587 files changed, 7335 insertions, 3477 deletions
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index c67f6f5ad611..36b0e61f9c09 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -30,6 +30,10 @@
 #include <linux/types.h>
 #include <linux/dmi.h>
 #include <linux/delay.h>
+#ifdef CONFIG_ACPI_PROCFS_POWER
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#endif
 #include <linux/platform_device.h>
 #include <linux/power_supply.h>
 #include <linux/acpi.h>
@@ -52,6 +56,7 @@ MODULE_AUTHOR("Paul Diefenbaugh");
 MODULE_DESCRIPTION("ACPI AC Adapter Driver");
 MODULE_LICENSE("GPL");
 static int acpi_ac_add(struct acpi_device *device);
 static int acpi_ac_remove(struct acpi_device *device);
 static void acpi_ac_notify(struct acpi_device *device, u32 event);
@@ -67,6 +72,13 @@ static int acpi_ac_resume(struct device *dev);
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_ac_pm, NULL, acpi_ac_resume);
+#ifdef CONFIG_ACPI_PROCFS_POWER
+extern struct proc_dir_entry *acpi_lock_ac_dir(void);
+extern void *acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir);
+static int acpi_ac_open_fs(struct inode *inode, struct file *file);
+#endif
 static int ac_sleep_before_get_state_ms;
 static struct acpi_driver acpi_ac_driver = {
@@ -91,6 +103,16 @@ struct acpi_ac {
 #define to_acpi_ac(x) container_of(x, struct acpi_ac, charger)
+#ifdef CONFIG_ACPI_PROCFS_POWER
+static const struct file_operations acpi_ac_fops = {
+        .owner = THIS_MODULE,
+        .open = acpi_ac_open_fs,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+#endif
 /* --------------------------------------------------------------------------
                               AC Adapter Management
   -------------------------------------------------------------------------- */
@@ -143,6 +165,83 @@ static enum power_supply_property ac_props[] = {
        POWER_SUPPLY_PROP_ONLINE,
 };
+#ifdef CONFIG_ACPI_PROCFS_POWER
+/* --------------------------------------------------------------------------
+                              FS Interface (/proc)
+   -------------------------------------------------------------------------- */
+static struct proc_dir_entry *acpi_ac_dir;
+static int acpi_ac_seq_show(struct seq_file *seq, void *offset)
+{
+        struct acpi_ac *ac = seq->private;
+        if (!ac)
+                return 0;
+        if (acpi_ac_get_state(ac)) {
+                seq_puts(seq, "ERROR: Unable to read AC Adapter state\n");
+                return 0;
+        }
+        seq_puts(seq, "state:                   ");
+        switch (ac->state) {
+        case ACPI_AC_STATUS_OFFLINE:
+                seq_puts(seq, "off-line\n");
+                break;
+        case ACPI_AC_STATUS_ONLINE:
+                seq_puts(seq, "on-line\n");
+                break;
+        default:
+                seq_puts(seq, "unknown\n");
+                break;
+        }
+        return 0;
+}
+static int acpi_ac_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_ac_seq_show, PDE_DATA(inode));
+}
+static int acpi_ac_add_fs(struct acpi_ac *ac)
+{
+        struct proc_dir_entry *entry = NULL;
+        printk(KERN_WARNING PREFIX "Deprecated procfs I/F for AC is loaded,"
+                        " please retry with CONFIG_ACPI_PROCFS_POWER cleared\n");
+        if (!acpi_device_dir(ac->device)) {
+                acpi_device_dir(ac->device) =
+                        proc_mkdir(acpi_device_bid(ac->device), acpi_ac_dir);
+                if (!acpi_device_dir(ac->device))
+                        return -ENODEV;
+        }
+        /* 'state' [R] */
+        entry = proc_create_data(ACPI_AC_FILE_STATE,
+                                 S_IRUGO, acpi_device_dir(ac->device),
+                                 &acpi_ac_fops, ac);
+        if (!entry)
+                return -ENODEV;
+        return 0;
+}
+static int acpi_ac_remove_fs(struct acpi_ac *ac)
+{
+        if (acpi_device_dir(ac->device)) {
+                remove_proc_entry(ACPI_AC_FILE_STATE,
+                                  acpi_device_dir(ac->device));
+                remove_proc_entry(acpi_device_bid(ac->device), acpi_ac_dir);
+                acpi_device_dir(ac->device) = NULL;
+        }
+        return 0;
+}
+#endif
 /* --------------------------------------------------------------------------
                                   Driver Model
   -------------------------------------------------------------------------- */
@@ -243,6 +342,11 @@ static int acpi_ac_add(struct acpi_device *device)
                goto end;
        ac->charger.name = acpi_device_bid(device);
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        result = acpi_ac_add_fs(ac);
+        if (result)
+                goto end;
+#endif
        ac->charger.type = POWER_SUPPLY_TYPE_MAINS;
        ac->charger.properties = ac_props;
        ac->charger.num_properties = ARRAY_SIZE(ac_props);
@@ -258,8 +362,12 @@ static int acpi_ac_add(struct acpi_device *device)
        ac->battery_nb.notifier_call = acpi_ac_battery_notify;
        register_acpi_notifier(&ac->battery_nb);
 end:
-        if (result)
+        if (result) {
+#ifdef CONFIG_ACPI_PROCFS_POWER
+                acpi_ac_remove_fs(ac);
+#endif
                kfree(ac);
+        }
        dmi_check_system(ac_dmi_table);
        return result;
@@ -303,6 +411,10 @@ static int acpi_ac_remove(struct acpi_device *device)
                power_supply_unregister(&ac->charger);
        unregister_acpi_notifier(&ac->battery_nb);
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_ac_remove_fs(ac);
+#endif
        kfree(ac);
        return 0;
@@ -315,9 +427,20 @@ static int __init acpi_ac_init(void)
        if (acpi_disabled)
                return -ENODEV;
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_ac_dir = acpi_lock_ac_dir();
+        if (!acpi_ac_dir)
+                return -ENODEV;
+#endif
        result = acpi_bus_register_driver(&acpi_ac_driver);
-        if (result < 0)
+        if (result < 0) {
+#ifdef CONFIG_ACPI_PROCFS_POWER
+                acpi_unlock_ac_dir(acpi_ac_dir);
+#endif
                return -ENODEV;
+        }
        return 0;
 }
@@ -325,6 +448,9 @@ static int __init acpi_ac_init(void)
 static void __exit acpi_ac_exit(void)
 {
        acpi_bus_unregister_driver(&acpi_ac_driver);
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_unlock_ac_dir(acpi_ac_dir);
+#endif
 }
 module_init(acpi_ac_init);
 module_exit(acpi_ac_exit);
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 63407d264885..9cb65b0e7597 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -34,6 +34,9 @@ ACPI_MODULE_NAME("acpi_lpss");
 /* Offsets relative to LPSS_PRIVATE_OFFSET */
 #define LPSS_CLK_DIVIDER_DEF_MASK       (BIT(1) | BIT(16))
+#define LPSS_RESETS                     0x04
+#define LPSS_RESETS_RESET_FUNC          BIT(0)
+#define LPSS_RESETS_RESET_APB           BIT(1)
 #define LPSS_GENERAL                    0x08
 #define LPSS_GENERAL_LTR_MODE_SW        BIT(2)
 #define LPSS_GENERAL_UART_RTS_OVRD      BIT(3)
@@ -99,6 +102,17 @@ static void lpss_uart_setup(struct lpss_private_data *pdata)
        writel(reg | LPSS_GENERAL_UART_RTS_OVRD, pdata->mmio_base + offset);
 }
+static void lpss_i2c_setup(struct lpss_private_data *pdata)
+{
+        unsigned int offset;
+        u32 val;
+        offset = pdata->dev_desc->prv_offset + LPSS_RESETS;
+        val = readl(pdata->mmio_base + offset);
+        val |= LPSS_RESETS_RESET_APB | LPSS_RESETS_RESET_FUNC;
+        writel(val, pdata->mmio_base + offset);
+}
 static struct lpss_device_desc lpt_dev_desc = {
        .clk_required = true,
        .prv_offset = 0x800,
@@ -171,6 +185,7 @@ static struct lpss_device_desc byt_i2c_dev_desc = {
        .prv_offset = 0x800,
        .save_ctx = true,
        .shared_clock = &i2c_clock,
+        .setup = lpss_i2c_setup,
 };
 #else
diff --git a/drivers/acpi/acpi_pnp.c b/drivers/acpi/acpi_pnp.c
index 6703c1fd993a..4ddb0dca56f6 100644
--- a/drivers/acpi/acpi_pnp.c
+++ b/drivers/acpi/acpi_pnp.c
@@ -14,6 +14,8 @@
 #include <linux/module.h>
 static const struct acpi_device_id acpi_pnp_device_ids[] = {
+        /* soc_button_array */
+        {"PNP0C40"},
        /* pata_isapnp */
        {"PNP0600"},            /* Generic ESDI/IDE/ATA compatible hard disk controller */
        /* floppy */
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index e48fc98e71c4..130f513e08c9 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -32,8 +32,10 @@
 #include <linux/jiffies.h>
 #include <linux/async.h>
 #include <linux/dmi.h>
+#include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/suspend.h>
+#include <linux/delay.h>
 #include <asm/unaligned.h>
 #ifdef CONFIG_ACPI_PROCFS_POWER
@@ -70,6 +72,7 @@ MODULE_DESCRIPTION("ACPI Battery Driver");
 MODULE_LICENSE("GPL");
 static int battery_bix_broken_package;
+static int battery_notification_delay_ms;
 static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
@@ -532,6 +535,20 @@ static int acpi_battery_get_state(struct acpi_battery *battery)
                        " invalid.\n");
        }
+        /*
+         * When fully charged, some batteries wrongly report
+         * capacity_now = design_capacity instead of = full_charge_capacity
+         */
+        if (battery->capacity_now > battery->full_charge_capacity
+            && battery->full_charge_capacity != ACPI_BATTERY_VALUE_UNKNOWN) {
+                battery->capacity_now = battery->full_charge_capacity;
+                if (battery->capacity_now != battery->design_capacity)
+                        printk_once(KERN_WARNING FW_BUG
+                                "battery: reported current charge level (%d) "
+                                "is higher than reported maximum charge level (%d).\n",
+                                battery->capacity_now, battery->full_charge_capacity);
+        }
        if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags)
            && battery->capacity_now >= 0 && battery->capacity_now <= 100)
                battery->capacity_now = (battery->capacity_now *
@@ -930,7 +947,10 @@ static ssize_t acpi_battery_write_alarm(struct file *file,
                goto end;
        }
        alarm_string[count] = '\0';
-        battery->alarm = simple_strtol(alarm_string, NULL, 0);
+        if (kstrtoint(alarm_string, 0, &battery->alarm)) {
+                result = -EINVAL;
+                goto end;
+        }
        result = acpi_battery_set_alarm(battery);
      end:
        if (!result)
@@ -1062,6 +1082,14 @@ static void acpi_battery_notify(struct acpi_device *device, u32 event)
        if (!battery)
                return;
        old = battery->bat.dev;
+        /*
+        * On Acer Aspire V5-573G notifications are sometimes triggered too
+        * early. For example, when AC is unplugged and notification is
+        * triggered, battery state is still reported as "Full", and changes to
+        * "Discharging" only after short delay, without any notification.
+        */
+        if (battery_notification_delay_ms > 0)
+                msleep(battery_notification_delay_ms);
        if (event == ACPI_BATTERY_NOTIFY_INFO)
                acpi_battery_refresh(battery);
        acpi_battery_update(battery, false);
@@ -1106,17 +1134,60 @@ static int battery_notify(struct notifier_block *nb,
        return 0;
 }
+static int battery_bix_broken_package_quirk(const struct dmi_system_id *d)
+{
+        battery_bix_broken_package = 1;
+        return 0;
+}
+static int battery_notification_delay_quirk(const struct dmi_system_id *d)
+{
+        battery_notification_delay_ms = 1000;
+        return 0;
+}
 static struct dmi_system_id bat_dmi_table[] = {
        {
+                .callback = battery_bix_broken_package_quirk,
                .ident = "NEC LZ750/LS",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-LZ750LS"),
                },
        },
+        {
+                .callback = battery_notification_delay_quirk,
+                .ident = "Acer Aspire V5-573G",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire V5-573G"),
+                },
+        },
        {},
 };
+/*
+ * Some machines'(E,G Lenovo Z480) ECs are not stable
+ * during boot up and this causes battery driver fails to be
+ * probed due to failure of getting battery information
+ * from EC sometimes. After several retries, the operation
+ * may work. So add retry code here and 20ms sleep between
+ * every retries.
+ */
+static int acpi_battery_update_retry(struct acpi_battery *battery)
+{
+        int retry, ret;
+        for (retry = 5; retry; retry--) {
+                ret = acpi_battery_update(battery, false);
+                if (!ret)
+                        break;
+                msleep(20);
+        }
+        return ret;
+}
 static int acpi_battery_add(struct acpi_device *device)
 {
        int result = 0;
@@ -1135,9 +1206,11 @@ static int acpi_battery_add(struct acpi_device *device)
        mutex_init(&battery->sysfs_lock);
        if (acpi_has_method(battery->device->handle, "_BIX"))
                set_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags);
-        result = acpi_battery_update(battery, false);
+        result = acpi_battery_update_retry(battery);
        if (result)
                goto fail;
 #ifdef CONFIG_ACPI_PROCFS_POWER
        result = acpi_battery_add_fs(device);
 #endif
@@ -1227,8 +1300,7 @@ static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
        if (acpi_disabled)
                return;
-        if (dmi_check_system(bat_dmi_table))
+        dmi_check_system(bat_dmi_table);
-                battery_bix_broken_package = 1;
        
 #ifdef CONFIG_ACPI_PROCFS_POWER
        acpi_battery_dir = acpi_lock_battery_dir();
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index ad11ba4a412d..a66ab658abbc 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1,11 +1,14 @@
 /*
- *  ec.c - ACPI Embedded Controller Driver (v2.1)
+ *  ec.c - ACPI Embedded Controller Driver (v2.2)
 *
- *  Copyright (C) 2006-2008 Alexey Starikovskiy <astarikovskiy@suse.de>
+ *  Copyright (C) 2001-2014 Intel Corporation
- *  Copyright (C) 2006 Denis Sadykov <denis.m.sadykov@intel.com>
+ *    Author: 2014       Lv Zheng <lv.zheng@intel.com>
- *  Copyright (C) 2004 Luming Yu <luming.yu@intel.com>
+ *            2006, 2007 Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>
- *  Copyright (C) 2001, 2002 Andy Grover <andrew.grover@intel.com>
+ *            2006       Denis Sadykov <denis.m.sadykov@intel.com>
- *  Copyright (C) 2001, 2002 Paul Diefenbaugh <paul.s.diefenbaugh@intel.com>
+ *            2004       Luming Yu <luming.yu@intel.com>
+ *            2001, 2002 Andy Grover <andrew.grover@intel.com>
+ *            2001, 2002 Paul Diefenbaugh <paul.s.diefenbaugh@intel.com>
+ *  Copyright (C) 2008      Alexey Starikovskiy <astarikovskiy@suse.de>
 *
 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 *
@@ -52,6 +55,7 @@
 /* EC status register */
 #define ACPI_EC_FLAG_OBF        0x01    /* Output buffer full */
 #define ACPI_EC_FLAG_IBF        0x02    /* Input buffer full */
+#define ACPI_EC_FLAG_CMD        0x08    /* Input buffer contains a command */
 #define ACPI_EC_FLAG_BURST      0x10    /* burst mode */
 #define ACPI_EC_FLAG_SCI        0x20    /* EC-SCI occurred */
@@ -78,6 +82,9 @@ enum {
        EC_FLAGS_BLOCKED,               /* Transactions are blocked */
 };
+#define ACPI_EC_COMMAND_POLL            0x01 /* Available for command byte */
+#define ACPI_EC_COMMAND_COMPLETE        0x02 /* Completed last byte */
 /* ec.c is compiled in acpi namespace so this shows up as acpi.ec_delay param */
 static unsigned int ec_delay __read_mostly = ACPI_EC_DELAY;
 module_param(ec_delay, uint, 0644);
@@ -109,7 +116,7 @@ struct transaction {
        u8 ri;
        u8 wlen;
        u8 rlen;
-        bool done;
+        u8 flags;
 };
 struct acpi_ec *boot_ec, *first_ec;
@@ -127,83 +134,104 @@ static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
 static inline u8 acpi_ec_read_status(struct acpi_ec *ec)
 {
        u8 x = inb(ec->command_addr);
-        pr_debug("---> status = 0x%2.2x\n", x);
+        pr_debug("EC_SC(R) = 0x%2.2x "
+                 "SCI_EVT=%d BURST=%d CMD=%d IBF=%d OBF=%d\n",
+                 x,
+                 !!(x & ACPI_EC_FLAG_SCI),
+                 !!(x & ACPI_EC_FLAG_BURST),
+                 !!(x & ACPI_EC_FLAG_CMD),
+                 !!(x & ACPI_EC_FLAG_IBF),
+                 !!(x & ACPI_EC_FLAG_OBF));
        return x;
 }
 static inline u8 acpi_ec_read_data(struct acpi_ec *ec)
 {
        u8 x = inb(ec->data_addr);
-        pr_debug("---> data = 0x%2.2x\n", x);
+        pr_debug("EC_DATA(R) = 0x%2.2x\n", x);
        return x;
 }
 static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command)
 {
-        pr_debug("<--- command = 0x%2.2x\n", command);
+        pr_debug("EC_SC(W) = 0x%2.2x\n", command);
        outb(command, ec->command_addr);
 }
 static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
 {
-        pr_debug("<--- data = 0x%2.2x\n", data);
+        pr_debug("EC_DATA(W) = 0x%2.2x\n", data);
        outb(data, ec->data_addr);
 }
-static int ec_transaction_done(struct acpi_ec *ec)
+static int ec_transaction_completed(struct acpi_ec *ec)
 {
        unsigned long flags;
        int ret = 0;
        spin_lock_irqsave(&ec->lock, flags);
-        if (!ec->curr || ec->curr->done)
+        if (ec->curr && (ec->curr->flags & ACPI_EC_COMMAND_COMPLETE))
                ret = 1;
        spin_unlock_irqrestore(&ec->lock, flags);
        return ret;
 }
-static void start_transaction(struct acpi_ec *ec)
+static bool advance_transaction(struct acpi_ec *ec)
 {
-        ec->curr->irq_count = ec->curr->wi = ec->curr->ri = 0;
-        ec->curr->done = false;
-        acpi_ec_write_cmd(ec, ec->curr->command);
-}
-static void advance_transaction(struct acpi_ec *ec, u8 status)
-{
-        unsigned long flags;
        struct transaction *t;
+        u8 status;
+        bool wakeup = false;
-        spin_lock_irqsave(&ec->lock, flags);
+        pr_debug("===== %s =====\n", in_interrupt() ? "IRQ" : "TASK");
+        status = acpi_ec_read_status(ec);
        t = ec->curr;
        if (!t)
-                goto unlock;
+                goto err;
-        if (t->wlen > t->wi) {
+        if (t->flags & ACPI_EC_COMMAND_POLL) {
-                if ((status & ACPI_EC_FLAG_IBF) == 0)
+                if (t->wlen > t->wi) {
-                        acpi_ec_write_data(ec,
+                        if ((status & ACPI_EC_FLAG_IBF) == 0)
-                                t->wdata[t->wi++]);
+                                acpi_ec_write_data(ec, t->wdata[t->wi++]);
-                else
+                        else
-                        goto err;
+                                goto err;
-        } else if (t->rlen > t->ri) {
+                } else if (t->rlen > t->ri) {
-                if ((status & ACPI_EC_FLAG_OBF) == 1) {
+                        if ((status & ACPI_EC_FLAG_OBF) == 1) {
-                        t->rdata[t->ri++] = acpi_ec_read_data(ec);
+                                t->rdata[t->ri++] = acpi_ec_read_data(ec);
-                        if (t->rlen == t->ri)
+                                if (t->rlen == t->ri) {
-                                t->done = true;
+                                        t->flags |= ACPI_EC_COMMAND_COMPLETE;
+                                        wakeup = true;
+                                }
+                        } else
+                                goto err;
+                } else if (t->wlen == t->wi &&
+                           (status & ACPI_EC_FLAG_IBF) == 0) {
+                        t->flags |= ACPI_EC_COMMAND_COMPLETE;
+                        wakeup = true;
+                }
+                return wakeup;
+        } else {
+                if ((status & ACPI_EC_FLAG_IBF) == 0) {
+                        acpi_ec_write_cmd(ec, t->command);
+                        t->flags |= ACPI_EC_COMMAND_POLL;
                } else
                        goto err;
-        } else if (t->wlen == t->wi &&
+                return wakeup;
-                   (status & ACPI_EC_FLAG_IBF) == 0)
+        }
-                t->done = true;
-        goto unlock;
 err:
        /*
         * If SCI bit is set, then don't think it's a false IRQ
         * otherwise will take a not handled IRQ as a false one.
