only so we don't recurse and blow the stack */
        continue_at(cl, read_dirty, dirty_wq);
@@ -318,9 +322,7 @@ static void write_dirty_finish(struct closure *cl)
        }
        bch_keybuf_del(&dc->writeback_keys, w);
-        atomic_dec_bug(&dc->in_flight);
+        up(&dc->in_flight);
-        closure_wake_up(&dc->writeback_wait);
        closure_return_with_destructor(cl, dirty_io_destructor);
 }
@@ -349,7 +351,7 @@ static void write_dirty(struct closure *cl)
        closure_bio_submit(&io->bio, cl, &io->dc->disk);
-        continue_at(cl, write_dirty_finish, dirty_wq);
+        continue_at(cl, write_dirty_finish, system_wq);
 }
 static void read_dirty_endio(struct bio *bio, int error)
@@ -369,7 +371,7 @@ static void read_dirty_submit(struct closure *cl)
        closure_bio_submit(&io->bio, cl, &io->dc->disk);
-        continue_at(cl, write_dirty, dirty_wq);
+        continue_at(cl, write_dirty, system_wq);
 }
 static void read_dirty(struct closure *cl)
@@ -394,12 +396,8 @@ static void read_dirty(struct closure *cl)
                if (delay > 0 &&
                    (KEY_START(&w->key) != dc->last_read ||
-                     jiffies_to_msecs(delay) > 50)) {
+                     jiffies_to_msecs(delay) > 50))
-                        w->private = NULL;
+                        delay = schedule_timeout_uninterruptible(delay);
-                        closure_delay(&dc->writeback, delay);
-                        continue_at(cl, read_dirty, dirty_wq);
-                }
                dc->last_read   = KEY_OFFSET(&w->key);
@@ -424,15 +422,10 @@ static void read_dirty(struct closure *cl)
                trace_bcache_writeback(&w->key);
-                closure_call(&io->cl, read_dirty_submit, NULL, &dc->disk.cl);
+                down(&dc->in_flight);
+                closure_call(&io->cl, read_dirty_submit, NULL, cl);
                delay = writeback_delay(dc, KEY_SIZE(&w->key));
-                atomic_inc(&dc->in_flight);
-                if (!closure_wait_event(&dc->writeback_wait, cl,
-                                        atomic_read(&dc->in_flight) < 64))
-                        continue_at(cl, read_dirty, dirty_wq);
        }
        if (0) {
@@ -442,7 +435,11 @@ err:
                bch_keybuf_del(&dc->writeback_keys, w);
        }
-        refill_dirty(cl);
+        /*
+         * Wait for outstanding writeback IOs to finish (and keybuf slots to be
+         * freed) before refilling again
+         */
+        continue_at(cl, refill_dirty, dirty_wq);
 }
 /* Init */
@@ -484,6 +481,7 @@ void bch_sectors_dirty_init(struct cached_dev *dc)
 void bch_cached_dev_writeback_init(struct cached_dev *dc)
 {
+        sema_init(&dc->in_flight, 64);
        closure_init_unlocked(&dc->writeback);
        init_rwsem(&dc->writeback_lock);
@@ -513,7 +511,7 @@ void bch_writeback_exit(void)
 int __init bch_writeback_init(void)
 {
-        dirty_wq = create_singlethread_workqueue("bcache_writeback");
+        dirty_wq = create_workqueue("bcache_writeback");
        if (!dirty_wq)
                return -ENOMEM;
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index ea49834377c8..2a20986a2fec 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -19,8 +19,6 @@
 #define DM_MSG_PREFIX "io"
 #define DM_IO_MAX_REGIONS       BITS_PER_LONG
-#define MIN_IOS         16
-#define MIN_BIOS        16
 struct dm_io_client {
        mempool_t *pool;
@@ -50,16 +48,17 @@ static struct kmem_cache *_dm_io_cache;
 struct dm_io_client *dm_io_client_create(void)
 {
        struct dm_io_client *client;
+        unsigned min_ios = dm_get_reserved_bio_based_ios();
        client = kmalloc(sizeof(*client), GFP_KERNEL);
        if (!client)
                return ERR_PTR(-ENOMEM);
-        client->pool = mempool_create_slab_pool(MIN_IOS, _dm_io_cache);
+        client->pool = mempool_create_slab_pool(min_ios, _dm_io_cache);
        if (!client->pool)
                goto bad;
-        client->bios = bioset_create(MIN_BIOS, 0);
+        client->bios = bioset_create(min_ios, 0);
        if (!client->bios)
                goto bad;
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index b759a127f9c3..de570a558764 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -7,6 +7,7 @@
 #include <linux/device-mapper.h>
+#include "dm.h"
 #include "dm-path-selector.h"
 #include "dm-uevent.h"
@@ -116,8 +117,6 @@ struct dm_mpath_io {
 typedef int (*action_fn) (struct pgpath *pgpath);
-#define MIN_IOS 256     /* Mempool size */
 static struct kmem_cache *_mpio_cache;
 static struct workqueue_struct *kmultipathd, *kmpath_handlerd;
@@ -190,6 +189,7 @@ static void free_priority_group(struct priority_group *pg,
 static struct multipath *alloc_multipath(struct dm_target *ti)
 {
        struct multipath *m;
+        unsigned min_ios = dm_get_reserved_rq_based_ios();
        m = kzalloc(sizeof(*m), GFP_KERNEL);
        if (m) {
@@ -202,7 +202,7 @@ static struct multipath *alloc_multipath(struct dm_target *ti)
                INIT_WORK(&m->trigger_event, trigger_event);
                init_waitqueue_head(&m->pg_init_wait);
                mutex_init(&m->work_mutex);
-                m->mpio_pool = mempool_create_slab_pool(MIN_IOS, _mpio_cache);
+                m->mpio_pool = mempool_create_slab_pool(min_ios, _mpio_cache);
                if (!m->mpio_pool) {
                        kfree(m);
                        return NULL;
@@ -1268,6 +1268,7 @@ static int noretry_error(int error)
        case -EREMOTEIO:
        case -EILSEQ:
        case -ENODATA:
+        case -ENOSPC:
                return 1;
        }
@@ -1298,8 +1299,17 @@ static int do_end_io(struct multipath *m, struct request *clone,
        if (!error && !clone->errors)
                return 0;       /* I/O complete */
-        if (noretry_error(error))
+        if (noretry_error(error)) {
+                if ((clone->cmd_flags & REQ_WRITE_SAME) &&
+                    !clone->q->limits.max_write_same_sectors) {
+                        struct queue_limits *limits;
+                        /* device doesn't really support WRITE SAME, disable it */
+                        limits = dm_get_queue_limits(dm_table_get_md(m->ti->table));
+                        limits->max_write_same_sectors = 0;
+                }
                return error;
+        }
        if (mpio->pgpath)
                fail_path(mpio->pgpath);
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 3ac415675b6c..2d2b1b7588d7 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -256,7 +256,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
         */
        INIT_WORK_ONSTACK(&req.work, do_metadata);
        queue_work(ps->metadata_wq, &req.work);
-        flush_work(&req.work);
+        flush_workqueue(ps->metadata_wq);
        return req.result;
 }
@@ -269,6 +269,14 @@ static chunk_t area_location(struct pstore *ps, chunk_t area)
        return NUM_SNAPSHOT_HDR_CHUNKS + ((ps->exceptions_per_area + 1) * area);
 }
+static void skip_metadata(struct pstore *ps)
+{
+        uint32_t stride = ps->exceptions_per_area + 1;
+        chunk_t next_free = ps->next_free;
+        if (sector_div(next_free, stride) == NUM_SNAPSHOT_HDR_CHUNKS)
+                ps->next_free++;
+}
 /*
 * Read or write a metadata area.  Remembering to skip the first
 * chunk which holds the header.
@@ -502,6 +510,8 @@ static int read_exceptions(struct pstore *ps,
        ps->current_area--;
+        skip_metadata(ps);
        return 0;
 }
@@ -616,8 +626,6 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
                                        struct dm_exception *e)
 {
        struct pstore *ps = get_info(store);
-        uint32_t stride;
-        chunk_t next_free;
        sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
        /* Is there enough room ? */
@@ -630,10 +638,8 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
         * Move onto the next free pending, making sure to take
         * into account the location of the metadata chunks.
         */
-        stride = (ps->exceptions_per_area + 1);
+        ps->next_free++;
-        next_free = ++ps->next_free;
+        skip_metadata(ps);
-        if (sector_div(next_free, stride) == 1)
-                ps->next_free++;
        atomic_inc(&ps->pending_count);
        return 0;
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index c434e5aab2df..aec57d76db5d 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -725,17 +725,16 @@ static int calc_max_buckets(void)
 */
 static int init_hash_tables(struct dm_snapshot *s)
 {
-        sector_t hash_size, cow_dev_size, origin_dev_size, max_buckets;
+        sector_t hash_size, cow_dev_size, max_buckets;
        /*
         * Calculate based on the size of the original volume or
         * the COW volume...
         */
        cow_dev_size = get_dev_size(s->cow->bdev);
-        origin_dev_size = get_dev_size(s->origin->bdev);
        max_buckets = calc_max_buckets();
-        hash_size = min(origin_dev_size, cow_dev_size) >> s->store->chunk_shift;
+        hash_size = cow_dev_size >> s->store->chunk_shift;
        hash_size = min(hash_size, max_buckets);
        if (hash_size < 64)
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 8ae31e8d3d64..3d404c1371ed 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -451,19 +451,26 @@ static void dm_stat_for_entry(struct dm_stat *s, size_t entry,
        struct dm_stat_percpu *p;
        /*
-         * For strict correctness we should use local_irq_disable/enable
+         * For strict correctness we should use local_irq_save/restore
         * instead of preempt_disable/enable.
         *
-         * This is racy if the driver finishes bios from non-interrupt
+         * preempt_disable/enable is racy if the driver finishes bios
-         * context as well as from interrupt context or from more different
+         * from non-interrupt context as well as from interrupt context
-         * interrupts.
+         * or from more different interrupts.
         *
-         * However, the race only results in not counting some events,
+         * On 64-bit architectures the race only results in not counting some
-         * so it is acceptable.
+         * events, so it is acceptable.  On 32-bit architectures the race could
+         * cause the counter going off by 2^32, so we need to do proper locking
+         * there.
         *
         * part_stat_lock()/part_stat_unlock() have this race too.
         */
+#if BITS_PER_LONG == 32
+        unsigned long flags;
+        local_irq_save(flags);
+#else
        preempt_disable();
+#endif
        p = &s->stat_percpu[smp_processor_id()][entry];
        if (!end) {
@@ -478,7 +485,11 @@ static void dm_stat_for_entry(struct dm_stat *s, size_t entry,
                p->ticks[idx] += duration;
        }
+#if BITS_PER_LONG == 32
+        local_irq_restore(flags);
+#else
        preempt_enable();
+#endif
 }
 static void __dm_stat_bio(struct dm_stat *s, unsigned long bi_rw,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index ed063427d676..2c0cf511ec23 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2095,6 +2095,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
         * them down to the data device.  The thin device's discard
         * processing will cause mappings to be removed from the btree.
         */
+        ti->discard_zeroes_data_unsupported = true;
        if (pf.discard_enabled && pf.discard_passdown) {
                ti->num_discard_bios = 1;
@@ -2104,7 +2105,6 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
                 * thin devices' discard limits consistent).
                 */
                ti->discards_supported = true;
-                ti->discard_zeroes_data_unsupported = true;
        }
        ti->private = pt;
@@ -2689,8 +2689,16 @@ static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
         * They get transferred to the live pool in bind_control_target()
         * called from pool_preresume().
         */
-        if (!pt->adjusted_pf.discard_enabled)
+        if (!pt->adjusted_pf.discard_enabled) {
+                /*
+                 * Must explicitly disallow stacking discard limits otherwise the
+                 * block layer will stack them if pool's data device has support.
+                 * QUEUE_FLAG_DISCARD wouldn't be set but there is no way for the
+                 * user to see that, so make sure to set all discard limits to 0.
+                 */
+                limits->discard_granularity = 0;
                return;
+        }
        disable_passdown_if_not_supported(pt);
@@ -2826,10 +2834,10 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
        ti->per_bio_data_size = sizeof(struct dm_thin_endio_hook);
        /* In case the pool supports discards, pass them on. */
+        ti->discard_zeroes_data_unsupported = true;
        if (tc->pool->pf.discard_enabled) {
                ti->discards_supported = true;
                ti->num_discard_bios = 1;
-                ti->discard_zeroes_data_unsupported = true;
                /* Discard bios must be split on a block boundary */
                ti->split_discard_bios = true;
        }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6a5e9ed2fcc3..b3e26c7d1417 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -211,10 +211,55 @@ struct dm_md_mempools {
        struct bio_set *bs;
 };
-#define MIN_IOS 256
+#define RESERVED_BIO_BASED_IOS          16
+#define RESERVED_REQUEST_BASED_IOS      256
+#define RESERVED_MAX_IOS                1024
 static struct kmem_cache *_io_cache;
 static struct kmem_cache *_rq_tio_cache;
+/*
+ * Bio-based DM's mempools' reserved IOs set by the user.
+ */
+static unsigned reserved_bio_based_ios = RESERVED_BIO_BASED_IOS;
+/*
+ * Request-based DM's mempools' reserved IOs set by the user.
+ */
+static unsigned reserved_rq_based_ios = RESERVED_REQUEST_BASED_IOS;
+static unsigned __dm_get_reserved_ios(unsigned *reserved_ios,
+                                      unsigned def, unsigned max)
+{
+        unsigned ios = ACCESS_ONCE(*reserved_ios);
+        unsigned modified_ios = 0;
+        if (!ios)
+                modified_ios = def;
+        else if (ios > max)
+                modified_ios = max;
+        if (modified_ios) {
+                (void)cmpxchg(reserved_ios, ios, modified_ios);
+                ios = modified_ios;
+        }
+        return ios;
+}
+unsigned dm_get_reserved_bio_based_ios(void)
+{
+        return __dm_get_reserved_ios(&reserved_bio_based_ios,
+                                     RESERVED_BIO_BASED_IOS, RESERVED_MAX_IOS);
+}
+EXPORT_SYMBOL_GPL(dm_get_reserved_bio_based_ios);
+unsigned dm_get_reserved_rq_based_ios(void)
+{
+        return __dm_get_reserved_ios(&reserved_rq_based_ios,
+                                     RESERVED_REQUEST_BASED_IOS, RESERVED_MAX_IOS);
+}
+EXPORT_SYMBOL_GPL(dm_get_reserved_rq_based_ios);
 static int __init local_init(void)
 {
        int r = -ENOMEM;
@@ -2278,6 +2323,17 @@ struct target_type *dm_get_immutable_target_type(struct mapped_device *md)
 }
 /*
+ * The queue_limits are only valid as long as you have a reference
+ * count on 'md'.
+ */
+struct queue_limits *dm_get_queue_limits(struct mapped_device *md)
+{
+        BUG_ON(!atomic_read(&md->holders));
+        return &md->queue->limits;
+}
+EXPORT_SYMBOL_GPL(dm_get_queue_limits);
+/*
 * Fully initialize a request-based queue (->elevator, ->request_fn, etc).
 */
 static int dm_init_request_based_queue(struct mapped_device *md)
@@ -2862,18 +2918,18 @@ struct dm_md_mempools *dm_alloc_md_mempools(unsigned type, unsigned integrity, u
        if (type == DM_TYPE_BIO_BASED) {
                cachep = _io_cache;
-                pool_size = 16;
+                pool_size = dm_get_reserved_bio_based_ios();
                front_pad = roundup(per_bio_data_size, __alignof__(struct dm_target_io)) + offsetof(struct dm_target_io, clone);
        } else if (type == DM_TYPE_REQUEST_BASED) {
                cachep = _rq_tio_cache;
-                pool_size = MIN_IOS;
+                pool_size = dm_get_reserved_rq_based_ios();
                front_pad = offsetof(struct dm_rq_clone_bio_info, clone);
                /* per_bio_data_size is not used. See __bind_mempools(). */
                WARN_ON(per_bio_data_size != 0);
        } else
                goto out;
-        pools->io_pool = mempool_create_slab_pool(MIN_IOS, cachep);
+        pools->io_pool = mempool_create_slab_pool(pool_size, cachep);
        if (!pools->io_pool)
                goto out;
@@ -2924,6 +2980,13 @@ module_exit(dm_exit);
 module_param(major, uint, 0);
 MODULE_PARM_DESC(major, "The major number of the device mapper");
+module_param(reserved_bio_based_ios, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(reserved_bio_based_ios, "Reserved IOs in bio-based mempools");
+module_param(reserved_rq_based_ios, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(reserved_rq_based_ios, "Reserved IOs in request-based mempools");
 MODULE_DESCRIPTION(DM_NAME " driver");
 MODULE_AUTHOR("Joe Thornber <dm-devel@redhat.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 5e604cc7b4aa..1d1ad7b7e527 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -184,6 +184,9 @@ void dm_free_md_mempools(struct dm_md_mempools *pools);
 /*
 * Helpers that are used by DM core
 */
+unsigned dm_get_reserved_bio_based_ios(void);
+unsigned dm_get_reserved_rq_based_ios(void);
 static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen)
 {
        return !maxlen || strlen(result) + 1 >= maxlen;
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index d0fdc134068a..f6ff711aa5bb 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -57,6 +57,7 @@ void mei_amthif_reset_params(struct mei_device *dev)
        dev->iamthif_ioctl = false;
        dev->iamthif_state = MEI_IAMTHIF_IDLE;
        dev->iamthif_timer = 0;
+        dev->iamthif_stall_timer = 0;
 }
 /**
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 6d0282c08a06..cd2033cd7120 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -297,10 +297,13 @@ int __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
        if (cl->reading_state != MEI_READ_COMPLETE &&
            !waitqueue_active(&cl->rx_wait)) {
                mutex_unlock(&dev->device_lock);
                if (wait_event_interruptible(cl->rx_wait,
-                                (MEI_READ_COMPLETE == cl->reading_state))) {
+                                cl->reading_state == MEI_READ_COMPLETE  ||
+                                mei_cl_is_transitioning(cl))) {
                        if (signal_pending(current))
                                return -EINTR;
                        return -ERESTARTSYS;
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index 9eb031e92070..892cc4207fa2 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -90,6 +90,12 @@ static inline bool mei_cl_is_connected(struct mei_cl *cl)
                cl->dev->dev_state == MEI_DEV_ENABLED &&
                cl->state == MEI_FILE_CONNECTED);
 }
+static inline bool mei_cl_is_transitioning(struct mei_cl *cl)
+{
+        return (MEI_FILE_INITIALIZING == cl->state ||
+                MEI_FILE_DISCONNECTED == cl->state ||
+                MEI_FILE_DISCONNECTING == cl->state);
+}
 bool mei_cl_is_other_connecting(struct mei_cl *cl);
 int mei_cl_disconnect(struct mei_cl *cl);
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 6127ab64bb39..0a0448326e9d 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -35,11 +35,15 @@ static void mei_hbm_me_cl_allocate(struct mei_device *dev)
        struct mei_me_client *clients;
        int b;
+        dev->me_clients_num = 0;
+        dev->me_client_presentation_num = 0;
+        dev->me_client_index = 0;
        /* count how many ME clients we have */
        for_each_set_bit(b, dev->me_clients_map, MEI_CLIENTS_MAX)
                dev->me_clients_num++;
-        if (dev->me_clients_num <= 0)
+        if (dev->me_clients_num == 0)
                return;
        kfree(dev->me_clients);
@@ -221,7 +225,7 @@ static int mei_hbm_prop_req(struct mei_device *dev)
        struct hbm_props_request *prop_req;
        const size_t len = sizeof(struct hbm_props_request);
        unsigned long next_client_index;
-        u8 client_num;
+        unsigned long client_num;
        client_num = dev->me_client_presentation_num;
@@ -677,8 +681,6 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
                    dev->hbm_state == MEI_HBM_ENUM_CLIENTS) {
                                dev->init_clients_timer = 0;
-                                dev->me_client_presentation_num = 0;
-                                dev->me_client_index = 0;
                                mei_hbm_me_cl_allocate(dev);
                                dev->hbm_state = MEI_HBM_CLIENT_PROPERTIES;
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 92c73118b13c..6197018e2f16 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -175,6 +175,9 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
                memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg));
        }
+        /* we're already in reset, cancel the init timer */
+        dev->init_clients_timer = 0;
        dev->me_clients_num = 0;
        dev->rd_msg_hdr = 0;
        dev->wd_pending = false;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 173ff095be0d..cabeddd66c1f 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -249,19 +249,16 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                mutex_unlock(&dev->device_lock);
                if (wait_event_interruptible(cl->rx_wait,
-                        (MEI_READ_COMPLETE == cl->reading_state ||
+                                MEI_READ_COMPLETE == cl->reading_state ||
-                         MEI_FILE_INITIALIZING == cl->state ||
+                                mei_cl_is_transitioning(cl))) {
-                         MEI_FILE_DISCONNECTED == cl->state ||
-                         MEI_FILE_DISCONNECTING == cl->state))) {
                        if (signal_pending(current))
                                return -EINTR;
                        return -ERESTARTSYS;
                }
                mutex_lock(&dev->device_lock);
-                if (MEI_FILE_INITIALIZING == cl->state ||
+                if (mei_cl_is_transitioning(cl)) {
-                    MEI_FILE_DISCONNECTED == cl->state ||
-                    MEI_FILE_DISCONNECTING == cl->state) {
                        rets = -EBUSY;
                        goto out;
                }
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 7b918b2fb894..456b322013e2 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -396,9 +396,9 @@ struct mei_device {
        struct mei_me_client *me_clients; /* Note: memory has to be allocated */
        DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX);
        DECLARE_BITMAP(host_clients_map, MEI_CLIENTS_MAX);
-        u8 me_clients_num;
+        unsigned long me_clients_num;
-        u8 me_client_presentation_num;
+        unsigned long me_client_presentation_num;
-        u8 me_client_index;
+        unsigned long me_client_index;
        struct mei_cl wd_cl;
        enum mei_wd_states wd_state;
diff --git a/drivers/mmc/host/sh_mobile_sdhi.c b/drivers/mmc/host/sh_mobile_sdhi.c
index 87ed3fb5149a..f344659dceac 100644
--- a/drivers/mmc/host/sh_mobile_sdhi.c
+++ b/drivers/mmc/host/sh_mobile_sdhi.c
@@ -113,14 +113,14 @@ static const struct sh_mobile_sdhi_ops sdhi_ops = {
 };
 static const struct of_device_id sh_mobile_sdhi_of_match[] = {
-        { .compatible = "renesas,shmobile-sdhi" },
+        { .compatible = "renesas,sdhi-shmobile" },
-        { .compatible = "renesas,sh7372-sdhi" },
+        { .compatible = "renesas,sdhi-sh7372" },
-        { .compatible = "renesas,sh73a0-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-sh73a0", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a73a4-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a73a4", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7740-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7740", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7778-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7778", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7779-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7779", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7790-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7790", .data = &sh_mobile_sdhi_of_cfg[0], },
        {},
 };
 MODULE_DEVICE_TABLE(of, sh_mobile_sdhi_of_match);
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 26b14f9fcac6..6bc9618af094 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -168,12 +168,25 @@ static inline int write_disable(struct m25p *flash)
 */
 static inline int set_4byte(struct m25p *flash, u32 jedec_id, int enable)
 {
+        int status;
+        bool need_wren = false;
        switch (JEDEC_MFR(jedec_id)) {
-        case CFI_MFR_MACRONIX:
        case CFI_MFR_ST: /* Micron, actually */
+                /* Some Micron need WREN command; all will accept it */
+                need_wren = true;
+        case CFI_MFR_MACRONIX:
        case 0xEF /* winbond */:
+                if (need_wren)
+                        write_enable(flash);
                flash->command[0] = enable ? OPCODE_EN4B : OPCODE_EX4B;
-                return spi_write(flash->spi, flash->command, 1);
+                status = spi_write(flash->spi, flash->command, 1);
+                if (need_wren)
+                        write_disable(flash);
+                return status;
        default:
                /* Spansion style */
                flash->command[0] = OPCODE_BRWR;
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 7ed4841327f2..d340b2f198c6 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2869,10 +2869,8 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
        len = le16_to_cpu(p->ext_param_page_length) * 16;
        ep = kmalloc(len, GFP_KERNEL);
-        if (!ep) {
+        if (!ep)
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto ext_out;
-        }
        /* Send our own NAND_CMD_PARAM. */
        chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
@@ -2920,7 +2918,7 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
        }
        pr_info("ONFI extended param page detected.\n");
-        return 0;
+        ret = 0;
 ext_out:
        kfree(ep);
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 5db900d917f9..dd03dfdfb0d6 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1236,7 +1236,6 @@ static int pxa3xx_nand_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_OF
 static struct of_device_id pxa3xx_nand_dt_ids[] = {
        {
                .compatible = "marvell,pxa3xx-nand",
@@ -1284,12 +1283,6 @@ static int pxa3xx_nand_probe_dt(struct platform_device *pdev)
        return 0;
 }
-#else
-static inline int pxa3xx_nand_probe_dt(struct platform_device *pdev)
-{
-        return 0;
-}
-#endif
 static int pxa3xx_nand_probe(struct platform_device *pdev)
 {
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 91f179d5135c..f428ef574372 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1472,7 +1472,7 @@ void bond_alb_monitor(struct work_struct *work)
        bond_info->lp_counter++;
        /* send learning packets */
-        if (bond_info->lp_counter >= BOND_ALB_LP_TICKS) {
+        if (bond_info->lp_counter >= BOND_ALB_LP_TICKS(bond)) {
                /* change of curr_active_slave involves swapping of mac addresses.
                 * in order to avoid this swapping from happening while
                 * sending the learning packets, the curr_slave_lock must be held for
diff --git a/drivers/net/bonding/bond_alb.h b/drivers/net/bonding/bond_alb.h
index 28d8e4c7dc06..c5eff5dafdfe 100644
--- a/drivers/net/bonding/bond_alb.h
+++ b/drivers/net/bonding/bond_alb.h
@@ -36,14 +36,15 @@ struct slave;
                                         * Used for division - never set
                                         * to zero !!!
                                         */
-#define BOND_ALB_LP_INTERVAL        1   /* In seconds, periodic send of
+#define BOND_ALB_DEFAULT_LP_INTERVAL 1
-                                         * learning packets to the switch
+#define BOND_ALB_LP_INTERVAL(bond) (bond->params.lp_interval)   /* In seconds, periodic send of
-                                         */
+                                                                 * learning packets to the switch
+                                                                 */
 #define BOND_TLB_REBALANCE_TICKS (BOND_TLB_REBALANCE_INTERVAL \
                                  * ALB_TIMER_TICKS_PER_SEC)
-#define BOND_ALB_LP_TICKS (BOND_ALB_LP_INTERVAL \
+#define BOND_ALB_LP_TICKS(bond) (BOND_ALB_LP_INTERVAL(bond) \
                           * ALB_TIMER_TICKS_PER_SEC)
 #define TLB_HASH_TABLE_SIZE 256 /* The size of the clients hash table.
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 72df399c4ab3..e883bfe2e727 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1724,6 +1724,7 @@ static int __bond_release_one(struct net_device *bond_dev,
        struct bonding *bond = netdev_priv(bond_dev);
        struct slave *slave, *oldcurrent;
        struct sockaddr addr;
+        int old_flags = bond_dev->flags;
        netdev_features_t old_features = bond_dev->features;
        /* slave is not a slave or master is not master of this slave */
@@ -1855,12 +1856,18 @@ static int __bond_release_one(struct net_device *bond_dev,
         * bond_change_active_slave(..., NULL)
         */
        if (!USES_PRIMARY(bond->params.mode)) {
-                /* unset promiscuity level from slave */
+                /* unset promiscuity level from slave
-                if (bond_dev->flags & IFF_PROMISC)
+                 * NOTE: The NETDEV_CHANGEADDR call above may change the value
+                 * of the IFF_PROMISC flag in the bond_dev, but we need the
+                 * value of that flag before that change, as that was the value
+                 * when this slave was attached, so we cache at the start of the
+                 * function and use it here. Same goes for ALLMULTI below
+                 */
+                if (old_flags & IFF_PROMISC)
                        dev_set_promiscuity(slave_dev, -1);
                /* unset allmulti level from slave */
-                if (bond_dev->flags & IFF_ALLMULTI)
+                if (old_flags & IFF_ALLMULTI)
                        dev_set_allmulti(slave_dev, -1);
                bond_hw_addr_flush(bond_dev, slave_dev);
@@ -4416,6 +4423,7 @@ static int bond_check_params(struct bond_params *params)
        params->all_slaves_active = all_slaves_active;
        params->resend_igmp = resend_igmp;
        params->min_links = min_links;
+        params->lp_interval = BOND_ALB_DEFAULT_LP_INTERVAL;
        if (primary) {
                strncpy(params->primary, primary, IFNAMSIZ);
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index eeab40b01b7a..c29b836749b6 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1699,6 +1699,44 @@ out:
 static DEVICE_ATTR(resend_igmp, S_IRUGO | S_IWUSR,
                   bonding_show_resend_igmp, bonding_store_resend_igmp);
+static ssize_t bonding_show_lp_interval(struct device *d,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct bonding *bond = to_bond(d);
+        return sprintf(buf, "%d\n", bond->params.lp_interval);
+}
+static ssize_t bonding_store_lp_interval(struct device *d,
+                                         struct device_attribute *attr,
+                                         const char *buf, size_t count)
+{
+        struct bonding *bond = to_bond(d);
+        int new_value, ret = count;
+        if (sscanf(buf, "%d", &new_value) != 1) {
+                pr_err("%s: no lp interval value specified.\n",
+                        bond->dev->name);
+                ret = -EINVAL;
+                goto out;
+        }
+        if (new_value <= 0) {
+                pr_err ("%s: lp_interval must be between 1 and %d\n",
+                        bond->dev->name, INT_MAX);
+                ret = -EINVAL;
+                goto out;
+        }
+        bond->params.lp_interval = new_value;
+out:
+        return ret;
+}
+static DEVICE_ATTR(lp_interval, S_IRUGO | S_IWUSR,
+                   bonding_show_lp_interval, bonding_store_lp_interval);
 static struct attribute *per_bond_attrs[] = {
        &dev_attr_slaves.attr,
        &dev_attr_mode.attr,
@@ -1729,6 +1767,7 @@ static struct attribute *per_bond_attrs[] = {
        &dev_attr_all_slaves_active.attr,
        &dev_attr_resend_igmp.attr,
        &dev_attr_min_links.attr,
+        &dev_attr_lp_interval.attr,
        NULL,
 };
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 7ad8bd5cc947..03cf3fd14490 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -176,6 +176,7 @@ struct bond_params {
        int tx_queues;
        int all_slaves_active;
        int resend_igmp;
+        int lp_interval;
 };
 struct bond_parm_tbl {
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 71c677e651d7..3f21142138b7 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -702,7 +702,6 @@ static int flexcan_chip_start(struct net_device *dev)
 {
        struct flexcan_priv *priv = netdev_priv(dev);
        struct flexcan_regs __iomem *regs = priv->base;
-        unsigned int i;
        int err;
        u32 reg_mcr, reg_ctrl;
@@ -772,17 +771,6 @@ static int flexcan_chip_start(struct net_device *dev)
        netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
        flexcan_write(reg_ctrl, &regs->ctrl);
-        for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) {
-                flexcan_write(0, &regs->cantxfg[i].can_ctrl);
-                flexcan_write(0, &regs->cantxfg[i].can_id);
-                flexcan_write(0, &regs->cantxfg[i].data[0]);
-                flexcan_write(0, &regs->cantxfg[i].data[1]);
-                /* put MB into rx queue */
-                flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
-                        &regs->cantxfg[i].can_ctrl);
-        }
        /* acceptance mask/acceptance code (accept everything) */
        flexcan_write(0x0, &regs->rxgmask);
        flexcan_write(0x0, &regs->rx14mask);
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index 874188ba06f7..25377e547f9b 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -76,6 +76,10 @@ MODULE_PARM_DESC(maxdev, "Maximum number of slcan interfaces");
 /* maximum rx buffer len: extended CAN frame with timestamp */
 #define SLC_MTU (sizeof("T1111222281122334455667788EA5F\r")+1)
+#define SLC_CMD_LEN 1
+#define SLC_SFF_ID_LEN 3
+#define SLC_EFF_ID_LEN 8
 struct slcan {
        int                     magic;
@@ -142,47 +146,63 @@ static void slc_bump(struct slcan *sl)
 {
        struct sk_buff *skb;
        struct can_frame cf;
-        int i, dlc_pos, tmp;
+        int i, tmp;
-        unsigned long ultmp;
+        u32 tmpid;
-        char cmd = sl->rbuff[0];
+        char *cmd = sl->rbuff;
-        if ((cmd != 't') && (cmd != 'T') && (cmd != 'r') && (cmd != 'R'))
+        cf.can_id = 0;
+        switch (*cmd) {
+        case 'r':
+                cf.can_id = CAN_RTR_FLAG;
+                /* fallthrough */
+        case 't':
+                /* store dlc ASCII value and terminate SFF CAN ID string */
+                cf.can_dlc = sl->rbuff[SLC_CMD_LEN + SLC_SFF_ID_LEN];
+                sl->rbuff[SLC_CMD_LEN + SLC_SFF_ID_LEN] = 0;
+                /* point to payload data behind the dlc */
+                cmd += SLC_CMD_LEN + SLC_SFF_ID_LEN + 1;
+                break;
+        case 'R':
+                cf.can_id = CAN_RTR_FLAG;
+                /* fallthrough */
+        case 'T':
+                cf.can_id |= CAN_EFF_FLAG;
+                /* store dlc ASCII value and terminate EFF CAN ID string */
+                cf.can_dlc = sl->rbuff[SLC_CMD_LEN + SLC_EFF_ID_LEN];
+                sl->rbuff[SLC_CMD_LEN + SLC_EFF_ID_LEN] = 0;
+                /* point to payload data behind the dlc */
+                cmd += SLC_CMD_LEN + SLC_EFF_ID_LEN + 1;
+                break;
+        default:
                return;
+        }
-        if (cmd & 0x20) /* tiny chars 'r' 't' => standard frame format */
+        if (kstrtou32(sl->rbuff + SLC_CMD_LEN, 16, &tmpid))
-                dlc_pos = 4; /* dlc position tiiid */
-        else
-                dlc_pos = 9; /* dlc position Tiiiiiiiid */
-        if (!((sl->rbuff[dlc_pos] >= '0') && (sl->rbuff[dlc_pos] < '9')))
                return;
-        cf.can_dlc = sl->rbuff[dlc_pos] - '0'; /* get can_dlc from ASCII val */
+        cf.can_id |= tmpid;
-        sl->rbuff[dlc_pos] = 0; /* terminate can_id string */
+        /* get can_dlc from sanitized ASCII value */
+        if (cf.can_dlc >= '0' && cf.can_dlc < '9')
-        if (kstrtoul(sl->rbuff+1, 16, &ultmp))
+                cf.can_dlc -= '0';
+        else
                return;
-        cf.can_id = ultmp;
-        if (!(cmd & 0x20)) /* NO tiny chars => extended frame format */
-                cf.can_id |= CAN_EFF_FLAG;
-        if ((cmd | 0x20) == 'r') /* RTR frame */
-                cf.can_id |= CAN_RTR_FLAG;
        *(u64 *) (&cf.data) = 0; /* clear payload */
-        for (i = 0, dlc_pos++; i < cf.can_dlc; i++) {
+        /* RTR frames may have a dlc > 0 but they never have any data bytes */
-                tmp = hex_to_bin(sl->rbuff[dlc_pos++]);
+        if (!(cf.can_id & CAN_RTR_FLAG)) {
-                if (tmp < 0)
+                for (i = 0; i < cf.can_dlc; i++) {
-                        return;
+                        tmp = hex_to_bin(*cmd++);
-                cf.data[i] = (tmp << 4);
+                        if (tmp < 0)
-                tmp = hex_to_bin(sl->rbuff[dlc_pos++]);
+                                return;
-                if (tmp < 0)
+                        cf.data[i] = (tmp << 4);
-                        return;
+                        tmp = hex_to_bin(*cmd++);
-                cf.data[i] |= tmp;
+                        if (tmp < 0)
+                                return;
+                        cf.data[i] |= tmp;
+                }
        }
        skb = dev_alloc_skb(sizeof(struct can_frame) +
@@ -209,7 +229,6 @@ static void slc_bump(struct slcan *sl)
 /* parse tty input stream */
 static void slcan_unesc(struct slcan *sl, unsigned char s)
 {
        if ((s == '\r') || (s == '\a')) { /* CR or BEL ends the pdu */
                if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
                    (sl->rcount > 4))  {
@@ -236,27 +255,46 @@ static void slcan_unesc(struct slcan *sl, unsigned char s)
 /* Encapsulate one can_frame and stuff into a TTY queue. */
 static void slc_encaps(struct slcan *sl, struct can_frame *cf)
 {
-        int actual, idx, i;
+        int actual, i;
-        char cmd;
+        unsigned char *pos;
+        unsigned char *endpos;
+        canid_t id = cf->can_id;
+        pos = sl->xbuff;
        if (cf->can_id & CAN_RTR_FLAG)
-                cmd = 'R'; /* becomes 'r' in standard frame format */
+                *pos = 'R'; /* becomes 'r' in standard frame format (SFF) */
        else
-                cmd = 'T'; /* becomes 't' in standard frame format */
+                *pos = 'T'; /* becomes 't' in standard frame format (SSF) */
-        if (cf->can_id & CAN_EFF_FLAG)
+        /* determine number of chars for the CAN-identifier */
-                sprintf(sl->xbuff, "%c%08X%d", cmd,
+        if (cf->can_id & CAN_EFF_FLAG) {
-                        cf->can_id & CAN_EFF_MASK, cf->can_dlc);
+                id &= CAN_EFF_MASK;
-        else
+                endpos = pos + SLC_EFF_ID_LEN;
-                sprintf(sl->xbuff, "%c%03X%d", cmd | 0x20,
+        } else {
-                        cf->can_id & CAN_SFF_MASK, cf->can_dlc);
+                *pos |= 0x20; /* convert R/T to lower case for SFF */
+                id &= CAN_SFF_MASK;
+                endpos = pos + SLC_SFF_ID_LEN;
+        }
-        idx = strlen(sl->xbuff);
+        /* build 3 (SFF) or 8 (EFF) digit CAN identifier */
+        pos++;
+        while (endpos >= pos) {
+                *endpos-- = hex_asc_upper[id & 0xf];
+                id >>= 4;
+        }
+        pos += (cf->can_id & CAN_EFF_FLAG) ? SLC_EFF_ID_LEN : SLC_SFF_ID_LEN;
-        for (i = 0; i < cf->can_dlc; i++)
+        *pos++ = cf->can_dlc + '0';
-                sprintf(&sl->xbuff[idx + 2*i], "%02X", cf->data[i]);
+        /* RTR frames may have a dlc > 0 but they never have any data bytes */
+        if (!(cf->can_id & CAN_RTR_FLAG)) {
+                for (i = 0; i < cf->can_dlc; i++)
+                        pos = hex_byte_pack_upper(pos, cf->data[i]);
+        }
-        strcat(sl->xbuff, "\r"); /* add terminating character */
+        *pos++ = '\r';
        /* Order of next two lines is *very* important.
         * When we are sending a little amount of data,
@@ -267,8 +305,8 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf)
         *       14 Oct 1994  Dmitry Gorodchanin.
         */
        set_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
-        actual = sl->tty->ops->write(sl->tty, sl->xbuff, strlen(sl->xbuff));
+        actual = sl->tty->ops->write(sl->tty, sl->xbuff, pos - sl->xbuff);
-        sl->xleft = strlen(sl->xbuff) - actual;
+        sl->xleft = (pos - sl->xbuff) - actual;
        sl->xhead = sl->xbuff + actual;
        sl->dev->stats.tx_bytes += cf->can_dlc;
 }
@@ -286,11 +324,13 @@ static void slcan_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
                return;
+        spin_lock(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                spin_unlock(&sl->lock);
                netif_wake_queue(sl->dev);
                return;
        }
@@ -298,6 +338,7 @@ static void slcan_write_wakeup(struct tty_struct *tty)
        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
+        spin_unlock(&sl->lock);
 }
 /* Send a can_frame to a TTY queue. */
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index a0f647f92bf5..0b7a4c3b01a2 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -463,7 +463,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
        if (i < PCAN_USB_MAX_TX_URBS) {
                if (i == 0) {
                        netdev_err(netdev, "couldn't setup any tx URB\n");
-                        return err;
+                        goto err_tx;
                }
                netdev_warn(netdev, "tx performance may be slow\n");
@@ -472,7 +472,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
        if (dev->adapter->dev_start) {
                err = dev->adapter->dev_start(dev);
                if (err)
-                        goto failed;
+                        goto err_adapter;
        }
        dev->state |= PCAN_USB_STATE_STARTED;
@@ -481,19 +481,26 @@ static int peak_usb_start(struct peak_usb_device *dev)
        if (dev->adapter->dev_set_bus) {
                err = dev->adapter->dev_set_bus(dev, 1);
                if (err)
-                        goto failed;
+                        goto err_adapter;
        }
        dev->can.state = CAN_STATE_ERROR_ACTIVE;
        return 0;
-failed:
+err_adapter:
        if (err == -ENODEV)
                netif_device_detach(dev->netdev);
        netdev_warn(netdev, "couldn't submit control: %d\n", err);
+        for (i = 0; i < PCAN_USB_MAX_TX_URBS; i++) {
+                usb_free_urb(dev->tx_contexts[i].urb);
+                dev->tx_contexts[i].urb = NULL;
+        }
+err_tx:
+        usb_kill_anchored_urbs(&dev->rx_submitted);
        return err;
 }
diff --git a/drivers/net/ethernet/adi/bfin_mac.c b/drivers/net/ethernet/adi/bfin_mac.c
index e66684a438f5..75fb1d20d6fd 100644
--- a/drivers/net/ethernet/adi/bfin_mac.c
+++ b/drivers/net/ethernet/adi/bfin_mac.c
@@ -530,7 +530,7 @@ static int bfin_mac_ethtool_setwol(struct net_device *dev,
        if (lp->wol && !lp->irq_wake_requested) {
                /* register wake irq handler */
                rc = request_irq(IRQ_MAC_WAKEDET, bfin_mac_wake_interrupt,
-                                 IRQF_DISABLED, "EMAC_WAKE", dev);
+                                 0, "EMAC_WAKE", dev);
                if (rc)
                        return rc;
                lp->irq_wake_requested = true;
@@ -1686,7 +1686,7 @@ static int bfin_mac_probe(struct platform_device *pdev)
        /* now, enable interrupts */
        /* register irq handler */
        rc = request_irq(IRQ_MAC_RX, bfin_mac_interrupt,
-                        IRQF_DISABLED, "EMAC_RX", ndev);
+                        0, "EMAC_RX", ndev);
        if (rc) {
                dev_err(&pdev->dev, "Cannot request Blackfin MAC RX IRQ!\n");
                rc = -EBUSY;
diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c
index d6b20296b8e4..3d8c6b2cdea4 100644
--- a/drivers/net/ethernet/amd/sun3lance.c
+++ b/drivers/net/ethernet/amd/sun3lance.c
@@ -358,7 +358,7 @@ static int __init lance_probe( struct net_device *dev)
        REGA(CSR0) = CSR0_STOP;
-        if (request_irq(LANCE_IRQ, lance_interrupt, IRQF_DISABLED, "SUN3 Lance", dev) < 0) {
+        if (request_irq(LANCE_IRQ, lance_interrupt, 0, "SUN3 Lance", dev) < 0) {
 #ifdef CONFIG_SUN3
                iounmap((void __iomem *)ioaddr);
 #endif
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 027398ebbba6..fc95b235e210 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1188,7 +1188,7 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        struct alx_priv *alx;
        struct alx_hw *hw;
        bool phy_configured;
-        int bars, pm_cap, err;
+        int bars, err;
        err = pci_enable_device_mem(pdev);
        if (err)
@@ -1225,18 +1225,13 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_enable_pcie_error_reporting(pdev);
        pci_set_master(pdev);
-        pm_cap = pci_find_capability(pdev, PCI_CAP_ID_PM);
+        if (!pdev->pm_cap) {
-        if (pm_cap == 0) {
                dev_err(&pdev->dev,
                        "Can't find power management capability, aborting\n");
                err = -EIO;
                goto out_pci_release;
        }
-        err = pci_set_power_state(pdev, PCI_D0);
-        if (err)
-                goto out_pci_release;
        netdev = alloc_etherdev(sizeof(*alx));
        if (!netdev) {
                err = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index eec0af45b859..249468f95365 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -157,6 +157,7 @@ static netdev_tx_t bgmac_dma_tx_add(struct bgmac *bgmac,
        if (++ring->end >= BGMAC_TX_RING_SLOTS)
                ring->end = 0;
        bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_TX_INDEX,
+                    ring->index_base +
                    ring->end * sizeof(struct bgmac_dma_desc));
        /* Always keep one slot free to allow detecting bugged calls. */
@@ -181,6 +182,8 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring)
        /* The last slot that hardware didn't consume yet */
        empty_slot = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_TX_STATUS);
        empty_slot &= BGMAC_DMA_TX_STATDPTR;
+        empty_slot -= ring->index_base;
+        empty_slot &= BGMAC_DMA_TX_STATDPTR;
        empty_slot /= sizeof(struct bgmac_dma_desc);
        while (ring->start != empty_slot) {
@@ -274,6 +277,8 @@ static int bgmac_dma_rx_read(struct bgmac *bgmac, struct bgmac_dma_ring *ring,
        end_slot = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_STATUS);
        end_slot &= BGMAC_DMA_RX_STATDPTR;
+        end_slot -= ring->index_base;
+        end_slot &= BGMAC_DMA_RX_STATDPTR;
        end_slot /= sizeof(struct bgmac_dma_desc);
        ring->end = end_slot;
@@ -418,9 +423,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                ring = &bgmac->tx_ring[i];
                ring->num_slots = BGMAC_TX_RING_SLOTS;
                ring->mmio_base = ring_base[i];
-                if (bgmac_dma_unaligned(bgmac, ring, BGMAC_DMA_RING_TX))
-                        bgmac_warn(bgmac, "TX on ring 0x%X supports unaligned addressing but this feature is not implemented\n",
-                                   ring->mmio_base);
                /* Alloc ring of descriptors */
                size = ring->num_slots * sizeof(struct bgmac_dma_desc);
@@ -435,6 +437,13 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                if (ring->dma_base & 0xC0000000)
                        bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
+                ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
+                                                      BGMAC_DMA_RING_TX);
+                if (ring->unaligned)
+                        ring->index_base = lower_32_bits(ring->dma_base);
+                else
+                        ring->index_base = 0;
                /* No need to alloc TX slots yet */
        }
@@ -444,9 +453,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                ring = &bgmac->rx_ring[i];
                ring->num_slots = BGMAC_RX_RING_SLOTS;
                ring->mmio_base = ring_base[i];
-                if (bgmac_dma_unaligned(bgmac, ring, BGMAC_DMA_RING_RX))
-                        bgmac_warn(bgmac, "RX on ring 0x%X supports unaligned addressing but this feature is not implemented\n",
-                                   ring->mmio_base);
                /* Alloc ring of descriptors */
                size = ring->num_slots * sizeof(struct bgmac_dma_desc);
@@ -462,6 +468,13 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                if (ring->dma_base & 0xC0000000)
                        bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
+                ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
+                                                      BGMAC_DMA_RING_RX);
+                if (ring->unaligned)
+                        ring->index_base = lower_32_bits(ring->dma_base);
+                else
+                        ring->index_base = 0;
                /* Alloc RX slots */
                for (j = 0; j < ring->num_slots; j++) {
                        err = bgmac_dma_rx_skb_for_slot(bgmac, &ring->slots[j]);
@@ -489,12 +502,14 @@ static void bgmac_dma_init(struct bgmac *bgmac)
        for (i = 0; i < BGMAC_MAX_TX_RINGS; i++) {
                ring = &bgmac->tx_ring[i];
-                /* We don't implement unaligned addressing, so enable first */
+                if (!ring->unaligned)
-                bgmac_dma_tx_enable(bgmac, ring);
+                        bgmac_dma_tx_enable(bgmac, ring);
                bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_TX_RINGLO,
                            lower_32_bits(ring->dma_base));
                bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_TX_RINGHI,
                            upper_32_bits(ring->dma_base));
+                if (ring->unaligned)
+                        bgmac_dma_tx_enable(bgmac, ring);
                ring->start = 0;
                ring->end = 0;  /* Points the slot that should *not* be read */
@@ -505,12 +520,14 @@ static void bgmac_dma_init(struct bgmac *bgmac)
                ring = &bgmac->rx_ring[i];
-                /* We don't implement unaligned addressing, so enable first */
+                if (!ring->unaligned)
-                bgmac_dma_rx_enable(bgmac, ring);
+                        bgmac_dma_rx_enable(bgmac, ring);
                bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_RX_RINGLO,
                            lower_32_bits(ring->dma_base));
                bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_RX_RINGHI,
                            upper_32_bits(ring->dma_base));
+                if (ring->unaligned)
+                        bgmac_dma_rx_enable(bgmac, ring);
                for (j = 0, dma_desc = ring->cpu_base; j < ring->num_slots;
                     j++, dma_desc++) {
@@ -531,6 +548,7 @@ static void bgmac_dma_init(struct bgmac *bgmac)
                }
                bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_RX_INDEX,
+                            ring->index_base +
                            ring->num_slots * sizeof(struct bgmac_dma_desc));
                ring->start = 0;
@@ -908,10 +926,10 @@ static void bgmac_chip_reset(struct bgmac *bgmac)
                struct bcma_drv_cc *cc = &bgmac->core->bus->drv_cc;
                u8 et_swtype = 0;
                u8 sw_type = BGMAC_CHIPCTL_1_SW_TYPE_EPHY |
-                             BGMAC_CHIPCTL_1_IF_TYPE_RMII;
+                             BGMAC_CHIPCTL_1_IF_TYPE_MII;
-                char buf[2];
+                char buf[4];
-                if (bcm47xx_nvram_getenv("et_swtype", buf, 1) > 0) {
+                if (bcm47xx_nvram_getenv("et_swtype", buf, sizeof(buf)) > 0) {
                        if (kstrtou8(buf, 0, &et_swtype))
                                bgmac_err(bgmac, "Failed to parse et_swtype (%s)\n",
                                          buf);
diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h
index 98d4b5fcc070..66c8afbdc8c7 100644
--- a/drivers/net/ethernet/broadcom/bgmac.h
+++ b/drivers/net/ethernet/broadcom/bgmac.h
@@ -333,7 +333,7 @@
 #define BGMAC_CHIPCTL_1_IF_TYPE_MASK            0x00000030
 #define BGMAC_CHIPCTL_1_IF_TYPE_RMII            0x00000000
-#define BGMAC_CHIPCTL_1_IF_TYPE_MI              0x00000010
+#define BGMAC_CHIPCTL_1_IF_TYPE_MII             0x00000010
 #define BGMAC_CHIPCTL_1_IF_TYPE_RGMII           0x00000020
 #define BGMAC_CHIPCTL_1_SW_TYPE_MASK            0x000000C0
 #define BGMAC_CHIPCTL_1_SW_TYPE_EPHY            0x00000000
@@ -384,6 +384,8 @@ struct bgmac_dma_ring {
        u16 mmio_base;
        struct bgmac_dma_desc *cpu_base;
        dma_addr_t dma_base;
+        u32 index_base; /* Used for unaligned rings only, otherwise 0 */
+        bool unaligned;
        struct bgmac_slot_info slots[BGMAC_RX_RING_SLOTS];
 };
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 0c338026ce01..97b3d32a98bd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -246,8 +246,37 @@ enum {
        BNX2X_MAX_CNIC_ETH_CL_ID_IDX,
 };
-#define BNX2X_CNIC_START_ETH_CID(bp)    (BNX2X_NUM_NON_CNIC_QUEUES(bp) *\
+/* use a value high enough to be above all the PFs, which has least significant
+ * nibble as 8, so when cnic needs to come up with a CID for UIO to use to
+ * calculate doorbell address according to old doorbell configuration scheme
+ * (db_msg_sz 1 << 7 * cid + 0x40 DPM offset) it can come up with a valid number
+ * We must avoid coming up with cid 8 for iscsi since according to this method
+ * the designated UIO cid will come out 0 and it has a special handling for that
+ * case which doesn't suit us. Therefore will will cieling to closes cid which
+ * has least signigifcant nibble 8 and if it is 8 we will move forward to 0x18.
+ */
+#define BNX2X_1st_NON_L2_ETH_CID(bp)    (BNX2X_NUM_NON_CNIC_QUEUES(bp) * \
                                         (bp)->max_cos)
+/* amount of cids traversed by UIO's DPM addition to doorbell */
+#define UIO_DPM                         8
+/* roundup to DPM offset */
+#define UIO_ROUNDUP(bp)                 (roundup(BNX2X_1st_NON_L2_ETH_CID(bp), \
+                                         UIO_DPM))
+/* offset to nearest value which has lsb nibble matching DPM */
+#define UIO_CID_OFFSET(bp)              ((UIO_ROUNDUP(bp) + UIO_DPM) % \
+                                         (UIO_DPM * 2))
+/* add offset to rounded-up cid to get a value which could be used with UIO */
+#define UIO_DPM_ALIGN(bp)               (UIO_ROUNDUP(bp) + UIO_CID_OFFSET(bp))
+/* but wait - avoid UIO special case for cid 0 */
+#define UIO_DPM_CID0_OFFSET(bp)         ((UIO_DPM * 2) * \
+                                         (UIO_DPM_ALIGN(bp) == UIO_DPM))
+/* Properly DPM aligned CID dajusted to cid 0 secal case */
+#define BNX2X_CNIC_START_ETH_CID(bp)    (UIO_DPM_ALIGN(bp) + \
+                                         (UIO_DPM_CID0_OFFSET(bp)))
+/* how many cids were wasted  - need this value for cid allocation */
+#define UIO_CID_PAD(bp)                 (BNX2X_CNIC_START_ETH_CID(bp) - \
+                                         BNX2X_1st_NON_L2_ETH_CID(bp))
        /* iSCSI L2 */
 #define BNX2X_ISCSI_ETH_CID(bp)         (BNX2X_CNIC_START_ETH_CID(bp))
        /* FCoE L2 */
@@ -1542,7 +1571,6 @@ struct bnx2x {
         */
        bool                    fcoe_init;
-        int                     pm_cap;
        int                     mrrs;
        struct delayed_work     sp_task;
@@ -1681,10 +1709,11 @@ struct bnx2x {
 * Maximum CID count that might be required by the bnx2x:
 * Max RSS * Max_Tx_Multi_Cos + FCoE + iSCSI
 */
 #define BNX2X_L2_CID_COUNT(bp)  (BNX2X_NUM_ETH_QUEUES(bp) * BNX2X_MULTI_TX_COS \
-                                + 2 * CNIC_SUPPORT(bp))
+                                + CNIC_SUPPORT(bp) * (2 + UIO_CID_PAD(bp)))
 #define BNX2X_L2_MAX_CID(bp)    (BNX2X_MAX_RSS_COUNT(bp) * BNX2X_MULTI_TX_COS \
-                                + 2 * CNIC_SUPPORT(bp))
+                                + CNIC_SUPPORT(bp) * (2 + UIO_CID_PAD(bp)))
 #define L2_ILT_LINES(bp)        (DIV_ROUND_UP(BNX2X_L2_CID_COUNT(bp),\
                                        ILT_PAGE_CIDS))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 90045c920d09..e66beff2704d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2481,8 +2481,7 @@ load_error_cnic2:
 load_error_cnic1:
        bnx2x_napi_disable_cnic(bp);
        /* Update the number of queues without the cnic queues */
-        rc = bnx2x_set_real_num_queues(bp, 0);
+        if (bnx2x_set_real_num_queues(bp, 0))
-        if (rc)
                BNX2X_ERR("Unable to set real_num_queues not including cnic\n");
 load_error_cnic0:
        BNX2X_ERR("CNIC-related load failed\n");
@@ -3008,16 +3007,16 @@ int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state)
        u16 pmcsr;
        /* If there is no power capability, silently succeed */
-        if (!bp->pm_cap) {
+        if (!bp->pdev->pm_cap) {
                BNX2X_DEV_INFO("No power capability. Breaking.\n");
                return 0;
        }
-        pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmcsr);
+        pci_read_config_word(bp->pdev, bp->pdev->pm_cap + PCI_PM_CTRL, &pmcsr);
        switch (state) {
        case PCI_D0:
-                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL,
+                pci_write_config_word(bp->pdev, bp->pdev->pm_cap + PCI_PM_CTRL,
                                      ((pmcsr & ~PCI_PM_CTRL_STATE_MASK) |
                                       PCI_PM_CTRL_PME_STATUS));
@@ -3041,7 +3040,7 @@ int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state)
                if (bp->wol)
                        pmcsr |= PCI_PM_CTRL_PME_ENABLE;
-                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL,
+                pci_write_config_word(bp->pdev, bp->pdev->pm_cap + PCI_PM_CTRL,
                                      pmcsr);
                /* No more memory access after this point until
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 2612e3c715d4..324de5f05332 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -1387,9 +1387,9 @@ static bool bnx2x_is_nvm_accessible(struct bnx2x *bp)
        u16 pm = 0;
        struct net_device *dev = pci_get_drvdata(bp->pdev);
-        if (bp->pm_cap)
+        if (bp->pdev->pm_cap)
                rc = pci_read_config_word(bp->pdev,
-                                          bp->pm_cap + PCI_PM_CTRL, &pm);
+                                          bp->pdev->pm_cap + PCI_PM_CTRL, &pm);
        if ((rc && !netif_running(dev)) ||
            (!rc && ((pm & PCI_PM_CTRL_STATE_MASK) != (__force u16)PCI_D0)))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index d60a2ea3da19..51468227bf3b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -175,6 +175,7 @@ typedef int (*read_sfp_module_eeprom_func_p)(struct bnx2x_phy *phy,
 #define EDC_MODE_LINEAR                         0x0022
 #define EDC_MODE_LIMITING                               0x0044
 #define EDC_MODE_PASSIVE_DAC                    0x0055
+#define EDC_MODE_ACTIVE_DAC                     0x0066
 /* ETS defines*/
 #define DCBX_INVALID_COS                                        (0xFF)
@@ -3684,6 +3685,41 @@ static void bnx2x_warpcore_enable_AN_KR2(struct bnx2x_phy *phy,
        bnx2x_update_link_attr(params, vars->link_attr_sync);
 }
+static void bnx2x_disable_kr2(struct link_params *params,
+                              struct link_vars *vars,
+                              struct bnx2x_phy *phy)
+{
+        struct bnx2x *bp = params->bp;
+        int i;
+        static struct bnx2x_reg_set reg_set[] = {
+                /* Step 1 - Program the TX/RX alignment markers */
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL5, 0x7690},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL7, 0xe647},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL6, 0xc4f0},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL9, 0x7690},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL11, 0xe647},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL10, 0xc4f0},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_USERB0_CTRL, 0x000c},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL1, 0x6000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL3, 0x0000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CODE_FIELD, 0x0002},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI1, 0x0000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI2, 0x0af7},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI3, 0x0af7},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_BAM_CODE, 0x0002},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_UD_CODE, 0x0000}
+        };
+        DP(NETIF_MSG_LINK, "Disabling 20G-KR2\n");
+        for (i = 0; i < ARRAY_SIZE(reg_set); i++)
+                bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
+                                 reg_set[i].val);
+        vars->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
+        bnx2x_update_link_attr(params, vars->link_attr_sync);
+        vars->check_kr2_recovery_cnt = CHECK_KR2_RECOVERY_CNT;
+}
 static void bnx2x_warpcore_set_lpi_passthrough(struct bnx2x_phy *phy,
                                               struct link_params *params)
 {
@@ -3715,7 +3751,6 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                                        struct link_params *params,
                                        struct link_vars *vars) {
        u16 lane, i, cl72_ctrl, an_adv = 0;
-        u16 ucode_ver;
        struct bnx2x *bp = params->bp;
        static struct bnx2x_reg_set reg_set[] = {
                {MDIO_WC_DEVAD, MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X2, 0x7},
@@ -3806,15 +3841,7 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
        /* Advertise pause */
        bnx2x_ext_phy_set_pause(params, phy, vars);
-        /* Set KR Autoneg Work-Around flag for Warpcore version older than D108
+        vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
-         */
-        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
-                        MDIO_WC_REG_UC_INFO_B1_VERSION, &ucode_ver);
-        if (ucode_ver < 0xd108) {
-                DP(NETIF_MSG_LINK, "Enable AN KR work-around. WC ver:0x%x\n",
-                               ucode_ver);
-                vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
-        }
        bnx2x_cl45_read_or_write(bp, phy, MDIO_WC_DEVAD,
                                 MDIO_WC_REG_DIGITAL5_MISC7, 0x100);
@@ -3838,6 +3865,8 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                bnx2x_set_aer_mmd(params, phy);
                bnx2x_warpcore_enable_AN_KR2(phy, params, vars);
+        } else {
+                bnx2x_disable_kr2(params, vars, phy);
        }
        /* Enable Autoneg: only on the main lane */
@@ -4347,20 +4376,14 @@ static void bnx2x_warpcore_config_runtime(struct bnx2x_phy *phy,
        struct bnx2x *bp = params->bp;
        u32 serdes_net_if;
        u16 gp_status1 = 0, lnkup = 0, lnkup_kr = 0;
-        u16 lane = bnx2x_get_warpcore_lane(phy, params);
        vars->turn_to_run_wc_rt = vars->turn_to_run_wc_rt ? 0 : 1;
        if (!vars->turn_to_run_wc_rt)
                return;
-        /* Return if there is no link partner */
-        if (!(bnx2x_warpcore_get_sigdet(phy, params))) {
-                DP(NETIF_MSG_LINK, "bnx2x_warpcore_get_sigdet false\n");
-                return;
-        }
        if (vars->rx_tx_asic_rst) {
+                u16 lane = bnx2x_get_warpcore_lane(phy, params);
                serdes_net_if = (REG_RD(bp, params->shmem_base +
                                offsetof(struct shmem_region, dev_info.
