67 files changed, 478 insertions, 262 deletions

diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 071c1dfb93f3..350d52a8f781 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -68,7 +68,7 @@ MODULE_AUTHOR("Bruno Ducrot");
 MODULE_DESCRIPTION("ACPI Video Driver");
 MODULE_LICENSE("GPL");
 
-static bool brightness_switch_enabled;
+static bool brightness_switch_enabled = 1;
 module_param(brightness_switch_enabled, bool, 0644);
 
 /*
@@ -581,6 +581,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
         },
         {
         .callback = video_set_use_native_backlight,
+        .ident = "HP ProBook 4540s",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "HP ProBook 4540s"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
         .ident = "HP ProBook 2013 models",
         .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index dae5607e1115..4cd52a4541a9 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -456,6 +456,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
 
         /* Promise */
         { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
+        { PCI_VDEVICE(PROMISE, 0x3781), board_ahci },   /* FastTrak TX8660 ahci-mode */
 
         /* Asmedia */
         { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },   /* ASM1060 */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 18d97d5c7d90..d19c37a7abc9 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4787,6 +4787,10 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
  *      ata_qc_new - Request an available ATA command, for queueing
  *      @ap: target port
  *
+ *      Some ATA host controllers may implement a queue depth which is less
+ *      than ATA_MAX_QUEUE. So we shouldn't allocate a tag which is beyond
+ *      the hardware limitation.
+ *
  *      LOCKING:
  *      None.
  */
@@ -4794,14 +4798,16 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
 {
         struct ata_queued_cmd *qc = NULL;
-        unsigned int i, tag;
+        unsigned int i, tag, max_queue;
+
+        max_queue = ap->scsi_host->can_queue;
 
         /* no command while frozen */
         if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
                 return NULL;
 
-        for (i = 0; i < ATA_MAX_QUEUE; i++) {
-                tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
+        for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
+                tag = tag < max_queue ? tag : 0;
 
                 /* the last tag is reserved for internal command. */
                 if (tag == ATA_TAG_INTERNAL)
@@ -6169,6 +6175,16 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
 {
         int i, rc;
 
+        /*
+         * The max queue supported by hardware must not be greater than
+         * ATA_MAX_QUEUE.
+         */
+        if (sht->can_queue > ATA_MAX_QUEUE) {
+                dev_err(host->dev, "BUG: the hardware max queue is too large\n");
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
         /* host must have been started */
         if (!(host->flags & ATA_HOST_STARTED)) {
                 dev_err(host->dev, "BUG: trying to register unstarted host\n");
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 6760fc4e85b8..dad83df555c4 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1811,7 +1811,7 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc,
         case ATA_DEV_ATA:
                 if (err & ATA_ICRC)
                         qc->err_mask |= AC_ERR_ATA_BUS;
-                if (err & ATA_UNC)
+                if (err & (ATA_UNC | ATA_AMNF))
                         qc->err_mask |= AC_ERR_MEDIA;
                 if (err & ATA_IDNF)
                         qc->err_mask |= AC_ERR_INVALID;
@@ -2556,11 +2556,12 @@ static void ata_eh_link_report(struct ata_link *link)
                 }
 
                 if (cmd->command != ATA_CMD_PACKET &&
-                    (res->feature & (ATA_ICRC | ATA_UNC | ATA_IDNF |
-                                     ATA_ABORTED)))
-                        ata_dev_err(qc->dev, "error: { %s%s%s%s}\n",
+                    (res->feature & (ATA_ICRC | ATA_UNC | ATA_AMNF |
+                                     ATA_IDNF | ATA_ABORTED)))
+                        ata_dev_err(qc->dev, "error: { %s%s%s%s%s}\n",
                           res->feature & ATA_ICRC ? "ICRC " : "",
                           res->feature & ATA_UNC ? "UNC " : "",
+                          res->feature & ATA_AMNF ? "AMNF " : "",
                           res->feature & ATA_IDNF ? "IDNF " : "",
                           res->feature & ATA_ABORTED ? "ABRT " : "");
 #endif
diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index 6ad5c072ce34..4d37c5415fc7 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -915,7 +915,7 @@ static int ep93xx_pata_probe(struct platform_device *pdev)
         struct ep93xx_pata_data *drv_data;
         struct ata_host *host;
         struct ata_port *ap;
-        unsigned int irq;
+        int irq;
         struct resource *mem_res;
         void __iomem *ide_base;
         int err;
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 9e9227e1762d..eee48c49f5de 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -89,8 +89,13 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
         return dev->archdata.irqs[num];
 #else
         struct resource *r;
-        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
-                return of_irq_get(dev->dev.of_node, num);
+        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node) {
+                int ret;
+
+                ret = of_irq_get(dev->dev.of_node, num);
+                if (ret >= 0 || ret == -EPROBE_DEFER)
+                        return ret;
+        }
 
         r = platform_get_resource(dev, IORESOURCE_IRQ, num);
 
@@ -133,8 +138,13 @@ int platform_get_irq_byname(struct platform_device *dev, const char *name)
 {
         struct resource *r;
 
-        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
-                return of_irq_get_byname(dev->dev.of_node, name);
+        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node) {
+                int ret;
+
+                ret = of_irq_get_byname(dev->dev.of_node, name);
+                if (ret >= 0 || ret == -EPROBE_DEFER)
+                        return ret;
+        }
 
         r = platform_get_resource_byname(dev, IORESOURCE_IRQ, name);
         return r ? r->start : -ENXIO;
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 1b35c45c92b7..3f2e16738080 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -544,6 +544,12 @@ void conn_try_outdate_peer_async(struct drbd_connection *connection)
         struct task_struct *opa;
 
         kref_get(&connection->kref);
+        /* We may just have force_sig()'ed this thread
+         * to get it out of some blocking network function.
+         * Clear signals; otherwise kthread_run(), which internally uses
+         * wait_on_completion_killable(), will mistake our pending signal
+         * for a new fatal signal and fail. */
+        flush_signals(current);
         opa = kthread_run(_try_outdate_peer_async, connection, "drbd_async_h");
         if (IS_ERR(opa)) {
                 drbd_err(connection, "out of mem, failed to invoke fence-peer helper\n");
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 334601cc81cf..c4419ea1ab07 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -55,16 +55,41 @@ static DEFINE_MUTEX(rng_mutex);
 static int data_avail;
 static u8 *rng_buffer;
 
+static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
+                               int wait);
+
 static size_t rng_buffer_size(void)
 {
         return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
 }
 
+static void add_early_randomness(struct hwrng *rng)
+{
+        unsigned char bytes[16];
+        int bytes_read;
+
+        /*
+         * Currently only virtio-rng cannot return data during device
+         * probe, and that's handled in virtio-rng.c itself.  If there
+         * are more such devices, this call to rng_get_data can be
+         * made conditional here instead of doing it per-device.
+         */
+        bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
+        if (bytes_read > 0)
+                add_device_randomness(bytes, bytes_read);
+}
+
 static inline int hwrng_init(struct hwrng *rng)
 {
-        if (!rng->init)
-                return 0;
-        return rng->init(rng);
+        if (rng->init) {
+                int ret;
+
+                ret =  rng->init(rng);
+                if (ret)
+                        return ret;
+        }
+        add_early_randomness(rng);
+        return 0;
 }
 
 static inline void hwrng_cleanup(struct hwrng *rng)
@@ -304,8 +329,6 @@ int hwrng_register(struct hwrng *rng)
 {
         int err = -EINVAL;
         struct hwrng *old_rng, *tmp;
-        unsigned char bytes[16];
-        int bytes_read;
 
         if (rng->name == NULL ||
             (rng->data_read == NULL && rng->read == NULL))
@@ -347,9 +370,17 @@ int hwrng_register(struct hwrng *rng)
         INIT_LIST_HEAD(&rng->list);
         list_add_tail(&rng->list, &rng_list);
 
-        bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
-        if (bytes_read > 0)
-                add_device_randomness(bytes, bytes_read);
+        if (old_rng && !rng->init) {
+                /*
+                 * Use a new device's input to add some randomness to
+                 * the system.  If this rng device isn't going to be
+                 * used right away, its init function hasn't been
+                 * called yet; so only use the randomness from devices
+                 * that don't need an init callback.
+                 */
+                add_early_randomness(rng);
+        }
+
 out_unlock:
         mutex_unlock(&rng_mutex);
 out:
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index f3e71501de54..e9b15bc18b4d 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -38,6 +38,8 @@ struct virtrng_info {
         int index;
 };
 
+static bool probe_done;
+
 static void random_recv_done(struct virtqueue *vq)
 {
         struct virtrng_info *vi = vq->vdev->priv;
@@ -67,6 +69,13 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
         int ret;
         struct virtrng_info *vi = (struct virtrng_info *)rng->priv;
 
+        /*
+         * Don't ask host for data till we're setup.  This call can
+         * happen during hwrng_register(), after commit d9e7972619.
+         */
+        if (unlikely(!probe_done))
+                return 0;
+
         if (!vi->busy) {
                 vi->busy = true;
                 init_completion(&vi->have_data);
@@ -137,6 +146,7 @@ static int probe_common(struct virtio_device *vdev)
                 return err;
         }
 
+        probe_done = true;
         return 0;
 }
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 0a7ac0a7b252..71529e196b84 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -641,7 +641,7 @@ retry:
                 } while (unlikely(entropy_count < pool_size-2 && pnfrac));
         }
 