         */
-        if (in_interrupt() && !(status & ACPI_EC_FLAG_SCI))
+        if (!(status & ACPI_EC_FLAG_SCI)) {
-                ++t->irq_count;
+                if (in_interrupt() && t)
+                        ++t->irq_count;
+        }
+        return wakeup;
+}
-unlock:
+static void start_transaction(struct acpi_ec *ec)
-        spin_unlock_irqrestore(&ec->lock, flags);
+{
+        ec->curr->irq_count = ec->curr->wi = ec->curr->ri = 0;
+        ec->curr->flags = 0;
+        (void)advance_transaction(ec);
 }
 static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data);
@@ -228,15 +256,17 @@ static int ec_poll(struct acpi_ec *ec)
                        /* don't sleep with disabled interrupts */
                        if (EC_FLAGS_MSI || irqs_disabled()) {
                                udelay(ACPI_EC_MSI_UDELAY);
-                                if (ec_transaction_done(ec))
+                                if (ec_transaction_completed(ec))
                                        return 0;
                        } else {
                                if (wait_event_timeout(ec->wait,
-                                                ec_transaction_done(ec),
+                                                ec_transaction_completed(ec),
                                                msecs_to_jiffies(1)))
                                        return 0;
                        }
-                        advance_transaction(ec, acpi_ec_read_status(ec));
+                        spin_lock_irqsave(&ec->lock, flags);
+                        (void)advance_transaction(ec);
+                        spin_unlock_irqrestore(&ec->lock, flags);
                } while (time_before(jiffies, delay));
                pr_debug("controller reset, restart transaction\n");
                spin_lock_irqsave(&ec->lock, flags);
@@ -268,23 +298,6 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
        return ret;
 }
-static int ec_check_ibf0(struct acpi_ec *ec)
-{
-        u8 status = acpi_ec_read_status(ec);
-        return (status & ACPI_EC_FLAG_IBF) == 0;
-}
-static int ec_wait_ibf0(struct acpi_ec *ec)
-{
-        unsigned long delay = jiffies + msecs_to_jiffies(ec_delay);
-        /* interrupt wait manually if GPE mode is not active */
-        while (time_before(jiffies, delay))
-                if (wait_event_timeout(ec->wait, ec_check_ibf0(ec),
-                                        msecs_to_jiffies(1)))
-                        return 0;
-        return -ETIME;
-}
 static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
 {
        int status;
@@ -305,12 +318,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
                        goto unlock;
                }
        }
-        if (ec_wait_ibf0(ec)) {
-                pr_err("input buffer is not empty, "
-                                "aborting transaction\n");
-                status = -ETIME;
-                goto end;
-        }
        pr_debug("transaction start (cmd=0x%02x, addr=0x%02x)\n",
                        t->command, t->wdata ? t->wdata[0] : 0);
        /* disable GPE during transaction if storm is detected */
@@ -334,7 +341,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
                set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
        }
        pr_debug("transaction end\n");
-end:
        if (ec->global_lock)
                acpi_release_global_lock(glk);
 unlock:
@@ -634,17 +640,14 @@ static int ec_check_sci(struct acpi_ec *ec, u8 state)
 static u32 acpi_ec_gpe_handler(acpi_handle gpe_device,
        u32 gpe_number, void *data)
 {
+        unsigned long flags;
        struct acpi_ec *ec = data;
-        u8 status = acpi_ec_read_status(ec);
-        pr_debug("~~~> interrupt, status:0x%02x\n", status);
+        spin_lock_irqsave(&ec->lock, flags);
+        if (advance_transaction(ec))
-        advance_transaction(ec, status);
-        if (ec_transaction_done(ec) &&
-            (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF) == 0) {
                wake_up(&ec->wait);
-                ec_check_sci(ec, acpi_ec_read_status(ec));
+        spin_unlock_irqrestore(&ec->lock, flags);
-        }
+        ec_check_sci(ec, acpi_ec_read_status(ec));
        return ACPI_INTERRUPT_HANDLED | ACPI_REENABLE_GPE;
 }
@@ -1066,8 +1069,10 @@ int __init acpi_ec_ecdt_probe(void)
        /* fall through */
        }
-        if (EC_FLAGS_SKIP_DSDT_SCAN)
+        if (EC_FLAGS_SKIP_DSDT_SCAN) {
+                kfree(saved_ec);
                return -ENODEV;
+        }
        /* This workaround is needed only on some broken machines,
         * which require early EC, but fail to provide ECDT */
@@ -1105,6 +1110,7 @@ install:
        }
 error:
        kfree(boot_ec);
+        kfree(saved_ec);
        boot_ec = NULL;
        return -ENODEV;
 }
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 3f2bdc812d23..bad25b070fe0 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -235,7 +235,8 @@ void acpi_os_vprintf(const char *fmt, va_list args)
 static unsigned long acpi_rsdp;
 static int __init setup_acpi_rsdp(char *arg)
 {
-        acpi_rsdp = simple_strtoul(arg, NULL, 16);
+        if (kstrtoul(arg, 16, &acpi_rsdp))
+                return -EINVAL;
        return 0;
 }
 early_param("acpi_rsdp", setup_acpi_rsdp);
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 0bdacc5e26a3..2ba8f02ced36 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -77,7 +77,7 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res)
        switch (ares->type) {
        case ACPI_RESOURCE_TYPE_MEMORY24:
                memory24 = &ares->data.memory24;
-                if (!memory24->address_length)
+                if (!memory24->minimum && !memory24->address_length)
                        return false;
                acpi_dev_get_memresource(res, memory24->minimum,
                                         memory24->address_length,
@@ -85,7 +85,7 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res)
                break;
        case ACPI_RESOURCE_TYPE_MEMORY32:
                memory32 = &ares->data.memory32;
-                if (!memory32->address_length)
+                if (!memory32->minimum && !memory32->address_length)
                        return false;
                acpi_dev_get_memresource(res, memory32->minimum,
                                         memory32->address_length,
@@ -93,7 +93,7 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res)
                break;
        case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
                fixed_memory32 = &ares->data.fixed_memory32;
-                if (!fixed_memory32->address_length)
+                if (!fixed_memory32->address && !fixed_memory32->address_length)
                        return false;
                acpi_dev_get_memresource(res, fixed_memory32->address,
                                         fixed_memory32->address_length,
@@ -150,7 +150,7 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res)
        switch (ares->type) {
        case ACPI_RESOURCE_TYPE_IO:
                io = &ares->data.io;
-                if (!io->address_length)
+                if (!io->minimum && !io->address_length)
                        return false;
                acpi_dev_get_ioresource(res, io->minimum,
                                        io->address_length,
@@ -158,7 +158,7 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res)
                break;
        case ACPI_RESOURCE_TYPE_FIXED_IO:
                fixed_io = &ares->data.fixed_io;
-                if (!fixed_io->address_length)
+                if (!fixed_io->address && !fixed_io->address_length)
                        return false;
                acpi_dev_get_ioresource(res, fixed_io->address,
                                        fixed_io->address_length,
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index 05550ba44d32..6d5a6cda0734 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -360,7 +360,8 @@ static int __init acpi_parse_apic_instance(char *str)
        if (!str)
                return -EINVAL;
-        acpi_apic_instance = simple_strtoul(str, NULL, 0);
+        if (kstrtoint(str, 0, &acpi_apic_instance))
+                return -EINVAL;
        pr_notice("Shall use APIC/MADT table %d\n", acpi_apic_instance);
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index fb9ffe9adc64..350d52a8f781 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -68,7 +68,7 @@ MODULE_AUTHOR("Bruno Ducrot");
 MODULE_DESCRIPTION("ACPI Video Driver");
 MODULE_LICENSE("GPL");
-static bool brightness_switch_enabled;
+static bool brightness_switch_enabled = 1;
 module_param(brightness_switch_enabled, bool, 0644);
 /*
@@ -241,13 +241,14 @@ static bool acpi_video_use_native_backlight(void)
                return use_native_backlight_dmi;
 }
-static bool acpi_video_verify_backlight_support(void)
+bool acpi_video_verify_backlight_support(void)
 {
        if (acpi_osi_is_win8() && acpi_video_use_native_backlight() &&
            backlight_device_registered(BACKLIGHT_RAW))
                return false;
        return acpi_video_backlight_support();
 }
+EXPORT_SYMBOL_GPL(acpi_video_verify_backlight_support);
 /* backlight device sysfs support */
 static int acpi_video_get_brightness(struct backlight_device *bd)
@@ -563,6 +564,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                },
        },
        {
+         .callback = video_set_use_native_backlight,
+         .ident = "Acer TravelMate B113",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate B113"),
+                },
+        },
+        {
        .callback = video_set_use_native_backlight,
        .ident = "HP ProBook 4340s",
        .matches = {
@@ -572,6 +581,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
        },
        {
        .callback = video_set_use_native_backlight,
+        .ident = "HP ProBook 4540s",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "HP ProBook 4540s"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
        .ident = "HP ProBook 2013 models",
        .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 33e3db548a29..c42feb2bacd0 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -166,6 +166,14 @@ static struct dmi_system_id video_detect_dmi_table[] = {
                DMI_MATCH(DMI_PRODUCT_NAME, "UL30A"),
                },
        },
+        {
+        .callback = video_detect_force_vendor,
+        .ident = "Dell Inspiron 5737",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5737"),
+                },
+        },
        { },
 };
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index dae5607e1115..4cd52a4541a9 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -456,6 +456,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        /* Promise */
        { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
+        { PCI_VDEVICE(PROMISE, 0x3781), board_ahci },   /* FastTrak TX8660 ahci-mode */
        /* Asmedia */
        { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },   /* ASM1060 */
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 05882e4445a6..5513296e5e2e 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -371,7 +371,9 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
                      int pmp, unsigned long deadline,
                      int (*check_ready)(struct ata_link *link));
+unsigned int ahci_qc_issue(struct ata_queued_cmd *qc);
 int ahci_stop_engine(struct ata_port *ap);
+void ahci_start_fis_rx(struct ata_port *ap);
 void ahci_start_engine(struct ata_port *ap);
 int ahci_check_ready(struct ata_link *link);
 int ahci_kick_engine(struct ata_port *ap);
diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
index 3a901520c62b..cac4360f272a 100644
--- a/drivers/ata/ahci_imx.c
+++ b/drivers/ata/ahci_imx.c
@@ -58,6 +58,8 @@ enum ahci_imx_type {
 struct imx_ahci_priv {
        struct platform_device *ahci_pdev;
        enum ahci_imx_type type;
+        struct clk *sata_clk;
+        struct clk *sata_ref_clk;
        struct clk *ahb_clk;
        struct regmap *gpr;
        bool no_device;
@@ -224,7 +226,7 @@ static int imx_sata_enable(struct ahci_host_priv *hpriv)
                        return ret;
        }
-        ret = ahci_platform_enable_clks(hpriv);
+        ret = clk_prepare_enable(imxpriv->sata_ref_clk);
        if (ret < 0)
                goto disable_regulator;
@@ -291,7 +293,7 @@ static void imx_sata_disable(struct ahci_host_priv *hpriv)
                                   !IMX6Q_GPR13_SATA_MPLL_CLK_EN);
        }
-        ahci_platform_disable_clks(hpriv);
+        clk_disable_unprepare(imxpriv->sata_ref_clk);
        if (hpriv->target_pwr)
                regulator_disable(hpriv->target_pwr);
@@ -324,6 +326,9 @@ static void ahci_imx_error_handler(struct ata_port *ap)
        writel(reg_val | IMX_P0PHYCR_TEST_PDDQ, mmio + IMX_P0PHYCR);
        imx_sata_disable(hpriv);
        imxpriv->no_device = true;
+        dev_info(ap->dev, "no device found, disabling link.\n");
+        dev_info(ap->dev, "pass " MODULE_PARAM_PREFIX ".hotplug=1 to enable hotplug\n");
 }
 static int ahci_imx_softreset(struct ata_link *link, unsigned int *class,
@@ -385,6 +390,19 @@ static int imx_ahci_probe(struct platform_device *pdev)
        imxpriv->no_device = false;
        imxpriv->first_time = true;
        imxpriv->type = (enum ahci_imx_type)of_id->data;
+        imxpriv->sata_clk = devm_clk_get(dev, "sata");
+        if (IS_ERR(imxpriv->sata_clk)) {
+                dev_err(dev, "can't get sata clock.\n");
+                return PTR_ERR(imxpriv->sata_clk);
+        }
+        imxpriv->sata_ref_clk = devm_clk_get(dev, "sata_ref");
+        if (IS_ERR(imxpriv->sata_ref_clk)) {
+                dev_err(dev, "can't get sata_ref clock.\n");
+                return PTR_ERR(imxpriv->sata_ref_clk);
+        }
        imxpriv->ahb_clk = devm_clk_get(dev, "ahb");
        if (IS_ERR(imxpriv->ahb_clk)) {
                dev_err(dev, "can't get ahb clock.\n");
@@ -407,10 +425,14 @@ static int imx_ahci_probe(struct platform_device *pdev)
        hpriv->plat_data = imxpriv;
-        ret = imx_sata_enable(hpriv);
+        ret = clk_prepare_enable(imxpriv->sata_clk);
        if (ret)
                return ret;
+        ret = imx_sata_enable(hpriv);
+        if (ret)
+                goto disable_clk;
        /*
         * Configure the HWINIT bits of the HOST_CAP and HOST_PORTS_IMPL,
         * and IP vendor specific register IMX_TIMER1MS.
@@ -435,16 +457,24 @@ static int imx_ahci_probe(struct platform_device *pdev)
        ret = ahci_platform_init_host(pdev, hpriv, &ahci_imx_port_info,
                                      0, 0, 0);
        if (ret)
-                imx_sata_disable(hpriv);
+                goto disable_sata;
+        return 0;
+disable_sata:
+        imx_sata_disable(hpriv);
+disable_clk:
+        clk_disable_unprepare(imxpriv->sata_clk);
        return ret;
 }
 static void ahci_imx_host_stop(struct ata_host *host)
 {
        struct ahci_host_priv *hpriv = host->private_data;
+        struct imx_ahci_priv *imxpriv = hpriv->plat_data;
        imx_sata_disable(hpriv);
+        clk_disable_unprepare(imxpriv->sata_clk);
 }
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index ebe505c17763..b10d81ddb528 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -58,7 +58,7 @@ static int ahci_probe(struct platform_device *pdev)
        }
        if (of_device_is_compatible(dev->of_node, "hisilicon,hisi-ahci"))
-                hflags |= AHCI_HFLAG_NO_FBS;
+                hflags |= AHCI_HFLAG_NO_FBS | AHCI_HFLAG_NO_NCQ;
        rc = ahci_platform_init_host(pdev, hpriv, &ahci_port_info,
                                     hflags, 0, 0);
diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c
index 042a9bb45c86..ee3a3659bd9e 100644
--- a/drivers/ata/ahci_xgene.c
+++ b/drivers/ata/ahci_xgene.c
@@ -78,6 +78,7 @@
 struct xgene_ahci_context {
        struct ahci_host_priv *hpriv;
        struct device *dev;
+        u8 last_cmd[MAX_AHCI_CHN_PERCTR]; /* tracking the last command issued*/
        void __iomem *csr_core;         /* Core CSR address of IP */
        void __iomem *csr_diag;         /* Diag CSR address of IP */
        void __iomem *csr_axi;          /* AXI CSR address of IP */
@@ -98,20 +99,62 @@ static int xgene_ahci_init_memram(struct xgene_ahci_context *ctx)
 }
 /**
+ * xgene_ahci_restart_engine - Restart the dma engine.
+ * @ap : ATA port of interest
+ *
+ * Restarts the dma engine inside the controller.
+ */
+static int xgene_ahci_restart_engine(struct ata_port *ap)
+{
+        struct ahci_host_priv *hpriv = ap->host->private_data;
+        ahci_stop_engine(ap);
+        ahci_start_fis_rx(ap);
+        hpriv->start_engine(ap);
+        return 0;
+}
+/**
+ * xgene_ahci_qc_issue - Issue commands to the device
+ * @qc: Command to issue
+ *
+ * Due to Hardware errata for IDENTIFY DEVICE command, the controller cannot
+ * clear the BSY bit after receiving the PIO setup FIS. This results in the dma
+ * state machine goes into the CMFatalErrorUpdate state and locks up. By
+ * restarting the dma engine, it removes the controller out of lock up state.
+ */
+static unsigned int xgene_ahci_qc_issue(struct ata_queued_cmd *qc)
+{
+        struct ata_port *ap = qc->ap;
+        struct ahci_host_priv *hpriv = ap->host->private_data;
+        struct xgene_ahci_context *ctx = hpriv->plat_data;
+        int rc = 0;
+        if (unlikely(ctx->last_cmd[ap->port_no] == ATA_CMD_ID_ATA))
+                xgene_ahci_restart_engine(ap);
+        rc = ahci_qc_issue(qc);
+        /* Save the last command issued */
+        ctx->last_cmd[ap->port_no] = qc->tf.command;
+        return rc;
+}
+/**
 * xgene_ahci_read_id - Read ID data from the specified device
 * @dev: device
 * @tf: proposed taskfile
 * @id: data buffer
 *
 * This custom read ID function is required due to the fact that the HW
- * does not support DEVSLP and the controller state machine may get stuck
+ * does not support DEVSLP.
- * after processing the ID query command.
 */
 static unsigned int xgene_ahci_read_id(struct ata_device *dev,
                                       struct ata_taskfile *tf, u16 *id)
 {
        u32 err_mask;
-        void __iomem *port_mmio = ahci_port_base(dev->link->ap);
        err_mask = ata_do_dev_read_id(dev, tf, id);
        if (err_mask)
@@ -133,16 +176,6 @@ static unsigned int xgene_ahci_read_id(struct ata_device *dev,
         */
        id[ATA_ID_FEATURE_SUPP] &= ~(1 << 8);
-        /*
-         * Due to HW errata, restart the port if no other command active.
-         * Otherwise the controller may get stuck.
-         */
-        if (!readl(port_mmio + PORT_CMD_ISSUE)) {
-                writel(PORT_CMD_FIS_RX, port_mmio + PORT_CMD);
-                readl(port_mmio + PORT_CMD);    /* Force a barrier */
-                writel(PORT_CMD_FIS_RX | PORT_CMD_START, port_mmio + PORT_CMD);
-                readl(port_mmio + PORT_CMD);    /* Force a barrier */
-        }
        return 0;
 }
@@ -300,6 +333,7 @@ static struct ata_port_operations xgene_ahci_ops = {
        .host_stop = xgene_ahci_host_stop,
        .hardreset = xgene_ahci_hardreset,
        .read_id = xgene_ahci_read_id,
+        .qc_issue = xgene_ahci_qc_issue,
 };
 static const struct ata_port_info xgene_ahci_port_info = {
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 40ea583d3610..d72ce0470309 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -68,7 +68,6 @@ static ssize_t ahci_transmit_led_message(struct ata_port *ap, u32 state,
 static int ahci_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
 static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
-static unsigned int ahci_qc_issue(struct ata_queued_cmd *qc);
 static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
 static int ahci_port_start(struct ata_port *ap);
 static void ahci_port_stop(struct ata_port *ap);
@@ -620,7 +619,7 @@ int ahci_stop_engine(struct ata_port *ap)
 }
 EXPORT_SYMBOL_GPL(ahci_stop_engine);
-static void ahci_start_fis_rx(struct ata_port *ap)
+void ahci_start_fis_rx(struct ata_port *ap)
 {
        void __iomem *port_mmio = ahci_port_base(ap);
        struct ahci_host_priv *hpriv = ap->host->private_data;
@@ -646,6 +645,7 @@ static void ahci_start_fis_rx(struct ata_port *ap)
        /* flush */
        readl(port_mmio + PORT_CMD);
 }
+EXPORT_SYMBOL_GPL(ahci_start_fis_rx);
 static int ahci_stop_fis_rx(struct ata_port *ap)
 {
@@ -1945,7 +1945,7 @@ irqreturn_t ahci_interrupt(int irq, void *dev_instance)
 }
 EXPORT_SYMBOL_GPL(ahci_interrupt);
-static unsigned int ahci_qc_issue(struct ata_queued_cmd *qc)
+unsigned int ahci_qc_issue(struct ata_queued_cmd *qc)
 {
        struct ata_port *ap = qc->ap;
        void __iomem *port_mmio = ahci_port_base(ap);
@@ -1974,6 +1974,7 @@ static unsigned int ahci_qc_issue(struct ata_queued_cmd *qc)
        return 0;
 }
+EXPORT_SYMBOL_GPL(ahci_qc_issue);
 static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc)
 {
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 3a5b4ed25a4f..b0077589f065 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -250,8 +250,13 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev)
        if (IS_ERR(hpriv->phy)) {
                rc = PTR_ERR(hpriv->phy);
                switch (rc) {
-                case -ENODEV:
                case -ENOSYS:
+                        /* No PHY support. Check if PHY is required. */
+                        if (of_find_property(dev->of_node, "phys", NULL)) {
+                                dev_err(dev, "couldn't get sata-phy: ENOSYS\n");
+                                goto err_out;
+                        }
+                case -ENODEV:
                        /* continue normally */
                        hpriv->phy = NULL;
                        break;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 18d97d5c7d90..677c0c1b03bd 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4787,6 +4787,10 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 *      ata_qc_new - Request an available ATA command, for queueing
 *      @ap: target port
 *
+ *      Some ATA host controllers may implement a queue depth which is less
+ *      than ATA_MAX_QUEUE. So we shouldn't allocate a tag which is beyond
+ *      the hardware limitation.
+ *
 *      LOCKING:
 *      None.
 */
@@ -4794,14 +4798,15 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
 {
        struct ata_queued_cmd *qc = NULL;
+        unsigned int max_queue = ap->host->n_tags;
        unsigned int i, tag;
        /* no command while frozen */
        if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
                return NULL;
-        for (i = 0; i < ATA_MAX_QUEUE; i++) {
+        for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
-                tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
+                tag = tag < max_queue ? tag : 0;
                /* the last tag is reserved for internal command. */
                if (tag == ATA_TAG_INTERNAL)
@@ -6088,6 +6093,7 @@ void ata_host_init(struct ata_host *host, struct device *dev,
 {
        spin_lock_init(&host->lock);
        mutex_init(&host->eh_mutex);
+        host->n_tags = ATA_MAX_QUEUE - 1;
        host->dev = dev;
        host->ops = ops;
 }
@@ -6169,6 +6175,8 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
 {
        int i, rc;
+        host->n_tags = clamp(sht->can_queue, 1, ATA_MAX_QUEUE - 1);
        /* host must have been started */
        if (!(host->flags & ATA_HOST_STARTED)) {
                dev_err(host->dev, "BUG: trying to register unstarted host\n");
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 6760fc4e85b8..dad83df555c4 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1811,7 +1811,7 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc,
        case ATA_DEV_ATA:
                if (err & ATA_ICRC)
                        qc->err_mask |= AC_ERR_ATA_BUS;
-                if (err & ATA_UNC)
+                if (err & (ATA_UNC | ATA_AMNF))
                        qc->err_mask |= AC_ERR_MEDIA;
                if (err & ATA_IDNF)
                        qc->err_mask |= AC_ERR_INVALID;
@@ -2556,11 +2556,12 @@ static void ata_eh_link_report(struct ata_link *link)
                }
                if (cmd->command != ATA_CMD_PACKET &&
-                    (res->feature & (ATA_ICRC | ATA_UNC | ATA_IDNF |
+                    (res->feature & (ATA_ICRC | ATA_UNC | ATA_AMNF |
-                                     ATA_ABORTED)))
+                                     ATA_IDNF | ATA_ABORTED)))
-                        ata_dev_err(qc->dev, "error: { %s%s%s%s}\n",
+                        ata_dev_err(qc->dev, "error: { %s%s%s%s%s}\n",
                          res->feature & ATA_ICRC ? "ICRC " : "",
                          res->feature & ATA_UNC ? "UNC " : "",
+                          res->feature & ATA_AMNF ? "AMNF " : "",
                          res->feature & ATA_IDNF ? "IDNF " : "",
                          res->feature & ATA_ABORTED ? "ABRT " : "");
 #endif
diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index 6ad5c072ce34..4d37c5415fc7 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -915,7 +915,7 @@ static int ep93xx_pata_probe(struct platform_device *pdev)
        struct ep93xx_pata_data *drv_data;
        struct ata_host *host;
        struct ata_port *ap;
-        unsigned int irq;
+        int irq;
        struct resource *mem_res;
        void __iomem *ide_base;
        int err;
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 83969f8c5727..6467c919c509 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -176,14 +176,24 @@ static int __init cma_activate_area(struct cma *cma)
                base_pfn = pfn;
                for (j = pageblock_nr_pages; j; --j, pfn++) {
                        WARN_ON_ONCE(!pfn_valid(pfn));
+                        /*
+                         * alloc_contig_range requires the pfn range
+                         * specified to be in the same zone. Make this
+                         * simple by forcing the entire CMA resv range
+                         * to be in the same zone.
+                         */
                        if (page_zone(pfn_to_page(pfn)) != zone)
-                                return -EINVAL;
+                                goto err;
                }
                init_cma_reserved_pageblock(pfn_to_page(base_pfn));
        } while (--i);
        mutex_init(&cma->lock);
        return 0;
+err:
+        kfree(cma->bitmap);
+        return -EINVAL;
 }
 static struct cma cma_areas[MAX_CMA_AREAS];
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 9e9227e1762d..eee48c49f5de 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -89,8 +89,13 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
        return dev->archdata.irqs[num];
 #else
        struct resource *r;
-        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
+        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node) {
-                return of_irq_get(dev->dev.of_node, num);
+                int ret;
+                ret = of_irq_get(dev->dev.of_node, num);
+                if (ret >= 0 || ret == -EPROBE_DEFER)
+                        return ret;
+        }
        r = platform_get_resource(dev, IORESOURCE_IRQ, num);
@@ -133,8 +138,13 @@ int platform_get_irq_byname(struct platform_device *dev, const char *name)
 {
        struct resource *r;
-        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
+        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node) {
-                return of_irq_get_byname(dev->dev.of_node, name);
+                int ret;
+                ret = of_irq_get_byname(dev->dev.of_node, name);
+                if (ret >= 0 || ret == -EPROBE_DEFER)
+                        return ret;
+        }
        r = platform_get_resource_byname(dev, IORESOURCE_IRQ, name);
        return r ? r->start : -ENXIO;
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 1b35c45c92b7..3f2e16738080 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -544,6 +544,12 @@ void conn_try_outdate_peer_async(struct drbd_connection *connection)
        struct task_struct *opa;
        kref_get(&connection->kref);
+        /* We may just have force_sig()'ed this thread
+         * to get it out of some blocking network function.
+         * Clear signals; otherwise kthread_run(), which internally uses
+         * wait_on_completion_killable(), will mistake our pending signal
+         * for a new fatal signal and fail. */
+        flush_signals(current);
        opa = kthread_run(_try_outdate_peer_async, connection, "drbd_async_h");
        if (IS_ERR(opa)) {
                drbd_err(connection, "out of mem, failed to invoke fence-peer helper\n");
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index b6c8aaf4931b..5b17ec88ea05 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1337,8 +1337,11 @@ int drbd_submit_peer_request(struct drbd_device *device,
                return 0;
        }
+        /* Discards don't have any payload.
+         * But the scsi layer still expects a bio_vec it can use internally,
+         * see sd_setup_discard_cmnd() and blk_add_request_payload(). */
        if (peer_req->flags & EE_IS_TRIM)
-                nr_pages = 0; /* discards don't have any payload. */
+                nr_pages = 1;
        /* In most cases, we will only need one bio.  But in case the lower
         * level restrictions happen to be different at this offset on this
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 677db049f55a..56d46ffb08e1 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3777,7 +3777,7 @@ static void floppy_rb0_cb(struct bio *bio, int err)
        int drive = cbdata->drive;
        if (err) {
-                pr_info("floppy: error %d while reading block 0", err);
+                pr_info("floppy: error %d while reading block 0\n", err);
                set_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
        }
        complete(&cbdata->complete);
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 77087a29b127..a3b042c4d448 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -79,7 +79,7 @@ MODULE_PARM_DESC(home_node, "Home node for the device");
 static int queue_mode = NULL_Q_MQ;
 module_param(queue_mode, int, S_IRUGO);
-MODULE_PARM_DESC(use_mq, "Use blk-mq interface (0=bio,1=rq,2=multiqueue)");
+MODULE_PARM_DESC(queue_mode, "Block interface to use (0=bio,1=rq,2=multiqueue)");
 static int gb = 250;
 module_param(gb, int, S_IRUGO);
@@ -227,7 +227,10 @@ static void null_cmd_end_timer(struct nullb_cmd *cmd)
 static void null_softirq_done_fn(struct request *rq)
 {
-        end_cmd(blk_mq_rq_to_pdu(rq));
+        if (queue_mode == NULL_Q_MQ)
+                end_cmd(blk_mq_rq_to_pdu(rq));
+        else
+                end_cmd(rq->special);
 }
 static inline void null_handle_cmd(struct nullb_cmd *cmd)
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index bbeb404b3a07..b2c98c1bc037 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1431,6 +1431,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request)
        return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0;
 }
+static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request)
+{
+        struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
+        return obj_request->img_offset <
+            round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header));
+}
 static void rbd_obj_request_get(struct rbd_obj_request *obj_request)
 {
        dout("%s: obj %p (was %d)\n", __func__, obj_request,
@@ -2748,7 +2756,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request)
         */
        if (!img_request_write_test(img_request) ||
                !img_request_layered_test(img_request) ||
-                rbd_dev->parent_overlap <= obj_request->img_offset ||
+                !obj_request_overlaps_parent(obj_request) ||
                ((known = obj_request_known_test(obj_request)) &&
                        obj_request_exists_test(obj_request))) {
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 48eccb350180..36e54be402df 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -624,7 +624,16 @@ static void zram_reset_device(struct zram *zram, bool reset_capacity)
        zram->disksize = 0;
        if (reset_capacity)
                set_capacity(zram->disk, 0);
        up_write(&zram->init_lock);
+        /*
+         * Revalidate disk out of the init_lock to avoid lockdep splat.