                                port_hw_config[params->port].default_cfg)) &
@@ -4375,14 +4398,8 @@ static void bnx2x_warpcore_config_runtime(struct bnx2x_phy *phy,
                                /*10G KR*/
                        lnkup_kr = (gp_status1 >> (12+lane)) & 0x1;
-                        DP(NETIF_MSG_LINK,
-                                "gp_status1 0x%x\n", gp_status1);
                        if (lnkup_kr || lnkup) {
-                                        vars->rx_tx_asic_rst = 0;
+                                vars->rx_tx_asic_rst = 0;
-                                        DP(NETIF_MSG_LINK,
-                                        "link up, rx_tx_asic_rst 0x%x\n",
-                                        vars->rx_tx_asic_rst);
                        } else {
                                /* Reset the lane to see if link comes up.*/
                                bnx2x_warpcore_reset_lane(bp, phy, 1);
@@ -4507,10 +4524,14 @@ static void bnx2x_warpcore_config_init(struct bnx2x_phy *phy,
                         * enabled transmitter to avoid current leakage in case
                         * no module is connected
                         */
-                        if (bnx2x_is_sfp_module_plugged(phy, params))
+                        if ((params->loopback_mode == LOOPBACK_NONE) ||
-                                bnx2x_sfp_module_detection(phy, params);
+                            (params->loopback_mode == LOOPBACK_EXT)) {
-                        else
+                                if (bnx2x_is_sfp_module_plugged(phy, params))
-                                bnx2x_sfp_e3_set_transmitter(params, phy, 1);
+                                        bnx2x_sfp_module_detection(phy, params);
+                                else
+                                        bnx2x_sfp_e3_set_transmitter(params,
+                                                                     phy, 1);
+                        }
                        bnx2x_warpcore_config_sfi(phy, params);
                        break;
@@ -5757,6 +5778,11 @@ static int bnx2x_warpcore_read_status(struct bnx2x_phy *phy,
        rc = bnx2x_get_link_speed_duplex(phy, params, vars, link_up, gp_speed,
                                         duplex);
+        /* In case of KR link down, start up the recovering procedure */
+        if ((!link_up) && (phy->media_type == ETH_PHY_KR) &&
+            (!(phy->flags & FLAGS_WC_DUAL_MODE)))
+                vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
        DP(NETIF_MSG_LINK, "duplex %x  flow_ctrl 0x%x link_status 0x%x\n",
                   vars->duplex, vars->flow_ctrl, vars->link_status);
        return rc;
@@ -6507,6 +6533,11 @@ static int bnx2x_link_initialize(struct link_params *params,
                        params->phy[INT_PHY].config_init(phy, params, vars);
        }
+        /* Re-read this value in case it was changed inside config_init due to
+         * limitations of optic module
+         */
+        vars->line_speed = params->phy[INT_PHY].req_line_speed;
        /* Init external phy*/
        if (non_ext_phy) {
                if (params->phy[INT_PHY].supported &
@@ -8080,7 +8111,10 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                if (copper_module_type &
                    SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_ACTIVE) {
                        DP(NETIF_MSG_LINK, "Active Copper cable detected\n");
-                        check_limiting_mode = 1;
+                        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT)
+                                *edc_mode = EDC_MODE_ACTIVE_DAC;
+                        else
+                                check_limiting_mode = 1;
                } else if (copper_module_type &
                        SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
                                DP(NETIF_MSG_LINK,
@@ -8555,6 +8589,7 @@ static void bnx2x_warpcore_set_limiting_mode(struct link_params *params,
                mode = MDIO_WC_REG_UC_INFO_B1_FIRMWARE_MODE_DEFAULT;
                break;
        case EDC_MODE_PASSIVE_DAC:
+        case EDC_MODE_ACTIVE_DAC:
                mode = MDIO_WC_REG_UC_INFO_B1_FIRMWARE_MODE_SFP_DAC;
                break;
        default:
@@ -9730,32 +9765,41 @@ static int bnx2x_848xx_cmn_config_init(struct bnx2x_phy *phy,
                         MDIO_AN_DEVAD, MDIO_AN_REG_8481_1000T_CTRL,
                         an_1000_val);
-        /* set 100 speed advertisement */
+        /* Set 10/100 speed advertisement */
-        if ((phy->req_line_speed == SPEED_AUTO_NEG) &&
+        if (phy->req_line_speed == SPEED_AUTO_NEG) {
-             (phy->speed_cap_mask &
+                if (phy->speed_cap_mask &
-              (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL) {
-               PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF))) {
+                        /* Enable autoneg and restart autoneg for legacy speeds
-                an_10_100_val |= (1<<7);
+                         */
-                /* Enable autoneg and restart autoneg for legacy speeds */
+                        autoneg_val |= (1<<9 | 1<<12);
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
                        an_10_100_val |= (1<<8);
-                DP(NETIF_MSG_LINK, "Advertising 100M\n");
+                        DP(NETIF_MSG_LINK, "Advertising 100M-FD\n");
-        }
+                }
-        /* set 10 speed advertisement */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+                if (phy->speed_cap_mask &
-             (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF) {
-              (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
+                        /* Enable autoneg and restart autoneg for legacy speeds
-               PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)) &&
+                         */
-             (phy->supported &
+                        autoneg_val |= (1<<9 | 1<<12);
-              (SUPPORTED_10baseT_Half |
+                        an_10_100_val |= (1<<7);
-               SUPPORTED_10baseT_Full)))) {
+                        DP(NETIF_MSG_LINK, "Advertising 100M-HD\n");
-                an_10_100_val |= (1<<5);
+                }
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
+                if ((phy->speed_cap_mask &
+                     PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) &&
+                    (phy->supported & SUPPORTED_10baseT_Full)) {
                        an_10_100_val |= (1<<6);
-                DP(NETIF_MSG_LINK, "Advertising 10M\n");
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-FD\n");
+                }
+                if ((phy->speed_cap_mask &
+                     PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF) &&
+                    (phy->supported & SUPPORTED_10baseT_Half)) {
+                        an_10_100_val |= (1<<5);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-HD\n");
+                }
        }
        /* Only 10/100 are allowed to work in FORCE mode */
@@ -13432,43 +13476,6 @@ static void bnx2x_sfp_tx_fault_detection(struct bnx2x_phy *phy,
                }
        }
 }
-static void bnx2x_disable_kr2(struct link_params *params,
-                              struct link_vars *vars,
-                              struct bnx2x_phy *phy)
-{
-        struct bnx2x *bp = params->bp;
-        int i;
-        static struct bnx2x_reg_set reg_set[] = {
-                /* Step 1 - Program the TX/RX alignment markers */
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL5, 0x7690},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL7, 0xe647},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL6, 0xc4f0},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL9, 0x7690},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL11, 0xe647},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL10, 0xc4f0},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_USERB0_CTRL, 0x000c},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL1, 0x6000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL3, 0x0000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CODE_FIELD, 0x0002},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI1, 0x0000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI2, 0x0af7},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI3, 0x0af7},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_BAM_CODE, 0x0002},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_UD_CODE, 0x0000}
-        };
-        DP(NETIF_MSG_LINK, "Disabling 20G-KR2\n");
-        for (i = 0; i < ARRAY_SIZE(reg_set); i++)
-                bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
-                                 reg_set[i].val);
-        vars->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
-        bnx2x_update_link_attr(params, vars->link_attr_sync);
-        vars->check_kr2_recovery_cnt = CHECK_KR2_RECOVERY_CNT;
-        /* Restart AN on leading lane */
-        bnx2x_warpcore_restart_AN_KR(phy, params);
-}
 static void bnx2x_kr2_recovery(struct link_params *params,
                               struct link_vars *vars,
                               struct bnx2x_phy *phy)
@@ -13546,6 +13553,8 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
                /* Disable KR2 on both lanes */
                DP(NETIF_MSG_LINK, "BP=0x%x, NP=0x%x\n", base_page, next_page);
                bnx2x_disable_kr2(params, vars, phy);
+                /* Restart AN on leading lane */
+                bnx2x_warpcore_restart_AN_KR(phy, params);
                return;
        }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 2f8dbbbd7a86..82b658d8c04c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -4703,6 +4703,14 @@ bool bnx2x_chk_parity_attn(struct bnx2x *bp, bool *global, bool print)
        attn.sig[3] = REG_RD(bp,
                MISC_REG_AEU_AFTER_INVERT_4_FUNC_0 +
                             port*4);
+        /* Since MCP attentions can't be disabled inside the block, we need to
+         * read AEU registers to see whether they're currently disabled
+         */
+        attn.sig[3] &= ((REG_RD(bp,
+                                !port ? MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0
+                                      : MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0) &
+                         MISC_AEU_ENABLE_MCP_PRTY_BITS) |
+                        ~MISC_AEU_ENABLE_MCP_PRTY_BITS);
        if (!CHIP_IS_E1x(bp))
                attn.sig[4] = REG_RD(bp,
@@ -5447,26 +5455,24 @@ static void bnx2x_timer(unsigned long data)
        if (IS_PF(bp) &&
            !BP_NOMCP(bp)) {
                int mb_idx = BP_FW_MB_IDX(bp);
-                u32 drv_pulse;
+                u16 drv_pulse;
-                u32 mcp_pulse;
+                u16 mcp_pulse;
                ++bp->fw_drv_pulse_wr_seq;
                bp->fw_drv_pulse_wr_seq &= DRV_PULSE_SEQ_MASK;
-                /* TBD - add SYSTEM_TIME */
                drv_pulse = bp->fw_drv_pulse_wr_seq;
                bnx2x_drv_pulse(bp);
                mcp_pulse = (SHMEM_RD(bp, func_mb[mb_idx].mcp_pulse_mb) &
                             MCP_PULSE_SEQ_MASK);
                /* The delta between driver pulse and mcp response
-                 * should be 1 (before mcp response) or 0 (after mcp response)
+                 * should not get too big. If the MFW is more than 5 pulses
+                 * behind, we should worry about it enough to generate an error
+                 * log.
                 */
-                if ((drv_pulse != mcp_pulse) &&
+                if (((drv_pulse - mcp_pulse) & MCP_PULSE_SEQ_MASK) > 5)
-                    (drv_pulse != ((mcp_pulse + 1) & MCP_PULSE_SEQ_MASK))) {
+                        BNX2X_ERR("MFW seems hanged: drv_pulse (0x%x) != mcp_pulse (0x%x)\n",
-                        /* someone lost a heartbeat... */
-                        BNX2X_ERR("drv_pulse (0x%x) != mcp_pulse (0x%x)\n",
                                  drv_pulse, mcp_pulse);
-                }
        }
        if (bp->state == BNX2X_STATE_OPEN)
@@ -8652,6 +8658,7 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
        else if (bp->wol) {
                u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
                u8 *mac_addr = bp->dev->dev_addr;
+                struct pci_dev *pdev = bp->pdev;
                u32 val;
                u16 pmc;
@@ -8668,9 +8675,9 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
                /* Enable the PME and clear the status */
-                pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmc);
+                pci_read_config_word(pdev, pdev->pm_cap + PCI_PM_CTRL, &pmc);
                pmc |= PCI_PM_CTRL_PME_ENABLE | PCI_PM_CTRL_PME_STATUS;
-                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, pmc);
+                pci_write_config_word(pdev, pdev->pm_cap + PCI_PM_CTRL, pmc);
                reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
@@ -10399,7 +10406,7 @@ static void bnx2x_get_common_hwinfo(struct bnx2x *bp)
                break;
        }
-        pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_PMC, &pmc);
+        pci_read_config_word(bp->pdev, bp->pdev->pm_cap + PCI_PM_PMC, &pmc);
        bp->flags |= (pmc & PCI_PM_CAP_PME_D3cold) ? 0 : NO_WOL_FLAG;
        BNX2X_DEV_INFO("%sWoL capable\n",
@@ -12141,8 +12148,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
        }
        if (IS_PF(bp)) {
-                bp->pm_cap = pdev->pm_cap;
+                if (!pdev->pm_cap) {
-                if (bp->pm_cap == 0) {
                        dev_err(&bp->pdev->dev,
                                "Cannot find power management capability, aborting\n");
                        rc = -EIO;
@@ -13632,6 +13638,10 @@ void bnx2x_setup_cnic_info(struct bnx2x *bp)
        cp->fcoe_init_cid = BNX2X_FCOE_ETH_CID(bp);
        cp->iscsi_l2_cid = BNX2X_ISCSI_ETH_CID(bp);
+        DP(NETIF_MSG_IFUP, "BNX2X_1st_NON_L2_ETH_CID(bp) %x, cp->starting_cid %x, cp->fcoe_init_cid %x, cp->iscsi_l2_cid %x\n",
+           BNX2X_1st_NON_L2_ETH_CID(bp), cp->starting_cid, cp->fcoe_init_cid,
+           cp->iscsi_l2_cid);
        if (NO_ISCSI_OOO(bp))
                cp->drv_state |= CNIC_DRV_STATE_NO_ISCSI_OOO;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 2604b6204abe..9ad012bdd915 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1819,7 +1819,7 @@ bnx2x_get_vf_igu_cam_info(struct bnx2x *bp)
                fid = GET_FIELD((val), IGU_REG_MAPPING_MEMORY_FID);
                if (fid & IGU_FID_ENCODE_IS_PF)
                        current_pf = fid & IGU_FID_PF_NUM_MASK;
-                else if (current_pf == BP_ABS_FUNC(bp))
+                else if (current_pf == BP_FUNC(bp))
                        bnx2x_vf_set_igu_info(bp, sb_id,
                                              (fid & IGU_FID_VF_NUM_MASK));
                DP(BNX2X_MSG_IOV, "%s[%d], igu_sb_id=%d, msix=%d\n",
@@ -3180,6 +3180,7 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                /* set local queue arrays */
                vf->vfqs = &bp->vfdb->vfqs[qcount];
                qcount += vf_sb_count(vf);
+                bnx2x_iov_static_resc(bp, vf);
        }
        /* prepare msix vectors in VF configuration space */
@@ -3187,6 +3188,8 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                bnx2x_pretend_func(bp, HW_VF_HANDLE(bp, vf_idx));
                REG_WR(bp, PCICFG_OFFSET + GRC_CONFIG_REG_VF_MSIX_CONTROL,
                       num_vf_queues);
+                DP(BNX2X_MSG_IOV, "set msix vec num in VF %d cfg space to %d\n",
+                   vf_idx, num_vf_queues);
        }
        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 6cfb88732452..da16953eb2ec 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -1765,28 +1765,28 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
                switch (mbx->first_tlv.tl.type) {
                case CHANNEL_TLV_ACQUIRE:
                        bnx2x_vf_mbx_acquire(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_INIT:
                        bnx2x_vf_mbx_init_vf(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_SETUP_Q:
                        bnx2x_vf_mbx_setup_q(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_SET_Q_FILTERS:
                        bnx2x_vf_mbx_set_q_filters(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_TEARDOWN_Q:
                        bnx2x_vf_mbx_teardown_q(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_CLOSE:
                        bnx2x_vf_mbx_close_vf(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_RELEASE:
                        bnx2x_vf_mbx_release_vf(bp, vf, mbx);
-                        break;
+                        return;
                case CHANNEL_TLV_UPDATE_RSS:
                        bnx2x_vf_mbx_update_rss(bp, vf, mbx);
-                        break;
+                        return;
                }
        } else {
@@ -1802,26 +1802,24 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
                for (i = 0; i < 20; i++)
                        DP_CONT(BNX2X_MSG_IOV, "%x ",
                                mbx->msg->req.tlv_buf_size.tlv_buffer[i]);
+        }
-                /* test whether we can respond to the VF (do we have an address
+        /* can we respond to VF (do we have an address for it?) */
-                 * for it?)
+        if (vf->state == VF_ACQUIRED || vf->state == VF_ENABLED) {
-                 */
+                /* mbx_resp uses the op_rc of the VF */
-                if (vf->state == VF_ACQUIRED || vf->state == VF_ENABLED) {
+                vf->op_rc = PFVF_STATUS_NOT_SUPPORTED;
-                        /* mbx_resp uses the op_rc of the VF */
-                        vf->op_rc = PFVF_STATUS_NOT_SUPPORTED;
-                        /* notify the VF that we do not support this request */
+                /* notify the VF that we do not support this request */
-                        bnx2x_vf_mbx_resp(bp, vf);
+                bnx2x_vf_mbx_resp(bp, vf);
-                } else {
+        } else {
-                        /* can't send a response since this VF is unknown to us
+                /* can't send a response since this VF is unknown to us
-                         * just ack the FW to release the mailbox and unlock
+                 * just ack the FW to release the mailbox and unlock
-                         * the channel.
+                 * the channel.
-                         */
+                 */
-                        storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
+                storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
-                        mmiowb();
+                /* Firmware ack should be written before unlocking channel */
-                        bnx2x_unlock_vf_pf_channel(bp, vf,
+                mmiowb();
-                                                   mbx->first_tlv.tl.type);
+                bnx2x_unlock_vf_pf_channel(bp, vf, mbx->first_tlv.tl.type);
-                }
        }
 }
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 8142480d9770..99394bd49a13 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -3135,6 +3135,7 @@ static void cnic_service_bnx2x_bh(unsigned long data)
 {
        struct cnic_dev *dev = (struct cnic_dev *) data;
        struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
        u32 status_idx, new_status_idx;
        if (unlikely(!test_bit(CNIC_F_CNIC_UP, &dev->flags)))
@@ -3146,7 +3147,7 @@ static void cnic_service_bnx2x_bh(unsigned long data)
                CNIC_WR16(dev, cp->kcq1.io_addr,
                          cp->kcq1.sw_prod_idx + MAX_KCQ_IDX);
-                if (cp->ethdev->drv_state & CNIC_DRV_STATE_NO_FCOE) {
+                if (!CNIC_SUPPORTS_FCOE(bp)) {
                        cp->arm_int(dev, status_idx);
                        break;
                }
@@ -5217,7 +5218,8 @@ static void cnic_init_rings(struct cnic_dev *dev)
                                "iSCSI CLIENT_SETUP did not complete\n");
                cnic_spq_completion(dev, DRV_CTL_RET_L2_SPQ_CREDIT_CMD, 1);
                cnic_ring_ctl(dev, cid, cli, 1);
-                *cid_ptr = cid;
+                *cid_ptr = cid >> 4;
+                *(cid_ptr + 1) = cid * bp->db_size;
        }
 }
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 5701f3d1a169..12d961c4ebca 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -3034,6 +3034,7 @@ static bool tg3_phy_led_bug(struct tg3 *tp)
 {
        switch (tg3_asic_rev(tp)) {
        case ASIC_REV_5719:
+        case ASIC_REV_5720:
                if ((tp->phy_flags & TG3_PHYFLG_MII_SERDES) &&
                    !tp->pci_fn)
                        return true;
@@ -16192,12 +16193,12 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
                         * So explicitly force the chip into D0 here.
                         */
                        pci_read_config_dword(tp->pdev,
-                                              tp->pm_cap + PCI_PM_CTRL,
+                                              tp->pdev->pm_cap + PCI_PM_CTRL,
                                              &pm_reg);
                        pm_reg &= ~PCI_PM_CTRL_STATE_MASK;
                        pm_reg |= PCI_PM_CTRL_PME_ENABLE | 0 /* D0 */;
                        pci_write_config_dword(tp->pdev,
-                                               tp->pm_cap + PCI_PM_CTRL,
+                                               tp->pdev->pm_cap + PCI_PM_CTRL,
                                               pm_reg);
                        /* Also, force SERR#/PERR# in PCI command. */
@@ -17346,7 +17347,6 @@ static int tg3_init_one(struct pci_dev *pdev,
        tp = netdev_priv(dev);
        tp->pdev = pdev;
        tp->dev = dev;
-        tp->pm_cap = pdev->pm_cap;
        tp->rx_mode = TG3_DEF_RX_MODE;
        tp->tx_mode = TG3_DEF_TX_MODE;
        tp->irq_sync = 1;
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index ddb8be1298ea..70257808aa37 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -3234,7 +3234,6 @@ struct tg3 {
        u8                              pci_lat_timer;
        int                             pci_fn;
-        int                             pm_cap;
        int                             msi_cap;
        int                             pcix_cap;
        int                             pcie_readrq;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 0d0665ca6f19..c73cabdbd4c0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -6149,8 +6149,10 @@ static int __init cxgb4_init_module(void)
                pr_warn("could not create debugfs entry, continuing\n");
        ret = pci_register_driver(&cxgb4_driver);
-        if (ret < 0)
+        if (ret < 0) {
                debugfs_remove(cxgb4_debugfs_root);
+                destroy_workqueue(workq);
+        }
        register_inet6addr_notifier(&cxgb4_inet6addr_notifier);
diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
index 2db6c573cec7..263b92c00cbf 100644
--- a/drivers/net/ethernet/dec/tulip/de4x5.c
+++ b/drivers/net/ethernet/dec/tulip/de4x5.c
@@ -1321,7 +1321,7 @@ de4x5_open(struct net_device *dev)
    if (request_irq(dev->irq, de4x5_interrupt, IRQF_SHARED,
                                                     lp->adapter_name, dev)) {
        printk("de4x5_open(): Requested IRQ%d is busy - attemping FAST/SHARE...", dev->irq);
-        if (request_irq(dev->irq, de4x5_interrupt, IRQF_DISABLED | IRQF_SHARED,
+        if (request_irq(dev->irq, de4x5_interrupt, IRQF_SHARED,
                                                     lp->adapter_name, dev)) {
            printk("\n              Cannot get IRQ- reconfigure your hardware.\n");
            disable_ast(dev);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index ace5050dba38..db020230bd0b 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -88,6 +88,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define BE_MIN_MTU              256
 #define BE_NUM_VLANS_SUPPORTED  64
+#define BE_UMC_NUM_VLANS_SUPPORTED      15
 #define BE_MAX_EQD              96u
 #define BE_MAX_TX_FRAG_COUNT    30
@@ -333,6 +334,7 @@ enum vf_state {
 #define BE_FLAGS_LINK_STATUS_INIT               1
 #define BE_FLAGS_WORKER_SCHEDULED               (1 << 3)
+#define BE_FLAGS_VLAN_PROMISC                   (1 << 4)
 #define BE_FLAGS_NAPI_ENABLED                   (1 << 9)
 #define BE_UC_PMAC_COUNT                30
 #define BE_VF_UC_PMAC_COUNT             2
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 1ab5dab11eff..bd0e0c0bbcd8 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -180,6 +180,9 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
                        dev_err(&adapter->pdev->dev,
                                "opcode %d-%d failed:status %d-%d\n",
                                opcode, subsystem, compl_status, extd_status);
+                        if (extd_status == MCC_ADDL_STS_INSUFFICIENT_RESOURCES)
+                                return extd_status;
                }
        }
 done:
@@ -1812,6 +1815,12 @@ int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
        } else if (flags & IFF_ALLMULTI) {
                req->if_flags_mask = req->if_flags =
                                cpu_to_le32(BE_IF_FLAGS_MCAST_PROMISCUOUS);
+        } else if (flags & BE_FLAGS_VLAN_PROMISC) {
+                req->if_flags_mask = cpu_to_le32(BE_IF_FLAGS_VLAN_PROMISCUOUS);
+                if (value == ON)
+                        req->if_flags =
+                                cpu_to_le32(BE_IF_FLAGS_VLAN_PROMISCUOUS);
        } else {
                struct netdev_hw_addr *ha;
                int i = 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index d026226db88c..108ca8abf0af 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -60,6 +60,8 @@ enum {
        MCC_STATUS_NOT_SUPPORTED = 66
 };
+#define MCC_ADDL_STS_INSUFFICIENT_RESOURCES     0x16
 #define CQE_STATUS_COMPL_MASK           0xFFFF
 #define CQE_STATUS_COMPL_SHIFT          0       /* bits 0 - 15 */
 #define CQE_STATUS_EXTD_MASK            0xFFFF
@@ -1791,7 +1793,7 @@ struct be_nic_res_desc {
        u8 acpi_params;
        u8 wol_param;
        u16 rsvd7;
-        u32 rsvd8[3];
+        u32 rsvd8[7];
 } __packed;
 struct be_cmd_req_get_func_config {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 3224d28cdad4..2c38cc402119 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -855,11 +855,11 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
        unsigned int eth_hdr_len;
        struct iphdr *ip;
-        /* Lancer ASIC has a bug wherein packets that are 32 bytes or less
+        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or less
         * may cause a transmit stall on that port. So the work-around is to
-         * pad such packets to a 36-byte length.
+         * pad short packets (<= 32 bytes) to a 36-byte length.
         */
-        if (unlikely(lancer_chip(adapter) && skb->len <= 32)) {
+        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
                if (skb_padto(skb, 36))
                        goto tx_drop;
                skb->len = 36;
@@ -1013,18 +1013,40 @@ static int be_vid_config(struct be_adapter *adapter)
        status = be_cmd_vlan_config(adapter, adapter->if_handle,
                                    vids, num, 1, 0);
-        /* Set to VLAN promisc mode as setting VLAN filter failed */
        if (status) {
-                dev_info(&adapter->pdev->dev, "Exhausted VLAN HW filters.\n");
+                /* Set to VLAN promisc mode as setting VLAN filter failed */
-                dev_info(&adapter->pdev->dev, "Disabling HW VLAN filtering.\n");
+                if (status == MCC_ADDL_STS_INSUFFICIENT_RESOURCES)
-                goto set_vlan_promisc;
+                        goto set_vlan_promisc;
+                dev_err(&adapter->pdev->dev,
+                        "Setting HW VLAN filtering failed.\n");
+        } else {
+                if (adapter->flags & BE_FLAGS_VLAN_PROMISC) {
+                        /* hw VLAN filtering re-enabled. */
+                        status = be_cmd_rx_filter(adapter,
+                                                  BE_FLAGS_VLAN_PROMISC, OFF);
+                        if (!status) {
+                                dev_info(&adapter->pdev->dev,
+                                         "Disabling VLAN Promiscuous mode.\n");
+                                adapter->flags &= ~BE_FLAGS_VLAN_PROMISC;
+                                dev_info(&adapter->pdev->dev,
+                                         "Re-Enabling HW VLAN filtering\n");
+                        }
+                }
        }
        return status;
 set_vlan_promisc:
-        status = be_cmd_vlan_config(adapter, adapter->if_handle,
+        dev_warn(&adapter->pdev->dev, "Exhausted VLAN HW filters.\n");
-                                    NULL, 0, 1, 1);
+        status = be_cmd_rx_filter(adapter, BE_FLAGS_VLAN_PROMISC, ON);
+        if (!status) {
+                dev_info(&adapter->pdev->dev, "Enable VLAN Promiscuous mode\n");
+                dev_info(&adapter->pdev->dev, "Disabling HW VLAN filtering\n");
+                adapter->flags |= BE_FLAGS_VLAN_PROMISC;
+        } else
+                dev_err(&adapter->pdev->dev,
+                        "Failed to enable VLAN Promiscuous mode.\n");
        return status;
 }
@@ -1033,10 +1055,6 @@ static int be_vlan_add_vid(struct net_device *netdev, __be16 proto, u16 vid)
        struct be_adapter *adapter = netdev_priv(netdev);
        int status = 0;
-        if (!lancer_chip(adapter) && !be_physfn(adapter)) {
-                status = -EINVAL;
-                goto ret;
-        }
        /* Packets with VID 0 are always received by Lancer by default */
        if (lancer_chip(adapter) && vid == 0)
@@ -1059,11 +1077,6 @@ static int be_vlan_rem_vid(struct net_device *netdev, __be16 proto, u16 vid)
        struct be_adapter *adapter = netdev_priv(netdev);
        int status = 0;
-        if (!lancer_chip(adapter) && !be_physfn(adapter)) {
-                status = -EINVAL;
-                goto ret;
-        }
        /* Packets with VID 0 are always received by Lancer by default */
        if (lancer_chip(adapter) && vid == 0)
                goto ret;
@@ -1188,8 +1201,8 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
        vi->vf = vf;
        vi->tx_rate = vf_cfg->tx_rate;
-        vi->vlan = vf_cfg->vlan_tag;
+        vi->vlan = vf_cfg->vlan_tag & VLAN_VID_MASK;
-        vi->qos = 0;
+        vi->qos = vf_cfg->vlan_tag >> VLAN_PRIO_SHIFT;
        memcpy(&vi->mac, vf_cfg->mac_addr, ETH_ALEN);
        return 0;
@@ -1199,28 +1212,29 @@ static int be_set_vf_vlan(struct net_device *netdev,
                        int vf, u16 vlan, u8 qos)
 {
        struct be_adapter *adapter = netdev_priv(netdev);
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
        int status = 0;
        if (!sriov_enabled(adapter))
                return -EPERM;
-        if (vf >= adapter->num_vfs || vlan > 4095)
+        if (vf >= adapter->num_vfs || vlan > 4095 || qos > 7)
                return -EINVAL;
-        if (vlan) {
+        if (vlan || qos) {
-                if (adapter->vf_cfg[vf].vlan_tag != vlan) {
+                vlan |= qos << VLAN_PRIO_SHIFT;
+                if (vf_cfg->vlan_tag != vlan) {
                        /* If this is new value, program it. Else skip. */
-                        adapter->vf_cfg[vf].vlan_tag = vlan;
+                        vf_cfg->vlan_tag = vlan;
+                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                        status = be_cmd_set_hsw_config(adapter, vlan,
+                                                       vf_cfg->if_handle, 0);
-                                vf + 1, adapter->vf_cfg[vf].if_handle, 0);
                }
        } else {
                /* Reset Transparent Vlan Tagging. */
-                adapter->vf_cfg[vf].vlan_tag = 0;
+                vf_cfg->vlan_tag = 0;
-                vlan = adapter->vf_cfg[vf].def_vid;
+                vlan = vf_cfg->def_vid;
                status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                        adapter->vf_cfg[vf].if_handle, 0);
+                                               vf_cfg->if_handle, 0);
        }
@@ -2802,7 +2816,7 @@ static int be_vfs_if_create(struct be_adapter *adapter)
        struct be_resources res = {0};
        struct be_vf_cfg *vf_cfg;
        u32 cap_flags, en_flags, vf;
-        int status;
+        int status = 0;
        cap_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                    BE_IF_FLAGS_MULTICAST;
@@ -2963,6 +2977,8 @@ static void BEx_get_resources(struct be_adapter *adapter,
        if (adapter->function_mode & FLEX10_MODE)
                res->max_vlans = BE_NUM_VLANS_SUPPORTED/8;
+        else if (adapter->function_mode & UMC_ENABLED)
+                res->max_vlans = BE_UMC_NUM_VLANS_SUPPORTED;
        else
                res->max_vlans = BE_NUM_VLANS_SUPPORTED;
        res->max_mcast_mac = BE_MAX_MC;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index f9aacf5d8523..b2793b91cc55 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2199,7 +2199,7 @@ fec_probe(struct platform_device *pdev)
                        goto failed_irq;
                }
                ret = devm_request_irq(&pdev->dev, irq, fec_enet_interrupt,
-                                       IRQF_DISABLED, pdev->name, ndev);
+                                       0, pdev->name, ndev);
                if (ret)
                        goto failed_irq;
        }
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index 098f133908ae..e006a09ba899 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -452,7 +452,9 @@ static int gianfar_ptp_probe(struct platform_device *dev)
        err = -ENODEV;
        etsects->caps = ptp_gianfar_caps;
-        etsects->cksel = DEFAULT_CKSEL;
+        if (get_of_u32(node, "fsl,cksel", &etsects->cksel))
+                etsects->cksel = DEFAULT_CKSEL;
        if (get_of_u32(node, "fsl,tclk-period", &etsects->tclk_period) ||
            get_of_u32(node, "fsl,tmr-prsc", &etsects->tmr_prsc) ||
diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
index e3c7c697fc45..91227d03274e 100644
--- a/drivers/net/ethernet/hp/hp100.c
+++ b/drivers/net/ethernet/hp/hp100.c
@@ -1097,7 +1097,7 @@ static int hp100_open(struct net_device *dev)
        /* New: if bus is PCI or EISA, interrupts might be shared interrupts */
        if (request_irq(dev->irq, hp100_interrupt,
                        lp->bus == HP100_BUS_PCI || lp->bus ==
-                        HP100_BUS_EISA ? IRQF_SHARED : IRQF_DISABLED,
+                        HP100_BUS_EISA ? IRQF_SHARED : 0,
                        "hp100", dev)) {
                printk("hp100: %s: unable to get IRQ %d\n", dev->name, dev->irq);
                return -EAGAIN;
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 35853b43d66e..2d1c6bdd3618 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -102,6 +102,19 @@ static int ehea_probe_adapter(struct platform_device *dev);
 static int ehea_remove(struct platform_device *dev);
+static struct of_device_id ehea_module_device_table[] = {
+        {
+                .name = "lhea",
+                .compatible = "IBM,lhea",
+        },
+        {
+                .type = "network",
+                .compatible = "IBM,lhea-ethernet",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, ehea_module_device_table);
 static struct of_device_id ehea_device_table[] = {
        {
                .name = "lhea",
@@ -109,7 +122,6 @@ static struct of_device_id ehea_device_table[] = {
        },
        {},
 };
-MODULE_DEVICE_TABLE(of, ehea_device_table);
 static struct platform_driver ehea_driver = {
        .driver = {
@@ -1285,7 +1297,7 @@ static int ehea_reg_interrupts(struct net_device *dev)
        ret = ibmebus_request_irq(port->qp_eq->attr.ist1,
                                  ehea_qp_aff_irq_handler,
-                                  IRQF_DISABLED, port->int_aff_name, port);
+                                  0, port->int_aff_name, port);
        if (ret) {
                netdev_err(dev, "failed registering irq for qp_aff_irq_handler:ist=%X\n",
                           port->qp_eq->attr.ist1);
@@ -1303,8 +1315,7 @@ static int ehea_reg_interrupts(struct net_device *dev)
                         "%s-queue%d", dev->name, i);
                ret = ibmebus_request_irq(pr->eq->attr.ist1,
                                          ehea_recv_irq_handler,
-                                          IRQF_DISABLED, pr->int_send_name,
+                                          0, pr->int_send_name, pr);
-                                          pr);
                if (ret) {
                        netdev_err(dev, "failed registering irq for ehea_queue port_res_nr:%d, ist=%X\n",
                                   i, pr->eq->attr.ist1);
@@ -3320,7 +3331,7 @@ static int ehea_probe_adapter(struct platform_device *dev)
        }
        ret = ibmebus_request_irq(adapter->neq->attr.ist1,
-                                  ehea_interrupt_neq, IRQF_DISABLED,
+                                  ehea_interrupt_neq, 0,
                                  "ehea_neq", adapter);
        if (ret) {
                dev_err(&dev->dev, "requesting NEQ IRQ failed\n");
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index a8633b8f0ac5..d14c8f53384c 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -922,6 +922,14 @@ static int e1000_reg_test(struct e1000_adapter *adapter, u64 *data)
                        else
                                mask &= ~(1 << 30);
                }
+                if (mac->type == e1000_pch2lan) {
+                        /* SHRAH[0,1,2] different than previous */
+                        if (i == 7)
+                                mask &= 0xFFF4FFFF;
+                        /* SHRAH[3] different than SHRAH[0,1,2] */
+                        if (i == 10)
+                                mask |= (1 << 30);
+                }
                REG_PATTERN_TEST_ARRAY(E1000_RA, ((i << 1) + 1), mask,
                                       0xFFFFFFFF);
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index af08188d7e62..42f0f6717511 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1371,7 +1371,10 @@ static void e1000_rar_set_pch2lan(struct e1000_hw *hw, u8 *addr, u32 index)
                return;
        }
-        if (index < hw->mac.rar_entry_count) {
+        /* RAR[1-6] are owned by manageability.  Skip those and program the
+         * next address into the SHRA register array.
+         */
+        if (index < (u32)(hw->mac.rar_entry_count - 6)) {
                s32 ret_val;
                ret_val = e1000_acquire_swflag_ich8lan(hw);
@@ -1962,8 +1965,8 @@ void e1000_copy_rx_addrs_to_phy_ich8lan(struct e1000_hw *hw)
        if (ret_val)
                goto release;
-        /* Copy both RAL/H (rar_entry_count) and SHRAL/H (+4) to PHY */
+        /* Copy both RAL/H (rar_entry_count) and SHRAL/H to PHY */
-        for (i = 0; i < (hw->mac.rar_entry_count + 4); i++) {
+        for (i = 0; i < (hw->mac.rar_entry_count); i++) {
                mac_reg = er32(RAL(i));
                hw->phy.ops.write_reg_page(hw, BM_RAR_L(i),
                                           (u16)(mac_reg & 0xFFFF));
@@ -2007,10 +2010,10 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                return ret_val;
        if (enable) {
-                /* Write Rx addresses (rar_entry_count for RAL/H, +4 for
+                /* Write Rx addresses (rar_entry_count for RAL/H, and
                 * SHRAL/H) and initial CRC values to the MAC
                 */
-                for (i = 0; i < (hw->mac.rar_entry_count + 4); i++) {
+                for (i = 0; i < hw->mac.rar_entry_count; i++) {
                        u8 mac_addr[ETH_ALEN] = { 0 };
                        u32 addr_high, addr_low;
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index 59865695b282..217090df33e7 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -98,7 +98,7 @@
 #define PCIE_ICH8_SNOOP_ALL     PCIE_NO_SNOOP_ALL
 #define E1000_ICH_RAR_ENTRIES   7
-#define E1000_PCH2_RAR_ENTRIES  5       /* RAR[0], SHRA[0-3] */
+#define E1000_PCH2_RAR_ENTRIES  11      /* RAR[0-6], SHRA[0-3] */
 #define E1000_PCH_LPT_RAR_ENTRIES       12      /* RAR[0], SHRA[0-10] */
 #define PHY_PAGE_SHIFT          5
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index e87e9b01f404..4ef786775acb 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -4868,7 +4868,7 @@ static void e1000_watchdog_task(struct work_struct *work)
                         */
                        if ((hw->phy.type == e1000_phy_igp_3 ||
                             hw->phy.type == e1000_phy_bm) &&
-                            (hw->mac.autoneg == true) &&
+                            hw->mac.autoneg &&
                            (adapter->link_speed == SPEED_10 ||
                             adapter->link_speed == SPEED_100) &&
                            (adapter->link_duplex == HALF_DUPLEX)) {
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.c b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
index 0c524fa9f811..cfef7fc32cdd 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
@@ -701,8 +701,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
        details = I40E_ADMINQ_DETAILS(hw->aq.asq, hw->aq.asq.next_to_use);
        if (cmd_details) {
-                memcpy(details, cmd_details,
+                *details = *cmd_details;
-                       sizeof(struct i40e_asq_cmd_details));
                /* If the cmd_details are defined copy the cookie.  The
                 * cpu_to_le32 is not needed here because the data is ignored
@@ -760,7 +759,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
        desc_on_ring = I40E_ADMINQ_DESC(hw->aq.asq, hw->aq.asq.next_to_use);
        /* if the desc is available copy the temp desc to the right place */
-        memcpy(desc_on_ring, desc, sizeof(struct i40e_aq_desc));
+        *desc_on_ring = *desc;
        /* if buff is not NULL assume indirect command */
        if (buff != NULL) {
@@ -807,7 +806,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
        /* if ready, copy the desc back to temp */
        if (i40e_asq_done(hw)) {
-                memcpy(desc, desc_on_ring, sizeof(struct i40e_aq_desc));
+                *desc = *desc_on_ring;
                if (buff != NULL)
                        memcpy(buff, dma_buff->va, buff_size);
                retval = le16_to_cpu(desc->retval);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index c21df7bc3b1d..1e4ea134975a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -507,7 +507,7 @@ i40e_status i40e_aq_get_link_info(struct i40e_hw *hw,
        /* save link status information */
        if (link)
-                memcpy(link, hw_link_info, sizeof(struct i40e_link_status));
+                *link = *hw_link_info;
        /* flag cleared so helper functions don't call AQ again */
        hw->phy.get_link_info = false;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 601d482694ea..221aa4795017 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -101,10 +101,10 @@ int i40e_allocate_dma_mem_d(struct i40e_hw *hw, struct i40e_dma_mem *mem,
        mem->size = ALIGN(size, alignment);
        mem->va = dma_zalloc_coherent(&pf->pdev->dev, mem->size,
                                      &mem->pa, GFP_KERNEL);
-        if (mem->va)
+        if (!mem->va)
-                return 0;
+                return -ENOMEM;
-        return -ENOMEM;
+        return 0;
 }
 /**
@@ -136,10 +136,10 @@ int i40e_allocate_virt_mem_d(struct i40e_hw *hw, struct i40e_virt_mem *mem,
        mem->size = size;
        mem->va = kzalloc(size, GFP_KERNEL);
-        if (mem->va)
+        if (!mem->va)
-                return 0;
+                return -ENOMEM;
-        return -ENOMEM;
+        return 0;
 }
 /**
@@ -174,8 +174,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
                         u16 needed, u16 id)
 {
        int ret = -ENOMEM;
-        int i = 0;
+        int i, j;
-        int j = 0;
        if (!pile || needed == 0 || id >= I40E_PILE_VALID_BIT) {
                dev_info(&pf->pdev->dev,
@@ -186,7 +185,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
        /* start the linear search with an imperfect hint */
        i = pile->search_hint;
-        while (i < pile->num_entries && ret < 0) {
+        while (i < pile->num_entries) {
                /* skip already allocated entries */
                if (pile->list[i] & I40E_PILE_VALID_BIT) {
                        i++;
@@ -205,6 +204,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
                                pile->list[i+j] = id | I40E_PILE_VALID_BIT;
                        ret = i;
                        pile->search_hint = i + j;
+                        break;
                } else {
                        /* not enough, so skip over it and continue looking */
                        i += j;
@@ -1388,7 +1388,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
        bool add_happened = false;
        int filter_list_len = 0;
        u32 changed_flags = 0;
-        i40e_status ret = 0;
+        i40e_status aq_ret = 0;
        struct i40e_pf *pf;
        int num_add = 0;
        int num_del = 0;
@@ -1449,28 +1449,28 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                        /* flush a full buffer */
                        if (num_del == filter_list_len) {
-                                ret = i40e_aq_remove_macvlan(&pf->hw,
+                                aq_ret = i40e_aq_remove_macvlan(&pf->hw,
                                            vsi->seid, del_list, num_del,
                                            NULL);
                                num_del = 0;
                                memset(del_list, 0, sizeof(*del_list));
-                                if (ret)
+                                if (aq_ret)
                                        dev_info(&pf->pdev->dev,
                                                 "ignoring delete macvlan error, err %d, aq_err %d while flushing a full buffer\n",
-                                                 ret,
+                                                 aq_ret,
                                                 pf->hw.aq.asq_last_status);
                        }
                }
                if (num_del) {
-                        ret = i40e_aq_remove_macvlan(&pf->hw, vsi->seid,
+                        aq_ret = i40e_aq_remove_macvlan(&pf->hw, vsi->seid,
                                                     del_list, num_del, NULL);
                        num_del = 0;
-                        if (ret)
+                        if (aq_ret)
                                dev_info(&pf->pdev->dev,
                                         "ignoring delete macvlan error, err %d, aq_err %d\n",
-                                         ret, pf->hw.aq.asq_last_status);
+                                         aq_ret, pf->hw.aq.asq_last_status);
                }
                kfree(del_list);
@@ -1515,32 +1515,30 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                        /* flush a full buffer */
                        if (num_add == filter_list_len) {
-                                ret = i40e_aq_add_macvlan(&pf->hw,
+                                aq_ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
-                                                          vsi->seid,
+                                                             add_list, num_add,
-                                                          add_list,
+                                                             NULL);
-                                                          num_add,
-                                                          NULL);
                                num_add = 0;
-                                if (ret)
+                                if (aq_ret)
                                        break;
                                memset(add_list, 0, sizeof(*add_list));
                        }
                }
                if (num_add) {
-                        ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
+                        aq_ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
-                                                  add_list, num_add, NULL);
+                                                     add_list, num_add, NULL);
                        num_add = 0;
                }
                kfree(add_list);
                add_list = NULL;
-                if (add_happened && (!ret)) {
+                if (add_happened && (!aq_ret)) {
                        /* do nothing */;
-                } else if (add_happened && (ret)) {
+                } else if (add_happened && (aq_ret)) {
                        dev_info(&pf->pdev->dev,
                                 "add filter failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
                        if ((pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOSPC) &&
                            !test_bit(__I40E_FILTER_OVERFLOW_PROMISC,
                                      &vsi->state)) {
@@ -1556,28 +1554,27 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
        if (changed_flags & IFF_ALLMULTI) {
                bool cur_multipromisc;
                cur_multipromisc = !!(vsi->current_netdev_flags & IFF_ALLMULTI);
-                ret = i40e_aq_set_vsi_multicast_promiscuous(&vsi->back->hw,
+                aq_ret = i40e_aq_set_vsi_multicast_promiscuous(&vsi->back->hw,
-                                                            vsi->seid,
+                                                               vsi->seid,
-                                                            cur_multipromisc,
+                                                               cur_multipromisc,
-                                                            NULL);
+                                                               NULL);
-                if (ret)
+                if (aq_ret)
                        dev_info(&pf->pdev->dev,
                                 "set multi promisc failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
        }
        if ((changed_flags & IFF_PROMISC) || promisc_forced_on) {
                bool cur_promisc;
                cur_promisc = (!!(vsi->current_netdev_flags & IFF_PROMISC) ||
                               test_bit(__I40E_FILTER_OVERFLOW_PROMISC,
                                        &vsi->state));
-                ret = i40e_aq_set_vsi_unicast_promiscuous(&vsi->back->hw,
+                aq_ret = i40e_aq_set_vsi_unicast_promiscuous(&vsi->back->hw,
-                                                          vsi->seid,
+                                                             vsi->seid,
-                                                          cur_promisc,
+                                                             cur_promisc, NULL);
-                                                          NULL);
+                if (aq_ret)
-                if (ret)
                        dev_info(&pf->pdev->dev,
                                 "set uni promisc failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
        }
        clear_bit(__I40E_CONFIG_BUSY, &vsi->state);
@@ -1790,6 +1787,8 @@ int i40e_vsi_add_vlan(struct i40e_vsi *vsi, s16 vid)
 * i40e_vsi_kill_vlan - Remove vsi membership for given vlan
 * @vsi: the vsi being configured
 * @vid: vlan id to be removed (0 = untagged only , -1 = any)
+ *
+ * Return: 0 on success or negative otherwise
 **/
 int i40e_vsi_kill_vlan(struct i40e_vsi *vsi, s16 vid)
 {
@@ -1863,37 +1862,39 @@ int i40e_vsi_kill_vlan(struct i40e_vsi *vsi, s16 vid)
 * i40e_vlan_rx_add_vid - Add a vlan id filter to HW offload
 * @netdev: network interface to be adjusted
 * @vid: vlan id to be added
+ *
+ * net_device_ops implementation for adding vlan ids
 **/
 static int i40e_vlan_rx_add_vid(struct net_device *netdev,
                                __always_unused __be16 proto, u16 vid)
 {
        struct i40e_netdev_priv *np = netdev_priv(netdev);
        struct i40e_vsi *vsi = np->vsi;
-        int ret;
+        int ret = 0;
        if (vid > 4095)
-                return 0;
+                return -EINVAL;
+        netdev_info(netdev, "adding %pM vid=%d\n", netdev->dev_addr, vid);
-        netdev_info(vsi->netdev, "adding %pM vid=%d\n",
-                    netdev->dev_addr, vid);
        /* If the network stack called us with vid = 0, we should
         * indicate to i40e_vsi_add_vlan() that we want to receive
         * any traffic (i.e. with any vlan tag, or untagged)
         */
        ret = i40e_vsi_add_vlan(vsi, vid ? vid : I40E_VLAN_ANY);
-        if (!ret) {
+        if (!ret && (vid < VLAN_N_VID))
-                if (vid < VLAN_N_VID)
+                set_bit(vid, vsi->active_vlans);
-                        set_bit(vid, vsi->active_vlans);
-        }
-        return 0;
+        return ret;
 }
 /**
 * i40e_vlan_rx_kill_vid - Remove a vlan id filter from HW offload
 * @netdev: network interface to be adjusted
 * @vid: vlan id to be removed
+ *
+ * net_device_ops implementation for adding vlan ids
 **/
 static int i40e_vlan_rx_kill_vid(struct net_device *netdev,
                                 __always_unused __be16 proto, u16 vid)
@@ -1901,15 +1902,16 @@ static int i40e_vlan_rx_kill_vid(struct net_device *netdev,
        struct i40e_netdev_priv *np = netdev_priv(netdev);
        struct i40e_vsi *vsi = np->vsi;
-        netdev_info(vsi->netdev, "removing %pM vid=%d\n",
+        netdev_info(netdev, "removing %pM vid=%d\n", netdev->dev_addr, vid);
-                    netdev->dev_addr, vid);
        /* return code is ignored as there is nothing a user
         * can do about failure to remove and a log message was
-         * already printed from another function
+         * already printed from the other function
         */
        i40e_vsi_kill_vlan(vsi, vid);
        clear_bit(vid, vsi->active_vlans);
        return 0;
 }
@@ -1936,10 +1938,10 @@ static void i40e_restore_vlan(struct i40e_vsi *vsi)
 * @vsi: the vsi being adjusted
 * @vid: the vlan id to set as a PVID
 **/
-i40e_status i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
+int i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
 {
        struct i40e_vsi_context ctxt;
-        i40e_status ret;
+        i40e_status aq_ret;
        vsi->info.valid_sections = cpu_to_le16(I40E_AQ_VSI_PROP_VLAN_VALID);
        vsi->info.pvid = cpu_to_le16(vid);
@@ -1948,14 +1950,15 @@ i40e_status i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
        ctxt.seid = vsi->seid;
        memcpy(&ctxt.info, &vsi->info, sizeof(vsi->info));
-        ret = i40e_aq_update_vsi_params(&vsi->back->hw, &ctxt, NULL);
+        aq_ret = i40e_aq_update_vsi_params(&vsi->back->hw, &ctxt, NULL);
-        if (ret) {
+        if (aq_ret) {
                dev_info(&vsi->back->pdev->dev,
                         "%s: update vsi failed, aq_err=%d\n",
                         __func__, vsi->back->hw.aq.asq_last_status);
+                return -ENOENT;
        }
-        return ret;
+        return 0;
 }
 /**
@@ -3326,7 +3329,8 @@ static void i40e_pf_unquiesce_all_vsi(struct i40e_pf *pf)
 **/
 static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
 {
-        int num_tc = 0, i;
+        u8 num_tc = 0;
+        int i;
        /* Scan the ETS Config Priority Table to find
         * traffic class enabled for a given priority
@@ -3341,9 +3345,7 @@ static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
        /* Traffic class index starts from zero so
         * increment to return the actual count
         */
-        num_tc++;
+        return num_tc + 1;
-        return num_tc;
 }
 /**
@@ -3451,28 +3453,27 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
        struct i40e_aqc_query_vsi_bw_config_resp bw_config = {0};
        struct i40e_pf *pf = vsi->back;
        struct i40e_hw *hw = &pf->hw;
+        i40e_status aq_ret;
        u32 tc_bw_max;
-        int ret;
        int i;
        /* Get the VSI level BW configuration */
-        ret = i40e_aq_query_vsi_bw_config(hw, vsi->seid, &bw_config, NULL);
+        aq_ret = i40e_aq_query_vsi_bw_config(hw, vsi->seid, &bw_config, NULL);
-        if (ret) {
+        if (aq_ret) {
                dev_info(&pf->pdev->dev,
                         "couldn't get pf vsi bw config, err %d, aq_err %d\n",
-                         ret, pf->hw.aq.asq_last_status);
+                         aq_ret, pf->hw.aq.asq_last_status);
-                return ret;
+                return -EINVAL;
        }
        /* Get the VSI level BW configuration per TC */
-        ret = i40e_aq_query_vsi_ets_sla_config(hw, vsi->seid,
+        aq_ret = i40e_aq_query_vsi_ets_sla_config(hw, vsi->seid, &bw_ets_config,
-                                               &bw_ets_config,
+                                                  NULL);
-                                               NULL);
+        if (aq_ret) {
-        if (ret) {
                dev_info(&pf->pdev->dev,
                         "couldn't get pf vsi ets bw config, err %d, aq_err %d\n",
-                         ret, pf->hw.aq.asq_last_status);
+                         aq_ret, pf->hw.aq.asq_last_status);
-                return ret;
+                return -EINVAL;
        }
        if (bw_config.tc_valid_bits != bw_ets_config.tc_valid_bits) {
@@ -3494,7 +3495,8 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
                /* 3 bits out of 4 for each TC */
                vsi->bw_ets_max_quanta[i] = (u8)((tc_bw_max >> (i*4)) & 0x7);
        }
-        return ret;
+        return 0;
 }
 /**
@@ -3505,30 +3507,30 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
 *
 * Returns 0 on success, negative value on failure
 **/
-static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi,
+static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi, u8 enabled_tc,
-                                       u8 enabled_tc,
                                       u8 *bw_share)
 {
        struct i40e_aqc_configure_vsi_tc_bw_data bw_data;
-        int i, ret = 0;
+        i40e_status aq_ret;
+        int i;
        bw_data.tc_valid_bits = enabled_tc;
        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
                bw_data.tc_bw_credits[i] = bw_share[i];
-        ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid,
+        aq_ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid, &bw_data,
-                                       &bw_data, NULL);
+                                          NULL);
-        if (ret) {
+        if (aq_ret) {
                dev_info(&vsi->back->pdev->dev,
                         "%s: AQ command Config VSI BW allocation per TC failed = %d\n",
                         __func__, vsi->back->hw.aq.asq_last_status);
-                return ret;
+                return -EINVAL;
        }
        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
                vsi->info.qs_handle[i] = bw_data.qs_handles[i];
-        return ret;
+        return 0;
 }
 /**
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 79b58353d849..47c2d10df826 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -719,6 +719,10 @@ static s32 igb_get_phy_id_82575(struct e1000_hw *hw)
        u32 ctrl_ext;
        u32 mdic;
+        /* Extra read required for some PHY's on i354 */
+        if (hw->mac.type == e1000_i354)
+                igb_get_phy_id(hw);
        /* For SGMII PHYs, we try the list of possible addresses until
         * we find one that works.  For non-SGMII PHYs
         * (e.g. integrated copper PHYs), an address of 1 should
diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.c b/drivers/net/ethernet/intel/igb/e1000_mac.c
index f0dfd41dd4bd..298f0ed50670 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mac.c
+++ b/drivers/net/ethernet/intel/igb/e1000_mac.c
@@ -712,6 +712,7 @@ static s32 igb_set_fc_watermarks(struct e1000_hw *hw)
 static s32 igb_set_default_fc(struct e1000_hw *hw)
 {
        s32 ret_val = 0;
+        u16 lan_offset;
        u16 nvm_data;
        /* Read and store word 0x0F of the EEPROM. This word contains bits
@@ -722,7 +723,14 @@ static s32 igb_set_default_fc(struct e1000_hw *hw)
         * control setting, then the variable hw->fc will
         * be initialized based on a value in the EEPROM.
         */
-        ret_val = hw->nvm.ops.read(hw, NVM_INIT_CONTROL2_REG, 1, &nvm_data);
+        if (hw->mac.type == e1000_i350) {
+                lan_offset = NVM_82580_LAN_FUNC_OFFSET(hw->bus.func);
+                ret_val = hw->nvm.ops.read(hw, NVM_INIT_CONTROL2_REG
+                                           + lan_offset, 1, &nvm_data);
+         } else {
+                ret_val = hw->nvm.ops.read(hw, NVM_INIT_CONTROL2_REG,
+                                           1, &nvm_data);
+         }
        if (ret_val) {
                hw_dbg("NVM Read Error\n");
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 48cbc833b051..86d51429a189 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -1607,6 +1607,9 @@ static int igb_integrated_phy_loopback(struct igb_adapter *adapter)
                        igb_write_phy_reg(hw, I347AT4_PAGE_SELECT, 0);
                        igb_write_phy_reg(hw, PHY_CONTROL, 0x4140);
                }
+        } else if (hw->phy.type == e1000_phy_82580) {
+                /* enable MII loopback */
+                igb_write_phy_reg(hw, I82580_PHY_LBK_CTRL, 0x8041);
        }
        /* add small delay to avoid loopback test failure */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index 0e1b973659b0..e8649abf97c0 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -160,6 +160,13 @@ static int ixgbe_get_settings(struct net_device *netdev,
        bool autoneg = false;
        bool link_up;
+        /* SFP type is needed for get_link_capabilities */
+        if (hw->phy.media_type & (ixgbe_media_type_fiber |
+                                  ixgbe_media_type_fiber_qsfp)) {
+                if (hw->phy.sfp_type == ixgbe_sfp_type_not_present)
+                                hw->phy.ops.identify_sfp(hw);
+        }
        hw->mac.ops.get_link_capabilities(hw, &supported_link, &autoneg);
        /* set the supported link speeds */
@@ -186,6 +193,11 @@ static int ixgbe_get_settings(struct net_device *netdev,
                        ecmd->advertising |= ADVERTISED_1000baseT_Full;
                if (supported_link & IXGBE_LINK_SPEED_100_FULL)
                        ecmd->advertising |= ADVERTISED_100baseT_Full;
+                if (hw->phy.multispeed_fiber && !autoneg) {
+                        if (supported_link & IXGBE_LINK_SPEED_10GB_FULL)
+                                ecmd->advertising = ADVERTISED_10000baseT_Full;
+                }
        }
        if (autoneg) {
@@ -314,6 +326,14 @@ static int ixgbe_set_settings(struct net_device *netdev,
                if (ecmd->advertising & ~ecmd->supported)
                        return -EINVAL;
+                /* only allow one speed at a time if no autoneg */
+                if (!ecmd->autoneg && hw->phy.multispeed_fiber) {
+                        if (ecmd->advertising ==
+                            (ADVERTISED_10000baseT_Full |
+                             ADVERTISED_1000baseT_Full))
+                                return -EINVAL;
+                }
                old = hw->phy.autoneg_advertised;
                advertised = 0;
                if (ecmd->advertising & ADVERTISED_10000baseT_Full)
@@ -1805,6 +1825,10 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
        unsigned int size = 1024;
        netdev_tx_t tx_ret_val;
        struct sk_buff *skb;
+        u32 flags_orig = adapter->flags;
+        /* DCB can modify the frames on Tx */
+        adapter->flags &= ~IXGBE_FLAG_DCB_ENABLED;
        /* allocate test skb */
        skb = alloc_skb(size, GFP_KERNEL);
@@ -1857,6 +1881,7 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
        /* free the original skb */
        kfree_skb(skb);
+        adapter->flags = flags_orig;
        return ret_val;
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 7aba452833e5..0ade0cd5ef53 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -3571,7 +3571,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
 {
        struct ixgbe_hw *hw = &adapter->hw;
        int i;
-        u32 rxctrl;
+        u32 rxctrl, rfctl;
        /* disable receives while setting up the descriptors */
        rxctrl = IXGBE_READ_REG(hw, IXGBE_RXCTRL);
@@ -3580,6 +3580,13 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
        ixgbe_setup_psrtype(adapter);
        ixgbe_setup_rdrxctl(adapter);
+        /* RSC Setup */
+        rfctl = IXGBE_READ_REG(hw, IXGBE_RFCTL);
+        rfctl &= ~IXGBE_RFCTL_RSC_DIS;
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))
+                rfctl |= IXGBE_RFCTL_RSC_DIS;
+        IXGBE_WRITE_REG(hw, IXGBE_RFCTL, rfctl);
        /* Program registers for the distribution of queues */
        ixgbe_setup_mrqc(adapter);
@@ -5993,8 +6000,16 @@ static void ixgbe_sfp_link_config_subtask(struct ixgbe_adapter *adapter)
        adapter->flags &= ~IXGBE_FLAG_NEED_LINK_CONFIG;
        speed = hw->phy.autoneg_advertised;
-        if ((!speed) && (hw->mac.ops.get_link_capabilities))
+        if ((!speed) && (hw->mac.ops.get_link_capabilities)) {
                hw->mac.ops.get_link_capabilities(hw, &speed, &autoneg);
+                /* setup the highest link when no autoneg */
+                if (!autoneg) {
+                        if (speed & IXGBE_LINK_SPEED_10GB_FULL)
+                                speed = IXGBE_LINK_SPEED_10GB_FULL;
+                }
+        }
        if (hw->mac.ops.setup_link)
                hw->mac.ops.setup_link(hw, speed, true);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
index 6442cf8f9dce..10775cb9b6d8 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
@@ -1861,6 +1861,7 @@ enum {
 #define IXGBE_RFCTL_ISCSI_DIS       0x00000001
 #define IXGBE_RFCTL_ISCSI_DWC_MASK  0x0000003E
 #define IXGBE_RFCTL_ISCSI_DWC_SHIFT 1
+#define IXGBE_RFCTL_RSC_DIS             0x00000020
 #define IXGBE_RFCTL_NFSW_DIS        0x00000040
 #define IXGBE_RFCTL_NFSR_DIS        0x00000080
 #define IXGBE_RFCTL_NFS_VER_MASK    0x00000300
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index bfdb06860397..6a6c1f76d8e0 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -282,8 +282,7 @@ ltq_etop_hw_init(struct net_device *dev)
                if (IS_TX(i)) {
                        ltq_dma_alloc_tx(&ch->dma);
-                        request_irq(irq, ltq_etop_dma_irq, IRQF_DISABLED,
+                        request_irq(irq, ltq_etop_dma_irq, 0, "etop_tx", priv);
-                                "etop_tx", priv);
                } else if (IS_RX(i)) {
                        ltq_dma_alloc_rx(&ch->dma);
                        for (ch->dma.desc = 0; ch->dma.desc < LTQ_DESC_NUM;
@@ -291,8 +290,7 @@ ltq_etop_hw_init(struct net_device *dev)
                                if (ltq_etop_alloc_skb(ch))
                                        return -ENOMEM;
                        ch->dma.desc = 0;
-                        request_irq(irq, ltq_etop_dma_irq, IRQF_DISABLED,
+                        request_irq(irq, ltq_etop_dma_irq, 0, "etop_rx", priv);
-                                "etop_rx", priv);
                }
                ch->dma.irq = irq;
        }
diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index 4ae0c7426010..fff62460185c 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1123,8 +1123,7 @@ static int pxa168_eth_open(struct net_device *dev)
        struct pxa168_eth_private *pep = netdev_priv(dev);
        int err;
-        err = request_irq(dev->irq, pxa168_eth_int_handler,
+        err = request_irq(dev->irq, pxa168_eth_int_handler, 0, dev->name, dev);
-                          IRQF_DISABLED, dev->name, dev);
        if (err) {
                dev_err(&dev->dev, "can't assign irq\n");
                return -EAGAIN;
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index ef94a591f9e5..ecc7f7b696b8 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -3086,23 +3086,27 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                                               PCI_DMA_FROMDEVICE);
                skge_rx_reuse(e, skge->rx_buf_size);
        } else {
+                struct skge_element ee;
                struct sk_buff *nskb;
                nskb = netdev_alloc_skb_ip_align(dev, skge->rx_buf_size);
                if (!nskb)
                        goto resubmit;
+                ee = *e;
+                skb = ee.skb;
+                prefetch(skb->data);
                if (skge_rx_setup(skge, e, nskb, skge->rx_buf_size) < 0) {
                        dev_kfree_skb(nskb);
                        goto resubmit;
                }
                pci_unmap_single(skge->hw->pdev,
-                                 dma_unmap_addr(e, mapaddr),
+                                 dma_unmap_addr(&ee, mapaddr),
-                                 dma_unmap_len(e, maplen),
+                                 dma_unmap_len(&ee, maplen),
                                 PCI_DMA_FROMDEVICE);
-                skb = e->skb;
-                prefetch(skb->data);
        }
        skb_put(skb, len);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index a28cd801a236..0c750985f47e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -53,9 +53,11 @@ static int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
        for (i = 0; i < priv->tx_ring_num; i++) {
                priv->tx_cq[i].moder_cnt = priv->tx_frames;
                priv->tx_cq[i].moder_time = priv->tx_usecs;
-                err = mlx4_en_set_cq_moder(priv, &priv->tx_cq[i]);
+                if (priv->port_up) {
-                if (err)
+                        err = mlx4_en_set_cq_moder(priv, &priv->tx_cq[i]);
-                        return err;
+                        if (err)
+                                return err;
+                }
        }
        if (priv->adaptive_rx_coal)
@@ -65,9 +67,11 @@ static int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
                priv->rx_cq[i].moder_cnt = priv->rx_frames;
                priv->rx_cq[i].moder_time = priv->rx_usecs;
                priv->last_moder_time[i] = MLX4_EN_AUTO_CONF;
-                err = mlx4_en_set_cq_moder(priv, &priv->rx_cq[i]);
+                if (priv->port_up) {
-                if (err)
+                        err = mlx4_en_set_cq_moder(priv, &priv->rx_cq[i]);
-                        return err;
+                        if (err)
+                                return err;
+                }
        }
        return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5472cbd34028..6ca30739625f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -180,28 +180,32 @@ static int verify_block_sig(struct mlx5_cmd_prot_block *block)
        return 0;
 }
-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token)
+static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
+                           int csum)
 {
        block->token = token;
-        block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 2);
+        if (csum) {
-        block->sig = ~xor8_buf(block, sizeof(*block) - 1);
+                block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
+                                            sizeof(block->data) - 2);
+                block->sig = ~xor8_buf(block, sizeof(*block) - 1);
+        }
 }
-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token)
+static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
 {
        struct mlx5_cmd_mailbox *next = msg->next;
        while (next) {
-                calc_block_sig(next->buf, token);
+                calc_block_sig(next->buf, token, csum);
                next = next->next;
        }
 }
-static void set_signature(struct mlx5_cmd_work_ent *ent)
+static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
 {
        ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
-        calc_chain_sig(ent->in, ent->token);
+        calc_chain_sig(ent->in, ent->token, csum);
-        calc_chain_sig(ent->out, ent->token);
+        calc_chain_sig(ent->out, ent->token, csum);
 }
 static void poll_timeout(struct mlx5_cmd_work_ent *ent)
@@ -539,8 +543,7 @@ static void cmd_work_handler(struct work_struct *work)
        lay->type = MLX5_PCI_CMD_XPORT;
        lay->token = ent->token;
        lay->status_own = CMD_OWNER_HW;
-        if (!cmd->checksum_disabled)
+        set_signature(ent, !cmd->checksum_disabled);
-                set_signature(ent);
        dump_command(dev, ent, 1);
        ktime_get_ts(&ent->ts1);
@@ -773,8 +776,6 @@ static int mlx5_copy_from_msg(void *to, struct mlx5_cmd_msg *from, int size)
                copy = min_t(int, size, MLX5_CMD_DATA_BLOCK_SIZE);
                block = next->buf;
-                if (xor8_buf(block, sizeof(*block)) != 0xff)
-                        return -EINVAL;
                memcpy(to, block->data, copy);
                to += copy;
@@ -1361,6 +1362,7 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev)
                goto err_map;
        }
+        cmd->checksum_disabled = 1;
        cmd->max_reg_cmds = (1 << cmd->log_sz) - 1;
        cmd->bitmask = (1 << cmd->max_reg_cmds) - 1;
@@ -1510,7 +1512,7 @@ int mlx5_cmd_status_to_err(struct mlx5_outbox_hdr *hdr)
        case MLX5_CMD_STAT_BAD_SYS_STATE_ERR:           return -EIO;
        case MLX5_CMD_STAT_BAD_RES_ERR:                 return -EINVAL;
        case MLX5_CMD_STAT_RES_BUSY:                    return -EBUSY;
-        case MLX5_CMD_STAT_LIM_ERR:                     return -EINVAL;
+        case MLX5_CMD_STAT_LIM_ERR:                     return -ENOMEM;
        case MLX5_CMD_STAT_BAD_RES_STATE_ERR:           return -EINVAL;
        case MLX5_CMD_STAT_IX_ERR:                      return -EINVAL;
        case MLX5_CMD_STAT_NO_RES_ERR:                  return -EAGAIN;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index 443cc4d7b024..2231d93cc7ad 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -366,9 +366,11 @@ int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
                goto err_in;
        }
+        snprintf(eq->name, MLX5_MAX_EQ_NAME, "%s@pci:%s",
+                 name, pci_name(dev->pdev));
        eq->eqn = out.eq_number;
        err = request_irq(table->msix_arr[vecidx].vector, mlx5_msix_handler, 0,
-                          name, eq);
+                          eq->name, eq);
        if (err)
                goto err_eq;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index b47739b0b5f6..bc0f5fb66e24 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -165,9 +165,7 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
        struct mlx5_cmd_set_hca_cap_mbox_in *set_ctx = NULL;
        struct mlx5_cmd_query_hca_cap_mbox_in query_ctx;
        struct mlx5_cmd_set_hca_cap_mbox_out set_out;
-        struct mlx5_profile *prof = dev->profile;
        u64 flags;
-        int csum = 1;
        int err;
        memset(&query_ctx, 0, sizeof(query_ctx));
@@ -197,20 +195,14 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
        memcpy(&set_ctx->hca_cap, &query_out->hca_cap,
               sizeof(set_ctx->hca_cap));
-        if (prof->mask & MLX5_PROF_MASK_CMDIF_CSUM) {
-                csum = !!prof->cmdif_csum;
-                flags = be64_to_cpu(set_ctx->hca_cap.flags);
-                if (csum)
-                        flags |= MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
-                else
-                        flags &= ~MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
-                set_ctx->hca_cap.flags = cpu_to_be64(flags);
-        }
        if (dev->profile->mask & MLX5_PROF_MASK_QP_SIZE)
                set_ctx->hca_cap.log_max_qp = dev->profile->log_max_qp;
+        flags = be64_to_cpu(query_out->hca_cap.flags);
+        /* disable checksum */
+        flags &= ~MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
+        set_ctx->hca_cap.flags = cpu_to_be64(flags);
        memset(&set_out, 0, sizeof(set_out));
        set_ctx->hca_cap.log_uar_page_sz = cpu_to_be16(PAGE_SHIFT - 12);
        set_ctx->hdr.opcode = cpu_to_be16(MLX5_CMD_OP_SET_HCA_CAP);
@@ -225,9 +217,6 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
        if (err)
                goto query_ex;
-        if (!csum)
-                dev->cmd.checksum_disabled = 1;
 query_ex:
        kfree(query_out);
        kfree(set_ctx);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 3a2408d44820..7b12acf210f8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -90,6 +90,10 @@ struct mlx5_manage_pages_outbox {
        __be64                  pas[0];
 };
+enum {
+        MAX_RECLAIM_TIME_MSECS  = 5000,
+};
 static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u16 func_id)
 {
        struct rb_root *root = &dev->priv.page_root;
@@ -279,6 +283,9 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
        int err;
        int i;
+        if (nclaimed)
+                *nclaimed = 0;
        memset(&in, 0, sizeof(in));
        outlen = sizeof(*out) + npages * sizeof(out->pas[0]);
        out = mlx5_vzalloc(outlen);
@@ -388,20 +395,25 @@ static int optimal_reclaimed_pages(void)
 int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev)
 {
-        unsigned long end = jiffies + msecs_to_jiffies(5000);
+        unsigned long end = jiffies + msecs_to_jiffies(MAX_RECLAIM_TIME_MSECS);
        struct fw_page *fwp;
        struct rb_node *p;
+        int nclaimed = 0;
        int err;
        do {
                p = rb_first(&dev->priv.page_root);
                if (p) {
                        fwp = rb_entry(p, struct fw_page, rb_node);
-                        err = reclaim_pages(dev, fwp->func_id, optimal_reclaimed_pages(), NULL);
+                        err = reclaim_pages(dev, fwp->func_id,
+                                            optimal_reclaimed_pages(),
+                                            &nclaimed);
                        if (err) {
                                mlx5_core_warn(dev, "failed reclaiming pages (%d)\n", err);
                                return err;
                        }
+                        if (nclaimed)
+                                end = jiffies + msecs_to_jiffies(MAX_RECLAIM_TIME_MSECS);
                }
                if (time_after(jiffies, end)) {
                        mlx5_core_warn(dev, "FW did not return all pages. giving up...\n");
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 0fba1532d326..075f4e21d33d 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -915,7 +915,7 @@ static int ks_net_open(struct net_device *netdev)
        struct ks_net *ks = netdev_priv(netdev);
        int err;
-#define KS_INT_FLAGS    (IRQF_DISABLED|IRQF_TRIGGER_LOW)
+#define KS_INT_FLAGS    IRQF_TRIGGER_LOW
        /* lock the card, even if we may not actually do anything
         * else at the moment.