-        if (entropy_count < 0) {
+        if (unlikely(entropy_count < 0)) {
                 pr_warn("random: negative entropy/overflow: pool %s count %d\n",
                         r->name, entropy_count);
                 WARN_ON(1);
@@ -981,7 +981,7 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
                       int reserved)
 {
         int entropy_count, orig;
-        size_t ibytes;
+        size_t ibytes, nfrac;
 
         BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
 
@@ -999,7 +999,17 @@ retry:
         }
         if (ibytes < min)
                 ibytes = 0;
-        if ((entropy_count -= ibytes << (ENTROPY_SHIFT + 3)) < 0)
+
+        if (unlikely(entropy_count < 0)) {
+                pr_warn("random: negative entropy count: pool %s count %d\n",
+                        r->name, entropy_count);
+                WARN_ON(1);
+                entropy_count = 0;
+        }
+        nfrac = ibytes << (ENTROPY_SHIFT + 3);
+        if ((size_t) entropy_count > nfrac)
+                entropy_count -= nfrac;
+        else
                 entropy_count = 0;
 
         if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
@@ -1376,6 +1386,7 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
                             "with %d bits of entropy available\n",
                             current->comm, nonblocking_pool.entropy_total);
 
+        nbytes = min_t(size_t, nbytes, INT_MAX >> (ENTROPY_SHIFT + 3));
         ret = extract_entropy_user(&nonblocking_pool, buf, nbytes);
 
         trace_urandom_read(8 * nbytes, ENTROPY_BITS(&nonblocking_pool),
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index ebac67115009..7364a538e056 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -104,6 +104,7 @@ config ARM_IMX6Q_CPUFREQ
         tristate "Freescale i.MX6 cpufreq support"
         depends on ARCH_MXC
         depends on REGULATOR_ANATOP
+        select PM_OPP
         help
           This adds cpufreq driver support for Freescale i.MX6 series SoCs.
 
@@ -118,7 +119,7 @@ config ARM_INTEGRATOR
           If in doubt, say Y.
 
 config ARM_KIRKWOOD_CPUFREQ
-        def_bool MACH_KIRKWOOD
+        def_bool ARCH_KIRKWOOD || MACH_KIRKWOOD
         help
           This adds the CPUFreq driver for Marvell Kirkwood
           SoCs.
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index ee1ae303a07c..86beda9f950b 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -152,11 +152,8 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                 goto out_put_reg;
         }
 
-        ret = of_init_opp_table(cpu_dev);
-        if (ret) {
-                pr_err("failed to init OPP table: %d\n", ret);
-                goto out_put_clk;
-        }
+        /* OPPs might be populated at runtime, don't check for error here */
+        of_init_opp_table(cpu_dev);
 
         ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
         if (ret) {
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 62259d27f03e..6f024852c6fb 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1153,10 +1153,12 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
          * the creation of a brand new one. So we need to perform this update
          * by invoking update_policy_cpu().
          */
-        if (recover_policy && cpu != policy->cpu)
+        if (recover_policy && cpu != policy->cpu) {
                 update_policy_cpu(policy, cpu);
-        else
+                WARN_ON(kobject_move(&policy->kobj, &dev->kobj));
+        } else {
                 policy->cpu = cpu;
+        }
 
         cpumask_copy(policy->cpus, cpumask_of(cpu));
 
diff --git a/drivers/cpufreq/sa1110-cpufreq.c b/drivers/cpufreq/sa1110-cpufreq.c
index 546376719d8f..b5befc211172 100644
--- a/drivers/cpufreq/sa1110-cpufreq.c
+++ b/drivers/cpufreq/sa1110-cpufreq.c
@@ -349,7 +349,7 @@ static int __init sa1110_clk_init(void)
                         name = "K4S641632D";
                 if (machine_is_h3100())
                         name = "KM416S4030CT";
-                if (machine_is_jornada720())
+                if (machine_is_jornada720() || machine_is_h3600())
                         name = "K4S281632B-1H";
                 if (machine_is_nanoengine())
                         name = "MT48LC8M16A2TG-75";
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index eff1a2f22f09..dc79346689e6 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -346,6 +346,7 @@ static __initdata struct {
 
 struct param_info {
         int verbose;
+        int found;
         void *params;
 };
 
@@ -362,16 +363,12 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
             (strcmp(uname, "chosen") != 0 && strcmp(uname, "chosen@0") != 0))
                 return 0;
 
-        pr_info("Getting parameters from FDT:\n");
-
         for (i = 0; i < ARRAY_SIZE(dt_params); i++) {
                 prop = of_get_flat_dt_prop(node, dt_params[i].propname, &len);
-                if (!prop) {
-                        pr_err("Can't find %s in device tree!\n",
-                               dt_params[i].name);
+                if (!prop)
                         return 0;
-                }
                 dest = info->params + dt_params[i].offset;
+                info->found++;
 
                 val = of_read_number(prop, len / sizeof(u32));
 
@@ -390,10 +387,21 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
 int __init efi_get_fdt_params(struct efi_fdt_params *params, int verbose)
 {
         struct param_info info;
+        int ret;
+
+        pr_info("Getting EFI parameters from FDT:\n");
 
         info.verbose = verbose;
+        info.found = 0;
         info.params = params;
 
-        return of_scan_flat_dt(fdt_find_uefi_params, &info);
+        ret = of_scan_flat_dt(fdt_find_uefi_params, &info);
+        if (!info.found)
+                pr_info("UEFI not found.\n");
+        else if (!ret)
+                pr_err("Can't find '%s' in device tree!\n",
+                       dt_params[info.found].name);
+
+        return ret;
 }
 #endif /* CONFIG_EFI_PARAMS_FROM_FDT */
diff --git a/drivers/firmware/efi/fdt.c b/drivers/firmware/efi/fdt.c
index 82d774161cc9..507a3df46a5d 100644
--- a/drivers/firmware/efi/fdt.c
+++ b/drivers/firmware/efi/fdt.c
@@ -23,16 +23,6 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
         u32 fdt_val32;
         u64 fdt_val64;
 
-        /*
-         * Copy definition of linux_banner here.  Since this code is
-         * built as part of the decompressor for ARM v7, pulling
-         * in version.c where linux_banner is defined for the
-         * kernel brings other kernel dependencies with it.
-         */
-        const char linux_banner[] =
-            "Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@"
-            LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n";
-
         /* Do some checks on provided FDT, if it exists*/
         if (orig_fdt) {
                 if (fdt_check_header(orig_fdt)) {
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e27e7804c0b9..f0be855ddf45 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -11673,6 +11673,9 @@ static struct intel_quirk intel_quirks[] = {
 
         /* Toshiba CB35 Chromebook (Celeron 2955U) */
         { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
+
+        /* HP Chromebook 14 (Celeron 2955U) */
+        { 0x0a06, 0x103c, 0x21ed, quirk_backlight_present },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
@@ -11911,6 +11914,7 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                  * ...  */
                 plane = crtc->plane;
                 crtc->plane = !plane;
+                crtc->primary_enabled = true;
                 dev_priv->display.crtc_disable(&crtc->base);
                 crtc->plane = plane;
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 075170d1844f..8a1a4fbc06ac 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -906,8 +906,8 @@ intel_dp_compute_config(struct intel_encoder *encoder,
                 mode_rate = intel_dp_link_required(adjusted_mode->crtc_clock,
                                                    bpp);
 
-                for (lane_count = min_lane_count; lane_count <= max_lane_count; lane_count <<= 1) {
-                        for (clock = min_clock; clock <= max_clock; clock++) {
+                for (clock = min_clock; clock <= max_clock; clock++) {
+                        for (lane_count = min_lane_count; lane_count <= max_lane_count; lane_count <<= 1) {
                                 link_clock = drm_dp_bw_code_to_link_rate(bws[clock]);
                                 link_avail = intel_dp_max_data_rate(link_clock,
                                                                     lane_count);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 23126023aeba..5e5a72fca5fb 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -111,6 +111,13 @@ static void intel_lvds_get_config(struct intel_encoder *encoder,
 
         pipe_config->adjusted_mode.flags |= flags;
 
+        /* gen2/3 store dither state in pfit control, needs to match */
+        if (INTEL_INFO(dev)->gen < 4) {
+                tmp = I915_READ(PFIT_CONTROL);
+
+                pipe_config->gmch_pfit.control |= tmp & PANEL_8TO6_DITHER_ENABLE;
+        }
+
         dotclock = pipe_config->port_clock;
 
         if (HAS_PCH_SPLIT(dev_priv->dev))
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 628cd8938274..12b02fe1d0ae 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -361,16 +361,16 @@ void intel_gmch_panel_fitting(struct intel_crtc *intel_crtc,
                 pfit_control |= ((intel_crtc->pipe << PFIT_PIPE_SHIFT) |
                                  PFIT_FILTER_FUZZY);
 
-        /* Make sure pre-965 set dither correctly for 18bpp panels. */
-        if (INTEL_INFO(dev)->gen < 4 && pipe_config->pipe_bpp == 18)
-                pfit_control |= PANEL_8TO6_DITHER_ENABLE;
-
 out:
         if ((pfit_control & PFIT_ENABLE) == 0) {
                 pfit_control = 0;
                 pfit_pgm_ratios = 0;
         }
 