+         * It's okay because disk's capacity is protected by init_lock
+         * so that revalidate_disk always sees up-to-date capacity.
+         */
+        if (reset_capacity)
+                revalidate_disk(zram->disk);
 }
 static ssize_t disksize_store(struct device *dev,
@@ -665,6 +674,14 @@ static ssize_t disksize_store(struct device *dev,
        zram->disksize = disksize;
        set_capacity(zram->disk, zram->disksize >> SECTOR_SHIFT);
        up_write(&zram->init_lock);
+        /*
+         * Revalidate disk out of the init_lock to avoid lockdep splat.
+         * It's okay because disk's capacity is protected by init_lock
+         * so that revalidate_disk always sees up-to-date capacity.
+         */
+        revalidate_disk(zram->disk);
        return len;
 out_destroy_comp:
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index f98380648cb3..f50dffc0374f 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -90,7 +90,6 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x0b05, 0x17d0) },
        { USB_DEVICE(0x0CF3, 0x0036) },
        { USB_DEVICE(0x0CF3, 0x3004) },
-        { USB_DEVICE(0x0CF3, 0x3005) },
        { USB_DEVICE(0x0CF3, 0x3008) },
        { USB_DEVICE(0x0CF3, 0x311D) },
        { USB_DEVICE(0x0CF3, 0x311E) },
@@ -140,7 +139,6 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
-        { USB_DEVICE(0x0cf3, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311E), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index a1c80b0c7663..6250fc2fb93a 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -162,7 +162,6 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
-        { USB_DEVICE(0x0cf3, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index 04680ead9275..fede8ca7147c 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -406,6 +406,7 @@ static int h5_rx_3wire_hdr(struct hci_uart *hu, unsigned char c)
            H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT) {
                BT_ERR("Non-link packet received in non-active state");
                h5_reset_rx(h5);
+                return 0;
        }
        h5->rx_func = h5_rx_payload;
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index a118ec1650fa..1f37d9870e7a 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -45,7 +45,7 @@ config OMAP_INTERCONNECT
 config ARM_CCI
        bool "ARM CCI driver support"
-        depends on ARM
+        depends on ARM && OF && CPU_V7
        help
          Driver supporting the CCI cache coherent interconnect for ARM
          platforms.
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 334601cc81cf..c4419ea1ab07 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -55,16 +55,41 @@ static DEFINE_MUTEX(rng_mutex);
 static int data_avail;
 static u8 *rng_buffer;
+static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
+                               int wait);
 static size_t rng_buffer_size(void)
 {
        return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
 }
+static void add_early_randomness(struct hwrng *rng)
+{
+        unsigned char bytes[16];
+        int bytes_read;
+        /*
+         * Currently only virtio-rng cannot return data during device
+         * probe, and that's handled in virtio-rng.c itself.  If there
+         * are more such devices, this call to rng_get_data can be
+         * made conditional here instead of doing it per-device.
+         */
+        bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
+        if (bytes_read > 0)
+                add_device_randomness(bytes, bytes_read);
+}
 static inline int hwrng_init(struct hwrng *rng)
 {
-        if (!rng->init)
+        if (rng->init) {
-                return 0;
+                int ret;
-        return rng->init(rng);
+                ret =  rng->init(rng);
+                if (ret)
+                        return ret;
+        }
+        add_early_randomness(rng);
+        return 0;
 }
 static inline void hwrng_cleanup(struct hwrng *rng)
@@ -304,8 +329,6 @@ int hwrng_register(struct hwrng *rng)
 {
        int err = -EINVAL;
        struct hwrng *old_rng, *tmp;
-        unsigned char bytes[16];
-        int bytes_read;
        if (rng->name == NULL ||
            (rng->data_read == NULL && rng->read == NULL))
@@ -347,9 +370,17 @@ int hwrng_register(struct hwrng *rng)
        INIT_LIST_HEAD(&rng->list);
        list_add_tail(&rng->list, &rng_list);
-        bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
+        if (old_rng && !rng->init) {
-        if (bytes_read > 0)
+                /*
-                add_device_randomness(bytes, bytes_read);
+                 * Use a new device's input to add some randomness to
+                 * the system.  If this rng device isn't going to be
+                 * used right away, its init function hasn't been
+                 * called yet; so only use the randomness from devices
+                 * that don't need an init callback.
+                 */
+                add_early_randomness(rng);
+        }
 out_unlock:
        mutex_unlock(&rng_mutex);
 out:
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index f3e71501de54..e9b15bc18b4d 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -38,6 +38,8 @@ struct virtrng_info {
        int index;
 };
+static bool probe_done;
 static void random_recv_done(struct virtqueue *vq)
 {
        struct virtrng_info *vi = vq->vdev->priv;
@@ -67,6 +69,13 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
        int ret;
        struct virtrng_info *vi = (struct virtrng_info *)rng->priv;
+        /*
+         * Don't ask host for data till we're setup.  This call can
+         * happen during hwrng_register(), after commit d9e7972619.
+         */
+        if (unlikely(!probe_done))
+                return 0;
        if (!vi->busy) {
                vi->busy = true;
                init_completion(&vi->have_data);
@@ -137,6 +146,7 @@ static int probe_common(struct virtio_device *vdev)
                return err;
        }
+        probe_done = true;
        return 0;
 }
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index d915707d2ba1..93dcad0c1cbe 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -138,7 +138,9 @@ static int i8k_smm(struct smm_regs *regs)
        if (!alloc_cpumask_var(&old_mask, GFP_KERNEL))
                return -ENOMEM;
        cpumask_copy(old_mask, &current->cpus_allowed);
-        set_cpus_allowed_ptr(current, cpumask_of(0));
+        rc = set_cpus_allowed_ptr(current, cpumask_of(0));
+        if (rc)
+                goto out;
        if (smp_processor_id() != 0) {
                rc = -EBUSY;
                goto out;
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 4ad71ef2cd59..71529e196b84 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -641,7 +641,7 @@ retry:
                } while (unlikely(entropy_count < pool_size-2 && pnfrac));
        }
-        if (entropy_count < 0) {
+        if (unlikely(entropy_count < 0)) {
                pr_warn("random: negative entropy/overflow: pool %s count %d\n",
                        r->name, entropy_count);
                WARN_ON(1);
@@ -980,26 +980,37 @@ static void push_to_pool(struct work_struct *work)
 static size_t account(struct entropy_store *r, size_t nbytes, int min,
                      int reserved)
 {
-        int have_bytes;
        int entropy_count, orig;
-        size_t ibytes;
+        size_t ibytes, nfrac;
        BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
        /* Can we pull enough? */
 retry:
        entropy_count = orig = ACCESS_ONCE(r->entropy_count);
-        have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
        ibytes = nbytes;
        /* If limited, never pull more than available */
-        if (r->limit)
+        if (r->limit) {
-                ibytes = min_t(size_t, ibytes, have_bytes - reserved);
+                int have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
+                if ((have_bytes -= reserved) < 0)
+                        have_bytes = 0;
+                ibytes = min_t(size_t, ibytes, have_bytes);
+        }
        if (ibytes < min)
                ibytes = 0;
-        if (have_bytes >= ibytes + reserved)
-                entropy_count -= ibytes << (ENTROPY_SHIFT + 3);
+        if (unlikely(entropy_count < 0)) {
+                pr_warn("random: negative entropy count: pool %s count %d\n",
+                        r->name, entropy_count);
+                WARN_ON(1);
+                entropy_count = 0;
+        }
+        nfrac = ibytes << (ENTROPY_SHIFT + 3);
+        if ((size_t) entropy_count > nfrac)
+                entropy_count -= nfrac;
        else
-                entropy_count = reserved << (ENTROPY_SHIFT + 3);
+                entropy_count = 0;
        if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
                goto retry;
@@ -1375,6 +1386,7 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
                            "with %d bits of entropy available\n",
                            current->comm, nonblocking_pool.entropy_total);
+        nbytes = min_t(size_t, nbytes, INT_MAX >> (ENTROPY_SHIFT + 3));
        ret = extract_entropy_user(&nonblocking_pool, buf, nbytes);
        trace_urandom_read(8 * nbytes, ENTROPY_BITS(&nonblocking_pool),
diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 9b7b5859a420..3757e9e72d37 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -230,16 +230,13 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
                        goto err_reg;
                }
-                s2mps11_clk->lookup = devm_kzalloc(&pdev->dev,
+                s2mps11_clk->lookup = clkdev_alloc(s2mps11_clk->clk,
-                                        sizeof(struct clk_lookup), GFP_KERNEL);
+                                        s2mps11_name(s2mps11_clk), NULL);
                if (!s2mps11_clk->lookup) {
                        ret = -ENOMEM;
                        goto err_lup;
                }
-                s2mps11_clk->lookup->con_id = s2mps11_name(s2mps11_clk);
-                s2mps11_clk->lookup->clk = s2mps11_clk->clk;
                clkdev_add(s2mps11_clk->lookup);
        }
diff --git a/drivers/clk/qcom/mmcc-msm8960.c b/drivers/clk/qcom/mmcc-msm8960.c
index 12f3c0b64fcd..4c449b3170f6 100644
--- a/drivers/clk/qcom/mmcc-msm8960.c
+++ b/drivers/clk/qcom/mmcc-msm8960.c
@@ -1209,7 +1209,7 @@ static struct clk_branch rot_clk = {
 static u8 mmcc_pxo_hdmi_map[] = {
        [P_PXO]         = 0,
-        [P_HDMI_PLL]    = 2,
+        [P_HDMI_PLL]    = 3,
 };
 static const char *mmcc_pxo_hdmi[] = {
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index 4f150c9dd38c..7f4a473a7ad7 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -925,21 +925,13 @@ static struct samsung_gate_clock exynos4x12_gate_clks[] __initdata = {
        GATE(CLK_RTC, "rtc", "aclk100", E4X12_GATE_IP_PERIR, 15,
                        0, 0),
        GATE(CLK_KEYIF, "keyif", "aclk100", E4X12_GATE_IP_PERIR, 16, 0, 0),
-        GATE(CLK_SCLK_PWM_ISP, "sclk_pwm_isp", "div_pwm_isp",
+        GATE(CLK_PWM_ISP_SCLK, "pwm_isp_sclk", "div_pwm_isp",
-                        E4X12_SRC_MASK_ISP, 0, CLK_SET_RATE_PARENT, 0),
-        GATE(CLK_SCLK_SPI0_ISP, "sclk_spi0_isp", "div_spi0_isp_pre",
-                        E4X12_SRC_MASK_ISP, 4, CLK_SET_RATE_PARENT, 0),
-        GATE(CLK_SCLK_SPI1_ISP, "sclk_spi1_isp", "div_spi1_isp_pre",
-                        E4X12_SRC_MASK_ISP, 8, CLK_SET_RATE_PARENT, 0),
-        GATE(CLK_SCLK_UART_ISP, "sclk_uart_isp", "div_uart_isp",
-                        E4X12_SRC_MASK_ISP, 12, CLK_SET_RATE_PARENT, 0),
-        GATE(CLK_PWM_ISP_SCLK, "pwm_isp_sclk", "sclk_pwm_isp",
                        E4X12_GATE_IP_ISP, 0, 0, 0),
-        GATE(CLK_SPI0_ISP_SCLK, "spi0_isp_sclk", "sclk_spi0_isp",
+        GATE(CLK_SPI0_ISP_SCLK, "spi0_isp_sclk", "div_spi0_isp_pre",
                        E4X12_GATE_IP_ISP, 1, 0, 0),
-        GATE(CLK_SPI1_ISP_SCLK, "spi1_isp_sclk", "sclk_spi1_isp",
+        GATE(CLK_SPI1_ISP_SCLK, "spi1_isp_sclk", "div_spi1_isp_pre",
                        E4X12_GATE_IP_ISP, 2, 0, 0),
-        GATE(CLK_UART_ISP_SCLK, "uart_isp_sclk", "sclk_uart_isp",
+        GATE(CLK_UART_ISP_SCLK, "uart_isp_sclk", "div_uart_isp",
                        E4X12_GATE_IP_ISP, 3, 0, 0),
        GATE(CLK_WDT, "watchdog", "aclk100", E4X12_GATE_IP_PERIR, 14, 0, 0),
        GATE(CLK_PCM0, "pcm0", "aclk100", E4X12_GATE_IP_MAUDIO, 2,
diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c
index 1fad4c5e3f5d..184f64293b26 100644
--- a/drivers/clk/samsung/clk-exynos5250.c
+++ b/drivers/clk/samsung/clk-exynos5250.c
@@ -661,7 +661,7 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(CLK_RTC, "rtc", "div_aclk66", GATE_IP_PERIS, 20, 0, 0),
        GATE(CLK_TMU, "tmu", "div_aclk66", GATE_IP_PERIS, 21, 0, 0),
        GATE(CLK_SMMU_TV, "smmu_tv", "mout_aclk200_disp1_sub",
-                        GATE_IP_DISP1, 2, 0, 0),
+                        GATE_IP_DISP1, 9, 0, 0),
        GATE(CLK_SMMU_FIMD1, "smmu_fimd1", "mout_aclk200_disp1_sub",
                        GATE_IP_DISP1, 8, 0, 0),
        GATE(CLK_SMMU_2D, "smmu_2d", "div_aclk200", GATE_IP_ACP, 7, 0, 0),
diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
index 9d7d7eed03fd..a4e6cc782e5c 100644
--- a/drivers/clk/samsung/clk-exynos5420.c
+++ b/drivers/clk/samsung/clk-exynos5420.c
@@ -631,7 +631,8 @@ static struct samsung_mux_clock exynos5x_mux_clks[] __initdata = {
                        SRC_TOP4, 16, 1),
        MUX(0, "mout_user_aclk266", mout_user_aclk266_p, SRC_TOP4, 20, 1),
        MUX(0, "mout_user_aclk166", mout_user_aclk166_p, SRC_TOP4, 24, 1),
-        MUX(0, "mout_user_aclk333", mout_user_aclk333_p, SRC_TOP4, 28, 1),
+        MUX(CLK_MOUT_USER_ACLK333, "mout_user_aclk333", mout_user_aclk333_p,
+                        SRC_TOP4, 28, 1),
        MUX(0, "mout_user_aclk400_disp1", mout_user_aclk400_disp1_p,
                        SRC_TOP5, 0, 1),
@@ -684,7 +685,8 @@ static struct samsung_mux_clock exynos5x_mux_clks[] __initdata = {
                        SRC_TOP11, 12, 1),
        MUX(0, "mout_sw_aclk266", mout_sw_aclk266_p, SRC_TOP11, 20, 1),
        MUX(0, "mout_sw_aclk166", mout_sw_aclk166_p, SRC_TOP11, 24, 1),
-        MUX(0, "mout_sw_aclk333", mout_sw_aclk333_p, SRC_TOP11, 28, 1),
+        MUX(CLK_MOUT_SW_ACLK333, "mout_sw_aclk333", mout_sw_aclk333_p,
+                        SRC_TOP11, 28, 1),
        MUX(0, "mout_sw_aclk400_disp1", mout_sw_aclk400_disp1_p,
                        SRC_TOP12, 4, 1),
@@ -890,8 +892,6 @@ static struct samsung_gate_clock exynos5x_gate_clks[] __initdata = {
                        GATE_BUS_TOP, 9, CLK_IGNORE_UNUSED, 0),
        GATE(0, "aclk66_psgen", "mout_user_aclk66_psgen",
                        GATE_BUS_TOP, 10, CLK_IGNORE_UNUSED, 0),
-        GATE(CLK_ACLK66_PERIC, "aclk66_peric", "mout_user_aclk66_peric",
-                        GATE_BUS_TOP, 11, CLK_IGNORE_UNUSED, 0),
        GATE(0, "aclk266_isp", "mout_user_aclk266_isp",
                        GATE_BUS_TOP, 13, 0, 0),
        GATE(0, "aclk166", "mout_user_aclk166",
@@ -994,34 +994,61 @@ static struct samsung_gate_clock exynos5x_gate_clks[] __initdata = {
                        SRC_MASK_FSYS, 24, CLK_SET_RATE_PARENT, 0),
        /* PERIC Block */
-        GATE(CLK_UART0, "uart0", "aclk66_peric", GATE_IP_PERIC, 0, 0, 0),
+        GATE(CLK_UART0, "uart0", "mout_user_aclk66_peric",
-        GATE(CLK_UART1, "uart1", "aclk66_peric", GATE_IP_PERIC, 1, 0, 0),
+                        GATE_IP_PERIC, 0, 0, 0),
-        GATE(CLK_UART2, "uart2", "aclk66_peric", GATE_IP_PERIC, 2, 0, 0),
+        GATE(CLK_UART1, "uart1", "mout_user_aclk66_peric",
-        GATE(CLK_UART3, "uart3", "aclk66_peric", GATE_IP_PERIC, 3, 0, 0),
+                        GATE_IP_PERIC, 1, 0, 0),
-        GATE(CLK_I2C0, "i2c0", "aclk66_peric", GATE_IP_PERIC, 6, 0, 0),
+        GATE(CLK_UART2, "uart2", "mout_user_aclk66_peric",
-        GATE(CLK_I2C1, "i2c1", "aclk66_peric", GATE_IP_PERIC, 7, 0, 0),
+                        GATE_IP_PERIC, 2, 0, 0),
-        GATE(CLK_I2C2, "i2c2", "aclk66_peric", GATE_IP_PERIC, 8, 0, 0),
+        GATE(CLK_UART3, "uart3", "mout_user_aclk66_peric",
-        GATE(CLK_I2C3, "i2c3", "aclk66_peric", GATE_IP_PERIC, 9, 0, 0),
+                        GATE_IP_PERIC, 3, 0, 0),
-        GATE(CLK_USI0, "usi0", "aclk66_peric", GATE_IP_PERIC, 10, 0, 0),
+        GATE(CLK_I2C0, "i2c0", "mout_user_aclk66_peric",
-        GATE(CLK_USI1, "usi1", "aclk66_peric", GATE_IP_PERIC, 11, 0, 0),
+                        GATE_IP_PERIC, 6, 0, 0),
-        GATE(CLK_USI2, "usi2", "aclk66_peric", GATE_IP_PERIC, 12, 0, 0),
+        GATE(CLK_I2C1, "i2c1", "mout_user_aclk66_peric",
-        GATE(CLK_USI3, "usi3", "aclk66_peric", GATE_IP_PERIC, 13, 0, 0),
+                        GATE_IP_PERIC, 7, 0, 0),
-        GATE(CLK_I2C_HDMI, "i2c_hdmi", "aclk66_peric", GATE_IP_PERIC, 14, 0, 0),
+        GATE(CLK_I2C2, "i2c2", "mout_user_aclk66_peric",
-        GATE(CLK_TSADC, "tsadc", "aclk66_peric", GATE_IP_PERIC, 15, 0, 0),
+                        GATE_IP_PERIC, 8, 0, 0),
-        GATE(CLK_SPI0, "spi0", "aclk66_peric", GATE_IP_PERIC, 16, 0, 0),
+        GATE(CLK_I2C3, "i2c3", "mout_user_aclk66_peric",
-        GATE(CLK_SPI1, "spi1", "aclk66_peric", GATE_IP_PERIC, 17, 0, 0),
+                        GATE_IP_PERIC, 9, 0, 0),
-        GATE(CLK_SPI2, "spi2", "aclk66_peric", GATE_IP_PERIC, 18, 0, 0),
+        GATE(CLK_USI0, "usi0", "mout_user_aclk66_peric",
-        GATE(CLK_I2S1, "i2s1", "aclk66_peric", GATE_IP_PERIC, 20, 0, 0),
+                        GATE_IP_PERIC, 10, 0, 0),
-        GATE(CLK_I2S2, "i2s2", "aclk66_peric", GATE_IP_PERIC, 21, 0, 0),
+        GATE(CLK_USI1, "usi1", "mout_user_aclk66_peric",
-        GATE(CLK_PCM1, "pcm1", "aclk66_peric", GATE_IP_PERIC, 22, 0, 0),
+                        GATE_IP_PERIC, 11, 0, 0),
-        GATE(CLK_PCM2, "pcm2", "aclk66_peric", GATE_IP_PERIC, 23, 0, 0),
+        GATE(CLK_USI2, "usi2", "mout_user_aclk66_peric",
-        GATE(CLK_PWM, "pwm", "aclk66_peric", GATE_IP_PERIC, 24, 0, 0),
+                        GATE_IP_PERIC, 12, 0, 0),
-        GATE(CLK_SPDIF, "spdif", "aclk66_peric", GATE_IP_PERIC, 26, 0, 0),
+        GATE(CLK_USI3, "usi3", "mout_user_aclk66_peric",
-        GATE(CLK_USI4, "usi4", "aclk66_peric", GATE_IP_PERIC, 28, 0, 0),
+                        GATE_IP_PERIC, 13, 0, 0),
-        GATE(CLK_USI5, "usi5", "aclk66_peric", GATE_IP_PERIC, 30, 0, 0),
+        GATE(CLK_I2C_HDMI, "i2c_hdmi", "mout_user_aclk66_peric",
-        GATE(CLK_USI6, "usi6", "aclk66_peric", GATE_IP_PERIC, 31, 0, 0),
+                        GATE_IP_PERIC, 14, 0, 0),
+        GATE(CLK_TSADC, "tsadc", "mout_user_aclk66_peric",
-        GATE(CLK_KEYIF, "keyif", "aclk66_peric", GATE_BUS_PERIC, 22, 0, 0),
+                        GATE_IP_PERIC, 15, 0, 0),
+        GATE(CLK_SPI0, "spi0", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 16, 0, 0),
+        GATE(CLK_SPI1, "spi1", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 17, 0, 0),
+        GATE(CLK_SPI2, "spi2", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 18, 0, 0),
+        GATE(CLK_I2S1, "i2s1", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 20, 0, 0),
+        GATE(CLK_I2S2, "i2s2", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 21, 0, 0),
+        GATE(CLK_PCM1, "pcm1", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 22, 0, 0),
+        GATE(CLK_PCM2, "pcm2", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 23, 0, 0),
+        GATE(CLK_PWM, "pwm", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 24, 0, 0),
+        GATE(CLK_SPDIF, "spdif", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 26, 0, 0),
+        GATE(CLK_USI4, "usi4", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 28, 0, 0),
+        GATE(CLK_USI5, "usi5", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 30, 0, 0),
+        GATE(CLK_USI6, "usi6", "mout_user_aclk66_peric",
+                        GATE_IP_PERIC, 31, 0, 0),
+        GATE(CLK_KEYIF, "keyif", "mout_user_aclk66_peric",
+                        GATE_BUS_PERIC, 22, 0, 0),
        /* PERIS Block */
        GATE(CLK_CHIPID, "chipid", "aclk66_psgen",
diff --git a/drivers/clk/samsung/clk-s3c2410.c b/drivers/clk/samsung/clk-s3c2410.c
index ba0716801db2..140f4733c02e 100644
--- a/drivers/clk/samsung/clk-s3c2410.c
+++ b/drivers/clk/samsung/clk-s3c2410.c
@@ -152,6 +152,11 @@ struct samsung_clock_alias s3c2410_common_aliases[] __initdata = {
        ALIAS(HCLK, NULL, "hclk"),
        ALIAS(MPLL, NULL, "mpll"),
        ALIAS(FCLK, NULL, "fclk"),
+        ALIAS(PCLK, NULL, "watchdog"),
+        ALIAS(PCLK_SDI, NULL, "sdi"),
+        ALIAS(HCLK_NAND, NULL, "nand"),
+        ALIAS(PCLK_I2S, NULL, "iis"),
+        ALIAS(PCLK_I2C, NULL, "i2c"),
 };
 /* S3C2410 specific clocks */
@@ -378,7 +383,7 @@ void __init s3c2410_common_clk_init(struct device_node *np, unsigned long xti_f,
        if (!np)
                s3c2410_common_clk_register_fixed_ext(ctx, xti_f);
-        if (current_soc == 2410) {
+        if (current_soc == S3C2410) {
                if (_get_rate("xti") == 12 * MHZ) {
                        s3c2410_plls[mpll].rate_table = pll_s3c2410_12mhz_tbl;
                        s3c2410_plls[upll].rate_table = pll_s3c2410_12mhz_tbl;
@@ -432,7 +437,7 @@ void __init s3c2410_common_clk_init(struct device_node *np, unsigned long xti_f,
                samsung_clk_register_fixed_factor(ctx, s3c2410_ffactor,
                                ARRAY_SIZE(s3c2410_ffactor));
                samsung_clk_register_alias(ctx, s3c2410_aliases,
-                        ARRAY_SIZE(s3c2410_common_aliases));
+                        ARRAY_SIZE(s3c2410_aliases));
                break;
        case S3C2440:
                samsung_clk_register_mux(ctx, s3c2440_muxes,
diff --git a/drivers/clk/samsung/clk-s3c64xx.c b/drivers/clk/samsung/clk-s3c64xx.c
index efa16ee592c8..8889ff1c10fc 100644
--- a/drivers/clk/samsung/clk-s3c64xx.c
+++ b/drivers/clk/samsung/clk-s3c64xx.c
@@ -418,8 +418,10 @@ static struct samsung_clock_alias s3c64xx_clock_aliases[] = {
        ALIAS(SCLK_MMC2, "s3c-sdhci.2", "mmc_busclk.2"),
        ALIAS(SCLK_MMC1, "s3c-sdhci.1", "mmc_busclk.2"),
        ALIAS(SCLK_MMC0, "s3c-sdhci.0", "mmc_busclk.2"),
-        ALIAS(SCLK_SPI1, "s3c6410-spi.1", "spi-bus"),
+        ALIAS(PCLK_SPI1, "s3c6410-spi.1", "spi_busclk0"),
-        ALIAS(SCLK_SPI0, "s3c6410-spi.0", "spi-bus"),
+        ALIAS(SCLK_SPI1, "s3c6410-spi.1", "spi_busclk2"),
+        ALIAS(PCLK_SPI0, "s3c6410-spi.0", "spi_busclk0"),
+        ALIAS(SCLK_SPI0, "s3c6410-spi.0", "spi_busclk2"),
        ALIAS(SCLK_AUDIO1, "samsung-pcm.1", "audio-bus"),
        ALIAS(SCLK_AUDIO1, "samsung-i2s.1", "audio-bus"),
        ALIAS(SCLK_AUDIO0, "samsung-pcm.0", "audio-bus"),
diff --git a/drivers/clk/spear/spear3xx_clock.c b/drivers/clk/spear/spear3xx_clock.c
index c2d204315546..bb5f387774e2 100644
--- a/drivers/clk/spear/spear3xx_clock.c
+++ b/drivers/clk/spear/spear3xx_clock.c
@@ -211,7 +211,7 @@ static inline void spear310_clk_init(void) { }
 /* array of all spear 320 clock lookups */
 #ifdef CONFIG_MACH_SPEAR320
-#define SPEAR320_CONTROL_REG            (soc_config_base + 0x0000)
+#define SPEAR320_CONTROL_REG            (soc_config_base + 0x0010)
 #define SPEAR320_EXT_CTRL_REG           (soc_config_base + 0x0018)
        #define SPEAR320_UARTX_PCLK_MASK                0x1
@@ -245,7 +245,8 @@ static const char *smii0_parents[] = { "smii_125m_pad", "ras_pll2_clk",
        "ras_syn0_gclk", };
 static const char *uartx_parents[] = { "ras_syn1_gclk", "ras_apb_clk", };
-static void __init spear320_clk_init(void __iomem *soc_config_base)
+static void __init spear320_clk_init(void __iomem *soc_config_base,
+                                     struct clk *ras_apb_clk)
 {
        struct clk *clk;
@@ -342,6 +343,8 @@ static void __init spear320_clk_init(void __iomem *soc_config_base)
                        SPEAR320_CONTROL_REG, UART1_PCLK_SHIFT, UART1_PCLK_MASK,
                        0, &_lock);
        clk_register_clkdev(clk, NULL, "a3000000.serial");
+        /* Enforce ras_apb_clk */
+        clk_set_parent(clk, ras_apb_clk);
        clk = clk_register_mux(NULL, "uart2_clk", uartx_parents,
                        ARRAY_SIZE(uartx_parents),
@@ -349,6 +352,8 @@ static void __init spear320_clk_init(void __iomem *soc_config_base)
                        SPEAR320_EXT_CTRL_REG, SPEAR320_UART2_PCLK_SHIFT,
                        SPEAR320_UARTX_PCLK_MASK, 0, &_lock);
        clk_register_clkdev(clk, NULL, "a4000000.serial");
+        /* Enforce ras_apb_clk */
+        clk_set_parent(clk, ras_apb_clk);
        clk = clk_register_mux(NULL, "uart3_clk", uartx_parents,
                        ARRAY_SIZE(uartx_parents),
@@ -379,12 +384,12 @@ static void __init spear320_clk_init(void __iomem *soc_config_base)
        clk_register_clkdev(clk, NULL, "60100000.serial");
 }
 #else
-static inline void spear320_clk_init(void __iomem *soc_config_base) { }
+static inline void spear320_clk_init(void __iomem *sb, struct clk *rc) { }
 #endif
 void __init spear3xx_clk_init(void __iomem *misc_base, void __iomem *soc_config_base)
 {
-        struct clk *clk, *clk1;
+        struct clk *clk, *clk1, *ras_apb_clk;
        clk = clk_register_fixed_rate(NULL, "osc_32k_clk", NULL, CLK_IS_ROOT,
                        32000);
@@ -613,6 +618,7 @@ void __init spear3xx_clk_init(void __iomem *misc_base, void __iomem *soc_config_
        clk = clk_register_gate(NULL, "ras_apb_clk", "apb_clk", 0, RAS_CLK_ENB,
                        RAS_APB_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, "ras_apb_clk", NULL);
+        ras_apb_clk = clk;
        clk = clk_register_gate(NULL, "ras_32k_clk", "osc_32k_clk", 0,