         */
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 83c2091c9c23..bd1a2d2bc2ae 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -543,7 +543,7 @@ static const struct of_device_id moxart_mac_match[] = {
        { }
 };
-struct __initdata platform_driver moxart_mac_driver = {
+static struct platform_driver moxart_mac_driver = {
        .probe  = moxart_mac_probe,
        .remove = moxart_remove,
        .driver = {
diff --git a/drivers/net/ethernet/natsemi/jazzsonic.c b/drivers/net/ethernet/natsemi/jazzsonic.c
index c20766c2f65b..79257f71c5d9 100644
--- a/drivers/net/ethernet/natsemi/jazzsonic.c
+++ b/drivers/net/ethernet/natsemi/jazzsonic.c
@@ -83,8 +83,7 @@ static int jazzsonic_open(struct net_device* dev)
 {
        int retval;
-        retval = request_irq(dev->irq, sonic_interrupt, IRQF_DISABLED,
+        retval = request_irq(dev->irq, sonic_interrupt, 0, "sonic", dev);
-                                "sonic", dev);
        if (retval) {
                printk(KERN_ERR "%s: unable to get IRQ %d.\n",
                                dev->name, dev->irq);
diff --git a/drivers/net/ethernet/natsemi/xtsonic.c b/drivers/net/ethernet/natsemi/xtsonic.c
index c2e0256fe3df..4da172ac5599 100644
--- a/drivers/net/ethernet/natsemi/xtsonic.c
+++ b/drivers/net/ethernet/natsemi/xtsonic.c
@@ -95,8 +95,7 @@ static int xtsonic_open(struct net_device *dev)
 {
        int retval;
-        retval = request_irq(dev->irq, sonic_interrupt, IRQF_DISABLED,
+        retval = request_irq(dev->irq, sonic_interrupt, 0, "sonic", dev);
-                                "sonic", dev);
        if (retval) {
                printk(KERN_ERR "%s: unable to get IRQ %d.\n",
                       dev->name, dev->irq);
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index c498181a9aa8..5b65356e7568 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1219,7 +1219,7 @@ static int pasemi_mac_open(struct net_device *dev)
        snprintf(mac->tx_irq_name, sizeof(mac->tx_irq_name), "%s tx",
                 dev->name);
-        ret = request_irq(mac->tx->chan.irq, pasemi_mac_tx_intr, IRQF_DISABLED,
+        ret = request_irq(mac->tx->chan.irq, pasemi_mac_tx_intr, 0,
                          mac->tx_irq_name, mac->tx);
        if (ret) {
                dev_err(&mac->pdev->dev, "request_irq of irq %d failed: %d\n",
@@ -1230,7 +1230,7 @@ static int pasemi_mac_open(struct net_device *dev)
        snprintf(mac->rx_irq_name, sizeof(mac->rx_irq_name), "%s rx",
                 dev->name);
-        ret = request_irq(mac->rx->chan.irq, pasemi_mac_rx_intr, IRQF_DISABLED,
+        ret = request_irq(mac->rx->chan.irq, pasemi_mac_rx_intr, 0,
                          mac->rx_irq_name, mac->rx);
        if (ret) {
                dev_err(&mac->pdev->dev, "request_irq of irq %d failed: %d\n",
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 4d7ad0074d1c..ebe4c86e5230 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1794,3 +1794,11 @@ const struct ethtool_ops qlcnic_sriov_vf_ethtool_ops = {
        .set_msglevel           = qlcnic_set_msglevel,
        .get_msglevel           = qlcnic_get_msglevel,
 };
+const struct ethtool_ops qlcnic_ethtool_failed_ops = {
+        .get_settings           = qlcnic_get_settings,
+        .get_drvinfo            = qlcnic_get_drvinfo,
+        .set_msglevel           = qlcnic_set_msglevel,
+        .get_msglevel           = qlcnic_get_msglevel,
+        .set_dump               = qlcnic_set_dump,
+};
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index c4c5023e1fdf..21d00a0449a1 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -431,6 +431,9 @@ static void qlcnic_82xx_cancel_idc_work(struct qlcnic_adapter *adapter)
        while (test_and_set_bit(__QLCNIC_RESETTING, &adapter->state))
                usleep_range(10000, 11000);
+        if (!adapter->fw_work.work.func)
+                return;
        cancel_delayed_work_sync(&adapter->fw_work);
 }
@@ -2275,8 +2278,9 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                adapter->portnum = adapter->ahw->pci_func;
                err = qlcnic_start_firmware(adapter);
                if (err) {
-                        dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n");
+                        dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n"
-                        goto err_out_free_hw;
+                                "\t\tIf reboot doesn't help, try flashing the card\n");
+                        goto err_out_maintenance_mode;
                }
                qlcnic_get_multiq_capability(adapter);
@@ -2408,6 +2412,22 @@ err_out_disable_pdev:
        pci_set_drvdata(pdev, NULL);
        pci_disable_device(pdev);
        return err;
+err_out_maintenance_mode:
+        netdev->netdev_ops = &qlcnic_netdev_failed_ops;
+        SET_ETHTOOL_OPS(netdev, &qlcnic_ethtool_failed_ops);
+        err = register_netdev(netdev);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to register net device\n");
+                qlcnic_clr_all_drv_state(adapter, 0);
+                goto err_out_free_hw;
+        }
+        pci_set_drvdata(pdev, adapter);
+        qlcnic_add_sysfs(adapter);
+        return 0;
 }
 static void qlcnic_remove(struct pci_dev *pdev)
@@ -2518,8 +2538,16 @@ static int qlcnic_resume(struct pci_dev *pdev)
 static int qlcnic_open(struct net_device *netdev)
 {
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
+        u32 state;
        int err;
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD) {
+                netdev_err(netdev, "%s: Device is in FAILED state\n", __func__);
+                return -EIO;
+        }
        netif_carrier_off(netdev);
        err = qlcnic_attach(adapter);
@@ -3228,6 +3256,13 @@ void qlcnic_82xx_dev_request_reset(struct qlcnic_adapter *adapter, u32 key)
                return;
        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD) {
+                netdev_err(adapter->netdev, "%s: Device is in FAILED state\n",
+                           __func__);
+                qlcnic_api_unlock(adapter);
+                return;
+        }
        if (state == QLCNIC_DEV_READY) {
                QLC_SHARED_REG_WR32(adapter, QLCNIC_CRB_DEV_STATE,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 652cc13c5023..392b9bd12b4f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -1561,6 +1561,7 @@ static int qlcnic_sriov_vf_reinit_driver(struct qlcnic_adapter *adapter)
 {
        int err;
+        adapter->need_fw_reset = 0;
        qlcnic_83xx_reinit_mbx_work(adapter->ahw->mailbox);
        qlcnic_83xx_enable_mbx_interrupt(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 330d9a8774ad..686f460b1502 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -397,6 +397,7 @@ static int qlcnic_pci_sriov_disable(struct qlcnic_adapter *adapter)
 {
        struct net_device *netdev = adapter->netdev;
+        rtnl_lock();
        if (netif_running(netdev))
                __qlcnic_down(adapter, netdev);
@@ -407,12 +408,15 @@ static int qlcnic_pci_sriov_disable(struct qlcnic_adapter *adapter)
        /* After disabling SRIOV re-init the driver in default mode
           configure opmode based on op_mode of function
         */
-        if (qlcnic_83xx_configure_opmode(adapter))
+        if (qlcnic_83xx_configure_opmode(adapter)) {
+                rtnl_unlock();
                return -EIO;
+        }
        if (netif_running(netdev))
                __qlcnic_up(adapter, netdev);
+        rtnl_unlock();
        return 0;
 }
@@ -533,6 +537,7 @@ static int qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, int num_vfs)
                return -EIO;
        }
+        rtnl_lock();
        if (netif_running(netdev))
                __qlcnic_down(adapter, netdev);
@@ -555,6 +560,7 @@ static int qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, int num_vfs)
                __qlcnic_up(adapter, netdev);
 error:
+        rtnl_unlock();
        return err;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index c6165d05cc13..019f4377307f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -1272,6 +1272,7 @@ void qlcnic_remove_sysfs_entries(struct qlcnic_adapter *adapter)
 void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
 {
        struct device *dev = &adapter->pdev->dev;
+        u32 state;
        if (device_create_bin_file(dev, &bin_attr_port_stats))
                dev_info(dev, "failed to create port stats sysfs entry");
@@ -1285,8 +1286,13 @@ void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
        if (device_create_bin_file(dev, &bin_attr_mem))
                dev_info(dev, "failed to create mem sysfs entry\n");
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD)
+                return;
        if (device_create_bin_file(dev, &bin_attr_pci_config))
                dev_info(dev, "failed to create pci config sysfs entry");
        if (device_create_file(dev, &dev_attr_beacon))
                dev_info(dev, "failed to create beacon sysfs entry");
@@ -1307,6 +1313,7 @@ void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
 void qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
 {
        struct device *dev = &adapter->pdev->dev;
+        u32 state;
        device_remove_bin_file(dev, &bin_attr_port_stats);
@@ -1315,6 +1322,11 @@ void qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
        device_remove_file(dev, &dev_attr_diag_mode);
        device_remove_bin_file(dev, &bin_attr_crb);
        device_remove_bin_file(dev, &bin_attr_mem);
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD)
+                return;
        device_remove_bin_file(dev, &bin_attr_pci_config);
        device_remove_file(dev, &dev_attr_beacon);
        if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED))
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
index 10093f0c4c0f..6bc5db703920 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
@@ -740,8 +740,8 @@ int ql_core_dump(struct ql_adapter *qdev, struct ql_mpi_coredump *mpi_coredump)
        int i;
        if (!mpi_coredump) {
-                netif_err(qdev, drv, qdev->ndev, "No memory available\n");
+                netif_err(qdev, drv, qdev->ndev, "No memory allocated\n");
-                return -ENOMEM;
+                return -EINVAL;
        }
        /* Try to get the spinlock, but dont worry if
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c b/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
index ff2bf8a4e247..7ad146080c36 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
@@ -1274,7 +1274,7 @@ void ql_mpi_reset_work(struct work_struct *work)
                return;
        }
-        if (!ql_core_dump(qdev, qdev->mpi_coredump)) {
+        if (qdev->mpi_coredump && !ql_core_dump(qdev, qdev->mpi_coredump)) {
                netif_err(qdev, drv, qdev->ndev, "Core is dumped!\n");
                qdev->core_is_dumped = 1;
                queue_delayed_work(qdev->workqueue,
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 6f87f2cde647..3397cee89777 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4231,6 +4231,7 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
        case RTL_GIGA_MAC_VER_23:
        case RTL_GIGA_MAC_VER_24:
        case RTL_GIGA_MAC_VER_34:
+        case RTL_GIGA_MAC_VER_35:
                RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
                break;
        case RTL_GIGA_MAC_VER_40:
diff --git a/drivers/net/ethernet/sfc/Kconfig b/drivers/net/ethernet/sfc/Kconfig
index 8b7152565c5e..088921294448 100644
--- a/drivers/net/ethernet/sfc/Kconfig
+++ b/drivers/net/ethernet/sfc/Kconfig
@@ -7,7 +7,7 @@ config SFC
        select I2C_ALGOBIT
        select PTP_1588_CLOCK
        ---help---
-          This driver supports 10-gigabit Ethernet cards based on
+          This driver supports 10/40-gigabit Ethernet cards based on
          the Solarflare SFC4000, SFC9000-family and SFC9100-family
          controllers.
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 5f42313b4965..9f18ae984f9e 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -94,7 +94,7 @@ static unsigned int efx_ef10_mem_map_size(struct efx_nic *efx)
        return resource_size(&efx->pci_dev->resource[EFX_MEM_BAR]);
 }
-static int efx_ef10_init_capabilities(struct efx_nic *efx)
+static int efx_ef10_init_datapath_caps(struct efx_nic *efx)
 {
        MCDI_DECLARE_BUF(outbuf, MC_CMD_GET_CAPABILITIES_OUT_LEN);
        struct efx_ef10_nic_data *nic_data = efx->nic_data;
@@ -107,16 +107,27 @@ static int efx_ef10_init_capabilities(struct efx_nic *efx)
                          outbuf, sizeof(outbuf), &outlen);
        if (rc)
                return rc;
+        if (outlen < sizeof(outbuf)) {
+                netif_err(efx, drv, efx->net_dev,
+                          "unable to read datapath firmware capabilities\n");
+                return -EIO;
+        }
-        if (outlen >= sizeof(outbuf)) {
+        nic_data->datapath_caps =
-                nic_data->datapath_caps =
+                MCDI_DWORD(outbuf, GET_CAPABILITIES_OUT_FLAGS1);
-                        MCDI_DWORD(outbuf, GET_CAPABILITIES_OUT_FLAGS1);
-                if (!(nic_data->datapath_caps &
+        if (!(nic_data->datapath_caps &
-                     (1 << MC_CMD_GET_CAPABILITIES_OUT_TX_TSO_LBN))) {
+              (1 << MC_CMD_GET_CAPABILITIES_OUT_TX_TSO_LBN))) {
-                        netif_err(efx, drv, efx->net_dev,
+                netif_err(efx, drv, efx->net_dev,
-                                  "Capabilities don't indicate TSO support.\n");
+                          "current firmware does not support TSO\n");
-                        return -ENODEV;
+                return -ENODEV;
-                }
+        }
+        if (!(nic_data->datapath_caps &
+              (1 << MC_CMD_GET_CAPABILITIES_OUT_RX_PREFIX_LEN_14_LBN))) {
+                netif_err(efx, probe, efx->net_dev,
+                          "current firmware does not support an RX prefix\n");
+                return -ENODEV;
        }
        return 0;
@@ -217,21 +228,13 @@ static int efx_ef10_probe(struct efx_nic *efx)
        if (rc)
                goto fail3;
-        rc = efx_ef10_init_capabilities(efx);
+        rc = efx_ef10_init_datapath_caps(efx);
        if (rc < 0)
                goto fail3;
        efx->rx_packet_len_offset =
                ES_DZ_RX_PREFIX_PKTLEN_OFST - ES_DZ_RX_PREFIX_SIZE;
-        if (!(nic_data->datapath_caps &
-              (1 << MC_CMD_GET_CAPABILITIES_OUT_RX_PREFIX_LEN_14_LBN))) {
-                netif_err(efx, probe, efx->net_dev,
-                          "current firmware does not support an RX prefix\n");
-                rc = -ENODEV;
-                goto fail3;
-        }
        rc = efx_mcdi_port_get_number(efx);
        if (rc < 0)
                goto fail3;
@@ -260,8 +263,6 @@ static int efx_ef10_probe(struct efx_nic *efx)
        if (rc)
                goto fail3;
-        efx_ptp_probe(efx);
        return 0;
 fail3:
@@ -342,6 +343,13 @@ static int efx_ef10_init_nic(struct efx_nic *efx)
        struct efx_ef10_nic_data *nic_data = efx->nic_data;
        int rc;
+        if (nic_data->must_check_datapath_caps) {
+                rc = efx_ef10_init_datapath_caps(efx);
+                if (rc)
+                        return rc;
+                nic_data->must_check_datapath_caps = false;
+        }
        if (nic_data->must_realloc_vis) {
                /* We cannot let the number of VIs change now */
                rc = efx_ef10_alloc_vis(efx, nic_data->n_allocated_vis,
@@ -710,6 +718,14 @@ static int efx_ef10_mcdi_poll_reboot(struct efx_nic *efx)
        nic_data->must_restore_filters = true;
        nic_data->rx_rss_context = EFX_EF10_RSS_CONTEXT_INVALID;
+        /* The datapath firmware might have been changed */
+        nic_data->must_check_datapath_caps = true;
+        /* MAC statistics have been cleared on the NIC; clear the local
+         * statistic that we update with efx_update_diff_stat().
+         */
+        nic_data->stats[EF10_STAT_rx_bad_bytes] = 0;
        return -EIO;
 }
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index 128d7cdf9eb2..c082562dbf4e 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -27,10 +27,10 @@
 /* A reboot/assertion causes the MCDI status word to be set after the
 * command word is set or a REBOOT event is sent. If we notice a reboot
- * via these mechanisms then wait 20ms for the status word to be set.
+ * via these mechanisms then wait 250ms for the status word to be set.
 */
 #define MCDI_STATUS_DELAY_US            100
-#define MCDI_STATUS_DELAY_COUNT         200
+#define MCDI_STATUS_DELAY_COUNT         2500
 #define MCDI_STATUS_SLEEP_MS                                            \
        (MCDI_STATUS_DELAY_US * MCDI_STATUS_DELAY_COUNT / 1000)
@@ -800,9 +800,6 @@ static void efx_mcdi_ev_death(struct efx_nic *efx, int rc)
        } else {
                int count;
-                /* Nobody was waiting for an MCDI request, so trigger a reset */
-                efx_schedule_reset(efx, RESET_TYPE_MC_FAILURE);
                /* Consume the status word since efx_mcdi_rpc_finish() won't */
                for (count = 0; count < MCDI_STATUS_DELAY_COUNT; ++count) {
                        if (efx_mcdi_poll_reboot(efx))
@@ -810,6 +807,9 @@ static void efx_mcdi_ev_death(struct efx_nic *efx, int rc)
                        udelay(MCDI_STATUS_DELAY_US);
                }
                mcdi->new_epoch = true;
+                /* Nobody was waiting for an MCDI request, so trigger a reset */
+                efx_schedule_reset(efx, RESET_TYPE_MC_FAILURE);
        }
        spin_unlock(&mcdi->iface_lock);
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index 8d33da6697fb..7b6be61d549f 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -556,6 +556,7 @@ static int efx_mcdi_phy_set_settings(struct efx_nic *efx, struct ethtool_cmd *ec
                case 100:   caps = 1 << MC_CMD_PHY_CAP_100FDX_LBN;   break;
                case 1000:  caps = 1 << MC_CMD_PHY_CAP_1000FDX_LBN;  break;
                case 10000: caps = 1 << MC_CMD_PHY_CAP_10000FDX_LBN; break;
+                case 40000: caps = 1 << MC_CMD_PHY_CAP_40000FDX_LBN; break;
                default:    return -EINVAL;
                }
        } else {
@@ -841,6 +842,7 @@ static unsigned int efx_mcdi_event_link_speed[] = {
        [MCDI_EVENT_LINKCHANGE_SPEED_100M] = 100,
        [MCDI_EVENT_LINKCHANGE_SPEED_1G] = 1000,
        [MCDI_EVENT_LINKCHANGE_SPEED_10G] = 10000,
+        [MCDI_EVENT_LINKCHANGE_SPEED_40G] = 40000,
 };
 void efx_mcdi_process_link_change(struct efx_nic *efx, efx_qword_t *ev)
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 4b1e188f7a2f..fda29d39032f 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -400,6 +400,8 @@ enum {
 * @rx_rss_context: Firmware handle for our RSS context
 * @stats: Hardware statistics
 * @workaround_35388: Flag: firmware supports workaround for bug 35388
+ * @must_check_datapath_caps: Flag: @datapath_caps needs to be revalidated
+ *      after MC reboot
 * @datapath_caps: Capabilities of datapath firmware (FLAGS1 field of
 *      %MC_CMD_GET_CAPABILITIES response)
 */
@@ -413,6 +415,7 @@ struct efx_ef10_nic_data {
        u32 rx_rss_context;
        u64 stats[EF10_STAT_COUNT];
        bool workaround_35388;
+        bool must_check_datapath_caps;
        u32 datapath_caps;
 };
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 370e13dde115..5730fe2445a6 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -271,7 +271,7 @@ static inline void mcf_outsw(void *a, unsigned char *p, int l)
 #define SMC_insw(a, r, p, l)    mcf_insw(a + r, p, l)
 #define SMC_outsw(a, r, p, l)   mcf_outsw(a + r, p, l)
-#define SMC_IRQ_FLAGS           (IRQF_DISABLED)
+#define SMC_IRQ_FLAGS           0
 #else
diff --git a/drivers/net/ethernet/smsc/smsc9420.c b/drivers/net/ethernet/smsc/smsc9420.c
index ffa5c4ad1210..5f9e79f7f2df 100644
--- a/drivers/net/ethernet/smsc/smsc9420.c
+++ b/drivers/net/ethernet/smsc/smsc9420.c
@@ -1356,8 +1356,7 @@ static int smsc9420_open(struct net_device *dev)
        smsc9420_reg_write(pd, INT_STAT, 0xFFFFFFFF);
        smsc9420_pci_flush_write(pd);
-        result = request_irq(irq, smsc9420_isr, IRQF_SHARED | IRQF_DISABLED,
+        result = request_irq(irq, smsc9420_isr, IRQF_SHARED, DRV_NAME, pd);
-                             DRV_NAME, pd);
        if (result) {
                smsc_warn(IFUP, "Unable to use IRQ = %d", irq);
                result = -ENODEV;
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
index 9c805e0c0cae..f7f2ef49c0c1 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
@@ -1726,7 +1726,7 @@ static int ps3_gelic_driver_probe(struct ps3_system_bus_device *dev)
                goto fail_alloc_irq;
        }
        result = request_irq(card->irq, gelic_card_interrupt,
-                             IRQF_DISABLED, netdev->name, card);
+                             0, netdev->name, card);
        if (result) {
                dev_info(ctodev(card), "%s:request_irq failed (%d)\n",
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index c8f088ab5fdf..bdf697b184ae 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -32,7 +32,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #define DRV_NAME        "via-rhine"
-#define DRV_VERSION     "1.5.0"
+#define DRV_VERSION     "1.5.1"
 #define DRV_RELDATE     "2010-10-09"
 #include <linux/types.h>
@@ -1704,7 +1704,12 @@ static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
                cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
        if (unlikely(vlan_tx_tag_present(skb))) {
-                rp->tx_ring[entry].tx_status = cpu_to_le32((vlan_tx_tag_get(skb)) << 16);
+                u16 vid_pcp = vlan_tx_tag_get(skb);
+                /* drop CFI/DEI bit, register needs VID and PCP */
+                vid_pcp = (vid_pcp & VLAN_VID_MASK) |
+                          ((vid_pcp & VLAN_PRIO_MASK) >> 1);
+                rp->tx_ring[entry].tx_status = cpu_to_le32((vid_pcp) << 16);
                /* request tagging */
                rp->tx_ring[entry].desc_length |= cpu_to_le32(0x020000);
        }
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index b88121f240ca..0029148077a9 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -297,6 +297,12 @@ static int temac_dma_bd_init(struct net_device *ndev)
                       lp->rx_bd_p + (sizeof(*lp->rx_bd_v) * (RX_BD_NUM - 1)));
        lp->dma_out(lp, TX_CURDESC_PTR, lp->tx_bd_p);
+        /* Init descriptor indexes */
+        lp->tx_bd_ci = 0;
+        lp->tx_bd_next = 0;
+        lp->tx_bd_tail = 0;
+        lp->rx_bd_ci = 0;
        return 0;
 out:
diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
index f07c340990da..3f138ca88670 100644
--- a/drivers/net/irda/mcs7780.c
+++ b/drivers/net/irda/mcs7780.c
@@ -191,8 +191,8 @@ static inline int mcs_setup_transceiver_vishay(struct mcs_cb *mcs)
                goto error;
        ret = 0;
-        error:
+error:
-                return ret;
+        return ret;
 }
 /* Setup a communication between mcs7780 and agilent chip. */
@@ -501,8 +501,11 @@ static inline int mcs_setup_urbs(struct mcs_cb *mcs)
                return 0;
        mcs->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!mcs->rx_urb)
+        if (!mcs->rx_urb) {
+                usb_free_urb(mcs->tx_urb);
+                mcs->tx_urb = NULL;
                return 0;
+        }
        return 1;
 }
@@ -643,9 +646,9 @@ static int mcs_speed_change(struct mcs_cb *mcs)
        ret = mcs_set_reg(mcs, MCS_MODE_REG, rval);
        mcs->speed = mcs->new_speed;
-        error:
+error:
-                mcs->new_speed = 0;
+        mcs->new_speed = 0;
-                return ret;
+        return ret;
 }
 /* Ioctl calls not supported at this time.  Can be an area of future work. */
@@ -738,17 +741,20 @@ static int mcs_net_open(struct net_device *netdev)
        ret = mcs_receive_start(mcs);
        if (ret)
-                goto error3;
+                goto error4;
        netif_start_queue(netdev);
        return 0;
-        error3:
+error4:
-                irlap_close(mcs->irlap);
+        usb_free_urb(mcs->rx_urb);
-        error2:
+        usb_free_urb(mcs->tx_urb);
-                kfree_skb(mcs->rx_buff.skb);
+error3:
-        error1:
+        irlap_close(mcs->irlap);
-                return ret;
+error2:
+        kfree_skb(mcs->rx_buff.skb);
+error1:
+        return ret;
 }
 /* Receive callback function.  */
@@ -946,11 +952,11 @@ static int mcs_probe(struct usb_interface *intf,
        usb_set_intfdata(intf, mcs);
        return 0;
-        error2:
+error2:
-                free_netdev(ndev);
+        free_netdev(ndev);
-        error1:
+error1:
-                return ret;
+        return ret;
 }
 /* The current device is removed, the USB layer tells us to shut down. */
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index fcbf680c3e62..a17d85a331f1 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -146,6 +146,7 @@ static int loopback_dev_init(struct net_device *dev)
 static void loopback_dev_free(struct net_device *dev)
 {
+        dev_net(dev)->loopback_dev = NULL;
        free_percpu(dev->lstats);
        free_netdev(dev);
 }
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index dcb21347c670..adeee615dd19 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -684,15 +684,12 @@ restart:
                        case NETDEV_RELEASE:
                        case NETDEV_JOIN:
                        case NETDEV_UNREGISTER:
-                                /*
+                                /* rtnl_lock already held
-                                 * rtnl_lock already held
                                 * we might sleep in __netpoll_cleanup()
                                 */
                                spin_unlock_irqrestore(&target_list_lock, flags);
-                                mutex_lock(&nt->mutex);
                                __netpoll_cleanup(&nt->np);
-                                mutex_unlock(&nt->mutex);
                                spin_lock_irqsave(&target_list_lock, flags);
                                dev_put(nt->np.dev);
diff --git a/drivers/net/phy/cicada.c b/drivers/net/phy/cicada.c
index db472ffb6e89..313a0377f68f 100644
--- a/drivers/net/phy/cicada.c
+++ b/drivers/net/phy/cicada.c
@@ -30,9 +30,9 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <asm/irq.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 /* Cicada Extended Control Register 1 */
 #define MII_CIS8201_EXT_CON1           0x17
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 6fa5ae00039f..01805319e1e0 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -281,7 +281,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        nf_reset(skb);
        skb->ip_summed = CHECKSUM_NONE;
-        ip_select_ident(iph, &rt->dst, NULL);
+        ip_select_ident(skb, &rt->dst, NULL);
        ip_send_check(iph);
        ip_local_out(skb);
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index a34d6bf5e43b..cc70ecfc7062 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -429,11 +429,13 @@ static void slip_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
                return;
+        spin_lock(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                spin_unlock(&sl->lock);
                sl_unlock(sl);
                return;
        }
@@ -441,6 +443,7 @@ static void slip_write_wakeup(struct tty_struct *tty)
        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
+        spin_unlock(&sl->lock);
 }
 static void sl_tx_timeout(struct net_device *dev)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a639de8401f8..807815fc9968 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1641,11 +1641,11 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                INIT_LIST_HEAD(&tun->disabled);
                err = tun_attach(tun, file, false);
                if (err < 0)
-                        goto err_free_dev;
+                        goto err_free_flow;
                err = register_netdevice(tun->dev);
                if (err < 0)
-                        goto err_free_dev;
+                        goto err_detach;
                if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
                    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
@@ -1689,7 +1689,12 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
        strcpy(ifr->ifr_name, tun->dev->name);
        return 0;
- err_free_dev:
+err_detach:
+        tun_detach_all(dev);
+err_free_flow:
+        tun_flow_uninit(tun);
+        security_tun_dev_free_security(tun->security);
+err_free_dev:
        free_netdev(dev);
        return err;
 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 03ad4dc293aa..2023f3ea891e 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -33,7 +33,7 @@
 #include <linux/usb/usbnet.h>
-#if defined(CONFIG_USB_NET_RNDIS_HOST) || defined(CONFIG_USB_NET_RNDIS_HOST_MODULE)
+#if IS_ENABLED(CONFIG_USB_NET_RNDIS_HOST)
 static int is_rndis(struct usb_interface_descriptor *desc)
 {
@@ -69,8 +69,7 @@ static const u8 mbm_guid[16] = {
        0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a,
 };
-/*
+/* probes control interface, claims data interface, collects the bulk
- * probes control interface, claims data interface, collects the bulk
 * endpoints, activates data interface (if needed), maybe sets MTU.
 * all pure cdc, except for certain firmware workarounds, and knowing
 * that rndis uses one different rule.
@@ -88,7 +87,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
        struct usb_cdc_mdlm_desc        *desc = NULL;
        struct usb_cdc_mdlm_detail_desc *detail = NULL;
-        if (sizeof dev->data < sizeof *info)
+        if (sizeof(dev->data) < sizeof(*info))
                return -EDOM;
        /* expect strict spec conformance for the descriptors, but
@@ -126,10 +125,10 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                 is_activesync(&intf->cur_altsetting->desc) ||
                 is_wireless_rndis(&intf->cur_altsetting->desc));
-        memset(info, 0, sizeof *info);
+        memset(info, 0, sizeof(*info));
        info->control = intf;
        while (len > 3) {
-                if (buf [1] != USB_DT_CS_INTERFACE)
+                if (buf[1] != USB_DT_CS_INTERFACE)
                        goto next_desc;
                /* use bDescriptorSubType to identify the CDC descriptors.
@@ -139,14 +138,14 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                 * in favor of a complicated OID-based RPC scheme doing what
                 * CDC Ethernet achieves with a simple descriptor.
                 */
-                switch (buf [2]) {
+                switch (buf[2]) {
                case USB_CDC_HEADER_TYPE:
                        if (info->header) {
                                dev_dbg(&intf->dev, "extra CDC header\n");
                                goto bad_desc;
                        }
                        info->header = (void *) buf;
-                        if (info->header->bLength != sizeof *info->header) {
+                        if (info->header->bLength != sizeof(*info->header)) {
                                dev_dbg(&intf->dev, "CDC header len %u\n",
                                        info->header->bLength);
                                goto bad_desc;
@@ -175,7 +174,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                                goto bad_desc;
                        }
                        info->u = (void *) buf;
-                        if (info->u->bLength != sizeof *info->u) {
+                        if (info->u->bLength != sizeof(*info->u)) {
                                dev_dbg(&intf->dev, "CDC union len %u\n",
                                        info->u->bLength);
                                goto bad_desc;
@@ -233,7 +232,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                                goto bad_desc;
                        }
                        info->ether = (void *) buf;
-                        if (info->ether->bLength != sizeof *info->ether) {
+                        if (info->ether->bLength != sizeof(*info->ether)) {
                                dev_dbg(&intf->dev, "CDC ether len %u\n",
                                        info->ether->bLength);
                                goto bad_desc;
@@ -274,8 +273,8 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                        break;
                }
 next_desc:
-                len -= buf [0]; /* bLength */
+                len -= buf[0];  /* bLength */
-                buf += buf [0];
+                buf += buf[0];
        }
        /* Microsoft ActiveSync based and some regular RNDIS devices lack the
@@ -379,9 +378,7 @@ void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
 }
 EXPORT_SYMBOL_GPL(usbnet_cdc_unbind);
-/*-------------------------------------------------------------------------
+/* Communications Device Class, Ethernet Control model
- *
- * Communications Device Class, Ethernet Control model
 *
 * Takes two interfaces.  The DATA interface is inactive till an altsetting
 * is selected.  Configuration data includes class descriptors.  There's
@@ -389,8 +386,7 @@ EXPORT_SYMBOL_GPL(usbnet_cdc_unbind);
 *
 * This should interop with whatever the 2.4 "CDCEther.c" driver
 * (by Brad Hards) talked with, with more functionality.
- *
+ */
- *-------------------------------------------------------------------------*/
 static void dumpspeed(struct usbnet *dev, __le32 *speeds)
 {
@@ -404,7 +400,7 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
 {
        struct usb_cdc_notification     *event;
-        if (urb->actual_length < sizeof *event)
+        if (urb->actual_length < sizeof(*event))
                return;
        /* SPEED_CHANGE can get split into two 8-byte packets */
@@ -423,7 +419,7 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
        case USB_CDC_NOTIFY_SPEED_CHANGE:       /* tx/rx rates */
                netif_dbg(dev, timer, dev->net, "CDC: speed change (len %d)\n",
                          urb->actual_length);
-                if (urb->actual_length != (sizeof *event + 8))
+                if (urb->actual_length != (sizeof(*event) + 8))
                        set_bit(EVENT_STS_SPLIT, &dev->flags);
                else
                        dumpspeed(dev, (__le32 *) &event[1]);
@@ -469,7 +465,6 @@ EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
 static const struct driver_info cdc_info = {
        .description =  "CDC Ethernet Device",
        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        // .check_connect = cdc_check_connect,
        .bind =         usbnet_cdc_bind,
        .unbind =       usbnet_cdc_unbind,
        .status =       usbnet_cdc_status,
@@ -493,9 +488,8 @@ static const struct driver_info wwan_info = {
 #define DELL_VENDOR_ID          0x413C
 #define REALTEK_VENDOR_ID       0x0bda
-static const struct usb_device_id       products [] = {
+static const struct usb_device_id       products[] = {
-/*
+/* BLACKLIST !!
- * BLACKLIST !!
 *
 * First blacklist any products that are egregiously nonconformant
 * with the CDC Ethernet specs.  Minor braindamage we cope with; when
@@ -542,7 +536,7 @@ static const struct usb_device_id	products [] = {
        .driver_info            = 0,
 }, {
        .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
-                  | USB_DEVICE_ID_MATCH_DEVICE,
+                          | USB_DEVICE_ID_MATCH_DEVICE,
        .idVendor               = 0x04DD,
        .idProduct              = 0x8007,       /* C-700 */
        ZAURUS_MASTER_INTERFACE,
@@ -659,8 +653,7 @@ static const struct usb_device_id	products [] = {
        .driver_info = 0,
 },
-/*
+/* WHITELIST!!!
- * WHITELIST!!!
 *
 * CDC Ether uses two interfaces, not necessarily consecutive.
 * We match the main interface, ignoring the optional device
@@ -672,60 +665,40 @@ static const struct usb_device_id	products [] = {
 */
 {
        /* ZTE (Vodafone) K3805-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1003, USB_CLASS_COMM,
-                 | USB_DEVICE_ID_MATCH_PRODUCT
+                                      USB_CDC_SUBCLASS_ETHERNET,
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
+                                      USB_CDC_PROTO_NONE),
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1003,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
        .driver_info = (unsigned long)&wwan_info,
 }, {
        /* ZTE (Vodafone) K3806-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1015, USB_CLASS_COMM,
-                 | USB_DEVICE_ID_MATCH_PRODUCT
+                                      USB_CDC_SUBCLASS_ETHERNET,
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
+                                      USB_CDC_PROTO_NONE),
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1015,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
        .driver_info = (unsigned long)&wwan_info,
 }, {
        /* ZTE (Vodafone) K4510-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1173, USB_CLASS_COMM,
-                 | USB_DEVICE_ID_MATCH_PRODUCT
+                                      USB_CDC_SUBCLASS_ETHERNET,
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
+                                      USB_CDC_PROTO_NONE),
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1173,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
        .driver_info = (unsigned long)&wwan_info,
 }, {
        /* ZTE (Vodafone) K3770-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1177, USB_CLASS_COMM,
-                 | USB_DEVICE_ID_MATCH_PRODUCT
+                                      USB_CDC_SUBCLASS_ETHERNET,
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
+                                      USB_CDC_PROTO_NONE),
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1177,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
        .driver_info = (unsigned long)&wwan_info,
 }, {
        /* ZTE (Vodafone) K3772-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1181, USB_CLASS_COMM,
-                 | USB_DEVICE_ID_MATCH_PRODUCT
+                                      USB_CDC_SUBCLASS_ETHERNET,
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
+                                      USB_CDC_PROTO_NONE),
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1181,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
        .driver_info = (unsigned long)&wwan_info,
 }, {
+        /* Telit modules */
+        USB_VENDOR_AND_INTERFACE_INFO(0x1bc7, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = (kernel_ulong_t) &wwan_info,
+}, {
        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                        USB_CDC_PROTO_NONE),
        .driver_info = (unsigned long) &cdc_info,
@@ -736,15 +709,11 @@ static const struct usb_device_id	products [] = {
 }, {
        /* Various Huawei modems with a network port like the UMG1831 */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+        USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_COMM,
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
+                                      USB_CDC_SUBCLASS_ETHERNET, 255),
-        .idVendor               = HUAWEI_VENDOR_ID,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = 255,
        .driver_info = (unsigned long)&wwan_info,
 },
-        { },            // END
+        { },            /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 2dbb9460349d..c6867f926cff 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -303,7 +303,7 @@ static void dm9601_set_multicast(struct net_device *net)
                rx_ctl |= 0x02;
        } else if (net->flags & IFF_ALLMULTI ||
                   netdev_mc_count(net) > DM_MAX_MCAST) {
-                rx_ctl |= 0x04;
+                rx_ctl |= 0x08;
        } else if (!netdev_mc_empty(net)) {
                struct netdev_hw_addr *ha;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6312332afeba..3d6aaf79d8b2 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -714,7 +714,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
-        {QMI_FIXED_INTF(0x1e2d, 0x12d1, 4)},    /* Cinterion PLxx */
+        {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 7b331e613e02..bf94e10a37c8 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1241,7 +1241,9 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
        if (num_sgs == 1)
                return 0;
-        urb->sg = kmalloc(num_sgs * sizeof(struct scatterlist), GFP_ATOMIC);
+        /* reserve one for zero packet */
+        urb->sg = kmalloc((num_sgs + 1) * sizeof(struct scatterlist),
+                          GFP_ATOMIC);
        if (!urb->sg)
                return -ENOMEM;
@@ -1305,7 +1307,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                if (build_dma_sg(skb, urb) < 0)
                        goto drop;
        }
-        entry->length = length = urb->transfer_buffer_length;
+        length = urb->transfer_buffer_length;
        /* don't assume the hardware handles USB_ZERO_PACKET
         * NOTE:  strictly conforming cdc-ether devices should expect
@@ -1317,15 +1319,18 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
        if (length % dev->maxpacket == 0) {
                if (!(info->flags & FLAG_SEND_ZLP)) {
                        if (!(info->flags & FLAG_MULTI_PACKET)) {
-                                urb->transfer_buffer_length++;
+                                length++;
-                                if (skb_tailroom(skb)) {
+                                if (skb_tailroom(skb) && !urb->num_sgs) {
                                        skb->data[skb->len] = 0;
                                        __skb_put(skb, 1);
-                                }
+                                } else if (urb->num_sgs)
+                                        sg_set_buf(&urb->sg[urb->num_sgs++],
+                                                        dev->padding_pkt, 1);
                        }
                } else
                        urb->transfer_flags |= URB_ZERO_PACKET;
        }
+        entry->length = urb->transfer_buffer_length = length;
        spin_lock_irqsave(&dev->txq.lock, flags);
        retval = usb_autopm_get_interface_async(dev->intf);
@@ -1509,6 +1514,7 @@ void usbnet_disconnect (struct usb_interface *intf)
        usb_kill_urb(dev->interrupt);
        usb_free_urb(dev->interrupt);
+        kfree(dev->padding_pkt);
        free_netdev(net);
 }
@@ -1679,9 +1685,16 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
        /* initialize max rx_qlen and tx_qlen */
        usbnet_update_max_qlen(dev);
+        if (dev->can_dma_sg && !(info->flags & FLAG_SEND_ZLP) &&
+                !(info->flags & FLAG_MULTI_PACKET)) {
+                dev->padding_pkt = kzalloc(1, GFP_KERNEL);
+                if (!dev->padding_pkt)
+                        goto out4;
+        }
        status = register_netdev (net);
        if (status)
-                goto out4;
+                goto out5;
        netif_info(dev, probe, dev->net,
                   "register '%s' at usb-%s-%s, %s, %pM\n",
                   udev->dev.driver->name,
@@ -1699,6 +1712,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
        return 0;
+out5:
+        kfree(dev->padding_pkt);
 out4:
        usb_free_urb(dev->interrupt);
 out3:
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index bf64b4191dcc..2ef5b6219f3f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -564,7 +564,7 @@ static void vxlan_notify_add_rx_port(struct sock *sk)
        struct net_device *dev;
        struct net *net = sock_net(sk);
        sa_family_t sa_family = sk->sk_family;
-        u16 port = htons(inet_sk(sk)->inet_sport);
+        __be16 port = inet_sk(sk)->inet_sport;
        rcu_read_lock();
        for_each_netdev_rcu(net, dev) {
@@ -581,7 +581,7 @@ static void vxlan_notify_del_rx_port(struct sock *sk)
        struct net_device *dev;
        struct net *net = sock_net(sk);
        sa_family_t sa_family = sk->sk_family;
-        u16 port = htons(inet_sk(sk)->inet_sport);
+        __be16 port = inet_sk(sk)->inet_sport;
        rcu_read_lock();
        for_each_netdev_rcu(net, dev) {
@@ -952,8 +952,7 @@ void vxlan_sock_release(struct vxlan_sock *vs)
        spin_lock(&vn->sock_lock);
        hlist_del_rcu(&vs->hlist);
-        smp_wmb();
+        rcu_assign_sk_user_data(vs->sock->sk, NULL);
-        vs->sock->sk->sk_user_data = NULL;
        vxlan_notify_del_rx_port(sk);
        spin_unlock(&vn->sock_lock);
@@ -1048,8 +1047,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
        port = inet_sk(sk)->inet_sport;
-        smp_read_barrier_depends();
+        vs = rcu_dereference_sk_user_data(sk);
-        vs = (struct vxlan_sock *)sk->sk_user_data;
        if (!vs)
                goto drop;
@@ -2021,7 +2019,8 @@ static struct device_type vxlan_type = {
 };
 /* Calls the ndo_add_vxlan_port of the caller in order to
- * supply the listening VXLAN udp ports.
+ * supply the listening VXLAN udp ports. Callers are expected
+ * to implement the ndo_add_vxlan_port.
 */
 void vxlan_get_rx_port(struct net_device *dev)
 {
@@ -2029,16 +2028,13 @@ void vxlan_get_rx_port(struct net_device *dev)
        struct net *net = dev_net(dev);
        struct vxlan_net *vn = net_generic(net, vxlan_net_id);
        sa_family_t sa_family;
-        u16 port;
+        __be16 port;
-        int i;
+        unsigned int i;
-        if (!dev || !dev->netdev_ops || !dev->netdev_ops->ndo_add_vxlan_port)
-                return;
        spin_lock(&vn->sock_lock);
        for (i = 0; i < PORT_HASH_SIZE; ++i) {
-                hlist_for_each_entry_rcu(vs, vs_head(net, i), hlist) {
+                hlist_for_each_entry_rcu(vs, &vn->sock_list[i], hlist) {
-                        port = htons(inet_sk(vs->sock->sk)->inet_sport);
+                        port = inet_sk(vs->sock->sk)->inet_sport;
                        sa_family = vs->sock->sk->sk_family;
                        dev->netdev_ops->ndo_add_vxlan_port(dev, sa_family,
                                                            port);
@@ -2304,8 +2300,7 @@ static struct vxlan_sock *vxlan_socket_create(struct net *net, __be16 port,
        atomic_set(&vs->refcnt, 1);
        vs->rcv = rcv;
        vs->data = data;
-        smp_wmb();
+        rcu_assign_sk_user_data(vs->sock->sk, vs);
-        vs->sock->sk->sk_user_data = vs;
        spin_lock(&vn->sock_lock);
        hlist_add_head_rcu(&vs->hlist, vs_head(net, port));
@@ -2492,15 +2487,19 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
        SET_ETHTOOL_OPS(dev, &vxlan_ethtool_ops);
-        /* create an fdb entry for default destination */
+        /* create an fdb entry for a valid default destination */
-        err = vxlan_fdb_create(vxlan, all_zeros_mac,
+        if (!vxlan_addr_any(&vxlan->default_dst.remote_ip)) {
-                               &vxlan->default_dst.remote_ip,
+                err = vxlan_fdb_create(vxlan, all_zeros_mac,
-                               NUD_REACHABLE|NUD_PERMANENT,
+                                       &vxlan->default_dst.remote_ip,
-                               NLM_F_EXCL|NLM_F_CREATE,
+                                       NUD_REACHABLE|NUD_PERMANENT,
-                               vxlan->dst_port, vxlan->default_dst.remote_vni,
+                                       NLM_F_EXCL|NLM_F_CREATE,
-                               vxlan->default_dst.remote_ifindex, NTF_SELF);
+                                       vxlan->dst_port,
-        if (err)
+                                       vxlan->default_dst.remote_vni,
-                return err;
+                                       vxlan->default_dst.remote_ifindex,
+                                       NTF_SELF);
+                if (err)
+                        return err;
+        }
        err = register_netdevice(dev);
        if (err) {
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 4ee472a5a4e4..ab9e3a8410bc 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -1270,13 +1270,6 @@ static void ath9k_antenna_check(struct ath_softc *sc,
                return;
        /*
-         * All MPDUs in an aggregate will use the same LNA
-         * as the first MPDU.
-         */
-        if (rs->rs_isaggr && !rs->rs_firstaggr)
-                return;
-        /*
         * Change the default rx antenna if rx diversity
         * chooses the other antenna 3 times in a row.
         */
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 35b515fe3ffa..5ac713d2ff5d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -399,6 +399,7 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
        tbf->bf_buf_addr = bf->bf_buf_addr;
        memcpy(tbf->bf_desc, bf->bf_desc, sc->sc_ah->caps.tx_desc_len);
        tbf->bf_state = bf->bf_state;
+        tbf->bf_state.stale = false;
        return tbf;
 }
@@ -1389,11 +1390,15 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                      u16 tid, u16 *ssn)
 {
        struct ath_atx_tid *txtid;
+        struct ath_txq *txq;
        struct ath_node *an;
        u8 density;
        an = (struct ath_node *)sta->drv_priv;
        txtid = ATH_AN_2_TID(an, tid);
+        txq = txtid->ac->txq;
+        ath_txq_lock(sc, txq);
        /* update ampdu factor/density, they may have changed. This may happen
         * in HT IBSS when a beacon with HT-info is received after the station
@@ -1417,6 +1422,8 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
        memset(txtid->tx_buf, 0, sizeof(txtid->tx_buf));
        txtid->baw_head = txtid->baw_tail = 0;
+        ath_txq_unlock_complete(sc, txq);
        return 0;
 }
@@ -1555,8 +1562,10 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                        __skb_unlink(bf->bf_mpdu, tid_q);
                        list_add_tail(&bf->list, &bf_q);
                        ath_set_rates(tid->an->vif, tid->an->sta, bf);
-                        ath_tx_addto_baw(sc, tid, bf);
+                        if (bf_isampdu(bf)) {
-                        bf->bf_state.bf_type &= ~BUF_AGGR;
+                                ath_tx_addto_baw(sc, tid, bf);
+                                bf->bf_state.bf_type &= ~BUF_AGGR;
+                        }
                        if (bf_tail)
                                bf_tail->bf_next = bf;
@@ -1950,7 +1959,9 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
                        if (bf_is_ampdu_not_probing(bf))
                                txq->axq_ampdu_depth++;
-                        bf = bf->bf_lastbf->bf_next;
+                        bf_last = bf->bf_lastbf;
+                        bf = bf_last->bf_next;
+                        bf_last->bf_next = NULL;
                }
        }
 }
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index fc8a0fa6d3b2..b00a7e92225f 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -28,7 +28,7 @@ config BRCMFMAC
 config BRCMFMAC_SDIO
        bool "SDIO bus interface support for FullMAC driver"
-        depends on MMC
+        depends on (MMC = y || MMC = BRCMFMAC)
        depends on BRCMFMAC
        select FW_LOADER
        default y
@@ -39,7 +39,7 @@ config BRCMFMAC_SDIO
 config BRCMFMAC_USB
        bool "USB bus interface support for FullMAC driver"
-        depends on USB
+        depends on (USB = y || USB = BRCMFMAC)
        depends on BRCMFMAC
        select FW_LOADER
        ---help---
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 64f4a2bc8dde..c3462b75bd08 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -464,8 +464,6 @@ static struct sdio_driver brcmf_sdmmc_driver = {
 static int brcmf_sdio_pd_probe(struct platform_device *pdev)
 {
-        int ret;
        brcmf_dbg(SDIO, "Enter\n");
        brcmfmac_sdio_pdata = pdev->dev.platform_data;
@@ -473,11 +471,7 @@ static int brcmf_sdio_pd_probe(struct platform_device *pdev)
        if (brcmfmac_sdio_pdata->power_on)
                brcmfmac_sdio_pdata->power_on();
-        ret = sdio_register_driver(&brcmf_sdmmc_driver);
+        return 0;
-        if (ret)
-                brcmf_err("sdio_register_driver failed: %d\n", ret);
-        return ret;
 }
 static int brcmf_sdio_pd_remove(struct platform_device *pdev)
@@ -500,6 +494,15 @@ static struct platform_driver brcmf_sdio_pd = {
        }
 };
+void brcmf_sdio_register(void)
+{
+        int ret;
+        ret = sdio_register_driver(&brcmf_sdmmc_driver);
+        if (ret)
+                brcmf_err("sdio_register_driver failed: %d\n", ret);
+}
 void brcmf_sdio_exit(void)
 {
        brcmf_dbg(SDIO, "Enter\n");
@@ -510,18 +513,13 @@ void brcmf_sdio_exit(void)
                sdio_unregister_driver(&brcmf_sdmmc_driver);
 }
-void brcmf_sdio_init(void)
+void __init brcmf_sdio_init(void)
 {
        int ret;
        brcmf_dbg(SDIO, "Enter\n");
        ret = platform_driver_probe(&brcmf_sdio_pd, brcmf_sdio_pd_probe);
-        if (ret == -ENODEV) {
+        if (ret == -ENODEV)
-                brcmf_dbg(SDIO, "No platform data available, registering without.\n");
+                brcmf_dbg(SDIO, "No platform data available.\n");
-                ret = sdio_register_driver(&brcmf_sdmmc_driver);
-        }
-        if (ret)
-                brcmf_err("driver registration failed: %d\n", ret);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index f7c1985844e4..74156f84180c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -156,10 +156,11 @@ extern int brcmf_bus_start(struct device *dev);
 #ifdef CONFIG_BRCMFMAC_SDIO
 extern void brcmf_sdio_exit(void);
 extern void brcmf_sdio_init(void);
+extern void brcmf_sdio_register(void);
 #endif
 #ifdef CONFIG_BRCMFMAC_USB
 extern void brcmf_usb_exit(void);
-extern void brcmf_usb_init(void);
+extern void brcmf_usb_register(void);
 #endif
 #endif                          /* _BRCMF_BUS_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index e067aec1fbf1..40e7f854e10f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -1231,21 +1231,23 @@ u32 brcmf_get_chip_info(struct brcmf_if *ifp)
        return bus->chip << 4 | bus->chiprev;
 }
-static void brcmf_driver_init(struct work_struct *work)
+static void brcmf_driver_register(struct work_struct *work)
 {
-        brcmf_debugfs_init();
 #ifdef CONFIG_BRCMFMAC_SDIO
-        brcmf_sdio_init();
+        brcmf_sdio_register();
 #endif
 #ifdef CONFIG_BRCMFMAC_USB
-        brcmf_usb_init();
+        brcmf_usb_register();
 #endif
 }
-static DECLARE_WORK(brcmf_driver_work, brcmf_driver_init);
+static DECLARE_WORK(brcmf_driver_work, brcmf_driver_register);
 static int __init brcmfmac_module_init(void)
 {
+        brcmf_debugfs_init();
+#ifdef CONFIG_BRCMFMAC_SDIO
+        brcmf_sdio_init();
+#endif
        if (!schedule_work(&brcmf_driver_work))
                return -EBUSY;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 39e01a7c8556..f4aea47e0730 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1539,7 +1539,7 @@ void brcmf_usb_exit(void)
        brcmf_release_fw(&fw_image_list);
 }
-void brcmf_usb_init(void)
+void brcmf_usb_register(void)
 {
        brcmf_dbg(USB, "Enter\n");
        INIT_LIST_HEAD(&fw_image_list);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 3a6544710c8a..edc5d105ff98 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -457,6 +457,8 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
        if (err != 0)
                brcms_err(wl->wlc->hw->d11core, "%s: brcms_up() returned %d\n",
                          __func__, err);
+        bcma_core_pci_power_save(wl->wlc->hw->d11core->bus, true);
        return err;
 }
@@ -479,6 +481,8 @@ static void brcms_ops_stop(struct ieee80211_hw *hw)
                return;
        }
+        bcma_core_pci_power_save(wl->wlc->hw->d11core->bus, false);
        /* put driver in down state */
        spin_lock_bh(&wl->lock);
        brcms_down(wl);
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
index d06376014bcd..899cad34ccd3 100644
--- a/drivers/net/wireless/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -40,6 +40,7 @@ struct hwbus_priv {
        struct cw1200_common    *core;
        const struct cw1200_platform_data_spi *pdata;
        spinlock_t              lock; /* Serialize all bus operations */
+        wait_queue_head_t       wq;
        int claimed;
 };
@@ -197,8 +198,11 @@ static void cw1200_spi_lock(struct hwbus_priv *self)
 {
        unsigned long flags;
+        DECLARE_WAITQUEUE(wait, current);
        might_sleep();
+        add_wait_queue(&self->wq, &wait);
        spin_lock_irqsave(&self->lock, flags);
        while (1) {
                set_current_state(TASK_UNINTERRUPTIBLE);
@@ -211,6 +215,7 @@ static void cw1200_spi_lock(struct hwbus_priv *self)
        set_current_state(TASK_RUNNING);
        self->claimed = 1;
        spin_unlock_irqrestore(&self->lock, flags);
+        remove_wait_queue(&self->wq, &wait);
        return;
 }
@@ -222,6 +227,8 @@ static void cw1200_spi_unlock(struct hwbus_priv *self)
        spin_lock_irqsave(&self->lock, flags);
        self->claimed = 0;
        spin_unlock_irqrestore(&self->lock, flags);
+        wake_up(&self->wq);
        return;
 }
@@ -243,9 +250,10 @@ static int cw1200_spi_irq_subscribe(struct hwbus_priv *self)
        pr_debug("SW IRQ subscribe\n");
-        ret = request_any_context_irq(self->func->irq, cw1200_spi_irq_handler,
+        ret = request_threaded_irq(self->func->irq, NULL,
-                                      IRQF_TRIGGER_HIGH,
+                                   cw1200_spi_irq_handler,
-                                      "cw1200_wlan_irq", self);
+                                   IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+                                   "cw1200_wlan_irq", self);
        if (WARN_ON(ret < 0))
                goto exit;
@@ -400,6 +408,8 @@ static int cw1200_spi_probe(struct spi_device *func)
        spi_set_drvdata(func, self);
+        init_waitqueue_head(&self->wq);
        status = cw1200_spi_irq_subscribe(self);
        status = cw1200_core_probe(&cw1200_spi_hwbus_ops,
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 21c688264708..1214c587fd08 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -150,7 +150,7 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
 */
 int
 mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
-                          struct mwifiex_ra_list_tbl *pra_list, int headroom,
+                          struct mwifiex_ra_list_tbl *pra_list,
                          int ptrindex, unsigned long ra_list_flags)
                          __releases(&priv->wmm.ra_list_spinlock)
 {
@@ -160,6 +160,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
        int pad = 0, ret;
        struct mwifiex_tx_param tx_param;
        struct txpd *ptx_pd = NULL;
+        int headroom = adapter->iface_type == MWIFIEX_USB ? 0 : INTF_HEADER_LEN;
        skb_src = skb_peek(&pra_list->skb_head);
        if (!skb_src) {
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.h b/drivers/net/wireless/mwifiex/11n_aggr.h
index 900e1c62a0cc..892098d6a696 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.h
+++ b/drivers/net/wireless/mwifiex/11n_aggr.h
@@ -26,7 +26,7 @@
 int mwifiex_11n_deaggregate_pkt(struct mwifiex_private *priv,
                                struct sk_buff *skb);
 int mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
-                              struct mwifiex_ra_list_tbl *ptr, int headroom,
+                              struct mwifiex_ra_list_tbl *ptr,
                              int ptr_index, unsigned long flags)
                              __releases(&priv->wmm.ra_list_spinlock);
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 2d761477d15e..a6c46f3b6e3a 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1155,7 +1155,7 @@ int mwifiex_ret_802_11_hs_cfg(struct mwifiex_private *priv,
        uint32_t conditions = le32_to_cpu(phs_cfg->params.hs_config.conditions);
        if (phs_cfg->action == cpu_to_le16(HS_ACTIVATE) &&
-            adapter->iface_type == MWIFIEX_SDIO) {
+            adapter->iface_type != MWIFIEX_USB) {
                mwifiex_hs_activated_event(priv, true);
                return 0;
        } else {
@@ -1167,8 +1167,7 @@ int mwifiex_ret_802_11_hs_cfg(struct mwifiex_private *priv,
        }
        if (conditions != HS_CFG_CANCEL) {
                adapter->is_hs_configured = true;
-                if (adapter->iface_type == MWIFIEX_USB ||
+                if (adapter->iface_type == MWIFIEX_USB)
-                    adapter->iface_type == MWIFIEX_PCIE)
                        mwifiex_hs_activated_event(priv, true);
        } else {
                adapter->is_hs_configured = false;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 2472d4b7f00e..1c70b8d09227 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -447,9 +447,6 @@ static int mwifiex_usb_suspend(struct usb_interface *intf, pm_message_t message)
         */
        adapter->is_suspended = true;
-        for (i = 0; i < adapter->priv_num; i++)
-                netif_carrier_off(adapter->priv[i]->netdev);
        if (atomic_read(&card->rx_cmd_urb_pending) && card->rx_cmd.urb)
                usb_kill_urb(card->rx_cmd.urb);
@@ -509,10 +506,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
                                                  MWIFIEX_RX_CMD_BUF_SIZE);
        }
-        for (i = 0; i < adapter->priv_num; i++)
-                if (adapter->priv[i]->media_connected)
-                        netif_carrier_on(adapter->priv[i]->netdev);
        /* Disable Host Sleep */
        if (adapter->hs_activated)
                mwifiex_cancel_hs(mwifiex_get_priv(adapter,
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 2e8f9cdea54d..95fa3599b407 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -1239,8 +1239,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
                if (enable_tx_amsdu && mwifiex_is_amsdu_allowed(priv, tid) &&
                    mwifiex_is_11n_aggragation_possible(priv, ptr,
                                                        adapter->tx_buf_size))
-                        mwifiex_11n_aggregate_pkt(priv, ptr, INTF_HEADER_LEN,
+                        mwifiex_11n_aggregate_pkt(priv, ptr, ptr_index, flags);
-                                                  ptr_index, flags);
                        /* ra_list_spinlock has been freed in
                           mwifiex_11n_aggregate_pkt() */
                else
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index b9deef66cf4b..e328d3058c41 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -83,6 +83,7 @@ static struct usb_device_id p54u_table[] = {
        {USB_DEVICE(0x06a9, 0x000e)},   /* Westell 802.11g USB (A90-211WG-01) */
        {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
        {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
+        {USB_DEVICE(0x07aa, 0x0020)},   /* Corega WLUSB2GTST USB */
        {USB_DEVICE(0x0803, 0x4310)},   /* Zoom 4410a */
        {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
        {USB_DEVICE(0x083a, 0x4531)},   /* T-Com Sinus 154 data II */
@@ -979,6 +980,7 @@ static int p54u_load_firmware(struct ieee80211_hw *dev,
        if (err) {
                dev_err(&priv->udev->dev, "(p54usb) cannot load firmware %s "
                                          "(%d)!\n", p54u_fwlist[i].fw, err);
+                usb_put_dev(udev);
        }
        return err;
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 95e6e61c3de0..88ce656f96cd 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -6659,19 +6659,20 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
                     rt2800_init_registers(rt2x00dev)))
                return -EIO;
+        if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev)))
+                return -EIO;
        /*
         * Send signal to firmware during boot time.