+        /* Make sure pre-965 set dither correctly for 18bpp panels. */
+        if (INTEL_INFO(dev)->gen < 4 && pipe_config->pipe_bpp == 18)
+                pfit_control |= PANEL_8TO6_DITHER_ENABLE;
+
         pipe_config->gmch_pfit.control = pfit_control;
         pipe_config->gmch_pfit.pgm_ratios = pfit_pgm_ratios;
         pipe_config->gmch_pfit.lvds_border_bits = border;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
index cfde9eb44ad0..6212537b90c5 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
@@ -192,11 +192,11 @@ alarm_timer_callback(struct nouveau_alarm *alarm)
         nouveau_therm_threshold_hyst_polling(therm, &sensor->thrs_shutdown,
                                              NOUVEAU_THERM_THRS_SHUTDOWN);
 
+        spin_unlock_irqrestore(&priv->sensor.alarm_program_lock, flags);
+
         /* schedule the next poll in one second */
         if (therm->temp_get(therm) >= 0 && list_empty(&alarm->head))
-                ptimer->alarm(ptimer, 1000 * 1000 * 1000, alarm);
-
-        spin_unlock_irqrestore(&priv->sensor.alarm_program_lock, flags);
+                ptimer->alarm(ptimer, 1000000000ULL, alarm);
 }
 
 void
diff --git a/drivers/gpu/drm/qxl/qxl_irq.c b/drivers/gpu/drm/qxl/qxl_irq.c
index 34d6a85e9023..0bf1e20c6e44 100644
--- a/drivers/gpu/drm/qxl/qxl_irq.c
+++ b/drivers/gpu/drm/qxl/qxl_irq.c
@@ -33,6 +33,9 @@ irqreturn_t qxl_irq_handler(int irq, void *arg)
 
         pending = xchg(&qdev->ram_header->int_pending, 0);
 
+        if (!pending)
+                return IRQ_NONE;
+
         atomic_inc(&qdev->irq_received);
 
         if (pending & QXL_INTERRUPT_DISPLAY) {
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index a03c73411a56..30d242b25078 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1414,8 +1414,8 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
         tmp &= ~EVERGREEN_GRPH_SURFACE_UPDATE_H_RETRACE_EN;
         WREG32(EVERGREEN_GRPH_FLIP_CONTROL + radeon_crtc->crtc_offset, tmp);
 
-        /* set pageflip to happen anywhere in vblank interval */
-        WREG32(EVERGREEN_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 0);
+        /* set pageflip to happen only at start of vblank interval (front porch) */
+        WREG32(EVERGREEN_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 3);
 
         if (!atomic && fb && fb != crtc->primary->fb) {
                 radeon_fb = to_radeon_framebuffer(fb);
@@ -1614,8 +1614,8 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
         tmp &= ~AVIVO_D1GRPH_SURFACE_UPDATE_H_RETRACE_EN;
         WREG32(AVIVO_D1GRPH_FLIP_CONTROL + radeon_crtc->crtc_offset, tmp);
 
-        /* set pageflip to happen anywhere in vblank interval */
-        WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 0);
+        /* set pageflip to happen only at start of vblank interval (front porch) */
+        WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 3);
 
         if (!atomic && fb && fb != crtc->primary->fb) {
                 radeon_fb = to_radeon_framebuffer(fb);
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 2b2908440644..7d68203a3737 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -183,7 +183,6 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
         struct backlight_properties props;
         struct radeon_backlight_privdata *pdata;
         struct radeon_encoder_atom_dig *dig;
-        u8 backlight_level;
         char bl_name[16];
 
         /* Mac laptops with multiple GPUs use the gmux driver for backlight
@@ -222,12 +221,17 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
 
         pdata->encoder = radeon_encoder;
 
-        backlight_level = radeon_atom_get_backlight_level_from_reg(rdev);
-
         dig = radeon_encoder->enc_priv;
         dig->bl_dev = bd;
 
         bd->props.brightness = radeon_atom_backlight_get_brightness(bd);
+        /* Set a reasonable default here if the level is 0 otherwise
+         * fbdev will attempt to turn the backlight on after console
+         * unblanking and it will try and restore 0 which turns the backlight
+         * off again.
+         */
+        if (bd->props.brightness == 0)
+                bd->props.brightness = RADEON_MAX_BL_LEVEL;
         bd->props.power = FB_BLANK_UNBLANK;
         backlight_update_status(bd);
 
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f7ece0ff431b..250bac3935a4 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2642,8 +2642,9 @@ void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *s
         for (i = 0; i < rdev->num_crtc; i++) {
                 if (save->crtc_enabled[i]) {
                         tmp = RREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i]);
-                        if ((tmp & 0x3) != 0) {
-                                tmp &= ~0x3;
+                        if ((tmp & 0x7) != 3) {
+                                tmp &= ~0x7;
+                                tmp |= 0x3;
                                 WREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i], tmp);
                         }
                         tmp = RREG32(EVERGREEN_GRPH_UPDATE + crtc_offsets[i]);
diff --git a/drivers/gpu/drm/radeon/evergreen_reg.h b/drivers/gpu/drm/radeon/evergreen_reg.h
index 333d143fca2c..23bff590fb6e 100644
--- a/drivers/gpu/drm/radeon/evergreen_reg.h
+++ b/drivers/gpu/drm/radeon/evergreen_reg.h
@@ -239,7 +239,6 @@
 #       define EVERGREEN_CRTC_V_BLANK                   (1 << 0)
 #define EVERGREEN_CRTC_STATUS_POSITION                  0x6e90
 #define EVERGREEN_CRTC_STATUS_HV_COUNT                  0x6ea0
-#define EVERGREEN_MASTER_UPDATE_MODE                    0x6ef8
 #define EVERGREEN_CRTC_UPDATE_LOCK                      0x6ed4
 #define EVERGREEN_MASTER_UPDATE_LOCK                    0x6ef4
 #define EVERGREEN_MASTER_UPDATE_MODE                    0x6ef8
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 29d9cc04c04e..b7204500a9a6 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -684,10 +684,9 @@ struct radeon_flip_work {
         struct work_struct              unpin_work;
         struct radeon_device            *rdev;
         int                             crtc_id;
-        struct drm_framebuffer          *fb;
+        uint64_t                        base;
         struct drm_pending_vblank_event *event;
         struct radeon_bo                *old_rbo;
-        struct radeon_bo                *new_rbo;
         struct radeon_fence             *fence;
 };
 
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 13896edcf0b6..bf25061c8ac4 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -366,7 +366,6 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
         spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
 
         drm_vblank_put(rdev->ddev, radeon_crtc->crtc_id);
-        radeon_fence_unref(&work->fence);
         radeon_irq_kms_pflip_irq_put(rdev, work->crtc_id);
         queue_work(radeon_crtc->flip_queue, &work->unpin_work);
 }
@@ -386,51 +385,108 @@ static void radeon_flip_work_func(struct work_struct *__work)
         struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[work->crtc_id];
 
         struct drm_crtc *crtc = &radeon_crtc->base;
-        struct drm_framebuffer *fb = work->fb;
-
-        uint32_t tiling_flags, pitch_pixels;
-        uint64_t base;
-
         unsigned long flags;
         int r;
 
         down_read(&rdev->exclusive_lock);
-        while (work->fence) {
+        if (work->fence) {
                 r = radeon_fence_wait(work->fence, false);
                 if (r == -EDEADLK) {
                         up_read(&rdev->exclusive_lock);
                         r = radeon_gpu_reset(rdev);
                         down_read(&rdev->exclusive_lock);
                 }
+                if (r)
+                        DRM_ERROR("failed to wait on page flip fence (%d)!\n", r);
 
-                if (r) {
-                        DRM_ERROR("failed to wait on page flip fence (%d)!\n",
-                                  r);
-                        goto cleanup;
-                } else
-                        radeon_fence_unref(&work->fence);
+                /* We continue with the page flip even if we failed to wait on
+                 * the fence, otherwise the DRM core and userspace will be
+                 * confused about which BO the CRTC is scanning out
+                 */
+
+                radeon_fence_unref(&work->fence);
         }
 
+        /* We borrow the event spin lock for protecting flip_status */
+        spin_lock_irqsave(&crtc->dev->event_lock, flags);
+
+        /* set the proper interrupt */
+        radeon_irq_kms_pflip_irq_get(rdev, radeon_crtc->crtc_id);
+
+        /* do the flip (mmio) */
+        radeon_page_flip(rdev, radeon_crtc->crtc_id, work->base);
+
+        radeon_crtc->flip_status = RADEON_FLIP_SUBMITTED;
+        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+        up_read(&rdev->exclusive_lock);
+}
+
+static int radeon_crtc_page_flip(struct drm_crtc *crtc,
+                                 struct drm_framebuffer *fb,
+                                 struct drm_pending_vblank_event *event,
+                                 uint32_t page_flip_flags)
+{
+        struct drm_device *dev = crtc->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        struct radeon_framebuffer *old_radeon_fb;
+        struct radeon_framebuffer *new_radeon_fb;
+        struct drm_gem_object *obj;
+        struct radeon_flip_work *work;
+        struct radeon_bo *new_rbo;
+        uint32_t tiling_flags, pitch_pixels;
+        uint64_t base;
+        unsigned long flags;
+        int r;
+
+        work = kzalloc(sizeof *work, GFP_KERNEL);
+        if (work == NULL)
+                return -ENOMEM;
+
+        INIT_WORK(&work->flip_work, radeon_flip_work_func);
+        INIT_WORK(&work->unpin_work, radeon_unpin_work_func);
+
+        work->rdev = rdev;
+        work->crtc_id = radeon_crtc->crtc_id;
+        work->event = event;
+
+        /* schedule unpin of the old buffer */
+        old_radeon_fb = to_radeon_framebuffer(crtc->primary->fb);
+        obj = old_radeon_fb->obj;
+
+        /* take a reference to the old object */
+        drm_gem_object_reference(obj);
+        work->old_rbo = gem_to_radeon_bo(obj);
+
+        new_radeon_fb = to_radeon_framebuffer(fb);
+        obj = new_radeon_fb->obj;
+        new_rbo = gem_to_radeon_bo(obj);
+
+        spin_lock(&new_rbo->tbo.bdev->fence_lock);
+        if (new_rbo->tbo.sync_obj)
+                work->fence = radeon_fence_ref(new_rbo->tbo.sync_obj);
+        spin_unlock(&new_rbo->tbo.bdev->fence_lock);
+
         /* pin the new buffer */
-        DRM_DEBUG_DRIVER("flip-ioctl() cur_fbo = %p, cur_bbo = %p\n",
-                         work->old_rbo, work->new_rbo);
+        DRM_DEBUG_DRIVER("flip-ioctl() cur_rbo = %p, new_rbo = %p\n",
+                         work->old_rbo, new_rbo);
 