                        RAS_CLK_ENB, RAS_32K_CLK_ENB, 0, &_lock);
@@ -659,5 +665,5 @@ void __init spear3xx_clk_init(void __iomem *misc_base, void __iomem *soc_config_
        else if (of_machine_is_compatible("st,spear310"))
                spear310_clk_init();
        else if (of_machine_is_compatible("st,spear320"))
-                spear320_clk_init(soc_config_base);
+                spear320_clk_init(soc_config_base, ras_apb_clk);
 }
diff --git a/drivers/clk/sunxi/clk-sun6i-apb0-gates.c b/drivers/clk/sunxi/clk-sun6i-apb0-gates.c
index 44cd27c5c401..670f90d629d7 100644
--- a/drivers/clk/sunxi/clk-sun6i-apb0-gates.c
+++ b/drivers/clk/sunxi/clk-sun6i-apb0-gates.c
@@ -29,7 +29,7 @@ static int sun6i_a31_apb0_gates_clk_probe(struct platform_device *pdev)
        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        reg = devm_ioremap_resource(&pdev->dev, r);
-        if (!reg)
+        if (IS_ERR(reg))
                return PTR_ERR(reg);
        clk_parent = of_clk_get_parent_name(np, 0);
diff --git a/drivers/clk/ti/apll.c b/drivers/clk/ti/apll.c
index 5428c9c547cd..72d97279eae1 100644
--- a/drivers/clk/ti/apll.c
+++ b/drivers/clk/ti/apll.c
@@ -77,13 +77,11 @@ static int dra7_apll_enable(struct clk_hw *hw)
        if (i == MAX_APLL_WAIT_TRIES) {
                pr_warn("clock: %s failed transition to '%s'\n",
                        clk_name, (state) ? "locked" : "bypassed");
-        } else {
+                r = -EBUSY;
+        } else
                pr_debug("clock: %s transition to '%s' in %d loops\n",
                         clk_name, (state) ? "locked" : "bypassed", i);
-                r = 0;
-        }
        return r;
 }
@@ -338,7 +336,7 @@ static void __init of_omap2_apll_setup(struct device_node *node)
        const char *parent_name;
        u32 val;
-        ad = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
+        ad = kzalloc(sizeof(*ad), GFP_KERNEL);
        clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
        init = kzalloc(sizeof(*init), GFP_KERNEL);
diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
index e1581335937d..cb8e6f14e880 100644
--- a/drivers/clk/ti/clk-7xx.c
+++ b/drivers/clk/ti/clk-7xx.c
@@ -16,7 +16,7 @@
 #include <linux/clkdev.h>
 #include <linux/clk/ti.h>
-#define DRA7_DPLL_ABE_DEFFREQ                           361267200
+#define DRA7_DPLL_ABE_DEFFREQ                           180633600
 #define DRA7_DPLL_GMAC_DEFFREQ                          1000000000
@@ -322,6 +322,11 @@ int __init dra7xx_dt_clk_init(void)
        if (rc)
                pr_err("%s: failed to configure ABE DPLL!\n", __func__);
+        dpll_ck = clk_get_sys(NULL, "dpll_abe_m2x2_ck");
+        rc = clk_set_rate(dpll_ck, DRA7_DPLL_ABE_DEFFREQ * 2);
+        if (rc)
+                pr_err("%s: failed to configure ABE DPLL m2x2!\n", __func__);
        dpll_ck = clk_get_sys(NULL, "dpll_gmac_ck");
        rc = clk_set_rate(dpll_ck, DRA7_DPLL_GMAC_DEFFREQ);
        if (rc)
diff --git a/drivers/clk/ti/dpll.c b/drivers/clk/ti/dpll.c
index abd956d5f838..79791e1bf282 100644
--- a/drivers/clk/ti/dpll.c
+++ b/drivers/clk/ti/dpll.c
@@ -161,7 +161,8 @@ cleanup:
 }
 #if defined(CONFIG_ARCH_OMAP4) || defined(CONFIG_SOC_OMAP5) || \
-        defined(CONFIG_SOC_DRA7XX) || defined(CONFIG_SOC_AM33XX)
+        defined(CONFIG_SOC_DRA7XX) || defined(CONFIG_SOC_AM33XX) || \
+        defined(CONFIG_SOC_AM43XX)
 /**
 * ti_clk_register_dpll_x2 - Registers a DPLLx2 clock
 * @node: device node for this clock
@@ -322,7 +323,7 @@ CLK_OF_DECLARE(ti_omap4_dpll_x2_clock, "ti,omap4-dpll-x2-clock",
               of_ti_omap4_dpll_x2_setup);
 #endif
-#ifdef CONFIG_SOC_AM33XX
+#if defined(CONFIG_SOC_AM33XX) || defined(CONFIG_SOC_AM43XX)
 static void __init of_ti_am3_dpll_x2_setup(struct device_node *node)
 {
        ti_clk_register_dpll_x2(node, &dpll_x2_ck_ops, NULL);
diff --git a/drivers/clk/ti/mux.c b/drivers/clk/ti/mux.c
index 0197a478720c..e9d650e51287 100644
--- a/drivers/clk/ti/mux.c
+++ b/drivers/clk/ti/mux.c
@@ -160,7 +160,7 @@ static void of_mux_clk_setup(struct device_node *node)
        u8 clk_mux_flags = 0;
        u32 mask = 0;
        u32 shift = 0;
-        u32 flags = 0;
+        u32 flags = CLK_SET_RATE_NO_REPARENT;
        num_parents = of_clk_get_parent_count(node);
        if (num_parents < 2) {
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 8d6420013a04..ab51bf20a3ed 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -153,19 +153,16 @@ static void exynos4_mct_write(unsigned int value, unsigned long offset)
 }
 /* Clocksource handling */
-static void exynos4_mct_frc_start(u32 hi, u32 lo)
+static void exynos4_mct_frc_start(void)
 {
        u32 reg;
-        exynos4_mct_write(lo, EXYNOS4_MCT_G_CNT_L);
-        exynos4_mct_write(hi, EXYNOS4_MCT_G_CNT_U);
        reg = __raw_readl(reg_base + EXYNOS4_MCT_G_TCON);
        reg |= MCT_G_TCON_START;
        exynos4_mct_write(reg, EXYNOS4_MCT_G_TCON);
 }
-static cycle_t exynos4_frc_read(struct clocksource *cs)
+static cycle_t notrace _exynos4_frc_read(void)
 {
        unsigned int lo, hi;
        u32 hi2 = __raw_readl(reg_base + EXYNOS4_MCT_G_CNT_U);
@@ -179,9 +176,14 @@ static cycle_t exynos4_frc_read(struct clocksource *cs)
        return ((cycle_t)hi << 32) | lo;
 }
+static cycle_t exynos4_frc_read(struct clocksource *cs)
+{
+        return _exynos4_frc_read();
+}
 static void exynos4_frc_resume(struct clocksource *cs)
 {
-        exynos4_mct_frc_start(0, 0);
+        exynos4_mct_frc_start();
 }
 struct clocksource mct_frc = {
@@ -195,12 +197,23 @@ struct clocksource mct_frc = {
 static u64 notrace exynos4_read_sched_clock(void)
 {
-        return exynos4_frc_read(&mct_frc);
+        return _exynos4_frc_read();
+}
+static struct delay_timer exynos4_delay_timer;
+static cycles_t exynos4_read_current_timer(void)
+{
+        return _exynos4_frc_read();
 }
 static void __init exynos4_clocksource_init(void)
 {
-        exynos4_mct_frc_start(0, 0);
+        exynos4_mct_frc_start();
+        exynos4_delay_timer.read_current_timer = &exynos4_read_current_timer;
+        exynos4_delay_timer.freq = clk_rate;
+        register_current_timer_delay(&exynos4_delay_timer);
        if (clocksource_register_hz(&mct_frc, clk_rate))
                panic("%s: can't register clocksource\n", mct_frc.name);
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index e473d6555f96..ffe350f86bca 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -186,6 +186,8 @@ config CPU_FREQ_GOV_CONSERVATIVE
 config GENERIC_CPUFREQ_CPU0
        tristate "Generic CPU0 cpufreq driver"
        depends on HAVE_CLK && OF
+        # if CPU_THERMAL is on and THERMAL=m, CPU0 cannot be =y:
+        depends on !CPU_THERMAL || THERMAL
        select PM_OPP
        help
          This adds a generic cpufreq driver for CPU0 frequency management.
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index ebac67115009..7364a538e056 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -104,6 +104,7 @@ config ARM_IMX6Q_CPUFREQ
        tristate "Freescale i.MX6 cpufreq support"
        depends on ARCH_MXC
        depends on REGULATOR_ANATOP
+        select PM_OPP
        help
          This adds cpufreq driver support for Freescale i.MX6 series SoCs.
@@ -118,7 +119,7 @@ config ARM_INTEGRATOR
          If in doubt, say Y.
 config ARM_KIRKWOOD_CPUFREQ
-        def_bool MACH_KIRKWOOD
+        def_bool ARCH_KIRKWOOD || MACH_KIRKWOOD
        help
          This adds the CPUFreq driver for Marvell Kirkwood
          SoCs.
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index 738c8b7b17dc..db6d9a2fea4d 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -49,7 +49,7 @@ obj-$(CONFIG_ARM_BIG_LITTLE_CPUFREQ)	+= arm_big_little.o
 # LITTLE drivers, so that it is probed last.
 obj-$(CONFIG_ARM_DT_BL_CPUFREQ)         += arm_big_little_dt.o
-obj-$(CONFIG_ARCH_DAVINCI_DA850)        += davinci-cpufreq.o
+obj-$(CONFIG_ARCH_DAVINCI)              += davinci-cpufreq.o
 obj-$(CONFIG_UX500_SOC_DB8500)          += dbx500-cpufreq.o
 obj-$(CONFIG_ARM_EXYNOS_CPUFREQ)        += exynos-cpufreq.o
 obj-$(CONFIG_ARM_EXYNOS4210_CPUFREQ)    += exynos4210-cpufreq.o
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index ee1ae303a07c..86beda9f950b 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -152,11 +152,8 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                goto out_put_reg;
        }
-        ret = of_init_opp_table(cpu_dev);
+        /* OPPs might be populated at runtime, don't check for error here */
-        if (ret) {
+        of_init_opp_table(cpu_dev);
-                pr_err("failed to init OPP table: %d\n", ret);
-                goto out_put_clk;
-        }
        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
        if (ret) {
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index aed2b0cb83dc..6f024852c6fb 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1153,10 +1153,12 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
         * the creation of a brand new one. So we need to perform this update
         * by invoking update_policy_cpu().
         */
-        if (recover_policy && cpu != policy->cpu)
+        if (recover_policy && cpu != policy->cpu) {
                update_policy_cpu(policy, cpu);
-        else
+                WARN_ON(kobject_move(&policy->kobj, &dev->kobj));
+        } else {
                policy->cpu = cpu;
+        }
        cpumask_copy(policy->cpus, cpumask_of(cpu));
@@ -2242,10 +2244,8 @@ int cpufreq_update_policy(unsigned int cpu)
        struct cpufreq_policy new_policy;
        int ret;
-        if (!policy) {
+        if (!policy)
-                ret = -ENODEV;
+                return -ENODEV;
-                goto no_policy;
-        }
        down_write(&policy->rwsem);
@@ -2264,7 +2264,7 @@ int cpufreq_update_policy(unsigned int cpu)
                new_policy.cur = cpufreq_driver->get(cpu);
                if (WARN_ON(!new_policy.cur)) {
                        ret = -EIO;
-                        goto no_policy;
+                        goto unlock;
                }
                if (!policy->cur) {
@@ -2279,10 +2279,10 @@ int cpufreq_update_policy(unsigned int cpu)
        ret = cpufreq_set_policy(policy, &new_policy);
+unlock:
        up_write(&policy->rwsem);
        cpufreq_cpu_put(policy);
-no_policy:
        return ret;
 }
 EXPORT_SYMBOL(cpufreq_update_policy);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 4e7f492ad583..86631cb6f7de 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -128,6 +128,7 @@ static struct pstate_funcs pstate_funcs;
 struct perf_limits {
        int no_turbo;
+        int turbo_disabled;
        int max_perf_pct;
        int min_perf_pct;
        int32_t max_perf;
@@ -196,10 +197,7 @@ static signed int pid_calc(struct _pid *pid, int32_t busy)
        pid->last_err = fp_error;
        result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
-        if (result >= 0)
+        result = result + (1 << (FRAC_BITS-1));
-                result = result + (1 << (FRAC_BITS-1));
-        else
-                result = result - (1 << (FRAC_BITS-1));
        return (signed int)fp_toint(result);
 }
@@ -290,7 +288,10 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
        if (ret != 1)
                return -EINVAL;
        limits.no_turbo = clamp_t(int, input, 0 , 1);
+        if (limits.turbo_disabled) {
+                pr_warn("Turbo disabled by BIOS or unavailable on processor\n");
+                limits.no_turbo = limits.turbo_disabled;
+        }
        return count;
 }
@@ -360,21 +361,21 @@ static int byt_get_min_pstate(void)
 {
        u64 value;
        rdmsrl(BYT_RATIOS, value);
-        return (value >> 8) & 0x3F;
+        return (value >> 8) & 0x7F;
 }
 static int byt_get_max_pstate(void)
 {
        u64 value;
        rdmsrl(BYT_RATIOS, value);
-        return (value >> 16) & 0x3F;
+        return (value >> 16) & 0x7F;
 }
 static int byt_get_turbo_pstate(void)
 {
        u64 value;
        rdmsrl(BYT_TURBO_RATIOS, value);
-        return value & 0x3F;
+        return value & 0x7F;
 }
 static void byt_set_pstate(struct cpudata *cpudata, int pstate)
@@ -384,7 +385,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
        u32 vid;
        val = pstate << 8;
-        if (limits.no_turbo)
+        if (limits.no_turbo && !limits.turbo_disabled)
                val |= (u64)1 << 32;
        vid_fp = cpudata->vid.min + mul_fp(
@@ -408,8 +409,8 @@ static void byt_get_vid(struct cpudata *cpudata)
        rdmsrl(BYT_VIDS, value);
-        cpudata->vid.min = int_tofp((value >> 8) & 0x3f);
+        cpudata->vid.min = int_tofp((value >> 8) & 0x7f);
-        cpudata->vid.max = int_tofp((value >> 16) & 0x3f);
+        cpudata->vid.max = int_tofp((value >> 16) & 0x7f);
        cpudata->vid.ratio = div_fp(
                cpudata->vid.max - cpudata->vid.min,
                int_tofp(cpudata->pstate.max_pstate -
@@ -451,7 +452,7 @@ static void core_set_pstate(struct cpudata *cpudata, int pstate)
        u64 val;
        val = pstate << 8;
-        if (limits.no_turbo)
+        if (limits.no_turbo && !limits.turbo_disabled)
                val |= (u64)1 << 32;
        wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
@@ -699,9 +700,8 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
        cpu = all_cpu_data[cpunum];
-        intel_pstate_get_cpu_pstates(cpu);
        cpu->cpu = cpunum;
+        intel_pstate_get_cpu_pstates(cpu);
        init_timer_deferrable(&cpu->timer);
        cpu->timer.function = intel_pstate_timer_func;
@@ -744,7 +744,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
                limits.min_perf = int_tofp(1);
                limits.max_perf_pct = 100;
                limits.max_perf = int_tofp(1);
-                limits.no_turbo = 0;
+                limits.no_turbo = limits.turbo_disabled;
                return 0;
        }
        limits.min_perf_pct = (policy->min * 100) / policy->cpuinfo.max_freq;
@@ -787,6 +787,7 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
 {
        struct cpudata *cpu;
        int rc;
+        u64 misc_en;
        rc = intel_pstate_init_cpu(policy->cpu);
        if (rc)
@@ -794,8 +795,13 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
        cpu = all_cpu_data[policy->cpu];
-        if (!limits.no_turbo &&
+        rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
-                limits.min_perf_pct == 100 && limits.max_perf_pct == 100)
+        if (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE ||
+                cpu->pstate.max_pstate == cpu->pstate.turbo_pstate) {
+                limits.turbo_disabled = 1;
+                limits.no_turbo = 1;
+        }
+        if (limits.min_perf_pct == 100 && limits.max_perf_pct == 100)
                policy->policy = CPUFREQ_POLICY_PERFORMANCE;
        else
                policy->policy = CPUFREQ_POLICY_POWERSAVE;
diff --git a/drivers/cpufreq/sa1110-cpufreq.c b/drivers/cpufreq/sa1110-cpufreq.c
index 546376719d8f..b5befc211172 100644
--- a/drivers/cpufreq/sa1110-cpufreq.c
+++ b/drivers/cpufreq/sa1110-cpufreq.c
@@ -349,7 +349,7 @@ static int __init sa1110_clk_init(void)
                        name = "K4S641632D";
                if (machine_is_h3100())
                        name = "KM416S4030CT";
-                if (machine_is_jornada720())
+                if (machine_is_jornada720() || machine_is_h3600())
                        name = "K4S281632B-1H";
                if (machine_is_nanoengine())
                        name = "MT48LC8M16A2TG-75";
diff --git a/drivers/cpuidle/cpuidle-armada-370-xp.c b/drivers/cpuidle/cpuidle-armada-370-xp.c
index 28587d0f3947..a5fba0287bfb 100644
--- a/drivers/cpuidle/cpuidle-armada-370-xp.c
+++ b/drivers/cpuidle/cpuidle-armada-370-xp.c
@@ -55,7 +55,7 @@ static struct cpuidle_driver armada_370_xp_idle_driver = {
                .power_usage            = 50,
                .target_residency       = 100,
                .flags                  = CPUIDLE_FLAG_TIME_VALID,
-                .name                   = "MV CPU IDLE",
+                .name                   = "Idle",
                .desc                   = "CPU power down",
        },
        .states[2]              = {
@@ -65,7 +65,7 @@ static struct cpuidle_driver armada_370_xp_idle_driver = {
                .target_residency       = 1000,
                .flags                  = CPUIDLE_FLAG_TIME_VALID |
                                                ARMADA_370_XP_FLAG_DEEP_IDLE,
-                .name                   = "MV CPU DEEP IDLE",
+                .name                   = "Deep idle",
                .desc                   = "CPU and L2 Fabric power down",
        },
        .state_count = ARMADA_370_XP_MAX_STATES,
diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index 1d80bd3636c5..b512a4ba7569 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -453,8 +453,8 @@ static int caam_jr_probe(struct platform_device *pdev)
        int error;
        jrdev = &pdev->dev;
-        jrpriv = kmalloc(sizeof(struct caam_drv_private_jr),
+        jrpriv = devm_kmalloc(jrdev, sizeof(struct caam_drv_private_jr),
-                         GFP_KERNEL);
+                              GFP_KERNEL);
        if (!jrpriv)
                return -ENOMEM;
@@ -487,10 +487,8 @@ static int caam_jr_probe(struct platform_device *pdev)
        /* Now do the platform independent part */
        error = caam_jr_init(jrdev); /* now turn on hardware */
-        if (error) {
+        if (error)
-                kfree(jrpriv);
                return error;
-        }
        jrpriv->dev = jrdev;
        spin_lock(&driver_data.jr_alloc_lock);
diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
index d028f36ae655..8f8b0b608875 100644
--- a/drivers/dma/cppi41.c
+++ b/drivers/dma/cppi41.c
@@ -86,6 +86,9 @@
 #define USBSS_IRQ_PD_COMP       (1 <<  2)
+/* Packet Descriptor */
+#define PD2_ZERO_LENGTH         (1 << 19)
 struct cppi41_channel {
        struct dma_chan chan;
        struct dma_async_tx_descriptor txd;
@@ -307,7 +310,7 @@ static irqreturn_t cppi41_irq(int irq, void *data)
                        __iormb();
                while (val) {
-                        u32 desc;
+                        u32 desc, len;
                        q_num = __fls(val);
                        val &= ~(1 << q_num);
@@ -319,9 +322,13 @@ static irqreturn_t cppi41_irq(int irq, void *data)
                                                q_num, desc);
                                continue;
                        }
-                        c->residue = pd_trans_len(c->desc->pd6) -
-                                pd_trans_len(c->desc->pd0);
+                        if (c->desc->pd2 & PD2_ZERO_LENGTH)
+                                len = 0;
+                        else
+                                len = pd_trans_len(c->desc->pd0);
+                        c->residue = pd_trans_len(c->desc->pd6) - len;
                        dma_cookie_complete(&c->txd);
                        c->txd.callback(c->txd.callback_param);
                }
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 128714622bf5..14867e3ac8ff 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -255,6 +255,7 @@ struct sdma_channel {
        enum dma_slave_buswidth         word_size;
        unsigned int                    buf_tail;
        unsigned int                    num_bd;
+        unsigned int                    period_len;
        struct sdma_buffer_descriptor   *bd;
        dma_addr_t                      bd_phys;
        unsigned int                    pc_from_device, pc_to_device;
@@ -593,6 +594,12 @@ static void sdma_event_disable(struct sdma_channel *sdmac, unsigned int event)
 static void sdma_handle_channel_loop(struct sdma_channel *sdmac)
 {
+        if (sdmac->desc.callback)
+                sdmac->desc.callback(sdmac->desc.callback_param);
+}
+static void sdma_update_channel_loop(struct sdma_channel *sdmac)
+{
        struct sdma_buffer_descriptor *bd;
        /*
@@ -611,9 +618,6 @@ static void sdma_handle_channel_loop(struct sdma_channel *sdmac)
                bd->mode.status |= BD_DONE;
                sdmac->buf_tail++;
                sdmac->buf_tail %= sdmac->num_bd;
-                if (sdmac->desc.callback)
-                        sdmac->desc.callback(sdmac->desc.callback_param);
        }
 }
@@ -669,6 +673,9 @@ static irqreturn_t sdma_int_handler(int irq, void *dev_id)
                int channel = fls(stat) - 1;
                struct sdma_channel *sdmac = &sdma->channel[channel];
+                if (sdmac->flags & IMX_DMA_SG_LOOP)
+                        sdma_update_channel_loop(sdmac);
                tasklet_schedule(&sdmac->tasklet);
                __clear_bit(channel, &stat);
@@ -1129,6 +1136,7 @@ static struct dma_async_tx_descriptor *sdma_prep_dma_cyclic(
        sdmac->status = DMA_IN_PROGRESS;
        sdmac->buf_tail = 0;
+        sdmac->period_len = period_len;
        sdmac->flags |= IMX_DMA_SG_LOOP;
        sdmac->direction = direction;
@@ -1225,9 +1233,15 @@ static enum dma_status sdma_tx_status(struct dma_chan *chan,
                                      struct dma_tx_state *txstate)
 {
        struct sdma_channel *sdmac = to_sdma_chan(chan);
+        u32 residue;
+        if (sdmac->flags & IMX_DMA_SG_LOOP)
+                residue = (sdmac->num_bd - sdmac->buf_tail) * sdmac->period_len;
+        else
+                residue = sdmac->chn_count - sdmac->chn_real_count;
        dma_set_tx_state(txstate, chan->completed_cookie, chan->cookie,
-                        sdmac->chn_count - sdmac->chn_real_count);
+                         residue);
        return sdmac->status;
 }
diff --git a/drivers/firewire/Kconfig b/drivers/firewire/Kconfig
index 4199849e3758..145974f9662b 100644
--- a/drivers/firewire/Kconfig
+++ b/drivers/firewire/Kconfig
@@ -1,4 +1,5 @@
 menu "IEEE 1394 (FireWire) support"
+        depends on HAS_DMA
        depends on PCI || COMPILE_TEST
        # firewire-core does not depend on PCI but is
        # not useful without PCI controller driver
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 57985410f12f..a66a3217f1d9 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -336,10 +336,10 @@ static const struct {
                QUIRK_CYCLE_TIMER | QUIRK_IR_WAKE},
        {PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT6315, 0,
-                QUIRK_CYCLE_TIMER | QUIRK_NO_MSI},
+                QUIRK_CYCLE_TIMER /* FIXME: necessary? */ | QUIRK_NO_MSI},
        {PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT6315, PCI_ANY_ID,
-                0},
+                QUIRK_NO_MSI},
        {PCI_VENDOR_ID_VIA, PCI_ANY_ID, PCI_ANY_ID,
                QUIRK_CYCLE_TIMER | QUIRK_NO_MSI},
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 4b9dc836dcf9..e992abc5ef26 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -40,7 +40,7 @@ struct pstore_read_data {
 static inline u64 generic_id(unsigned long timestamp,
                             unsigned int part, int count)
 {
-        return (timestamp * 100 + part) * 1000 + count;
+        return ((u64) timestamp * 100 + part) * 1000 + count;
 }
 static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index cd36deb619fa..dc79346689e6 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -346,6 +346,7 @@ static __initdata struct {
 struct param_info {
        int verbose;
+        int found;
        void *params;
 };
@@ -353,25 +354,21 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
                                       int depth, void *data)
 {
        struct param_info *info = data;
-        void *prop, *dest;
+        const void *prop;
-        unsigned long len;
+        void *dest;
        u64 val;
-        int i;
+        int i, len;
        if (depth != 1 ||
            (strcmp(uname, "chosen") != 0 && strcmp(uname, "chosen@0") != 0))
                return 0;
-        pr_info("Getting parameters from FDT:\n");
        for (i = 0; i < ARRAY_SIZE(dt_params); i++) {
                prop = of_get_flat_dt_prop(node, dt_params[i].propname, &len);
-                if (!prop) {
+                if (!prop)
-                        pr_err("Can't find %s in device tree!\n",
-                               dt_params[i].name);
                        return 0;
-                }
                dest = info->params + dt_params[i].offset;
+                info->found++;
                val = of_read_number(prop, len / sizeof(u32));
@@ -390,10 +387,21 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
 int __init efi_get_fdt_params(struct efi_fdt_params *params, int verbose)
 {
        struct param_info info;
+        int ret;
+        pr_info("Getting EFI parameters from FDT:\n");
        info.verbose = verbose;
+        info.found = 0;
        info.params = params;
-        return of_scan_flat_dt(fdt_find_uefi_params, &info);
+        ret = of_scan_flat_dt(fdt_find_uefi_params, &info);
+        if (!info.found)
+                pr_info("UEFI not found.\n");
+        else if (!ret)
+                pr_err("Can't find '%s' in device tree!\n",
+                       dt_params[info.found].name);
+        return ret;
 }
 #endif /* CONFIG_EFI_PARAMS_FROM_FDT */
diff --git a/drivers/firmware/efi/fdt.c b/drivers/firmware/efi/fdt.c
index 5c6a8e8a9580..507a3df46a5d 100644
--- a/drivers/firmware/efi/fdt.c
+++ b/drivers/firmware/efi/fdt.c
@@ -23,16 +23,6 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
        u32 fdt_val32;
        u64 fdt_val64;
-        /*
-         * Copy definition of linux_banner here.  Since this code is
-         * built as part of the decompressor for ARM v7, pulling
-         * in version.c where linux_banner is defined for the
-         * kernel brings other kernel dependencies with it.