         */
        rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
-        if (rt2x00_is_usb(rt2x00dev)) {
+        if (rt2x00_is_usb(rt2x00dev))
                rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0);
-                rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
-        }
        msleep(1);
-        if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev) ||
+        if (unlikely(rt2800_wait_bbp_ready(rt2x00dev)))
-                     rt2800_wait_bbp_ready(rt2x00dev)))
                return -EIO;
        rt2800_init_bbp(rt2x00dev);
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 841fb9dfc9da..9a6edb0c014e 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -438,17 +438,16 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
                skb_queue_tail(&priv->rx_queue, skb);
                usb_anchor_urb(entry, &priv->anchored);
                ret = usb_submit_urb(entry, GFP_KERNEL);
+                usb_put_urb(entry);
                if (ret) {
                        skb_unlink(skb, &priv->rx_queue);
                        usb_unanchor_urb(entry);
                        goto err;
                }
-                usb_free_urb(entry);
        }
        return ret;
 err:
-        usb_free_urb(entry);
        kfree_skb(skb);
        usb_kill_anchored_urbs(&priv->anchored);
        return ret;
@@ -956,8 +955,12 @@ static int rtl8187_start(struct ieee80211_hw *dev)
                                  (RETRY_COUNT << 8  /* short retry limit */) |
                                  (RETRY_COUNT << 0  /* long retry limit */) |
                                  (7 << 21 /* MAX TX DMA */));
-                rtl8187_init_urbs(dev);
+                ret = rtl8187_init_urbs(dev);
-                rtl8187b_init_status_urb(dev);
+                if (ret)
+                        goto rtl8187_start_exit;
+                ret = rtl8187b_init_status_urb(dev);
+                if (ret)
+                        usb_kill_anchored_urbs(&priv->anchored);
                goto rtl8187_start_exit;
        }
@@ -966,7 +969,9 @@ static int rtl8187_start(struct ieee80211_hw *dev)
        rtl818x_iowrite32(priv, &priv->map->MAR[0], ~0);
        rtl818x_iowrite32(priv, &priv->map->MAR[1], ~0);
-        rtl8187_init_urbs(dev);
+        ret = rtl8187_init_urbs(dev);
+        if (ret)
+                goto rtl8187_start_exit;
        reg = RTL818X_RX_CONF_ONLYERLPKT |
              RTL818X_RX_CONF_RX_AUTORESETPHY |
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index cc03e7c87cbe..703258742d28 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2057,7 +2057,7 @@ struct rtl_priv {
           that it points to the data allocated
           beyond  this structure like:
           rtl_pci_priv or rtl_usb_priv */
-        u8 priv[0];
+        u8 priv[0] __aligned(sizeof(void *));
 };
 #define rtl_priv(hw)            (((struct rtl_priv *)(hw)->priv))
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index a1977430ddfb..5715318d6bab 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -184,6 +184,7 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
                   unsigned long rx_ring_ref, unsigned int tx_evtchn,
                   unsigned int rx_evtchn);
 void xenvif_disconnect(struct xenvif *vif);
+void xenvif_free(struct xenvif *vif);
 int xenvif_xenbus_init(void);
 void xenvif_xenbus_fini(void);
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 625c6f49cfba..01bb854c7f62 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -353,6 +353,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
        }
        netdev_dbg(dev, "Successfully created xenvif\n");
+        __module_get(THIS_MODULE);
        return vif;
 }
@@ -366,8 +369,6 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
        if (vif->tx_irq)
                return 0;
-        __module_get(THIS_MODULE);
        err = xenvif_map_frontend_rings(vif, tx_ring_ref, rx_ring_ref);
        if (err < 0)
                goto err;
@@ -406,7 +407,7 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
        init_waitqueue_head(&vif->wq);
        vif->task = kthread_create(xenvif_kthread,
-                                   (void *)vif, vif->dev->name);
+                                   (void *)vif, "%s", vif->dev->name);
        if (IS_ERR(vif->task)) {
                pr_warn("Could not allocate kthread for %s\n", vif->dev->name);
                err = PTR_ERR(vif->task);
@@ -452,12 +453,6 @@ void xenvif_carrier_off(struct xenvif *vif)
 void xenvif_disconnect(struct xenvif *vif)
 {
-        /* Disconnect funtion might get called by generic framework
-         * even before vif connects, so we need to check if we really
-         * need to do a module_put.
-         */
-        int need_module_put = 0;
        if (netif_carrier_ok(vif->dev))
                xenvif_carrier_off(vif);
@@ -468,23 +463,22 @@ void xenvif_disconnect(struct xenvif *vif)
                        unbind_from_irqhandler(vif->tx_irq, vif);
                        unbind_from_irqhandler(vif->rx_irq, vif);
                }
-                /* vif->irq is valid, we had a module_get in
+                vif->tx_irq = 0;
-                 * xenvif_connect.
-                 */
-                need_module_put = 1;
        }
        if (vif->task)
                kthread_stop(vif->task);
+        xenvif_unmap_frontend_rings(vif);
+}
+void xenvif_free(struct xenvif *vif)
+{
        netif_napi_del(&vif->napi);
        unregister_netdev(vif->dev);
-        xenvif_unmap_frontend_rings(vif);
        free_netdev(vif->dev);
-        if (need_module_put)
+        module_put(THIS_MODULE);
-                module_put(THIS_MODULE);
 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 956130c70036..f3e591c611de 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -212,6 +212,49 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head)
        return false;
 }
+struct xenvif_count_slot_state {
+        unsigned long copy_off;
+        bool head;
+};
+unsigned int xenvif_count_frag_slots(struct xenvif *vif,
+                                     unsigned long offset, unsigned long size,
+                                     struct xenvif_count_slot_state *state)
+{
+        unsigned count = 0;
+        offset &= ~PAGE_MASK;
+        while (size > 0) {
+                unsigned long bytes;
+                bytes = PAGE_SIZE - offset;
+                if (bytes > size)
+                        bytes = size;
+                if (start_new_rx_buffer(state->copy_off, bytes, state->head)) {
+                        count++;
+                        state->copy_off = 0;
+                }
+                if (state->copy_off + bytes > MAX_BUFFER_OFFSET)
+                        bytes = MAX_BUFFER_OFFSET - state->copy_off;
+                state->copy_off += bytes;
+                offset += bytes;
+                size -= bytes;
+                if (offset == PAGE_SIZE)
+                        offset = 0;
+                state->head = false;
+        }
+        return count;
+}
 /*
 * Figure out how many ring slots we're going to need to send @skb to
 * the guest. This function is essentially a dry run of
@@ -219,48 +262,39 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head)
 */
 unsigned int xenvif_count_skb_slots(struct xenvif *vif, struct sk_buff *skb)
 {
+        struct xenvif_count_slot_state state;
        unsigned int count;
-        int i, copy_off;
+        unsigned char *data;
+        unsigned i;
-        count = DIV_ROUND_UP(skb_headlen(skb), PAGE_SIZE);
+        state.head = true;
+        state.copy_off = 0;
-        copy_off = skb_headlen(skb) % PAGE_SIZE;
+        /* Slot for the first (partial) page of data. */
+        count = 1;
+        /* Need a slot for the GSO prefix for GSO extra data? */
        if (skb_shinfo(skb)->gso_size)
                count++;
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        data = skb->data;
-                unsigned long size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+        while (data < skb_tail_pointer(skb)) {
-                unsigned long offset = skb_shinfo(skb)->frags[i].page_offset;
+                unsigned long offset = offset_in_page(data);
-                unsigned long bytes;
+                unsigned long size = PAGE_SIZE - offset;
-                offset &= ~PAGE_MASK;
-                while (size > 0) {
-                        BUG_ON(offset >= PAGE_SIZE);
-                        BUG_ON(copy_off > MAX_BUFFER_OFFSET);
-                        bytes = PAGE_SIZE - offset;
-                        if (bytes > size)
-                                bytes = size;
-                        if (start_new_rx_buffer(copy_off, bytes, 0)) {
+                if (data + size > skb_tail_pointer(skb))
-                                count++;
+                        size = skb_tail_pointer(skb) - data;
-                                copy_off = 0;
-                        }
-                        if (copy_off + bytes > MAX_BUFFER_OFFSET)
+                count += xenvif_count_frag_slots(vif, offset, size, &state);
-                                bytes = MAX_BUFFER_OFFSET - copy_off;
-                        copy_off += bytes;
+                data += size;
+        }
-                        offset += bytes;
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                        size -= bytes;
+                unsigned long size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+                unsigned long offset = skb_shinfo(skb)->frags[i].page_offset;
-                        if (offset == PAGE_SIZE)
+                count += xenvif_count_frag_slots(vif, offset, size, &state);
-                                offset = 0;
-                }
        }
        return count;
 }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 1fe48fe364ed..b45bce20ad76 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -24,6 +24,12 @@
 struct backend_info {
        struct xenbus_device *dev;
        struct xenvif *vif;
+        /* This is the state that will be reflected in xenstore when any
+         * active hotplug script completes.
+         */
+        enum xenbus_state state;
        enum xenbus_state frontend_state;
        struct xenbus_watch hotplug_status_watch;
        u8 have_hotplug_status_watch:1;
@@ -42,7 +48,7 @@ static int netback_remove(struct xenbus_device *dev)
        if (be->vif) {
                kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
                xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
-                xenvif_disconnect(be->vif);
+                xenvif_free(be->vif);
                be->vif = NULL;
        }
        kfree(be);
@@ -136,6 +142,8 @@ static int netback_probe(struct xenbus_device *dev,
        if (err)
                goto fail;
+        be->state = XenbusStateInitWait;
        /* This kicks hotplug scripts, so do it immediately. */
        backend_create_xenvif(be);
@@ -208,15 +216,113 @@ static void backend_create_xenvif(struct backend_info *be)
        kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
 }
+static void backend_disconnect(struct backend_info *be)
+{
+        if (be->vif)
+                xenvif_disconnect(be->vif);
+}
-static void disconnect_backend(struct xenbus_device *dev)
+static void backend_connect(struct backend_info *be)
 {
-        struct backend_info *be = dev_get_drvdata(&dev->dev);
+        if (be->vif)
+                connect(be);
+}
-        if (be->vif) {
+static inline void backend_switch_state(struct backend_info *be,
-                xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
+                                        enum xenbus_state state)
-                xenvif_disconnect(be->vif);
+{
-                be->vif = NULL;
+        struct xenbus_device *dev = be->dev;
+        pr_debug("%s -> %s\n", dev->nodename, xenbus_strstate(state));
+        be->state = state;
+        /* If we are waiting for a hotplug script then defer the
+         * actual xenbus state change.
+         */
+        if (!be->have_hotplug_status_watch)
+                xenbus_switch_state(dev, state);
+}
+/* Handle backend state transitions:
+ *
+ * The backend state starts in InitWait and the following transitions are
+ * allowed.
+ *
+ * InitWait -> Connected
+ *
+ *    ^    \         |
+ *    |     \        |
+ *    |      \       |
+ *    |       \      |
+ *    |        \     |
+ *    |         \    |
+ *    |          V   V
+ *
+ *  Closed  <-> Closing
+ *
+ * The state argument specifies the eventual state of the backend and the
+ * function transitions to that state via the shortest path.
+ */
+static void set_backend_state(struct backend_info *be,
+                              enum xenbus_state state)
+{
+        while (be->state != state) {
+                switch (be->state) {
+                case XenbusStateClosed:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateConnected:
+                                pr_info("%s: prepare for reconnect\n",
+                                        be->dev->nodename);
+                                backend_switch_state(be, XenbusStateInitWait);
+                                break;
+                        case XenbusStateClosing:
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateInitWait:
+                        switch (state) {
+                        case XenbusStateConnected:
+                                backend_connect(be);
+                                backend_switch_state(be, XenbusStateConnected);
+                                break;
+                        case XenbusStateClosing:
+                        case XenbusStateClosed:
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateConnected:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateClosing:
+                        case XenbusStateClosed:
+                                backend_disconnect(be);
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateClosing:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateConnected:
+                        case XenbusStateClosed:
+                                backend_switch_state(be, XenbusStateClosed);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                default:
+                        BUG();
+                }
        }
 }
@@ -228,42 +334,33 @@ static void frontend_changed(struct xenbus_device *dev,
 {
        struct backend_info *be = dev_get_drvdata(&dev->dev);
-        pr_debug("frontend state %s\n", xenbus_strstate(frontend_state));
+        pr_debug("%s -> %s\n", dev->otherend, xenbus_strstate(frontend_state));
        be->frontend_state = frontend_state;
        switch (frontend_state) {
        case XenbusStateInitialising:
-                if (dev->state == XenbusStateClosed) {
+                set_backend_state(be, XenbusStateInitWait);
-                        pr_info("%s: prepare for reconnect\n", dev->nodename);
-                        xenbus_switch_state(dev, XenbusStateInitWait);
-                }
                break;
        case XenbusStateInitialised:
                break;
        case XenbusStateConnected:
-                if (dev->state == XenbusStateConnected)
+                set_backend_state(be, XenbusStateConnected);
-                        break;
-                backend_create_xenvif(be);
-                if (be->vif)
-                        connect(be);
                break;
        case XenbusStateClosing:
-                if (be->vif)
+                set_backend_state(be, XenbusStateClosing);
-                        kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
-                disconnect_backend(dev);
-                xenbus_switch_state(dev, XenbusStateClosing);
                break;
        case XenbusStateClosed:
-                xenbus_switch_state(dev, XenbusStateClosed);
+                set_backend_state(be, XenbusStateClosed);
                if (xenbus_dev_is_online(dev))
                        break;
                /* fall through if not online */
        case XenbusStateUnknown:
+                set_backend_state(be, XenbusStateClosed);
                device_unregister(&dev->dev);
                break;
@@ -356,7 +453,9 @@ static void hotplug_status_changed(struct xenbus_watch *watch,
        if (IS_ERR(str))
                return;
        if (len == sizeof("connected")-1 && !memcmp(str, "connected", len)) {
-                xenbus_switch_state(be->dev, XenbusStateConnected);
+                /* Complete any pending state change */
+                xenbus_switch_state(be->dev, be->state);
                /* Not interested in this watch anymore. */
                unregister_hotplug_status_watch(be);
        }
@@ -386,12 +485,8 @@ static void connect(struct backend_info *be)
        err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
                                   hotplug_status_changed,
                                   "%s/%s", dev->nodename, "hotplug-status");
-        if (err) {
+        if (!err)
-                /* Switch now, since we can't do a watch. */
-                xenbus_switch_state(dev, XenbusStateConnected);
-        } else {
                be->have_hotplug_status_watch = 1;
-        }
        netif_wake_queue(be->vif->dev);
 }
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 9d2009a9004d..78cc76053328 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -74,10 +74,4 @@ config OF_MTD
        depends on MTD
        def_bool y
-config OF_RESERVED_MEM
-        depends on OF_FLATTREE && (DMA_CMA || (HAVE_GENERIC_DMA_COHERENT && HAVE_MEMBLOCK))
-        def_bool y
-        help
-          Initialization code for DMA reserved memory
 endmenu # OF
diff --git a/drivers/of/Makefile b/drivers/of/Makefile
index ed9660adad77..efd05102c405 100644
--- a/drivers/of/Makefile
+++ b/drivers/of/Makefile
@@ -9,4 +9,3 @@ obj-$(CONFIG_OF_MDIO)	+= of_mdio.o
 obj-$(CONFIG_OF_PCI)    += of_pci.o
 obj-$(CONFIG_OF_PCI_IRQ)  += of_pci_irq.o
 obj-$(CONFIG_OF_MTD)    += of_mtd.o
-obj-$(CONFIG_OF_RESERVED_MEM) += of_reserved_mem.o
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 865d3f66c86b..7d4c70f859e3 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -303,10 +303,8 @@ struct device_node *of_get_cpu_node(int cpu, unsigned int *thread)
        struct device_node *cpun, *cpus;
        cpus = of_find_node_by_path("/cpus");
-        if (!cpus) {
+        if (!cpus)
-                pr_warn("Missing cpus node, bailing out\n");
                return NULL;
-        }
        for_each_child_of_node(cpus, cpun) {
                if (of_node_cmp(cpun->type, "cpu"))
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 229dd9d69e18..a4fa9ad31b8f 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -18,7 +18,6 @@
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
-#include <linux/random.h>
 #include <asm/setup.h>  /* for COMMAND_LINE_SIZE */
 #ifdef CONFIG_PPC
@@ -803,14 +802,3 @@ void __init unflatten_device_tree(void)
 }
 #endif /* CONFIG_OF_EARLY_FLATTREE */
-/* Feed entire flattened device tree into the random pool */
-static int __init add_fdt_randomness(void)
-{
-        if (initial_boot_params)
-                add_device_randomness(initial_boot_params,
-                                be32_to_cpu(initial_boot_params->totalsize));
-        return 0;
-}
-core_initcall(add_fdt_randomness);
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
deleted file mode 100644
index 0fe40c7d6904..000000000000
--- a/drivers/of/of_reserved_mem.c
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Device tree based initialization code for reserved memory.
- *
- * Copyright (c) 2013 Samsung Electronics Co., Ltd.
- *              http://www.samsung.com
- * Author: Marek Szyprowski <m.szyprowski@samsung.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License or (at your optional) any later version of the license.
- */
-#include <linux/memblock.h>
-#include <linux/err.h>
-#include <linux/of.h>
-#include <linux/of_fdt.h>
-#include <linux/of_platform.h>
-#include <linux/mm.h>
-#include <linux/sizes.h>
-#include <linux/mm_types.h>
-#include <linux/dma-contiguous.h>
-#include <linux/dma-mapping.h>
-#include <linux/of_reserved_mem.h>
-#define MAX_RESERVED_REGIONS    16
-struct reserved_mem {
-        phys_addr_t             base;
-        unsigned long           size;
-        struct cma              *cma;
-        char                    name[32];
-};
-static struct reserved_mem reserved_mem[MAX_RESERVED_REGIONS];
-static int reserved_mem_count;
-static int __init fdt_scan_reserved_mem(unsigned long node, const char *uname,
-                                        int depth, void *data)
-{
-        struct reserved_mem *rmem = &reserved_mem[reserved_mem_count];
-        phys_addr_t base, size;
-        int is_cma, is_reserved;
-        unsigned long len;
-        const char *status;
-        __be32 *prop;
-        is_cma = IS_ENABLED(CONFIG_DMA_CMA) &&
-               of_flat_dt_is_compatible(node, "linux,contiguous-memory-region");
-        is_reserved = of_flat_dt_is_compatible(node, "reserved-memory-region");
-        if (!is_reserved && !is_cma) {
-                /* ignore node and scan next one */
-                return 0;
-        }
-        status = of_get_flat_dt_prop(node, "status", &len);
-        if (status && strcmp(status, "okay") != 0) {
-                /* ignore disabled node nad scan next one */
-                return 0;
-        }
-        prop = of_get_flat_dt_prop(node, "reg", &len);
-        if (!prop || (len < (dt_root_size_cells + dt_root_addr_cells) *
-                             sizeof(__be32))) {
-                pr_err("Reserved mem: node %s, incorrect \"reg\" property\n",
-                       uname);
-                /* ignore node and scan next one */
-                return 0;
-        }
-        base = dt_mem_next_cell(dt_root_addr_cells, &prop);
-        size = dt_mem_next_cell(dt_root_size_cells, &prop);
-        if (!size) {
-                /* ignore node and scan next one */
-                return 0;
-        }
-        pr_info("Reserved mem: found %s, memory base %lx, size %ld MiB\n",
-                uname, (unsigned long)base, (unsigned long)size / SZ_1M);
-        if (reserved_mem_count == ARRAY_SIZE(reserved_mem))
-                return -ENOSPC;
-        rmem->base = base;
-        rmem->size = size;
-        strlcpy(rmem->name, uname, sizeof(rmem->name));
-        if (is_cma) {
-                struct cma *cma;
-                if (dma_contiguous_reserve_area(size, base, 0, &cma) == 0) {
-                        rmem->cma = cma;
-                        reserved_mem_count++;
-                        if (of_get_flat_dt_prop(node,
-                                                "linux,default-contiguous-region",
-                                                NULL))
-                                dma_contiguous_set_default(cma);
-                }
-        } else if (is_reserved) {
-                if (memblock_remove(base, size) == 0)
-                        reserved_mem_count++;
-                else
-                        pr_err("Failed to reserve memory for %s\n", uname);
-        }
-        return 0;
-}
-static struct reserved_mem *get_dma_memory_region(struct device *dev)
-{
-        struct device_node *node;
-        const char *name;
-        int i;
-        node = of_parse_phandle(dev->of_node, "memory-region", 0);
-        if (!node)
-                return NULL;
-        name = kbasename(node->full_name);
-        for (i = 0; i < reserved_mem_count; i++)
-                if (strcmp(name, reserved_mem[i].name) == 0)
-                        return &reserved_mem[i];
-        return NULL;
-}
-/**
- * of_reserved_mem_device_init() - assign reserved memory region to given device
- *
- * This function assign memory region pointed by "memory-region" device tree
- * property to the given device.
- */
-void of_reserved_mem_device_init(struct device *dev)
-{
-        struct reserved_mem *region = get_dma_memory_region(dev);
-        if (!region)
-                return;
-        if (region->cma) {
-                dev_set_cma_area(dev, region->cma);
-                pr_info("Assigned CMA %s to %s device\n", region->name,
-                        dev_name(dev));
-        } else {
-                if (dma_declare_coherent_memory(dev, region->base, region->base,
-                    region->size, DMA_MEMORY_MAP | DMA_MEMORY_EXCLUSIVE) != 0)
-                        pr_info("Declared reserved memory %s to %s device\n",
-                                region->name, dev_name(dev));
-        }
-}
-/**
- * of_reserved_mem_device_release() - release reserved memory device structures
- *
- * This function releases structures allocated for memory region handling for
- * the given device.
- */
-void of_reserved_mem_device_release(struct device *dev)
-{
-        struct reserved_mem *region = get_dma_memory_region(dev);
-        if (!region && !region->cma)
-                dma_release_declared_memory(dev);
-}
-/**
- * early_init_dt_scan_reserved_mem() - create reserved memory regions
- *
- * This function grabs memory from early allocator for device exclusive use
- * defined in device tree structures. It should be called by arch specific code
- * once the early allocator (memblock) has been activated and all other
- * subsystems have already allocated/reserved memory.
- */
-void __init early_init_dt_scan_reserved_mem(void)
-{
-        of_scan_flat_dt_by_path("/memory/reserved-memory",
-                                fdt_scan_reserved_mem, NULL);
-}
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 9b439ac63d8e..f6dcde220821 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -21,7 +21,6 @@
 #include <linux/of_device.h>
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
-#include <linux/of_reserved_mem.h>
 #include <linux/platform_device.h>
 const struct of_device_id of_default_bus_match_table[] = {
@@ -219,8 +218,6 @@ static struct platform_device *of_platform_device_create_pdata(
        dev->dev.bus = &platform_bus_type;
        dev->dev.platform_data = platform_data;
-        of_reserved_mem_device_init(&dev->dev);
        /* We do not fill the DMA ops for platform devices by default.
         * This is currently the responsibility of the platform code
         * to do such, possibly using a device notifier
@@ -228,7 +225,6 @@ static struct platform_device *of_platform_device_create_pdata(
        if (of_device_add(dev) != 0) {
                platform_device_put(dev);
-                of_reserved_mem_device_release(&dev->dev);
                return NULL;
        }
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 0b7d23b4ad95..be12fbfcae10 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -994,14 +994,16 @@ void acpiphp_enumerate_slots(struct pci_bus *bus)
                /*
                 * This bridge should have been registered as a hotplug function
-                 * under its parent, so the context has to be there.  If not, we
+                 * under its parent, so the context should be there, unless the
-                 * are in deep goo.
+                 * parent is going to be handled by pciehp, in which case this
+                 * bridge is not interesting to us either.
                 */
                mutex_lock(&acpiphp_context_lock);
                context = acpiphp_get_context(handle);
-                if (WARN_ON(!context)) {
+                if (!context) {
                        mutex_unlock(&acpiphp_context_lock);
                        put_device(&bus->dev);
+                        pci_dev_put(bridge->pci_dev);
                        kfree(bridge);
                        return;
                }
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 7c29ee4ed0ae..b0299e6d9a3f 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -47,6 +47,9 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context)
        if (event != ACPI_NOTIFY_DEVICE_WAKE || !pci_dev)
                return;
+        if (pci_dev->pme_poll)
+                pci_dev->pme_poll = false;
        if (pci_dev->current_state == PCI_D3cold) {
                pci_wakeup_event(pci_dev);
                pm_runtime_resume(&pci_dev->dev);
@@ -57,9 +60,6 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context)
        if (pci_dev->pme_support)
                pci_check_pme_status(pci_dev);
-        if (pci_dev->pme_poll)
-                pci_dev->pme_poll = false;
        pci_wakeup_event(pci_dev);
        pm_runtime_resume(&pci_dev->dev);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e8ccf6c0f08a..bdd64b1b4817 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1155,8 +1155,14 @@ static void pci_enable_bridge(struct pci_dev *dev)
        pci_enable_bridge(dev->bus->self);
-        if (pci_is_enabled(dev))
+        if (pci_is_enabled(dev)) {
+                if (!dev->is_busmaster) {
+                        dev_warn(&dev->dev, "driver skip pci_set_master, fix it!\n");
+                        pci_set_master(dev);
+                }
                return;
+        }
        retval = pci_enable_device(dev);
        if (retval)
                dev_err(&dev->dev, "Error enabling bridge (%d), continuing\n",
diff --git a/drivers/pinctrl/pinconf.c b/drivers/pinctrl/pinconf.c
index a138965c01cb..b8fcc38c0d11 100644
--- a/drivers/pinctrl/pinconf.c
+++ b/drivers/pinctrl/pinconf.c
@@ -490,7 +490,7 @@ exit:
 * <devicename> <state> <pinname> are values that should match the pinctrl-maps
 * <newvalue> reflects the new config and is driver dependant
 */
-static int pinconf_dbg_config_write(struct file *file,
+static ssize_t pinconf_dbg_config_write(struct file *file,
        const char __user *user_buf, size_t count, loff_t *ppos)
 {
        struct pinctrl_maps *maps_node;
@@ -508,7 +508,7 @@ static int pinconf_dbg_config_write(struct file *file,
        int i;
        /* Get userspace string and assure termination */
-        buf_size = min(count, (size_t)(sizeof(buf)-1));
+        buf_size = min(count, sizeof(buf) - 1);
        if (copy_from_user(buf, user_buf, buf_size))
                return -EFAULT;
        buf[buf_size] = 0;
diff --git a/drivers/pinctrl/pinctrl-exynos.c b/drivers/pinctrl/pinctrl-exynos.c
index 2689f8d01a1e..155b1b3a0e7a 100644
--- a/drivers/pinctrl/pinctrl-exynos.c
+++ b/drivers/pinctrl/pinctrl-exynos.c
@@ -663,18 +663,18 @@ static void exynos_pinctrl_resume(struct samsung_pinctrl_drv_data *drvdata)
 /* pin banks of s5pv210 pin-controller */
 static struct samsung_pin_bank s5pv210_pin_bank[] = {
        EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
-        EXYNOS_PIN_BANK_EINTG(6, 0x020, "gpa1", 0x04),
+        EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpa1", 0x04),
        EXYNOS_PIN_BANK_EINTG(8, 0x040, "gpb", 0x08),
        EXYNOS_PIN_BANK_EINTG(5, 0x060, "gpc0", 0x0c),
        EXYNOS_PIN_BANK_EINTG(5, 0x080, "gpc1", 0x10),
        EXYNOS_PIN_BANK_EINTG(4, 0x0a0, "gpd0", 0x14),
-        EXYNOS_PIN_BANK_EINTG(4, 0x0c0, "gpd1", 0x18),
+        EXYNOS_PIN_BANK_EINTG(6, 0x0c0, "gpd1", 0x18),
-        EXYNOS_PIN_BANK_EINTG(5, 0x0e0, "gpe0", 0x1c),
+        EXYNOS_PIN_BANK_EINTG(8, 0x0e0, "gpe0", 0x1c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x100, "gpe1", 0x20),
+        EXYNOS_PIN_BANK_EINTG(5, 0x100, "gpe1", 0x20),
-        EXYNOS_PIN_BANK_EINTG(6, 0x120, "gpf0", 0x24),
+        EXYNOS_PIN_BANK_EINTG(8, 0x120, "gpf0", 0x24),
        EXYNOS_PIN_BANK_EINTG(8, 0x140, "gpf1", 0x28),
        EXYNOS_PIN_BANK_EINTG(8, 0x160, "gpf2", 0x2c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x180, "gpf3", 0x30),
+        EXYNOS_PIN_BANK_EINTG(6, 0x180, "gpf3", 0x30),
        EXYNOS_PIN_BANK_EINTG(7, 0x1a0, "gpg0", 0x34),
        EXYNOS_PIN_BANK_EINTG(7, 0x1c0, "gpg1", 0x38),
        EXYNOS_PIN_BANK_EINTG(7, 0x1e0, "gpg2", 0x3c),
diff --git a/drivers/pinctrl/pinctrl-palmas.c b/drivers/pinctrl/pinctrl-palmas.c
index 82638fac3cfa..30c4d356cb33 100644
--- a/drivers/pinctrl/pinctrl-palmas.c
+++ b/drivers/pinctrl/pinctrl-palmas.c
@@ -891,9 +891,10 @@ static int palmas_pinconf_set(struct pinctrl_dev *pctldev,
                param = pinconf_to_config_param(configs[i]);
                param_val = pinconf_to_config_argument(configs[i]);
+                if (param == PIN_CONFIG_BIAS_PULL_PIN_DEFAULT)
+                        continue;
                switch (param) {
-                case PIN_CONFIG_BIAS_PULL_PIN_DEFAULT:
-                        return 0;
                case PIN_CONFIG_BIAS_DISABLE:
                case PIN_CONFIG_BIAS_PULL_UP:
                case PIN_CONFIG_BIAS_PULL_DOWN:
diff --git a/drivers/pinctrl/pinctrl-tegra114.c b/drivers/pinctrl/pinctrl-tegra114.c
index 622c4854977e..93c9e3899d5e 100644
--- a/drivers/pinctrl/pinctrl-tegra114.c
+++ b/drivers/pinctrl/pinctrl-tegra114.c
@@ -3,7 +3,7 @@
 *
 * Copyright (c) 2012-2013, NVIDIA CORPORATION.  All rights reserved.
 *
- * Arthur:  Pritesh Raithatha <praithatha@nvidia.com>
+ * Author:  Pritesh Raithatha <praithatha@nvidia.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@@ -2763,7 +2763,6 @@ static struct platform_driver tegra114_pinctrl_driver = {
 };
 module_platform_driver(tegra114_pinctrl_driver);
-MODULE_ALIAS("platform:tegra114-pinctrl");
 MODULE_AUTHOR("Pritesh Raithatha <praithatha@nvidia.com>");
-MODULE_DESCRIPTION("NVIDIA Tegra114 pincontrol driver");
+MODULE_DESCRIPTION("NVIDIA Tegra114 pinctrl driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/regulator/da9063-regulator.c b/drivers/regulator/da9063-regulator.c
index 1a7816390773..b9f2653e4ef9 100644
--- a/drivers/regulator/da9063-regulator.c
+++ b/drivers/regulator/da9063-regulator.c
@@ -709,7 +709,7 @@ static struct da9063_regulators_pdata *da9063_parse_regulators_dt(
                struct of_regulator_match **da9063_reg_matches)
 {
        da9063_reg_matches = NULL;
-        return PTR_ERR(-ENODEV);
+        return ERR_PTR(-ENODEV);
 }
 #endif
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 488dfe7ce9a6..7e2b165972e6 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -201,13 +201,7 @@ static unsigned int palmas_smps_ramp_delay[4] = {0, 10000, 5000, 2500};
 #define SMPS_CTRL_MODE_ECO              0x02
 #define SMPS_CTRL_MODE_PWM              0x03
-/* These values are derived from the data sheet. And are the number of steps
+#define PALMAS_SMPS_NUM_VOLTAGES        122
- * where there is a voltage change, the ranges at beginning and end of register
- * max/min values where there are no change are ommitted.
- *
- * So they are basically (maxV-minV)/stepV
- */
-#define PALMAS_SMPS_NUM_VOLTAGES        117
 #define PALMAS_SMPS10_NUM_VOLTAGES      2
 #define PALMAS_LDO_NUM_VOLTAGES         50
@@ -979,6 +973,7 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                        pmic->desc[id].min_uV = 900000;
                        pmic->desc[id].uV_step = 50000;
                        pmic->desc[id].linear_min_sel = 1;
+                        pmic->desc[id].enable_time = 500;
                        pmic->desc[id].vsel_reg =
                                        PALMAS_BASE_TO_REG(PALMAS_LDO_BASE,
                                                palmas_regs_info[id].vsel_addr);
@@ -997,6 +992,11 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                                pmic->desc[id].min_uV = 450000;
                                pmic->desc[id].uV_step = 25000;
                        }
+                        /* LOD6 in vibrator mode will have enable time 2000us */
+                        if (pdata && pdata->ldo6_vibrator &&
+                                (id == PALMAS_REG_LDO6))
+                                pmic->desc[id].enable_time = 2000;
                } else {
                        pmic->desc[id].n_voltages = 1;
                        pmic->desc[id].ops = &palmas_ops_extreg;
diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
index d8e3e1262bc2..20c271d49dcb 100644
--- a/drivers/regulator/ti-abb-regulator.c
+++ b/drivers/regulator/ti-abb-regulator.c
@@ -279,8 +279,12 @@ static int ti_abb_set_opp(struct regulator_dev *rdev, struct ti_abb *abb,
        ti_abb_rmw(regs->opp_sel_mask, info->opp_sel, regs->control_reg,
                   abb->base);
-        /* program LDO VBB vset override if needed */
+        /*
-        if (abb->ldo_base)
+         * program LDO VBB vset override if needed for !bypass mode
+         * XXX: Do not switch sequence - for !bypass, LDO override reset *must*
+         * be performed *before* switch to bias mode else VBB glitches.
+         */
+        if (abb->ldo_base && info->opp_sel != TI_ABB_NOMINAL_OPP)
                ti_abb_program_ldovbb(dev, abb, info);
        /* Initiate ABB ldo change */
@@ -295,6 +299,14 @@ static int ti_abb_set_opp(struct regulator_dev *rdev, struct ti_abb *abb,
        if (ret)
                goto out;
+        /*
+         * Reset LDO VBB vset override bypass mode
+         * XXX: Do not switch sequence - for bypass, LDO override reset *must*
+         * be performed *after* switch to bypass else VBB glitches.
+         */
+        if (abb->ldo_base && info->opp_sel == TI_ABB_NOMINAL_OPP)
+                ti_abb_program_ldovbb(dev, abb, info);
 out:
        return ret;
 }
diff --git a/drivers/regulator/wm831x-ldo.c b/drivers/regulator/wm831x-ldo.c
index 1432b26ef2e9..2205fbc2c37b 100644
--- a/drivers/regulator/wm831x-ldo.c
+++ b/drivers/regulator/wm831x-ldo.c
@@ -63,7 +63,7 @@ static irqreturn_t wm831x_ldo_uv_irq(int irq, void *data)
 */
 static const struct regulator_linear_range wm831x_gp_ldo_ranges[] = {
-        { .min_uV =  900000, .max_uV = 1650000, .min_sel =  0, .max_sel = 14,
+        { .min_uV =  900000, .max_uV = 1600000, .min_sel =  0, .max_sel = 14,
          .uV_step =  50000 },
        { .min_uV = 1700000, .max_uV = 3300000, .min_sel = 15, .max_sel = 31,
          .uV_step = 100000 },
@@ -332,7 +332,7 @@ static struct platform_driver wm831x_gp_ldo_driver = {
 */
 static const struct regulator_linear_range wm831x_aldo_ranges[] = {
-        { .min_uV = 1000000, .max_uV = 1650000, .min_sel =  0, .max_sel = 12,
+        { .min_uV = 1000000, .max_uV = 1600000, .min_sel =  0, .max_sel = 12,
          .uV_step =  50000 },
        { .min_uV = 1700000, .max_uV = 3500000, .min_sel = 13, .max_sel = 31,
          .uV_step = 100000 },
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 835b5f0f344e..61ca9292a429 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -543,7 +543,7 @@ static int wm8350_dcdc_set_suspend_mode(struct regulator_dev *rdev,
 }
 static const struct regulator_linear_range wm8350_ldo_ranges[] = {
-        { .min_uV =  900000, .max_uV = 1750000, .min_sel =  0, .max_sel = 15,
+        { .min_uV =  900000, .max_uV = 1650000, .min_sel =  0, .max_sel = 15,
          .uV_step =  50000 },
        { .min_uV = 1800000, .max_uV = 3300000, .min_sel = 16, .max_sel = 31,
          .uV_step = 100000 },
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 8cd34bf644b3..77df9cb00688 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -145,9 +145,11 @@ bool __init sclp_has_linemode(void)
        if (sccb->header.response_code != 0x20)
                return 0;
-        if (sccb->sclp_send_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK))
+        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
-                return 1;
+                return 0;
-        return 0;
+        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        return 1;
 }
 bool __init sclp_has_vt220(void)
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index a0f47c83fd62..3f4ca4e09a4c 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -810,7 +810,7 @@ static void tty3270_resize_work(struct work_struct *work)
        struct winsize ws;
        screen = tty3270_alloc_screen(tp->n_rows, tp->n_cols);
-        if (!screen)
+        if (IS_ERR(screen))
                return;
        /* Switch to new output size */
        spin_lock_bh(&tp->view.lock);
diff --git a/drivers/scsi/bnx2fc/bnx2fc.h b/drivers/scsi/bnx2fc/bnx2fc.h
index 08b22a901c25..d7ca9305ff45 100644
--- a/drivers/scsi/bnx2fc/bnx2fc.h
+++ b/drivers/scsi/bnx2fc/bnx2fc.h
@@ -105,7 +105,7 @@
 #define BNX2FC_RQ_WQE_SIZE              (BNX2FC_RQ_BUF_SZ)
 #define BNX2FC_XFERQ_WQE_SIZE           (sizeof(struct fcoe_xfrqe))
 #define BNX2FC_CONFQ_WQE_SIZE           (sizeof(struct fcoe_confqe))
-#define BNX2FC_5771X_DB_PAGE_SIZE       128
+#define BNX2X_DB_SHIFT                  3
 #define BNX2FC_TASK_SIZE                128
 #define BNX2FC_TASKS_PER_PAGE           (PAGE_SIZE/BNX2FC_TASK_SIZE)
diff --git a/drivers/scsi/bnx2fc/bnx2fc_hwi.c b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
index c0d035a8f8f9..46a37657307f 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_hwi.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
@@ -1421,8 +1421,7 @@ int bnx2fc_map_doorbell(struct bnx2fc_rport *tgt)
        reg_base = pci_resource_start(hba->pcidev,
                                        BNX2X_DOORBELL_PCI_BAR);
-        reg_off = BNX2FC_5771X_DB_PAGE_SIZE *
+        reg_off = (1 << BNX2X_DB_SHIFT) * (context_id & 0x1FFFF);
-                        (context_id & 0x1FFFF) + DPM_TRIGER_TYPE;
        tgt->ctx_base = ioremap_nocache(reg_base + reg_off, 4);
        if (!tgt->ctx_base)
                return -ENOMEM;
diff --git a/drivers/scsi/bnx2i/bnx2i.h b/drivers/scsi/bnx2i/bnx2i.h
index 6940f0930a84..c73bbcb63c02 100644
--- a/drivers/scsi/bnx2i/bnx2i.h
+++ b/drivers/scsi/bnx2i/bnx2i.h
@@ -64,7 +64,7 @@
 #define MAX_PAGES_PER_CTRL_STRUCT_POOL  8
 #define BNX2I_RESERVED_SLOW_PATH_CMD_SLOTS      4
-#define BNX2I_5771X_DBELL_PAGE_SIZE     128
+#define BNX2X_DB_SHIFT                  3
 /* 5706/08 hardware has limit on maximum buffer size per BD it can handle */
 #define MAX_BD_LENGTH                   65535
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index af3e675d4d48..5be718c241c4 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -2738,8 +2738,7 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep)
        if (test_bit(BNX2I_NX2_DEV_57710, &ep->hba->cnic_dev_type)) {
                reg_base = pci_resource_start(ep->hba->pcidev,
                                              BNX2X_DOORBELL_PCI_BAR);
-                reg_off = BNX2I_5771X_DBELL_PAGE_SIZE * (cid_num & 0x1FFFF) +
+                reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF);
-                          DPM_TRIGER_TYPE;
                ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4);
                goto arm_cq;
        }
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index b9c53cc40e1f..eb1f1ef5fa2e 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -264,6 +264,7 @@ config SPI_FSL_SPI
 config SPI_FSL_DSPI
        tristate "Freescale DSPI controller"
        select SPI_BITBANG
+        depends on SOC_VF610 || COMPILE_TEST
        help
          This enables support for the Freescale DSPI controller in master
          mode. VF610 platform uses the controller.
@@ -369,7 +370,7 @@ config SPI_PXA2XX_PCI
 config SPI_RSPI
        tristate "Renesas RSPI controller"
-        depends on SUPERH && SH_DMAE_BASE
+        depends on (SUPERH || ARCH_SHMOBILE) && SH_DMAE_BASE
        help
          SPI driver for Renesas RSPI blocks.
@@ -393,7 +394,7 @@ config SPI_S3C24XX_FIQ
 config SPI_S3C64XX
        tristate "Samsung S3C64XX series type SPI"
-        depends on (ARCH_S3C24XX || ARCH_S3C64XX || ARCH_S5P64X0 || ARCH_EXYNOS)
+        depends on PLAT_SAMSUNG
        select S3C64XX_DMA if ARCH_S3C64XX
        help
          SPI driver for Samsung S3C64XX and newer SoCs.
diff --git a/drivers/spi/spi-altera.c b/drivers/spi/spi-altera.c
index 9a64c3fee218..595b62cb545d 100644
--- a/drivers/spi/spi-altera.c
+++ b/drivers/spi/spi-altera.c
@@ -219,7 +219,7 @@ static int altera_spi_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, hw);
        /* setup the state for the bitbang driver */
-        hw->bitbang.master = spi_master_get(master);
+        hw->bitbang.master = master;
        if (!hw->bitbang.master)
                return err;
        hw->bitbang.chipselect = altera_spi_chipsel;
diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c
index 37bad952ab38..821bf7ac218d 100644
--- a/drivers/spi/spi-ath79.c
+++ b/drivers/spi/spi-ath79.c
@@ -231,7 +231,7 @@ static int ath79_spi_probe(struct platform_device *pdev)
                master->num_chipselect = pdata->num_chipselect;
        }
-        sp->bitbang.master = spi_master_get(master);
+        sp->bitbang.master = master;
        sp->bitbang.chipselect = ath79_spi_chipselect;
        sp->bitbang.txrx_word[SPI_MODE_0] = ath79_spi_txrx_mode0;
        sp->bitbang.setup_transfer = spi_bitbang_setup_transfer;
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index fd7cc566095a..273db0beb2b8 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -170,18 +170,18 @@
 /* Bit manipulation macros */
 #define SPI_BIT(name) \
        (1 << SPI_##name##_OFFSET)
-#define SPI_BF(name,value) \
+#define SPI_BF(name, value) \
        (((value) & ((1 << SPI_##name##_SIZE) - 1)) << SPI_##name##_OFFSET)
-#define SPI_BFEXT(name,value) \
+#define SPI_BFEXT(name, value) \
        (((value) >> SPI_##name##_OFFSET) & ((1 << SPI_##name##_SIZE) - 1))
-#define SPI_BFINS(name,value,old) \
+#define SPI_BFINS(name, value, old) \
-        ( ((old) & ~(((1 << SPI_##name##_SIZE) - 1) << SPI_##name##_OFFSET)) \
+        (((old) & ~(((1 << SPI_##name##_SIZE) - 1) << SPI_##name##_OFFSET)) \
-          | SPI_BF(name,value))
+          | SPI_BF(name, value))
 /* Register access macros */
-#define spi_readl(port,reg) \
+#define spi_readl(port, reg) \
        __raw_readl((port)->regs + SPI_##reg)
-#define spi_writel(port,reg,value) \
+#define spi_writel(port, reg, value) \
        __raw_writel((value), (port)->regs + SPI_##reg)
 /* use PIO for small transfers, avoiding DMA setup/teardown overhead and
@@ -1401,8 +1401,8 @@ static int atmel_spi_transfer(struct spi_device *spi, struct spi_message *msg)
                        asd = spi->controller_state;
                        bits = (asd->csr >> 4) & 0xf;
                        if (bits != xfer->bits_per_word - 8) {
-                                dev_dbg(&spi->dev, "you can't yet change "
+                                dev_dbg(&spi->dev,
-                                         "bits_per_word in transfers\n");
+                                        "you can't yet change bits_per_word in transfers\n");
                                return -ENOPROTOOPT;
                        }
                }
@@ -1516,7 +1516,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
        /* setup spi core then atmel-specific driver state */
        ret = -ENOMEM;
-        master = spi_alloc_master(&pdev->dev, sizeof *as);
+        master = spi_alloc_master(&pdev->dev, sizeof(*as));
        if (!master)
                goto out_free;
@@ -1546,9 +1546,11 @@ static int atmel_spi_probe(struct platform_device *pdev)
        INIT_LIST_HEAD(&as->queue);
        as->pdev = pdev;
-        as->regs = ioremap(regs->start, resource_size(regs));
+        as->regs = devm_ioremap_resource(&pdev->dev, regs);
-        if (!as->regs)
+        if (IS_ERR(as->regs)) {
+                ret = PTR_ERR(as->regs);
                goto out_free_buffer;
+        }
        as->phybase = regs->start;
        as->irq = irq;
        as->clk = clk;
@@ -1583,7 +1585,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
        /* Initialize the hardware */
        ret = clk_prepare_enable(clk);
        if (ret)
-                goto out_unmap_regs;
+                goto out_free_irq;
        spi_writel(as, CR, SPI_BIT(SWRST));
        spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
        if (as->caps.has_wdrbt) {
@@ -1614,9 +1616,9 @@ out_free_dma:
        spi_writel(as, CR, SPI_BIT(SWRST));
        spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
        clk_disable_unprepare(clk);
+out_free_irq:
        free_irq(irq, master);
 out_unmap_regs:
-        iounmap(as->regs);
 out_free_buffer:
        if (!as->use_pdc)
                tasklet_kill(&as->tasklet);
@@ -1668,36 +1670,36 @@ static int atmel_spi_remove(struct platform_device *pdev)
        clk_disable_unprepare(as->clk);
        clk_put(as->clk);
        free_irq(as->irq, master);
-        iounmap(as->regs);
        spi_unregister_master(master);
        return 0;
 }
-#ifdef  CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
+static int atmel_spi_suspend(struct device *dev)
-static int atmel_spi_suspend(struct platform_device *pdev, pm_message_t mesg)
 {
-        struct spi_master       *master = platform_get_drvdata(pdev);
+        struct spi_master       *master = dev_get_drvdata(dev);
        struct atmel_spi        *as = spi_master_get_devdata(master);
        clk_disable_unprepare(as->clk);
        return 0;
 }
-static int atmel_spi_resume(struct platform_device *pdev)
+static int atmel_spi_resume(struct device *dev)
 {
-        struct spi_master       *master = platform_get_drvdata(pdev);
+        struct spi_master       *master = dev_get_drvdata(dev);
        struct atmel_spi        *as = spi_master_get_devdata(master);
-        return clk_prepare_enable(as->clk);
+        clk_prepare_enable(as->clk);
        return 0;
 }
+static SIMPLE_DEV_PM_OPS(atmel_spi_pm_ops, atmel_spi_suspend, atmel_spi_resume);
+#define ATMEL_SPI_PM_OPS        (&atmel_spi_pm_ops)
 #else
-#define atmel_spi_suspend       NULL
+#define ATMEL_SPI_PM_OPS        NULL
-#define atmel_spi_resume        NULL
 #endif
 #if defined(CONFIG_OF)
@@ -1713,10 +1715,9 @@ static struct platform_driver atmel_spi_driver = {
        .driver         = {
                .name   = "atmel_spi",
                .owner  = THIS_MODULE,
+                .pm     = ATMEL_SPI_PM_OPS,
                .of_match_table = of_match_ptr(atmel_spi_dt_ids),
        },
-        .suspend        = atmel_spi_suspend,
-        .resume         = atmel_spi_resume,
        .probe          = atmel_spi_probe,
        .remove         = atmel_spi_remove,
 };
diff --git a/drivers/spi/spi-au1550.c b/drivers/spi/spi-au1550.c
index 1d00d9b397dd..c4141c92bcff 100644
--- a/drivers/spi/spi-au1550.c
+++ b/drivers/spi/spi-au1550.c
@@ -775,7 +775,7 @@ static int au1550_spi_probe(struct platform_device *pdev)
        hw = spi_master_get_devdata(master);
-        hw->master = spi_master_get(master);
+        hw->master = master;
        hw->pdata = dev_get_platdata(&pdev->dev);
        hw->dev = &pdev->dev;
@@ -985,6 +985,7 @@ static int au1550_spi_remove(struct platform_device *pdev)
 MODULE_ALIAS("platform:au1550-spi");
 static struct platform_driver au1550_spi_drv = {
+        .probe = au1550_spi_probe,
        .remove = au1550_spi_remove,
        .driver = {
                .name = "au1550-spi",
@@ -1004,7 +1005,7 @@ static int __init au1550_spi_init(void)
                        printk(KERN_ERR "au1550-spi: cannot add memory"
                                        "dbdma device\n");
        }
-        return platform_driver_probe(&au1550_spi_drv, au1550_spi_probe);
+        return platform_driver_register(&au1550_spi_drv);
 }
 module_init(au1550_spi_init);
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 52c81481c5c7..4c332143a310 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -358,7 +358,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
        bcm2835_wr(bs, BCM2835_SPI_CS,
                   BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX);
-        err = spi_register_master(master);
+        err = devm_spi_register_master(&pdev->dev, master);
        if (err) {
                dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
                goto out_free_irq;
@@ -381,14 +381,12 @@ static int bcm2835_spi_remove(struct platform_device *pdev)
        struct bcm2835_spi *bs = spi_master_get_devdata(master);
        free_irq(bs->irq, master);
-        spi_unregister_master(master);
        /* Clear FIFOs, and disable the HW block */
        bcm2835_wr(bs, BCM2835_SPI_CS,
                   BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX);
        clk_disable_unprepare(bs->clk);
-        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 536b0e363826..80d56b214eb5 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -412,7 +412,7 @@ static int bcm63xx_spi_probe(struct platform_device *pdev)
        bcm_spi_writeb(bs, SPI_INTR_CLEAR_ALL, SPI_INT_STATUS);
        /* register and we are done */
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(dev, master);
        if (ret) {
                dev_err(dev, "spi register failed\n");
                goto out_clk_disable;
@@ -438,8 +438,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev)
        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
        struct bcm63xx_spi *bs = spi_master_get_devdata(master);
-        spi_unregister_master(master);
        /* reset spi block */
        bcm_spi_writeb(bs, 0, SPI_INT_MASK);
@@ -447,8 +445,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev)
        clk_disable_unprepare(bs->clk);
        clk_put(bs->clk);
-        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-bfin-sport.c b/drivers/spi/spi-bfin-sport.c
index 91921b5f5817..38941e5920b5 100644
--- a/drivers/spi/spi-bfin-sport.c
+++ b/drivers/spi/spi-bfin-sport.c
@@ -592,7 +592,7 @@ bfin_sport_spi_setup(struct spi_device *spi)
                         */
                        if (chip_info->ctl_reg || chip_info->enable_dma) {
                                ret = -EINVAL;
-                                dev_err(&spi->dev, "don't set ctl_reg/enable_dma fields");
+                                dev_err(&spi->dev, "don't set ctl_reg/enable_dma fields\n");
                                goto error;
                        }
                        chip->cs_chg_udelay = chip_info->cs_chg_udelay;
@@ -879,11 +879,10 @@ static int bfin_sport_spi_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
-static int
+static int bfin_sport_spi_suspend(struct device *dev)
-bfin_sport_spi_suspend(struct platform_device *pdev, pm_message_t state)
 {
-        struct bfin_sport_spi_master_data *drv_data = platform_get_drvdata(pdev);
+        struct bfin_sport_spi_master_data *drv_data = dev_get_drvdata(dev);
        int status;
        status = bfin_sport_spi_stop_queue(drv_data);
@@ -896,10 +895,9 @@ bfin_sport_spi_suspend(struct platform_device *pdev, pm_message_t state)
        return status;
 }
-static int
+static int bfin_sport_spi_resume(struct device *dev)
-bfin_sport_spi_resume(struct platform_device *pdev)
 {
-        struct bfin_sport_spi_master_data *drv_data = platform_get_drvdata(pdev);
+        struct bfin_sport_spi_master_data *drv_data = dev_get_drvdata(dev);
        int status;
        /* Enable the SPI interface */
@@ -912,19 +910,22 @@ bfin_sport_spi_resume(struct platform_device *pdev)
        return status;
 }
+static SIMPLE_DEV_PM_OPS(bfin_sport_spi_pm_ops, bfin_sport_spi_suspend,
+                        bfin_sport_spi_resume);
+#define BFIN_SPORT_SPI_PM_OPS           (&bfin_sport_spi_pm_ops)
 #else
-# define bfin_sport_spi_suspend NULL
+#define BFIN_SPORT_SPI_PM_OPS           NULL
-# define bfin_sport_spi_resume  NULL
 #endif
 static struct platform_driver bfin_sport_spi_driver = {
        .driver = {
-                .name = DRV_NAME,
+                .name   = DRV_NAME,
-                .owner = THIS_MODULE,
+                .owner  = THIS_MODULE,
+                .pm     = BFIN_SPORT_SPI_PM_OPS,
        },
        .probe   = bfin_sport_spi_probe,
        .remove  = bfin_sport_spi_remove,
-        .suspend = bfin_sport_spi_suspend,
-        .resume  = bfin_sport_spi_resume,
 };
 module_platform_driver(bfin_sport_spi_driver);
diff --git a/drivers/spi/spi-bfin-v3.c b/drivers/spi/spi-bfin-v3.c
index f4bf81347d68..8f8598834b30 100644
--- a/drivers/spi/spi-bfin-v3.c
+++ b/drivers/spi/spi-bfin-v3.c
@@ -867,7 +867,7 @@ static int bfin_spi_probe(struct platform_device *pdev)
        tasklet_init(&drv_data->pump_transfers,
                        bfin_spi_pump_transfers, (unsigned long)drv_data);
        /* register with the SPI framework */
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(dev, master);
        if (ret) {
                dev_err(dev, "can not  register spi master\n");
                goto err_free_peripheral;
@@ -898,7 +898,6 @@ static int bfin_spi_remove(struct platform_device *pdev)
        free_dma(drv_data->rx_dma);
        free_dma(drv_data->tx_dma);
-        spi_unregister_master(drv_data->master);
        return 0;
 }
diff --git a/drivers/spi/spi-bfin5xx.c b/drivers/spi/spi-bfin5xx.c
index 45bdf73d6868..f0f195af75d4 100644
--- a/drivers/spi/spi-bfin5xx.c
+++ b/drivers/spi/spi-bfin5xx.c
@@ -524,7 +524,7 @@ static irqreturn_t bfin_spi_dma_irq_handler(int irq, void *dev_id)
        timeout = jiffies + HZ;
        while (!(bfin_read(&drv_data->regs->stat) & BIT_STAT_SPIF))
                if (!time_before(jiffies, timeout)) {
-                        dev_warn(&drv_data->pdev->dev, "timeout waiting for SPIF");
+                        dev_warn(&drv_data->pdev->dev, "timeout waiting for SPIF\n");
                        break;
                } else
                        cpu_relax();
@@ -913,8 +913,9 @@ static void bfin_spi_pump_messages(struct work_struct *work)
        drv_data->cur_transfer = list_entry(drv_data->cur_msg->transfers.next,
                                            struct spi_transfer, transfer_list);
-        dev_dbg(&drv_data->pdev->dev, "got a message to pump, "
+        dev_dbg(&drv_data->pdev->dev,
-                "state is set to: baud %d, flag 0x%x, ctl 0x%x\n",
+                "got a message to pump, state is set to: baud "
+                "%d, flag 0x%x, ctl 0x%x\n",
                drv_data->cur_chip->baud, drv_data->cur_chip->flag,
                drv_data->cur_chip->ctl_reg);
@@ -1013,8 +1014,8 @@ static int bfin_spi_setup(struct spi_device *spi)
                 * but let's assume (for now) they do.
                 */
                if (chip_info->ctl_reg & ~bfin_ctl_reg) {
-                        dev_err(&spi->dev, "do not set bits in ctl_reg "
+                        dev_err(&spi->dev,
-                                "that the SPI framework manages\n");
+                                "do not set bits in ctl_reg that the SPI framework manages\n");
                        goto error;
                }
                chip->enable_dma = chip_info->enable_dma != 0
@@ -1050,17 +1051,17 @@ static int bfin_spi_setup(struct spi_device *spi)
        chip->chip_select_num = spi->chip_select;
        if (chip->chip_select_num < MAX_CTRL_CS) {
                if (!(spi->mode & SPI_CPHA))
-                        dev_warn(&spi->dev, "Warning: SPI CPHA not set:"
+                        dev_warn(&spi->dev,
-                                " Slave Select not under software control!\n"
+                                "Warning: SPI CPHA not set: Slave Select not under software control!\n"
-                                " See Documentation/blackfin/bfin-spi-notes.txt");
+                                "See Documentation/blackfin/bfin-spi-notes.txt\n");
                chip->flag = (1 << spi->chip_select) << 8;
        } else
                chip->cs_gpio = chip->chip_select_num - MAX_CTRL_CS;
        if (chip->enable_dma && chip->pio_interrupt) {
-                dev_err(&spi->dev, "enable_dma is set, "
+                dev_err(&spi->dev,
-                                "do not set pio_interrupt\n");
+                        "enable_dma is set, do not set pio_interrupt\n");
                goto error;
        }
        /*
@@ -1410,10 +1411,10 @@ static int bfin_spi_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
-static int bfin_spi_suspend(struct platform_device *pdev, pm_message_t state)
+static int bfin_spi_suspend(struct device *dev)
 {
-        struct bfin_spi_master_data *drv_data = platform_get_drvdata(pdev);
+        struct bfin_spi_master_data *drv_data = dev_get_drvdata(dev);
        int status = 0;
        status = bfin_spi_stop_queue(drv_data);
@@ -1432,9 +1433,9 @@ static int bfin_spi_suspend(struct platform_device *pdev, pm_message_t state)
        return 0;
 }
-static int bfin_spi_resume(struct platform_device *pdev)
+static int bfin_spi_resume(struct device *dev)
 {
-        struct bfin_spi_master_data *drv_data = platform_get_drvdata(pdev);
+        struct bfin_spi_master_data *drv_data = dev_get_drvdata(dev);
        int status = 0;
        bfin_write(&drv_data->regs->ctl, drv_data->ctrl_reg);
@@ -1443,31 +1444,34 @@ static int bfin_spi_resume(struct platform_device *pdev)
        /* Start the queue running */
        status = bfin_spi_start_queue(drv_data);
        if (status != 0) {
-                dev_err(&pdev->dev, "problem starting queue (%d)\n", status);
+                dev_err(dev, "problem starting queue (%d)\n", status);
                return status;
        }
        return 0;
 }
+static SIMPLE_DEV_PM_OPS(bfin_spi_pm_ops, bfin_spi_suspend, bfin_spi_resume);
+#define BFIN_SPI_PM_OPS         (&bfin_spi_pm_ops)
 #else
-#define bfin_spi_suspend NULL
+#define BFIN_SPI_PM_OPS         NULL
-#define bfin_spi_resume NULL
+#endif
-#endif                          /* CONFIG_PM */
 MODULE_ALIAS("platform:bfin-spi");
 static struct platform_driver bfin_spi_driver = {
        .driver = {
                .name   = DRV_NAME,
                .owner  = THIS_MODULE,
+                .pm     = BFIN_SPI_PM_OPS,
        },
-        .suspend        = bfin_spi_suspend,
+        .probe          = bfin_spi_probe,
-        .resume         = bfin_spi_resume,
        .remove         = bfin_spi_remove,
 };
 static int __init bfin_spi_init(void)
 {
-        return platform_driver_probe(&bfin_spi_driver, bfin_spi_probe);
+        return platform_driver_register(&bfin_spi_driver);
 }
 subsys_initcall(bfin_spi_init);
diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
index 8c11355dec23..bd222f6b677d 100644
--- a/drivers/spi/spi-bitbang.c
+++ b/drivers/spi/spi-bitbang.c
@@ -191,7 +191,7 @@ int spi_bitbang_setup(struct spi_device *spi)
        bitbang = spi_master_get_devdata(spi->master);
        if (!cs) {
-                cs = kzalloc(sizeof *cs, GFP_KERNEL);
+                cs = kzalloc(sizeof(*cs), GFP_KERNEL);
                if (!cs)
                        return -ENOMEM;
                spi->controller_state = cs;
@@ -258,7 +258,7 @@ static int spi_bitbang_bufs(struct spi_device *spi, struct spi_transfer *t)
 static int spi_bitbang_prepare_hardware(struct spi_master *spi)
 {
-        struct spi_bitbang      *bitbang;
+        struct spi_bitbang      *bitbang;
        unsigned long           flags;
        bitbang = spi_master_get_devdata(spi);
@@ -273,7 +273,7 @@ static int spi_bitbang_prepare_hardware(struct spi_master *spi)
 static int spi_bitbang_transfer_one(struct spi_master *master,
                                    struct spi_message *m)
 {
-        struct spi_bitbang      *bitbang;
+        struct spi_bitbang      *bitbang;
        unsigned                nsecs;
        struct spi_transfer     *t = NULL;
        unsigned                cs_change;
@@ -292,7 +292,7 @@ static int spi_bitbang_transfer_one(struct spi_master *master,
        cs_change = 1;
        status = 0;
-        list_for_each_entry (t, &m->transfers, transfer_list) {
+        list_for_each_entry(t, &m->transfers, transfer_list) {
                /* override speed or wordsize? */
                if (t->speed_hz || t->bits_per_word)
@@ -349,7 +349,8 @@ static int spi_bitbang_transfer_one(struct spi_master *master,
                if (t->delay_usecs)
                        udelay(t->delay_usecs);
-                if (cs_change && !list_is_last(&t->transfer_list, &m->transfers)) {
+                if (cs_change &&
+                    !list_is_last(&t->transfer_list, &m->transfers)) {
                        /* sometimes a short mid-message deselect of the chip
                         * may be needed to terminate a mode or command
                         */
@@ -378,7 +379,7 @@ static int spi_bitbang_transfer_one(struct spi_master *master,
 static int spi_bitbang_unprepare_hardware(struct spi_master *spi)
 {
-        struct spi_bitbang      *bitbang;
+        struct spi_bitbang      *bitbang;
        unsigned long           flags;
        bitbang = spi_master_get_devdata(spi);
@@ -414,10 +415,16 @@ static int spi_bitbang_unprepare_hardware(struct spi_master *spi)
 * This routine registers the spi_master, which will process requests in a
 * dedicated task, keeping IRQs unblocked most of the time.  To stop
 * processing those requests, call spi_bitbang_stop().
+ *
+ * On success, this routine will take a reference to master. The caller is
+ * responsible for calling spi_bitbang_stop() to decrement the reference and
+ * spi_master_put() as counterpart of spi_alloc_master() to prevent a memory
+ * leak.
 */
 int spi_bitbang_start(struct spi_bitbang *bitbang)
 {
        struct spi_master *master = bitbang->master;
+        int ret;
        if (!master || !bitbang->chipselect)
                return -EINVAL;
@@ -449,7 +456,11 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
        /* driver may get busy before register() returns, especially
         * if someone registered boardinfo for devices
         */
-        return spi_register_master(master);
+        ret = spi_register_master(spi_master_get(master));
+        if (ret)
+                spi_master_put(master);
+        return 0;
 }
 EXPORT_SYMBOL_GPL(spi_bitbang_start);
diff --git a/drivers/spi/spi-butterfly.c b/drivers/spi/spi-butterfly.c
index 5ed08e537433..8081f96bd1d5 100644
--- a/drivers/spi/spi-butterfly.c
+++ b/drivers/spi/spi-butterfly.c
@@ -147,8 +147,8 @@ static void butterfly_chipselect(struct spi_device *spi, int value)
 /* we only needed to implement one mode here, and choose SPI_MODE_0 */
-#define spidelay(X)     do{}while(0)
+#define spidelay(X)     do { } while (0)
-//#define       spidelay        ndelay
+/* #define spidelay     ndelay */
 #include "spi-bitbang-txrx.h"
@@ -171,15 +171,15 @@ static struct mtd_partition partitions[] = { {
        /* sector 0 = 8 pages * 264 bytes/page (1 block)
         * sector 1 = 248 pages * 264 bytes/page
         */
-        .name           = "bookkeeping",        // 66 KB
+        .name           = "bookkeeping",        /* 66 KB */
        .offset         = 0,
        .size           = (8 + 248) * 264,
-//      .mask_flags     = MTD_WRITEABLE,
+        /* .mask_flags  = MTD_WRITEABLE, */
 }, {
        /* sector 2 = 256 pages * 264 bytes/page
         * sectors 3-5 = 512 pages * 264 bytes/page
         */
-        .name           = "filesystem",         // 462 KB
+        .name           = "filesystem",         /* 462 KB */
        .offset         = MTDPART_OFS_APPEND,
        .size           = MTDPART_SIZ_FULL,
 } };
@@ -209,7 +209,7 @@ static void butterfly_attach(struct parport *p)
         * and no way to be selective about what it binds to.