-        r = radeon_bo_reserve(work->new_rbo, false);
+        r = radeon_bo_reserve(new_rbo, false);
         if (unlikely(r != 0)) {
                 DRM_ERROR("failed to reserve new rbo buffer before flip\n");
                 goto cleanup;
         }
         /* Only 27 bit offset for legacy CRTC */
-        r = radeon_bo_pin_restricted(work->new_rbo, RADEON_GEM_DOMAIN_VRAM,
+        r = radeon_bo_pin_restricted(new_rbo, RADEON_GEM_DOMAIN_VRAM,
                                      ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27, &base);
         if (unlikely(r != 0)) {
-                radeon_bo_unreserve(work->new_rbo);
+                radeon_bo_unreserve(new_rbo);
                 r = -EINVAL;
                 DRM_ERROR("failed to pin new rbo buffer before flip\n");
                 goto cleanup;
         }
-        radeon_bo_get_tiling_flags(work->new_rbo, &tiling_flags, NULL);
-        radeon_bo_unreserve(work->new_rbo);
+        radeon_bo_get_tiling_flags(new_rbo, &tiling_flags, NULL);
+        radeon_bo_unreserve(new_rbo);
 
         if (!ASIC_IS_AVIVO(rdev)) {
                 /* crtc offset is from display base addr not FB location */
@@ -467,6 +523,7 @@ static void radeon_flip_work_func(struct work_struct *__work)
                 }
                 base &= ~7;
         }
+        work->base = base;
 
         r = drm_vblank_get(crtc->dev, radeon_crtc->crtc_id);
         if (r) {
@@ -477,100 +534,42 @@ static void radeon_flip_work_func(struct work_struct *__work)
         /* We borrow the event spin lock for protecting flip_work */
         spin_lock_irqsave(&crtc->dev->event_lock, flags);
 
-        /* set the proper interrupt */
-        radeon_irq_kms_pflip_irq_get(rdev, radeon_crtc->crtc_id);
+        if (radeon_crtc->flip_status != RADEON_FLIP_NONE) {
+                DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
+                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+                r = -EBUSY;
+                goto vblank_cleanup;
+        }
+        radeon_crtc->flip_status = RADEON_FLIP_PENDING;
+        radeon_crtc->flip_work = work;
 
-        /* do the flip (mmio) */
-        radeon_page_flip(rdev, radeon_crtc->crtc_id, base);
+        /* update crtc fb */
+        crtc->primary->fb = fb;
 
-        radeon_crtc->flip_status = RADEON_FLIP_SUBMITTED;
         spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
-        up_read(&rdev->exclusive_lock);
 
-        return;
+        queue_work(radeon_crtc->flip_queue, &work->flip_work);
+        return 0;
+
+vblank_cleanup:
+        drm_vblank_put(crtc->dev, radeon_crtc->crtc_id);
 
 pflip_cleanup:
-        if (unlikely(radeon_bo_reserve(work->new_rbo, false) != 0)) {
+        if (unlikely(radeon_bo_reserve(new_rbo, false) != 0)) {
                 DRM_ERROR("failed to reserve new rbo in error path\n");
                 goto cleanup;
         }
-        if (unlikely(radeon_bo_unpin(work->new_rbo) != 0)) {
+        if (unlikely(radeon_bo_unpin(new_rbo) != 0)) {
                 DRM_ERROR("failed to unpin new rbo in error path\n");
         }
-        radeon_bo_unreserve(work->new_rbo);
+        radeon_bo_unreserve(new_rbo);
 
 cleanup:
         drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
         radeon_fence_unref(&work->fence);
         kfree(work);
-        up_read(&rdev->exclusive_lock);
-}
-
-static int radeon_crtc_page_flip(struct drm_crtc *crtc,
-                                 struct drm_framebuffer *fb,
-                                 struct drm_pending_vblank_event *event,
-                                 uint32_t page_flip_flags)
-{
-        struct drm_device *dev = crtc->dev;
-        struct radeon_device *rdev = dev->dev_private;
-        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-        struct radeon_framebuffer *old_radeon_fb;
-        struct radeon_framebuffer *new_radeon_fb;
-        struct drm_gem_object *obj;
-        struct radeon_flip_work *work;
-        unsigned long flags;
-
-        work = kzalloc(sizeof *work, GFP_KERNEL);
-        if (work == NULL)
-                return -ENOMEM;
-
-        INIT_WORK(&work->flip_work, radeon_flip_work_func);
-        INIT_WORK(&work->unpin_work, radeon_unpin_work_func);
-
-        work->rdev = rdev;
-        work->crtc_id = radeon_crtc->crtc_id;
-        work->fb = fb;
-        work->event = event;
-
-        /* schedule unpin of the old buffer */
-        old_radeon_fb = to_radeon_framebuffer(crtc->primary->fb);
-        obj = old_radeon_fb->obj;
-
-        /* take a reference to the old object */
-        drm_gem_object_reference(obj);
-        work->old_rbo = gem_to_radeon_bo(obj);
-
-        new_radeon_fb = to_radeon_framebuffer(fb);
-        obj = new_radeon_fb->obj;
-        work->new_rbo = gem_to_radeon_bo(obj);
-
-        spin_lock(&work->new_rbo->tbo.bdev->fence_lock);
-        if (work->new_rbo->tbo.sync_obj)
-                work->fence = radeon_fence_ref(work->new_rbo->tbo.sync_obj);
-        spin_unlock(&work->new_rbo->tbo.bdev->fence_lock);
-
-        /* We borrow the event spin lock for protecting flip_work */
-        spin_lock_irqsave(&crtc->dev->event_lock, flags);
 
-        if (radeon_crtc->flip_status != RADEON_FLIP_NONE) {
-                DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
-                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
-                drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
-                radeon_fence_unref(&work->fence);
-                kfree(work);
-                return -EBUSY;
-        }
-        radeon_crtc->flip_status = RADEON_FLIP_PENDING;
-        radeon_crtc->flip_work = work;
-
-        /* update crtc fb */
-        crtc->primary->fb = fb;
-
-        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
-
-        queue_work(radeon_crtc->flip_queue, &work->flip_work);
-
-        return 0;
+        return r;
 }
 
 static int
@@ -830,6 +829,10 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
         struct radeon_device *rdev = dev->dev_private;
         int ret = 0;
 
+        /* don't leak the edid if we already fetched it in detect() */
+        if (radeon_connector->edid)
+                goto got_edid;
+
         /* on hw with routers, select right port */
         if (radeon_connector->router.ddc_valid)
                 radeon_router_select_ddc_port(radeon_connector);
@@ -868,6 +871,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
                         radeon_connector->edid = radeon_bios_get_hardcoded_edid(rdev);
         }
         if (radeon_connector->edid) {
+got_edid:
                 drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
                 ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
                 drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 237dd29d9f1c..3e21e869015f 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -406,8 +406,9 @@ void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
         for (i = 0; i < rdev->num_crtc; i++) {
                 if (save->crtc_enabled[i]) {
                         tmp = RREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + crtc_offsets[i]);
-                        if ((tmp & 0x3) != 0) {
-                                tmp &= ~0x3;
+                        if ((tmp & 0x7) != 3) {
+                                tmp &= ~0x7;
+                                tmp |= 0x3;
                                 WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + crtc_offsets[i], tmp);
                         }
                         tmp = RREG32(AVIVO_D1GRPH_UPDATE + crtc_offsets[i]);
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index eaaa3d843b80..23b2ce294c4c 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -246,8 +246,8 @@ void hv_fcopy_onchannelcallback(void *context)
                 /*
                  * Send the information to the user-level daemon.
                  */
-                fcopy_send_data();
                 schedule_delayed_work(&fcopy_work, 5*HZ);
+                fcopy_send_data();
                 return;
         }
         icmsghdr->icflags = ICMSGHDRFLAG_TRANSACTION | ICMSGHDRFLAG_RESPONSE;
diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 0f4dea5ccf17..9ee3913850d6 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -515,7 +515,7 @@ static ssize_t set_temp_min(struct device *dev,
                 return -EINVAL;
 
         temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
 
         mutex_lock(&data->lock);
         data->temp_min[attr->index] = temp;
@@ -549,7 +549,7 @@ static ssize_t set_temp_max(struct device *dev,
                 return -EINVAL;
 
         temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
 
         mutex_lock(&data->lock);
         data->temp_max[attr->index] = temp;
@@ -826,7 +826,7 @@ static ssize_t set_pwm_tmin(struct device *dev,
                 return -EINVAL;
 
         temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
 
         mutex_lock(&data->lock);
         data->pwm_tmin[attr->index] = temp;
diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c
index afd31042b452..d14ab3c45daa 100644
--- a/drivers/hwmon/da9052-hwmon.c
+++ b/drivers/hwmon/da9052-hwmon.c
@@ -194,7 +194,7 @@ static ssize_t da9052_hwmon_show_name(struct device *dev,
                                       struct device_attribute *devattr,
                                       char *buf)
 {
-        return sprintf(buf, "da9052-hwmon\n");
+        return sprintf(buf, "da9052\n");
 }
 
 static ssize_t show_label(struct device *dev,
diff --git a/drivers/hwmon/da9055-hwmon.c b/drivers/hwmon/da9055-hwmon.c
index 73b3865f1207..35eb7738d711 100644
--- a/drivers/hwmon/da9055-hwmon.c
+++ b/drivers/hwmon/da9055-hwmon.c
@@ -204,7 +204,7 @@ static ssize_t da9055_hwmon_show_name(struct device *dev,
                                       struct device_attribute *devattr,
                                       char *buf)
 {
-        return sprintf(buf, "da9055-hwmon\n");
+        return sprintf(buf, "da9055\n");
 }
 
 static ssize_t show_label(struct device *dev,
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 8fb46aab2d87..a04c49f2a011 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -416,6 +416,7 @@ config BLK_DEV_CY82C693
 
 config BLK_DEV_CS5520
         tristate "Cyrix CS5510/20 MediaGX chipset support (VERY EXPERIMENTAL)"
+        depends on X86_32 || COMPILE_TEST
         select BLK_DEV_IDEDMA_PCI
         help
           Include support for PIO tuning and virtual DMA on the Cyrix MediaGX
@@ -426,6 +427,7 @@ config BLK_DEV_CS5520
 
 config BLK_DEV_CS5530
         tristate "Cyrix/National Semiconductor CS5530 MediaGX chipset support"
+        depends on X86_32 || COMPILE_TEST
         select BLK_DEV_IDEDMA_PCI
         help
           Include support for UDMA on the Cyrix MediaGX 5530 chipset. This
@@ -435,7 +437,7 @@ config BLK_DEV_CS5530
 
 config BLK_DEV_CS5535
         tristate "AMD CS5535 chipset support"
-        depends on X86 && !X86_64
+        depends on X86_32
         select BLK_DEV_IDEDMA_PCI
         help
           Include support for UDMA on the NSC/AMD CS5535 companion chipset.
@@ -486,6 +488,7 @@ config BLK_DEV_JMICRON
 
 config BLK_DEV_SC1200
         tristate "National SCx200 chipset support"
+        depends on X86_32 || COMPILE_TEST
         select BLK_DEV_IDEDMA_PCI
         help
           This driver adds support for the on-board IDE controller on the
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 2a744a91370e..a3d3b1733c49 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -853,8 +853,9 @@ static int init_irq (ide_hwif_t *hwif)
         if (irq_handler == NULL)
                 irq_handler = ide_intr;
 
-        if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
-                goto out_up;
+        if (!host->get_lock)
+                if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
+                        goto out_up;
 
 #if !defined(__mc68000__)
         printk(KERN_INFO "%s at 0x%03lx-0x%03lx,0x%03lx on irq %d", hwif->name,
@@ -1533,7 +1534,8 @@ static void ide_unregister(ide_hwif_t *hwif)
 
         ide_proc_unregister_port(hwif);
 
-        free_irq(hwif->irq, hwif);
+        if (!hwif->host->get_lock)
+                free_irq(hwif->irq, hwif);
 
         device_unregister(hwif->portdev);
         device_unregister(&hwif->gendev);
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 17aeea170566..2a5fa9a436e5 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -111,8 +111,14 @@ static const int mma8452_samp_freq[8][2] = {
         {6, 250000}, {1, 560000}
 };
 
+/* 
+ * Hardware has fullscale of -2G, -4G, -8G corresponding to raw value -2048
+ * The userspace interface uses m/s^2 and we declare micro units
+ * So scale factor is given by:
+ *      g * N * 1000000 / 2048 for N = 2, 4, 8 and g=9.80665
+ */
 static const int mma8452_scales[3][2] = {
-        {0, 977}, {0, 1953}, {0, 3906}
+        {0, 9577}, {0, 19154}, {0, 38307}
 };
 
 static ssize_t mma8452_show_samp_freq_avail(struct device *dev,
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
index 258a973a1fb8..bfbf4d419f41 100644
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -345,6 +345,9 @@ static int iio_device_add_event(struct iio_dev *indio_dev,
                         &indio_dev->event_interface->dev_attr_list);
                 kfree(postfix);
 
+                if ((ret == -EBUSY) && (shared_by != IIO_SEPARATE))
+                        continue;
+
                 if (ret)
                         return ret;
 
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 5e153f6d4b48..768a0fb67dd6 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -432,8 +432,17 @@ static void arp_failure_discard(void *handle, struct sk_buff *skb)
  */
 static void act_open_req_arp_failure(void *handle, struct sk_buff *skb)
 {
+        struct c4iw_ep *ep = handle;
+
         printk(KERN_ERR MOD "ARP failure duing connect\n");
         kfree_skb(skb);
+        connect_reply_upcall(ep, -EHOSTUNREACH);
+        state_set(&ep->com, DEAD);
+        remove_handle(ep->com.dev, &ep->com.dev->atid_idr, ep->atid);
+        cxgb4_free_atid(ep->com.dev->rdev.lldi.tids, ep->atid);
+        dst_release(ep->dst);
+        cxgb4_l2t_release(ep->l2t);
+        c4iw_put_ep(&ep->com);
 }
 
 /*
@@ -658,7 +667,7 @@ static int send_connect(struct c4iw_ep *ep)
                 opt2 |= T5_OPT_2_VALID;
                 opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
         }
-        t4_set_arp_err_handler(skb, NULL, act_open_req_arp_failure);
+        t4_set_arp_err_handler(skb, ep, act_open_req_arp_failure);
 
         if (is_t4(ep->com.dev->rdev.lldi.adapter_type)) {
                 if (ep->com.remote_addr.ss_family == AF_INET) {
@@ -2180,7 +2189,6 @@ static void reject_cr(struct c4iw_dev *dev, u32 hwtid, struct sk_buff *skb)
         PDBG("%s c4iw_dev %p tid %u\n", __func__, dev, hwtid);
         BUG_ON(skb_cloned(skb));
         skb_trim(skb, sizeof(struct cpl_tid_release));
-        skb_get(skb);
         release_tid(&dev->rdev, hwtid, skb);
         return;
 }
@@ -3917,7 +3925,7 @@ int __init c4iw_cm_init(void)
         return 0;
 }
 
-void __exit c4iw_cm_term(void)
+void c4iw_cm_term(void)
 {
         WARN_ON(!list_empty(&timeout_list));
         flush_workqueue(workq);
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index dd93aadc996e..7db82b24302b 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -696,6 +696,7 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
                 pr_err(MOD "error allocating status page\n");
                 goto err4;
         }
+        rdev->status_page->db_off = 0;
         return 0;
 err4:
         c4iw_rqtpool_destroy(rdev);
@@ -729,7 +730,6 @@ static void c4iw_dealloc(struct uld_ctx *ctx)
         if (ctx->dev->rdev.oc_mw_kva)
                 iounmap(ctx->dev->rdev.oc_mw_kva);
         ib_dealloc_device(&ctx->dev->ibdev);
-        iwpm_exit(RDMA_NL_C4IW);
         ctx->dev = NULL;
 }
 
@@ -826,12 +826,6 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
                 setup_debugfs(devp);
         }
 
-        ret = iwpm_init(RDMA_NL_C4IW);
-        if (ret) {
-                pr_err("port mapper initialization failed with %d\n", ret);
-                ib_dealloc_device(&devp->ibdev);
-                return ERR_PTR(ret);
-        }
 
         return devp;
 }
@@ -1332,6 +1326,15 @@ static int __init c4iw_init_module(void)
                 pr_err("%s[%u]: Failed to add netlink callback\n"
                        , __func__, __LINE__);
 