-         */
-        const char linux_banner[] =
-            "Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@"
-            LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n";
        /* Do some checks on provided FDT, if it exists*/
        if (orig_fdt) {
                if (fdt_check_header(orig_fdt)) {
@@ -63,7 +53,7 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
         */
        prev = 0;
        for (;;) {
-                const char *type, *name;
+                const char *type;
                int len;
                node = fdt_next_node(fdt, prev, NULL);
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index fe7c0e211f9a..57adbc90fdad 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -900,8 +900,6 @@ static int mcp23s08_probe(struct spi_device *spi)
                        if (spi_present_mask & (1 << addr))
                                chips++;
                }
-                if (!chips)
-                        return -ENODEV;
        } else {
                type = spi_get_device_id(spi)->driver_data;
                pdata = dev_get_platdata(&spi->dev);
@@ -940,10 +938,6 @@ static int mcp23s08_probe(struct spi_device *spi)
                if (!(spi_present_mask & (1 << addr)))
                        continue;
                chips--;
-                if (chips < 0) {
-                        dev_err(&spi->dev, "FATAL: invalid negative chip id\n");
-                        goto fail;
-                }
                data->mcp[addr] = &data->chip[chips];
                status = mcp23s08_probe_one(data->mcp[addr], &spi->dev, spi,
                                            0x40 | (addr << 1), type, base,
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index 0c9f803fc1ac..b6ae89ea8811 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -284,6 +284,7 @@ static int gpio_rcar_irq_domain_map(struct irq_domain *h, unsigned int irq,
 static struct irq_domain_ops gpio_rcar_irq_domain_ops = {
        .map    = gpio_rcar_irq_domain_map,
+        .xlate  = irq_domain_xlate_twocell,
 };
 struct gpio_rcar_info {
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 03711d00aaae..8218078b6133 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -419,8 +419,9 @@ long drm_ioctl(struct file *filp,
                        retcode = -EFAULT;
                        goto err_i1;
                }
-        } else
+        } else if (cmd & IOC_OUT) {
                memset(kdata, 0, usize);
+        }
        if (ioctl->flags & DRM_UNLOCKED)
                retcode = func(dev, kdata, file_priv);
diff --git a/drivers/gpu/drm/drm_modeset_lock.c b/drivers/gpu/drm/drm_modeset_lock.c
index 7c2497dea1e9..0dc57d5ecd10 100644
--- a/drivers/gpu/drm/drm_modeset_lock.c
+++ b/drivers/gpu/drm/drm_modeset_lock.c
@@ -64,6 +64,7 @@
 void drm_modeset_acquire_init(struct drm_modeset_acquire_ctx *ctx,
                uint32_t flags)
 {
+        memset(ctx, 0, sizeof(*ctx));
        ww_acquire_init(&ctx->ww_ctx, &crtc_ww_class);
        INIT_LIST_HEAD(&ctx->locked);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dpi.c b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
index 482127f633c5..9e530f205ad2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dpi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
@@ -40,7 +40,7 @@ exynos_dpi_detect(struct drm_connector *connector, bool force)
 {
        struct exynos_dpi *ctx = connector_to_dpi(connector);
-        if (!ctx->panel->connector)
+        if (ctx->panel && !ctx->panel->connector)
                drm_panel_attach(ctx->panel, &ctx->connector);
        return connector_status_connected;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index d91f27777537..ab7d182063c3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -765,24 +765,24 @@ static int exynos_drm_init(void)
        return 0;
-err_unregister_pd:
-        platform_device_unregister(exynos_drm_pdev);
 err_remove_vidi:
 #ifdef CONFIG_DRM_EXYNOS_VIDI
        exynos_drm_remove_vidi();
+err_unregister_pd:
 #endif
+        platform_device_unregister(exynos_drm_pdev);
        return ret;
 }
 static void exynos_drm_exit(void)
 {
+        platform_driver_unregister(&exynos_drm_platform_driver);
 #ifdef CONFIG_DRM_EXYNOS_VIDI
        exynos_drm_remove_vidi();
 #endif
        platform_device_unregister(exynos_drm_pdev);
-        platform_driver_unregister(&exynos_drm_platform_driver);
 }
 module_init(exynos_drm_init);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index 36535f398848..06cde4506278 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -343,7 +343,7 @@ struct exynos_drm_display * exynos_dpi_probe(struct device *dev);
 int exynos_dpi_remove(struct device *dev);
 #else
 static inline struct exynos_drm_display *
-exynos_dpi_probe(struct device *dev) { return 0; }
+exynos_dpi_probe(struct device *dev) { return NULL; }
 static inline int exynos_dpi_remove(struct device *dev) { return 0; }
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index bb45ab2e7384..33161ad38201 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -741,6 +741,8 @@ static void fimd_apply(struct exynos_drm_manager *mgr)
                win_data = &ctx->win_data[i];
                if (win_data->enabled)
                        fimd_win_commit(mgr, i);
+                else
+                        fimd_win_disable(mgr, i);
        }
        fimd_commit(mgr);
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index c104d0c9b385..aa259b0a873a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2090,6 +2090,11 @@ out:
 static void hdmi_dpms(struct exynos_drm_display *display, int mode)
 {
+        struct hdmi_context *hdata = display->ctx;
+        struct drm_encoder *encoder = hdata->encoder;
+        struct drm_crtc *crtc = encoder->crtc;
+        struct drm_crtc_helper_funcs *funcs = NULL;
        DRM_DEBUG_KMS("mode %d\n", mode);
        switch (mode) {
@@ -2099,6 +2104,20 @@ static void hdmi_dpms(struct exynos_drm_display *display, int mode)
        case DRM_MODE_DPMS_STANDBY:
        case DRM_MODE_DPMS_SUSPEND:
        case DRM_MODE_DPMS_OFF:
+                /*
+                 * The SFRs of VP and Mixer are updated by Vertical Sync of
+                 * Timing generator which is a part of HDMI so the sequence
+                 * to disable TV Subsystem should be as following,
+                 *      VP -> Mixer -> HDMI
+                 *
+                 * Below codes will try to disable Mixer and VP(if used)
+                 * prior to disabling HDMI.
+                 */
+                if (crtc)
+                        funcs = crtc->helper_private;
+                if (funcs && funcs->dpms)
+                        (*funcs->dpms)(crtc, mode);
                hdmi_poweroff(display);
                break;
        default:
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 4c5aed7e54c8..7529946d0a74 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -377,6 +377,20 @@ static void mixer_run(struct mixer_context *ctx)
        mixer_regs_dump(ctx);
 }
+static void mixer_stop(struct mixer_context *ctx)
+{
+        struct mixer_resources *res = &ctx->mixer_res;
+        int timeout = 20;
+        mixer_reg_writemask(res, MXR_STATUS, 0, MXR_STATUS_REG_RUN);
+        while (!(mixer_reg_read(res, MXR_STATUS) & MXR_STATUS_REG_IDLE) &&
+                        --timeout)
+                usleep_range(10000, 12000);
+        mixer_regs_dump(ctx);
+}
 static void vp_video_buffer(struct mixer_context *ctx, int win)
 {
        struct mixer_resources *res = &ctx->mixer_res;
@@ -497,13 +511,8 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
 static void mixer_layer_update(struct mixer_context *ctx)
 {
        struct mixer_resources *res = &ctx->mixer_res;
-        u32 val;
-        val = mixer_reg_read(res, MXR_CFG);
-        /* allow one update per vsync only */
+        mixer_reg_writemask(res, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
-        if (!(val & MXR_CFG_LAYER_UPDATE_COUNT_MASK))
-                mixer_reg_writemask(res, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
 }
 static void mixer_graph_buffer(struct mixer_context *ctx, int win)
@@ -1010,6 +1019,8 @@ static void mixer_wait_for_vblank(struct exynos_drm_manager *mgr)
        }
        mutex_unlock(&mixer_ctx->mixer_mutex);
+        drm_vblank_get(mgr->crtc->dev, mixer_ctx->pipe);
        atomic_set(&mixer_ctx->wait_vsync_event, 1);
        /*
@@ -1020,6 +1031,8 @@ static void mixer_wait_for_vblank(struct exynos_drm_manager *mgr)
                                !atomic_read(&mixer_ctx->wait_vsync_event),
                                HZ/20))
                DRM_DEBUG_KMS("vblank wait timed out.\n");
+        drm_vblank_put(mgr->crtc->dev, mixer_ctx->pipe);
 }
 static void mixer_window_suspend(struct exynos_drm_manager *mgr)
@@ -1061,7 +1074,7 @@ static void mixer_poweron(struct exynos_drm_manager *mgr)
                mutex_unlock(&ctx->mixer_mutex);
                return;
        }
-        ctx->powered = true;
        mutex_unlock(&ctx->mixer_mutex);
        pm_runtime_get_sync(ctx->dev);
@@ -1072,6 +1085,12 @@ static void mixer_poweron(struct exynos_drm_manager *mgr)
                clk_prepare_enable(res->sclk_mixer);
        }
+        mutex_lock(&ctx->mixer_mutex);
+        ctx->powered = true;
+        mutex_unlock(&ctx->mixer_mutex);
+        mixer_reg_writemask(res, MXR_STATUS, ~0, MXR_STATUS_SOFT_RESET);
        mixer_reg_write(res, MXR_INT_EN, ctx->int_en);
        mixer_win_reset(ctx);
@@ -1084,14 +1103,21 @@ static void mixer_poweroff(struct exynos_drm_manager *mgr)
        struct mixer_resources *res = &ctx->mixer_res;
        mutex_lock(&ctx->mixer_mutex);
-        if (!ctx->powered)
+        if (!ctx->powered) {
-                goto out;
+                mutex_unlock(&ctx->mixer_mutex);
+                return;
+        }
        mutex_unlock(&ctx->mixer_mutex);
+        mixer_stop(ctx);
        mixer_window_suspend(mgr);
        ctx->int_en = mixer_reg_read(res, MXR_INT_EN);
+        mutex_lock(&ctx->mixer_mutex);
+        ctx->powered = false;
+        mutex_unlock(&ctx->mixer_mutex);
        clk_disable_unprepare(res->mixer);
        if (ctx->vp_enabled) {
                clk_disable_unprepare(res->vp);
@@ -1099,12 +1125,6 @@ static void mixer_poweroff(struct exynos_drm_manager *mgr)
        }
        pm_runtime_put_sync(ctx->dev);
-        mutex_lock(&ctx->mixer_mutex);
-        ctx->powered = false;
-out:
-        mutex_unlock(&ctx->mixer_mutex);
 }
 static void mixer_dpms(struct exynos_drm_manager *mgr, int mode)
diff --git a/drivers/gpu/drm/exynos/regs-mixer.h b/drivers/gpu/drm/exynos/regs-mixer.h
index 4537026bc385..5f32e1a29411 100644
--- a/drivers/gpu/drm/exynos/regs-mixer.h
+++ b/drivers/gpu/drm/exynos/regs-mixer.h
@@ -78,6 +78,7 @@
 #define MXR_STATUS_BIG_ENDIAN           (1 << 3)
 #define MXR_STATUS_ENDIAN_MASK          (1 << 3)
 #define MXR_STATUS_SYNC_ENABLE          (1 << 2)
+#define MXR_STATUS_REG_IDLE             (1 << 1)
 #define MXR_STATUS_REG_RUN              (1 << 0)
 /* bits for MXR_CFG */
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 240c331405b9..ac357b02bd35 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -810,6 +810,12 @@ static int
 tda998x_encoder_mode_valid(struct drm_encoder *encoder,
                          struct drm_display_mode *mode)
 {
+        if (mode->clock > 150000)
+                return MODE_CLOCK_HIGH;
+        if (mode->htotal >= BIT(13))
+                return MODE_BAD_HVALUE;
+        if (mode->vtotal >= BIT(11))
+                return MODE_BAD_VVALUE;
        return MODE_OK;
 }
@@ -1048,8 +1054,8 @@ read_edid_block(struct drm_encoder *encoder, uint8_t *buf, int blk)
                        return i;
                }
        } else {
-                for (i = 10; i > 0; i--) {
+                for (i = 100; i > 0; i--) {
-                        msleep(10);
+                        msleep(1);
                        ret = reg_read(priv, REG_INT_FLAGS_2);
                        if (ret < 0)
                                return ret;
@@ -1183,7 +1189,6 @@ static void
 tda998x_encoder_destroy(struct drm_encoder *encoder)
 {
        struct tda998x_priv *priv = to_tda998x_priv(encoder);
-        drm_i2c_encoder_destroy(encoder);
        /* disable all IRQs and free the IRQ handler */
        cec_write(priv, REG_CEC_RXSHPDINTENA, 0);
@@ -1193,6 +1198,7 @@ tda998x_encoder_destroy(struct drm_encoder *encoder)
        if (priv->cec)
                i2c_unregister_device(priv->cec);
+        drm_i2c_encoder_destroy(encoder);
        kfree(priv);
 }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 601caa88c092..b8c689202c40 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -446,7 +446,9 @@ static int i915_gem_object_info(struct seq_file *m, void* data)
                memset(&stats, 0, sizeof(stats));
                stats.file_priv = file->driver_priv;
+                spin_lock(&file->table_lock);
                idr_for_each(&file->object_idr, per_file_stats, &stats);
+                spin_unlock(&file->table_lock);
                /*
                 * Although we have a valid reference on file->pid, that does
                 * not guarantee that the task_struct who called get_pid() is
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 4c22a5b7f4c5..d44344140627 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -36,6 +36,8 @@
 #include "i915_drv.h"
 #include "i915_trace.h"
 #include <linux/pci.h>
+#include <linux/console.h>
+#include <linux/vt.h>
 #include <linux/vgaarb.h>
 #include <linux/acpi.h>
 #include <linux/pnp.h>
@@ -1386,7 +1388,6 @@ cleanup_gem:
        i915_gem_context_fini(dev);
        mutex_unlock(&dev->struct_mutex);
        WARN_ON(dev_priv->mm.aliasing_ppgtt);
-        drm_mm_takedown(&dev_priv->gtt.base.mm);
 cleanup_irq:
        drm_irq_uninstall(dev);
 cleanup_gem_stolen:
@@ -1450,6 +1451,39 @@ static void i915_kick_out_firmware_fb(struct drm_i915_private *dev_priv)
 }
 #endif
+#if !defined(CONFIG_VGA_CONSOLE)
+static int i915_kick_out_vgacon(struct drm_i915_private *dev_priv)
+{
+        return 0;
+}
+#elif !defined(CONFIG_DUMMY_CONSOLE)
+static int i915_kick_out_vgacon(struct drm_i915_private *dev_priv)
+{
+        return -ENODEV;
+}
+#else
+static int i915_kick_out_vgacon(struct drm_i915_private *dev_priv)
+{
+        int ret = 0;
+        DRM_INFO("Replacing VGA console driver\n");
+        console_lock();
+        if (con_is_bound(&vga_con))
+                ret = do_take_over_console(&dummy_con, 0, MAX_NR_CONSOLES - 1, 1);
+        if (ret == 0) {
+                ret = do_unregister_con_driver(&vga_con);
+                /* Ignore "already unregistered". */
+                if (ret == -ENODEV)
+                        ret = 0;
+        }
+        console_unlock();
+        return ret;
+}
+#endif
 static void i915_dump_device_info(struct drm_i915_private *dev_priv)
 {
        const struct intel_device_info *info = &dev_priv->info;
@@ -1623,8 +1657,15 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (ret)
                goto out_regs;
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
+        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+                ret = i915_kick_out_vgacon(dev_priv);
+                if (ret) {
+                        DRM_ERROR("failed to remove conflicting VGA console\n");
+                        goto out_gtt;
+                }
                i915_kick_out_firmware_fb(dev_priv);
+        }
        pci_set_master(dev->pdev);
@@ -1756,8 +1797,6 @@ out_mtrrfree:
        arch_phys_wc_del(dev_priv->gtt.mtrr);
        io_mapping_free(dev_priv->gtt.mappable);
 out_gtt:
-        list_del(&dev_priv->gtt.base.global_link);
-        drm_mm_takedown(&dev_priv->gtt.base.mm);
        dev_priv->gtt.base.cleanup(&dev_priv->gtt.base);
 out_regs:
        intel_uncore_fini(dev);
@@ -1846,7 +1885,6 @@ int i915_driver_unload(struct drm_device *dev)
                        i915_free_hws(dev);
        }
-        list_del(&dev_priv->gtt.base.global_link);
        WARN_ON(!list_empty(&dev_priv->vm_list));
        drm_vblank_cleanup(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 49414d30e8d4..374f964323ad 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -656,6 +656,7 @@ enum intel_sbi_destination {
 #define QUIRK_PIPEA_FORCE (1<<0)
 #define QUIRK_LVDS_SSC_DISABLE (1<<1)
 #define QUIRK_INVERT_BRIGHTNESS (1<<2)
+#define QUIRK_BACKLIGHT_PRESENT (1<<3)
 struct intel_fbdev;
 struct intel_fbc_work;
@@ -977,6 +978,8 @@ struct i915_power_well {
        bool always_on;
        /* power well enable/disable usage count */
        int count;
+        /* cached hw enabled state */
+        bool hw_enabled;
        unsigned long domains;
        unsigned long data;
        const struct i915_power_well_ops *ops;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index f36126383d26..d893e4da5dce 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1616,22 +1616,6 @@ out:
        return ret;
 }
-void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv)
-{
-        struct i915_vma *vma;
-        /*
-         * Only the global gtt is relevant for gtt memory mappings, so restrict
-         * list traversal to objects bound into the global address space. Note
-         * that the active list should be empty, but better safe than sorry.