         */
-        master = spi_alloc_master(dev, sizeof *pp);
+        master = spi_alloc_master(dev, sizeof(*pp));
        if (!master) {
                status = -ENOMEM;
                goto done;
@@ -225,7 +225,7 @@ static void butterfly_attach(struct parport *p)
        master->bus_num = 42;
        master->num_chipselect = 2;
-        pp->bitbang.master = spi_master_get(master);
+        pp->bitbang.master = master;
        pp->bitbang.chipselect = butterfly_chipselect;
        pp->bitbang.txrx_word[SPI_MODE_0] = butterfly_txrx_word_mode0;
@@ -289,7 +289,6 @@ static void butterfly_attach(struct parport *p)
                pr_debug("%s: dataflash at %s\n", p->name,
                                dev_name(&pp->dataflash->dev));
-        // dev_info(_what?_, ...)
        pr_info("%s: AVR Butterfly\n", p->name);
        butterfly = pp;
        return;
diff --git a/drivers/spi/spi-clps711x.c b/drivers/spi/spi-clps711x.c
index 5655acf55bfe..e2a5a426b2ef 100644
--- a/drivers/spi/spi-clps711x.c
+++ b/drivers/spi/spi-clps711x.c
@@ -226,11 +226,10 @@ static int spi_clps711x_probe(struct platform_device *pdev)
                               dev_name(&pdev->dev), hw);
        if (ret) {
                dev_err(&pdev->dev, "Can't request IRQ\n");
-                clk_put(hw->spi_clk);
+                goto err_out;
-                goto clk_out;
        }
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(&pdev->dev, master);
        if (!ret) {
                dev_info(&pdev->dev,
                         "SPI bus driver initialized. Master clock %u Hz\n",
@@ -240,14 +239,12 @@ static int spi_clps711x_probe(struct platform_device *pdev)
        dev_err(&pdev->dev, "Failed to register master\n");
-clk_out:
 err_out:
        while (--i >= 0)
                if (gpio_is_valid(hw->chipselect[i]))
                        gpio_free(hw->chipselect[i]);
        spi_master_put(master);
-        kfree(master);
        return ret;
 }
@@ -262,9 +259,6 @@ static int spi_clps711x_remove(struct platform_device *pdev)
                if (gpio_is_valid(hw->chipselect[i]))
                        gpio_free(hw->chipselect[i]);
-        spi_unregister_master(master);
-        kfree(master);
        return 0;
 }
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 8fbfe2483ffd..dd72445ba2ea 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -279,7 +279,8 @@ static int davinci_spi_setup_transfer(struct spi_device *spi,
        struct davinci_spi *dspi;
        struct davinci_spi_config *spicfg;
        u8 bits_per_word = 0;
-        u32 hz = 0, spifmt = 0, prescale = 0;
+        u32 hz = 0, spifmt = 0;
+        int prescale;
        dspi = spi_master_get_devdata(spi->master);
        spicfg = (struct davinci_spi_config *)spi->controller_data;
@@ -916,7 +917,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
        if (ret)
                goto unmap_io;
-        dspi->bitbang.master = spi_master_get(master);
+        dspi->bitbang.master = master;
        if (dspi->bitbang.master == NULL) {
                ret = -ENODEV;
                goto irq_free;
@@ -925,7 +926,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
        dspi->clk = clk_get(&pdev->dev, NULL);
        if (IS_ERR(dspi->clk)) {
                ret = -ENODEV;
-                goto put_master;
+                goto irq_free;
        }
        clk_prepare_enable(dspi->clk);
@@ -1015,8 +1016,6 @@ free_dma:
 free_clk:
        clk_disable_unprepare(dspi->clk);
        clk_put(dspi->clk);
-put_master:
-        spi_master_put(master);
 irq_free:
        free_irq(dspi->irq, dspi);
 unmap_io:
@@ -1024,7 +1023,7 @@ unmap_io:
 release_region:
        release_mem_region(dspi->pbase, resource_size(r));
 free_master:
-        kfree(master);
+        spi_master_put(master);
 err:
        return ret;
 }
@@ -1051,11 +1050,11 @@ static int davinci_spi_remove(struct platform_device *pdev)
        clk_disable_unprepare(dspi->clk);
        clk_put(dspi->clk);
-        spi_master_put(master);
        free_irq(dspi->irq, dspi);
        iounmap(dspi->base);
        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        release_mem_region(dspi->pbase, resource_size(r));
+        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-dw-mmio.c b/drivers/spi/spi-dw-mmio.c
index 4aa8be865cc0..168c620947f4 100644
--- a/drivers/spi/spi-dw-mmio.c
+++ b/drivers/spi/spi-dw-mmio.c
@@ -74,7 +74,7 @@ static int dw_spi_mmio_probe(struct platform_device *pdev)
        dwsmmio->clk = clk_get(&pdev->dev, NULL);
        if (IS_ERR(dwsmmio->clk)) {
                ret = PTR_ERR(dwsmmio->clk);
-                goto err_irq;
+                goto err_unmap;
        }
        clk_enable(dwsmmio->clk);
@@ -94,8 +94,6 @@ err_clk:
        clk_disable(dwsmmio->clk);
        clk_put(dwsmmio->clk);
        dwsmmio->clk = NULL;
-err_irq:
-        free_irq(dws->irq, dws);
 err_unmap:
        iounmap(dws->regs);
 err_release_reg:
@@ -115,7 +113,6 @@ static int dw_spi_mmio_remove(struct platform_device *pdev)
        clk_put(dwsmmio->clk);
        dwsmmio->clk = NULL;
-        free_irq(dwsmmio->dws.irq, &dwsmmio->dws);
        dw_spi_remove_host(&dwsmmio->dws);
        iounmap(dwsmmio->dws.regs);
        kfree(dwsmmio);
diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
index 6055c8d9fdd7..66fa9955ea14 100644
--- a/drivers/spi/spi-dw-pci.c
+++ b/drivers/spi/spi-dw-pci.c
@@ -40,7 +40,7 @@ static int spi_pci_probe(struct pci_dev *pdev,
        int pci_bar = 0;
        int ret;
-        printk(KERN_INFO "DW: found PCI SPI controller(ID: %04x:%04x)\n",
+        dev_info(&pdev->dev, "found PCI SPI controller(ID: %04x:%04x)\n",
                pdev->vendor, pdev->device);
        ret = pci_enable_device(pdev);
@@ -109,7 +109,6 @@ static void spi_pci_remove(struct pci_dev *pdev)
 {
        struct dw_spi_pci *dwpci = pci_get_drvdata(pdev);
-        pci_set_drvdata(pdev, NULL);
        dw_spi_remove_host(&dwpci->dws);
        iounmap(dwpci->dws.regs);
        pci_release_region(pdev, 0);
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 79c958e49f61..b897c4adb39d 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -870,8 +870,8 @@ void dw_spi_remove_host(struct dw_spi *dws)
        /* Remove the queue */
        status = destroy_queue(dws);
        if (status != 0)
-                dev_err(&dws->master->dev, "dw_spi_remove: workqueue will not "
+                dev_err(&dws->master->dev,
-                        "complete, message memory not freed\n");
+                        "dw_spi_remove: workqueue will not complete, message memory not freed\n");
        if (dws->dma_ops && dws->dma_ops->dma_exit)
                dws->dma_ops->dma_exit(dws);
diff --git a/drivers/spi/spi-efm32.c b/drivers/spi/spi-efm32.c
index 7d84418a01d8..d4d3cc534792 100644
--- a/drivers/spi/spi-efm32.c
+++ b/drivers/spi/spi-efm32.c
@@ -280,10 +280,6 @@ static irqreturn_t efm32_spi_txirq(int irq, void *data)
        return IRQ_HANDLED;
 }
-static const struct efm32_spi_pdata efm32_spi_pdata_default = {
-        .location = 1,
-};
 static u32 efm32_spi_get_configured_location(struct efm32_spi_ddata *ddata)
 {
        u32 reg = efm32_spi_read32(ddata, REG_ROUTE);
@@ -347,7 +343,7 @@ static int efm32_spi_probe(struct platform_device *pdev)
        ddata = spi_master_get_devdata(master);
-        ddata->bitbang.master = spi_master_get(master);
+        ddata->bitbang.master = master;
        ddata->bitbang.chipselect = efm32_spi_chipselect;
        ddata->bitbang.setup_transfer = efm32_spi_setup_transfer;
        ddata->bitbang.txrx_bufs = efm32_spi_txrx_bufs;
@@ -387,7 +383,7 @@ static int efm32_spi_probe(struct platform_device *pdev)
                goto err;
        }
-        if (resource_size(res) < 60) {
+        if (resource_size(res) < 0x60) {
                ret = -EINVAL;
                dev_err(&pdev->dev, "memory resource too small\n");
                goto err;
@@ -467,7 +463,6 @@ err_disable_clk:
                clk_disable_unprepare(ddata->clk);
 err:
                spi_master_put(master);
-                kfree(master);
        }
        return ret;
@@ -478,13 +473,14 @@ static int efm32_spi_remove(struct platform_device *pdev)
        struct spi_master *master = platform_get_drvdata(pdev);
        struct efm32_spi_ddata *ddata = spi_master_get_devdata(master);
+        spi_bitbang_stop(&ddata->bitbang);
        efm32_spi_write32(ddata, 0, REG_IEN);
        free_irq(ddata->txirq, ddata);
        free_irq(ddata->rxirq, ddata);
        clk_disable_unprepare(ddata->clk);
        spi_master_put(master);
-        kfree(master);
        return 0;
 }
diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
index d22c00a227b6..1bfaed6e4073 100644
--- a/drivers/spi/spi-ep93xx.c
+++ b/drivers/spi/spi-ep93xx.c
@@ -330,7 +330,7 @@ static int ep93xx_spi_chip_setup(const struct ep93xx_spi *espi,
        dev_dbg(&espi->pdev->dev, "setup: mode %d, cpsr %d, scr %d, dss %d\n",
                chip->spi->mode, div_cpsr, div_scr, dss);
-        dev_dbg(&espi->pdev->dev, "setup: cr0 %#x", cr0);
+        dev_dbg(&espi->pdev->dev, "setup: cr0 %#x\n", cr0);
        ep93xx_spi_write_u8(espi, SSPCPSR, div_cpsr);
        ep93xx_spi_write_u16(espi, SSPCR0, cr0);
@@ -509,7 +509,7 @@ ep93xx_spi_dma_prepare(struct ep93xx_spi *espi, enum dma_transfer_direction dir)
        }
        if (WARN_ON(len)) {
-                dev_warn(&espi->pdev->dev, "len = %zu expected 0!", len);
+                dev_warn(&espi->pdev->dev, "len = %zu expected 0!\n", len);
                return ERR_PTR(-EINVAL);
        }
@@ -942,7 +942,7 @@ static int ep93xx_spi_probe(struct platform_device *pdev)
        /* make sure that the hardware is disabled */
        ep93xx_spi_write_u8(espi, SSPCR1, 0);
-        error = spi_register_master(master);
+        error = devm_spi_register_master(&pdev->dev, master);
        if (error) {
                dev_err(&pdev->dev, "failed to register SPI master\n");
                goto fail_free_dma;
@@ -968,7 +968,6 @@ static int ep93xx_spi_remove(struct platform_device *pdev)
        ep93xx_spi_release_dma(espi);
-        spi_unregister_master(master);
        return 0;
 }
diff --git a/drivers/spi/spi-fsl-cpm.c b/drivers/spi/spi-fsl-cpm.c
index 07971e3fe58b..58630edb8c21 100644
--- a/drivers/spi/spi-fsl-cpm.c
+++ b/drivers/spi/spi-fsl-cpm.c
@@ -299,7 +299,7 @@ int fsl_spi_cpm_init(struct mpc8xxx_spi *mspi)
                switch (mspi->subblock) {
                default:
-                        dev_warn(dev, "cell-index unspecified, assuming SPI1");
+                        dev_warn(dev, "cell-index unspecified, assuming SPI1\n");
                        /* fall through */
                case 0:
                        mspi->subblock = QE_CR_SUBBLOCK_SPI1;
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 6cd07d13ecab..8641b03bdd7a 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -108,7 +108,7 @@ struct fsl_dspi {
        struct spi_bitbang      bitbang;
        struct platform_device  *pdev;
-        void                    *base;
+        void __iomem            *base;
        int                     irq;
        struct clk              *clk;
@@ -165,7 +165,7 @@ static void hz_to_spi_baud(char *pbr, char *br, int speed_hz,
                        }
                }
-        pr_warn("Can not find valid buad rate,speed_hz is %d,clkrate is %ld\
+        pr_warn("Can not find valid baud rate,speed_hz is %d,clkrate is %ld\
                ,we use the max prescaler value.\n", speed_hz, clkrate);
        *pbr = ARRAY_SIZE(pbr_tbl) - 1;
        *br =  ARRAY_SIZE(brs) - 1;
@@ -450,7 +450,7 @@ static int dspi_probe(struct platform_device *pdev)
        dspi = spi_master_get_devdata(master);
        dspi->pdev = pdev;
-        dspi->bitbang.master = spi_master_get(master);
+        dspi->bitbang.master = master;
        dspi->bitbang.chipselect = dspi_chipselect;
        dspi->bitbang.setup_transfer = dspi_setup_transfer;
        dspi->bitbang.txrx_bufs = dspi_txrx_transfer;
@@ -476,15 +476,9 @@ static int dspi_probe(struct platform_device *pdev)
        master->bus_num = bus_num;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(&pdev->dev, "can't get platform resource\n");
-                ret = -EINVAL;
-                goto out_master_put;
-        }
        dspi->base = devm_ioremap_resource(&pdev->dev, res);
-        if (!dspi->base) {
+        if (IS_ERR(dspi->base)) {
-                ret = -EINVAL;
+                ret = PTR_ERR(dspi->base);
                goto out_master_put;
        }
@@ -526,7 +520,6 @@ out_clk_put:
        clk_disable_unprepare(dspi->clk);
 out_master_put:
        spi_master_put(master);
-        platform_set_drvdata(pdev, NULL);
        return ret;
 }
@@ -537,6 +530,7 @@ static int dspi_remove(struct platform_device *pdev)
        /* Disconnect from the SPI framework */
        spi_bitbang_stop(&dspi->bitbang);
+        clk_disable_unprepare(dspi->clk);
        spi_master_put(dspi->bitbang.master);
        return 0;
@@ -553,5 +547,5 @@ static struct platform_driver fsl_dspi_driver = {
 module_platform_driver(fsl_dspi_driver);
 MODULE_DESCRIPTION("Freescale DSPI Controller Driver");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" DRIVER_NAME);
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
index b8f1103fe28e..43222d7532d1 100644
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -289,8 +289,8 @@ static void fsl_espi_do_trans(struct spi_message *m,
                if ((first->bits_per_word != t->bits_per_word) ||
                        (first->speed_hz != t->speed_hz)) {
                        espi_trans->status = -EINVAL;
-                        dev_err(mspi->dev, "bits_per_word/speed_hz should be"
+                        dev_err(mspi->dev,
-                                        " same for the same SPI transfer\n");
+                                "bits_per_word/speed_hz should be same for the same SPI transfer\n");
                        return;
                }
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index 68b69fec13a9..3fb09f981980 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -22,6 +22,7 @@
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/gpio.h>
+#include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/of_gpio.h>
@@ -467,7 +468,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
        }
 #endif
-        spi_gpio->bitbang.master = spi_master_get(master);
+        spi_gpio->bitbang.master = master;
        spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
        if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
@@ -486,7 +487,6 @@ static int spi_gpio_probe(struct platform_device *pdev)
        status = spi_bitbang_start(&spi_gpio->bitbang);
        if (status < 0) {
-                spi_master_put(spi_gpio->bitbang.master);
 gpio_free:
                if (SPI_MISO_GPIO != SPI_GPIO_NO_MISO)
                        gpio_free(SPI_MISO_GPIO);
@@ -510,13 +510,13 @@ static int spi_gpio_remove(struct platform_device *pdev)
        /* stop() unregisters child devices too */
        status = spi_bitbang_stop(&spi_gpio->bitbang);
-        spi_master_put(spi_gpio->bitbang.master);
        if (SPI_MISO_GPIO != SPI_GPIO_NO_MISO)
                gpio_free(SPI_MISO_GPIO);
        if (SPI_MOSI_GPIO != SPI_GPIO_NO_MOSI)
                gpio_free(SPI_MOSI_GPIO);
        gpio_free(SPI_SCK_GPIO);
+        spi_master_put(spi_gpio->bitbang.master);
        return status;
 }
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 15323d8bd9cf..b80f2f70fef7 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -749,6 +749,35 @@ static void spi_imx_cleanup(struct spi_device *spi)
 {
 }
+static int
+spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg)
+{
+        struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+        int ret;
+        ret = clk_enable(spi_imx->clk_per);
+        if (ret)
+                return ret;
+        ret = clk_enable(spi_imx->clk_ipg);
+        if (ret) {
+                clk_disable(spi_imx->clk_per);
+                return ret;
+        }
+        return 0;
+}
+static int
+spi_imx_unprepare_message(struct spi_master *master, struct spi_message *msg)
+{
+        struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+        clk_disable(spi_imx->clk_ipg);
+        clk_disable(spi_imx->clk_per);
+        return 0;
+}
 static int spi_imx_probe(struct platform_device *pdev)
 {
        struct device_node *np = pdev->dev.of_node;
@@ -786,7 +815,7 @@ static int spi_imx_probe(struct platform_device *pdev)
        master->num_chipselect = num_cs;
        spi_imx = spi_master_get_devdata(master);
-        spi_imx->bitbang.master = spi_master_get(master);
+        spi_imx->bitbang.master = master;
        for (i = 0; i < master->num_chipselect; i++) {
                int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
@@ -810,6 +839,8 @@ static int spi_imx_probe(struct platform_device *pdev)
        spi_imx->bitbang.txrx_bufs = spi_imx_transfer;
        spi_imx->bitbang.master->setup = spi_imx_setup;
        spi_imx->bitbang.master->cleanup = spi_imx_cleanup;
+        spi_imx->bitbang.master->prepare_message = spi_imx_prepare_message;
+        spi_imx->bitbang.master->unprepare_message = spi_imx_unprepare_message;
        spi_imx->bitbang.master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
        init_completion(&spi_imx->xfer_done);
@@ -872,6 +903,8 @@ static int spi_imx_probe(struct platform_device *pdev)
        dev_info(&pdev->dev, "probed\n");
+        clk_disable(spi_imx->clk_ipg);
+        clk_disable(spi_imx->clk_per);
        return ret;
 out_clk_put:
diff --git a/drivers/spi/spi-lm70llp.c b/drivers/spi/spi-lm70llp.c
index 0759b5db9883..41c5765be746 100644
--- a/drivers/spi/spi-lm70llp.c
+++ b/drivers/spi/spi-lm70llp.c
@@ -222,7 +222,7 @@ static void spi_lm70llp_attach(struct parport *p)
        /*
         * SPI and bitbang hookup.
         */
-        pp->bitbang.master = spi_master_get(master);
+        pp->bitbang.master = master;
        pp->bitbang.chipselect = lm70_chipselect;
        pp->bitbang.txrx_word[SPI_MODE_0] = lm70_txrx;
        pp->bitbang.flags = SPI_3WIRE;
diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
index dbc5e999a1f5..ee6e61cbf7f5 100644
--- a/drivers/spi/spi-mpc512x-psc.c
+++ b/drivers/spi/spi-mpc512x-psc.c
@@ -522,8 +522,10 @@ static int mpc512x_psc_spi_do_probe(struct device *dev, u32 regaddr,
        psc_num = master->bus_num;
        snprintf(clk_name, sizeof(clk_name), "psc%d_mclk", psc_num);
        clk = devm_clk_get(dev, clk_name);
-        if (IS_ERR(clk))
+        if (IS_ERR(clk)) {
+                ret = PTR_ERR(clk);
                goto free_irq;
+        }
        ret = clk_prepare_enable(clk);
        if (ret)
                goto free_irq;
@@ -534,7 +536,7 @@ static int mpc512x_psc_spi_do_probe(struct device *dev, u32 regaddr,
        if (ret < 0)
                goto free_clock;
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(dev, master);
        if (ret < 0)
                goto free_clock;
@@ -557,12 +559,10 @@ static int mpc512x_psc_spi_do_remove(struct device *dev)
        struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
        struct mpc512x_psc_spi *mps = spi_master_get_devdata(master);
-        spi_unregister_master(master);
        clk_disable_unprepare(mps->clk_mclk);
        free_irq(mps->irq, mps);
        if (mps->psc)
                iounmap(mps->psc);
-        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-mpc52xx-psc.c b/drivers/spi/spi-mpc52xx-psc.c
index 6e925dc34396..00ba910ab302 100644
--- a/drivers/spi/spi-mpc52xx-psc.c
+++ b/drivers/spi/spi-mpc52xx-psc.c
@@ -383,8 +383,8 @@ static int mpc52xx_psc_spi_do_probe(struct device *dev, u32 regaddr,
        mps->irq = irq;
        if (pdata == NULL) {
-                dev_warn(dev, "probe called without platform data, no "
+                dev_warn(dev,
-                                "cs_control function will be called\n");
+                         "probe called without platform data, no cs_control function will be called\n");
                mps->cs_control = NULL;
                mps->sysclk = 0;
                master->bus_num = bus_num;
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index de7b1141b90f..de333059a9a7 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -57,34 +57,53 @@
 #define SG_MAXLEN               0xff00
+/*
+ * Flags for txrx functions.  More efficient that using an argument register for
+ * each one.
+ */
+#define TXRX_WRITE              (1<<0)  /* This is a write */
+#define TXRX_DEASSERT_CS        (1<<1)  /* De-assert CS at end of txrx */
 struct mxs_spi {
        struct mxs_ssp          ssp;
        struct completion       c;
+        unsigned int            sck;    /* Rate requested (vs actual) */
 };
 static int mxs_spi_setup_transfer(struct spi_device *dev,
-                                struct spi_transfer *t)
+                                  const struct spi_transfer *t)
 {
        struct mxs_spi *spi = spi_master_get_devdata(dev->master);
        struct mxs_ssp *ssp = &spi->ssp;
-        uint32_t hz = 0;
+        const unsigned int hz = min(dev->max_speed_hz, t->speed_hz);
-        hz = dev->max_speed_hz;
-        if (t && t->speed_hz)
-                hz = min(hz, t->speed_hz);
        if (hz == 0) {
-                dev_err(&dev->dev, "Cannot continue with zero clock\n");
+                dev_err(&dev->dev, "SPI clock rate of zero not allowed\n");
                return -EINVAL;
        }
-        mxs_ssp_set_clk_rate(ssp, hz);
+        if (hz != spi->sck) {
+                mxs_ssp_set_clk_rate(ssp, hz);
+                /*
+                 * Save requested rate, hz, rather than the actual rate,
+                 * ssp->clk_rate.  Otherwise we would set the rate every trasfer
+                 * when the actual rate is not quite the same as requested rate.
+                 */
+                spi->sck = hz;
+                /*
+                 * Perhaps we should return an error if the actual clock is
+                 * nowhere close to what was requested?
+                 */
+        }
+        writel(BM_SSP_CTRL0_LOCK_CS,
+                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
        writel(BF_SSP_CTRL1_SSP_MODE(BV_SSP_CTRL1_SSP_MODE__SPI) |
-                     BF_SSP_CTRL1_WORD_LENGTH
+               BF_SSP_CTRL1_WORD_LENGTH(BV_SSP_CTRL1_WORD_LENGTH__EIGHT_BITS) |
-                     (BV_SSP_CTRL1_WORD_LENGTH__EIGHT_BITS) |
+               ((dev->mode & SPI_CPOL) ? BM_SSP_CTRL1_POLARITY : 0) |
-                     ((dev->mode & SPI_CPOL) ? BM_SSP_CTRL1_POLARITY : 0) |
+               ((dev->mode & SPI_CPHA) ? BM_SSP_CTRL1_PHASE : 0),
-                     ((dev->mode & SPI_CPHA) ? BM_SSP_CTRL1_PHASE : 0),
+               ssp->base + HW_SSP_CTRL1(ssp));
-                     ssp->base + HW_SSP_CTRL1(ssp));
        writel(0x0, ssp->base + HW_SSP_CMD0);
        writel(0x0, ssp->base + HW_SSP_CMD1);
@@ -94,26 +113,15 @@ static int mxs_spi_setup_transfer(struct spi_device *dev,
 static int mxs_spi_setup(struct spi_device *dev)
 {
-        int err = 0;
        if (!dev->bits_per_word)
                dev->bits_per_word = 8;
-        if (dev->mode & ~(SPI_CPOL | SPI_CPHA))
+        return 0;
-                return -EINVAL;
-        err = mxs_spi_setup_transfer(dev, NULL);
-        if (err) {
-                dev_err(&dev->dev,
-                        "Failed to setup transfer, error = %d\n", err);
-        }
-        return err;
 }
-static uint32_t mxs_spi_cs_to_reg(unsigned cs)
+static u32 mxs_spi_cs_to_reg(unsigned cs)
 {
-        uint32_t select = 0;
+        u32 select = 0;
        /*
         * i.MX28 Datasheet: 17.10.1: HW_SSP_CTRL0
@@ -131,43 +139,11 @@ static uint32_t mxs_spi_cs_to_reg(unsigned cs)
        return select;
 }
-static void mxs_spi_set_cs(struct mxs_spi *spi, unsigned cs)
-{
-        const uint32_t mask =
-                BM_SSP_CTRL0_WAIT_FOR_CMD | BM_SSP_CTRL0_WAIT_FOR_IRQ;
-        uint32_t select;
-        struct mxs_ssp *ssp = &spi->ssp;
-        writel(mask, ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
-        select = mxs_spi_cs_to_reg(cs);
-        writel(select, ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
-}
-static inline void mxs_spi_enable(struct mxs_spi *spi)
-{
-        struct mxs_ssp *ssp = &spi->ssp;
-        writel(BM_SSP_CTRL0_LOCK_CS,
-                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
-        writel(BM_SSP_CTRL0_IGNORE_CRC,
-                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
-}
-static inline void mxs_spi_disable(struct mxs_spi *spi)
-{
-        struct mxs_ssp *ssp = &spi->ssp;
-        writel(BM_SSP_CTRL0_LOCK_CS,
-                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
-        writel(BM_SSP_CTRL0_IGNORE_CRC,
-                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
-}
 static int mxs_ssp_wait(struct mxs_spi *spi, int offset, int mask, bool set)
 {
        const unsigned long timeout = jiffies + msecs_to_jiffies(SSP_TIMEOUT);
        struct mxs_ssp *ssp = &spi->ssp;
-        uint32_t reg;
+        u32 reg;
        do {
                reg = readl_relaxed(ssp->base + offset);
@@ -200,9 +176,9 @@ static irqreturn_t mxs_ssp_irq_handler(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
-static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
+static int mxs_spi_txrx_dma(struct mxs_spi *spi,
                            unsigned char *buf, int len,
-                            int *first, int *last, int write)
+                            unsigned int flags)
 {
        struct mxs_ssp *ssp = &spi->ssp;
        struct dma_async_tx_descriptor *desc = NULL;
@@ -211,11 +187,11 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
        const int sgs = DIV_ROUND_UP(len, desc_len);
        int sg_count;
        int min, ret;
-        uint32_t ctrl0;
+        u32 ctrl0;
        struct page *vm_page;
        void *sg_buf;
        struct {
-                uint32_t                pio[4];
+                u32                     pio[4];
                struct scatterlist      sg;
        } *dma_xfer;
@@ -228,21 +204,25 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
        INIT_COMPLETION(spi->c);
+        /* Chip select was already programmed into CTRL0 */
        ctrl0 = readl(ssp->base + HW_SSP_CTRL0);
-        ctrl0 &= ~BM_SSP_CTRL0_XFER_COUNT;
+        ctrl0 &= ~(BM_SSP_CTRL0_XFER_COUNT | BM_SSP_CTRL0_IGNORE_CRC |
-        ctrl0 |= BM_SSP_CTRL0_DATA_XFER | mxs_spi_cs_to_reg(cs);
+                 BM_SSP_CTRL0_READ);
+        ctrl0 |= BM_SSP_CTRL0_DATA_XFER;
-        if (*first)
+        if (!(flags & TXRX_WRITE))
-                ctrl0 |= BM_SSP_CTRL0_LOCK_CS;
-        if (!write)
                ctrl0 |= BM_SSP_CTRL0_READ;
        /* Queue the DMA data transfer. */
        for (sg_count = 0; sg_count < sgs; sg_count++) {
+                /* Prepare the transfer descriptor. */
                min = min(len, desc_len);
-                /* Prepare the transfer descriptor. */
+                /*
-                if ((sg_count + 1 == sgs) && *last)
+                 * De-assert CS on last segment if flag is set (i.e., no more
+                 * transfers will follow)
+                 */
+                if ((sg_count + 1 == sgs) && (flags & TXRX_DEASSERT_CS))
                        ctrl0 |= BM_SSP_CTRL0_IGNORE_CRC;
                if (ssp->devid == IMX23_SSP) {
@@ -267,7 +247,7 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
                sg_init_one(&dma_xfer[sg_count].sg, sg_buf, min);
                ret = dma_map_sg(ssp->dev, &dma_xfer[sg_count].sg, 1,
-                        write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                        (flags & TXRX_WRITE) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
                len -= min;
                buf += min;
@@ -287,7 +267,7 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
                desc = dmaengine_prep_slave_sg(ssp->dmach,
                                &dma_xfer[sg_count].sg, 1,
-                                write ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM,
+                                (flags & TXRX_WRITE) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM,
                                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
                if (!desc) {
@@ -324,7 +304,7 @@ err_vmalloc:
        while (--sg_count >= 0) {
 err_mapped:
                dma_unmap_sg(ssp->dev, &dma_xfer[sg_count].sg, 1,
-                        write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                        (flags & TXRX_WRITE) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
        }
        kfree(dma_xfer);
@@ -332,20 +312,19 @@ err_mapped:
        return ret;
 }
-static int mxs_spi_txrx_pio(struct mxs_spi *spi, int cs,
+static int mxs_spi_txrx_pio(struct mxs_spi *spi,
                            unsigned char *buf, int len,
-                            int *first, int *last, int write)
+                            unsigned int flags)
 {
        struct mxs_ssp *ssp = &spi->ssp;
-        if (*first)
+        writel(BM_SSP_CTRL0_IGNORE_CRC,
-                mxs_spi_enable(spi);
+               ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
-        mxs_spi_set_cs(spi, cs);
        while (len--) {
-                if (*last && len == 0)
+                if (len == 0 && (flags & TXRX_DEASSERT_CS))
-                        mxs_spi_disable(spi);
+                        writel(BM_SSP_CTRL0_IGNORE_CRC,
+                               ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
                if (ssp->devid == IMX23_SSP) {
                        writel(BM_SSP_CTRL0_XFER_COUNT,
@@ -356,7 +335,7 @@ static int mxs_spi_txrx_pio(struct mxs_spi *spi, int cs,
                        writel(1, ssp->base + HW_SSP_XFER_SIZE);
                }
-                if (write)
+                if (flags & TXRX_WRITE)
                        writel(BM_SSP_CTRL0_READ,
                                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
                else
@@ -369,13 +348,13 @@ static int mxs_spi_txrx_pio(struct mxs_spi *spi, int cs,
                if (mxs_ssp_wait(spi, HW_SSP_CTRL0, BM_SSP_CTRL0_RUN, 1))
                        return -ETIMEDOUT;
-                if (write)
+                if (flags & TXRX_WRITE)
                        writel(*buf, ssp->base + HW_SSP_DATA(ssp));
                writel(BM_SSP_CTRL0_DATA_XFER,
                             ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
-                if (!write) {
+                if (!(flags & TXRX_WRITE)) {
                        if (mxs_ssp_wait(spi, HW_SSP_STATUS(ssp),
                                                BM_SSP_STATUS_FIFO_EMPTY, 0))
                                return -ETIMEDOUT;
@@ -400,14 +379,15 @@ static int mxs_spi_transfer_one(struct spi_master *master,
 {
        struct mxs_spi *spi = spi_master_get_devdata(master);
        struct mxs_ssp *ssp = &spi->ssp;
-        int first, last;
        struct spi_transfer *t, *tmp_t;
+        unsigned int flag;
        int status = 0;
-        int cs;
-        first = last = 0;
-        cs = m->spi->chip_select;
+        /* Program CS register bits here, it will be used for all transfers. */
+        writel(BM_SSP_CTRL0_WAIT_FOR_CMD | BM_SSP_CTRL0_WAIT_FOR_IRQ,
+               ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+        writel(mxs_spi_cs_to_reg(m->spi->chip_select),
+               ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
        list_for_each_entry_safe(t, tmp_t, &m->transfers, transfer_list) {
@@ -415,16 +395,9 @@ static int mxs_spi_transfer_one(struct spi_master *master,
                if (status)
                        break;
-                if (&t->transfer_list == m->transfers.next)
+                /* De-assert on last transfer, inverted by cs_change flag */
-                        first = 1;
+                flag = (&t->transfer_list == m->transfers.prev) ^ t->cs_change ?
-                if (&t->transfer_list == m->transfers.prev)
+                       TXRX_DEASSERT_CS : 0;
-                        last = 1;
-                if ((t->rx_buf && t->tx_buf) || (t->rx_dma && t->tx_dma)) {
-                        dev_err(ssp->dev,
-                                "Cannot send and receive simultaneously\n");
-                        status = -EINVAL;
-                        break;
-                }
                /*
                 * Small blocks can be transfered via PIO.
@@ -441,26 +414,26 @@ static int mxs_spi_transfer_one(struct spi_master *master,
                                STMP_OFFSET_REG_CLR);
                        if (t->tx_buf)
-                                status = mxs_spi_txrx_pio(spi, cs,
+                                status = mxs_spi_txrx_pio(spi,
                                                (void *)t->tx_buf,
-                                                t->len, &first, &last, 1);
+                                                t->len, flag | TXRX_WRITE);
                        if (t->rx_buf)
-                                status = mxs_spi_txrx_pio(spi, cs,
+                                status = mxs_spi_txrx_pio(spi,
                                                t->rx_buf, t->len,
-                                                &first, &last, 0);
+                                                flag);
                } else {
                        writel(BM_SSP_CTRL1_DMA_ENABLE,
                                ssp->base + HW_SSP_CTRL1(ssp) +
                                STMP_OFFSET_REG_SET);
                        if (t->tx_buf)
-                                status = mxs_spi_txrx_dma(spi, cs,
+                                status = mxs_spi_txrx_dma(spi,
                                                (void *)t->tx_buf, t->len,
-                                                &first, &last, 1);
+                                                flag | TXRX_WRITE);
                        if (t->rx_buf)
-                                status = mxs_spi_txrx_dma(spi, cs,
+                                status = mxs_spi_txrx_dma(spi,
                                                t->rx_buf, t->len,
-                                                &first, &last, 0);
+                                                flag);
                }
                if (status) {
@@ -469,7 +442,6 @@ static int mxs_spi_transfer_one(struct spi_master *master,
                }
                m->actual_length += t->len;
-                first = last = 0;
        }
        m->status = status;
@@ -563,7 +535,6 @@ static int mxs_spi_probe(struct platform_device *pdev)
                goto out_dma_release;
        clk_set_rate(ssp->clk, clk_freq);
-        ssp->clk_rate = clk_get_rate(ssp->clk) / 1000;
        ret = stmp_reset_block(ssp->base);
        if (ret)
@@ -571,7 +542,7 @@ static int mxs_spi_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, master);
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(&pdev->dev, master);
        if (ret) {
                dev_err(&pdev->dev, "Cannot register SPI master, %d\n", ret);
                goto out_disable_clk;
@@ -598,10 +569,8 @@ static int mxs_spi_remove(struct platform_device *pdev)
        spi = spi_master_get_devdata(master);
        ssp = &spi->ssp;
-        spi_unregister_master(master);
        clk_disable_unprepare(ssp->clk);
        dma_release_channel(ssp->dmach);
-        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-nuc900.c b/drivers/spi/spi-nuc900.c
index 47a68b43bcd5..e0c32bc69ee2 100644
--- a/drivers/spi/spi-nuc900.c
+++ b/drivers/spi/spi-nuc900.c
@@ -349,7 +349,7 @@ static int nuc900_spi_probe(struct platform_device *pdev)
        }
        hw = spi_master_get_devdata(master);
-        hw->master = spi_master_get(master);
+        hw->master = master;
        hw->pdata  = dev_get_platdata(&pdev->dev);
        hw->dev = &pdev->dev;
@@ -435,7 +435,6 @@ err_iomap:
        kfree(hw->ioarea);
 err_pdata:
        spi_master_put(hw->master);
 err_nomem:
        return err;
 }
diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c
index 333cb1badcd7..91c668596202 100644
--- a/drivers/spi/spi-oc-tiny.c
+++ b/drivers/spi/spi-oc-tiny.c
@@ -306,7 +306,7 @@ static int tiny_spi_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, hw);
        /* setup the state for the bitbang driver */
-        hw->bitbang.master = spi_master_get(master);
+        hw->bitbang.master = master;
        if (!hw->bitbang.master)
                return err;
        hw->bitbang.setup_transfer = tiny_spi_setup_transfer;
diff --git a/drivers/spi/spi-octeon.c b/drivers/spi/spi-octeon.c
index 5f28ddbe4f7e..67249a48b391 100644
--- a/drivers/spi/spi-octeon.c
+++ b/drivers/spi/spi-octeon.c
@@ -272,7 +272,7 @@ static int octeon_spi_probe(struct platform_device *pdev)
        master->bits_per_word_mask = SPI_BPW_MASK(8);
        master->dev.of_node = pdev->dev.of_node;
-        err = spi_register_master(master);
+        err = devm_spi_register_master(&pdev->dev, master);
        if (err) {
                dev_err(&pdev->dev, "register master failed: %d\n", err);
                goto fail;
@@ -292,8 +292,6 @@ static int octeon_spi_remove(struct platform_device *pdev)
        struct octeon_spi *p = spi_master_get_devdata(master);
        u64 register_base = p->register_base;
-        spi_unregister_master(master);
        /* Clear the CSENA* and put everything in a known state. */
        cvmx_write_csr(register_base + OCTEON_SPI_CFG, 0);
diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
index 69ecf05757dd..b6ed82beb01d 100644
--- a/drivers/spi/spi-omap-100k.c
+++ b/drivers/spi/spi-omap-100k.c
@@ -457,7 +457,7 @@ static int omap1_spi100k_probe(struct platform_device *pdev)
                goto err;
        }
-        status = spi_register_master(master);
+        status = devm_spi_register_master(&pdev->dev, master);
        if (status < 0)
                goto err;
@@ -485,8 +485,6 @@ static int omap1_spi100k_remove(struct platform_device *pdev)
        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        spi_unregister_master(master);
        return 0;
 }
diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c
index a6a8f0961750..9313fd3b413d 100644
--- a/drivers/spi/spi-omap-uwire.c
+++ b/drivers/spi/spi-omap-uwire.c
@@ -557,7 +557,8 @@ static struct platform_driver uwire_driver = {
                .name           = "omap_uwire",
                .owner          = THIS_MODULE,
        },
-        .remove         = uwire_remove,
+        .probe = uwire_probe,
+        .remove = uwire_remove,
        // suspend ... unuse ck
        // resume ... use ck
 };
@@ -579,7 +580,7 @@ static int __init omap_uwire_init(void)
                omap_writel(val | 0x00AAA000, OMAP7XX_IO_CONF_9);
        }
-        return platform_driver_probe(&uwire_driver, uwire_probe);
+        return platform_driver_register(&uwire_driver);
 }
 static void __exit omap_uwire_exit(void)
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index ed4af4708d9a..443df39840bc 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -276,7 +276,7 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
        struct omap2_mcspi_cs *cs = spi->controller_state;
        struct omap2_mcspi *mcspi;
        unsigned int wcnt;
-        int fifo_depth, bytes_per_word;
+        int max_fifo_depth, fifo_depth, bytes_per_word;
        u32 chconf, xferlevel;
        mcspi = spi_master_get_devdata(master);
@@ -287,7 +287,12 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
                if (t->len % bytes_per_word != 0)
                        goto disable_fifo;
-                fifo_depth = gcd(t->len, OMAP2_MCSPI_MAX_FIFODEPTH);
+                if (t->rx_buf != NULL && t->tx_buf != NULL)
+                        max_fifo_depth = OMAP2_MCSPI_MAX_FIFODEPTH / 2;
+                else
+                        max_fifo_depth = OMAP2_MCSPI_MAX_FIFODEPTH;
+                fifo_depth = gcd(t->len, max_fifo_depth);
                if (fifo_depth < 2 || fifo_depth % bytes_per_word != 0)
                        goto disable_fifo;
@@ -299,7 +304,8 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
                if (t->rx_buf != NULL) {
                        chconf |= OMAP2_MCSPI_CHCONF_FFER;
                        xferlevel |= (fifo_depth - 1) << 8;
-                } else {
+                }
+                if (t->tx_buf != NULL) {
                        chconf |= OMAP2_MCSPI_CHCONF_FFET;
                        xferlevel |= fifo_depth - 1;
                }
@@ -498,7 +504,7 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer,
                                ((u32 *)xfer->rx_buf)[elements++] = w;
                } else {
                        int bytes_per_word = mcspi_bytes_per_word(word_len);
-                        dev_err(&spi->dev, "DMA RX penultimate word empty");
+                        dev_err(&spi->dev, "DMA RX penultimate word empty\n");
                        count -= (bytes_per_word << 1);
                        omap2_mcspi_set_enable(spi, 1);
                        return count;
@@ -516,7 +522,7 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer,
                else /* word_len <= 32 */
                        ((u32 *)xfer->rx_buf)[elements] = w;
        } else {
-                dev_err(&spi->dev, "DMA RX last word empty");
+                dev_err(&spi->dev, "DMA RX last word empty\n");
                count -= mcspi_bytes_per_word(word_len);
        }
        omap2_mcspi_set_enable(spi, 1);
@@ -1407,7 +1413,7 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
        if (status < 0)
                goto disable_pm;
-        status = spi_register_master(master);
+        status = devm_spi_register_master(&pdev->dev, master);
        if (status < 0)
                goto disable_pm;
@@ -1435,7 +1441,6 @@ static int omap2_mcspi_remove(struct platform_device *pdev)
        pm_runtime_put_sync(mcspi->dev);
        pm_runtime_disable(&pdev->dev);
-        spi_unregister_master(master);
        kfree(dma_channels);
        return 0;
diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
index 1d1d321d90c4..744841e095e4 100644
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -84,8 +84,8 @@ static int orion_spi_set_transfer_size(struct orion_spi *orion_spi, int size)
                orion_spi_clrbits(orion_spi, ORION_SPI_IF_CONFIG_REG,
                                  ORION_SPI_IF_8_16_BIT_MODE);
        } else {
-                pr_debug("Bad bits per word value %d (only 8 or 16 are "
+                pr_debug("Bad bits per word value %d (only 8 or 16 are allowed).\n",
-                         "allowed).\n", size);
+                        size);
                return -EINVAL;
        }
@@ -407,7 +407,7 @@ static int orion_spi_probe(struct platform_device *pdev)
        const u32 *iprop;
        int size;
-        master = spi_alloc_master(&pdev->dev, sizeof *spi);
+        master = spi_alloc_master(&pdev->dev, sizeof(*spi));
        if (master == NULL) {
                dev_dbg(&pdev->dev, "master allocation failed\n");
                return -ENOMEM;
@@ -457,7 +457,7 @@ static int orion_spi_probe(struct platform_device *pdev)
                goto out_rel_clk;
        master->dev.of_node = pdev->dev.of_node;
-        status = spi_register_master(master);
+        status = devm_spi_register_master(&pdev->dev, master);
        if (status < 0)
                goto out_rel_clk;
@@ -483,8 +483,6 @@ static int orion_spi_remove(struct platform_device *pdev)
        clk_disable_unprepare(spi->clk);
        clk_put(spi->clk);
-        spi_unregister_master(master);
        return 0;
 }
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 9c511a954d21..2789b452e711 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1619,7 +1619,6 @@ static int verify_controller_parameters(struct pl022 *pl022,
                dev_err(&pl022->adev->dev,
                        "RX FIFO Trigger Level is configured incorrectly\n");
                return -EINVAL;
-                break;
        }
        switch (chip_info->tx_lev_trig) {
        case SSP_TX_1_OR_MORE_EMPTY_LOC:
@@ -1645,7 +1644,6 @@ static int verify_controller_parameters(struct pl022 *pl022,
                dev_err(&pl022->adev->dev,
                        "TX FIFO Trigger Level is configured incorrectly\n");
                return -EINVAL;
-                break;
        }
        if (chip_info->iface == SSP_INTERFACE_NATIONAL_MICROWIRE) {
                if ((chip_info->ctrl_len < SSP_BITS_4)
@@ -2175,8 +2173,8 @@ static int pl022_probe(struct amba_device *adev, const struct amba_id *id)
                status = -ENOMEM;
                goto err_no_ioremap;
        }
-        printk(KERN_INFO "pl022: mapped registers from %pa to %p\n",
+        dev_info(&adev->dev, "mapped registers from %pa to %p\n",
-               &adev->res.start, pl022->virtbase);
+                &adev->res.start, pl022->virtbase);
        pl022->clk = devm_clk_get(&adev->dev, NULL);
        if (IS_ERR(pl022->clk)) {
@@ -2227,7 +2225,7 @@ static int pl022_probe(struct amba_device *adev, const struct amba_id *id)
        /* Register with the SPI framework */
        amba_set_drvdata(adev, pl022);
-        status = spi_register_master(master);
+        status = devm_spi_register_master(&adev->dev, master);
        if (status != 0) {
                dev_err(&adev->dev,
                        "probe - problem registering spi master\n");
@@ -2287,8 +2285,6 @@ pl022_remove(struct amba_device *adev)
        clk_unprepare(pl022->clk);
        amba_release_regions(adev);
        tasklet_disable(&pl022->pump_transfers);
-        spi_unregister_master(pl022->master);
-        amba_set_drvdata(adev, NULL);
        return 0;
 }
diff --git a/drivers/spi/spi-ppc4xx.c b/drivers/spi/spi-ppc4xx.c
index 0ee53c25ba58..c57740bb70d3 100644
--- a/drivers/spi/spi-ppc4xx.c
+++ b/drivers/spi/spi-ppc4xx.c
@@ -396,7 +396,7 @@ static int spi_ppc4xx_of_probe(struct platform_device *op)
        master->dev.of_node = np;
        platform_set_drvdata(op, master);
        hw = spi_master_get_devdata(master);
-        hw->master = spi_master_get(master);
+        hw->master = master;
        hw->dev = dev;
        init_completion(&hw->done);
@@ -558,6 +558,7 @@ static int spi_ppc4xx_of_remove(struct platform_device *op)
        free_irq(hw->irqnum, hw);
        iounmap(hw->regs);
        free_gpios(hw);
+        spi_master_put(master);
        return 0;
 }
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index 2eb06ee0b326..cb0e1f1137ad 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -546,8 +546,17 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
        if (pm_runtime_suspended(&drv_data->pdev->dev))
                return IRQ_NONE;
-        sccr1_reg = read_SSCR1(reg);
+        /*
+         * If the device is not yet in RPM suspended state and we get an
+         * interrupt that is meant for another device, check if status bits
+         * are all set to one. That means that the device is already
+         * powered off.
+         */
        status = read_SSSR(reg);
+        if (status == ~0)
+                return IRQ_NONE;
+        sccr1_reg = read_SSCR1(reg);
        /* Ignore possible writes if we don't need to write */
        if (!(sccr1_reg & SSCR1_TIE))
@@ -564,8 +573,8 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
                        write_SSTO(0, reg);
                write_SSSR_CS(drv_data, drv_data->clear_sr);
-                dev_err(&drv_data->pdev->dev, "bad message state "
+                dev_err(&drv_data->pdev->dev,
-                        "in interrupt handler\n");
+                        "bad message state in interrupt handler\n");
                /* Never fail */
                return IRQ_HANDLED;
@@ -642,8 +651,8 @@ static void pump_transfers(unsigned long data)
                if (message->is_dma_mapped
                                || transfer->rx_dma || transfer->tx_dma) {
                        dev_err(&drv_data->pdev->dev,
-                                "pump_transfers: mapped transfer length "
+                                "pump_transfers: mapped transfer length of "
-                                "of %u is greater than %d\n",
+                                "%u is greater than %d\n",
                                transfer->len, MAX_DMA_LEN);
                        message->status = -EINVAL;
                        giveback(drv_data);
@@ -651,11 +660,10 @@ static void pump_transfers(unsigned long data)
                }
                /* warn ... we force this to PIO mode */
-                if (printk_ratelimit())
+                dev_warn_ratelimited(&message->spi->dev,
-                        dev_warn(&message->spi->dev, "pump_transfers: "
+                                     "pump_transfers: DMA disabled for transfer length %ld "
-                                "DMA disabled for transfer length %ld "
+                                     "greater than %d\n",
-                                "greater than %d\n",
+                                     (long)drv_data->len, MAX_DMA_LEN);
-                                (long)drv_data->len, MAX_DMA_LEN);
        }
        /* Setup the transfer state based on the type of transfer */
@@ -717,11 +725,8 @@ static void pump_transfers(unsigned long data)
                                                        message->spi,
                                                        bits, &dma_burst,
                                                        &dma_thresh))
-                                if (printk_ratelimit())
+                                dev_warn_ratelimited(&message->spi->dev,
-                                        dev_warn(&message->spi->dev,
+                                                     "pump_transfers: DMA burst size reduced to match bits_per_word\n");
-                                                "pump_transfers: "
-                                                "DMA burst size reduced to "
-                                                "match bits_per_word\n");
                }
                cr0 = clk_div
@@ -845,8 +850,8 @@ static int setup_cs(struct spi_device *spi, struct chip_data *chip,
        if (gpio_is_valid(chip_info->gpio_cs)) {
                err = gpio_request(chip_info->gpio_cs, "SPI_CS");
                if (err) {
-                        dev_err(&spi->dev, "failed to request chip select "
+                        dev_err(&spi->dev, "failed to request chip select GPIO%d\n",
-                                        "GPIO%d\n", chip_info->gpio_cs);
+                                chip_info->gpio_cs);
                        return err;
                }
@@ -890,8 +895,8 @@ static int setup(struct spi_device *spi)
                if (drv_data->ssp_type == CE4100_SSP) {
                        if (spi->chip_select > 4) {
-                                dev_err(&spi->dev, "failed setup: "
+                                dev_err(&spi->dev,
-                                "cs number must not be > 4.\n");
+                                        "failed setup: cs number must not be > 4.\n");
                                kfree(chip);
                                return -EINVAL;
                        }
@@ -947,8 +952,8 @@ static int setup(struct spi_device *spi)
                                                spi->bits_per_word,
                                                &chip->dma_burst_size,
                                                &chip->dma_threshold)) {
-                        dev_warn(&spi->dev, "in setup: DMA burst size reduced "
+                        dev_warn(&spi->dev,
-                                        "to match bits_per_word\n");
+                                 "in setup: DMA burst size reduced to match bits_per_word\n");
                }
        }
@@ -1196,7 +1201,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
        /* Register with the SPI framework */
        platform_set_drvdata(pdev, drv_data);
-        status = spi_register_master(master);
+        status = devm_spi_register_master(&pdev->dev, master);
        if (status != 0) {
                dev_err(&pdev->dev, "problem registering spi master\n");
                goto out_error_clock_enabled;
@@ -1248,9 +1253,6 @@ static int pxa2xx_spi_remove(struct platform_device *pdev)
        /* Release SSP */
        pxa_ssp_free(ssp);
-        /* Disconnect from the SPI framework */
-        spi_unregister_master(drv_data->master);
        return 0;
 }
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 8719206a03a0..58449ad4ad0d 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -59,6 +59,14 @@
 #define RSPI_SPCMD6             0x1c
 #define RSPI_SPCMD7             0x1e
+/*qspi only */
+#define QSPI_SPBFCR             0x18
+#define QSPI_SPBDCR             0x1a
+#define QSPI_SPBMUL0            0x1c
+#define QSPI_SPBMUL1            0x20
+#define QSPI_SPBMUL2            0x24
+#define QSPI_SPBMUL3            0x28
 /* SPCR */
 #define SPCR_SPRIE              0x80
 #define SPCR_SPE                0x40
@@ -126,6 +134,8 @@
 #define SPCMD_LSBF              0x1000
 #define SPCMD_SPB_MASK          0x0f00
 #define SPCMD_SPB_8_TO_16(bit)  (((bit - 1) << 8) & SPCMD_SPB_MASK)
+#define SPCMD_SPB_8BIT          0x0000  /* qspi only */
+#define SPCMD_SPB_16BIT         0x0100
 #define SPCMD_SPB_20BIT         0x0000
 #define SPCMD_SPB_24BIT         0x0100
 #define SPCMD_SPB_32BIT         0x0200
@@ -135,6 +145,10 @@
 #define SPCMD_CPOL              0x0002
 #define SPCMD_CPHA              0x0001
+/* SPBFCR */
+#define SPBFCR_TXRST            0x80    /* qspi only */
+#define SPBFCR_RXRST            0x40    /* qspi only */
 struct rspi_data {
        void __iomem *addr;
        u32 max_speed_hz;
@@ -145,6 +159,7 @@ struct rspi_data {
        spinlock_t lock;
        struct clk *clk;
        unsigned char spsr;
+        const struct spi_ops *ops;
        /* for dmaengine */
        struct dma_chan *chan_tx;
@@ -165,6 +180,11 @@ static void rspi_write16(struct rspi_data *rspi, u16 data, u16 offset)
        iowrite16(data, rspi->addr + offset);
 }
+static void rspi_write32(struct rspi_data *rspi, u32 data, u16 offset)
+{
+        iowrite32(data, rspi->addr + offset);
+}
 static u8 rspi_read8(struct rspi_data *rspi, u16 offset)
 {
        return ioread8(rspi->addr + offset);
@@ -175,17 +195,103 @@ static u16 rspi_read16(struct rspi_data *rspi, u16 offset)
        return ioread16(rspi->addr + offset);
 }
-static unsigned char rspi_calc_spbr(struct rspi_data *rspi)
+/* optional functions */
+struct spi_ops {
+        int (*set_config_register)(struct rspi_data *rspi, int access_size);
+        int (*send_pio)(struct rspi_data *rspi, struct spi_message *mesg,
+                        struct spi_transfer *t);
+        int (*receive_pio)(struct rspi_data *rspi, struct spi_message *mesg,
+                           struct spi_transfer *t);
+};
+/*
+ * functions for RSPI
+ */
+static int rspi_set_config_register(struct rspi_data *rspi, int access_size)
+{
+        int spbr;
+        /* Sets output mode(CMOS) and MOSI signal(from previous transfer) */
+        rspi_write8(rspi, 0x00, RSPI_SPPCR);
+        /* Sets transfer bit rate */
+        spbr = clk_get_rate(rspi->clk) / (2 * rspi->max_speed_hz) - 1;
+        rspi_write8(rspi, clamp(spbr, 0, 255), RSPI_SPBR);
+        /* Sets number of frames to be used: 1 frame */
+        rspi_write8(rspi, 0x00, RSPI_SPDCR);
+        /* Sets RSPCK, SSL, next-access delay value */
+        rspi_write8(rspi, 0x00, RSPI_SPCKD);
+        rspi_write8(rspi, 0x00, RSPI_SSLND);
+        rspi_write8(rspi, 0x00, RSPI_SPND);
+        /* Sets parity, interrupt mask */
+        rspi_write8(rspi, 0x00, RSPI_SPCR2);
+        /* Sets SPCMD */
+        rspi_write16(rspi, SPCMD_SPB_8_TO_16(access_size) | SPCMD_SSLKP,
+                     RSPI_SPCMD0);
+        /* Sets RSPI mode */
+        rspi_write8(rspi, SPCR_MSTR, RSPI_SPCR);
+        return 0;
+}
+/*
+ * functions for QSPI
+ */
+static int qspi_set_config_register(struct rspi_data *rspi, int access_size)
 {
-        int tmp;
+        u16 spcmd;
-        unsigned char spbr;
+        int spbr;
+        /* Sets output mode(CMOS) and MOSI signal(from previous transfer) */
+        rspi_write8(rspi, 0x00, RSPI_SPPCR);
+        /* Sets transfer bit rate */
+        spbr = clk_get_rate(rspi->clk) / (2 * rspi->max_speed_hz);
+        rspi_write8(rspi, clamp(spbr, 0, 255), RSPI_SPBR);
+        /* Sets number of frames to be used: 1 frame */
+        rspi_write8(rspi, 0x00, RSPI_SPDCR);
+        /* Sets RSPCK, SSL, next-access delay value */
+        rspi_write8(rspi, 0x00, RSPI_SPCKD);
+        rspi_write8(rspi, 0x00, RSPI_SSLND);
+        rspi_write8(rspi, 0x00, RSPI_SPND);
+        /* Data Length Setting */
+        if (access_size == 8)
+                spcmd = SPCMD_SPB_8BIT;
+        else if (access_size == 16)
+                spcmd = SPCMD_SPB_16BIT;
+        else if (access_size == 32)
+                spcmd = SPCMD_SPB_32BIT;
+        spcmd |= SPCMD_SCKDEN | SPCMD_SLNDEN | SPCMD_SSLKP | SPCMD_SPNDEN;
+        /* Resets transfer data length */
+        rspi_write32(rspi, 0, QSPI_SPBMUL0);
+        /* Resets transmit and receive buffer */
+        rspi_write8(rspi, SPBFCR_TXRST | SPBFCR_RXRST, QSPI_SPBFCR);
+        /* Sets buffer to allow normal operation */
+        rspi_write8(rspi, 0x00, QSPI_SPBFCR);
+        /* Sets SPCMD */
+        rspi_write16(rspi, spcmd, RSPI_SPCMD0);
-        tmp = clk_get_rate(rspi->clk) / (2 * rspi->max_speed_hz) - 1;
+        /* Enables SPI function in a master mode */
-        spbr = clamp(tmp, 0, 255);
+        rspi_write8(rspi, SPCR_SPE | SPCR_MSTR, RSPI_SPCR);
-        return spbr;
+        return 0;
 }
+#define set_config_register(spi, n) spi->ops->set_config_register(spi, n)
 static void rspi_enable_irq(struct rspi_data *rspi, u8 enable)
 {
        rspi_write8(rspi, rspi_read8(rspi, RSPI_SPCR) | enable, RSPI_SPCR);
@@ -220,54 +326,60 @@ static void rspi_negate_ssl(struct rspi_data *rspi)
        rspi_write8(rspi, rspi_read8(rspi, RSPI_SPCR) & ~SPCR_SPE, RSPI_SPCR);
 }
-static int rspi_set_config_register(struct rspi_data *rspi, int access_size)
+static int rspi_send_pio(struct rspi_data *rspi, struct spi_message *mesg,
+                         struct spi_transfer *t)
 {
-        /* Sets output mode(CMOS) and MOSI signal(from previous transfer) */
+        int remain = t->len;
-        rspi_write8(rspi, 0x00, RSPI_SPPCR);
+        u8 *data;
-        /* Sets transfer bit rate */
-        rspi_write8(rspi, rspi_calc_spbr(rspi), RSPI_SPBR);
-        /* Sets number of frames to be used: 1 frame */
-        rspi_write8(rspi, 0x00, RSPI_SPDCR);
-        /* Sets RSPCK, SSL, next-access delay value */
+        data = (u8 *)t->tx_buf;
-        rspi_write8(rspi, 0x00, RSPI_SPCKD);
+        while (remain > 0) {
-        rspi_write8(rspi, 0x00, RSPI_SSLND);
+                rspi_write8(rspi, rspi_read8(rspi, RSPI_SPCR) | SPCR_TXMD,
-        rspi_write8(rspi, 0x00, RSPI_SPND);
+                            RSPI_SPCR);
-        /* Sets parity, interrupt mask */
+                if (rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE) < 0) {
-        rspi_write8(rspi, 0x00, RSPI_SPCR2);
+                        dev_err(&rspi->master->dev,
+                                "%s: tx empty timeout\n", __func__);
+                        return -ETIMEDOUT;
+                }
-        /* Sets SPCMD */
+                rspi_write16(rspi, *data, RSPI_SPDR);
-        rspi_write16(rspi, SPCMD_SPB_8_TO_16(access_size) | SPCMD_SSLKP,
+                data++;
-                     RSPI_SPCMD0);
+                remain--;
+        }
-        /* Sets RSPI mode */
+        /* Waiting for the last transmition */
-        rspi_write8(rspi, SPCR_MSTR, RSPI_SPCR);
+        rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE);
        return 0;
 }
-static int rspi_send_pio(struct rspi_data *rspi, struct spi_message *mesg,
+static int qspi_send_pio(struct rspi_data *rspi, struct spi_message *mesg,
                         struct spi_transfer *t)
 {
        int remain = t->len;
        u8 *data;
+        rspi_write8(rspi, SPBFCR_TXRST, QSPI_SPBFCR);
+        rspi_write8(rspi, 0x00, QSPI_SPBFCR);
        data = (u8 *)t->tx_buf;
        while (remain > 0) {
-                rspi_write8(rspi, rspi_read8(rspi, RSPI_SPCR) | SPCR_TXMD,
-                            RSPI_SPCR);
                if (rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE) < 0) {
                        dev_err(&rspi->master->dev,
                                "%s: tx empty timeout\n", __func__);
                        return -ETIMEDOUT;
                }
+                rspi_write8(rspi, *data++, RSPI_SPDR);
+                if (rspi_wait_for_interrupt(rspi, SPSR_SPRF, SPCR_SPRIE) < 0) {
+                        dev_err(&rspi->master->dev,
+                                "%s: receive timeout\n", __func__);
+                        return -ETIMEDOUT;
+                }
+                rspi_read8(rspi, RSPI_SPDR);
-                rspi_write16(rspi, *data, RSPI_SPDR);
-                data++;
                remain--;
        }
@@ -277,6 +389,8 @@ static int rspi_send_pio(struct rspi_data *rspi, struct spi_message *mesg,
        return 0;
 }
+#define send_pio(spi, mesg, t) spi->ops->send_pio(spi, mesg, t)
 static void rspi_dma_complete(void *arg)
 {
        struct rspi_data *rspi = arg;
@@ -442,6 +556,51 @@ static int rspi_receive_pio(struct rspi_data *rspi, struct spi_message *mesg,
        return 0;
 }
+static void qspi_receive_init(struct rspi_data *rspi)
+{
+        unsigned char spsr;
+        spsr = rspi_read8(rspi, RSPI_SPSR);
+        if (spsr & SPSR_SPRF)
+                rspi_read8(rspi, RSPI_SPDR);   /* dummy read */
+        rspi_write8(rspi, SPBFCR_TXRST | SPBFCR_RXRST, QSPI_SPBFCR);
+        rspi_write8(rspi, 0x00, QSPI_SPBFCR);
+}
+static int qspi_receive_pio(struct rspi_data *rspi, struct spi_message *mesg,
+                            struct spi_transfer *t)
+{
+        int remain = t->len;
+        u8 *data;
+        qspi_receive_init(rspi);
+        data = (u8 *)t->rx_buf;
+        while (remain > 0) {
+                if (rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE) < 0) {
+                        dev_err(&rspi->master->dev,
+                                "%s: tx empty timeout\n", __func__);
+                        return -ETIMEDOUT;
+                }
+                /* dummy write for generate clock */
+                rspi_write8(rspi, 0x00, RSPI_SPDR);
+                if (rspi_wait_for_interrupt(rspi, SPSR_SPRF, SPCR_SPRIE) < 0) {
+                        dev_err(&rspi->master->dev,
+                                "%s: receive timeout\n", __func__);
+                        return -ETIMEDOUT;
+                }
+                /* SPDR allows 8, 16 or 32-bit access */
+                *data++ = rspi_read8(rspi, RSPI_SPDR);
+                remain--;
+        }
+        return 0;
+}
+#define receive_pio(spi, mesg, t) spi->ops->receive_pio(spi, mesg, t)
 static int rspi_receive_dma(struct rspi_data *rspi, struct spi_transfer *t)
 {
        struct scatterlist sg, sg_dummy;
@@ -581,7 +740,7 @@ static void rspi_work(struct work_struct *work)
                                if (rspi_is_dma(rspi, t))
                                        ret = rspi_send_dma(rspi, t);
                                else
-                                        ret = rspi_send_pio(rspi, mesg, t);
+                                        ret = send_pio(rspi, mesg, t);
                                if (ret < 0)
                                        goto error;
                        }
@@ -589,7 +748,7 @@ static void rspi_work(struct work_struct *work)
                                if (rspi_is_dma(rspi, t))
                                        ret = rspi_receive_dma(rspi, t);
                                else
-                                        ret = rspi_receive_pio(rspi, mesg, t);
+                                        ret = receive_pio(rspi, mesg, t);
                                if (ret < 0)
                                        goto error;
                        }
@@ -616,7 +775,7 @@ static int rspi_setup(struct spi_device *spi)
                spi->bits_per_word = 8;
        rspi->max_speed_hz = spi->max_speed_hz;
-        rspi_set_config_register(rspi, 8);
+        set_config_register(rspi, 8);
        return 0;
 }
@@ -745,7 +904,16 @@ static int rspi_probe(struct platform_device *pdev)
        struct rspi_data *rspi;
        int ret, irq;
        char clk_name[16];
+        struct rspi_plat_data *rspi_pd = pdev->dev.platform_data;
+        const struct spi_ops *ops;
+        const struct platform_device_id *id_entry = pdev->id_entry;
+        ops = (struct spi_ops *)id_entry->driver_data;
+        /* ops parameter check */
+        if (!ops->set_config_register) {
+                dev_err(&pdev->dev, "there is no set_config_register\n");
+                return -ENODEV;
+        }
        /* get base addr */
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (unlikely(res == NULL)) {
@@ -767,7 +935,7 @@ static int rspi_probe(struct platform_device *pdev)
        rspi = spi_master_get_devdata(master);
        platform_set_drvdata(pdev, rspi);
+        rspi->ops = ops;
        rspi->master = master;
        rspi->addr = ioremap(res->start, resource_size(res));
        if (rspi->addr == NULL) {
@@ -776,7 +944,7 @@ static int rspi_probe(struct platform_device *pdev)
                goto error1;
        }
-        snprintf(clk_name, sizeof(clk_name), "rspi%d", pdev->id);
+        snprintf(clk_name, sizeof(clk_name), "%s%d", id_entry->name, pdev->id);
        rspi->clk = clk_get(&pdev->dev, clk_name);
        if (IS_ERR(rspi->clk)) {
                dev_err(&pdev->dev, "cannot get clock\n");
@@ -790,7 +958,10 @@ static int rspi_probe(struct platform_device *pdev)
        INIT_WORK(&rspi->ws, rspi_work);
        init_waitqueue_head(&rspi->wait);
-        master->num_chipselect = 2;
+        master->num_chipselect = rspi_pd->num_chipselect;
+        if (!master->num_chipselect)
+                master->num_chipselect = 2; /* default */
        master->bus_num = pdev->id;
        master->setup = rspi_setup;
        master->transfer = rspi_transfer;
@@ -832,11 +1003,32 @@ error1:
        return ret;
 }
+static struct spi_ops rspi_ops = {
+        .set_config_register =          rspi_set_config_register,
+        .send_pio =                     rspi_send_pio,
+        .receive_pio =                  rspi_receive_pio,
+};
+static struct spi_ops qspi_ops = {
+        .set_config_register =          qspi_set_config_register,
+        .send_pio =                     qspi_send_pio,
+        .receive_pio =                  qspi_receive_pio,
+};
+static struct platform_device_id spi_driver_ids[] = {
+        { "rspi",       (kernel_ulong_t)&rspi_ops },
+        { "qspi",       (kernel_ulong_t)&qspi_ops },
+        {},
+};
+MODULE_DEVICE_TABLE(platform, spi_driver_ids);
 static struct platform_driver rspi_driver = {
        .probe =        rspi_probe,
        .remove =       rspi_remove,
+        .id_table =     spi_driver_ids,
        .driver         = {
-                .name = "rspi",
+                .name = "renesas_spi",
                .owner  = THIS_MODULE,
        },
 };
diff --git a/drivers/spi/spi-s3c24xx.c b/drivers/spi/spi-s3c24xx.c
index ce318d95a6ee..0dc32a11bd3c 100644
--- a/drivers/spi/spi-s3c24xx.c
+++ b/drivers/spi/spi-s3c24xx.c
@@ -280,7 +280,7 @@ static inline u32 ack_bit(unsigned int irq)
 * so the caller does not need to do anything more than start the transfer
 * as normal, since the IRQ will have been re-routed to the FIQ handler.