+        err = iwpm_init(RDMA_NL_C4IW);
+        if (err) {
+                pr_err("port mapper initialization failed with %d\n", err);
+                ibnl_remove_client(RDMA_NL_C4IW);
+                c4iw_cm_term();
+                debugfs_remove_recursive(c4iw_debugfs_root);
+                return err;
+        }
+
         cxgb4_register_uld(CXGB4_ULD_RDMA, &c4iw_uld_info);
 
         return 0;
@@ -1349,6 +1352,7 @@ static void __exit c4iw_exit_module(void)
         }
         mutex_unlock(&dev_mutex);
         cxgb4_unregister_uld(CXGB4_ULD_RDMA);
+        iwpm_exit(RDMA_NL_C4IW);
         ibnl_remove_client(RDMA_NL_C4IW);
         c4iw_cm_term();
         debugfs_remove_recursive(c4iw_debugfs_root);
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 125bc5d1e175..361fff7a0742 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -908,7 +908,7 @@ int c4iw_destroy_ctrl_qp(struct c4iw_rdev *rdev);
 int c4iw_register_device(struct c4iw_dev *dev);
 void c4iw_unregister_device(struct c4iw_dev *dev);
 int __init c4iw_cm_init(void);
-void __exit c4iw_cm_term(void);
+void c4iw_cm_term(void);
 void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
                                struct c4iw_dev_ucontext *uctx);
 void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index d13ddf1c0033..bbbcf389272c 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -675,7 +675,7 @@ static int create_kernel_qp(struct mlx5_ib_dev *dev,
         int err;
 
         uuari = &dev->mdev.priv.uuari;
-        if (init_attr->create_flags & ~IB_QP_CREATE_SIGNATURE_EN)
+        if (init_attr->create_flags & ~(IB_QP_CREATE_SIGNATURE_EN | IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK))
                 return -EINVAL;
 
         if (init_attr->qp_type == MLX5_IB_QPT_REG_UMR)
diff --git a/drivers/iommu/fsl_pamu.c b/drivers/iommu/fsl_pamu.c
index b99dd88e31b9..bb446d742a2d 100644
--- a/drivers/iommu/fsl_pamu.c
+++ b/drivers/iommu/fsl_pamu.c
@@ -170,10 +170,10 @@ int pamu_disable_liodn(int liodn)
 static unsigned int map_addrspace_size_to_wse(phys_addr_t addrspace_size)
 {
         /* Bug if not a power of 2 */
-        BUG_ON(!is_power_of_2(addrspace_size));
+        BUG_ON((addrspace_size & (addrspace_size - 1)));
 
         /* window size is 2^(WSE+1) bytes */
-        return __ffs(addrspace_size) - 1;
+        return fls64(addrspace_size) - 2;
 }
 
 /* Derive the PAACE window count encoding for the subwindow count */
@@ -351,7 +351,7 @@ int pamu_config_ppaace(int liodn, phys_addr_t win_addr, phys_addr_t win_size,
         struct paace *ppaace;
         unsigned long fspi;
 
-        if (!is_power_of_2(win_size) || win_size < PAMU_PAGE_SIZE) {
+        if ((win_size & (win_size - 1)) || win_size < PAMU_PAGE_SIZE) {
                 pr_debug("window size too small or not a power of two %llx\n", win_size);
                 return -EINVAL;
         }
@@ -464,7 +464,7 @@ int pamu_config_spaace(int liodn, u32 subwin_cnt, u32 subwin,
                 return -ENOENT;
         }
 
-        if (!is_power_of_2(subwin_size) || subwin_size < PAMU_PAGE_SIZE) {
+        if ((subwin_size & (subwin_size - 1)) || subwin_size < PAMU_PAGE_SIZE) {
                 pr_debug("subwindow size out of range, or not a power of 2\n");
                 return -EINVAL;
         }
diff --git a/drivers/iommu/fsl_pamu_domain.c b/drivers/iommu/fsl_pamu_domain.c
index 93072ba44b1d..af47648301a9 100644
--- a/drivers/iommu/fsl_pamu_domain.c
+++ b/drivers/iommu/fsl_pamu_domain.c
@@ -301,7 +301,7 @@ static int check_size(u64 size, dma_addr_t iova)
          * Size must be a power of two and at least be equal
          * to PAMU page size.
          */
-        if (!is_power_of_2(size) || size < PAMU_PAGE_SIZE) {
+        if ((size & (size - 1)) || size < PAMU_PAGE_SIZE) {
                 pr_debug("%s: size too small or not a power of two\n", __func__);
                 return -EINVAL;
         }
@@ -335,11 +335,6 @@ static struct fsl_dma_domain *iommu_alloc_dma_domain(void)
         return domain;
 }
 
-static inline struct device_domain_info *find_domain(struct device *dev)
-{
-        return dev->archdata.iommu_domain;
-}
-
 static void remove_device_ref(struct device_domain_info *info, u32 win_cnt)
 {
         unsigned long flags;
@@ -380,7 +375,7 @@ static void attach_device(struct fsl_dma_domain *dma_domain, int liodn, struct d
          * Check here if the device is already attached to domain or not.
          * If the device is already attached to a domain detach it.
          */
-        old_domain_info = find_domain(dev);
+        old_domain_info = dev->archdata.iommu_domain;
         if (old_domain_info && old_domain_info->domain != dma_domain) {
                 spin_unlock_irqrestore(&device_domain_lock, flags);
                 detach_device(dev, old_domain_info->domain);
@@ -399,7 +394,7 @@ static void attach_device(struct fsl_dma_domain *dma_domain, int liodn, struct d
          * the info for the first LIODN as all
          * LIODNs share the same domain
          */
-        if (!old_domain_info)
+        if (!dev->archdata.iommu_domain)
                 dev->archdata.iommu_domain = info;
         spin_unlock_irqrestore(&device_domain_lock, flags);
 
@@ -1042,12 +1037,15 @@ root_bus:
                         group = get_shared_pci_device_group(pdev);
         }
 
+        if (!group)
+                group = ERR_PTR(-ENODEV);
+
         return group;
 }
 
 static int fsl_pamu_add_device(struct device *dev)
 {
-        struct iommu_group *group = NULL;
+        struct iommu_group *group = ERR_PTR(-ENODEV);
         struct pci_dev *pdev;
         const u32 *prop;
         int ret, len;
@@ -1070,7 +1068,7 @@ static int fsl_pamu_add_device(struct device *dev)
                         group = get_device_iommu_group(dev);
         }
 
-        if (!group || IS_ERR(group))
+        if (IS_ERR(group))
                 return PTR_ERR(group);
 
         ret = iommu_group_add_device(group, dev);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 7e11c9d6ae8c..7c131cf7cc13 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -42,6 +42,7 @@
 #include <linux/irqchip/chained_irq.h>
 #include <linux/irqchip/arm-gic.h>
 
+#include <asm/cputype.h>
 #include <asm/irq.h>
 #include <asm/exception.h>
 #include <asm/smp_plat.h>
@@ -954,7 +955,9 @@ void __init gic_init_bases(unsigned int gic_nr, int irq_start,
                 }
 
                 for_each_possible_cpu(cpu) {
-                        unsigned long offset = percpu_offset * cpu_logical_map(cpu);
+                        u32 mpidr = cpu_logical_map(cpu);
+                        u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+                        unsigned long offset = percpu_offset * core_id;
                         *per_cpu_ptr(gic->dist_base.percpu_base, cpu) = dist_base + offset;
                         *per_cpu_ptr(gic->cpu_base.percpu_base, cpu) = cpu_base + offset;
                 }
@@ -1071,8 +1074,10 @@ gic_of_init(struct device_node *node, struct device_node *parent)
         gic_cnt++;
         return 0;
 }
+IRQCHIP_DECLARE(gic_400, "arm,gic-400", gic_of_init);
 IRQCHIP_DECLARE(cortex_a15_gic, "arm,cortex-a15-gic", gic_of_init);
 IRQCHIP_DECLARE(cortex_a9_gic, "arm,cortex-a9-gic", gic_of_init);
+IRQCHIP_DECLARE(cortex_a7_gic, "arm,cortex-a7-gic", gic_of_init);
 IRQCHIP_DECLARE(msm_8660_qgic, "qcom,msm-8660-qgic", gic_of_init);
 IRQCHIP_DECLARE(msm_qgic2, "qcom,msm-qgic2", gic_of_init);
 
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 4ead4ba60656..d2899e7eb3aa 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -425,6 +425,15 @@ static int __open_metadata(struct dm_cache_metadata *cmd)
 
         disk_super = dm_block_data(sblock);
 
+        /* Verify the data block size hasn't changed */
+        if (le32_to_cpu(disk_super->data_block_size) != cmd->data_block_size) {
+                DMERR("changing the data block size (from %u to %llu) is not supported",
+                      le32_to_cpu(disk_super->data_block_size),
+                      (unsigned long long)cmd->data_block_size);
+                r = -EINVAL;
+                goto bad;
+        }
+
         r = __check_incompat_features(disk_super, cmd);
         if (r < 0)
                 goto bad;
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index b086a945edcb..e9d33ad59df5 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -613,6 +613,15 @@ static int __open_metadata(struct dm_pool_metadata *pmd)
 
         disk_super = dm_block_data(sblock);
 
+        /* Verify the data block size hasn't changed */
+        if (le32_to_cpu(disk_super->data_block_size) != pmd->data_block_size) {
+                DMERR("changing the data block size (from %u to %llu) is not supported",
+                      le32_to_cpu(disk_super->data_block_size),
+                      (unsigned long long)pmd->data_block_size);
+                r = -EINVAL;
+                goto bad_unlock_sblock;
+        }
+
         r = __check_incompat_features(disk_super, pmd);
         if (r < 0)
                 goto bad_unlock_sblock;
diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c
index 8637d2ed7623..2e3cdcfa0a67 100644
--- a/drivers/media/dvb-frontends/si2168.c
+++ b/drivers/media/dvb-frontends/si2168.c
@@ -60,7 +60,7 @@ static int si2168_cmd_execute(struct si2168 *s, struct si2168_cmd *cmd)
                                 jiffies_to_msecs(jiffies) -
                                 (jiffies_to_msecs(timeout) - TIMEOUT));
 
-                if (!(cmd->args[0] >> 7) & 0x01) {
+                if (!((cmd->args[0] >> 7) & 0x01)) {
                         ret = -ETIMEDOUT;
                         goto err_mutex_unlock;
                 }
@@ -485,20 +485,6 @@ static int si2168_init(struct dvb_frontend *fe)
         if (ret)
                 goto err;
 