-         */
-        WARN_ON(!list_empty(&dev_priv->gtt.base.active_list));
-        list_for_each_entry(vma, &dev_priv->gtt.base.active_list, mm_list)
-                i915_gem_release_mmap(vma->obj);
-        list_for_each_entry(vma, &dev_priv->gtt.base.inactive_list, mm_list)
-                i915_gem_release_mmap(vma->obj);
-}
 /**
 * i915_gem_release_mmap - remove physical page mappings
 * @obj: obj in question
@@ -1657,6 +1641,15 @@ i915_gem_release_mmap(struct drm_i915_gem_object *obj)
        obj->fault_mappable = false;
 }
+void
+i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv)
+{
+        struct drm_i915_gem_object *obj;
+        list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list)
+                i915_gem_release_mmap(obj);
+}
 uint32_t
 i915_gem_get_gtt_size(struct drm_device *dev, uint32_t size, int tiling_mode)
 {
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 3ffe308d5893..a5ddf3bce9c3 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -598,6 +598,7 @@ static int do_switch(struct intel_engine_cs *ring,
        struct intel_context *from = ring->last_context;
        struct i915_hw_ppgtt *ppgtt = ctx_to_ppgtt(to);
        u32 hw_flags = 0;
+        bool uninitialized = false;
        int ret, i;
        if (from != NULL && ring == &dev_priv->ring[RCS]) {
@@ -696,19 +697,20 @@ static int do_switch(struct intel_engine_cs *ring,
                i915_gem_context_unreference(from);
        }
+        uninitialized = !to->is_initialized && from == NULL;
+        to->is_initialized = true;
 done:
        i915_gem_context_reference(to);
        ring->last_context = to;
        to->last_ring = ring;
-        if (ring->id == RCS && !to->is_initialized && from == NULL) {
+        if (uninitialized) {
                ret = i915_gem_render_state_init(ring);
                if (ret)
                        DRM_ERROR("init render state: %d\n", ret);
        }
-        to->is_initialized = true;
        return 0;
 unpin_out:
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index eec820aec022..8b3cde703364 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1992,7 +1992,10 @@ static void gen6_gmch_remove(struct i915_address_space *vm)
        struct i915_gtt *gtt = container_of(vm, struct i915_gtt, base);
-        drm_mm_takedown(&vm->mm);
+        if (drm_mm_initialized(&vm->mm)) {
+                drm_mm_takedown(&vm->mm);
+                list_del(&vm->global_link);
+        }
        iounmap(gtt->gsm);
        teardown_scratch_page(vm->dev);
 }
@@ -2025,6 +2028,10 @@ static int i915_gmch_probe(struct drm_device *dev,
 static void i915_gmch_remove(struct i915_address_space *vm)
 {
+        if (drm_mm_initialized(&vm->mm)) {
+                drm_mm_takedown(&vm->mm);
+                list_del(&vm->global_link);
+        }
        intel_gmch_remove();
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_render_state.c b/drivers/gpu/drm/i915/i915_gem_render_state.c
index 3521f998a178..34894b573064 100644
--- a/drivers/gpu/drm/i915/i915_gem_render_state.c
+++ b/drivers/gpu/drm/i915/i915_gem_render_state.c
@@ -31,7 +31,7 @@
 struct i915_render_state {
        struct drm_i915_gem_object *obj;
        unsigned long ggtt_offset;
-        void *batch;
+        u32 *batch;
        u32 size;
        u32 len;
 };
@@ -80,7 +80,7 @@ free:
 static void render_state_free(struct i915_render_state *so)
 {
-        kunmap(so->batch);
+        kunmap(kmap_to_page(so->batch));
        i915_gem_object_ggtt_unpin(so->obj);
        drm_gem_object_unreference(&so->obj->base);
        kfree(so);
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 62ef55ba061c..7465ab0fd396 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -74,6 +74,50 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
        if (base == 0)
                return 0;
+        /* make sure we don't clobber the GTT if it's within stolen memory */
+        if (INTEL_INFO(dev)->gen <= 4 && !IS_G33(dev) && !IS_G4X(dev)) {
+                struct {
+                        u32 start, end;
+                } stolen[2] = {
+                        { .start = base, .end = base + dev_priv->gtt.stolen_size, },
+                        { .start = base, .end = base + dev_priv->gtt.stolen_size, },
+                };
+                u64 gtt_start, gtt_end;
+                gtt_start = I915_READ(PGTBL_CTL);
+                if (IS_GEN4(dev))
+                        gtt_start = (gtt_start & PGTBL_ADDRESS_LO_MASK) |
+                                (gtt_start & PGTBL_ADDRESS_HI_MASK) << 28;
+                else
+                        gtt_start &= PGTBL_ADDRESS_LO_MASK;
+                gtt_end = gtt_start + gtt_total_entries(dev_priv->gtt) * 4;
+                if (gtt_start >= stolen[0].start && gtt_start < stolen[0].end)
+                        stolen[0].end = gtt_start;
+                if (gtt_end > stolen[1].start && gtt_end <= stolen[1].end)
+                        stolen[1].start = gtt_end;
+                /* pick the larger of the two chunks */
+                if (stolen[0].end - stolen[0].start >
+                    stolen[1].end - stolen[1].start) {
+                        base = stolen[0].start;
+                        dev_priv->gtt.stolen_size = stolen[0].end - stolen[0].start;
+                } else {
+                        base = stolen[1].start;
+                        dev_priv->gtt.stolen_size = stolen[1].end - stolen[1].start;
+                }
+                if (stolen[0].start != stolen[1].start ||
+                    stolen[0].end != stolen[1].end) {
+                        DRM_DEBUG_KMS("GTT within stolen memory at 0x%llx-0x%llx\n",
+                                      (unsigned long long) gtt_start,
+                                      (unsigned long long) gtt_end - 1);
+                        DRM_DEBUG_KMS("Stolen memory adjusted to 0x%x-0x%x\n",
+                                      base, base + (u32) dev_priv->gtt.stolen_size - 1);
+                }
+        }
        /* Verify that nothing else uses this physical address. Stolen
         * memory should be reserved by the BIOS and hidden from the
         * kernel. So if the region is already marked as busy, something
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 87ec60e181a7..66cf41765bf9 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -888,6 +888,8 @@ static void i915_gem_record_rings(struct drm_device *dev,
        for (i = 0; i < I915_NUM_RINGS; i++) {
                struct intel_engine_cs *ring = &dev_priv->ring[i];
+                error->ring[i].pid = -1;
                if (ring->dev == NULL)
                        continue;
@@ -895,7 +897,6 @@ static void i915_gem_record_rings(struct drm_device *dev,
                i915_record_ring_state(dev, ring, &error->ring[i]);
-                error->ring[i].pid = -1;
                request = i915_gem_find_active_request(ring);
                if (request) {
                        /* We need to copy these to an anonymous buffer
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 6f8017a7e937..c05c84f3f091 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2845,20 +2845,27 @@ static int semaphore_passed(struct intel_engine_cs *ring)
 {
        struct drm_i915_private *dev_priv = ring->dev->dev_private;
        struct intel_engine_cs *signaller;
-        u32 seqno, ctl;
+        u32 seqno;
-        ring->hangcheck.deadlock = true;
+        ring->hangcheck.deadlock++;
        signaller = semaphore_waits_for(ring, &seqno);
-        if (signaller == NULL || signaller->hangcheck.deadlock)
+        if (signaller == NULL)
                return -1;
+        /* Prevent pathological recursion due to driver bugs */
+        if (signaller->hangcheck.deadlock >= I915_NUM_RINGS)
+                return -1;
+        if (i915_seqno_passed(signaller->get_seqno(signaller, false), seqno))
+                return 1;
        /* cursory check for an unkickable deadlock */
-        ctl = I915_READ_CTL(signaller);
+        if (I915_READ_CTL(signaller) & RING_WAIT_SEMAPHORE &&
-        if (ctl & RING_WAIT_SEMAPHORE && semaphore_passed(signaller) < 0)
+            semaphore_passed(signaller) < 0)
                return -1;
-        return i915_seqno_passed(signaller->get_seqno(signaller, false), seqno);
+        return 0;
 }
 static void semaphore_clear_deadlocks(struct drm_i915_private *dev_priv)
@@ -2867,7 +2874,7 @@ static void semaphore_clear_deadlocks(struct drm_i915_private *dev_priv)
        int i;
        for_each_ring(ring, dev_priv, i)
-                ring->hangcheck.deadlock = false;
+                ring->hangcheck.deadlock = 0;
 }
 static enum intel_ring_hangcheck_action
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index e691b30b2817..a5bab61bfc00 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -942,6 +942,9 @@ enum punit_power_well {
 /*
 * Instruction and interrupt control regs
 */
+#define PGTBL_CTL       0x02020
+#define   PGTBL_ADDRESS_LO_MASK 0xfffff000 /* bits [31:12] */
+#define   PGTBL_ADDRESS_HI_MASK 0x000000f0 /* bits [35:32] (gen4) */
 #define PGTBL_ER        0x02024
 #define RENDER_RING_BASE        0x02000
 #define BSD_RING_BASE           0x04000
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 1ee98f121a00..827498e081df 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -315,9 +315,6 @@ parse_lfp_backlight(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
        const struct bdb_lfp_backlight_data *backlight_data;
        const struct bdb_lfp_backlight_data_entry *entry;
-        /* Err to enabling backlight if no backlight block. */
-        dev_priv->vbt.backlight.present = true;
        backlight_data = find_section(bdb, BDB_LVDS_BACKLIGHT);
        if (!backlight_data)
                return;
@@ -1088,6 +1085,9 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
        dev_priv->vbt.crt_ddc_pin = GMBUS_PORT_VGADDC;
+        /* Default to having backlight */
+        dev_priv->vbt.backlight.present = true;
        /* LFP panel data */
        dev_priv->vbt.lvds_dither = 1;
        dev_priv->vbt.lvds_vbt = 0;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index efd3cf50cb0f..f0be855ddf45 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2087,6 +2087,7 @@ void intel_flush_primary_plane(struct drm_i915_private *dev_priv,
 static void intel_enable_primary_hw_plane(struct drm_i915_private *dev_priv,
                                          enum plane plane, enum pipe pipe)
 {
+        struct drm_device *dev = dev_priv->dev;
        struct intel_crtc *intel_crtc =
                to_intel_crtc(dev_priv->pipe_to_crtc_mapping[pipe]);
        int reg;
@@ -2106,6 +2107,14 @@ static void intel_enable_primary_hw_plane(struct drm_i915_private *dev_priv,
        I915_WRITE(reg, val | DISPLAY_PLANE_ENABLE);
        intel_flush_primary_plane(dev_priv, plane);
+        /*
+         * BDW signals flip done immediately if the plane
+         * is disabled, even if the plane enable is already
+         * armed to occur at the next vblank :(
+         */
+        if (IS_BROADWELL(dev))
+                intel_wait_for_vblank(dev, intel_crtc->pipe);
 }
 /**
@@ -4564,7 +4573,10 @@ static void valleyview_crtc_enable(struct drm_crtc *crtc)
        if (intel_crtc->active)
                return;
-        vlv_prepare_pll(intel_crtc);
+        is_dsi = intel_pipe_has_type(crtc, INTEL_OUTPUT_DSI);
+        if (!is_dsi && !IS_CHERRYVIEW(dev))
+                vlv_prepare_pll(intel_crtc);
        /* Set up the display plane register */
        dspcntr = DISPPLANE_GAMMA_ENABLE;
@@ -4598,8 +4610,6 @@ static void valleyview_crtc_enable(struct drm_crtc *crtc)
                if (encoder->pre_pll_enable)
                        encoder->pre_pll_enable(encoder);
-        is_dsi = intel_pipe_has_type(crtc, INTEL_OUTPUT_DSI);
        if (!is_dsi) {
                if (IS_CHERRYVIEW(dev))
                        chv_enable_pll(intel_crtc);
@@ -11087,6 +11097,22 @@ const char *intel_output_name(int output)
        return names[output];
 }
+static bool intel_crt_present(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (IS_ULT(dev))
+                return false;
+        if (IS_CHERRYVIEW(dev))
+                return false;
+        if (IS_VALLEYVIEW(dev) && !dev_priv->vbt.int_crt_support)
+                return false;
+        return true;
+}
 static void intel_setup_outputs(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -11095,7 +11121,7 @@ static void intel_setup_outputs(struct drm_device *dev)
        intel_lvds_init(dev);
-        if (!IS_ULT(dev) && !IS_CHERRYVIEW(dev) && dev_priv->vbt.int_crt_support)
+        if (intel_crt_present(dev))
                intel_crt_init(dev);
        if (HAS_DDI(dev)) {
@@ -11565,6 +11591,14 @@ static void quirk_invert_brightness(struct drm_device *dev)
        DRM_INFO("applying inverted panel brightness quirk\n");
 }
+/* Some VBT's incorrectly indicate no backlight is present */
+static void quirk_backlight_present(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        dev_priv->quirks |= QUIRK_BACKLIGHT_PRESENT;
+        DRM_INFO("applying backlight present quirk\n");
+}
 struct intel_quirk {
        int device;
        int subsystem_vendor;
@@ -11633,6 +11667,15 @@ static struct intel_quirk intel_quirks[] = {
        /* Acer Aspire 5336 */
        { 0x2a42, 0x1025, 0x048a, quirk_invert_brightness },
+        /* Acer C720 and C720P Chromebooks (Celeron 2955U) have backlights */
+        { 0x0a06, 0x1025, 0x0a11, quirk_backlight_present },
+        /* Toshiba CB35 Chromebook (Celeron 2955U) */
+        { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
+        /* HP Chromebook 14 (Celeron 2955U) */
+        { 0x0a06, 0x103c, 0x21ed, quirk_backlight_present },
 };
 static void intel_init_quirks(struct drm_device *dev)
@@ -11871,6 +11914,7 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                 * ...  */
                plane = crtc->plane;
                crtc->plane = !plane;
+                crtc->primary_enabled = true;
                dev_priv->display.crtc_disable(&crtc->base);
                crtc->plane = plane;
@@ -12411,8 +12455,8 @@ intel_display_capture_error_state(struct drm_device *dev)
        for_each_pipe(i) {
                error->pipe[i].power_domain_on =
-                        intel_display_power_enabled_sw(dev_priv,
+                        intel_display_power_enabled_unlocked(dev_priv,
-                                                       POWER_DOMAIN_PIPE(i));
+                                                           POWER_DOMAIN_PIPE(i));
                if (!error->pipe[i].power_domain_on)
                        continue;
@@ -12447,7 +12491,7 @@ intel_display_capture_error_state(struct drm_device *dev)
                enum transcoder cpu_transcoder = transcoders[i];
                error->transcoder[i].power_domain_on =
-                        intel_display_power_enabled_sw(dev_priv,
+                        intel_display_power_enabled_unlocked(dev_priv,
                                POWER_DOMAIN_TRANSCODER(cpu_transcoder));
                if (!error->transcoder[i].power_domain_on)
                        continue;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 52fda950fd2a..8a1a4fbc06ac 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -28,6 +28,8 @@
 #include <linux/i2c.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/notifier.h>
+#include <linux/reboot.h>
 #include <drm/drmP.h>
 #include <drm/drm_crtc.h>
 #include <drm/drm_crtc_helper.h>
@@ -336,6 +338,37 @@ static u32 _pp_stat_reg(struct intel_dp *intel_dp)
                return VLV_PIPE_PP_STATUS(vlv_power_sequencer_pipe(intel_dp));
 }
+/* Reboot notifier handler to shutdown panel power to guarantee T12 timing
+   This function only applicable when panel PM state is not to be tracked */
+static int edp_notify_handler(struct notifier_block *this, unsigned long code,
+                              void *unused)
+{
+        struct intel_dp *intel_dp = container_of(this, typeof(* intel_dp),
+                                                 edp_notifier);
+        struct drm_device *dev = intel_dp_to_dev(intel_dp);
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 pp_div;
+        u32 pp_ctrl_reg, pp_div_reg;
+        enum pipe pipe = vlv_power_sequencer_pipe(intel_dp);
+        if (!is_edp(intel_dp) || code != SYS_RESTART)
+                return 0;
+        if (IS_VALLEYVIEW(dev)) {
+                pp_ctrl_reg = VLV_PIPE_PP_CONTROL(pipe);
+                pp_div_reg  = VLV_PIPE_PP_DIVISOR(pipe);
+                pp_div = I915_READ(pp_div_reg);
+                pp_div &= PP_REFERENCE_DIVIDER_MASK;
+                /* 0x1F write to PP_DIV_REG sets max cycle delay */
+                I915_WRITE(pp_div_reg, pp_div | 0x1F);
+                I915_WRITE(pp_ctrl_reg, PANEL_UNLOCK_REGS | PANEL_POWER_OFF);
+                msleep(intel_dp->panel_power_cycle_delay);
+        }
+        return 0;
+}
 static bool edp_have_panel_power(struct intel_dp *intel_dp)
 {
        struct drm_device *dev = intel_dp_to_dev(intel_dp);
@@ -873,8 +906,8 @@ intel_dp_compute_config(struct intel_encoder *encoder,
                mode_rate = intel_dp_link_required(adjusted_mode->crtc_clock,
                                                   bpp);
-                for (lane_count = min_lane_count; lane_count <= max_lane_count; lane_count <<= 1) {
+                for (clock = min_clock; clock <= max_clock; clock++) {
-                        for (clock = min_clock; clock <= max_clock; clock++) {
+                        for (lane_count = min_lane_count; lane_count <= max_lane_count; lane_count <<= 1) {
                                link_clock = drm_dp_bw_code_to_link_rate(bws[clock]);
                                link_avail = intel_dp_max_data_rate(link_clock,
                                                                    lane_count);
@@ -3707,6 +3740,10 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
                drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
                edp_panel_vdd_off_sync(intel_dp);
                drm_modeset_unlock(&dev->mode_config.connection_mutex);
+                if (intel_dp->edp_notifier.notifier_call) {
+                        unregister_reboot_notifier(&intel_dp->edp_notifier);
+                        intel_dp->edp_notifier.notifier_call = NULL;
+                }
        }
        kfree(intel_dig_port);
 }
@@ -4184,6 +4221,11 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
        }
        mutex_unlock(&dev->mode_config.mutex);
+        if (IS_VALLEYVIEW(dev)) {
+                intel_dp->edp_notifier.notifier_call = edp_notify_handler;
+                register_reboot_notifier(&intel_dp->edp_notifier);
+        }
        intel_panel_init(&intel_connector->panel, fixed_mode, downclock_mode);
        intel_panel_setup_backlight(connector);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index bda0ae3d80cc..f67340ed2c12 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -538,6 +538,8 @@ struct intel_dp {
        unsigned long last_power_on;
        unsigned long last_backlight_off;
        bool psr_setup_done;
+        struct notifier_block edp_notifier;
        bool use_tps3;
        struct intel_connector *attached_connector;
@@ -950,8 +952,8 @@ int intel_power_domains_init(struct drm_i915_private *);
 void intel_power_domains_remove(struct drm_i915_private *);
 bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
                                 enum intel_display_power_domain domain);
-bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
+bool intel_display_power_enabled_unlocked(struct drm_i915_private *dev_priv,
-                                    enum intel_display_power_domain domain);
+                                          enum intel_display_power_domain domain);
 void intel_display_power_get(struct drm_i915_private *dev_priv,
                             enum intel_display_power_domain domain);
 void intel_display_power_put(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index 02f99d768d49..3fd082933c87 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -117,17 +117,18 @@ static void intel_dsi_device_ready(struct intel_encoder *encoder)
        /* bandgap reset is needed after everytime we do power gate */
        band_gap_reset(dev_priv);
+        I915_WRITE(MIPI_DEVICE_READY(pipe), ULPS_STATE_ENTER);
+        usleep_range(2500, 3000);
        val = I915_READ(MIPI_PORT_CTRL(pipe));
        I915_WRITE(MIPI_PORT_CTRL(pipe), val | LP_OUTPUT_HOLD);
        usleep_range(1000, 1500);
-        I915_WRITE(MIPI_DEVICE_READY(pipe), DEVICE_READY | ULPS_STATE_EXIT);
-        usleep_range(2000, 2500);
+        I915_WRITE(MIPI_DEVICE_READY(pipe), ULPS_STATE_EXIT);
-        I915_WRITE(MIPI_DEVICE_READY(pipe), DEVICE_READY);
+        usleep_range(2500, 3000);
-        usleep_range(2000, 2500);
-        I915_WRITE(MIPI_DEVICE_READY(pipe), 0x00);
-        usleep_range(2000, 2500);
        I915_WRITE(MIPI_DEVICE_READY(pipe), DEVICE_READY);
-        usleep_range(2000, 2500);
+        usleep_range(2500, 3000);
 }
 static void intel_dsi_enable(struct intel_encoder *encoder)
@@ -271,23 +272,23 @@ static void intel_dsi_clear_device_ready(struct intel_encoder *encoder)
        DRM_DEBUG_KMS("\n");
-        I915_WRITE(MIPI_DEVICE_READY(pipe), ULPS_STATE_ENTER);
+        I915_WRITE(MIPI_DEVICE_READY(pipe), DEVICE_READY | ULPS_STATE_ENTER);
        usleep_range(2000, 2500);
-        I915_WRITE(MIPI_DEVICE_READY(pipe), ULPS_STATE_EXIT);
+        I915_WRITE(MIPI_DEVICE_READY(pipe), DEVICE_READY | ULPS_STATE_EXIT);
        usleep_range(2000, 2500);
-        I915_WRITE(MIPI_DEVICE_READY(pipe), ULPS_STATE_ENTER);
+        I915_WRITE(MIPI_DEVICE_READY(pipe), DEVICE_READY | ULPS_STATE_ENTER);
        usleep_range(2000, 2500);
-        val = I915_READ(MIPI_PORT_CTRL(pipe));
-        I915_WRITE(MIPI_PORT_CTRL(pipe), val & ~LP_OUTPUT_HOLD);
-        usleep_range(1000, 1500);
        if (wait_for(((I915_READ(MIPI_PORT_CTRL(pipe)) & AFE_LATCHOUT)
                                        == 0x00000), 30))
                DRM_ERROR("DSI LP not going Low\n");
+        val = I915_READ(MIPI_PORT_CTRL(pipe));
+        I915_WRITE(MIPI_PORT_CTRL(pipe), val & ~LP_OUTPUT_HOLD);
+        usleep_range(1000, 1500);
        I915_WRITE(MIPI_DEVICE_READY(pipe), 0x00);
        usleep_range(2000, 2500);
diff --git a/drivers/gpu/drm/i915/intel_dsi_cmd.c b/drivers/gpu/drm/i915/intel_dsi_cmd.c
index 3eeb21b9fddf..933c86305237 100644
--- a/drivers/gpu/drm/i915/intel_dsi_cmd.c
+++ b/drivers/gpu/drm/i915/intel_dsi_cmd.c
@@ -404,12 +404,6 @@ int dpi_send_cmd(struct intel_dsi *intel_dsi, u32 cmd, bool hs)
        else
                cmd |= DPI_LP_MODE;
-        /* DPI virtual channel?! */
-        mask = DPI_FIFO_EMPTY;
-        if (wait_for((I915_READ(MIPI_GEN_FIFO_STAT(pipe)) & mask) == mask, 50))
-                DRM_ERROR("Timeout waiting for DPI FIFO empty.\n");
        /* clear bit */
        I915_WRITE(MIPI_INTR_STAT(pipe), SPL_PKT_SENT_INTERRUPT);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 23126023aeba..5e5a72fca5fb 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -111,6 +111,13 @@ static void intel_lvds_get_config(struct intel_encoder *encoder,
        pipe_config->adjusted_mode.flags |= flags;
+        /* gen2/3 store dither state in pfit control, needs to match */
+        if (INTEL_INFO(dev)->gen < 4) {
+                tmp = I915_READ(PFIT_CONTROL);
+                pipe_config->gmch_pfit.control |= tmp & PANEL_8TO6_DITHER_ENABLE;
+        }
        dotclock = pipe_config->port_clock;
        if (HAS_PCH_SPLIT(dev_priv->dev))
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index 2e2c71fcc9ed..4f6b53998d79 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -403,6 +403,15 @@ static u32 asle_set_backlight(struct drm_device *dev, u32 bclp)
        DRM_DEBUG_DRIVER("bclp = 0x%08x\n", bclp);
+        /*
+         * If the acpi_video interface is not supposed to be used, don't
+         * bother processing backlight level change requests from firmware.