 */
-void s3c24xx_spi_tryfiq(struct s3c24xx_spi *hw)
+static void s3c24xx_spi_tryfiq(struct s3c24xx_spi *hw)
 {
        struct pt_regs regs;
        enum spi_fiq_mode mode;
@@ -524,7 +524,7 @@ static int s3c24xx_spi_probe(struct platform_device *pdev)
        hw = spi_master_get_devdata(master);
        memset(hw, 0, sizeof(struct s3c24xx_spi));
-        hw->master = spi_master_get(master);
+        hw->master = master;
        hw->pdata = pdata = dev_get_platdata(&pdev->dev);
        hw->dev = &pdev->dev;
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index 512b8893893b..9e2020df9e0f 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -205,7 +205,6 @@ struct s3c64xx_spi_driver_data {
 #endif
        struct s3c64xx_spi_port_config  *port_conf;
        unsigned int                    port_id;
-        unsigned long                   gpios[4];
        bool                            cs_gpio;
 };
@@ -559,25 +558,18 @@ static void enable_datapath(struct s3c64xx_spi_driver_data *sdd,
 static inline void enable_cs(struct s3c64xx_spi_driver_data *sdd,
                                                struct spi_device *spi)
 {
-        struct s3c64xx_spi_csinfo *cs;
        if (sdd->tgl_spi != NULL) { /* If last device toggled after mssg */
                if (sdd->tgl_spi != spi) { /* if last mssg on diff device */
                        /* Deselect the last toggled device */
-                        cs = sdd->tgl_spi->controller_data;
+                        if (spi->cs_gpio >= 0)
-                        if (sdd->cs_gpio)
+                                gpio_set_value(spi->cs_gpio,
-                                gpio_set_value(cs->line,
                                        spi->mode & SPI_CS_HIGH ? 0 : 1);
                }
                sdd->tgl_spi = NULL;
        }
-        cs = spi->controller_data;
+        if (spi->cs_gpio >= 0)
-        if (sdd->cs_gpio)
+                gpio_set_value(spi->cs_gpio, spi->mode & SPI_CS_HIGH ? 1 : 0);
-                gpio_set_value(cs->line, spi->mode & SPI_CS_HIGH ? 1 : 0);
-        /* Start the signals */
-        writel(0, sdd->regs + S3C64XX_SPI_SLAVE_SEL);
 }
 static u32 s3c64xx_spi_wait_for_timeout(struct s3c64xx_spi_driver_data *sdd,
@@ -702,16 +694,11 @@ static int wait_for_xfer(struct s3c64xx_spi_driver_data *sdd,
 static inline void disable_cs(struct s3c64xx_spi_driver_data *sdd,
                                                struct spi_device *spi)
 {
-        struct s3c64xx_spi_csinfo *cs = spi->controller_data;
        if (sdd->tgl_spi == spi)
                sdd->tgl_spi = NULL;
-        if (sdd->cs_gpio)
+        if (spi->cs_gpio >= 0)
-                gpio_set_value(cs->line, spi->mode & SPI_CS_HIGH ? 0 : 1);
+                gpio_set_value(spi->cs_gpio, spi->mode & SPI_CS_HIGH ? 0 : 1);
-        /* Quiese the signals */
-        writel(S3C64XX_SPI_SLAVE_SIG_INACT, sdd->regs + S3C64XX_SPI_SLAVE_SEL);
 }
 static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
@@ -862,16 +849,12 @@ static void s3c64xx_spi_unmap_mssg(struct s3c64xx_spi_driver_data *sdd,
        }
 }
-static int s3c64xx_spi_transfer_one_message(struct spi_master *master,
+static int s3c64xx_spi_prepare_message(struct spi_master *master,
-                                            struct spi_message *msg)
+                                       struct spi_message *msg)
 {
        struct s3c64xx_spi_driver_data *sdd = spi_master_get_devdata(master);
        struct spi_device *spi = msg->spi;
        struct s3c64xx_spi_csinfo *cs = spi->controller_data;
-        struct spi_transfer *xfer;
-        int status = 0, cs_toggle = 0;
-        u32 speed;
-        u8 bpw;
        /* If Master's(controller) state differs from that needed by Slave */
        if (sdd->cur_speed != spi->max_speed_hz
@@ -887,106 +870,98 @@ static int s3c64xx_spi_transfer_one_message(struct spi_master *master,
        if (s3c64xx_spi_map_mssg(sdd, msg)) {
                dev_err(&spi->dev,
                        "Xfer: Unable to map message buffers!\n");
-                status = -ENOMEM;
+                return -ENOMEM;
-                goto out;
        }
        /* Configure feedback delay */
        writel(cs->fb_delay & 0x3, sdd->regs + S3C64XX_SPI_FB_CLK);
-        list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+        return 0;
+}
-                unsigned long flags;
-                int use_dma;
-                INIT_COMPLETION(sdd->xfer_completion);
-                /* Only BPW and Speed may change across transfers */
-                bpw = xfer->bits_per_word;
-                speed = xfer->speed_hz ? : spi->max_speed_hz;
-                if (xfer->len % (bpw / 8)) {
-                        dev_err(&spi->dev,
-                                "Xfer length(%u) not a multiple of word size(%u)\n",
-                                xfer->len, bpw / 8);
-                        status = -EIO;
-                        goto out;
-                }
-                if (bpw != sdd->cur_bpw || speed != sdd->cur_speed) {
+static int s3c64xx_spi_transfer_one(struct spi_master *master,
-                        sdd->cur_bpw = bpw;
+                                    struct spi_device *spi,
-                        sdd->cur_speed = speed;
+                                    struct spi_transfer *xfer)
-                        s3c64xx_spi_config(sdd);
+{
-                }
+        struct s3c64xx_spi_driver_data *sdd = spi_master_get_devdata(master);
+        int status;
+        u32 speed;
+        u8 bpw;
+        unsigned long flags;
+        int use_dma;
-                /* Polling method for xfers not bigger than FIFO capacity */
+        INIT_COMPLETION(sdd->xfer_completion);
-                use_dma = 0;
-                if (!is_polling(sdd) &&
-                        (sdd->rx_dma.ch && sdd->tx_dma.ch &&
-                        (xfer->len > ((FIFO_LVL_MASK(sdd) >> 1) + 1))))
-                        use_dma = 1;
-                spin_lock_irqsave(&sdd->lock, flags);
+        /* Only BPW and Speed may change across transfers */
+        bpw = xfer->bits_per_word;
+        speed = xfer->speed_hz ? : spi->max_speed_hz;
-                /* Pending only which is to be done */
+        if (xfer->len % (bpw / 8)) {
-                sdd->state &= ~RXBUSY;
+                dev_err(&spi->dev,
-                sdd->state &= ~TXBUSY;
+                        "Xfer length(%u) not a multiple of word size(%u)\n",
+                        xfer->len, bpw / 8);
+                return -EIO;
+        }
-                enable_datapath(sdd, spi, xfer, use_dma);
+        if (bpw != sdd->cur_bpw || speed != sdd->cur_speed) {
+                sdd->cur_bpw = bpw;
+                sdd->cur_speed = speed;
+                s3c64xx_spi_config(sdd);
+        }
-                /* Slave Select */
+        /* Polling method for xfers not bigger than FIFO capacity */
-                enable_cs(sdd, spi);
+        use_dma = 0;
+        if (!is_polling(sdd) &&
+            (sdd->rx_dma.ch && sdd->tx_dma.ch &&
+             (xfer->len > ((FIFO_LVL_MASK(sdd) >> 1) + 1))))
+                use_dma = 1;
-                spin_unlock_irqrestore(&sdd->lock, flags);
+        spin_lock_irqsave(&sdd->lock, flags);
-                status = wait_for_xfer(sdd, xfer, use_dma);
+        /* Pending only which is to be done */
+        sdd->state &= ~RXBUSY;
+        sdd->state &= ~TXBUSY;
-                if (status) {
+        enable_datapath(sdd, spi, xfer, use_dma);
-                        dev_err(&spi->dev, "I/O Error: rx-%d tx-%d res:rx-%c tx-%c len-%d\n",
-                                xfer->rx_buf ? 1 : 0, xfer->tx_buf ? 1 : 0,
-                                (sdd->state & RXBUSY) ? 'f' : 'p',
-                                (sdd->state & TXBUSY) ? 'f' : 'p',
-                                xfer->len);
-                        if (use_dma) {
+        /* Start the signals */
-                                if (xfer->tx_buf != NULL
+        writel(0, sdd->regs + S3C64XX_SPI_SLAVE_SEL);
-                                                && (sdd->state & TXBUSY))
-                                        s3c64xx_spi_dma_stop(sdd, &sdd->tx_dma);
-                                if (xfer->rx_buf != NULL
-                                                && (sdd->state & RXBUSY))
-                                        s3c64xx_spi_dma_stop(sdd, &sdd->rx_dma);
-                        }
-                        goto out;
+        /* Start the signals */
-                }
+        writel(0, sdd->regs + S3C64XX_SPI_SLAVE_SEL);
-                if (xfer->delay_usecs)
+        spin_unlock_irqrestore(&sdd->lock, flags);
-                        udelay(xfer->delay_usecs);
-                if (xfer->cs_change) {
+        status = wait_for_xfer(sdd, xfer, use_dma);
-                        /* Hint that the next mssg is gonna be
-                           for the same device */
+        if (status) {
-                        if (list_is_last(&xfer->transfer_list,
+                dev_err(&spi->dev, "I/O Error: rx-%d tx-%d res:rx-%c tx-%c len-%d\n",
-                                                &msg->transfers))
+                        xfer->rx_buf ? 1 : 0, xfer->tx_buf ? 1 : 0,
-                                cs_toggle = 1;
+                        (sdd->state & RXBUSY) ? 'f' : 'p',
+                        (sdd->state & TXBUSY) ? 'f' : 'p',
+                        xfer->len);
+                if (use_dma) {
+                        if (xfer->tx_buf != NULL
+                            && (sdd->state & TXBUSY))
+                                s3c64xx_spi_dma_stop(sdd, &sdd->tx_dma);
+                        if (xfer->rx_buf != NULL
+                            && (sdd->state & RXBUSY))
+                                s3c64xx_spi_dma_stop(sdd, &sdd->rx_dma);
                }
+        } else {
-                msg->actual_length += xfer->len;
                flush_fifo(sdd);
        }
-out:
+        return status;
-        if (!cs_toggle || status)
+}
-                disable_cs(sdd, spi);
-        else
-                sdd->tgl_spi = spi;
-        s3c64xx_spi_unmap_mssg(sdd, msg);
-        msg->status = status;
+static int s3c64xx_spi_unprepare_message(struct spi_master *master,
+                                            struct spi_message *msg)
+{
+        struct s3c64xx_spi_driver_data *sdd = spi_master_get_devdata(master);
-        spi_finalize_current_message(master);
+        s3c64xx_spi_unmap_mssg(sdd, msg);
        return 0;
 }
@@ -1071,6 +1046,8 @@ static int s3c64xx_spi_setup(struct spi_device *spi)
                                        cs->line, err);
                                goto err_gpio_req;
                        }
+                        spi->cs_gpio = cs->line;
                }
                spi_set_ctldata(spi, cs);
@@ -1117,11 +1094,14 @@ static int s3c64xx_spi_setup(struct spi_device *spi)
        }
        pm_runtime_put(&sdd->pdev->dev);
+        writel(S3C64XX_SPI_SLAVE_SIG_INACT, sdd->regs + S3C64XX_SPI_SLAVE_SEL);
        disable_cs(sdd, spi);
        return 0;
 setup_exit:
+        pm_runtime_put(&sdd->pdev->dev);
        /* setup() returns with device de-selected */
+        writel(S3C64XX_SPI_SLAVE_SIG_INACT, sdd->regs + S3C64XX_SPI_SLAVE_SEL);
        disable_cs(sdd, spi);
        gpio_free(cs->line);
@@ -1140,8 +1120,8 @@ static void s3c64xx_spi_cleanup(struct spi_device *spi)
        struct s3c64xx_spi_driver_data *sdd;
        sdd = spi_master_get_devdata(spi->master);
-        if (cs && sdd->cs_gpio) {
+        if (spi->cs_gpio) {
-                gpio_free(cs->line);
+                gpio_free(spi->cs_gpio);
                if (spi->dev.of_node)
                        kfree(cs);
        }
@@ -1359,7 +1339,9 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
        master->setup = s3c64xx_spi_setup;
        master->cleanup = s3c64xx_spi_cleanup;
        master->prepare_transfer_hardware = s3c64xx_spi_prepare_transfer;
-        master->transfer_one_message = s3c64xx_spi_transfer_one_message;
+        master->prepare_message = s3c64xx_spi_prepare_message;
+        master->transfer_one = s3c64xx_spi_transfer_one;
+        master->unprepare_message = s3c64xx_spi_unprepare_message;
        master->unprepare_transfer_hardware = s3c64xx_spi_unprepare_transfer;
        master->num_chipselect = sci->num_cs;
        master->dma_alignment = 8;
@@ -1428,9 +1410,12 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
               S3C64XX_SPI_INT_TX_OVERRUN_EN | S3C64XX_SPI_INT_TX_UNDERRUN_EN,
               sdd->regs + S3C64XX_SPI_INT_EN);
-        if (spi_register_master(master)) {
+        pm_runtime_set_active(&pdev->dev);
-                dev_err(&pdev->dev, "cannot register SPI master\n");
+        pm_runtime_enable(&pdev->dev);
-                ret = -EBUSY;
+        ret = devm_spi_register_master(&pdev->dev, master);
+        if (ret != 0) {
+                dev_err(&pdev->dev, "cannot register SPI master: %d\n", ret);
                goto err3;
        }
@@ -1440,8 +1425,6 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
                                        mem_res,
                                        sdd->rx_dma.dmach, sdd->tx_dma.dmach);
-        pm_runtime_enable(&pdev->dev);
        return 0;
 err3:
@@ -1461,16 +1444,12 @@ static int s3c64xx_spi_remove(struct platform_device *pdev)
        pm_runtime_disable(&pdev->dev);
-        spi_unregister_master(master);
        writel(0, sdd->regs + S3C64XX_SPI_INT_EN);
        clk_disable_unprepare(sdd->src_clk);
        clk_disable_unprepare(sdd->clk);
-        spi_master_put(master);
        return 0;
 }
@@ -1480,11 +1459,14 @@ static int s3c64xx_spi_suspend(struct device *dev)
        struct spi_master *master = dev_get_drvdata(dev);
        struct s3c64xx_spi_driver_data *sdd = spi_master_get_devdata(master);
-        spi_master_suspend(master);
+        int ret = spi_master_suspend(master);
+        if (ret)
+                return ret;
-        /* Disable the clock */
+        if (!pm_runtime_suspended(dev)) {
-        clk_disable_unprepare(sdd->src_clk);
+                clk_disable_unprepare(sdd->clk);
-        clk_disable_unprepare(sdd->clk);
+                clk_disable_unprepare(sdd->src_clk);
+        }
        sdd->cur_speed = 0; /* Output Clock is stopped */
@@ -1500,15 +1482,14 @@ static int s3c64xx_spi_resume(struct device *dev)
        if (sci->cfg_gpio)
                sci->cfg_gpio();
-        /* Enable the clock */
+        if (!pm_runtime_suspended(dev)) {
-        clk_prepare_enable(sdd->src_clk);
+                clk_prepare_enable(sdd->src_clk);
-        clk_prepare_enable(sdd->clk);
+                clk_prepare_enable(sdd->clk);
+        }
        s3c64xx_spi_hwinit(sdd, sdd->port_id);
-        spi_master_resume(master);
+        return spi_master_resume(master);
-        return 0;
 }
 #endif /* CONFIG_PM_SLEEP */
@@ -1528,9 +1509,17 @@ static int s3c64xx_spi_runtime_resume(struct device *dev)
 {
        struct spi_master *master = dev_get_drvdata(dev);
        struct s3c64xx_spi_driver_data *sdd = spi_master_get_devdata(master);
+        int ret;
-        clk_prepare_enable(sdd->src_clk);
+        ret = clk_prepare_enable(sdd->src_clk);
-        clk_prepare_enable(sdd->clk);
+        if (ret != 0)
+                return ret;
+        ret = clk_prepare_enable(sdd->clk);
+        if (ret != 0) {
+                clk_disable_unprepare(sdd->src_clk);
+                return ret;
+        }
        return 0;
 }
@@ -1616,6 +1605,18 @@ static struct platform_device_id s3c64xx_spi_driver_ids[] = {
 };
 static const struct of_device_id s3c64xx_spi_dt_match[] = {
+        { .compatible = "samsung,s3c2443-spi",
+                        .data = (void *)&s3c2443_spi_port_config,
+        },
+        { .compatible = "samsung,s3c6410-spi",
+                        .data = (void *)&s3c6410_spi_port_config,
+        },
+        { .compatible = "samsung,s5pc100-spi",
+                        .data = (void *)&s5pc100_spi_port_config,
+        },
+        { .compatible = "samsung,s5pv210-spi",
+                        .data = (void *)&s5pv210_spi_port_config,
+        },
        { .compatible = "samsung,exynos4210-spi",
                        .data = (void *)&exynos4_spi_port_config,
        },
@@ -1633,22 +1634,13 @@ static struct platform_driver s3c64xx_spi_driver = {
                .pm = &s3c64xx_spi_pm,
                .of_match_table = of_match_ptr(s3c64xx_spi_dt_match),
        },
+        .probe = s3c64xx_spi_probe,
        .remove = s3c64xx_spi_remove,
        .id_table = s3c64xx_spi_driver_ids,
 };
 MODULE_ALIAS("platform:s3c64xx-spi");
-static int __init s3c64xx_spi_init(void)
+module_platform_driver(s3c64xx_spi_driver);
-{
-        return platform_driver_probe(&s3c64xx_spi_driver, s3c64xx_spi_probe);
-}
-subsys_initcall(s3c64xx_spi_init);
-static void __exit s3c64xx_spi_exit(void)
-{
-        platform_driver_unregister(&s3c64xx_spi_driver);
-}
-module_exit(s3c64xx_spi_exit);
 MODULE_AUTHOR("Jaswinder Singh <jassi.brar@samsung.com>");
 MODULE_DESCRIPTION("S3C64XX SPI Controller Driver");
diff --git a/drivers/spi/spi-sh-hspi.c b/drivers/spi/spi-sh-hspi.c
index 0b68cb592fa4..292567ab4c6c 100644
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -137,7 +137,7 @@ static void hspi_hw_setup(struct hspi_priv *hspi,
                        rate /= 16;
                /* CLKCx calculation */
-                rate /= (((idiv_clk & 0x1F) + 1) * 2) ;
+                rate /= (((idiv_clk & 0x1F) + 1) * 2);
                /* save best settings */
                tmp = abs(target_rate - rate);
@@ -296,21 +296,22 @@ static int hspi_probe(struct platform_device *pdev)
                goto error1;
        }
+        pm_runtime_enable(&pdev->dev);
        master->num_chipselect  = 1;
        master->bus_num         = pdev->id;
        master->setup           = hspi_setup;
        master->cleanup         = hspi_cleanup;
        master->mode_bits       = SPI_CPOL | SPI_CPHA;
+        master->dev.of_node     = pdev->dev.of_node;
        master->auto_runtime_pm = true;
        master->transfer_one_message            = hspi_transfer_one_message;
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(&pdev->dev, master);
        if (ret < 0) {
                dev_err(&pdev->dev, "spi_register_master error.\n");
                goto error1;
        }
-        pm_runtime_enable(&pdev->dev);
        return 0;
 error1:
@@ -328,17 +329,23 @@ static int hspi_remove(struct platform_device *pdev)
        pm_runtime_disable(&pdev->dev);
        clk_put(hspi->clk);
-        spi_unregister_master(hspi->master);
        return 0;
 }
+static struct of_device_id hspi_of_match[] = {
+        { .compatible = "renesas,hspi", },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, hspi_of_match);
 static struct platform_driver hspi_driver = {
        .probe = hspi_probe,
        .remove = hspi_remove,
        .driver = {
                .name = "sh-hspi",
                .owner = THIS_MODULE,
+                .of_match_table = hspi_of_match,
        },
 };
 module_platform_driver(hspi_driver);
diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
index 8eefeb6007df..38eb24df796c 100644
--- a/drivers/spi/spi-sh-sci.c
+++ b/drivers/spi/spi-sh-sci.c
@@ -133,7 +133,7 @@ static int sh_sci_spi_probe(struct platform_device *dev)
        sp->info = dev_get_platdata(&dev->dev);
        /* setup spi bitbang adaptor */
-        sp->bitbang.master = spi_master_get(master);
+        sp->bitbang.master = master;
        sp->bitbang.master->bus_num = sp->info->bus_num;
        sp->bitbang.master->num_chipselect = sp->info->num_chipselect;
        sp->bitbang.chipselect = sh_sci_spi_chipselect;
diff --git a/drivers/spi/spi-sirf.c b/drivers/spi/spi-sirf.c
index a1f21b747733..592b4aff651f 100644
--- a/drivers/spi/spi-sirf.c
+++ b/drivers/spi/spi-sirf.c
@@ -632,7 +632,7 @@ static int spi_sirfsoc_probe(struct platform_device *pdev)
        if (ret)
                goto free_master;
-        sspi->bitbang.master = spi_master_get(master);
+        sspi->bitbang.master = master;
        sspi->bitbang.chipselect = spi_sirfsoc_chipselect;
        sspi->bitbang.setup_transfer = spi_sirfsoc_setup_transfer;
        sspi->bitbang.txrx_bufs = spi_sirfsoc_transfer;
diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 946ff7377352..b3821fb9da3f 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -1115,7 +1115,7 @@ static int tegra_spi_probe(struct platform_device *pdev)
        pm_runtime_put(&pdev->dev);
        master->dev.of_node = pdev->dev.of_node;
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(&pdev->dev, master);
        if (ret < 0) {
                dev_err(&pdev->dev, "can not register to master err %d\n", ret);
                goto exit_pm_disable;
@@ -1142,7 +1142,6 @@ static int tegra_spi_remove(struct platform_device *pdev)
        struct tegra_spi_data   *tspi = spi_master_get_devdata(master);
        free_irq(tspi->irq, tspi);
-        spi_unregister_master(master);
        if (tspi->tx_dma_chan)
                tegra_spi_deinit_dma_param(tspi, false);
diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
index 64c9cf511175..79be8ce6a9d1 100644
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -529,7 +529,7 @@ static int tegra_sflash_probe(struct platform_device *pdev)
        pm_runtime_put(&pdev->dev);
        master->dev.of_node = pdev->dev.of_node;
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(&pdev->dev, master);
        if (ret < 0) {
                dev_err(&pdev->dev, "can not register to master err %d\n", ret);
                goto exit_pm_disable;
@@ -553,7 +553,6 @@ static int tegra_sflash_remove(struct platform_device *pdev)
        struct tegra_sflash_data        *tsd = spi_master_get_devdata(master);
        free_irq(tsd->irq, tsd);
-        spi_unregister_master(master);
        pm_runtime_disable(&pdev->dev);
        if (!pm_runtime_status_suspended(&pdev->dev))
diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index 231b84523d37..c74ee87b243b 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -1164,7 +1164,7 @@ static int tegra_slink_probe(struct platform_device *pdev)
        pm_runtime_put(&pdev->dev);
        master->dev.of_node = pdev->dev.of_node;
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(&pdev->dev, master);
        if (ret < 0) {
                dev_err(&pdev->dev, "can not register to master err %d\n", ret);
                goto exit_pm_disable;
@@ -1191,7 +1191,6 @@ static int tegra_slink_remove(struct platform_device *pdev)
        struct tegra_slink_data *tspi = spi_master_get_devdata(master);
        free_irq(tspi->irq, tspi);
-        spi_unregister_master(master);
        if (tspi->tx_dma_chan)
                tegra_slink_deinit_dma_param(tspi, false);
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index e12d962a289f..0b71270fbf67 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -41,9 +41,6 @@ struct ti_qspi_regs {
 struct ti_qspi {
        struct completion       transfer_complete;
-        /* IRQ synchronization */
-        spinlock_t              lock;
        /* list synchronization */
        struct mutex            list_lock;
@@ -57,7 +54,6 @@ struct ti_qspi {
        u32 spi_max_frequency;
        u32 cmd;
        u32 dc;
-        u32 stat;
 };
 #define QSPI_PID                        (0x0)
@@ -397,13 +393,12 @@ static irqreturn_t ti_qspi_isr(int irq, void *dev_id)
 {
        struct ti_qspi *qspi = dev_id;
        u16 int_stat;
+        u32 stat;
        irqreturn_t ret = IRQ_HANDLED;
-        spin_lock(&qspi->lock);
        int_stat = ti_qspi_read(qspi, QSPI_INTR_STATUS_ENABLED_CLEAR);
-        qspi->stat = ti_qspi_read(qspi, QSPI_SPI_STATUS_REG);
+        stat = ti_qspi_read(qspi, QSPI_SPI_STATUS_REG);
        if (!int_stat) {
                dev_dbg(qspi->dev, "No IRQ triggered\n");
@@ -411,35 +406,14 @@ static irqreturn_t ti_qspi_isr(int irq, void *dev_id)
                goto out;
        }
-        ret = IRQ_WAKE_THREAD;
-        ti_qspi_write(qspi, QSPI_WC_INT_DISABLE, QSPI_INTR_ENABLE_CLEAR_REG);
        ti_qspi_write(qspi, QSPI_WC_INT_DISABLE,
                                QSPI_INTR_STATUS_ENABLED_CLEAR);
+        if (stat & WC)
+                complete(&qspi->transfer_complete);
 out:
-        spin_unlock(&qspi->lock);
        return ret;
 }
-static irqreturn_t ti_qspi_threaded_isr(int this_irq, void *dev_id)
-{
-        struct ti_qspi *qspi = dev_id;
-        unsigned long flags;
-        spin_lock_irqsave(&qspi->lock, flags);
-        if (qspi->stat & WC)
-                complete(&qspi->transfer_complete);
-        spin_unlock_irqrestore(&qspi->lock, flags);
-        ti_qspi_write(qspi, QSPI_WC_INT_EN, QSPI_INTR_ENABLE_SET_REG);
-        return IRQ_HANDLED;
-}
 static int ti_qspi_runtime_resume(struct device *dev)
 {
        struct ti_qspi      *qspi;
@@ -472,7 +446,7 @@ static int ti_qspi_probe(struct platform_device *pdev)
        if (!master)
                return -ENOMEM;
-        master->mode_bits = SPI_CPOL | SPI_CPHA;
+        master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_RX_DUAL | SPI_RX_QUAD;
        master->bus_num = -1;
        master->flags = SPI_MASTER_HALF_DUPLEX;
@@ -499,7 +473,6 @@ static int ti_qspi_probe(struct platform_device *pdev)
                return irq;
        }
-        spin_lock_init(&qspi->lock);
        mutex_init(&qspi->list_lock);
        qspi->base = devm_ioremap_resource(&pdev->dev, r);
@@ -508,8 +481,7 @@ static int ti_qspi_probe(struct platform_device *pdev)
                goto free_master;
        }
-        ret = devm_request_threaded_irq(&pdev->dev, irq, ti_qspi_isr,
+        ret = devm_request_irq(&pdev->dev, irq, ti_qspi_isr, 0,
-                        ti_qspi_threaded_isr, 0,
                        dev_name(&pdev->dev), qspi);
        if (ret < 0) {
                dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n",
@@ -532,7 +504,7 @@ static int ti_qspi_probe(struct platform_device *pdev)
        if (!of_property_read_u32(np, "spi-max-frequency", &max_freq))
                qspi->spi_max_frequency = max_freq;
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(&pdev->dev, master);
        if (ret)
                goto free_master;
@@ -547,7 +519,7 @@ static int ti_qspi_remove(struct platform_device *pdev)
 {
        struct  ti_qspi *qspi = platform_get_drvdata(pdev);
-        spi_unregister_master(qspi->master);
+        ti_qspi_write(qspi, QSPI_WC_INT_DISABLE, QSPI_INTR_ENABLE_CLEAR_REG);
        return 0;
 }
@@ -558,7 +530,7 @@ static const struct dev_pm_ops ti_qspi_pm_ops = {
 static struct platform_driver ti_qspi_driver = {
        .probe  = ti_qspi_probe,
-        .remove = ti_qspi_remove,
+        .remove = ti_qspi_remove,
        .driver = {
                .name   = "ti,dra7xxx-qspi",
                .owner  = THIS_MODULE,
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index eaeeed51bbbf..14843efaaf3a 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -506,8 +506,8 @@ static int pch_spi_transfer(struct spi_device *pspi, struct spi_message *pmsg)
                goto err_out;
        }
-        dev_dbg(&pspi->dev, "%s Transfer List not empty. "
+        dev_dbg(&pspi->dev,
-                "Transfer Speed is set.\n", __func__);
+                "%s Transfer List not empty. Transfer Speed is set.\n", __func__);
        spin_lock_irqsave(&data->lock, flags);
        /* validate Tx/Rx buffers and Transfer length */
@@ -526,8 +526,9 @@ static int pch_spi_transfer(struct spi_device *pspi, struct spi_message *pmsg)
                        goto err_return_spinlock;
                }
-                dev_dbg(&pspi->dev, "%s Tx/Rx buffer valid. Transfer length"
+                dev_dbg(&pspi->dev,
-                        " valid\n", __func__);
+                        "%s Tx/Rx buffer valid. Transfer length valid\n",
+                        __func__);
                /* if baud rate has been specified validate the same */
                if (transfer->speed_hz > PCH_MAX_BAUDRATE)
@@ -1181,8 +1182,8 @@ static void pch_spi_process_messages(struct work_struct *pwork)
        spin_lock(&data->lock);
        /* check if suspend has been initiated;if yes flush queue */
        if (data->board_dat->suspend_sts || (data->status == STATUS_EXITING)) {
-                dev_dbg(&data->master->dev, "%s suspend/remove initiated,"
+                dev_dbg(&data->master->dev,
-                        "flushing queue\n", __func__);
+                        "%s suspend/remove initiated, flushing queue\n", __func__);
                list_for_each_entry_safe(pmsg, tmp, data->queue.next, queue) {
                        pmsg->status = -EIO;
diff --git a/drivers/spi/spi-txx9.c b/drivers/spi/spi-txx9.c
index 7c6d15766c72..1937be437246 100644
--- a/drivers/spi/spi-txx9.c
+++ b/drivers/spi/spi-txx9.c
@@ -406,7 +406,7 @@ static int txx9spi_probe(struct platform_device *dev)
        master->num_chipselect = (u16)UINT_MAX; /* any GPIO numbers */
        master->bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16);
-        ret = spi_register_master(master);
+        ret = devm_spi_register_master(&dev->dev, master);
        if (ret)
                goto exit;
        return 0;
@@ -428,11 +428,9 @@ static int txx9spi_remove(struct platform_device *dev)
        struct spi_master *master = spi_master_get(platform_get_drvdata(dev));
        struct txx9spi *c = spi_master_get_devdata(master);
-        spi_unregister_master(master);
        destroy_workqueue(c->workqueue);
        clk_disable(c->clk);
        clk_put(c->clk);
-        spi_master_put(master);
        return 0;
 }
@@ -440,6 +438,7 @@ static int txx9spi_remove(struct platform_device *dev)
 MODULE_ALIAS("platform:spi_txx9");
 static struct platform_driver txx9spi_driver = {
+        .probe = txx9spi_probe,
        .remove = txx9spi_remove,
        .driver = {
                .name = "spi_txx9",
@@ -449,7 +448,7 @@ static struct platform_driver txx9spi_driver = {
 static int __init txx9spi_init(void)
 {
-        return platform_driver_probe(&txx9spi_driver, txx9spi_probe);
+        return platform_driver_register(&txx9spi_driver);
 }
 subsys_initcall(txx9spi_init);
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index 0bf1b2c457a1..ec3a83f52ea2 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -372,7 +372,7 @@ static int xilinx_spi_probe(struct platform_device *pdev)
        master->mode_bits = SPI_CPOL | SPI_CPHA;
        xspi = spi_master_get_devdata(master);
-        xspi->bitbang.master = spi_master_get(master);
+        xspi->bitbang.master = master;
        xspi->bitbang.chipselect = xilinx_spi_chipselect;
        xspi->bitbang.setup_transfer = xilinx_spi_setup_transfer;
        xspi->bitbang.txrx_bufs = xilinx_spi_txrx_bufs;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 9e039c60c068..8d05accf706c 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -39,6 +39,9 @@
 #include <linux/ioport.h>
 #include <linux/acpi.h>
+#define CREATE_TRACE_POINTS
+#include <trace/events/spi.h>
 static void spidev_release(struct device *dev)
 {
        struct spi_device       *spi = to_spi_device(dev);
@@ -58,11 +61,13 @@ modalias_show(struct device *dev, struct device_attribute *a, char *buf)
        return sprintf(buf, "%s%s\n", SPI_MODULE_PREFIX, spi->modalias);
 }
+static DEVICE_ATTR_RO(modalias);
-static struct device_attribute spi_dev_attrs[] = {
+static struct attribute *spi_dev_attrs[] = {
-        __ATTR_RO(modalias),
+        &dev_attr_modalias.attr,
-        __ATTR_NULL,
+        NULL,
 };
+ATTRIBUTE_GROUPS(spi_dev);
 /* modalias support makes "modprobe $MODALIAS" new-style hotplug work,
 * and the sysfs version makes coldplug work too.
@@ -229,7 +234,7 @@ static const struct dev_pm_ops spi_pm = {
 struct bus_type spi_bus_type = {
        .name           = "spi",
-        .dev_attrs      = spi_dev_attrs,
+        .dev_groups     = spi_dev_groups,
        .match          = spi_match_device,
        .uevent         = spi_uevent,
        .pm             = &spi_pm,
@@ -323,7 +328,7 @@ struct spi_device *spi_alloc_device(struct spi_master *master)
        if (!spi_master_get(master))
                return NULL;
-        spi = kzalloc(sizeof *spi, GFP_KERNEL);
+        spi = kzalloc(sizeof(*spi), GFP_KERNEL);
        if (!spi) {
                dev_err(dev, "cannot alloc spi_device\n");
                spi_master_put(master);
@@ -523,6 +528,95 @@ int spi_register_board_info(struct spi_board_info const *info, unsigned n)
 /*-------------------------------------------------------------------------*/
+static void spi_set_cs(struct spi_device *spi, bool enable)
+{
+        if (spi->mode & SPI_CS_HIGH)
+                enable = !enable;
+        if (spi->cs_gpio >= 0)
+                gpio_set_value(spi->cs_gpio, !enable);
+        else if (spi->master->set_cs)
+                spi->master->set_cs(spi, !enable);
+}
+/*
+ * spi_transfer_one_message - Default implementation of transfer_one_message()
+ *
+ * This is a standard implementation of transfer_one_message() for
+ * drivers which impelment a transfer_one() operation.  It provides
+ * standard handling of delays and chip select management.
+ */
+static int spi_transfer_one_message(struct spi_master *master,
+                                    struct spi_message *msg)
+{
+        struct spi_transfer *xfer;
+        bool cur_cs = true;
+        bool keep_cs = false;
+        int ret = 0;
+        spi_set_cs(msg->spi, true);
+        list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+                trace_spi_transfer_start(msg, xfer);
+                INIT_COMPLETION(master->xfer_completion);
+                ret = master->transfer_one(master, msg->spi, xfer);
+                if (ret < 0) {
+                        dev_err(&msg->spi->dev,
+                                "SPI transfer failed: %d\n", ret);
+                        goto out;
+                }
+                if (ret > 0)
+                        wait_for_completion(&master->xfer_completion);
+                trace_spi_transfer_stop(msg, xfer);
+                if (msg->status != -EINPROGRESS)
+                        goto out;
+                if (xfer->delay_usecs)
+                        udelay(xfer->delay_usecs);
+                if (xfer->cs_change) {
+                        if (list_is_last(&xfer->transfer_list,
+                                         &msg->transfers)) {
+                                keep_cs = true;
+                        } else {
+                                cur_cs = !cur_cs;
+                                spi_set_cs(msg->spi, cur_cs);
+                        }
+                }
+                msg->actual_length += xfer->len;
+        }
+out:
+        if (ret != 0 || !keep_cs)
+                spi_set_cs(msg->spi, false);
+        if (msg->status == -EINPROGRESS)
+                msg->status = ret;
+        spi_finalize_current_message(master);
+        return ret;
+}
+/**
+ * spi_finalize_current_transfer - report completion of a transfer
+ *
+ * Called by SPI drivers using the core transfer_one_message()
+ * implementation to notify it that the current interrupt driven
+ * transfer has finised and the next one may be scheduled.
+ */
+void spi_finalize_current_transfer(struct spi_master *master)
+{
+        complete(&master->xfer_completion);
+}
+EXPORT_SYMBOL_GPL(spi_finalize_current_transfer);
 /**
 * spi_pump_messages - kthread work function which processes spi message queue
 * @work: pointer to kthread work struct contained in the master struct
@@ -557,6 +651,7 @@ static void spi_pump_messages(struct kthread_work *work)
                        pm_runtime_mark_last_busy(master->dev.parent);
                        pm_runtime_put_autosuspend(master->dev.parent);
                }
+                trace_spi_master_idle(master);
                return;
        }
@@ -585,6 +680,9 @@ static void spi_pump_messages(struct kthread_work *work)
                }
        }
+        if (!was_busy)
+                trace_spi_master_busy(master);
        if (!was_busy && master->prepare_transfer_hardware) {
                ret = master->prepare_transfer_hardware(master);
                if (ret) {
@@ -597,6 +695,20 @@ static void spi_pump_messages(struct kthread_work *work)
                }
        }
+        trace_spi_message_start(master->cur_msg);
+        if (master->prepare_message) {
+                ret = master->prepare_message(master, master->cur_msg);
+                if (ret) {
+                        dev_err(&master->dev,
+                                "failed to prepare message: %d\n", ret);
+                        master->cur_msg->status = ret;
+                        spi_finalize_current_message(master);
+                        return;
+                }
+                master->cur_msg_prepared = true;
+        }
        ret = master->transfer_one_message(master, master->cur_msg);
        if (ret) {
                dev_err(&master->dev,
@@ -678,6 +790,7 @@ void spi_finalize_current_message(struct spi_master *master)
 {
        struct spi_message *mesg;
        unsigned long flags;
+        int ret;
        spin_lock_irqsave(&master->queue_lock, flags);
        mesg = master->cur_msg;
@@ -686,9 +799,20 @@ void spi_finalize_current_message(struct spi_master *master)
        queue_kthread_work(&master->kworker, &master->pump_messages);
        spin_unlock_irqrestore(&master->queue_lock, flags);
+        if (master->cur_msg_prepared && master->unprepare_message) {
+                ret = master->unprepare_message(master, mesg);
+                if (ret) {
+                        dev_err(&master->dev,
+                                "failed to unprepare message: %d\n", ret);
+                }
+        }
+        master->cur_msg_prepared = false;
        mesg->state = NULL;
        if (mesg->complete)
                mesg->complete(mesg->context);
+        trace_spi_message_done(mesg);
 }
 EXPORT_SYMBOL_GPL(spi_finalize_current_message);
@@ -803,6 +927,8 @@ static int spi_master_initialize_queue(struct spi_master *master)
        master->queued = true;
        master->transfer = spi_queued_transfer;
+        if (!master->transfer_one_message)
+                master->transfer_one_message = spi_transfer_one_message;
        /* Initialize and start queue */
        ret = spi_init_queue(master);
@@ -838,10 +964,8 @@ static void of_register_spi_devices(struct spi_master *master)
 {
        struct spi_device *spi;
        struct device_node *nc;
-        const __be32 *prop;
-        char modalias[SPI_NAME_SIZE + 4];
        int rc;
-        int len;
+        u32 value;
        if (!master->dev.of_node)
                return;
@@ -866,14 +990,14 @@ static void of_register_spi_devices(struct spi_master *master)
                }
                /* Device address */
-                prop = of_get_property(nc, "reg", &len);
+                rc = of_property_read_u32(nc, "reg", &value);
-                if (!prop || len < sizeof(*prop)) {
+                if (rc) {
-                        dev_err(&master->dev, "%s has no 'reg' property\n",
+                        dev_err(&master->dev, "%s has no valid 'reg' property (%d)\n",
-                                nc->full_name);
+                                nc->full_name, rc);
                        spi_dev_put(spi);
                        continue;
                }
-                spi->chip_select = be32_to_cpup(prop);
+                spi->chip_select = value;
                /* Mode (clock phase/polarity/etc.) */
                if (of_find_property(nc, "spi-cpha", NULL))
@@ -886,55 +1010,53 @@ static void of_register_spi_devices(struct spi_master *master)
                        spi->mode |= SPI_3WIRE;
                /* Device DUAL/QUAD mode */
-                prop = of_get_property(nc, "spi-tx-bus-width", &len);
+                if (!of_property_read_u32(nc, "spi-tx-bus-width", &value)) {
-                if (prop && len == sizeof(*prop)) {
+                        switch (value) {
-                        switch (be32_to_cpup(prop)) {
+                        case 1:
-                        case SPI_NBITS_SINGLE:
                                break;
-                        case SPI_NBITS_DUAL:
+                        case 2:
                                spi->mode |= SPI_TX_DUAL;
                                break;
-                        case SPI_NBITS_QUAD:
+                        case 4:
                                spi->mode |= SPI_TX_QUAD;
                                break;
                        default:
                                dev_err(&master->dev,
                                        "spi-tx-bus-width %d not supported\n",
-                                        be32_to_cpup(prop));
+                                        value);
                                spi_dev_put(spi);
                                continue;
                        }
                }
-                prop = of_get_property(nc, "spi-rx-bus-width", &len);
+                if (!of_property_read_u32(nc, "spi-rx-bus-width", &value)) {
-                if (prop && len == sizeof(*prop)) {
+                        switch (value) {
-                        switch (be32_to_cpup(prop)) {
+                        case 1:
-                        case SPI_NBITS_SINGLE:
                                break;
-                        case SPI_NBITS_DUAL:
+                        case 2:
                                spi->mode |= SPI_RX_DUAL;
                                break;
-                        case SPI_NBITS_QUAD:
+                        case 4:
                                spi->mode |= SPI_RX_QUAD;
                                break;
                        default:
                                dev_err(&master->dev,
                                        "spi-rx-bus-width %d not supported\n",
-                                        be32_to_cpup(prop));
+                                        value);
                                spi_dev_put(spi);
                                continue;
                        }
                }
                /* Device speed */
-                prop = of_get_property(nc, "spi-max-frequency", &len);
+                rc = of_property_read_u32(nc, "spi-max-frequency", &value);
-                if (!prop || len < sizeof(*prop)) {
+                if (rc) {
-                        dev_err(&master->dev, "%s has no 'spi-max-frequency' property\n",
+                        dev_err(&master->dev, "%s has no valid 'spi-max-frequency' property (%d)\n",
-                                nc->full_name);
+                                nc->full_name, rc);
                        spi_dev_put(spi);
                        continue;
                }
-                spi->max_speed_hz = be32_to_cpup(prop);
+                spi->max_speed_hz = value;
                /* IRQ */
                spi->irq = irq_of_parse_and_map(nc, 0);
@@ -944,9 +1066,7 @@ static void of_register_spi_devices(struct spi_master *master)
                spi->dev.of_node = nc;
                /* Register the new device */
-                snprintf(modalias, sizeof(modalias), "%s%s", SPI_MODULE_PREFIX,
+                request_module("%s%s", SPI_MODULE_PREFIX, spi->modalias);
-                         spi->modalias);
-                request_module(modalias);
                rc = spi_add_device(spi);
                if (rc) {
                        dev_err(&master->dev, "spi_device register error %s\n",
@@ -1025,7 +1145,7 @@ static acpi_status acpi_spi_add_device(acpi_handle handle, u32 level,
                return AE_OK;
        }
-        strlcpy(spi->modalias, dev_name(&adev->dev), sizeof(spi->modalias));
+        strlcpy(spi->modalias, acpi_device_hid(adev), sizeof(spi->modalias));
        if (spi_add_device(spi)) {
                dev_err(&master->dev, "failed to add SPI device %s from ACPI\n",
                        dev_name(&adev->dev));
@@ -1097,7 +1217,7 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
        if (!dev)
                return NULL;
-        master = kzalloc(size + sizeof *master, GFP_KERNEL);
+        master = kzalloc(size + sizeof(*master), GFP_KERNEL);
        if (!master)
                return NULL;
@@ -1122,7 +1242,7 @@ static int of_spi_register_master(struct spi_master *master)
                return 0;
        nb = of_gpio_named_count(np, "cs-gpios");
-        master->num_chipselect = max(nb, (int)master->num_chipselect);
+        master->num_chipselect = max_t(int, nb, master->num_chipselect);
        /* Return error only for an incorrectly formed cs-gpios property */
        if (nb == 0 || nb == -ENOENT)
@@ -1209,6 +1329,7 @@ int spi_register_master(struct spi_master *master)
        spin_lock_init(&master->bus_lock_spinlock);
        mutex_init(&master->bus_lock_mutex);
        master->bus_lock_flag = 0;
+        init_completion(&master->xfer_completion);
        /* register the device, then userspace will see it.
         * registration fails if the bus ID is in use.
@@ -1245,6 +1366,41 @@ done:
 }
 EXPORT_SYMBOL_GPL(spi_register_master);
+static void devm_spi_unregister(struct device *dev, void *res)
+{
+        spi_unregister_master(*(struct spi_master **)res);
+}
+/**
+ * dev_spi_register_master - register managed SPI master controller
+ * @dev:    device managing SPI master
+ * @master: initialized master, originally from spi_alloc_master()
+ * Context: can sleep
+ *
+ * Register a SPI device as with spi_register_master() which will
+ * automatically be unregister
+ */
+int devm_spi_register_master(struct device *dev, struct spi_master *master)
+{
+        struct spi_master **ptr;
+        int ret;
+        ptr = devres_alloc(devm_spi_unregister, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return -ENOMEM;
+        ret = spi_register_master(master);
+        if (ret != 0) {
+                *ptr = master;
+                devres_add(dev, ptr);
+        } else {
+                devres_free(ptr);
+        }
+        return ret;
+}
+EXPORT_SYMBOL_GPL(devm_spi_register_master);
 static int __unregister(struct device *dev, void *null)
 {
        spi_unregister_device(to_spi_device(dev));
@@ -1402,8 +1558,7 @@ int spi_setup(struct spi_device *spi)
        if (spi->master->setup)
                status = spi->master->setup(spi);
-        dev_dbg(&spi->dev, "setup mode %d, %s%s%s%s"
+        dev_dbg(&spi->dev, "setup mode %d, %s%s%s%s%u bits/w, %u Hz max --> %d\n",
-                                "%u bits/w, %u Hz max --> %d\n",
                        (int) (spi->mode & (SPI_CPOL | SPI_CPHA)),
                        (spi->mode & SPI_CS_HIGH) ? "cs_high, " : "",
                        (spi->mode & SPI_LSB_FIRST) ? "lsb, " : "",
@@ -1421,6 +1576,10 @@ static int __spi_async(struct spi_device *spi, struct spi_message *message)
        struct spi_master *master = spi->master;
        struct spi_transfer *xfer;
+        message->spi = spi;
+        trace_spi_message_submit(message);
        if (list_empty(&message->transfers))
                return -EINVAL;
        if (!message->complete)
@@ -1520,7 +1679,6 @@ static int __spi_async(struct spi_device *spi, struct spi_message *message)
                }
        }
-        message->spi = spi;
        message->status = -EINPROGRESS;
        return master->transfer(spi, message);
 }
@@ -1762,7 +1920,7 @@ int spi_bus_unlock(struct spi_master *master)
 EXPORT_SYMBOL_GPL(spi_bus_unlock);
 /* portable code must never pass more than 32 bytes */
-#define SPI_BUFSIZ      max(32,SMP_CACHE_BYTES)
+#define SPI_BUFSIZ      max(32, SMP_CACHE_BYTES)
 static u8       *buf;
@@ -1811,7 +1969,7 @@ int spi_write_then_read(struct spi_device *spi,
        }
        spi_message_init(&message);
-        memset(x, 0, sizeof x);
+        memset(x, 0, sizeof(x));
        if (n_tx) {
                x[0].len = n_tx;
                spi_message_add_tail(&x[0], &message);
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index ca5bcfe874d0..d7c6e36021e8 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -37,7 +37,7 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/spidev.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 /*
@@ -206,9 +206,9 @@ spidev_write(struct file *filp, const char __user *buf,
        mutex_lock(&spidev->buf_lock);
        missing = copy_from_user(spidev->buffer, buf, count);
-        if (missing == 0) {
+        if (missing == 0)
                status = spidev_sync_write(spidev, count);
-        } else
+        else
                status = -EFAULT;
        mutex_unlock(&spidev->buf_lock);
@@ -629,7 +629,6 @@ static int spidev_remove(struct spi_device *spi)
        /* make sure ops on existing fds can abort cleanly */
        spin_lock_irq(&spidev->spi_lock);
        spidev->spi = NULL;
-        spi_set_drvdata(spi, NULL);
        spin_unlock_irq(&spidev->spi_lock);
        /* prevent new opens */
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index a84aab47a113..f73287eab373 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -96,6 +96,15 @@ config COMEDI_SKEL
          To compile this driver as a module, choose M here: the module will be
          called skel.
+config COMEDI_SSV_DNP
+        tristate "SSV Embedded Systems DIL/Net-PC support"
+        depends on X86_32 || COMPILE_TEST
+        ---help---
+          Enable support for SSV Embedded Systems DIL/Net-PC
+          To compile this driver as a module, choose M here: the module will be
+          called ssv_dnp.
 endif # COMEDI_MISC_DRIVERS
 menuconfig COMEDI_ISA_DRIVERS
@@ -386,6 +395,14 @@ config COMEDI_DMM32AT
          To compile this driver as a module, choose M here: the module will be
          called dmm32at.
+config COMEDI_UNIOXX5
+        tristate "Fastwel UNIOxx-5 analog and digital io board support"
+        ---help---
+          Enable support for Fastwel UNIOxx-5 (analog and digital i/o) boards
+          To compile this driver as a module, choose M here: the module will be
+          called unioxx5.
 config COMEDI_FL512
        tristate "FL512 ISA card support"
        ---help---
@@ -855,14 +872,6 @@ config COMEDI_DYNA_PCI10XX
          To compile this driver as a module, choose M here: the module will be
          called dyna_pci10xx.
-config COMEDI_UNIOXX5
-        tristate "Fastwel UNIOxx-5 analog and digital io board support"
-        ---help---
-          Enable support for Fastwel UNIOxx-5 (analog and digital i/o) boards
-          To compile this driver as a module, choose M here: the module will be
-          called unioxx5.
 config COMEDI_GSC_HPDI
        tristate "General Standards PCI-HPDI32 / PMC-HPDI32 support"
        select COMEDI_FC
@@ -1085,14 +1094,6 @@ config COMEDI_S626
          To compile this driver as a module, choose M here: the module will be
          called s626.
-config COMEDI_SSV_DNP
-        tristate "SSV Embedded Systems DIL/Net-PC support"
-        ---help---
-          Enable support for SSV Embedded Systems DIL/Net-PC
-          To compile this driver as a module, choose M here: the module will be
-          called ssv_dnp.
 config COMEDI_MITE
        depends on HAS_DMA
        tristate
diff --git a/drivers/staging/comedi/drivers/ni_65xx.c b/drivers/staging/comedi/drivers/ni_65xx.c
index 3ba4c5712dff..853f62b2b1a9 100644
--- a/drivers/staging/comedi/drivers/ni_65xx.c
+++ b/drivers/staging/comedi/drivers/ni_65xx.c
@@ -369,28 +369,23 @@ static int ni_65xx_dio_insn_bits(struct comedi_device *dev,
 {
        const struct ni_65xx_board *board = comedi_board(dev);
        struct ni_65xx_private *devpriv = dev->private;
-        unsigned base_bitfield_channel;
+        int base_bitfield_channel;
-        const unsigned max_ports_per_bitfield = 5;
        unsigned read_bits = 0;
-        unsigned j;
+        int last_port_offset = ni_65xx_port_by_channel(s->n_chan - 1);
+        int port_offset;
        base_bitfield_channel = CR_CHAN(insn->chanspec);
-        for (j = 0; j < max_ports_per_bitfield; ++j) {
+        for (port_offset = ni_65xx_port_by_channel(base_bitfield_channel);
-                const unsigned port_offset =
+             port_offset <= last_port_offset; port_offset++) {
-                        ni_65xx_port_by_channel(base_bitfield_channel) + j;
+                unsigned port = sprivate(s)->base_port + port_offset;
-                const unsigned port =
+                int base_port_channel = port_offset * ni_65xx_channels_per_port;
-                        sprivate(s)->base_port + port_offset;
-                unsigned base_port_channel;
                unsigned port_mask, port_data, port_read_bits;
-                int bitshift;
+                int bitshift = base_port_channel - base_bitfield_channel;
-                if (port >= ni_65xx_total_num_ports(board))
+                if (bitshift >= 32)
                        break;
-                base_port_channel = port_offset * ni_65xx_channels_per_port;
                port_mask = data[0];
                port_data = data[1];
-                bitshift = base_port_channel - base_bitfield_channel;
-                if (bitshift >= 32 || bitshift <= -32)
-                        break;
                if (bitshift > 0) {
                        port_mask >>= bitshift;
                        port_data >>= bitshift;
diff --git a/drivers/staging/dgap/dgap_driver.c b/drivers/staging/dgap/dgap_driver.c
index 724a685753dd..40ef785a0428 100644
--- a/drivers/staging/dgap/dgap_driver.c
+++ b/drivers/staging/dgap/dgap_driver.c
@@ -474,7 +474,7 @@ static void dgap_cleanup_board(struct board_t *brd)
                DGAP_LOCK(dgap_global_lock, flags);
                brd->msgbuf = NULL;
-                printk(brd->msgbuf_head);
+                printk("%s", brd->msgbuf_head);
                kfree(brd->msgbuf_head);
                brd->msgbuf_head = NULL;
                DGAP_UNLOCK(dgap_global_lock, flags);
@@ -628,7 +628,7 @@ static int dgap_found_board(struct pci_dev *pdev, int id)
        DPR_INIT(("dgap_scan(%d) - printing out the msgbuf\n", i));
        DGAP_LOCK(dgap_global_lock, flags);
        brd->msgbuf = NULL;
-        printk(brd->msgbuf_head);
+        printk("%s", brd->msgbuf_head);
        kfree(brd->msgbuf_head);
        brd->msgbuf_head = NULL;
        DGAP_UNLOCK(dgap_global_lock, flags);
@@ -955,25 +955,28 @@ static void dgap_mbuf(struct board_t *brd, const char *fmt, ...) {
        char            buf[1024];
        int             i;
        unsigned long   flags;
+        size_t          length;
        DGAP_LOCK(dgap_global_lock, flags);
        /* Format buf using fmt and arguments contained in ap. */
        va_start(ap, fmt);
-        i = vsprintf(buf, fmt,  ap);
+        i = vsnprintf(buf, sizeof(buf), fmt,  ap);
        va_end(ap);
        DPR((buf));
        if (!brd || !brd->msgbuf) {
-                printk(buf);
+                printk("%s", buf);
                DGAP_UNLOCK(dgap_global_lock, flags);
                return;
        }
-        memcpy(brd->msgbuf, buf, strlen(buf));
+        length = strlen(buf) + 1;
-        brd->msgbuf += strlen(buf);
+        if (brd->msgbuf - brd->msgbuf_head < length)
-        *brd->msgbuf = 0;
+                length = brd->msgbuf - brd->msgbuf_head;
+        memcpy(brd->msgbuf, buf, length);
+        brd->msgbuf += length;
        DGAP_UNLOCK(dgap_global_lock, flags);
 }
diff --git a/drivers/staging/dgnc/dgnc_driver.c b/drivers/staging/dgnc/dgnc_driver.c
index f8c1e22585d6..71d2b83cc3a1 100644
--- a/drivers/staging/dgnc/dgnc_driver.c
+++ b/drivers/staging/dgnc/dgnc_driver.c
@@ -454,7 +454,7 @@ static void dgnc_cleanup_board(struct board_t *brd)
                DGNC_LOCK(dgnc_global_lock, flags);
                brd->msgbuf = NULL;
-                printk(brd->msgbuf_head);
+                printk("%s", brd->msgbuf_head);
                kfree(brd->msgbuf_head);
                brd->msgbuf_head = NULL;
                DGNC_UNLOCK(dgnc_global_lock, flags);
@@ -710,7 +710,7 @@ static int dgnc_found_board(struct pci_dev *pdev, int id)
        DPR_INIT(("dgnc_scan(%d) - printing out the msgbuf\n", i));
        DGNC_LOCK(dgnc_global_lock, flags);
        brd->msgbuf = NULL;
-        printk(brd->msgbuf_head);
+        printk("%s", brd->msgbuf_head);
        kfree(brd->msgbuf_head);
        brd->msgbuf_head = NULL;
        DGNC_UNLOCK(dgnc_global_lock, flags);
diff --git a/drivers/staging/iio/Kconfig b/drivers/staging/iio/Kconfig
index db4d6dc03243..b36feb080cba 100644
--- a/drivers/staging/iio/Kconfig
+++ b/drivers/staging/iio/Kconfig
@@ -37,7 +37,7 @@ config IIO_SIMPLE_DUMMY_EVENTS
 config IIO_SIMPLE_DUMMY_BUFFER
       boolean "Buffered capture support"
-       depends on IIO_KFIFO_BUF
+       select IIO_KFIFO_BUF
       help
         Add buffered data capture to the simple dummy driver.