-        cmd.args[0] = 0x05;
-        cmd.args[1] = 0x00;
-        cmd.args[2] = 0xaa;
-        cmd.args[3] = 0x4d;
-        cmd.args[4] = 0x56;
-        cmd.args[5] = 0x40;
-        cmd.args[6] = 0x00;
-        cmd.args[7] = 0x00;
-        cmd.wlen = 8;
-        cmd.rlen = 1;
-        ret = si2168_cmd_execute(s, &cmd);
-        if (ret)
-                goto err;
-
         /* cold state - try to download firmware */
         dev_info(&s->client->dev, "%s: found a '%s' in cold state\n",
                         KBUILD_MODNAME, si2168_ops.info.name);
diff --git a/drivers/media/dvb-frontends/si2168_priv.h b/drivers/media/dvb-frontends/si2168_priv.h
index 2a343e896f40..53f7f06ae343 100644
--- a/drivers/media/dvb-frontends/si2168_priv.h
+++ b/drivers/media/dvb-frontends/si2168_priv.h
@@ -22,7 +22,7 @@
 #include <linux/firmware.h>
 #include <linux/i2c-mux.h>
 
-#define SI2168_FIRMWARE "dvb-demod-si2168-01.fw"
+#define SI2168_FIRMWARE "dvb-demod-si2168-02.fw"
 
 /* state struct */
 struct si2168 {
diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
index 522fe00f5eee..9619be5d4827 100644
--- a/drivers/media/dvb-frontends/tda10071.c
+++ b/drivers/media/dvb-frontends/tda10071.c
@@ -668,6 +668,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
         struct dtv_frontend_properties *c = &fe->dtv_property_cache;
         int ret, i;
         u8 mode, rolloff, pilot, inversion, div;
+        fe_modulation_t modulation;
 
         dev_dbg(&priv->i2c->dev,
                         "%s: delivery_system=%d modulation=%d frequency=%d symbol_rate=%d inversion=%d pilot=%d rolloff=%d\n",
@@ -702,10 +703,13 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
 
         switch (c->delivery_system) {
         case SYS_DVBS:
+                modulation = QPSK;
                 rolloff = 0;
                 pilot = 2;
                 break;
         case SYS_DVBS2:
+                modulation = c->modulation;
+
                 switch (c->rolloff) {
                 case ROLLOFF_20:
                         rolloff = 2;
@@ -750,7 +754,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
 
         for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
                 if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
-                        c->modulation == TDA10071_MODCOD[i].modulation &&
+                        modulation == TDA10071_MODCOD[i].modulation &&
                         c->fec_inner == TDA10071_MODCOD[i].fec) {
                         mode = TDA10071_MODCOD[i].val;
                         dev_dbg(&priv->i2c->dev, "%s: mode found=%02x\n",
@@ -834,10 +838,10 @@ static int tda10071_get_frontend(struct dvb_frontend *fe)
 
         switch ((buf[1] >> 0) & 0x01) {
         case 0:
-                c->inversion = INVERSION_OFF;
+                c->inversion = INVERSION_ON;
                 break;
         case 1:
-                c->inversion = INVERSION_ON;
+                c->inversion = INVERSION_OFF;
                 break;
         }
 
@@ -856,7 +860,7 @@ static int tda10071_get_frontend(struct dvb_frontend *fe)
         if (ret)
                 goto error;
 
-        c->symbol_rate = (buf[0] << 16) | (buf[1] << 8) | (buf[2] << 0);
+        c->symbol_rate = ((buf[0] << 16) | (buf[1] << 8) | (buf[2] << 0)) * 1000;
 
         return ret;
 error:
diff --git a/drivers/media/dvb-frontends/tda10071_priv.h b/drivers/media/dvb-frontends/tda10071_priv.h
index 4baf14bfb65a..420486192736 100644
--- a/drivers/media/dvb-frontends/tda10071_priv.h
+++ b/drivers/media/dvb-frontends/tda10071_priv.h
@@ -55,6 +55,7 @@ static struct tda10071_modcod {
         { SYS_DVBS2, QPSK,  FEC_8_9,  0x0a },
         { SYS_DVBS2, QPSK,  FEC_9_10, 0x0b },
         /* 8PSK */
+        { SYS_DVBS2, PSK_8, FEC_AUTO, 0x00 },
         { SYS_DVBS2, PSK_8, FEC_3_5,  0x0c },
         { SYS_DVBS2, PSK_8, FEC_2_3,  0x0d },
         { SYS_DVBS2, PSK_8, FEC_3_4,  0x0e },
diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index e65c760e4e8b..0006d6bf8c18 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -179,7 +179,7 @@ static const struct v4l2_file_operations ts_fops =
         .read     = vb2_fop_read,
         .poll     = vb2_fop_poll,
         .mmap     = vb2_fop_mmap,
-        .ioctl    = video_ioctl2,
+        .unlocked_ioctl = video_ioctl2,
 };
 
 static const struct v4l2_ioctl_ops ts_ioctl_ops = {
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index a7ed16497903..1e4ec697fb10 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -269,6 +269,7 @@ err:
                 list_del(&buf->list);
                 vb2_buffer_done(&buf->vb, VB2_BUF_STATE_QUEUED);
         }
+        spin_unlock_irqrestore(&common->irqlock, flags);
 
         return ret;
 }
diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c
index 5bb085b19bcb..b431b58f39e3 100644
--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -233,6 +233,7 @@ err:
                 list_del(&buf->list);
                 vb2_buffer_done(&buf->vb, VB2_BUF_STATE_QUEUED);
         }
+        spin_unlock_irqrestore(&common->irqlock, flags);
 
         return ret;
 }
diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
index 271a752cee54..fa4cc7b880aa 100644
--- a/drivers/media/tuners/si2157.c
+++ b/drivers/media/tuners/si2157.c
@@ -57,7 +57,7 @@ static int si2157_cmd_execute(struct si2157 *s, struct si2157_cmd *cmd)
                         jiffies_to_msecs(jiffies) -
                         (jiffies_to_msecs(timeout) - TIMEOUT));
 
-        if (!(buf[0] >> 7) & 0x01) {
+        if (!((buf[0] >> 7) & 0x01)) {
                 ret = -ETIMEDOUT;
                 goto err_mutex_unlock;
         } else {
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 021e4d35e4d7..7b9b75f60774 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -704,15 +704,41 @@ static int af9035_read_config(struct dvb_usb_device *d)
                 if (ret < 0)
                         goto err;
 
-                if (tmp == 0x00)
-                        dev_dbg(&d->udev->dev,
-                                        "%s: [%d]tuner not set, using default\n",
-                                        __func__, i);
-                else
+                dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
+                                __func__, i, tmp);
+
+                /* tuner sanity check */
+                if (state->chip_type == 0x9135) {
+                        if (state->chip_version == 0x02) {
+                                /* IT9135 BX (v2) */
+                                switch (tmp) {
+                                case AF9033_TUNER_IT9135_60:
+                                case AF9033_TUNER_IT9135_61:
+                                case AF9033_TUNER_IT9135_62:
+                                        state->af9033_config[i].tuner = tmp;
+                                        break;
+                                }
+                        } else {
+                                /* IT9135 AX (v1) */
+                                switch (tmp) {
+                                case AF9033_TUNER_IT9135_38:
+                                case AF9033_TUNER_IT9135_51:
+                                case AF9033_TUNER_IT9135_52:
+                                        state->af9033_config[i].tuner = tmp;
+                                        break;
+                                }
+                        }
+                } else {
+                        /* AF9035 */
                         state->af9033_config[i].tuner = tmp;
+                }
 
-                dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
-                                __func__, i, state->af9033_config[i].tuner);
+                if (state->af9033_config[i].tuner != tmp) {
+                        dev_info(&d->udev->dev,
+                                        "%s: [%d] overriding tuner from %02x to %02x\n",
+                                        KBUILD_MODNAME, i, tmp,
+                                        state->af9033_config[i].tuner);
+                }
 
                 switch (state->af9033_config[i].tuner) {
                 case AF9033_TUNER_TUA9001:
diff --git a/drivers/media/usb/gspca/pac7302.c b/drivers/media/usb/gspca/pac7302.c
index 2fd1c5e31a0f..339adce7c7a5 100644
--- a/drivers/media/usb/gspca/pac7302.c
+++ b/drivers/media/usb/gspca/pac7302.c
@@ -928,6 +928,7 @@ static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x093a, 0x2620)},
         {USB_DEVICE(0x093a, 0x2621)},
         {USB_DEVICE(0x093a, 0x2622), .driver_info = FL_VFLIP},
+        {USB_DEVICE(0x093a, 0x2623), .driver_info = FL_VFLIP},
         {USB_DEVICE(0x093a, 0x2624), .driver_info = FL_VFLIP},
         {USB_DEVICE(0x093a, 0x2625)},
         {USB_DEVICE(0x093a, 0x2626)},
diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
index 0500c4175d5f..6bce01a674f9 100644
--- a/drivers/media/usb/hdpvr/hdpvr-video.c
+++ b/drivers/media/usb/hdpvr/hdpvr-video.c
@@ -82,7 +82,7 @@ static void hdpvr_read_bulk_callback(struct urb *urb)
 }
 
 /*=========================================================================*/
-/* bufffer bits */
+/* buffer bits */
 