+         */
+        if (!acpi_video_verify_backlight_support()) {
+                DRM_DEBUG_KMS("opregion backlight request ignored\n");
+                return 0;
+        }
        if (!(bclp & ASLE_BCLP_VALID))
                return ASLC_BACKLIGHT_FAILED;
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 5e6c888b4928..12b02fe1d0ae 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -361,16 +361,16 @@ void intel_gmch_panel_fitting(struct intel_crtc *intel_crtc,
                pfit_control |= ((intel_crtc->pipe << PFIT_PIPE_SHIFT) |
                                 PFIT_FILTER_FUZZY);
-        /* Make sure pre-965 set dither correctly for 18bpp panels. */
-        if (INTEL_INFO(dev)->gen < 4 && pipe_config->pipe_bpp == 18)
-                pfit_control |= PANEL_8TO6_DITHER_ENABLE;
 out:
        if ((pfit_control & PFIT_ENABLE) == 0) {
                pfit_control = 0;
                pfit_pgm_ratios = 0;
        }
+        /* Make sure pre-965 set dither correctly for 18bpp panels. */
+        if (INTEL_INFO(dev)->gen < 4 && pipe_config->pipe_bpp == 18)
+                pfit_control |= PANEL_8TO6_DITHER_ENABLE;
        pipe_config->gmch_pfit.control = pfit_control;
        pipe_config->gmch_pfit.pgm_ratios = pfit_pgm_ratios;
        pipe_config->gmch_pfit.lvds_border_bits = border;
@@ -798,9 +798,6 @@ static void i965_enable_backlight(struct intel_connector *connector)
        ctl = freq << 16;
        I915_WRITE(BLC_PWM_CTL, ctl);
-        /* XXX: combine this into above write? */
-        intel_panel_actually_set_backlight(connector, panel->backlight.level);
        ctl2 = BLM_PIPE(pipe);
        if (panel->backlight.combination_mode)
                ctl2 |= BLM_COMBINATION_MODE;
@@ -809,6 +806,8 @@ static void i965_enable_backlight(struct intel_connector *connector)
        I915_WRITE(BLC_PWM_CTL2, ctl2);
        POSTING_READ(BLC_PWM_CTL2);
        I915_WRITE(BLC_PWM_CTL2, ctl2 | BLM_PWM_ENABLE);
+        intel_panel_actually_set_backlight(connector, panel->backlight.level);
 }
 static void vlv_enable_backlight(struct intel_connector *connector)
@@ -1119,8 +1118,12 @@ int intel_panel_setup_backlight(struct drm_connector *connector)
        int ret;
        if (!dev_priv->vbt.backlight.present) {
-                DRM_DEBUG_KMS("native backlight control not available per VBT\n");
+                if (dev_priv->quirks & QUIRK_BACKLIGHT_PRESENT) {
-                return 0;
+                        DRM_DEBUG_KMS("no backlight present per VBT, but present per quirk\n");
+                } else {
+                        DRM_DEBUG_KMS("no backlight present per VBT\n");
+                        return 0;
+                }
        }
        /* set level and max in panel struct */
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index d1e53abec1b5..ee72807069e4 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -511,8 +511,7 @@ void intel_update_fbc(struct drm_device *dev)
        obj = intel_fb->obj;
        adjusted_mode = &intel_crtc->config.adjusted_mode;
-        if (i915.enable_fbc < 0 &&
+        if (i915.enable_fbc < 0) {
-            INTEL_INFO(dev)->gen <= 7 && !IS_HASWELL(dev)) {
                if (set_no_fbc_reason(dev_priv, FBC_CHIP_DEFAULT))
                        DRM_DEBUG_KMS("disabled per chip default\n");
                goto out_disable;
@@ -3210,6 +3209,14 @@ void gen6_set_rps(struct drm_device *dev, u8 val)
 */
 static void vlv_set_rps_idle(struct drm_i915_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+        /* Latest VLV doesn't need to force the gfx clock */
+        if (dev->pdev->revision >= 0xd) {
+                valleyview_set_rps(dev_priv->dev, dev_priv->rps.min_freq_softlimit);
+                return;
+        }
        /*
         * When we are idle.  Drop to min voltage state.
         */
@@ -3506,15 +3513,11 @@ static void gen8_enable_rps(struct drm_device *dev)
        I915_WRITE(GEN6_RP_IDLE_HYSTERSIS, 10);
-        /* WaDisablePwrmtrEvent:chv (pre-production hw) */
-        I915_WRITE(0xA80C, I915_READ(0xA80C) & 0x00ffffff);
-        I915_WRITE(0xA810, I915_READ(0xA810) & 0xffffff00);
        /* 5: Enable RPS */
        I915_WRITE(GEN6_RP_CONTROL,
                   GEN6_RP_MEDIA_TURBO |
                   GEN6_RP_MEDIA_HW_NORMAL_MODE |
-                   GEN6_RP_MEDIA_IS_GFX | /* WaSetMaskForGfxBusyness:chv (pre-production hw ?) */
+                   GEN6_RP_MEDIA_IS_GFX |
                   GEN6_RP_ENABLE |
                   GEN6_RP_UP_BUSY_AVG |
                   GEN6_RP_DOWN_IDLE_AVG);
@@ -5608,8 +5611,8 @@ static bool hsw_power_well_enabled(struct drm_i915_private *dev_priv,
                     (HSW_PWR_WELL_ENABLE_REQUEST | HSW_PWR_WELL_STATE_ENABLED);
 }
-bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
+bool intel_display_power_enabled_unlocked(struct drm_i915_private *dev_priv,
-                                    enum intel_display_power_domain domain)
+                                          enum intel_display_power_domain domain)
 {
        struct i915_power_domains *power_domains;
        struct i915_power_well *power_well;
@@ -5620,16 +5623,19 @@ bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
                return false;
        power_domains = &dev_priv->power_domains;
        is_enabled = true;
        for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
                if (power_well->always_on)
                        continue;
-                if (!power_well->count) {
+                if (!power_well->hw_enabled) {
                        is_enabled = false;
                        break;
                }
        }
        return is_enabled;
 }
@@ -5637,30 +5643,15 @@ bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
                                 enum intel_display_power_domain domain)
 {
        struct i915_power_domains *power_domains;
-        struct i915_power_well *power_well;
+        bool ret;
-        bool is_enabled;
-        int i;
-        if (dev_priv->pm.suspended)
-                return false;
        power_domains = &dev_priv->power_domains;
-        is_enabled = true;
        mutex_lock(&power_domains->lock);
-        for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
+        ret = intel_display_power_enabled_unlocked(dev_priv, domain);
-                if (power_well->always_on)
-                        continue;
-                if (!power_well->ops->is_enabled(dev_priv, power_well)) {
-                        is_enabled = false;
-                        break;
-                }
-        }
        mutex_unlock(&power_domains->lock);
-        return is_enabled;
+        return ret;
 }
 /*
@@ -5981,6 +5972,7 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
                if (!power_well->count++) {
                        DRM_DEBUG_KMS("enabling %s\n", power_well->name);
                        power_well->ops->enable(dev_priv, power_well);
+                        power_well->hw_enabled = true;
                }
                check_power_well_state(dev_priv, power_well);
@@ -6010,6 +6002,7 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
                if (!--power_well->count && i915.disable_power_well) {
                        DRM_DEBUG_KMS("disabling %s\n", power_well->name);
+                        power_well->hw_enabled = false;
                        power_well->ops->disable(dev_priv, power_well);
                }
@@ -6024,33 +6017,56 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
 static struct i915_power_domains *hsw_pwr;
 /* Display audio driver power well request */
-void i915_request_power_well(void)
+int i915_request_power_well(void)
 {
        struct drm_i915_private *dev_priv;
-        if (WARN_ON(!hsw_pwr))
+        if (!hsw_pwr)
-                return;
+                return -ENODEV;
        dev_priv = container_of(hsw_pwr, struct drm_i915_private,
                                power_domains);
        intel_display_power_get(dev_priv, POWER_DOMAIN_AUDIO);
+        return 0;
 }
 EXPORT_SYMBOL_GPL(i915_request_power_well);
 /* Display audio driver power well release */
-void i915_release_power_well(void)
+int i915_release_power_well(void)
 {
        struct drm_i915_private *dev_priv;
-        if (WARN_ON(!hsw_pwr))
+        if (!hsw_pwr)
-                return;
+                return -ENODEV;
        dev_priv = container_of(hsw_pwr, struct drm_i915_private,
                                power_domains);
        intel_display_power_put(dev_priv, POWER_DOMAIN_AUDIO);
+        return 0;
 }
 EXPORT_SYMBOL_GPL(i915_release_power_well);
+/*
+ * Private interface for the audio driver to get CDCLK in kHz.
+ *
+ * Caller must request power well using i915_request_power_well() prior to
+ * making the call.
+ */
+int i915_get_cdclk_freq(void)
+{
+        struct drm_i915_private *dev_priv;
+        if (!hsw_pwr)
+                return -ENODEV;
+        dev_priv = container_of(hsw_pwr, struct drm_i915_private,
+                                power_domains);
+        return intel_ddi_get_cdclk_freq(dev_priv);
+}
+EXPORT_SYMBOL_GPL(i915_get_cdclk_freq);
 #define POWER_DOMAIN_MASK (BIT(POWER_DOMAIN_NUM) - 1)
 #define HSW_ALWAYS_ON_POWER_DOMAINS (                   \
@@ -6270,8 +6286,11 @@ static void intel_power_domains_resume(struct drm_i915_private *dev_priv)
        int i;
        mutex_lock(&power_domains->lock);
-        for_each_power_well(i, power_well, POWER_DOMAIN_MASK, power_domains)
+        for_each_power_well(i, power_well, POWER_DOMAIN_MASK, power_domains) {
                power_well->ops->sync_hw(dev_priv, power_well);
+                power_well->hw_enabled = power_well->ops->is_enabled(dev_priv,
+                                                                     power_well);
+        }
        mutex_unlock(&power_domains->lock);
 }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 910c83cf7d44..e72017bdcd7f 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -55,7 +55,7 @@ struct intel_ring_hangcheck {
        u32 seqno;
        int score;
        enum intel_ring_hangcheck_action action;
-        bool deadlock;
+        int deadlock;
 };
 struct intel_ringbuffer {
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 6a4d5bc17697..20375cc7f82d 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1385,7 +1385,9 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder,
                         >> SDVO_PORT_MULTIPLY_SHIFT) + 1;
        }
-        dotclock = pipe_config->port_clock / pipe_config->pixel_multiplier;
+        dotclock = pipe_config->port_clock;
+        if (pipe_config->pixel_multiplier)
+                dotclock /= pipe_config->pixel_multiplier;
        if (HAS_PCH_SPLIT(dev))
                ironlake_check_encoder_dotclock(pipe_config, dotclock);
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 1b66ddcdfb33..9a17b4e92ef4 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -691,6 +691,14 @@ intel_post_enable_primary(struct drm_crtc *crtc)
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        /*
+         * BDW signals flip done immediately if the plane
+         * is disabled, even if the plane enable is already
+         * armed to occur at the next vblank :(
+         */
+        if (IS_BROADWELL(dev))
+                intel_wait_for_vblank(dev, intel_crtc->pipe);
+        /*
         * FIXME IPS should be fine as long as one plane is
         * enabled, but in practice it seems to have problems
         * when going from primary only to sprite only and vice
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index 79cba593df0d..4f6fef7ac069 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -320,7 +320,8 @@ static void intel_uncore_forcewake_reset(struct drm_device *dev, bool restore)
        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long irqflags;
-        del_timer_sync(&dev_priv->uncore.force_wake_timer);
+        if (del_timer_sync(&dev_priv->uncore.force_wake_timer))
+                gen6_force_wake_timer((unsigned long)dev_priv);
        /* Hold uncore.lock across reset to prevent any register access
         * with forcewake not set correctly
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
index ae750f6928c1..7f7aadef8a82 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
@@ -277,6 +277,7 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
        static const char *hpd_reg_names[] = {"hpd-gdsc", "hpd-5v"};
        static const char *pwr_reg_names[] = {"core-vdda", "core-vcc"};
        static const char *hpd_clk_names[] = {"iface_clk", "core_clk", "mdp_core_clk"};
+        static unsigned long hpd_clk_freq[] = {0, 19200000, 0};
        static const char *pwr_clk_names[] = {"extp_clk", "alt_iface_clk"};
        config.phy_init      = hdmi_phy_8x74_init;
@@ -286,6 +287,7 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
        config.pwr_reg_names = pwr_reg_names;
        config.pwr_reg_cnt   = ARRAY_SIZE(pwr_reg_names);
        config.hpd_clk_names = hpd_clk_names;
+        config.hpd_freq      = hpd_clk_freq;
        config.hpd_clk_cnt   = ARRAY_SIZE(hpd_clk_names);
        config.pwr_clk_names = pwr_clk_names;
        config.pwr_clk_cnt   = ARRAY_SIZE(pwr_clk_names);
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.h b/drivers/gpu/drm/msm/hdmi/hdmi.h
index 9fafee6a3e43..9d7723c6528a 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.h
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.h
@@ -87,6 +87,7 @@ struct hdmi_platform_config {
        /* clks that need to be on for hpd: */
        const char **hpd_clk_names;
+        const long unsigned *hpd_freq;
        int hpd_clk_cnt;
        /* clks that need to be on for screen pwr (ie pixel clk): */
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
index e56a6196867c..28f7e3ec6c28 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
@@ -127,6 +127,14 @@ static int hpd_enable(struct hdmi_connector *hdmi_connector)
        }
        for (i = 0; i < config->hpd_clk_cnt; i++) {
+                if (config->hpd_freq && config->hpd_freq[i]) {
+                        ret = clk_set_rate(hdmi->hpd_clks[i],
+                                        config->hpd_freq[i]);
+                        if (ret)
+                                dev_warn(dev->dev, "failed to set clk %s (%d)\n",
+                                                config->hpd_clk_names[i], ret);
+                }
                ret = clk_prepare_enable(hdmi->hpd_clks[i]);
                if (ret) {
                        dev_err(dev->dev, "failed to enable hpd clk: %s (%d)\n",
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 42caf7fcb0b9..71510ee26e96 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -20,6 +20,10 @@
 #include "msm_mmu.h"
 #include "mdp5_kms.h"
+static const char *iommu_ports[] = {
+                "mdp_0",
+};
 static struct mdp5_platform_config *mdp5_get_config(struct platform_device *dev);
 static int mdp5_hw_init(struct msm_kms *kms)
@@ -104,6 +108,12 @@ static void mdp5_preclose(struct msm_kms *kms, struct drm_file *file)
 static void mdp5_destroy(struct msm_kms *kms)
 {
        struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+        struct msm_mmu *mmu = mdp5_kms->mmu;
+        if (mmu) {
+                mmu->funcs->detach(mmu, iommu_ports, ARRAY_SIZE(iommu_ports));
+                mmu->funcs->destroy(mmu);
+        }
        kfree(mdp5_kms);
 }
@@ -216,10 +226,6 @@ fail:
        return ret;
 }
-static const char *iommu_ports[] = {
-                "mdp_0",
-};
 static int get_clk(struct platform_device *pdev, struct clk **clkp,
                const char *name)
 {
@@ -317,17 +323,23 @@ struct msm_kms *mdp5_kms_init(struct drm_device *dev)
                mmu = msm_iommu_new(dev, config->iommu);
                if (IS_ERR(mmu)) {
                        ret = PTR_ERR(mmu);
+                        dev_err(dev->dev, "failed to init iommu: %d\n", ret);
                        goto fail;
                }
                ret = mmu->funcs->attach(mmu, iommu_ports,
                                ARRAY_SIZE(iommu_ports));
-                if (ret)
+                if (ret) {
+                        dev_err(dev->dev, "failed to attach iommu: %d\n", ret);
+                        mmu->funcs->destroy(mmu);
                        goto fail;
+                }
        } else {
                dev_info(dev->dev, "no iommu, fallback to phys "
                                "contig buffers for scanout\n");
                mmu = NULL;
        }
+        mdp5_kms->mmu = mmu;
        mdp5_kms->id = msm_register_mmu(dev, mmu);
        if (mdp5_kms->id < 0) {
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
index c8b1a2522c25..6e981b692d1d 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
@@ -33,6 +33,7 @@ struct mdp5_kms {
        /* mapper-id used to request GEM buffer mapped for scanout: */
        int id;
+        struct msm_mmu *mmu;
        /* for tracking smp allocation amongst pipes: */
        mdp5_smp_state_t smp_state;
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 0d2562fb681e..9a5d87db5c23 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -159,7 +159,7 @@ static int msm_unload(struct drm_device *dev)
 static int get_mdp_ver(struct platform_device *pdev)
 {
 #ifdef CONFIG_OF
-        const static struct of_device_id match_types[] = { {
+        static const struct of_device_id match_types[] = { {
                .compatible = "qcom,mdss_mdp",
                .data   = (void *)5,
        }, {
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index a752ab83b810..5107fc4826bc 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -59,7 +59,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
        struct drm_framebuffer *fb = NULL;
        struct fb_info *fbi = NULL;
        struct drm_mode_fb_cmd2 mode_cmd = {0};
-        dma_addr_t paddr;
+        uint32_t paddr;
        int ret, size;
        sizes->surface_bpp = 32;
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index bb8026daebc9..690d7e7b6d1e 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -278,6 +278,7 @@ int msm_gem_get_iova_locked(struct drm_gem_object *obj, int id,
                uint32_t *iova)
 {
        struct msm_gem_object *msm_obj = to_msm_bo(obj);
+        struct drm_device *dev = obj->dev;
        int ret = 0;
        if (!msm_obj->domain[id].iova) {
@@ -285,6 +286,11 @@ int msm_gem_get_iova_locked(struct drm_gem_object *obj, int id,
                struct msm_mmu *mmu = priv->mmus[id];
                struct page **pages = get_pages(obj);
+                if (!mmu) {
+                        dev_err(dev->dev, "null MMU pointer\n");
+                        return -EINVAL;
+                }
                if (IS_ERR(pages))
                        return PTR_ERR(pages);
diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
index 92b745986231..4b2ad9181edf 100644
--- a/drivers/gpu/drm/msm/msm_iommu.c
+++ b/drivers/gpu/drm/msm/msm_iommu.c
@@ -28,7 +28,7 @@ static int msm_fault_handler(struct iommu_domain *iommu, struct device *dev,
                unsigned long iova, int flags, void *arg)
 {
        DBG("*** fault: iova=%08lx, flags=%d", iova, flags);
-        return 0;
+        return -ENOSYS;
 }
 static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
@@ -40,8 +40,10 @@ static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
        for (i = 0; i < cnt; i++) {
                struct device *msm_iommu_get_ctx(const char *ctx_name);
                struct device *ctx = msm_iommu_get_ctx(names[i]);
-                if (IS_ERR_OR_NULL(ctx))
+                if (IS_ERR_OR_NULL(ctx)) {
+                        dev_warn(dev->dev, "couldn't get %s context", names[i]);
                        continue;
+                }
                ret = iommu_attach_device(iommu->domain, ctx);
                if (ret) {
                        dev_warn(dev->dev, "could not attach iommu to %s", names[i]);
@@ -52,6 +54,20 @@ static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
        return 0;
 }
+static void msm_iommu_detach(struct msm_mmu *mmu, const char **names, int cnt)
+{
+        struct msm_iommu *iommu = to_msm_iommu(mmu);
+        int i;
+        for (i = 0; i < cnt; i++) {
+                struct device *msm_iommu_get_ctx(const char *ctx_name);
+                struct device *ctx = msm_iommu_get_ctx(names[i]);
+                if (IS_ERR_OR_NULL(ctx))
+                        continue;
+                iommu_detach_device(iommu->domain, ctx);
+        }
+}
 static int msm_iommu_map(struct msm_mmu *mmu, uint32_t iova,
                struct sg_table *sgt, unsigned len, int prot)
 {
@@ -110,7 +126,7 @@ static int msm_iommu_unmap(struct msm_mmu *mmu, uint32_t iova,
                VERB("unmap[%d]: %08x(%x)", i, iova, bytes);
-                BUG_ON(!IS_ALIGNED(bytes, PAGE_SIZE));
+                BUG_ON(!PAGE_ALIGNED(bytes));
                da += bytes;
        }
@@ -127,6 +143,7 @@ static void msm_iommu_destroy(struct msm_mmu *mmu)
 static const struct msm_mmu_funcs funcs = {
                .attach = msm_iommu_attach,
+                .detach = msm_iommu_detach,
                .map = msm_iommu_map,
                .unmap = msm_iommu_unmap,
                .destroy = msm_iommu_destroy,
diff --git a/drivers/gpu/drm/msm/msm_mmu.h b/drivers/gpu/drm/msm/msm_mmu.h
index 030324482b4a..21da6d154f71 100644
--- a/drivers/gpu/drm/msm/msm_mmu.h
+++ b/drivers/gpu/drm/msm/msm_mmu.h
@@ -22,6 +22,7 @@
 struct msm_mmu_funcs {
        int (*attach)(struct msm_mmu *mmu, const char **names, int cnt);
+        void (*detach)(struct msm_mmu *mmu, const char **names, int cnt);
        int (*map)(struct msm_mmu *mmu, uint32_t iova, struct sg_table *sgt,
                        unsigned len, int prot);
        int (*unmap)(struct msm_mmu *mmu, uint32_t iova, struct sg_table *sgt,
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
index 2b6156d0e4b5..8b307e143632 100644
--- a/drivers/gpu/drm/nouveau/Makefile
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -140,6 +140,7 @@ nouveau-y += core/subdev/i2c/nv4e.o
 nouveau-y += core/subdev/i2c/nv50.o
 nouveau-y += core/subdev/i2c/nv94.o
 nouveau-y += core/subdev/i2c/nvd0.o
+nouveau-y += core/subdev/i2c/gf117.o
 nouveau-y += core/subdev/i2c/nve0.o
 nouveau-y += core/subdev/ibus/nvc0.o
 nouveau-y += core/subdev/ibus/nve0.o
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
index f199957995fa..8d55ed633b19 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
@@ -314,7 +314,7 @@ nvc0_identify(struct nouveau_device *device)
                device->cname = "GF117";
                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                device->oclass[NVDEV_SUBDEV_GPIO   ] =  nvd0_gpio_oclass;
-                device->oclass[NVDEV_SUBDEV_I2C    ] =  nvd0_i2c_oclass;
+                device->oclass[NVDEV_SUBDEV_I2C    ] =  gf117_i2c_oclass;
                device->oclass[NVDEV_SUBDEV_CLOCK  ] = &nvc0_clock_oclass;
                device->oclass[NVDEV_SUBDEV_THERM  ] = &nvd0_therm_oclass;
                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/base.c b/drivers/gpu/drm/nouveau/core/engine/disp/base.c
index c41f656abe64..9c38c5e40500 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/base.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/base.c
@@ -99,8 +99,10 @@ _nouveau_disp_dtor(struct nouveau_object *object)
        nouveau_event_destroy(&disp->vblank);
-        list_for_each_entry_safe(outp, outt, &disp->outp, head) {
+        if (disp->outp.next) {
-                nouveau_object_ref(NULL, (struct nouveau_object **)&outp);
+                list_for_each_entry_safe(outp, outt, &disp->outp, head) {
+                        nouveau_object_ref(NULL, (struct nouveau_object **)&outp);
+                }
        }
        nouveau_engine_destroy(&disp->base);
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/dport.c b/drivers/gpu/drm/nouveau/core/engine/disp/dport.c
index 39562d48101d..5a5b59b21130 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/dport.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/dport.c