diff --git a/drivers/staging/iio/light/isl29018.c b/drivers/staging/iio/light/isl29018.c
index 351936c3efd6..e4998e4d4434 100644
--- a/drivers/staging/iio/light/isl29018.c
+++ b/drivers/staging/iio/light/isl29018.c
@@ -563,6 +563,7 @@ static int isl29018_probe(struct i2c_client *client,
        mutex_init(&chip->lock);
        chip->lux_scale = 1;
+        chip->lux_uscale = 0;
        chip->range = 1000;
        chip->adc_bit = 16;
        chip->suspended = false;
diff --git a/drivers/staging/iio/magnetometer/hmc5843.c b/drivers/staging/iio/magnetometer/hmc5843.c
index d2748c329eae..c3f3f539e787 100644
--- a/drivers/staging/iio/magnetometer/hmc5843.c
+++ b/drivers/staging/iio/magnetometer/hmc5843.c
@@ -229,7 +229,7 @@ static int hmc5843_read_measurement(struct iio_dev *indio_dev,
        if (result < 0)
                return -EINVAL;
-        *val = result;
+        *val = sign_extend32(result, 15);
        return IIO_VAL_INT;
 }
diff --git a/drivers/staging/iio/meter/ade7854-spi.c b/drivers/staging/iio/meter/ade7854-spi.c
index a802cf2491d6..4c6d2041260b 100644
--- a/drivers/staging/iio/meter/ade7854-spi.c
+++ b/drivers/staging/iio/meter/ade7854-spi.c
@@ -299,7 +299,7 @@ static int ade7854_spi_probe(struct spi_device *spi)
        if (ret)
                iio_device_free(indio_dev);
-        return 0;
+        return ret;
 }
 static int ade7854_spi_remove(struct spi_device *spi)
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 47c5888461ff..a2e52a0c53c9 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -41,7 +41,6 @@ struct imx_drm_device {
        struct list_head                        encoder_list;
        struct list_head                        connector_list;
        struct mutex                            mutex;
-        int                                     references;
        int                                     pipes;
        struct drm_fbdev_cma                    *fbhelper;
 };
@@ -241,8 +240,6 @@ struct drm_device *imx_drm_device_get(void)
                }
        }
-        imxdrm->references++;
        return imxdrm->drm;
 unwind_crtc:
@@ -280,8 +277,6 @@ void imx_drm_device_put(void)
        list_for_each_entry(enc, &imxdrm->encoder_list, list)
                module_put(enc->owner);
-        imxdrm->references--;
        mutex_unlock(&imxdrm->mutex);
 }
 EXPORT_SYMBOL_GPL(imx_drm_device_put);
@@ -485,7 +480,7 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
        mutex_lock(&imxdrm->mutex);
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                ret = -EBUSY;
                goto err_busy;
        }
@@ -564,7 +559,7 @@ int imx_drm_add_encoder(struct drm_encoder *encoder,
        mutex_lock(&imxdrm->mutex);
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                ret = -EBUSY;
                goto err_busy;
        }
@@ -709,7 +704,7 @@ int imx_drm_add_connector(struct drm_connector *connector,
        mutex_lock(&imxdrm->mutex);
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                ret = -EBUSY;
                goto err_busy;
        }
diff --git a/drivers/staging/line6/toneport.c b/drivers/staging/line6/toneport.c
index 2f44d56700af..776d3632dc7d 100644
--- a/drivers/staging/line6/toneport.c
+++ b/drivers/staging/line6/toneport.c
@@ -244,13 +244,17 @@ static int snd_toneport_source_put(struct snd_kcontrol *kcontrol,
        struct snd_line6_pcm *line6pcm = snd_kcontrol_chip(kcontrol);
        struct usb_line6_toneport *toneport =
            (struct usb_line6_toneport *)line6pcm->line6;
+        unsigned int source;
-        if (ucontrol->value.enumerated.item[0] == toneport->source)
+        source = ucontrol->value.enumerated.item[0];
+        if (source >= ARRAY_SIZE(toneport_source_info))
+                return -EINVAL;
+        if (source == toneport->source)
                return 0;
-        toneport->source = ucontrol->value.enumerated.item[0];
+        toneport->source = source;
        toneport_send_cmd(toneport->line6.usbdev,
-                          toneport_source_info[toneport->source].code, 0x0000);
+                          toneport_source_info[source].code, 0x0000);
        return 1;
 }
diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
index 086ca3d7241b..26b49a24b3df 100644
--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
@@ -1802,7 +1802,7 @@ kiblnd_recv (lnet_ni_t *ni, void *private, lnet_msg_t *lntmsg, int delayed,
 int
 kiblnd_thread_start(int (*fn)(void *arg), void *arg, char *name)
 {
-        struct task_struct *task = kthread_run(fn, arg, name);
+        struct task_struct *task = kthread_run(fn, arg, "%s", name);
        if (IS_ERR(task))
                return PTR_ERR(task);
diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
index 2c581b7fa8ad..68a4f52ec998 100644
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
@@ -1005,7 +1005,7 @@ ksocknal_send(lnet_ni_t *ni, void *private, lnet_msg_t *lntmsg)
 int
 ksocknal_thread_start(int (*fn)(void *arg), void *arg, char *name)
 {
-        struct task_struct *task = kthread_run(fn, arg, name);
+        struct task_struct *task = kthread_run(fn, arg, "%s", name);
        if (IS_ERR(task))
                return PTR_ERR(task);
diff --git a/drivers/staging/lustre/lustre/Kconfig b/drivers/staging/lustre/lustre/Kconfig
index 4e898e491860..2156a44d0740 100644
--- a/drivers/staging/lustre/lustre/Kconfig
+++ b/drivers/staging/lustre/lustre/Kconfig
@@ -1,6 +1,6 @@
 config LUSTRE_FS
        tristate "Lustre file system client support"
-        depends on INET && m
+        depends on INET && m && !MIPS && !XTENSA && !SUPERH
        select LNET
        select CRYPTO
        select CRYPTO_CRC32
@@ -52,7 +52,7 @@ config LUSTRE_DEBUG_EXPENSIVE_CHECK
 config LUSTRE_TRANSLATE_ERRNOS
        bool
        depends on LUSTRE_FS && !X86
-        default true
+        default y
 config LUSTRE_LLITE_LLOOP
        bool "Lustre virtual block device"
diff --git a/drivers/staging/lustre/lustre/ldlm/ldlm_lockd.c b/drivers/staging/lustre/lustre/ldlm/ldlm_lockd.c
index 3916bda3004c..a100a0b96381 100644
--- a/drivers/staging/lustre/lustre/ldlm/ldlm_lockd.c
+++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lockd.c
@@ -800,9 +800,9 @@ static int ldlm_bl_thread_start(struct ldlm_bl_pool *blp)
        init_completion(&bltd.bltd_comp);
        bltd.bltd_num = atomic_read(&blp->blp_num_threads);
-        snprintf(bltd.bltd_name, sizeof(bltd.bltd_name) - 1,
+        snprintf(bltd.bltd_name, sizeof(bltd.bltd_name),
                "ldlm_bl_%02d", bltd.bltd_num);
-        task = kthread_run(ldlm_bl_thread_main, &bltd, bltd.bltd_name);
+        task = kthread_run(ldlm_bl_thread_main, &bltd, "%s", bltd.bltd_name);
        if (IS_ERR(task)) {
                CERROR("cannot start LDLM thread ldlm_bl_%02d: rc %ld\n",
                       atomic_read(&blp->blp_num_threads), PTR_ERR(task));
diff --git a/drivers/staging/lustre/lustre/libcfs/workitem.c b/drivers/staging/lustre/lustre/libcfs/workitem.c
index 462172d1a756..1a55c81892e0 100644
--- a/drivers/staging/lustre/lustre/libcfs/workitem.c
+++ b/drivers/staging/lustre/lustre/libcfs/workitem.c
@@ -397,7 +397,7 @@ cfs_wi_sched_create(char *name, struct cfs_cpt_table *cptab,
                                 sched->ws_name, sched->ws_nthreads);
                }
-                task = kthread_run(cfs_wi_scheduler, sched, name);
+                task = kthread_run(cfs_wi_scheduler, sched, "%s", name);
                if (!IS_ERR(task)) {
                        nthrs--;
                        continue;
diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/staging/lustre/lustre/obdecho/echo_client.c
index 2644edf438c1..c8b43442dc74 100644
--- a/drivers/staging/lustre/lustre/obdecho/echo_client.c
+++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c
@@ -1387,7 +1387,7 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
        if (nob > ulsm_nob)
                return (-EINVAL);
-        if (copy_to_user (ulsm, lsm, sizeof(ulsm)))
+        if (copy_to_user (ulsm, lsm, sizeof(*ulsm)))
                return (-EFAULT);
        for (i = 0; i < lsm->lsm_stripe_count; i++) {
diff --git a/drivers/staging/lustre/lustre/ptlrpc/pinger.c b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
index 227a0ae9593b..5dec771d70ee 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/pinger.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
@@ -383,8 +383,8 @@ int ptlrpc_start_pinger(void)
        /* CLONE_VM and CLONE_FILES just avoid a needless copy, because we
         * just drop the VM and FILES in cfs_daemonize_ctxt() right away. */
-        rc = PTR_ERR(kthread_run(ptlrpc_pinger_main,
+        rc = PTR_ERR(kthread_run(ptlrpc_pinger_main, &pinger_thread,
-                                 &pinger_thread, pinger_thread.t_name));
+                                 "%s", pinger_thread.t_name));
        if (IS_ERR_VALUE(rc)) {
                CERROR("cannot start thread: %d\n", rc);
                return rc;
diff --git a/drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c b/drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c
index fbdeff65d059..89c9be96f454 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c
@@ -615,7 +615,7 @@ int ptlrpcd_start(int index, int max, const char *name, struct ptlrpcd_ctl *pc)
        init_completion(&pc->pc_starting);
        init_completion(&pc->pc_finishing);
        spin_lock_init(&pc->pc_lock);
-        strncpy(pc->pc_name, name, sizeof(pc->pc_name) - 1);
+        strlcpy(pc->pc_name, name, sizeof(pc->pc_name));
        pc->pc_set = ptlrpc_prep_set();
        if (pc->pc_set == NULL)
                GOTO(out, rc = -ENOMEM);
@@ -638,7 +638,7 @@ int ptlrpcd_start(int index, int max, const char *name, struct ptlrpcd_ctl *pc)
                                GOTO(out, rc);
                }
-                task = kthread_run(ptlrpcd, pc, pc->pc_name);
+                task = kthread_run(ptlrpcd, pc, "%s", pc->pc_name);
                if (IS_ERR(task))
                        GOTO(out, rc = PTR_ERR(task));
@@ -745,7 +745,7 @@ static int ptlrpcd_init(void)
        if (ptlrpcds == NULL)
                GOTO(out, rc = -ENOMEM);
-        snprintf(name, 15, "ptlrpcd_rcv");
+        snprintf(name, sizeof(name), "ptlrpcd_rcv");
        set_bit(LIOD_RECOVERY, &ptlrpcds->pd_thread_rcv.pc_flags);
        rc = ptlrpcd_start(-1, nthreads, name, &ptlrpcds->pd_thread_rcv);
        if (rc < 0)
@@ -764,7 +764,7 @@ static int ptlrpcd_init(void)
         *      unnecessary dependency. But how to distribute async RPCs load
         *      among all the ptlrpc daemons becomes another trouble. */
        for (i = 0; i < nthreads; i++) {
-                snprintf(name, 15, "ptlrpcd_%d", i);
+                snprintf(name, sizeof(name), "ptlrpcd_%d", i);
                rc = ptlrpcd_start(i, nthreads, name, &ptlrpcds->pd_threads[i]);
                if (rc < 0)
                        GOTO(out, rc);
diff --git a/drivers/staging/lustre/lustre/ptlrpc/sec_bulk.c b/drivers/staging/lustre/lustre/ptlrpc/sec_bulk.c
index e90c8fb7da6a..6547f46a7729 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/sec_bulk.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/sec_bulk.c
@@ -59,8 +59,8 @@
 ****************************************/
-#define PTRS_PER_PAGE   (PAGE_CACHE_SIZE / sizeof(void *))
+#define POINTERS_PER_PAGE       (PAGE_CACHE_SIZE / sizeof(void *))
-#define PAGES_PER_POOL  (PTRS_PER_PAGE)
+#define PAGES_PER_POOL          (POINTERS_PER_PAGE)
 #define IDLE_IDX_MAX        (100)
 #define IDLE_IDX_WEIGHT  (3)
diff --git a/drivers/staging/lustre/lustre/ptlrpc/service.c b/drivers/staging/lustre/lustre/ptlrpc/service.c
index ac8b5fd2300b..acf75f3873d1 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/service.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/service.c
@@ -2718,15 +2718,15 @@ int ptlrpc_start_thread(struct ptlrpc_service_part *svcpt, int wait)
        spin_unlock(&svcpt->scp_lock);
        if (svcpt->scp_cpt >= 0) {
-                snprintf(thread->t_name, PTLRPC_THR_NAME_LEN, "%s%02d_%03d",
+                snprintf(thread->t_name, sizeof(thread->t_name), "%s%02d_%03d",
                         svc->srv_thread_name, svcpt->scp_cpt, thread->t_id);
        } else {
-                snprintf(thread->t_name, PTLRPC_THR_NAME_LEN, "%s_%04d",
+                snprintf(thread->t_name, sizeof(thread->t_name), "%s_%04d",
                         svc->srv_thread_name, thread->t_id);
        }
        CDEBUG(D_RPCTRACE, "starting thread '%s'\n", thread->t_name);
-        rc = PTR_ERR(kthread_run(ptlrpc_main, thread, thread->t_name));
+        rc = PTR_ERR(kthread_run(ptlrpc_main, thread, "%s", thread->t_name));
        if (IS_ERR_VALUE(rc)) {
                CERROR("cannot start thread '%s': rc %d\n",
                       thread->t_name, rc);
diff --git a/drivers/staging/octeon-usb/cvmx-usb.c b/drivers/staging/octeon-usb/cvmx-usb.c
index d7b3c82b5ead..45dfe94199ae 100644
--- a/drivers/staging/octeon-usb/cvmx-usb.c
+++ b/drivers/staging/octeon-usb/cvmx-usb.c
@@ -604,7 +604,7 @@ int cvmx_usb_initialize(struct cvmx_usb_state *state, int usb_port_number,
                        }
        }
-        memset(usb, 0, sizeof(usb));
+        memset(usb, 0, sizeof(*usb));
        usb->init_flags = flags;
        /* Initialize the USB state structure */
diff --git a/drivers/staging/octeon/ethernet-mem.c b/drivers/staging/octeon/ethernet-mem.c
index 78b6cb743769..199059d64c9b 100644
--- a/drivers/staging/octeon/ethernet-mem.c
+++ b/drivers/staging/octeon/ethernet-mem.c
@@ -48,13 +48,8 @@ static int cvm_oct_fill_hw_skbuff(int pool, int size, int elements)
        while (freed) {
                struct sk_buff *skb = dev_alloc_skb(size + 256);
-                if (unlikely(skb == NULL)) {
+                if (unlikely(skb == NULL))
-                        pr_warning
-                            ("Failed to allocate skb for hardware pool %d\n",
-                             pool);
                        break;
-                }
                skb_reserve(skb, 256 - (((unsigned long)skb->data) & 0x7f));
                *(struct sk_buff **)(skb->data - sizeof(void *)) = skb;
                cvmx_fpa_free(skb->data, pool, DONT_WRITEBACK(size / 128));
diff --git a/drivers/staging/octeon/ethernet-rgmii.c b/drivers/staging/octeon/ethernet-rgmii.c
index d8f5f694ec35..ea53af30dfa7 100644
--- a/drivers/staging/octeon/ethernet-rgmii.c
+++ b/drivers/staging/octeon/ethernet-rgmii.c
@@ -373,9 +373,7 @@ int cvm_oct_rgmii_init(struct net_device *dev)
                         * Enable interrupts on inband status changes
                         * for this port.
                         */
-                        gmx_rx_int_en.u64 =
+                        gmx_rx_int_en.u64 = 0;
-                            cvmx_read_csr(CVMX_GMXX_RXX_INT_EN
-                                          (index, interface));
                        gmx_rx_int_en.s.phy_dupx = 1;
                        gmx_rx_int_en.s.phy_link = 1;
                        gmx_rx_int_en.s.phy_spd = 1;
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index 34afc16bc493..e14a1bb04361 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -303,6 +303,7 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
                        if (backlog > budget * cores_in_use && napi != NULL)
                                cvm_oct_enable_one_cpu();
                }
+                rx_count++;
                skb_in_hw = USE_SKBUFFS_IN_HW && work->word2.s.bufs == 1;
                if (likely(skb_in_hw)) {
@@ -336,9 +337,6 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
                         */
                        skb = dev_alloc_skb(work->len);
                        if (!skb) {
-                                printk_ratelimited("Port %d failed to allocate "
-                                                   "skbuff, packet dropped\n",
-                                                   work->ipprt);
                                cvm_oct_free_work(work);
                                continue;
                        }
@@ -429,7 +427,6 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
 #endif
                                }
                                netif_receive_skb(skb);
-                                rx_count++;
                        } else {
                                /* Drop any packet received for a device that isn't up */
                                /*
diff --git a/drivers/staging/rtl8188eu/core/rtw_ieee80211.c b/drivers/staging/rtl8188eu/core/rtw_ieee80211.c
index 3605c5da822d..6fc77428e83a 100644
--- a/drivers/staging/rtl8188eu/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ieee80211.c
@@ -157,8 +157,8 @@ _func_enter_;
        *frlen = *frlen + (len + 2);
-        return pbuf + len + 2;
 _func_exit_;
+        return pbuf + len + 2;
 }
 inline u8 *rtw_set_ie_ch_switch (u8 *buf, u32 *buf_len, u8 ch_switch_mode,
diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
index 8b2ba26ba38d..4b2eb8e9b562 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
@@ -1827,13 +1827,13 @@ unsigned int OnAction_back(struct adapter *padapter, union recv_frame *precv_fra
 #ifdef CONFIG_88EU_P2P
-static int get_reg_classes_full_count(struct p2p_channels channel_list)
+static int get_reg_classes_full_count(struct p2p_channels *channel_list)
 {
        int cnt = 0;
        int i;
-        for (i = 0; i < channel_list.reg_classes; i++) {
+        for (i = 0; i < channel_list->reg_classes; i++) {
-                cnt += channel_list.reg_class[i].channels;
+                cnt += channel_list->reg_class[i].channels;
        }
        return cnt;
@@ -2065,7 +2065,7 @@ void issue_p2p_GO_request(struct adapter *padapter, u8 *raddr)
        /*  + number of channels in all classes */
        len_channellist_attr = 3
           + (1 + 1) * (u16)(pmlmeext->channel_list.reg_classes)
-           + get_reg_classes_full_count(pmlmeext->channel_list);
+           + get_reg_classes_full_count(&pmlmeext->channel_list);
        *(__le16 *)(p2pie + p2pielen) = cpu_to_le16(len_channellist_attr);
        p2pielen += 2;
@@ -2437,7 +2437,7 @@ static void issue_p2p_GO_response(struct adapter *padapter, u8 *raddr, u8 *frame
        /*  + number of channels in all classes */
        len_channellist_attr = 3
           + (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
-           + get_reg_classes_full_count(pmlmeext->channel_list);
+           + get_reg_classes_full_count(&pmlmeext->channel_list);
        *(__le16 *)(p2pie + p2pielen) = cpu_to_le16(len_channellist_attr);
@@ -2859,7 +2859,7 @@ void issue_p2p_invitation_request(struct adapter *padapter, u8 *raddr)
        /*  + number of channels in all classes */
        len_channellist_attr = 3
           + (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
-           + get_reg_classes_full_count(pmlmeext->channel_list);
+           + get_reg_classes_full_count(&pmlmeext->channel_list);
        *(__le16 *)(p2pie + p2pielen) = cpu_to_le16(len_channellist_attr);
@@ -3120,7 +3120,7 @@ void issue_p2p_invitation_response(struct adapter *padapter, u8 *raddr, u8 dialo
                /*  + number of channels in all classes */
                len_channellist_attr = 3
                        + (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
-                        + get_reg_classes_full_count(pmlmeext->channel_list);
+                        + get_reg_classes_full_count(&pmlmeext->channel_list);
                *(__le16 *)(p2pie + p2pielen) = cpu_to_le16(len_channellist_attr);
                p2pielen += 2;
diff --git a/drivers/staging/rtl8188eu/core/rtw_mp.c b/drivers/staging/rtl8188eu/core/rtw_mp.c
index c7ff2e4d1f23..9832dcbbd07f 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mp.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mp.c
@@ -907,7 +907,7 @@ u32 mp_query_psd(struct adapter *pAdapter, u8 *data)
                sscanf(data, "pts =%d, start =%d, stop =%d", &psd_pts, &psd_start, &psd_stop);
        }
-        _rtw_memset(data, '\0', sizeof(data));
+        _rtw_memset(data, '\0', sizeof(*data));
        i = psd_start;
        while (i < psd_stop) {
diff --git a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
index 013ea487e7ac..8018edd3d42e 100644
--- a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
@@ -631,7 +631,7 @@ void WMMOnAssocRsp(struct adapter *padapter)
        inx[0] = 0; inx[1] = 1; inx[2] = 2; inx[3] = 3;
        if (pregpriv->wifi_spec == 1) {
-                u32     j, tmp, change_inx;
+                u32     j, tmp, change_inx = false;
                /* entry indx: 0->vo, 1->vi, 2->be, 3->bk. */
                for (i = 0; i < 4; i++) {
diff --git a/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c b/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
index 9c2e7a20c09e..ec0028d4e61a 100644
--- a/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
+++ b/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
@@ -57,7 +57,7 @@ static void Init_ODM_ComInfo_88E(struct adapter *Adapter)
        u8 cut_ver, fab_ver;
        /*  Init Value */
-        _rtw_memset(dm_odm, 0, sizeof(dm_odm));
+        _rtw_memset(dm_odm, 0, sizeof(*dm_odm));
        dm_odm->Adapter = Adapter;
diff --git a/drivers/staging/rtl8188eu/include/odm.h b/drivers/staging/rtl8188eu/include/odm.h
index 2bfe72841921..4787bacdcad8 100644
--- a/drivers/staging/rtl8188eu/include/odm.h
+++ b/drivers/staging/rtl8188eu/include/odm.h
@@ -1010,7 +1010,7 @@ enum dm_dig_op {
 #define         DM_false_ALARM_THRESH_LOW       400
 #define         DM_false_ALARM_THRESH_HIGH      1000
-#define         DM_DIG_MAX_NIC                  0x3e
+#define         DM_DIG_MAX_NIC                  0x4e
 #define         DM_DIG_MIN_NIC                  0x1e /* 0x22/0x1c */
 #define         DM_DIG_MAX_AP                   0x32
diff --git a/drivers/staging/rtl8188eu/include/rtl8188e_hal.h b/drivers/staging/rtl8188eu/include/rtl8188e_hal.h
index 52b280165a92..555c801d2ded 100644
--- a/drivers/staging/rtl8188eu/include/rtl8188e_hal.h
+++ b/drivers/staging/rtl8188eu/include/rtl8188e_hal.h
@@ -188,7 +188,7 @@ enum ChannelPlan {
 struct txpowerinfo24g {
        u8 IndexCCK_Base[MAX_RF_PATH][MAX_CHNL_GROUP_24G];
-        u8 IndexBW40_Base[MAX_RF_PATH][MAX_CHNL_GROUP_24G-1];
+        u8 IndexBW40_Base[MAX_RF_PATH][MAX_CHNL_GROUP_24G];
        /* If only one tx, only BW20 and OFDM are used. */
        s8 CCK_Diff[MAX_RF_PATH][MAX_TX_COUNT];
        s8 OFDM_Diff[MAX_RF_PATH][MAX_TX_COUNT];
diff --git a/drivers/staging/rtl8188eu/include/rtw_mlme_ext.h b/drivers/staging/rtl8188eu/include/rtw_mlme_ext.h
index a96b018e5e6a..853ab80a2b86 100644
--- a/drivers/staging/rtl8188eu/include/rtw_mlme_ext.h
+++ b/drivers/staging/rtl8188eu/include/rtw_mlme_ext.h
@@ -870,6 +870,7 @@ static struct fwevent wlanevents[] = {
        {0, NULL},
        {0, NULL},
        {0, &rtw_cpwm_event_callback},
+        {0, NULL},
 };
 #endif/* _RTL_MLME_EXT_C_ */
diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index cd4100fb3645..95953ebc0279 100644
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -6973,7 +6973,7 @@ static int rtw_mp_ctx(struct net_device *dev,
        stop = strncmp(extra, "stop", 4);
        sscanf(extra, "count =%d, pkt", &count);
-        _rtw_memset(extra, '\0', sizeof(extra));
+        _rtw_memset(extra, '\0', sizeof(*extra));
        if (stop == 0) {
                bStartTest = 0; /*  To set Stop */
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index d3078d200e50..9ca3180ebaa0 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -54,6 +54,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
        /*=== Customer ID ===*/
        /****** 8188EUS ********/
        {USB_DEVICE(0x8179, 0x07B8)}, /* Abocom - Abocom */
+        {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
        {}      /* Terminating entry */
 };
diff --git a/drivers/staging/rtl8192u/r819xU_cmdpkt.c b/drivers/staging/rtl8192u/r819xU_cmdpkt.c
index 5bc361b16d4c..56144014b7c9 100644
--- a/drivers/staging/rtl8192u/r819xU_cmdpkt.c
+++ b/drivers/staging/rtl8192u/r819xU_cmdpkt.c
@@ -37,6 +37,8 @@ rt_status SendTxCommandPacket(struct net_device *dev, void *pData, u32 DataLen)
        /* Get TCB and local buffer from common pool.
           (It is shared by CmdQ, MgntQ, and USB coalesce DataQ) */
        skb  = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4);
+        if (!skb)
+                return RT_STATUS_FAILURE;
        memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
        tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
        tcb_desc->queue_index = TXCMD_QUEUE;
diff --git a/drivers/staging/vt6656/card.c b/drivers/staging/vt6656/card.c
index dbf11ecb794e..19d3cf451b88 100644
--- a/drivers/staging/vt6656/card.c
+++ b/drivers/staging/vt6656/card.c
@@ -172,8 +172,8 @@ static u16 swGetOFDMControlRate(struct vnt_private *pDevice, u16 wRateIdx)
        if (!CARDbIsOFDMinBasicRate(pDevice)) {
                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
                        "swGetOFDMControlRate:(NO OFDM) %d\n", wRateIdx);
-        if (wRateIdx > RATE_24M)
+                if (wRateIdx > RATE_24M)
-                wRateIdx = RATE_24M;
+                        wRateIdx = RATE_24M;
                return wRateIdx;
        }
diff --git a/drivers/staging/vt6656/iwctl.c b/drivers/staging/vt6656/iwctl.c
index d0cf7d8a20e5..8872e0f84f40 100644
--- a/drivers/staging/vt6656/iwctl.c
+++ b/drivers/staging/vt6656/iwctl.c
@@ -1634,6 +1634,9 @@ int iwctl_siwencodeext(struct net_device *dev, struct iw_request_info *info,
        if (pMgmt == NULL)
                return -EFAULT;
+        if (!(pDevice->flags & DEVICE_FLAGS_OPENED))
+                return -ENODEV;
        buf = kzalloc(sizeof(struct viawget_wpa_param), GFP_KERNEL);
        if (buf == NULL)
                return -ENOMEM;
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index 536971786ae8..6f9d28182445 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -1098,6 +1098,8 @@ static int device_close(struct net_device *dev)
    memset(pMgmt->abyCurrBSSID, 0, 6);
    pMgmt->eCurrState = WMAC_STATE_IDLE;
+        pDevice->flags &= ~DEVICE_FLAGS_OPENED;
    device_free_tx_bufs(pDevice);
    device_free_rx_bufs(pDevice);
    device_free_int_bufs(pDevice);
@@ -1109,7 +1111,6 @@ static int device_close(struct net_device *dev)
    usb_free_urb(pDevice->pInterruptURB);
    BSSvClearNodeDBTable(pDevice, 0);
-    pDevice->flags &=(~DEVICE_FLAGS_OPENED);
    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "device_close2 \n");
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index fb743a8811bb..14f3e852215d 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -148,6 +148,8 @@ static void *s_vGetFreeContext(struct vnt_private *pDevice)
    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"GetFreeContext()\n");
    for (ii = 0; ii < pDevice->cbTD; ii++) {
+        if (!pDevice->apTD[ii])
+                return NULL;
        pContext = pDevice->apTD[ii];
        if (pContext->bBoolInUse == false) {
            pContext->bBoolInUse = true;
diff --git a/drivers/staging/xillybus/xillybus_core.c b/drivers/staging/xillybus/xillybus_core.c
index efc56987a60b..7db6f03a0054 100644
--- a/drivers/staging/xillybus/xillybus_core.c
+++ b/drivers/staging/xillybus/xillybus_core.c
@@ -2054,7 +2054,7 @@ static int xillybus_init_chrdev(struct xilly_endpoint *endpoint,
                                       NULL,
                                       MKDEV(major, i),
                                       NULL,
-                                       devname);
+                                       "%s", devname);
                if (IS_ERR(device)) {
                        pr_warn("xillybus: Failed to create %s "
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index 91d94b564433..2c4ed52ca849 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -981,4 +981,3 @@ MODULE_PARM_DESC(num_devices, "Number of zram devices");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Nitin Gupta <ngupta@vflare.org>");
 MODULE_DESCRIPTION("Compressed RAM Block Device");
-MODULE_ALIAS("devname:zram");
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 35b61f7d6c63..38e44b9abf0f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -753,7 +753,8 @@ static void iscsit_unmap_iovec(struct iscsi_cmd *cmd)
 static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
 {
-        struct iscsi_cmd *cmd;
+        LIST_HEAD(ack_list);
+        struct iscsi_cmd *cmd, *cmd_p;
        conn->exp_statsn = exp_statsn;
@@ -761,19 +762,23 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
                return;
        spin_lock_bh(&conn->cmd_lock);
-        list_for_each_entry(cmd, &conn->conn_cmd_list, i_conn_node) {
+        list_for_each_entry_safe(cmd, cmd_p, &conn->conn_cmd_list, i_conn_node) {
                spin_lock(&cmd->istate_lock);
                if ((cmd->i_state == ISTATE_SENT_STATUS) &&
                    iscsi_sna_lt(cmd->stat_sn, exp_statsn)) {
                        cmd->i_state = ISTATE_REMOVE;
                        spin_unlock(&cmd->istate_lock);
-                        iscsit_add_cmd_to_immediate_queue(cmd, conn,
+                        list_move_tail(&cmd->i_conn_node, &ack_list);
-                                                cmd->i_state);
                        continue;
                }
                spin_unlock(&cmd->istate_lock);
        }
        spin_unlock_bh(&conn->cmd_lock);
+        list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
+                list_del(&cmd->i_conn_node);
+                iscsit_free_cmd(cmd, false);
+        }
 }
 static int iscsit_allocate_iovecs(struct iscsi_cmd *cmd)
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 14d1aed5af1d..ef6d836a4d09 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -1192,7 +1192,7 @@ get_target:
         */
 alloc_tags:
        tag_num = max_t(u32, ISCSIT_MIN_TAGS, queue_depth);
-        tag_num += ISCSIT_EXTRA_TAGS;
+        tag_num += (tag_num / 2) + ISCSIT_EXTRA_TAGS;
        tag_size = sizeof(struct iscsi_cmd) + conn->conn_transport->priv_size;
        ret = transport_alloc_session_tags(sess->se_sess, tag_num, tag_size);
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index f2de28e178fd..b0cac0c342e1 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -736,7 +736,7 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
                 * Fallthrough
                 */
        case ISCSI_OP_SCSI_TMFUNC:
-                rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
+                rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
                if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
                        __iscsit_free_cmd(cmd, true, shutdown);
                        target_put_sess_cmd(se_cmd->se_sess, se_cmd);
@@ -752,7 +752,7 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
                        se_cmd = &cmd->se_cmd;
                        __iscsit_free_cmd(cmd, true, shutdown);
-                        rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
+                        rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
                        if (!rc && shutdown && se_cmd->se_sess) {
                                __iscsit_free_cmd(cmd, true, shutdown);
                                target_put_sess_cmd(se_cmd->se_sess, se_cmd);
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 6c17295e8d7c..4714c6f8da4b 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -349,7 +349,16 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd)
 {
        struct se_device *dev = cmd->se_dev;
-        cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+        /*
+         * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
+         * within target_complete_ok_work() if the command was successfully
+         * sent to the backend driver.
+         */
+        spin_lock_irq(&cmd->t_state_lock);
+        if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status)
+                cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+        spin_unlock_irq(&cmd->t_state_lock);
        /*
         * Unlock ->caw_sem originally obtained during sbc_compare_and_write()
         * before the original READ I/O submission.
@@ -363,7 +372,7 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
 {
        struct se_device *dev = cmd->se_dev;
        struct scatterlist *write_sg = NULL, *sg;
-        unsigned char *buf, *addr;
+        unsigned char *buf = NULL, *addr;
        struct sg_mapping_iter m;
        unsigned int offset = 0, len;
        unsigned int nlbas = cmd->t_task_nolb;
@@ -378,6 +387,15 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
         */
        if (!cmd->t_data_sg || !cmd->t_bidi_data_sg)
                return TCM_NO_SENSE;
+        /*
+         * Immediately exit + release dev->caw_sem if command has already
+         * been failed with a non-zero SCSI status.
+         */
+        if (cmd->scsi_status) {
+                pr_err("compare_and_write_callback: non zero scsi_status:"
+                        " 0x%02x\n", cmd->scsi_status);
+                goto out;
+        }
        buf = kzalloc(cmd->data_length, GFP_KERNEL);
        if (!buf) {
@@ -508,6 +526,12 @@ sbc_compare_and_write(struct se_cmd *cmd)
                cmd->transport_complete_callback = NULL;
                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
        }
+        /*
+         * Reset cmd->data_length to individual block_size in order to not
+         * confuse backend drivers that depend on this value matching the
+         * size of the I/O being submitted.
+         */
+        cmd->data_length = cmd->t_task_nolb * dev->dev_attrib.block_size;
        ret = cmd->execute_rw(cmd, cmd->t_bidi_data_sg, cmd->t_bidi_data_nents,
                              DMA_FROM_DEVICE);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 84747cc1aac0..81e945eefbbd 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -236,17 +236,24 @@ int transport_alloc_session_tags(struct se_session *se_sess,
 {
        int rc;
-        se_sess->sess_cmd_map = kzalloc(tag_num * tag_size, GFP_KERNEL);
+        se_sess->sess_cmd_map = kzalloc(tag_num * tag_size,
+                                        GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
        if (!se_sess->sess_cmd_map) {
-                pr_err("Unable to allocate se_sess->sess_cmd_map\n");
+                se_sess->sess_cmd_map = vzalloc(tag_num * tag_size);
-                return -ENOMEM;
+                if (!se_sess->sess_cmd_map) {
+                        pr_err("Unable to allocate se_sess->sess_cmd_map\n");
+                        return -ENOMEM;
+                }
        }
        rc = percpu_ida_init(&se_sess->sess_tag_pool, tag_num);
        if (rc < 0) {
                pr_err("Unable to init se_sess->sess_tag_pool,"
                        " tag_num: %u\n", tag_num);
-                kfree(se_sess->sess_cmd_map);
+                if (is_vmalloc_addr(se_sess->sess_cmd_map))
+                        vfree(se_sess->sess_cmd_map);
+                else
+                        kfree(se_sess->sess_cmd_map);
                se_sess->sess_cmd_map = NULL;
                return -ENOMEM;
        }
@@ -412,7 +419,10 @@ void transport_free_session(struct se_session *se_sess)
 {
        if (se_sess->sess_cmd_map) {
                percpu_ida_destroy(&se_sess->sess_tag_pool);
-                kfree(se_sess->sess_cmd_map);
+                if (is_vmalloc_addr(se_sess->sess_cmd_map))
+                        vfree(se_sess->sess_cmd_map);
+                else
+                        kfree(se_sess->sess_cmd_map);
        }
        kmem_cache_free(se_sess_cache, se_sess);
 }
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 4d22e7d2adca..3da4fd10b9f8 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -298,8 +298,8 @@ static int target_xcopy_parse_segdesc_02(struct se_cmd *se_cmd, struct xcopy_op
                (unsigned long long)xop->dst_lba);
        if (dc != 0) {
-                xop->dbl = (desc[29] << 16) & 0xff;
+                xop->dbl = (desc[29] & 0xff) << 16;
-                xop->dbl |= (desc[30] << 8) & 0xff;
+                xop->dbl |= (desc[30] & 0xff) << 8;
                xop->dbl |= desc[31] & 0xff;
                pr_debug("XCOPY seg desc 0x02: DC=1 w/ dbl: %u\n", xop->dbl);
diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index e61c36cbb866..c193af6a628f 100644
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -636,6 +636,7 @@ struct console xenboot_console = {
        .name           = "xenboot",
        .write          = xenboot_write_console,
        .flags          = CON_PRINTBUFFER | CON_BOOT | CON_ANYTIME,
+        .index          = -1,
 };
 #endif  /* CONFIG_EARLY_PRINTK */
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index c9a9ddd1d0bc..7a744b69c3d1 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1758,8 +1758,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
                canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
        if (canon_change) {
                bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
-                ldata->line_start = 0;
+                ldata->line_start = ldata->canon_head = ldata->read_tail;
-                ldata->canon_head = ldata->read_tail;
                ldata->erasing = 0;
                ldata->lnext = 0;
        }
@@ -2184,28 +2183,34 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                if (!input_available_p(tty, 0)) {
                        if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
-                                retval = -EIO;
+                                up_read(&tty->termios_rwsem);
-                                break;
+                                tty_flush_to_ldisc(tty);
-                        }
+                                down_read(&tty->termios_rwsem);
-                        if (tty_hung_up_p(file))
+                                if (!input_available_p(tty, 0)) {
-                                break;
+                                        retval = -EIO;
-                        if (!timeout)
+                                        break;
-                                break;
+                                }
-                        if (file->f_flags & O_NONBLOCK) {
+                        } else {
-                                retval = -EAGAIN;
+                                if (tty_hung_up_p(file))
-                                break;
+                                        break;
-                        }
+                                if (!timeout)
-                        if (signal_pending(current)) {
+                                        break;
-                                retval = -ERESTARTSYS;
+                                if (file->f_flags & O_NONBLOCK) {
-                                break;
+                                        retval = -EAGAIN;
-                        }
+                                        break;
-                        n_tty_set_room(tty);
+                                }
-                        up_read(&tty->termios_rwsem);
+                                if (signal_pending(current)) {
+                                        retval = -ERESTARTSYS;
+                                        break;
+                                }
+                                n_tty_set_room(tty);
+                                up_read(&tty->termios_rwsem);
-                        timeout = schedule_timeout(timeout);
+                                timeout = schedule_timeout(timeout);
-                        down_read(&tty->termios_rwsem);
+                                down_read(&tty->termios_rwsem);
-                        continue;
+                                continue;
+                        }
                }
                __set_current_state(TASK_RUNNING);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index a0ebbc9ce5cd..042aa077b5b3 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1912,9 +1912,6 @@ static int serial_imx_probe_dt(struct imx_port *sport,
        sport->devdata = of_id->data;
-        if (of_device_is_stdout_path(np))
-                add_preferred_console(imx_reg.cons->name, sport->port.line, 0);
        return 0;
 }
 #else
diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index 52379e56a31e..44077c0b7670 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -667,30 +667,21 @@ static int pop_tx_x(struct eg20t_port *priv, unsigned char *buf)
 static int dma_push_rx(struct eg20t_port *priv, int size)
 {
-        struct tty_struct *tty;
        int room;
        struct uart_port *port = &priv->port;
        struct tty_port *tport = &port->state->port;
-        port = &priv->port;
-        tty = tty_port_tty_get(tport);
-        if (!tty) {
-                dev_dbg(priv->port.dev, "%s:tty is busy now", __func__);
-                return 0;
-        }
        room = tty_buffer_request_room(tport, size);
        if (room < size)
                dev_warn(port->dev, "Rx overrun: dropping %u bytes\n",
                         size - room);
        if (!room)
-                return room;
+                return 0;
        tty_insert_flip_string(tport, sg_virt(&priv->sg_rx), size);
        port->icount.rx += room;
-        tty_kref_put(tty);
        return room;
 }
@@ -1098,6 +1089,8 @@ static void pch_uart_err_ir(struct eg20t_port *priv, unsigned int lsr)
        if (tty == NULL) {
                for (i = 0; error_msg[i] != NULL; i++)
                        dev_err(&priv->pdev->dev, error_msg[i]);
+        } else {
+                tty_kref_put(tty);
        }
 }
diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index d0d972f7e43e..0489a2bdcdf9 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -732,7 +732,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data)
 static void tegra_uart_stop_rx(struct uart_port *u)
 {
        struct tegra_uart_port *tup = to_tegra_uport(u);
-        struct tty_struct *tty = tty_port_tty_get(&tup->uport.state->port);
+        struct tty_struct *tty;
        struct tty_port *port = &u->state->port;
        struct dma_tx_state state;
        unsigned long ier;
@@ -744,6 +744,8 @@ static void tegra_uart_stop_rx(struct uart_port *u)
        if (!tup->rx_in_progress)
                return;
+        tty = tty_port_tty_get(&tup->uport.state->port);
        tegra_uart_wait_sym_time(tup, 1); /* wait a character interval */
        ier = tup->ier_shadow;
diff --git a/drivers/tty/serial/vt8500_serial.c b/drivers/tty/serial/vt8500_serial.c
index 93b697a0de65..15ad6fcda88b 100644
--- a/drivers/tty/serial/vt8500_serial.c
+++ b/drivers/tty/serial/vt8500_serial.c
@@ -561,12 +561,13 @@ static int vt8500_serial_probe(struct platform_device *pdev)
        if (!mmres || !irqres)
                return -ENODEV;
-        if (np)
+        if (np) {
                port = of_alias_get_id(np, "serial");
                if (port >= VT8500_MAX_PORTS)
                        port = -1;
-        else
+        } else {
                port = -1;
+        }
        if (port < 0) {
                /* calculate the port id */
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index a9355ce1c6d5..3a1a01af9a80 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -854,7 +854,8 @@ void disassociate_ctty(int on_exit)
                        struct pid *tty_pgrp = tty_get_pgrp(tty);
                        if (tty_pgrp) {
                                kill_pgrp(tty_pgrp, SIGHUP, on_exit);
-                                kill_pgrp(tty_pgrp, SIGCONT, on_exit);
+                                if (!on_exit)
+                                        kill_pgrp(tty_pgrp, SIGCONT, on_exit);
                                put_pid(tty_pgrp);
                        }
                }
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 03ba081c5772..6fd60fece6b4 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -1201,6 +1201,9 @@ int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
                }
                return 0;
        case TCFLSH:
+                retval = tty_check_change(tty);
+                if (retval)
+                        return retval;
                return __tty_perform_flush(tty, arg);
        default:
                /* Try the mode commands */
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index 4a851e15e58c..77b47d82c9a6 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -1,6 +1,6 @@
 config USB_CHIPIDEA
        tristate "ChipIdea Highspeed Dual Role Controller"
-        depends on (USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)
+        depends on ((USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)) && HAS_DMA
        help
          Say Y here if your system has a dual role high speed USB
          controller based on ChipIdea silicon IP. Currently, only the
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 74d998d9b45b..be822a2c1776 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -131,7 +131,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                if (ret) {
                        dev_err(&pdev->dev, "usbmisc init failed, ret=%d\n",
                                        ret);
-                        goto err_clk;
+                        goto err_phy;
                }
        }
@@ -143,7 +143,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                dev_err(&pdev->dev,
                        "Can't register ci_hdrc platform device, err=%d\n",
                        ret);
-                goto err_clk;
+                goto err_phy;
        }
        if (data->usbmisc_data) {
@@ -164,6 +164,9 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
 disable_device:
        ci_hdrc_remove_device(data->ci_pdev);
+err_phy:
+        if (data->phy)
+                usb_phy_shutdown(data->phy);
 err_clk:
        clk_disable_unprepare(data->clk);
        return ret;
diff --git a/drivers/usb/chipidea/ci_hdrc_pci.c b/drivers/usb/chipidea/ci_hdrc_pci.c
index 042320a6c6c7..d514332ac081 100644
--- a/drivers/usb/chipidea/ci_hdrc_pci.c
+++ b/drivers/usb/chipidea/ci_hdrc_pci.c
@@ -129,7 +129,12 @@ static DEFINE_PCI_DEVICE_TABLE(ci_hdrc_pci_id_table) = {
                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0829),
                .driver_data = (kernel_ulong_t)&penwell_pci_platdata,
        },
-        { 0, 0, 0, 0, 0, 0, 0 /* end: all zeroes */ }
+        {
+                /* Intel Clovertrail */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe006),
+                .driver_data = (kernel_ulong_t)&penwell_pci_platdata,
+        },
+        { 0 } /* end: all zeroes */
 };
 MODULE_DEVICE_TABLE(pci, ci_hdrc_pci_id_table);
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 94626409559a..23763dcec069 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -605,6 +605,7 @@ static int ci_hdrc_remove(struct platform_device *pdev)
        dbg_remove_files(ci);
        free_irq(ci->irq, ci);
        ci_role_destroy(ci);
+        kfree(ci->hw_bank.regmap);
        return 0;
 }
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 6f96795dd20c..64d7a6d9a1ad 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -100,8 +100,10 @@ static void host_stop(struct ci_hdrc *ci)
 {
        struct usb_hcd *hcd = ci->hcd;
-        usb_remove_hcd(hcd);
+        if (hcd) {
-        usb_put_hcd(hcd);
+                usb_remove_hcd(hcd);
+                usb_put_hcd(hcd);
+        }
        if (ci->platdata->reg_vbus)
                regulator_disable(ci->platdata->reg_vbus);
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 6b4c2f2eb946..9333083dd111 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1600,6 +1600,8 @@ static void destroy_eps(struct ci_hdrc *ci)
        for (i = 0; i < ci->hw_ep_max; i++) {
                struct ci_hw_ep *hwep = &ci->ci_hw_ep[i];
+                if (hwep->pending_td)
+                        free_pending_td(hwep);
                dma_pool_free(ci->qh_pool, hwep->qh.ptr, hwep->qh.dma);
        }
 }
@@ -1667,13 +1669,13 @@ static int ci_udc_stop(struct usb_gadget *gadget,
                if (ci->platdata->notify_event)
                        ci->platdata->notify_event(ci,
                        CI_HDRC_CONTROLLER_STOPPED_EVENT);
-                ci->driver = NULL;
                spin_unlock_irqrestore(&ci->lock, flags);
                _gadget_stop_activity(&ci->gadget);
                spin_lock_irqsave(&ci->lock, flags);
                pm_runtime_put(&ci->gadget.dev);
        }
+        ci->driver = NULL;
        spin_unlock_irqrestore(&ci->lock, flags);
        return 0;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 737e3c19967b..71dc5d768fa5 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -742,6 +742,22 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
                if ((index & ~USB_DIR_IN) == 0)
                        return 0;
                ret = findintfep(ps->dev, index);
+                if (ret < 0) {
+                        /*
+                         * Some not fully compliant Win apps seem to get
+                         * index wrong and have the endpoint number here
+                         * rather than the endpoint address (with the
+                         * correct direction). Win does let this through,
+                         * so we'll not reject it here but leave it to
+                         * the device to not break KVM. But we warn.
+                         */
+                        ret = findintfep(ps->dev, index ^ 0x80);
+                        if (ret >= 0)
+                                dev_info(&ps->dev->dev,
+                                        "%s: process %i (%s) requesting ep %02x but needs %02x\n",
+                                        __func__, task_pid_nr(current),
+                                        current->comm, index, index ^ 0x80);
+                }
                if (ret >= 0)
                        ret = checkintf(ps, ret);
                break;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index dde4c83516a1..e6b682c6c236 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3426,6 +3426,9 @@ static int usb_req_set_sel(struct usb_device *udev, enum usb3_link_state state)
        unsigned long long u2_pel;
        int ret;
+        if (udev->state != USB_STATE_CONFIGURED)
+                return 0;
        /* Convert SEL and PEL stored in ns to us */
        u1_sel = DIV_ROUND_UP(udev->u1_params.sel, 1000);
        u1_pel = DIV_ROUND_UP(udev->u1_params.pel, 1000);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 5b44cd47da5b..01fe36273f3b 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -97,6 +97,9 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* Alcor Micro Corp. Hub */
        { USB_DEVICE(0x058f, 0x9254), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* MicroTouch Systems touchscreen */
+        { USB_DEVICE(0x0596, 0x051e), .driver_info = USB_QUIRK_RESET_RESUME },
        /* appletouch */
        { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
@@ -130,6 +133,9 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* Broadcom BCM92035DGROM BT dongle */
        { USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* MAYA44USB sound device */
+        { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
        /* Action Semiconductor flash disk */
        { USB_DEVICE(0x10d6, 0x2200), .driver_info =
                        USB_QUIRK_STRING_FETCH_255 },
diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
index b870872e020f..70fc43027a5c 100644
--- a/drivers/usb/dwc3/Kconfig
+++ b/drivers/usb/dwc3/Kconfig
@@ -1,7 +1,6 @@
 config USB_DWC3
        tristate "DesignWare USB3 DRD Core Support"
        depends on (USB || USB_GADGET) && HAS_DMA
-        depends on EXTCON
        select USB_XHCI_PLATFORM if USB_SUPPORT && USB_XHCI_HCD
        help
          Say Y or M here if your system has a Dual Role SuperSpeed
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 9b138129e856..2e252aae51ca 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -28,6 +28,8 @@
 /* FIXME define these in <linux/pci_ids.h> */
 #define PCI_VENDOR_ID_SYNOPSYS          0x16c3
 #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
+#define PCI_DEVICE_ID_INTEL_BYT         0x0f37
+#define PCI_DEVICE_ID_INTEL_MRFLD       0x119e
 struct dwc3_pci {
        struct device           *dev;
@@ -187,6 +189,8 @@ static DEFINE_PCI_DEVICE_TABLE(dwc3_pci_id_table) = {
                PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS,
                                PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3),
        },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
        {  }    /* Terminating Entry */
 };
 MODULE_DEVICE_TABLE(pci, dwc3_pci_id_table);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index f168eaebdef8..5452c0fce360 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2611,15 +2611,13 @@ int dwc3_gadget_init(struct dwc3 *dwc)
        ret = usb_add_gadget_udc(dwc->dev, &dwc->gadget);
        if (ret) {
                dev_err(dwc->dev, "failed to register udc\n");
-                goto err5;
+                goto err4;
        }
        return 0;
-err5:
-        dwc3_gadget_free_endpoints(dwc);
 err4:
+        dwc3_gadget_free_endpoints(dwc);
        dma_free_coherent(dwc->dev, DWC3_EP0_BOUNCE_SIZE,
                        dwc->ep0_bounce, dwc->ep0_bounce_addr);
diff --git a/drivers/usb/gadget/cdc2.c b/drivers/usb/gadget/cdc2.c
index 5a5acf22c694..e126b6b248e6 100644
--- a/drivers/usb/gadget/cdc2.c
+++ b/drivers/usb/gadget/cdc2.c
@@ -113,12 +113,6 @@ static int __init cdc_do_config(struct usb_configuration *c)
                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
        }
-        fi_ecm = usb_get_function_instance("ecm");
-        if (IS_ERR(fi_ecm)) {
-                status = PTR_ERR(fi_ecm);
-                goto err_func_ecm;
-        }
        f_ecm = usb_get_function(fi_ecm);
        if (IS_ERR(f_ecm)) {
                status = PTR_ERR(f_ecm);
@@ -129,35 +123,24 @@ static int __init cdc_do_config(struct usb_configuration *c)
        if (status)
                goto err_add_ecm;
-        fi_serial = usb_get_function_instance("acm");
-        if (IS_ERR(fi_serial)) {
-                status = PTR_ERR(fi_serial);
-                goto err_get_acm;
-        }
        f_acm = usb_get_function(fi_serial);
        if (IS_ERR(f_acm)) {
                status = PTR_ERR(f_acm);
-                goto err_func_acm;
+                goto err_get_acm;
        }
        status = usb_add_function(c, f_acm);
        if (status)
                goto err_add_acm;
        return 0;
 err_add_acm:
        usb_put_function(f_acm);
-err_func_acm:
-        usb_put_function_instance(fi_serial);
 err_get_acm:
        usb_remove_function(c, f_ecm);
 err_add_ecm:
        usb_put_function(f_ecm);
 err_get_ecm:
-        usb_put_function_instance(fi_ecm);
-err_func_ecm:
        return status;
 }
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 06ecd08fd57a..b8a2376971a4 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -923,8 +923,9 @@ static int dummy_udc_stop(struct usb_gadget *g,
        struct dummy_hcd        *dum_hcd = gadget_to_dummy_hcd(g);
        struct dummy            *dum = dum_hcd->dum;
-        dev_dbg(udc_dev(dum), "unregister gadget driver '%s'\n",
+        if (driver)
-                        driver->driver.name);
+                dev_dbg(udc_dev(dum), "unregister gadget driver '%s'\n",
+                                driver->driver.name);
        dum->driver = NULL;
@@ -1000,8 +1001,8 @@ static int dummy_udc_remove(struct platform_device *pdev)
 {
        struct dummy    *dum = platform_get_drvdata(pdev);
-        usb_del_gadget_udc(&dum->gadget);
        device_remove_file(&dum->gadget.dev, &dev_attr_function);
+        usb_del_gadget_udc(&dum->gadget);
        return 0;
 }
diff --git a/drivers/usb/gadget/f_ecm.c b/drivers/usb/gadget/f_ecm.c
index edab45da3741..8d9e6f7e8f1a 100644
--- a/drivers/usb/gadget/f_ecm.c
+++ b/drivers/usb/gadget/f_ecm.c
@@ -995,7 +995,7 @@ static void ecm_unbind(struct usb_configuration *c, struct usb_function *f)
        usb_ep_free_request(ecm->notify, ecm->notify_req);
 }
-struct usb_function *ecm_alloc(struct usb_function_instance *fi)
+static struct usb_function *ecm_alloc(struct usb_function_instance *fi)
 {
        struct f_ecm    *ecm;
        struct f_ecm_opts *opts;
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index d00392d879db..d61c11d765d0 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -624,7 +624,7 @@ static void eem_unbind(struct usb_configuration *c, struct usb_function *f)
        usb_free_all_descriptors(f);
 }
-struct usb_function *eem_alloc(struct usb_function_instance *fi)
+static struct usb_function *eem_alloc(struct usb_function_instance *fi)
 {
        struct f_eem    *eem;
        struct f_eem_opts *opts;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 1a66c5baa0d1..44cf775a8627 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1034,37 +1034,19 @@ struct ffs_sb_fill_data {
        struct ffs_file_perms perms;
        umode_t root_mode;
        const char *dev_name;
-        union {
+        struct ffs_data *ffs_data;
-                /* set by ffs_fs_mount(), read by ffs_sb_fill() */
-                void *private_data;
-                /* set by ffs_sb_fill(), read by ffs_fs_mount */
-                struct ffs_data *ffs_data;
-        };
 };
 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
 {
        struct ffs_sb_fill_data *data = _data;
        struct inode    *inode;
-        struct ffs_data *ffs;
+        struct ffs_data *ffs = data->ffs_data;
        ENTER();
-        /* Initialise data */
-        ffs = ffs_data_new();
-        if (unlikely(!ffs))
-                goto Enomem;
        ffs->sb              = sb;
-        ffs->dev_name        = kstrdup(data->dev_name, GFP_KERNEL);
+        data->ffs_data       = NULL;
-        if (unlikely(!ffs->dev_name))
-                goto Enomem;
-        ffs->file_perms      = data->perms;
-        ffs->private_data    = data->private_data;
-        /* used by the caller of this function */
-        data->ffs_data       = ffs;
        sb->s_fs_info        = ffs;
        sb->s_blocksize      = PAGE_CACHE_SIZE;
        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
@@ -1080,17 +1062,14 @@ static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
                                  &data->perms);
        sb->s_root = d_make_root(inode);
        if (unlikely(!sb->s_root))
-                goto Enomem;
+                return -ENOMEM;
        /* EP0 file */
        if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
                                         &ffs_ep0_operations, NULL)))
-                goto Enomem;
+                return -ENOMEM;
        return 0;
-Enomem:
-        return -ENOMEM;
 }
 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
@@ -1193,6 +1172,7 @@ ffs_fs_mount(struct file_system_type *t, int flags,
        struct dentry *rv;
        int ret;
        void *ffs_dev;
+        struct ffs_data *ffs;
        ENTER();
@@ -1200,18 +1180,30 @@ ffs_fs_mount(struct file_system_type *t, int flags,
        if (unlikely(ret < 0))
                return ERR_PTR(ret);
+        ffs = ffs_data_new();
+        if (unlikely(!ffs))
+                return ERR_PTR(-ENOMEM);
+        ffs->file_perms = data.perms;
+        ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
+        if (unlikely(!ffs->dev_name)) {
+                ffs_data_put(ffs);
+                return ERR_PTR(-ENOMEM);
+        }
        ffs_dev = functionfs_acquire_dev_callback(dev_name);
-        if (IS_ERR(ffs_dev))
+        if (IS_ERR(ffs_dev)) {
-                return ffs_dev;
+                ffs_data_put(ffs);
+                return ERR_CAST(ffs_dev);
+        }
+        ffs->private_data = ffs_dev;
+        data.ffs_data = ffs;
-        data.dev_name = dev_name;
-        data.private_data = ffs_dev;
        rv = mount_nodev(t, flags, &data, ffs_sb_fill);
+        if (IS_ERR(rv) && data.ffs_data) {
-        /* data.ffs_data is set by ffs_sb_fill */
-        if (IS_ERR(rv))
                functionfs_release_dev_callback(data.ffs_data);
+                ffs_data_put(data.ffs_data);
+        }
        return rv;
 }
@@ -2264,6 +2256,8 @@ static int ffs_func_bind(struct usb_configuration *c,
                                   data->raw_descs + ret,
                                   (sizeof data->raw_descs) - ret,
                                   __ffs_func_bind_do_descs, func);
+                if (unlikely(ret < 0))
+                        goto error;
        }
        /*
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 313b835eedfd..a01d7d38c016 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -2260,10 +2260,12 @@ reset:
                /* Disable the endpoints */
                if (fsg->bulk_in_enabled) {
                        usb_ep_disable(fsg->bulk_in);
+                        fsg->bulk_in->driver_data = NULL;
                        fsg->bulk_in_enabled = 0;
                }
                if (fsg->bulk_out_enabled) {
                        usb_ep_disable(fsg->bulk_out);
+                        fsg->bulk_out->driver_data = NULL;
                        fsg->bulk_out_enabled = 0;
                }
diff --git a/drivers/usb/gadget/fotg210-udc.c b/drivers/usb/gadget/fotg210-udc.c
index 32db2eee2d87..bbbfd1948778 100644
--- a/drivers/usb/gadget/fotg210-udc.c
+++ b/drivers/usb/gadget/fotg210-udc.c
@@ -1214,6 +1214,6 @@ static struct platform_driver fotg210_driver = {
 module_platform_driver(fotg210_driver);
-MODULE_AUTHOR("Yuan-Hsin Chen <yhchen@faraday-tech.com>");
+MODULE_AUTHOR("Yuan-Hsin Chen, Feng-Hsin Chiang <john453@faraday-tech.com>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/usb/gadget/fusb300_udc.c b/drivers/usb/gadget/fusb300_udc.c
index f1dd6daabe21..b278abe52453 100644
--- a/drivers/usb/gadget/fusb300_udc.c
+++ b/drivers/usb/gadget/fusb300_udc.c
@@ -22,7 +22,7 @@
 MODULE_DESCRIPTION("FUSB300  USB gadget driver");
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Yuan Hsin Chen <yhchen@faraday-tech.com>");
+MODULE_AUTHOR("Yuan-Hsin Chen, Feng-Hsin Chiang <john453@faraday-tech.com>");
 MODULE_ALIAS("platform:fusb300_udc");
 #define DRIVER_VERSION  "20 October 2010"
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 2a1ebefd8f9e..23393254a8a3 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -179,7 +179,7 @@ err_conf:
        return ret;
 }
-static int rndis_config_register(struct usb_composite_dev *cdev)
+static __ref int rndis_config_register(struct usb_composite_dev *cdev)
 {
        static struct usb_configuration config = {
                .bConfigurationValue    = MULTI_RNDIS_CONFIG_NUM,
@@ -194,7 +194,7 @@ static int rndis_config_register(struct usb_composite_dev *cdev)
 #else
-static int rndis_config_register(struct usb_composite_dev *cdev)
+static __ref int rndis_config_register(struct usb_composite_dev *cdev)
 {
        return 0;
 }
@@ -241,7 +241,7 @@ err_conf:
        return ret;
 }
-static int cdc_config_register(struct usb_composite_dev *cdev)
+static __ref int cdc_config_register(struct usb_composite_dev *cdev)
 {
        static struct usb_configuration config = {
                .bConfigurationValue    = MULTI_CDC_CONFIG_NUM,
@@ -256,7 +256,7 @@ static int cdc_config_register(struct usb_composite_dev *cdev)
 #else
-static int cdc_config_register(struct usb_composite_dev *cdev)
+static __ref int cdc_config_register(struct usb_composite_dev *cdev)
 {
        return 0;
 }
diff --git a/drivers/usb/gadget/mv_u3d_core.c b/drivers/usb/gadget/mv_u3d_core.c
index bbb6e98c4384..561b30efb8ee 100644
--- a/drivers/usb/gadget/mv_u3d_core.c
+++ b/drivers/usb/gadget/mv_u3d_core.c
@@ -645,6 +645,7 @@ static int  mv_u3d_ep_disable(struct usb_ep *_ep)
        struct mv_u3d_ep *ep;
        struct mv_u3d_ep_context *ep_context;
        u32 epxcr, direction;
+        unsigned long flags;
        if (!_ep)
                return -EINVAL;
@@ -661,7 +662,9 @@ static int  mv_u3d_ep_disable(struct usb_ep *_ep)
        direction = mv_u3d_ep_dir(ep);
        /* nuke all pending requests (does flush) */
+        spin_lock_irqsave(&u3d->lock, flags);
        mv_u3d_nuke(ep, -ESHUTDOWN);
+        spin_unlock_irqrestore(&u3d->lock, flags);
        /* Disable the endpoint for Rx or Tx and reset the endpoint type */
        if (direction == MV_U3D_EP_DIR_OUT) {
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index cc9207473dbc..0ac6064aa3b8 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -2054,7 +2054,7 @@ static struct pxa25x_udc memory = {
 /*
 *      probe - binds to the platform device
 */
-static int __init pxa25x_udc_probe(struct platform_device *pdev)
+static int pxa25x_udc_probe(struct platform_device *pdev)
 {
        struct pxa25x_udc *dev = &memory;
        int retval, irq;
@@ -2203,7 +2203,7 @@ static void pxa25x_udc_shutdown(struct platform_device *_dev)
        pullup_off();
 }
-static int __exit pxa25x_udc_remove(struct platform_device *pdev)
+static int pxa25x_udc_remove(struct platform_device *pdev)
 {
        struct pxa25x_udc *dev = platform_get_drvdata(pdev);
@@ -2294,7 +2294,8 @@ static int pxa25x_udc_resume(struct platform_device *dev)
 static struct platform_driver udc_driver = {
        .shutdown       = pxa25x_udc_shutdown,
-        .remove         = __exit_p(pxa25x_udc_remove),
+        .probe          = pxa25x_udc_probe,
+        .remove         = pxa25x_udc_remove,
        .suspend        = pxa25x_udc_suspend,
        .resume         = pxa25x_udc_resume,
        .driver         = {
@@ -2303,7 +2304,7 @@ static struct platform_driver udc_driver = {
        },
 };
-module_platform_driver_probe(udc_driver, pxa25x_udc_probe);
+module_platform_driver(udc_driver);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR("Frank Becker, Robert Schwebel, David Brownell");
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index d69b36a99dbc..a8a99e4748d5 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -543,7 +543,7 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
         * FIFO, requests of >512 cause the endpoint to get stuck with a
         * fragment of the end of the transfer in it.
         */
-        if (can_write > 512)
+        if (can_write > 512 && !periodic)
                can_write = 512;
        /*
@@ -2475,8 +2475,6 @@ irq_retry:
        if (gintsts & GINTSTS_ErlySusp) {
                dev_dbg(hsotg->dev, "GINTSTS_ErlySusp\n");
                writel(GINTSTS_ErlySusp, hsotg->regs + GINTSTS);
-                s3c_hsotg_disconnect(hsotg);
        }
        /*
@@ -2962,9 +2960,6 @@ static int s3c_hsotg_udc_stop(struct usb_gadget *gadget,
        if (!hsotg)
                return -ENODEV;
-        if (!driver || driver != hsotg->driver || !driver->unbind)
-                return -EINVAL;
        /* all endpoints should be shutdown */
        for (ep = 0; ep < hsotg->num_of_eps; ep++)
                s3c_hsotg_ep_disable(&hsotg->eps[ep].ep);
@@ -2972,15 +2967,15 @@ static int s3c_hsotg_udc_stop(struct usb_gadget *gadget,
        spin_lock_irqsave(&hsotg->lock, flags);
        s3c_hsotg_phy_disable(hsotg);
-        regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies), hsotg->supplies);
-        hsotg->driver = NULL;
+        if (!driver)
+                hsotg->driver = NULL;
        hsotg->gadget.speed = USB_SPEED_UNKNOWN;
        spin_unlock_irqrestore(&hsotg->lock, flags);
-        dev_info(hsotg->dev, "unregistered gadget driver '%s'\n",
+        regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies), hsotg->supplies);
-                 driver->driver.name);
        return 0;
 }
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 947b009009f1..f2407b2e8a99 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -130,7 +130,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
        }
        /* Enable USB controller, 83xx or 8536 */
-        if (pdata->have_sysif_regs)
+        if (pdata->have_sysif_regs && pdata->controller_ver < FSL_USB_VER_1_6)
                setbits32(hcd->regs + FSL_SOC_USB_CTRL, 0x4);
        /* Don't need to set host mode here. It will be done by tdi_reset() */
@@ -232,15 +232,9 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
        case FSL_USB2_PHY_ULPI:
                if (pdata->have_sysif_regs && pdata->controller_ver) {
                        /* controller version 1.6 or above */
+                        clrbits32(non_ehci + FSL_SOC_USB_CTRL, UTMI_PHY_EN);
                        setbits32(non_ehci + FSL_SOC_USB_CTRL,
-                                        ULPI_PHY_CLK_SEL);
+                                ULPI_PHY_CLK_SEL | USB_CTRL_USB_EN);
-                        /*
-                         * Due to controller issue of PHY_CLK_VALID in ULPI
-                         * mode, we set USB_CTRL_USB_EN before checking
-                         * PHY_CLK_VALID, otherwise PHY_CLK_VALID doesn't work.