 /* function expects dev->io_mutex to be hold by caller */
 int hdpvr_cancel_queue(struct hdpvr_device *dev)
@@ -926,7 +926,7 @@ static int hdpvr_s_ctrl(struct v4l2_ctrl *ctrl)
         case V4L2_CID_MPEG_AUDIO_ENCODING:
                 if (dev->flags & HDPVR_FLAG_AC3_CAP) {
                         opt->audio_codec = ctrl->val;
-                        return hdpvr_set_audio(dev, opt->audio_input,
+                        return hdpvr_set_audio(dev, opt->audio_input + 1,
                                               opt->audio_codec);
                 }
                 return 0;
@@ -1198,7 +1198,7 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
         v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
                 V4L2_CID_MPEG_AUDIO_ENCODING,
                 ac3 ? V4L2_MPEG_AUDIO_ENCODING_AC3 : V4L2_MPEG_AUDIO_ENCODING_AAC,
-                0x7, V4L2_MPEG_AUDIO_ENCODING_AAC);
+                0x7, ac3 ? dev->options.audio_codec : V4L2_MPEG_AUDIO_ENCODING_AAC);
         v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
                 V4L2_CID_MPEG_VIDEO_ENCODING,
                 V4L2_MPEG_VIDEO_ENCODING_MPEG_4_AVC, 0x3,
diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
index 4ae54caadd03..ce1c9f5d9dee 100644
--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
@@ -610,10 +610,10 @@ struct v4l2_fract v4l2_calc_aspect_ratio(u8 hor_landscape, u8 vert_portrait)
                 aspect.denominator = 9;
         } else if (ratio == 34) {
                 aspect.numerator = 4;
-                aspect.numerator = 3;
+                aspect.denominator = 3;
         } else if (ratio == 68) {
                 aspect.numerator = 15;
-                aspect.numerator = 9;
+                aspect.denominator = 9;
         } else {
                 aspect.numerator = hor_landscape + 99;
                 aspect.denominator = 100;
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index b04e7d059888..0431b46d9fd9 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -125,7 +125,7 @@ static struct ubi_ainf_volume *add_vol(struct ubi_attach_info *ai, int vol_id,
                 parent = *p;
                 av = rb_entry(parent, struct ubi_ainf_volume, rb);
 
-                if (vol_id < av->vol_id)
+                if (vol_id > av->vol_id)
                         p = &(*p)->rb_left;
                 else
                         p = &(*p)->rb_right;
@@ -423,7 +423,7 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
                                 pnum, err);
                         ret = err > 0 ? UBI_BAD_FASTMAP : err;
                         goto out;
-                } else if (ret == UBI_IO_BITFLIPS)
+                } else if (err == UBI_IO_BITFLIPS)
                         scrub = 1;
 
                 /*
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mr.c b/drivers/net/ethernet/mellanox/mlx5/core/mr.c
index ba0401d4af50..184c3615f479 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mr.c
@@ -94,6 +94,11 @@ int mlx5_core_create_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr,
         write_lock_irq(&table->lock);
         err = radix_tree_insert(&table->tree, mlx5_base_mkey(mr->key), mr);
         write_unlock_irq(&table->lock);
+        if (err) {
+                mlx5_core_warn(dev, "failed radix tree insert of mr 0x%x, %d\n",
+                               mlx5_base_mkey(mr->key), err);
+                mlx5_core_destroy_mkey(dev, mr);
+        }
 
         return err;
 }
@@ -104,12 +109,22 @@ int mlx5_core_destroy_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr)
         struct mlx5_mr_table *table = &dev->priv.mr_table;
         struct mlx5_destroy_mkey_mbox_in in;
         struct mlx5_destroy_mkey_mbox_out out;
+        struct mlx5_core_mr *deleted_mr;
         unsigned long flags;
         int err;
 
         memset(&in, 0, sizeof(in));
         memset(&out, 0, sizeof(out));
 
+        write_lock_irqsave(&table->lock, flags);
+        deleted_mr = radix_tree_delete(&table->tree, mlx5_base_mkey(mr->key));
+        write_unlock_irqrestore(&table->lock, flags);
+        if (!deleted_mr) {
+                mlx5_core_warn(dev, "failed radix tree delete of mr 0x%x\n",
+                               mlx5_base_mkey(mr->key));
+                return -ENOENT;
+        }
+
         in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_DESTROY_MKEY);
         in.mkey = cpu_to_be32(mlx5_mkey_to_idx(mr->key));
         err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
@@ -119,10 +134,6 @@ int mlx5_core_destroy_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr)
         if (out.hdr.status)
                 return mlx5_cmd_status_to_err(&out.hdr);
 
-        write_lock_irqsave(&table->lock, flags);
-        radix_tree_delete(&table->tree, mlx5_base_mkey(mr->key));
-        write_unlock_irqrestore(&table->lock, flags);
-
         return err;
 }
 EXPORT_SYMBOL(mlx5_core_destroy_mkey);
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index 15b3459f8656..220acb4cbee5 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -633,7 +633,6 @@ raw3270_reset_device_cb(struct raw3270_request *rq, void *data)
         } else
                 raw3270_writesf_readpart(rp);
         memset(&rp->init_reset, 0, sizeof(rp->init_reset));
-        memset(&rp->init_data, 0, sizeof(rp->init_data));
 }
 
 static int
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 69ef4f8cfac8..4038437ff033 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -901,10 +901,15 @@ static int ap_device_probe(struct device *dev)
         int rc;
 
         ap_dev->drv = ap_drv;
+
+        spin_lock_bh(&ap_device_list_lock);
+        list_add(&ap_dev->list, &ap_device_list);
+        spin_unlock_bh(&ap_device_list_lock);
+
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
-        if (!rc) {
+        if (rc) {
                 spin_lock_bh(&ap_device_list_lock);
-                list_add(&ap_dev->list, &ap_device_list);
+                list_del_init(&ap_dev->list);
                 spin_unlock_bh(&ap_device_list_lock);
         }
         return rc;
diff --git a/drivers/staging/media/omap4iss/Kconfig b/drivers/staging/media/omap4iss/Kconfig
index 78b0fba7047e..8afc6fee40c5 100644
--- a/drivers/staging/media/omap4iss/Kconfig
+++ b/drivers/staging/media/omap4iss/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_OMAP4
         bool "OMAP 4 Camera support"
-        depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API && I2C && ARCH_OMAP4
+        depends on VIDEO_V4L2=y && VIDEO_V4L2_SUBDEV_API && I2C=y && ARCH_OMAP4
         select VIDEOBUF2_DMA_CONTIG
         ---help---
           Driver for an OMAP 4 ISS controller.
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 9d2b673f90e3..b8125aa64ad8 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1169,8 +1169,8 @@ static int ep_enable(struct usb_ep *ep,
 
         if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
                 cap |= QH_IOS;
-        if (hwep->num)
-                cap |= QH_ZLT;
+
+        cap |= QH_ZLT;
         cap |= (hwep->ep.maxpacket << __ffs(QH_MAX_PKT)) & QH_MAX_PKT;
         /*
          * For ISO-TX, we set mult at QH as the largest value, and use
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 21b99b4b4082..0e950ad8cb25 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -889,6 +889,25 @@ static int hub_usb3_port_disable(struct usb_hub *hub, int port1)
         if (!hub_is_superspeed(hub->hdev))
                 return -EINVAL;
 
+        ret = hub_port_status(hub, port1, &portstatus, &portchange);
+        if (ret < 0)
+                return ret;
+
+        /*
+         * USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI
+         * Controller [1022:7814] will have spurious result making the following
+         * usb 3.0 device hotplugging route to the 2.0 root hub and recognized
+         * as high-speed device if we set the usb 3.0 port link state to
+         * Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we
+         * check the state here to avoid the bug.
+         */
+        if ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+                                USB_SS_PORT_LS_RX_DETECT) {
+                dev_dbg(&hub->ports[port1 - 1]->dev,
+                         "Not disabling port; link state is RxDetect\n");
+                return ret;
+        }
+
         ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED);
         if (ret)
                 return ret;
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index b7a506f2bb14..5c660c77f03b 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -426,20 +426,18 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                  * p2m are consistent.
                  */
                 if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                        unsigned long p;
-                        struct page   *scratch_page = get_balloon_scratch_page();
-
                         if (!PageHighMem(page)) {
+                                struct page *scratch_page = get_balloon_scratch_page();
+
                                 ret = HYPERVISOR_update_va_mapping(
                                                 (unsigned long)__va(pfn << PAGE_SHIFT),
                                                 pfn_pte(page_to_pfn(scratch_page),
                                                         PAGE_KERNEL_RO), 0);
                                 BUG_ON(ret);
-                        }
-                        p = page_to_pfn(scratch_page);
-                        __set_phys_to_machine(pfn, pfn_to_mfn(p));
 
-                        put_balloon_scratch_page();
+                                put_balloon_scratch_page();
+                        }
+                        __set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
                 }
 #endif
 
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index c3667b202f2f..5f1e1f3cd186 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -88,7 +88,6 @@ static int xen_suspend(void *data)
 
         if (!si->cancelled) {
                 xen_irq_resume();
-                xen_console_resume();
                 xen_timer_resume();
         }
 
@@ -135,6 +134,10 @@ static void do_suspend(void)
 
         err = stop_machine(xen_suspend, &si, cpumask_of(0));
 
+        /* Resume console as early as possible. */
+        if (!si.cancelled)
+                xen_console_resume();
+
         raw_notifier_call_chain(&xen_resume_notifier, 0, NULL);
 
         dpm_resume_start(si.cancelled ? PMSG_THAW : PMSG_RESTORE);