-                         */
-                        clrsetbits_be32(non_ehci + FSL_SOC_USB_CTRL,
-                                        UTMI_PHY_EN, USB_CTRL_USB_EN);
                }
                portsc |= PORT_PTS_ULPI;
                break;
@@ -270,8 +264,9 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
        if (pdata->have_sysif_regs && pdata->controller_ver &&
            (phy_mode == FSL_USB2_PHY_ULPI)) {
                /* check PHY_CLK_VALID to get phy clk valid */
-                if (!spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
+                if (!(spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
-                                PHY_CLK_VALID, FSL_USB_PHY_CLK_TIMEOUT, 0)) {
+                                PHY_CLK_VALID, FSL_USB_PHY_CLK_TIMEOUT, 0) ||
+                                in_be32(non_ehci + FSL_SOC_USB_PRICTRL))) {
                        printk(KERN_WARNING "fsl-ehci: USB PHY clock invalid\n");
                        return -EINVAL;
                }
@@ -669,7 +664,7 @@ static const struct hc_driver ehci_fsl_hc_driver = {
         * generic hardware linkage
         */
        .irq = ehci_irq,
-        .flags = HCD_USB2 | HCD_MEMORY | HCD_BH,
+        .flags = HCD_USB2 | HCD_MEMORY,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-grlib.c b/drivers/usb/host/ehci-grlib.c
index b52a66ce92e8..83ab51af250f 100644
--- a/drivers/usb/host/ehci-grlib.c
+++ b/drivers/usb/host/ehci-grlib.c
@@ -43,7 +43,7 @@ static const struct hc_driver ehci_grlib_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags                  = HCD_MEMORY | HCD_USB2,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 5d6022f30ebe..86ab9fd9fe9e 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1158,7 +1158,7 @@ static const struct hc_driver ehci_hc_driver = {
         * generic hardware linkage
         */
        .irq =                  ehci_irq,
-        .flags =                HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags =                HCD_MEMORY | HCD_USB2,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index 417c10da9450..35cdbd88bbbe 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -96,7 +96,7 @@ static const struct hc_driver mv_ehci_hc_driver = {
         * generic hardware linkage
         */
        .irq = ehci_irq,
-        .flags = HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags = HCD_MEMORY | HCD_USB2,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-octeon.c b/drivers/usb/host/ehci-octeon.c
index ab0397e4d8f3..45cc00158412 100644
--- a/drivers/usb/host/ehci-octeon.c
+++ b/drivers/usb/host/ehci-octeon.c
@@ -51,7 +51,7 @@ static const struct hc_driver ehci_octeon_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags                  = HCD_MEMORY | HCD_USB2,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 6bd299e61f58..854c2ec7b699 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -361,7 +361,7 @@ static struct pci_driver ehci_pci_driver = {
        .remove =       usb_hcd_pci_remove,
        .shutdown =     usb_hcd_pci_shutdown,
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        .driver =       {
                .pm =   &usb_hcd_pci_pm_ops
        },
diff --git a/drivers/usb/host/ehci-pmcmsp.c b/drivers/usb/host/ehci-pmcmsp.c
index 893b707f0000..601e208bd782 100644
--- a/drivers/usb/host/ehci-pmcmsp.c
+++ b/drivers/usb/host/ehci-pmcmsp.c
@@ -286,7 +286,7 @@ static const struct hc_driver ehci_msp_hc_driver = {
 #else
        .irq =                  ehci_irq,
 #endif
-        .flags =                HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags =                HCD_MEMORY | HCD_USB2,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c
index 6cc5567bf9c8..932293fa32de 100644
--- a/drivers/usb/host/ehci-ppc-of.c
+++ b/drivers/usb/host/ehci-ppc-of.c
@@ -28,7 +28,7 @@ static const struct hc_driver ehci_ppc_of_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags                  = HCD_MEMORY | HCD_USB2,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-ps3.c b/drivers/usb/host/ehci-ps3.c
index 8188542ba17e..fd983771b025 100644
--- a/drivers/usb/host/ehci-ps3.c
+++ b/drivers/usb/host/ehci-ps3.c
@@ -71,7 +71,7 @@ static const struct hc_driver ps3_ehci_hc_driver = {
        .product_desc           = "PS3 EHCI Host Controller",
        .hcd_priv_size          = sizeof(struct ehci_hcd),
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags                  = HCD_MEMORY | HCD_USB2,
        .reset                  = ps3_ehci_hc_reset,
        .start                  = ehci_run,
        .stop                   = ehci_stop,
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index e321804c3475..a7f776a13eb1 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -247,6 +247,8 @@ static int qtd_copy_status (
 static void
 ehci_urb_done(struct ehci_hcd *ehci, struct urb *urb, int status)
+__releases(ehci->lock)
+__acquires(ehci->lock)
 {
        if (usb_pipetype(urb->pipe) == PIPE_INTERRUPT) {
                /* ... update hc-wide periodic stats */
@@ -272,8 +274,11 @@ ehci_urb_done(struct ehci_hcd *ehci, struct urb *urb, int status)
                urb->actual_length, urb->transfer_buffer_length);
 #endif
+        /* complete() can reenter this HCD */
        usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+        spin_unlock (&ehci->lock);
        usb_hcd_giveback_urb(ehci_to_hcd(ehci), urb, status);
+        spin_lock (&ehci->lock);
 }
 static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh);
diff --git a/drivers/usb/host/ehci-sead3.c b/drivers/usb/host/ehci-sead3.c
index 8a734498079b..b2de52d39614 100644
--- a/drivers/usb/host/ehci-sead3.c
+++ b/drivers/usb/host/ehci-sead3.c
@@ -55,7 +55,7 @@ const struct hc_driver ehci_sead3_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags                  = HCD_MEMORY | HCD_USB2,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-sh.c b/drivers/usb/host/ehci-sh.c
index dc899eb2b861..93e59a13bc1f 100644
--- a/drivers/usb/host/ehci-sh.c
+++ b/drivers/usb/host/ehci-sh.c
@@ -36,7 +36,7 @@ static const struct hc_driver ehci_sh_hc_driver = {
         * generic hardware linkage
         */
        .irq                            = ehci_irq,
-        .flags                          = HCD_USB2 | HCD_MEMORY | HCD_BH,
+        .flags                          = HCD_USB2 | HCD_MEMORY,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-tilegx.c b/drivers/usb/host/ehci-tilegx.c
index 67026ffbf9a8..cca4be90a864 100644
--- a/drivers/usb/host/ehci-tilegx.c
+++ b/drivers/usb/host/ehci-tilegx.c
@@ -61,7 +61,7 @@ static const struct hc_driver ehci_tilegx_hc_driver = {
         * Generic hardware linkage.
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags                  = HCD_MEMORY | HCD_USB2,
        /*
         * Basic lifecycle operations.
diff --git a/drivers/usb/host/ehci-w90x900.c b/drivers/usb/host/ehci-w90x900.c
index 1c370dfbee0d..59e0e24c753f 100644
--- a/drivers/usb/host/ehci-w90x900.c
+++ b/drivers/usb/host/ehci-w90x900.c
@@ -108,7 +108,7 @@ static const struct hc_driver ehci_w90x900_hc_driver = {
         * generic hardware linkage
         */
        .irq = ehci_irq,
-        .flags = HCD_USB2|HCD_MEMORY|HCD_BH,
+        .flags = HCD_USB2|HCD_MEMORY,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/ehci-xilinx-of.c b/drivers/usb/host/ehci-xilinx-of.c
index 95979f9f4381..eba962e6ebfb 100644
--- a/drivers/usb/host/ehci-xilinx-of.c
+++ b/drivers/usb/host/ehci-xilinx-of.c
@@ -79,7 +79,7 @@ static const struct hc_driver ehci_xilinx_of_hc_driver = {
         * generic hardware linkage
         */
        .irq                    = ehci_irq,
-        .flags                  = HCD_MEMORY | HCD_USB2 | HCD_BH,
+        .flags                  = HCD_MEMORY | HCD_USB2,
        /*
         * basic lifecycle operations
diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
index 9e0020d9e4c8..abd5050a4899 100644
--- a/drivers/usb/host/fsl-mph-dr-of.c
+++ b/drivers/usb/host/fsl-mph-dr-of.c
@@ -24,7 +24,7 @@ struct fsl_usb2_dev_data {
        enum fsl_usb2_operating_modes op_mode;  /* operating mode */
 };
-struct fsl_usb2_dev_data dr_mode_data[] = {
+static struct fsl_usb2_dev_data dr_mode_data[] = {
        {
                .dr_mode = "host",
                .drivers = { "fsl-ehci", NULL, NULL, },
@@ -42,7 +42,7 @@ struct fsl_usb2_dev_data dr_mode_data[] = {
        },
 };
-struct fsl_usb2_dev_data *get_dr_mode_data(struct device_node *np)
+static struct fsl_usb2_dev_data *get_dr_mode_data(struct device_node *np)
 {
        const unsigned char *prop;
        int i;
@@ -75,7 +75,7 @@ static enum fsl_usb2_phy_modes determine_usb_phy(const char *phy_type)
        return FSL_USB2_PHY_NONE;
 }
-struct platform_device *fsl_usb2_device_register(
+static struct platform_device *fsl_usb2_device_register(
                                        struct platform_device *ofdev,
                                        struct fsl_usb2_platform_data *pdata,
                                        const char *name, int id)
diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c
index 60a5de505ca1..adb01d950a16 100644
--- a/drivers/usb/host/imx21-hcd.c
+++ b/drivers/usb/host/imx21-hcd.c
@@ -824,13 +824,13 @@ static int imx21_hc_urb_enqueue_isoc(struct usb_hcd *hcd,
                        i = DIV_ROUND_UP(wrap_frame(
                                        cur_frame - urb->start_frame),
                                        urb->interval);
-                        if (urb->transfer_flags & URB_ISO_ASAP) {
+                        /* Treat underruns as if URB_ISO_ASAP was set */
+                        if ((urb->transfer_flags & URB_ISO_ASAP) ||
+                                        i >= urb->number_of_packets) {
                                urb->start_frame = wrap_frame(urb->start_frame
                                                + i * urb->interval);
                                i = 0;
-                        } else if (i >= urb->number_of_packets) {
-                                ret = -EXDEV;
-                                goto alloc_dmem_failed;
                        }
                }
        }
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 8f6b695af6a4..604cad1bcf9c 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -216,31 +216,26 @@ static int ohci_urb_enqueue (
                        frame &= ~(ed->interval - 1);
                        frame |= ed->branch;
                        urb->start_frame = frame;
+                        ed->last_iso = frame + ed->interval * (size - 1);
                }
        } else if (ed->type == PIPE_ISOCHRONOUS) {
                u16     next = ohci_frame_no(ohci) + 1;
                u16     frame = ed->last_iso + ed->interval;
+                u16     length = ed->interval * (size - 1);
                /* Behind the scheduling threshold? */
                if (unlikely(tick_before(frame, next))) {
-                        /* USB_ISO_ASAP: Round up to the first available slot */
+                        /* URB_ISO_ASAP: Round up to the first available slot */
                        if (urb->transfer_flags & URB_ISO_ASAP) {
                                frame += (next - frame + ed->interval - 1) &
                                                -ed->interval;
                        /*
-                         * Not ASAP: Use the next slot in the stream.  If
+                         * Not ASAP: Use the next slot in the stream,
-                         * the entire URB falls before the threshold, fail.
+                         * no matter what.
                         */
                        } else {
-                                if (tick_before(frame + ed->interval *
-                                        (urb->number_of_packets - 1), next)) {
-                                        retval = -EXDEV;
-                                        usb_hcd_unlink_urb_from_ep(hcd, urb);
-                                        goto fail;
-                                }
                                /*
                                 * Some OHCI hardware doesn't handle late TDs
                                 * correctly.  After retiring them it proceeds
@@ -251,9 +246,16 @@ static int ohci_urb_enqueue (
                                urb_priv->td_cnt = DIV_ROUND_UP(
                                                (u16) (next - frame),
                                                ed->interval);
+                                if (urb_priv->td_cnt >= urb_priv->length) {
+                                        ++urb_priv->td_cnt;     /* Mark it */
+                                        ohci_dbg(ohci, "iso underrun %p (%u+%u < %u)\n",
+                                                        urb, frame, length,
+                                                        next);
+                                }
                        }
                }
                urb->start_frame = frame;
+                ed->last_iso = frame + length;
        }
        /* fill the TDs and link them to the ed; and
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index df4a6707322d..e7f577e63624 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -41,9 +41,13 @@ finish_urb(struct ohci_hcd *ohci, struct urb *urb, int status)
 __releases(ohci->lock)
 __acquires(ohci->lock)
 {
-         struct device *dev = ohci_to_hcd(ohci)->self.controller;
+        struct device *dev = ohci_to_hcd(ohci)->self.controller;
+        struct usb_host_endpoint *ep = urb->ep;
+        struct urb_priv *urb_priv;
        // ASSERT (urb->hcpriv != 0);
+ restart:
        urb_free_priv (ohci, urb->hcpriv);
        urb->hcpriv = NULL;
        if (likely(status == -EINPROGRESS))
@@ -80,6 +84,21 @@ __acquires(ohci->lock)
                ohci->hc_control &= ~(OHCI_CTRL_PLE|OHCI_CTRL_IE);
                ohci_writel (ohci, ohci->hc_control, &ohci->regs->control);
        }
+        /*
+         * An isochronous URB that is sumitted too late won't have any TDs
+         * (marked by the fact that the td_cnt value is larger than the
+         * actual number of TDs).  If the next URB on this endpoint is like
+         * that, give it back now.
+         */
+        if (!list_empty(&ep->urb_list)) {
+                urb = list_first_entry(&ep->urb_list, struct urb, urb_list);
+                urb_priv = urb->hcpriv;
+                if (urb_priv->td_cnt > urb_priv->length) {
+                        status = 0;
+                        goto restart;
+                }
+        }
 }
@@ -546,7 +565,6 @@ td_fill (struct ohci_hcd *ohci, u32 info,
                td->hwCBP = cpu_to_hc32 (ohci, data & 0xFFFFF000);
                *ohci_hwPSWp(ohci, td, 0) = cpu_to_hc16 (ohci,
                                                (data & 0x0FFF) | 0xE000);
-                td->ed->last_iso = info & 0xffff;
        } else {
                td->hwCBP = cpu_to_hc32 (ohci, data);
        }
@@ -996,7 +1014,7 @@ rescan_this:
                        urb_priv->td_cnt++;
                        /* if URB is done, clean up */
-                        if (urb_priv->td_cnt == urb_priv->length) {
+                        if (urb_priv->td_cnt >= urb_priv->length) {
                                modified = completed = 1;
                                finish_urb(ohci, urb, 0);
                        }
@@ -1086,7 +1104,7 @@ static void takeback_td(struct ohci_hcd *ohci, struct td *td)
        urb_priv->td_cnt++;
        /* If all this urb's TDs are done, call complete() */
-        if (urb_priv->td_cnt == urb_priv->length)
+        if (urb_priv->td_cnt >= urb_priv->length)
                finish_urb(ohci, urb, status);
        /* clean schedule:  unlink EDs that are no longer busy */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 2c76ef1320ea..08ef2829a7e2 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -799,7 +799,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
         * switchable ports.
         */
        pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
-                        cpu_to_le32(ports_available));
+                        ports_available);
        pci_read_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
                        &ports_available);
@@ -821,7 +821,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
         * host.
         */
        pci_write_config_dword(xhci_pdev, USB_INTEL_XUSB2PR,
-                        cpu_to_le32(ports_available));
+                        ports_available);
        pci_read_config_dword(xhci_pdev, USB_INTEL_XUSB2PR,
                        &ports_available);
diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c
index c300bd2f7d1c..0f228c46eeda 100644
--- a/drivers/usb/host/uhci-pci.c
+++ b/drivers/usb/host/uhci-pci.c
@@ -293,7 +293,7 @@ static struct pci_driver uhci_pci_driver = {
        .remove =       usb_hcd_pci_remove,
        .shutdown =     uhci_shutdown,
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        .driver =       {
                .pm =   &usb_hcd_pci_pm_ops
        },
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 041c6ddb695c..da6f56d996ce 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -1303,7 +1303,7 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
                }
                /* Fell behind? */
-                if (uhci_frame_before_eq(frame, next)) {
+                if (!uhci_frame_before_eq(next, frame)) {
                        /* USB_ISO_ASAP: Round up to the first available slot */
                        if (urb->transfer_flags & URB_ISO_ASAP)
@@ -1311,13 +1311,17 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
                                                -qh->period;
                        /*
-                         * Not ASAP: Use the next slot in the stream.  If
+                         * Not ASAP: Use the next slot in the stream,
-                         * the entire URB falls before the threshold, fail.
+                         * no matter what.
                         */
                        else if (!uhci_frame_before_eq(next,
                                        frame + (urb->number_of_packets - 1) *
                                                qh->period))
-                                return -EXDEV;
+                                dev_dbg(uhci_dev(uhci), "iso underrun %p (%u+%u < %u)\n",
+                                                urb, frame,
+                                                (urb->number_of_packets - 1) *
+                                                        qh->period,
+                                                next);
                }
        }
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index fae697ed0b70..e8b4c56dcf62 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -287,7 +287,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
                if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)
                        xhci_queue_stop_endpoint(xhci, slot_id, i, suspend);
        }
-        cmd->command_trb = xhci->cmd_ring->enqueue;
+        cmd->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
        list_add_tail(&cmd->cmd_list, &virt_dev->cmd_list);
        xhci_queue_stop_endpoint(xhci, slot_id, 0, suspend);
        xhci_ring_cmd_db(xhci);
@@ -552,11 +552,15 @@ void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
 *  - Mark a port as being done with device resume,
 *    and ring the endpoint doorbells.
 *  - Stop the Synopsys redriver Compliance Mode polling.
+ *  - Drop and reacquire the xHCI lock, in order to wait for port resume.
 */
 static u32 xhci_get_port_status(struct usb_hcd *hcd,
                struct xhci_bus_state *bus_state,
                __le32 __iomem **port_array,
-                u16 wIndex, u32 raw_port_status)
+                u16 wIndex, u32 raw_port_status,
+                unsigned long flags)
+        __releases(&xhci->lock)
+        __acquires(&xhci->lock)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        u32 status = 0;
@@ -591,21 +595,42 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                        return 0xffffffff;
                if (time_after_eq(jiffies,
                                        bus_state->resume_done[wIndex])) {
+                        int time_left;
                        xhci_dbg(xhci, "Resume USB2 port %d\n",
                                        wIndex + 1);
                        bus_state->resume_done[wIndex] = 0;
                        clear_bit(wIndex, &bus_state->resuming_ports);
+                        set_bit(wIndex, &bus_state->rexit_ports);
                        xhci_set_link_state(xhci, port_array, wIndex,
                                        XDEV_U0);
-                        xhci_dbg(xhci, "set port %d resume\n",
-                                        wIndex + 1);
+                        spin_unlock_irqrestore(&xhci->lock, flags);
-                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+                        time_left = wait_for_completion_timeout(
-                                        wIndex + 1);
+                                        &bus_state->rexit_done[wIndex],
-                        if (!slot_id) {
+                                        msecs_to_jiffies(
-                                xhci_dbg(xhci, "slot_id is zero\n");
+                                                XHCI_MAX_REXIT_TIMEOUT));
-                                return 0xffffffff;
+                        spin_lock_irqsave(&xhci->lock, flags);
+                        if (time_left) {
+                                slot_id = xhci_find_slot_id_by_port(hcd,
+                                                xhci, wIndex + 1);
+                                if (!slot_id) {
+                                        xhci_dbg(xhci, "slot_id is zero\n");
+                                        return 0xffffffff;
+                                }
+                                xhci_ring_device(xhci, slot_id);
+                        } else {
+                                int port_status = xhci_readl(xhci,
+                                                port_array[wIndex]);
+                                xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
+                                                XHCI_MAX_REXIT_TIMEOUT,
+                                                port_status);
+                                status |= USB_PORT_STAT_SUSPEND;
+                                clear_bit(wIndex, &bus_state->rexit_ports);
                        }
-                        xhci_ring_device(xhci, slot_id);
                        bus_state->port_c_suspend |= 1 << wIndex;
                        bus_state->suspended_ports &= ~(1 << wIndex);
                } else {
@@ -728,7 +753,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                        break;
                }
                status = xhci_get_port_status(hcd, bus_state, port_array,
-                                wIndex, temp);
+                                wIndex, temp, flags);
                if (status == 0xffffffff)
                        goto error;
@@ -1132,18 +1157,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                t1 = xhci_port_state_to_neutral(t1);
                if (t1 != t2)
                        xhci_writel(xhci, t2, port_array[port_index]);
-                if (hcd->speed != HCD_USB3) {
-                        /* enable remote wake up for USB 2.0 */
-                        __le32 __iomem *addr;
-                        u32 tmp;
-                        /* Get the port power control register address. */
-                        addr = port_array[port_index] + PORTPMSC;
-                        tmp = xhci_readl(xhci, addr);
-                        tmp |= PORT_RWE;
-                        xhci_writel(xhci, tmp, addr);
-                }
        }
        hcd->state = HC_STATE_SUSPENDED;
        bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
@@ -1222,20 +1235,6 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                                xhci_ring_device(xhci, slot_id);
                } else
                        xhci_writel(xhci, temp, port_array[port_index]);
-                if (hcd->speed != HCD_USB3) {
-                        /* disable remote wake up for USB 2.0 */
-                        __le32 __iomem *addr;
-                        u32 tmp;
-                        /* Add one to the port status register address to get
-                         * the port power control register address.
-                         */
-                        addr = port_array[port_index] + PORTPMSC;
-                        tmp = xhci_readl(xhci, addr);
-                        tmp &= ~PORT_RWE;
-                        xhci_writel(xhci, tmp, addr);
-                }
        }
        (void) xhci_readl(xhci, &xhci->op_regs->command);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 53b972c2a09f..83bcd13622c3 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2428,6 +2428,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
        for (i = 0; i < USB_MAXCHILDREN; ++i) {
                xhci->bus_state[0].resume_done[i] = 0;
                xhci->bus_state[1].resume_done[i] = 0;
+                /* Only the USB 2.0 completions will ever be used. */
+                init_completion(&xhci->bus_state[1].rexit_done[i]);
        }
        if (scratchpad_alloc(xhci, flags))
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index c2d495057eb5..b8dffd59eb25 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -35,6 +35,9 @@
 #define PCI_VENDOR_ID_ETRON             0x1b6f
 #define PCI_DEVICE_ID_ASROCK_P67        0x7023
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI      0x8c31
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
 static const char hcd_name[] = "xhci_hcd";
 /* called after powerup, by probe or system-pm "wakeup" */
@@ -69,6 +72,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                                "QUIRK: Fresco Logic xHC needs configure"
                                " endpoint cmd after reset endpoint");
                }
+                if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+                                pdev->revision == 0x4) {
+                        xhci->quirks |= XHCI_SLOW_SUSPEND;
+                        xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+                                "QUIRK: Fresco Logic xHC revision %u"
+                                "must be suspended extra slowly",
+                                pdev->revision);
+                }
                /* Fresco Logic confirms: all revisions of this chip do not
                 * support MSI, even though some of them claim to in their PCI
                 * capabilities.
@@ -110,6 +121,15 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
                xhci->quirks |= XHCI_AVOID_BEI;
        }
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+            (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) {
+                /* Workaround for occasional spurious wakeups from S5 (or
+                 * any other sleep) on Haswell machines with LPT and LPT-LP
+                 * with the new Intel BIOS
+                 */
+                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+        }
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
                xhci->quirks |= XHCI_RESET_ON_RESUME;
@@ -217,6 +237,11 @@ static void xhci_pci_remove(struct pci_dev *dev)
                usb_put_hcd(xhci->shared_hcd);
        }
        usb_hcd_pci_remove(dev);
+        /* Workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                pci_set_power_state(dev, PCI_D3hot);
        kfree(xhci);
 }
@@ -351,7 +376,7 @@ static struct pci_driver xhci_pci_driver = {
        /* suspend and resume implemented later */
        .shutdown =     usb_hcd_pci_shutdown,
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        .driver = {
                .pm = &usb_hcd_pci_pm_ops
        },
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 411da1fc7ae8..6bfbd80ec2b9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -123,6 +123,16 @@ static int enqueue_is_link_trb(struct xhci_ring *ring)
        return TRB_TYPE_LINK_LE32(link->control);
 }
+union xhci_trb *xhci_find_next_enqueue(struct xhci_ring *ring)
+{
+        /* Enqueue pointer can be left pointing to the link TRB,
+         * we must handle that
+         */
+        if (TRB_TYPE_LINK_LE32(ring->enqueue->link.control))
+                return ring->enq_seg->next->trbs;
+        return ring->enqueue;
+}
 /* Updates trb to point to the next TRB in the ring, and updates seg if the next
 * TRB is in a new segment.  This does not skip over link TRBs, and it does not
 * effect the ring dequeue or enqueue pointers.
@@ -859,8 +869,12 @@ remove_finished_td:
                /* Otherwise ring the doorbell(s) to restart queued transfers */
                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
        }
-        ep->stopped_td = NULL;
-        ep->stopped_trb = NULL;
+        /* Clear stopped_td and stopped_trb if endpoint is not halted */
+        if (!(ep->ep_state & EP_HALTED)) {
+                ep->stopped_td = NULL;
+                ep->stopped_trb = NULL;
+        }
        /*
         * Drop the lock and complete the URBs in the cancelled TD list.
@@ -1414,6 +1428,12 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                        inc_deq(xhci, xhci->cmd_ring);
                        return;
                }
+                /* There is no command to handle if we get a stop event when the
+                 * command ring is empty, event->cmd_trb points to the next
+                 * unset command
+                 */
+                if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)
+                        return;
        }
        switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
@@ -1743,6 +1763,19 @@ static void handle_port_status(struct xhci_hcd *xhci,
                }
        }
+        /*
+         * Check to see if xhci-hub.c is waiting on RExit to U0 transition (or
+         * RExit to a disconnect state).  If so, let the the driver know it's
+         * out of the RExit state.
+         */
+        if (!DEV_SUPERSPEED(temp) &&
+                        test_and_clear_bit(faked_port_index,
+                                &bus_state->rexit_ports)) {
+                complete(&bus_state->rexit_done[faked_port_index]);
+                bogus_port_status = true;
+                goto cleanup;
+        }
        if (hcd->speed != HCD_USB3)
                xhci_test_and_clear_bit(xhci, port_array, faked_port_index,
                                        PORT_PLC);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 49b6edb84a79..6e0d886bcce5 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -730,6 +730,9 @@ void xhci_shutdown(struct usb_hcd *hcd)
        spin_lock_irq(&xhci->lock);
        xhci_halt(xhci);
+        /* Workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                xhci_reset(xhci);
        spin_unlock_irq(&xhci->lock);
        xhci_cleanup_msix(xhci);
@@ -737,6 +740,10 @@ void xhci_shutdown(struct usb_hcd *hcd)
        xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                        "xhci_shutdown completed - status = %x",
                        xhci_readl(xhci, &xhci->op_regs->status));
+        /* Yet another workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                pci_set_power_state(to_pci_dev(hcd->self.controller), PCI_D3hot);
 }
 #ifdef CONFIG_PM
@@ -839,6 +846,7 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci)
 int xhci_suspend(struct xhci_hcd *xhci)
 {
        int                     rc = 0;
+        unsigned int            delay = XHCI_MAX_HALT_USEC;
        struct usb_hcd          *hcd = xhci_to_hcd(xhci);
        u32                     command;
@@ -861,8 +869,12 @@ int xhci_suspend(struct xhci_hcd *xhci)
        command = xhci_readl(xhci, &xhci->op_regs->command);
        command &= ~CMD_RUN;
        xhci_writel(xhci, command, &xhci->op_regs->command);
+        /* Some chips from Fresco Logic need an extraordinary delay */
+        delay *= (xhci->quirks & XHCI_SLOW_SUSPEND) ? 10 : 1;
        if (xhci_handshake(xhci, &xhci->op_regs->status,
-                      STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC)) {
+                      STS_HALT, STS_HALT, delay)) {
                xhci_warn(xhci, "WARN: xHC CMD_RUN timeout\n");
                spin_unlock_irq(&xhci->lock);
                return -ETIMEDOUT;
@@ -2598,15 +2610,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
        if (command) {
                cmd_completion = command->completion;
                cmd_status = &command->status;
-                command->command_trb = xhci->cmd_ring->enqueue;
+                command->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
-                /* Enqueue pointer can be left pointing to the link TRB,
-                 * we must handle that
-                 */
-                if (TRB_TYPE_LINK_LE32(command->command_trb->link.control))
-                        command->command_trb =
-                                xhci->cmd_ring->enq_seg->next->trbs;
                list_add_tail(&command->cmd_list, &virt_dev->cmd_list);
        } else {
                cmd_completion = &virt_dev->cmd_completion;
@@ -2614,7 +2618,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
        }
        init_completion(cmd_completion);
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
        if (!ctx_change)
                ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,
                                udev->slot_id, must_succeed);
@@ -3439,14 +3443,7 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
        /* Attempt to submit the Reset Device command to the command ring */
        spin_lock_irqsave(&xhci->lock, flags);
-        reset_device_cmd->command_trb = xhci->cmd_ring->enqueue;
+        reset_device_cmd->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
-        /* Enqueue pointer can be left pointing to the link TRB,
-         * we must handle that
-         */
-        if (TRB_TYPE_LINK_LE32(reset_device_cmd->command_trb->link.control))
-                reset_device_cmd->command_trb =
-                        xhci->cmd_ring->enq_seg->next->trbs;
        list_add_tail(&reset_device_cmd->cmd_list, &virt_dev->cmd_list);
        ret = xhci_queue_reset_device(xhci, slot_id);
@@ -3650,7 +3647,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
        union xhci_trb *cmd_trb;
        spin_lock_irqsave(&xhci->lock, flags);
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
        ret = xhci_queue_slot_control(xhci, TRB_ENABLE_SLOT, 0);
        if (ret) {
                spin_unlock_irqrestore(&xhci->lock, flags);
@@ -3785,7 +3782,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
                                slot_ctx->dev_info >> 27);
        spin_lock_irqsave(&xhci->lock, flags);
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
        ret = xhci_queue_address_device(xhci, virt_dev->in_ctx->dma,
                                        udev->slot_id);
        if (ret) {
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 46aa14894148..941d5f59e4dc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1412,8 +1412,18 @@ struct xhci_bus_state {
        unsigned long           resume_done[USB_MAXCHILDREN];
        /* which ports have started to resume */
        unsigned long           resuming_ports;
+        /* Which ports are waiting on RExit to U0 transition. */
+        unsigned long           rexit_ports;
+        struct completion       rexit_done[USB_MAXCHILDREN];
 };
+/*
+ * It can take up to 20 ms to transition from RExit to U0 on the
+ * Intel Lynx Point LP xHCI host.
+ */
+#define XHCI_MAX_REXIT_TIMEOUT  (20 * 1000)
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
        if (hcd->speed == HCD_USB3)
@@ -1538,6 +1548,8 @@ struct xhci_hcd {
 #define XHCI_COMP_MODE_QUIRK    (1 << 14)
 #define XHCI_AVOID_BEI          (1 << 15)
 #define XHCI_PLAT               (1 << 16)
+#define XHCI_SLOW_SUSPEND       (1 << 17)
+#define XHCI_SPURIOUS_WAKEUP    (1 << 18)
        unsigned int            num_active_eps;
        unsigned int            limit_active_eps;
        /* There are two roothubs to keep track of bus suspend info for */
@@ -1840,6 +1852,7 @@ int xhci_cancel_cmd(struct xhci_hcd *xhci, struct xhci_command *command,
                union xhci_trb *cmd_trb);
 void xhci_ring_ep_doorbell(struct xhci_hcd *xhci, unsigned int slot_id,
                unsigned int ep_index, unsigned int stream_id);
+union xhci_trb *xhci_find_next_enqueue(struct xhci_ring *ring);
 /* xHCI roothub code */
 void xhci_set_link_state(struct xhci_hcd *xhci, __le32 __iomem **port_array,
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index e2b21c1d9c40..ba5f70f92888 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -246,6 +246,6 @@ config USB_EZUSB_FX2
 config USB_HSIC_USB3503
       tristate "USB3503 HSIC to USB20 Driver"
       depends on I2C
-       select REGMAP
+       select REGMAP_I2C
       help
         This option enables support for SMSC USB3503 HSIC to USB 2.0 Driver.
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 18e877ffe7b7..cd70cc886171 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -922,6 +922,52 @@ static void musb_generic_disable(struct musb *musb)
 }
 /*
+ * Program the HDRC to start (enable interrupts, dma, etc.).
+ */
+void musb_start(struct musb *musb)
+{
+        void __iomem    *regs = musb->mregs;
+        u8              devctl = musb_readb(regs, MUSB_DEVCTL);
+        dev_dbg(musb->controller, "<== devctl %02x\n", devctl);
+        /*  Set INT enable registers, enable interrupts */
+        musb->intrtxe = musb->epmask;
+        musb_writew(regs, MUSB_INTRTXE, musb->intrtxe);
+        musb->intrrxe = musb->epmask & 0xfffe;
+        musb_writew(regs, MUSB_INTRRXE, musb->intrrxe);
+        musb_writeb(regs, MUSB_INTRUSBE, 0xf7);
+        musb_writeb(regs, MUSB_TESTMODE, 0);
+        /* put into basic highspeed mode and start session */
+        musb_writeb(regs, MUSB_POWER, MUSB_POWER_ISOUPDATE
+                        | MUSB_POWER_HSENAB
+                        /* ENSUSPEND wedges tusb */
+                        /* | MUSB_POWER_ENSUSPEND */
+                   );
+        musb->is_active = 0;
+        devctl = musb_readb(regs, MUSB_DEVCTL);
+        devctl &= ~MUSB_DEVCTL_SESSION;
+        /* session started after:
+         * (a) ID-grounded irq, host mode;
+         * (b) vbus present/connect IRQ, peripheral mode;
+         * (c) peripheral initiates, using SRP
+         */
+        if (musb->port_mode != MUSB_PORT_MODE_HOST &&
+                        (devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS) {
+                musb->is_active = 1;
+        } else {
+                devctl |= MUSB_DEVCTL_SESSION;
+        }
+        musb_platform_enable(musb);
+        musb_writeb(regs, MUSB_DEVCTL, devctl);
+}
+/*
 * Make the HDRC stop (disable interrupts, etc.);
 * reversible by musb_start
 * called on gadget driver unregister
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 65f3917b4fc5..1c5bf75ee8ff 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -503,6 +503,7 @@ static inline void musb_configure_ep0(struct musb *musb)
 extern const char musb_driver_name[];
 extern void musb_stop(struct musb *musb);
+extern void musb_start(struct musb *musb);
 extern void musb_write_fifo(struct musb_hw_ep *ep, u16 len, const u8 *src);
 extern void musb_read_fifo(struct musb_hw_ep *ep, u16 len, u8 *dst);
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 4047cbb91bac..bd4138d80a48 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -535,6 +535,9 @@ static int dsps_probe(struct platform_device *pdev)
        struct dsps_glue *glue;
        int ret;
+        if (!strcmp(pdev->name, "musb-hdrc"))
+                return -ENODEV;
        match = of_match_node(musb_dsps_of_match, pdev->dev.of_node);
        if (!match) {
                dev_err(&pdev->dev, "fail to get matching of_match struct\n");
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 9a08679d204d..3671898a4535 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1790,6 +1790,10 @@ int musb_gadget_setup(struct musb *musb)
        musb->g.max_speed = USB_SPEED_HIGH;
        musb->g.speed = USB_SPEED_UNKNOWN;
+        MUSB_DEV_MODE(musb);
+        musb->xceiv->otg->default_a = 0;
+        musb->xceiv->state = OTG_STATE_B_IDLE;
        /* this "gadget" abstracts/virtualizes the controller */
        musb->g.name = musb_driver_name;
        musb->g.is_otg = 1;
@@ -1855,6 +1859,8 @@ static int musb_gadget_start(struct usb_gadget *g,
        musb->xceiv->state = OTG_STATE_B_IDLE;
        spin_unlock_irqrestore(&musb->lock, flags);
+        musb_start(musb);
        /* REVISIT:  funcall to other code, which also
         * handles power budgeting ... this way also
         * ensures HdrcStart is indirectly called.
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index a523950c2b32..d1d6b83aabca 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -44,52 +44,6 @@
 #include "musb_core.h"
-/*
-* Program the HDRC to start (enable interrupts, dma, etc.).
-*/
-static void musb_start(struct musb *musb)
-{
-        void __iomem    *regs = musb->mregs;
-        u8              devctl = musb_readb(regs, MUSB_DEVCTL);
-        dev_dbg(musb->controller, "<== devctl %02x\n", devctl);
-        /*  Set INT enable registers, enable interrupts */
-        musb->intrtxe = musb->epmask;
-        musb_writew(regs, MUSB_INTRTXE, musb->intrtxe);
-        musb->intrrxe = musb->epmask & 0xfffe;
-        musb_writew(regs, MUSB_INTRRXE, musb->intrrxe);
-        musb_writeb(regs, MUSB_INTRUSBE, 0xf7);
-        musb_writeb(regs, MUSB_TESTMODE, 0);
-        /* put into basic highspeed mode and start session */
-        musb_writeb(regs, MUSB_POWER, MUSB_POWER_ISOUPDATE
-                                                | MUSB_POWER_HSENAB
-                                                /* ENSUSPEND wedges tusb */
-                                                /* | MUSB_POWER_ENSUSPEND */
-                                                );
-        musb->is_active = 0;
-        devctl = musb_readb(regs, MUSB_DEVCTL);
-        devctl &= ~MUSB_DEVCTL_SESSION;
-        /* session started after:
-         * (a) ID-grounded irq, host mode;
-         * (b) vbus present/connect IRQ, peripheral mode;
-         * (c) peripheral initiates, using SRP
-         */
-        if (musb->port_mode != MUSB_PORT_MODE_HOST &&
-            (devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS) {
-                musb->is_active = 1;
-        } else {
-                devctl |= MUSB_DEVCTL_SESSION;
-        }
-        musb_platform_enable(musb);
-        musb_writeb(regs, MUSB_DEVCTL, devctl);
-}
 static void musb_port_suspend(struct musb *musb, bool do_suspend)
 {
        struct usb_otg  *otg = musb->xceiv->otg;
diff --git a/drivers/usb/phy/phy-gpio-vbus-usb.c b/drivers/usb/phy/phy-gpio-vbus-usb.c
index b2f29c9aebbf..02799a5efcd4 100644
--- a/drivers/usb/phy/phy-gpio-vbus-usb.c
+++ b/drivers/usb/phy/phy-gpio-vbus-usb.c
@@ -241,7 +241,7 @@ static int gpio_vbus_set_suspend(struct usb_phy *phy, int suspend)
 /* platform driver interface */
-static int __init gpio_vbus_probe(struct platform_device *pdev)
+static int gpio_vbus_probe(struct platform_device *pdev)
 {
        struct gpio_vbus_mach_info *pdata = dev_get_platdata(&pdev->dev);
        struct gpio_vbus_data *gpio_vbus;
@@ -349,7 +349,7 @@ err_gpio:
        return err;
 }
-static int __exit gpio_vbus_remove(struct platform_device *pdev)
+static int gpio_vbus_remove(struct platform_device *pdev)
 {
        struct gpio_vbus_data *gpio_vbus = platform_get_drvdata(pdev);
        struct gpio_vbus_mach_info *pdata = dev_get_platdata(&pdev->dev);
@@ -398,8 +398,6 @@ static const struct dev_pm_ops gpio_vbus_dev_pm_ops = {
 };
 #endif
-/* NOTE:  the gpio-vbus device may *NOT* be hotplugged */
 MODULE_ALIAS("platform:gpio-vbus");
 static struct platform_driver gpio_vbus_driver = {
@@ -410,10 +408,11 @@ static struct platform_driver gpio_vbus_driver = {
                .pm = &gpio_vbus_dev_pm_ops,
 #endif
        },
-        .remove  = __exit_p(gpio_vbus_remove),
+        .probe          = gpio_vbus_probe,
+        .remove         = gpio_vbus_remove,
 };
-module_platform_driver_probe(gpio_vbus_driver, gpio_vbus_probe);
+module_platform_driver(gpio_vbus_driver);
 MODULE_DESCRIPTION("simple GPIO controlled OTG transceiver driver");
 MODULE_AUTHOR("Philipp Zabel");
diff --git a/drivers/usb/phy/phy-omap-usb3.c b/drivers/usb/phy/phy-omap-usb3.c
index fc15694d3031..4e8a0405f956 100644
--- a/drivers/usb/phy/phy-omap-usb3.c
+++ b/drivers/usb/phy/phy-omap-usb3.c
@@ -79,7 +79,7 @@ static struct usb_dpll_params *omap_usb3_get_dpll_params(unsigned long rate)
                        return &dpll_map[i].params;
        }
-        return 0;
+        return NULL;
 }
 static int omap_usb3_suspend(struct usb_phy *x, int suspend)
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index c454bfa22a10..ddb9c51f2c99 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -60,7 +60,7 @@ config USB_SERIAL_SIMPLE
                - Suunto ANT+ USB device.
                - Fundamental Software dongle.
                - HP4x calculators
-                - a number of Motoroloa phones
+                - a number of Motorola phones
                - Siemens USB/MPI adapter.
                - ViVOtech ViVOpay USB device.
                - Infineon Modem Flashloader USB interface
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 1cf6f125f5f0..acaee066b99a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -81,6 +81,7 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_VENDOR_ID                        0x12D1
 #define HUAWEI_PRODUCT_E173                     0x140C
+#define HUAWEI_PRODUCT_E1750                    0x1406
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_K4605                    0x14C6
@@ -450,6 +451,10 @@ static void option_instat_callback(struct urb *urb);
 #define CHANGHONG_VENDOR_ID                     0x2077
 #define CHANGHONG_PRODUCT_CH690                 0x7001
+/* Inovia */
+#define INOVIA_VENDOR_ID                        0x20a6
+#define INOVIA_SEW858                           0x1105
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                OPTION_BLACKLIST_NONE = 0,
@@ -567,6 +572,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t) &net_intf2_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),
@@ -686,6 +693,222 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7A) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7B) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
@@ -1254,7 +1477,9 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
-        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist
+        },
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
@@ -1342,6 +1567,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+        { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index e7a84f0f5179..bedf8e47713b 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -139,6 +139,7 @@ enum pl2303_type {
        HX_TA,          /* HX(A) / X(A) / TA version  */ /* TODO: improve */
        HXD_EA_RA_SA,   /* HXD / EA / RA / SA version */ /* TODO: improve */
        TB,             /* TB version */
+        HX_CLONE,       /* Cheap and less functional clone of the HX chip */
 };
 /*
 * NOTE: don't know the difference between type 0 and type 1,
@@ -206,8 +207,23 @@ static int pl2303_startup(struct usb_serial *serial)
                 * the device descriptors of the X/HX, HXD, EA, RA, SA, TA, TB
                 */
                if (le16_to_cpu(serial->dev->descriptor.bcdDevice) == 0x300) {
-                        type = HX_TA;
+                        /* Check if the device is a clone */
-                        type_str = "X/HX/TA";
+                        pl2303_vendor_read(0x9494, 0, serial, buf);
+                        /*
+                         * NOTE: Not sure if this read is really needed.
+                         * The HX returns 0x00, the clone 0x02, but the Windows
+                         * driver seems to ignore the value and continues.
+                         */
+                        pl2303_vendor_write(0x0606, 0xaa, serial);
+                        pl2303_vendor_read(0x8686, 0, serial, buf);
+                        if (buf[0] != 0xaa) {
+                                type = HX_CLONE;
+                                type_str = "X/HX clone (limited functionality)";
+                        } else {
+                                type = HX_TA;
+                                type_str = "X/HX/TA";
+                        }
+                        pl2303_vendor_write(0x0606, 0x00, serial);
                } else if (le16_to_cpu(serial->dev->descriptor.bcdDevice)
                                                                     == 0x400) {
                        type = HXD_EA_RA_SA;
@@ -305,8 +321,9 @@ static int pl2303_baudrate_encode_direct(int baud, enum pl2303_type type,
 {
        /*
         * NOTE: Only the values defined in baud_sup are supported !
-         *       => if unsupported values are set, the PL2303 seems to
+         * => if unsupported values are set, the PL2303 uses 9600 baud instead
-         *          use 9600 baud (at least my PL2303X always does)
+         * => HX clones just don't work at unsupported baud rates < 115200 baud,
+         *    for baud rates > 115200 they run at 115200 baud
         */
        const int baud_sup[] = { 75, 150, 300, 600, 1200, 1800, 2400, 3600,
                                 4800, 7200, 9600, 14400, 19200, 28800, 38400,
@@ -316,14 +333,14 @@ static int pl2303_baudrate_encode_direct(int baud, enum pl2303_type type,
         * NOTE: With the exception of type_0/1 devices, the following
         * additional baud rates are supported (tested with HX rev. 3A only):
         * 110*, 56000*, 128000, 134400, 161280, 201600, 256000*, 268800,
-         * 403200, 806400.      (*: not HX)
+         * 403200, 806400.      (*: not HX and HX clones)
         *
         * Maximum values: HXD, TB: 12000000; HX, TA: 6000000;
-         *                 type_0+1: 1228800; RA: 921600; SA: 115200
+         *                 type_0+1: 1228800; RA: 921600; HX clones, SA: 115200
         *
         * As long as we are not using this encoding method for anything else
-         * than the type_0+1 and HX chips, there is no point in complicating
+         * than the type_0+1, HX and HX clone chips, there is no point in
-         * the code to support them.
+         * complicating the code to support them.
         */
        int i;
@@ -347,6 +364,8 @@ static int pl2303_baudrate_encode_direct(int baud, enum pl2303_type type,
                baud = min_t(int, baud, 6000000);
        else if (type == type_0 || type == type_1)
                baud = min_t(int, baud, 1228800);
+        else if (type == HX_CLONE)
+                baud = min_t(int, baud, 115200);
        /* Direct (standard) baud rate encoding method */
        put_unaligned_le32(baud, buf);
@@ -359,7 +378,8 @@ static int pl2303_baudrate_encode_divisor(int baud, enum pl2303_type type,
        /*
         * Divisor based baud rate encoding method
         *
-         * NOTE: it's not clear if the type_0/1 chips support this method
+         * NOTE: HX clones do NOT support this method.
+         * It's not clear if the type_0/1 chips support it.
         *
         * divisor = 12MHz * 32 / baudrate = 2^A * B
         *
@@ -452,7 +472,7 @@ static void pl2303_encode_baudrate(struct tty_struct *tty,
         * 1) Direct method: encodes the baud rate value directly
         *    => supported by all chip types
         * 2) Divisor based method: encodes a divisor to a base value (12MHz*32)
-         *    => supported by HX chips (and likely not by type_0/1 chips)
+         *    => not supported by HX clones (and likely type_0/1 chips)
         *
         * NOTE: Although the divisor based baud rate encoding method is much
         * more flexible, some of the standard baud rate values can not be
@@ -460,7 +480,7 @@ static void pl2303_encode_baudrate(struct tty_struct *tty,
         * the device likely uses the same baud rate generator for both methods
         * so that there is likley no difference.
         */
-        if (type == type_0 || type == type_1)
+        if (type == type_0 || type == type_1 || type == HX_CLONE)
                baud = pl2303_baudrate_encode_direct(baud, type, buf);
        else
                baud = pl2303_baudrate_encode_divisor(baud, type, buf);
@@ -813,6 +833,7 @@ static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
        result = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
                                 BREAK_REQUEST, BREAK_REQUEST_TYPE, state,
                                 0, NULL, 0, 100);
+        /* NOTE: HX clones don't support sending breaks, -EPIPE is returned */
        if (result)
                dev_err(&port->dev, "error sending break = %d\n", result);
 }
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 760b78560f67..c9a35697ebe9 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -190,6 +190,7 @@ static struct usb_device_id ti_id_table_combined[] = {
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
        { }     /* terminator */
 };
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 94d75edef77f..18509e6c21ab 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -211,8 +211,11 @@ static int slave_configure(struct scsi_device *sdev)
                /*
                 * Many devices do not respond properly to READ_CAPACITY_16.
                 * Tell the SCSI layer to try READ_CAPACITY_10 first.
+                 * However some USB 3.0 drive enclosures return capacity
+                 * modulo 2TB. Those must use READ_CAPACITY_16
                 */
-                sdev->try_rc_10_first = 1;
+                if (!(us->fflags & US_FL_NEEDS_CAP16))
+                        sdev->try_rc_10_first = 1;
                /* assume SPC3 or latter devices support sense size > 18 */
                if (sdev->scsi_level > SCSI_SPC_2)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c015f2c16729..de32cfa5bfa6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1925,6 +1925,13 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_IGNORE_RESIDUE ),
+/* Reported by Oliver Neukum <oneukum@suse.com> */
+UNUSUAL_DEV(  0x174c, 0x55aa, 0x0100, 0x0100,
+                "ASMedia",
+                "AS2105",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NEEDS_CAP16),
 /* Reported by Jesse Feddema <jdfeddema@gmail.com> */
 UNUSUAL_DEV(  0x177f, 0x0400, 0x0000, 0x0000,
                "Yarvik",
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index a9807dea3887..4fb7a8f83c8a 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -545,6 +545,8 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
        long npage;
        int ret = 0, prot = 0;
        uint64_t mask;
+        struct vfio_dma *dma = NULL;
+        unsigned long pfn;
        end = map->iova + map->size;
@@ -587,8 +589,6 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
        }
        for (iova = map->iova; iova < end; iova += size, vaddr += size) {
-                struct vfio_dma *dma = NULL;
-                unsigned long pfn;
                long i;
                /* Pin a contiguous chunk of memory */
@@ -597,16 +597,15 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                if (npage <= 0) {
                        WARN_ON(!npage);
                        ret = (int)npage;
-                        break;
+                        goto out;
                }
                /* Verify pages are not already mapped */
                for (i = 0; i < npage; i++) {
                        if (iommu_iova_to_phys(iommu->domain,
                                               iova + (i << PAGE_SHIFT))) {
-                                vfio_unpin_pages(pfn, npage, prot, true);
                                ret = -EBUSY;
-                                break;
+                                goto out_unpin;
                        }
                }
@@ -616,8 +615,7 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                if (ret) {
                        if (ret != -EBUSY ||
                            map_try_harder(iommu, iova, pfn, npage, prot)) {
-                                vfio_unpin_pages(pfn, npage, prot, true);
+                                goto out_unpin;
-                                break;
                        }
                }
@@ -672,9 +670,8 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                        dma = kzalloc(sizeof(*dma), GFP_KERNEL);
                        if (!dma) {
                                iommu_unmap(iommu->domain, iova, size);
-                                vfio_unpin_pages(pfn, npage, prot, true);
                                ret = -ENOMEM;
-                                break;
+                                goto out_unpin;
                        }
                        dma->size = size;
@@ -685,16 +682,21 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                }
        }
-        if (ret) {
+        WARN_ON(ret);
-                struct vfio_dma *tmp;
+        mutex_unlock(&iommu->lock);
-                iova = map->iova;
+        return ret;
-                size = map->size;
-                while ((tmp = vfio_find_dma(iommu, iova, size))) {
+out_unpin:
-                        int r = vfio_remove_dma_overlap(iommu, iova,
+        vfio_unpin_pages(pfn, npage, prot, true);
-                                                        &size, tmp);
-                        if (WARN_ON(r || !size))
+out:
-                                break;
+        iova = map->iova;
-                }
+        size = map->size;
+        while ((dma = vfio_find_dma(iommu, iova, size))) {
+                int r = vfio_remove_dma_overlap(iommu, iova,
+                                                &size, dma);
+                if (WARN_ON(r || !size))
+                        break;
        }
        mutex_unlock(&iommu->lock);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 4b79a1f2f901..ce5221fa393a 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -461,7 +461,7 @@ static void tcm_vhost_release_cmd(struct se_cmd *se_cmd)
                u32 i;
                for (i = 0; i < tv_cmd->tvc_sgl_count; i++)
                        put_page(sg_page(&tv_cmd->tvc_sgl[i]));
-        }
+        }
        tcm_vhost_put_inflight(tv_cmd->inflight);
        percpu_ida_free(&se_sess->sess_tag_pool, se_cmd->map_tag);
@@ -728,7 +728,12 @@ vhost_scsi_get_tag(struct vhost_virtqueue *vq,
        }
        se_sess = tv_nexus->tvn_se_sess;
-        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_KERNEL);
+        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
+        if (tag < 0) {
+                pr_err("Unable to obtain tag for tcm_vhost_cmd\n");
+                return ERR_PTR(-ENOMEM);
+        }
        cmd = &((struct tcm_vhost_cmd *)se_sess->sess_cmd_map)[tag];
        sg = cmd->tvc_sgl;
        pages = cmd->tvc_upages;
@@ -1373,21 +1378,30 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
        return 0;
 }
+static void vhost_scsi_free(struct vhost_scsi *vs)
+{
+        if (is_vmalloc_addr(vs))
+                vfree(vs);
+        else
+                kfree(vs);
+}
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
        struct vhost_scsi *vs;
        struct vhost_virtqueue **vqs;
-        int r, i;
+        int r = -ENOMEM, i;
-        vs = kzalloc(sizeof(*vs), GFP_KERNEL);
+        vs = kzalloc(sizeof(*vs), GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
-        if (!vs)
+        if (!vs) {
-                return -ENOMEM;
+                vs = vzalloc(sizeof(*vs));
+                if (!vs)
+                        goto err_vs;
+        }
        vqs = kmalloc(VHOST_SCSI_MAX_VQ * sizeof(*vqs), GFP_KERNEL);
-        if (!vqs) {
+        if (!vqs)
-                kfree(vs);
+                goto err_vqs;
-                return -ENOMEM;
-        }
        vhost_work_init(&vs->vs_completion_work, vhost_scsi_complete_cmd_work);
        vhost_work_init(&vs->vs_event_work, tcm_vhost_evt_work);
@@ -1407,14 +1421,18 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
        tcm_vhost_init_inflight(vs, NULL);
-        if (r < 0) {
+        if (r < 0)
-                kfree(vqs);
+                goto err_init;
-                kfree(vs);
-                return r;
-        }
        f->private_data = vs;
        return 0;
+err_init:
+        kfree(vqs);
+err_vqs:
+        vhost_scsi_free(vs);
+err_vs:
+        return r;
 }
 static int vhost_scsi_release(struct inode *inode, struct file *f)
@@ -1431,7 +1449,7 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
        /* Jobs can re-queue themselves in evt kick handler. Do extra flush. */
        vhost_scsi_flush(vs);
        kfree(vs->dev.vqs);
-        kfree(vs);
+        vhost_scsi_free(vs);
        return 0;
 }
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 9a9502a4aa50..69068e0d8f31 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -161,9 +161,11 @@ void vhost_work_queue(struct vhost_dev *dev, struct vhost_work *work)
        if (list_empty(&work->node)) {
                list_add_tail(&work->node, &dev->work_list);
                work->queue_seq++;
+                spin_unlock_irqrestore(&dev->work_lock, flags);
                wake_up_process(dev->worker);
+        } else {
+                spin_unlock_irqrestore(&dev->work_lock, flags);
        }
-        spin_unlock_irqrestore(&dev->work_lock, flags);
 }
 EXPORT_SYMBOL_GPL(vhost_work_queue);
diff --git a/drivers/video/mmp/hw/mmp_ctrl.c b/drivers/video/mmp/hw/mmp_ctrl.c
index 75dca19bf214..6ac755270ab4 100644
--- a/drivers/video/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/mmp/hw/mmp_ctrl.c
@@ -514,7 +514,7 @@ static int mmphw_probe(struct platform_device *pdev)
        if (IS_ERR(ctrl->clk)) {
                dev_err(ctrl->dev, "unable to get clk %s\n", mi->clk_name);
                ret = -ENOENT;
-                goto failed_get_clk;
+                goto failed;
        }
        clk_prepare_enable(ctrl->clk);
@@ -551,21 +551,8 @@ failed_path_init:
                path_deinit(path_plat);
        }
-        if (ctrl->clk) {
+        clk_disable_unprepare(ctrl->clk);
-                devm_clk_put(ctrl->dev, ctrl->clk);
-                clk_disable_unprepare(ctrl->clk);
-        }
-failed_get_clk:
-        devm_free_irq(ctrl->dev, ctrl->irq, ctrl);
 failed:
-        if (ctrl) {
-                if (ctrl->reg_base)
-                        devm_iounmap(ctrl->dev, ctrl->reg_base);
-                devm_release_mem_region(ctrl->dev, res->start,
-                                resource_size(res));
-                devm_kfree(ctrl->dev, ctrl);
-        }
        dev_err(&pdev->dev, "device init failed\n");
        return ret;
diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c
index d250ed0f806d..27197a8048c0 100644
--- a/drivers/video/mxsfb.c
+++ b/drivers/video/mxsfb.c
@@ -620,6 +620,7 @@ static int mxsfb_restore_mode(struct mxsfb_info *host)
                break;
        case 3:
                bits_per_pixel = 32;
+                break;
        case 1:
        default:
                return -EINVAL;
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index 7ef079c146e7..c172a5281f9e 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -2075,6 +2075,7 @@ static int neofb_probe(struct pci_dev *dev, const struct pci_device_id *id)
        if (!fb_find_mode(&info->var, info, mode_option, NULL, 0,
                        info->monspecs.modedb, 16)) {
                printk(KERN_ERR "neofb: Unable to find usable video mode.\n");
+                err = -EINVAL;
                goto err_map_video;
        }
@@ -2097,7 +2098,8 @@ static int neofb_probe(struct pci_dev *dev, const struct pci_device_id *id)
               info->fix.smem_len >> 10, info->var.xres,
               info->var.yres, h_sync / 1000, h_sync % 1000, v_sync);
-        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0)
+        err = fb_alloc_cmap(&info->cmap, 256, 0);
+        if (err < 0)
                goto err_map_video;
        err = register_framebuffer(info);
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 171821ddd78d..ba5b40f581f6 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -120,7 +120,7 @@ int of_get_display_timing(struct device_node *np, const char *name,
                return -EINVAL;
        }
-        timing_np = of_find_node_by_name(np, name);
+        timing_np = of_get_child_by_name(np, name);
        if (!timing_np) {
                pr_err("%s: could not find node '%s'\n",
                        of_node_full_name(np), name);
@@ -143,11 +143,11 @@ struct display_timings *of_get_display_timings(struct device_node *np)
        struct display_timings *disp;
        if (!np) {
-                pr_err("%s: no devicenode given\n", of_node_full_name(np));
+                pr_err("%s: no device node given\n", of_node_full_name(np));
                return NULL;
        }
-        timings_np = of_find_node_by_name(np, "display-timings");
+        timings_np = of_get_child_by_name(np, "display-timings");
        if (!timings_np) {
                pr_err("%s: could not find display-timings node\n",
                        of_node_full_name(np));
diff --git a/drivers/video/omap2/displays-new/Kconfig b/drivers/video/omap2/displays-new/Kconfig
index 6c90885b0940..10b25e7cd878 100644
--- a/drivers/video/omap2/displays-new/Kconfig
+++ b/drivers/video/omap2/displays-new/Kconfig
@@ -35,6 +35,7 @@ config DISPLAY_PANEL_DPI
 config DISPLAY_PANEL_DSI_CM
        tristate "Generic DSI Command Mode Panel"
+        depends on BACKLIGHT_CLASS_DEVICE
        help
          Driver for generic DSI command mode panels.
diff --git a/drivers/video/omap2/displays-new/connector-analog-tv.c b/drivers/video/omap2/displays-new/connector-analog-tv.c
index 1b60698f141e..ccd9073f706f 100644
--- a/drivers/video/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/omap2/displays-new/connector-analog-tv.c
@@ -191,7 +191,7 @@ static int tvc_probe_pdata(struct platform_device *pdev)
        in = omap_dss_find_output(pdata->source);
        if (in == NULL) {
                dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        ddata->in = in;
diff --git a/drivers/video/omap2/displays-new/connector-dvi.c b/drivers/video/omap2/displays-new/connector-dvi.c
index bc5f8ceda371..63d88ee6dfe4 100644
--- a/drivers/video/omap2/displays-new/connector-dvi.c
+++ b/drivers/video/omap2/displays-new/connector-dvi.c
@@ -263,7 +263,7 @@ static int dvic_probe_pdata(struct platform_device *pdev)
        in = omap_dss_find_output(pdata->source);
        if (in == NULL) {
                dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        ddata->in = in;
diff --git a/drivers/video/omap2/displays-new/connector-hdmi.c b/drivers/video/omap2/displays-new/connector-hdmi.c
index c5826716d6ab..9abe2c039ae9 100644
--- a/drivers/video/omap2/displays-new/connector-hdmi.c
+++ b/drivers/video/omap2/displays-new/connector-hdmi.c
@@ -290,7 +290,7 @@ static int hdmic_probe_pdata(struct platform_device *pdev)
        in = omap_dss_find_output(pdata->source);
        if (in == NULL) {
                dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        ddata->in = in;
diff --git a/drivers/video/omap2/dss/dispc.c b/drivers/video/omap2/dss/dispc.c
index 02a7340111df..477975009eee 100644
--- a/drivers/video/omap2/dss/dispc.c
+++ b/drivers/video/omap2/dss/dispc.c
@@ -3691,6 +3691,7 @@ static int __init omap_dispchw_probe(struct platform_device *pdev)
        }
        pm_runtime_enable(&pdev->dev);
+        pm_runtime_irq_safe(&pdev->dev);
        r = dispc_runtime_get();
        if (r)
diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
index 47ca86c5c6c0..d838ba829459 100644
--- a/drivers/video/s3fb.c
+++ b/drivers/video/s3fb.c
@@ -1336,14 +1336,7 @@ static int s3_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                        (info->var.bits_per_pixel * info->var.xres_virtual);
        if (info->var.yres_virtual < info->var.yres) {
                dev_err(info->device, "virtual vertical size smaller than real\n");
-                goto err_find_mode;
+                rc = -EINVAL;
-        }
-        /* maximize virtual vertical size for fast scrolling */
-        info->var.yres_virtual = info->fix.smem_len * 8 /
-                        (info->var.bits_per_pixel * info->var.xres_virtual);
-        if (info->var.yres_virtual < info->var.yres) {
-                dev_err(info->device, "virtual vertical size smaller than real\n");
                goto err_find_mode;
        }
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index c7c64f18773d..fa932c2f7d97 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -613,6 +613,9 @@ static int w1_bus_notify(struct notifier_block *nb, unsigned long action,
        sl = dev_to_w1_slave(dev);
        fops = sl->family->fops;
+        if (!fops)
+                return 0;
        switch (action) {
        case BUS_NOTIFY_ADD_DEVICE:
                /* if the family driver needs to initialize something... */
@@ -713,7 +716,10 @@ static int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn)
        atomic_set(&sl->refcnt, 0);
        init_completion(&sl->released);
+        /* slave modules need to be loaded in a context with unlocked mutex */
+        mutex_unlock(&dev->mutex);
        request_module("w1-family-0x%0x", rn->family);
+        mutex_lock(&dev->mutex);
        spin_lock(&w1_flock);
        f = w1_family_registered(rn->family);
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 5be5e3d14f79..19f3c3fc65f4 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -802,6 +802,12 @@ static int hpwdt_init_one(struct pci_dev *dev,
                return -ENODEV;
        }
+        /*
+         * Ignore all auxilary iLO devices with the following PCI ID
+         */
+        if (dev->subsystem_device == 0x1979)
+                return -ENODEV;
        if (pci_enable_device(dev)) {
                dev_warn(&dev->dev,
                        "Not possible to enable PCI Device: 0x%x:0x%x.\n",
diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c
index 491419e0772a..5c3d4df63e68 100644
--- a/drivers/watchdog/kempld_wdt.c
+++ b/drivers/watchdog/kempld_wdt.c
@@ -35,7 +35,7 @@
 #define KEMPLD_WDT_STAGE_TIMEOUT(x)     (0x1b + (x) * 4)
 #define KEMPLD_WDT_STAGE_CFG(x)         (0x18 + (x))
 #define STAGE_CFG_GET_PRESCALER(x)      (((x) & 0x30) >> 4)
-#define STAGE_CFG_SET_PRESCALER(x)      (((x) & 0x30) << 4)
+#define STAGE_CFG_SET_PRESCALER(x)      (((x) & 0x3) << 4)
 #define STAGE_CFG_PRESCALER_MASK        0x30
 #define STAGE_CFG_ACTION_MASK           0x7
 #define STAGE_CFG_ASSERT                (1 << 3)
diff --git a/drivers/watchdog/sunxi_wdt.c b/drivers/watchdog/sunxi_wdt.c
index 1f94b42764aa..f6caa77151c7 100644
--- a/drivers/watchdog/sunxi_wdt.c
+++ b/drivers/watchdog/sunxi_wdt.c
@@ -146,7 +146,7 @@ static const struct watchdog_ops sunxi_wdt_ops = {
        .set_timeout    = sunxi_wdt_set_timeout,
 };
-static int __init sunxi_wdt_probe(struct platform_device *pdev)
+static int sunxi_wdt_probe(struct platform_device *pdev)
 {
        struct sunxi_wdt_dev *sunxi_wdt;
        struct resource *res;
@@ -187,7 +187,7 @@ static int __init sunxi_wdt_probe(struct platform_device *pdev)
        return 0;
 }
-static int __exit sunxi_wdt_remove(struct platform_device *pdev)
+static int sunxi_wdt_remove(struct platform_device *pdev)
 {
        struct sunxi_wdt_dev *sunxi_wdt = platform_get_drvdata(pdev);
diff --git a/drivers/watchdog/ts72xx_wdt.c b/drivers/watchdog/ts72xx_wdt.c
index 42913f131dc2..c9b0c627fe7e 100644
--- a/drivers/watchdog/ts72xx_wdt.c
+++ b/drivers/watchdog/ts72xx_wdt.c
@@ -310,7 +310,8 @@ static long ts72xx_wdt_ioctl(struct file *file, unsigned int cmd,
        case WDIOC_GETSTATUS:
        case WDIOC_GETBOOTSTATUS:
-                return put_user(0, p);
+                error = put_user(0, p);
+                break;
        case WDIOC_KEEPALIVE:
                ts72xx_wdt_kick(wdt);
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index a50c6e3a7cc4..b232908a6192 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -398,8 +398,6 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
        if (nr_pages > ARRAY_SIZE(frame_list))
                nr_pages = ARRAY_SIZE(frame_list);
-        scratch_page = get_balloon_scratch_page();
        for (i = 0; i < nr_pages; i++) {
                page = alloc_page(gfp);
                if (page == NULL) {
@@ -413,6 +411,12 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                scrub_page(page);
+                /*
+                 * Ballooned out frames are effectively replaced with
+                 * a scratch frame.  Ensure direct mappings and the
+                 * p2m are consistent.
+                 */
+                scratch_page = get_balloon_scratch_page();
 #ifdef CONFIG_XEN_HAVE_PVMMU
                if (xen_pv_domain() && !PageHighMem(page)) {
                        ret = HYPERVISOR_update_va_mapping(
@@ -422,24 +426,19 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                        BUG_ON(ret);
                }
 #endif
-        }
-        /* Ensure that ballooned highmem pages don't have kmaps. */
-        kmap_flush_unused();
-        flush_tlb_all();
-        /* No more mappings: invalidate P2M and add to balloon. */
-        for (i = 0; i < nr_pages; i++) {
-                pfn = mfn_to_pfn(frame_list[i]);
                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
                        unsigned long p;
                        p = page_to_pfn(scratch_page);
                        __set_phys_to_machine(pfn, pfn_to_mfn(p));
                }
+                put_balloon_scratch_page();
                balloon_append(pfn_to_page(pfn));
        }
-        put_balloon_scratch_page();
+        /* Ensure that ballooned highmem pages don't have kmaps. */
+        kmap_flush_unused();
+        flush_tlb_all();
        set_xen_guest_handle(reservation.extent_start, frame_list);
        reservation.nr_extents   = nr_pages;