@@ -241,7 +241,9 @@ dp_link_train_eq(struct dp_state *dp)
                dp_set_training_pattern(dp, 2);
        do {
-                if (dp_link_train_update(dp, dp->pc2, 400))
+                if ((tries &&
+                    dp_link_train_commit(dp, dp->pc2)) ||
+                    dp_link_train_update(dp, dp->pc2, 400))
                        break;
                eq_done = !!(dp->stat[2] & DPCD_LS04_INTERLANE_ALIGN_DONE);
@@ -253,9 +255,6 @@ dp_link_train_eq(struct dp_state *dp)
                            !(lane & DPCD_LS02_LANE0_SYMBOL_LOCKED))
                                eq_done = false;
                }
-                if (dp_link_train_commit(dp, dp->pc2))
-                        break;
        } while (!eq_done && cr_done && ++tries <= 5);
        return eq_done ? 0 : -1;
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 1e85f36c705f..2283c442a10d 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -1270,7 +1270,7 @@ exec_clkcmp(struct nv50_disp_priv *priv, int head, int id, u32 pclk, u32 *conf)
        i--;
        outp = exec_lookup(priv, head, i, ctrl, &data, &ver, &hdr, &cnt, &len, &info1);
-        if (!data)
+        if (!outp)
                return NULL;
        if (outp->info.location == 0) {
@@ -1516,11 +1516,11 @@ nv50_disp_intr_unk20_2(struct nv50_disp_priv *priv, int head)
                }
                switch ((ctrl & 0x000f0000) >> 16) {
-                case 6: datarate = pclk * 30 / 8; break;
+                case 6: datarate = pclk * 30; break;
-                case 5: datarate = pclk * 24 / 8; break;
+                case 5: datarate = pclk * 24; break;
                case 2:
                default:
-                        datarate = pclk * 18 / 8;
+                        datarate = pclk * 18;
                        break;
                }
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
index 48aa38a87e3f..fa30d8196f35 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
@@ -1159,11 +1159,11 @@ nvd0_disp_intr_unk2_2(struct nv50_disp_priv *priv, int head)
        if (outp->info.type == DCB_OUTPUT_DP) {
                u32 sync = nv_rd32(priv, 0x660404 + (head * 0x300));
                switch ((sync & 0x000003c0) >> 6) {
-                case 6: pclk = pclk * 30 / 8; break;
+                case 6: pclk = pclk * 30; break;
-                case 5: pclk = pclk * 24 / 8; break;
+                case 5: pclk = pclk * 24; break;
                case 2:
                default:
-                        pclk = pclk * 18 / 8;
+                        pclk = pclk * 18;
                        break;
                }
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/outpdp.c b/drivers/gpu/drm/nouveau/core/engine/disp/outpdp.c
index 52c299c3d300..eb2d7789555d 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/outpdp.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/outpdp.c
@@ -34,7 +34,7 @@ nvkm_output_dp_train(struct nvkm_output *base, u32 datarate, bool wait)
        struct nvkm_output_dp *outp = (void *)base;
        bool retrain = true;
        u8 link[2], stat[3];
-        u32 rate;
+        u32 linkrate;
        int ret, i;
        /* check that the link is trained at a high enough rate */
@@ -44,8 +44,10 @@ nvkm_output_dp_train(struct nvkm_output *base, u32 datarate, bool wait)
                goto done;
        }
-        rate = link[0] * 27000 * (link[1] & DPCD_LC01_LANE_COUNT_SET);
+        linkrate = link[0] * 27000 * (link[1] & DPCD_LC01_LANE_COUNT_SET);
-        if (rate < ((datarate / 8) * 10)) {
+        linkrate = (linkrate * 8) / 10; /* 8B/10B coding overhead */
+        datarate = (datarate + 9) / 10; /* -> decakilobits */
+        if (linkrate < datarate) {
                DBG("link not trained at sufficient rate\n");
                goto done;
        }
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
index e1832778e8b6..7a1ebdfa9e1b 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
@@ -87,6 +87,7 @@ nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
                        struct nvkm_output_dp *outpdp = (void *)outp;
                        switch (data) {
                        case NV94_DISP_SOR_DP_PWR_STATE_OFF:
+                                nouveau_event_put(outpdp->irq);
                                ((struct nvkm_output_dp_impl *)nv_oclass(outp))
                                        ->lnk_pwr(outpdp, 0);
                                atomic_set(&outpdp->lt.done, 0);
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/gpc.fuc b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/gpc.fuc
index 2f7345f7fe07..7445f12b1d9e 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/gpc.fuc
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/gpc.fuc
@@ -54,7 +54,7 @@ mmio_list_base:
 #ifdef INCLUDE_CODE
 // reports an exception to the host
 //
-// In: $r15 error code (see nvc0.fuc)
+// In: $r15 error code (see os.h)
 //
 error:
        push $r14
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hub.fuc b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hub.fuc
index c8ddb8d71b91..b4ad18bf5a26 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hub.fuc
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hub.fuc
@@ -49,7 +49,7 @@ hub_mmio_list_next:
 #ifdef INCLUDE_CODE
 // reports an exception to the host
 //
-// In: $r15 error code (see nvc0.fuc)
+// In: $r15 error code (see os.h)
 //
 error:
        nv_iowr(NV_PGRAPH_FECS_CC_SCRATCH_VAL(5), 0, $r15)
@@ -343,13 +343,25 @@ ih:
        ih_no_ctxsw:
        and $r11 $r10 NV_PGRAPH_FECS_INTR_FWMTHD
        bra e #ih_no_fwmthd
-                // none we handle, ack, and fall-through to unhandled
+                // none we handle; report to host and ack
+                nv_rd32($r15, NV_PGRAPH_TRAPPED_DATA_LO)
+                nv_iowr(NV_PGRAPH_FECS_CC_SCRATCH_VAL(4), 0, $r15)
+                nv_rd32($r15, NV_PGRAPH_TRAPPED_ADDR)
+                nv_iowr(NV_PGRAPH_FECS_CC_SCRATCH_VAL(3), 0, $r15)
+                extr $r14 $r15 16:18
+                shl b32 $r14 $r14 2
+                imm32($r15, NV_PGRAPH_FE_OBJECT_TABLE(0))
+                add b32 $r14 $r15
+                call(nv_rd32)
+                nv_iowr(NV_PGRAPH_FECS_CC_SCRATCH_VAL(2), 0, $r15)
+                mov $r15 E_BAD_FWMTHD
+                call(error)
                mov $r11 0x100
                nv_wr32(0x400144, $r11)
        // anything we didn't handle, bring it to the host's attention
        ih_no_fwmthd:
-        mov $r11 0x104 // FIFO | CHSW
+        mov $r11 0x504 // FIFO | CHSW | FWMTHD
        not b32 $r11
        and $r11 $r10 $r11
        bra e #ih_no_other
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubgm107.fuc5.h b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubgm107.fuc5.h
index 214dd16ec566..5f953c5c20b7 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubgm107.fuc5.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubgm107.fuc5.h
@@ -478,10 +478,10 @@ uint32_t gm107_grhub_code[] = {
        0x01040080,
        0xbd0001f6,
        0x01004104,
-        0x627e020f,
+        0xa87e020f,
-        0x717e0006,
+        0xb77e0006,
        0x100f0006,
-        0x0006b37e,
+        0x0006f97e,
        0x98000e98,
        0x207e010f,
        0x14950001,
@@ -523,8 +523,8 @@ uint32_t gm107_grhub_code[] = {
        0x800040b7,
        0xf40132b6,
        0x000fb41b,
-        0x0006b37e,
+        0x0006f97e,
-        0x627e000f,
+        0xa87e000f,
        0x00800006,
        0x01f60201,
        0xbd04bd00,
@@ -554,7 +554,7 @@ uint32_t gm107_grhub_code[] = {
        0x0009f602,
        0x32f404bd,
        0x0231f401,
-        0x0008367e,
+        0x00087c7e,
        0x99f094bd,
        0x17008007,
        0x0009f602,
@@ -563,7 +563,7 @@ uint32_t gm107_grhub_code[] = {
        0x37008006,
        0x0009f602,
        0x31f404bd,
-        0x08367e01,
+        0x087c7e01,
        0xf094bd00,
        0x00800699,
        0x09f60217,
@@ -572,7 +572,7 @@ uint32_t gm107_grhub_code[] = {
        0x20f92f0e,
        0x32f412b2,
        0x0232f401,
-        0x0008367e,
+        0x00087c7e,
        0x008020fc,
        0x02f602c0,
        0xf404bd00,
@@ -580,7 +580,7 @@ uint32_t gm107_grhub_code[] = {
        0x23c8130e,
        0x0d0bf41f,
        0xf40131f4,
-        0x367e0232,
+        0x7c7e0232,
 /* 0x054e: chsw_done */
        0x01020008,
        0x02c30080,
@@ -593,7 +593,7 @@ uint32_t gm107_grhub_code[] = {
        0xb0ff2a0e,
        0x1bf401e4,
        0x7ef2b20c,
-        0xf40007d6,
+        0xf400081c,
 /* 0x057a: main_not_ctx_chan */
        0xe4b0400e,
        0x2c1bf402,
@@ -602,7 +602,7 @@ uint32_t gm107_grhub_code[] = {
        0x0009f602,
        0x32f404bd,
        0x0232f401,
-        0x0008367e,
+        0x00087c7e,
        0x99f094bd,
        0x17008007,
        0x0009f602,
@@ -642,238 +642,238 @@ uint32_t gm107_grhub_code[] = {
 /* 0x061a: ih_no_ctxsw */
        0xabe40000,
        0x0bf40400,
-        0x01004b10,
+        0x07088e56,
-        0x448ebfb2,
-        0x8f7e4001,
-/* 0x062e: ih_no_fwmthd */
-        0x044b0000,
-        0xffb0bd01,
-        0x0bf4b4ab,
-        0x0700800c,
-        0x000bf603,
-/* 0x0642: ih_no_other */
-        0x004004bd,
-        0x000af601,
-        0xf0fc04bd,
-        0xd0fce0fc,
-        0xa0fcb0fc,
-        0x80fc90fc,
-        0xfc0088fe,
-        0x0032f480,
-/* 0x0662: ctx_4170s */
-        0xf5f001f8,
-        0x8effb210,
-        0x7e404170,
-        0xf800008f,
-/* 0x0671: ctx_4170w */
-        0x41708e00,
        0x00657e40,
-        0xf0ffb200,
+        0x80ffb200,
-        0x1bf410f4,
+        0xf6020400,
-/* 0x0683: ctx_redswitch */
-        0x4e00f8f3,
-        0xe5f00200,
-        0x20e5f040,
-        0x8010e5f0,
-        0xf6018500,
-        0x04bd000e,
-/* 0x069a: ctx_redswitch_delay */
-        0xf2b6080f,
-        0xfd1bf401,
-        0x0400e5f1,
-        0x0100e5f1,
-        0x01850080,
-        0xbd000ef6,
-/* 0x06b3: ctx_86c */
-        0x8000f804,
-        0xf6022300,
        0x04bd000f,
-        0x148effb2,
+        0x4007048e,
-        0x8f7e408a,
+        0x0000657e,
-        0xffb20000,
+        0x0080ffb2,
-        0x41a88c8e,
+        0x0ff60203,
+        0xc704bd00,
+        0xee9450fe,
+        0x07008f02,
+        0x00efbb40,
+        0x0000657e,
+        0x02020080,
+        0xbd000ff6,
+        0x7e030f04,
+        0x4b0002f8,
+        0xbfb20100,
+        0x4001448e,
        0x00008f7e,
-/* 0x06d2: ctx_mem */
+/* 0x0674: ih_no_fwmthd */
-        0x008000f8,
+        0xbd05044b,
-        0x0ff60284,
+        0xb4abffb0,
-/* 0x06db: ctx_mem_wait */
+        0x800c0bf4,
-        0x8f04bd00,
+        0xf6030700,
-        0xcf028400,
+        0x04bd000b,
-        0xfffd00ff,
+/* 0x0688: ih_no_other */
-        0xf61bf405,
+        0xf6010040,
-/* 0x06ea: ctx_load */
+        0x04bd000a,
-        0x94bd00f8,
+        0xe0fcf0fc,
-        0x800599f0,
+        0xb0fcd0fc,
-        0xf6023700,
+        0x90fca0fc,
-        0x04bd0009,
+        0x88fe80fc,
-        0xb87e0c0a,
+        0xf480fc00,
-        0xf4bd0000,
+        0x01f80032,
-        0x02890080,
+/* 0x06a8: ctx_4170s */
+        0xb210f5f0,
+        0x41708eff,
+        0x008f7e40,
+/* 0x06b7: ctx_4170w */
+        0x8e00f800,
+        0x7e404170,
+        0xb2000065,
+        0x10f4f0ff,
+        0xf8f31bf4,
+/* 0x06c9: ctx_redswitch */
+        0x02004e00,
+        0xf040e5f0,
+        0xe5f020e5,
+        0x85008010,
+        0x000ef601,
+        0x080f04bd,
+/* 0x06e0: ctx_redswitch_delay */
+        0xf401f2b6,
+        0xe5f1fd1b,
+        0xe5f10400,
+        0x00800100,
+        0x0ef60185,
+        0xf804bd00,
+/* 0x06f9: ctx_86c */
+        0x23008000,
+        0x000ff602,
+        0xffb204bd,
+        0x408a148e,
+        0x00008f7e,
+        0x8c8effb2,
+        0x8f7e41a8,
+        0x00f80000,
+/* 0x0718: ctx_mem */
+        0x02840080,
        0xbd000ff6,
-        0xc1008004,
+/* 0x0721: ctx_mem_wait */
-        0x0002f602,
+        0x84008f04,
-        0x008004bd,
+        0x00ffcf02,
-        0x02f60283,
+        0xf405fffd,
-        0x0f04bd00,
+        0x00f8f61b,
-        0x06d27e07,
+/* 0x0730: ctx_load */
-        0xc0008000,
+        0x99f094bd,
-        0x0002f602,
+        0x37008005,
-        0x0bfe04bd,
+        0x0009f602,
-        0x1f2af000,
+        0x0c0a04bd,
-        0xb60424b6,
+        0x0000b87e,
-        0x94bd0220,
+        0x0080f4bd,
-        0x800899f0,
+        0x0ff60289,
-        0xf6023700,
+        0x8004bd00,
-        0x04bd0009,
+        0xf602c100,
-        0x02810080,
+        0x04bd0002,
-        0xbd0002f6,
+        0x02830080,
-        0x0000d204,
-        0x25f08000,
-        0x88008002,
-        0x0002f602,
-        0x100104bd,
-        0xf0020042,
-        0x12fa0223,
-        0xbd03f805,
-        0x0899f094,
-        0x02170080,
-        0xbd0009f6,
-        0x81019804,
-        0x981814b6,
-        0x25b68002,
-        0x0512fd08,
-        0xbd1601b5,
-        0x0999f094,
-        0x02370080,
-        0xbd0009f6,
-        0x81008004,
-        0x0001f602,
-        0x010204bd,
-        0x02880080,
        0xbd0002f6,
-        0x01004104,
+        0x7e070f04,
-        0xfa0613f0,
+        0x80000718,
-        0x03f80501,
+        0xf602c000,
+        0x04bd0002,
+        0xf0000bfe,
+        0x24b61f2a,
+        0x0220b604,
        0x99f094bd,
-        0x17008009,
+        0x37008008,
        0x0009f602,
-        0x94bd04bd,
+        0x008004bd,
-        0x800599f0,
+        0x02f60281,
+        0xd204bd00,
+        0x80000000,
+        0x800225f0,
+        0xf6028800,
+        0x04bd0002,
+        0x00421001,
+        0x0223f002,
+        0xf80512fa,
+        0xf094bd03,
+        0x00800899,
+        0x09f60217,
+        0x9804bd00,
+        0x14b68101,
+        0x80029818,
+        0xfd0825b6,
+        0x01b50512,
+        0xf094bd16,
+        0x00800999,
+        0x09f60237,
+        0x8004bd00,
+        0xf6028100,
+        0x04bd0001,
+        0x00800102,
+        0x02f60288,
+        0x4104bd00,
+        0x13f00100,
+        0x0501fa06,
+        0x94bd03f8,
+        0x800999f0,
        0xf6021700,
        0x04bd0009,
-/* 0x07d6: ctx_chan */
+        0x99f094bd,
-        0xea7e00f8,
+        0x17008005,
-        0x0c0a0006,
+        0x0009f602,
-        0x0000b87e,
+        0x00f804bd,
-        0xd27e050f,
+/* 0x081c: ctx_chan */
-        0x00f80006,
+        0x0007307e,
-/* 0x07e8: ctx_mmio_exec */
+        0xb87e0c0a,
-        0x80410398,
+        0x050f0000,
+        0x0007187e,
+/* 0x082e: ctx_mmio_exec */
+        0x039800f8,
+        0x81008041,
+        0x0003f602,
+        0x34bd04bd,
+/* 0x083c: ctx_mmio_loop */
+        0xf4ff34c4,
+        0x00450e1b,
+        0x0653f002,
+        0xf80535fa,
+/* 0x084d: ctx_mmio_pull */
+        0x804e9803,
+        0x7e814f98,
+        0xb600008f,
+        0x12b60830,
+        0xdf1bf401,
+/* 0x0860: ctx_mmio_done */
+        0x80160398,
        0xf6028100,
        0x04bd0003,
-/* 0x07f6: ctx_mmio_loop */
+        0x414000b5,
-        0x34c434bd,
+        0x13f00100,
-        0x0e1bf4ff,
+        0x0601fa06,
-        0xf0020045,
+        0x00f803f8,
-        0x35fa0653,
+/* 0x087c: ctx_xfer */
-/* 0x0807: ctx_mmio_pull */
+        0x0080040e,
-        0x9803f805,
+        0x0ef60302,
-        0x4f98804e,
+/* 0x0887: ctx_xfer_idle */
-        0x008f7e81,
+        0x8e04bd00,
-        0x0830b600,
+        0xcf030000,
-        0xf40112b6,
+        0xe4f100ee,
-/* 0x081a: ctx_mmio_done */
+        0x1bf42000,
-        0x0398df1b,
+        0x0611f4f5,
-        0x81008016,
+/* 0x089b: ctx_xfer_pre */
-        0x0003f602,
+        0x0f0c02f4,
-        0x00b504bd,
+        0x06f97e10,
-        0x01004140,
+        0x1b11f400,
-        0xfa0613f0,
+/* 0x08a4: ctx_xfer_pre_load */
-        0x03f80601,
+        0xa87e020f,
-/* 0x0836: ctx_xfer */
+        0xb77e0006,
-        0x040e00f8,
+        0xc97e0006,
-        0x03020080,
+        0xf4bd0006,
-        0xbd000ef6,
+        0x0006a87e,
-/* 0x0841: ctx_xfer_idle */
+        0x0007307e,
-        0x00008e04,
+/* 0x08bc: ctx_xfer_exec */
-        0x00eecf03,
+        0xbd160198,
-        0x2000e4f1,
+        0x05008024,
-        0xf4f51bf4,
+        0x0002f601,
-        0x02f40611,
+        0x1fb204bd,
-/* 0x0855: ctx_xfer_pre */
+        0x41a5008e,
-        0x7e100f0c,
-        0xf40006b3,
-/* 0x085e: ctx_xfer_pre_load */
-        0x020f1b11,
-        0x0006627e,
-        0x0006717e,
-        0x0006837e,
-        0x627ef4bd,
-        0xea7e0006,
-/* 0x0876: ctx_xfer_exec */
-        0x01980006,
-        0x8024bd16,
-        0xf6010500,
-        0x04bd0002,
-        0x008e1fb2,
-        0x8f7e41a5,
-        0xfcf00000,
-        0x022cf001,
-        0xfd0124b6,
-        0xffb205f2,
-        0x41a5048e,
        0x00008f7e,
-        0x0002167e,
+        0xf001fcf0,
-        0xfc8024bd,
+        0x24b6022c,
-        0x02f60247,
+        0x05f2fd01,
-        0xf004bd00,
+        0x048effb2,
-        0x20b6012c,
+        0x8f7e41a5,
-        0x4afc8003,
+        0x167e0000,
-        0x0002f602,
+        0x24bd0002,
-        0xacf004bd,
+        0x0247fc80,
-        0x06a5f001,
+        0xbd0002f6,
-        0x0c98000b,
+        0x012cf004,
-        0x010d9800,
+        0x800320b6,
-        0x3d7e000e,
+        0xf6024afc,
-        0x080a0001,
+        0x04bd0002,
-        0x0000ec7e,
+        0xf001acf0,
-        0x00020a7e,
+        0x000b06a5,
-        0x0a1201f4,
+        0x98000c98,
-        0x00b87e0c,
+        0x000e010d,
-        0x7e050f00,
+        0x00013d7e,
-        0xf40006d2,
+        0xec7e080a,
-/* 0x08f2: ctx_xfer_post */
+        0x0a7e0000,
-        0x020f2d02,
+        0x01f40002,
-        0x0006627e,
+        0x7e0c0a12,
-        0xb37ef4bd,
+        0x0f0000b8,
-        0x277e0006,
+        0x07187e05,
-        0x717e0002,
+        0x2d02f400,
+/* 0x0938: ctx_xfer_post */
+        0xa87e020f,
        0xf4bd0006,
-        0x0006627e,
+        0x0006f97e,
-        0x981011f4,
+        0x0002277e,
-        0x11fd4001,
+        0x0006b77e,
-        0x070bf405,
+        0xa87ef4bd,
-        0x0007e87e,
+        0x11f40006,
-/* 0x091c: ctx_xfer_no_post_mmio */
+        0x40019810,
-/* 0x091c: ctx_xfer_done */
+        0xf40511fd,
-        0x000000f8,
+        0x2e7e070b,
-        0x00000000,
+/* 0x0962: ctx_xfer_no_post_mmio */
-        0x00000000,
+/* 0x0962: ctx_xfer_done */
-        0x00000000,
+        0x00f80008,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnv108.fuc5.h b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnv108.fuc5.h
index 64dfd75192bf..e49b5a877ae4 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnv108.fuc5.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnv108.fuc5.h
@@ -478,10 +478,10 @@ uint32_t nv108_grhub_code[] = {
        0x01040080,
        0xbd0001f6,
        0x01004104,
-        0x627e020f,
+        0xa87e020f,
-        0x717e0006,
+        0xb77e0006,
        0x100f0006,
-        0x0006b37e,
+        0x0006f97e,
        0x98000e98,
        0x207e010f,
        0x14950001,
@@ -523,8 +523,8 @@ uint32_t nv108_grhub_code[] = {
        0x800040b7,
        0xf40132b6,
        0x000fb41b,
-        0x0006b37e,
+        0x0006f97e,
-        0x627e000f,
+        0xa87e000f,
        0x00800006,
        0x01f60201,
        0xbd04bd00,
@@ -554,7 +554,7 @@ uint32_t nv108_grhub_code[] = {
        0x0009f602,
        0x32f404bd,
        0x0231f401,
-        0x0008367e,
+        0x00087c7e,
        0x99f094bd,
        0x17008007,
        0x0009f602,
@@ -563,7 +563,7 @@ uint32_t nv108_grhub_code[] = {
        0x37008006,
        0x0009f602,
        0x31f404bd,
-        0x08367e01,
+        0x087c7e01,
        0xf094bd00,
        0x00800699,
        0x09f60217,
@@ -572,7 +572,7 @@ uint32_t nv108_grhub_code[] = {
        0x20f92f0e,
        0x32f412b2,
        0x0232f401,
-        0x0008367e,
+        0x00087c7e,
        0x008020fc,
        0x02f602c0,
        0xf404bd00,
@@ -580,7 +580,7 @@ uint32_t nv108_grhub_code[] = {
        0x23c8130e,
        0x0d0bf41f,
        0xf40131f4,
-        0x367e0232,
+        0x7c7e0232,
 /* 0x054e: chsw_done */
        0x01020008,
        0x02c30080,
@@ -593,7 +593,7 @@ uint32_t nv108_grhub_code[] = {
        0xb0ff2a0e,
        0x1bf401e4,
        0x7ef2b20c,
-        0xf40007d6,
+        0xf400081c,
 /* 0x057a: main_not_ctx_chan */
        0xe4b0400e,
        0x2c1bf402,
@@ -602,7 +602,7 @@ uint32_t nv108_grhub_code[] = {
        0x0009f602,
        0x32f404bd,
        0x0232f401,
-        0x0008367e,
+        0x00087c7e,
        0x99f094bd,
        0x17008007,
        0x0009f602,
@@ -642,238 +642,238 @@ uint32_t nv108_grhub_code[] = {
 /* 0x061a: ih_no_ctxsw */
        0xabe40000,
        0x0bf40400,
-        0x01004b10,
+        0x07088e56,
-        0x448ebfb2,
-        0x8f7e4001,
-/* 0x062e: ih_no_fwmthd */
-        0x044b0000,
-        0xffb0bd01,
-        0x0bf4b4ab,
-        0x0700800c,
-        0x000bf603,
-/* 0x0642: ih_no_other */
-        0x004004bd,
-        0x000af601,
-        0xf0fc04bd,
-        0xd0fce0fc,
-        0xa0fcb0fc,
-        0x80fc90fc,
-        0xfc0088fe,
-        0x0032f480,
-/* 0x0662: ctx_4170s */
-        0xf5f001f8,
-        0x8effb210,
-        0x7e404170,
-        0xf800008f,
-/* 0x0671: ctx_4170w */
-        0x41708e00,
        0x00657e40,
-        0xf0ffb200,
+        0x80ffb200,
-        0x1bf410f4,
+        0xf6020400,
-/* 0x0683: ctx_redswitch */
-        0x4e00f8f3,
-        0xe5f00200,
-        0x20e5f040,
-        0x8010e5f0,
-        0xf6018500,
-        0x04bd000e,
-/* 0x069a: ctx_redswitch_delay */
-        0xf2b6080f,
-        0xfd1bf401,
-        0x0400e5f1,
-        0x0100e5f1,
-        0x01850080,
-        0xbd000ef6,
-/* 0x06b3: ctx_86c */
-        0x8000f804,
-        0xf6022300,
        0x04bd000f,
-        0x148effb2,
+        0x4007048e,
-        0x8f7e408a,
+        0x0000657e,
-        0xffb20000,
+        0x0080ffb2,
-        0x41a88c8e,
+        0x0ff60203,
+        0xc704bd00,
+        0xee9450fe,
+        0x07008f02,
+        0x00efbb40,
+        0x0000657e,
+        0x02020080,
+        0xbd000ff6,
+        0x7e030f04,
+        0x4b0002f8,
+        0xbfb20100,
+        0x4001448e,
        0x00008f7e,
-/* 0x06d2: ctx_mem */
+/* 0x0674: ih_no_fwmthd */
-        0x008000f8,
+        0xbd05044b,
-        0x0ff60284,
+        0xb4abffb0,
-/* 0x06db: ctx_mem_wait */
+        0x800c0bf4,
-        0x8f04bd00,
+        0xf6030700,
-        0xcf028400,
+        0x04bd000b,
-        0xfffd00ff,
+/* 0x0688: ih_no_other */
-        0xf61bf405,
+        0xf6010040,
-/* 0x06ea: ctx_load */
+        0x04bd000a,
-        0x94bd00f8,
+        0xe0fcf0fc,
-        0x800599f0,
+        0xb0fcd0fc,
-        0xf6023700,
+        0x90fca0fc,
-        0x04bd0009,
+        0x88fe80fc,
-        0xb87e0c0a,
+        0xf480fc00,
-        0xf4bd0000,
+        0x01f80032,
-        0x02890080,
+/* 0x06a8: ctx_4170s */
+        0xb210f5f0,
+        0x41708eff,
+        0x008f7e40,
+/* 0x06b7: ctx_4170w */
+        0x8e00f800,
+        0x7e404170,
+        0xb2000065,
+        0x10f4f0ff,
+        0xf8f31bf4,
+/* 0x06c9: ctx_redswitch */
+        0x02004e00,
+        0xf040e5f0,
+        0xe5f020e5,
+        0x85008010,
+        0x000ef601,
+        0x080f04bd,
+/* 0x06e0: ctx_redswitch_delay */
+        0xf401f2b6,
+        0xe5f1fd1b,
+        0xe5f10400,
+        0x00800100,
+        0x0ef60185,
+        0xf804bd00,
+/* 0x06f9: ctx_86c */
+        0x23008000,
+        0x000ff602,
+        0xffb204bd,
+        0x408a148e,
+        0x00008f7e,
+        0x8c8effb2,
+        0x8f7e41a8,
+        0x00f80000,
+/* 0x0718: ctx_mem */
+        0x02840080,
        0xbd000ff6,
-        0xc1008004,
+/* 0x0721: ctx_mem_wait */
-        0x0002f602,
+        0x84008f04,
-        0x008004bd,
+        0x00ffcf02,
-        0x02f60283,
+        0xf405fffd,
-        0x0f04bd00,
+        0x00f8f61b,
-        0x06d27e07,
+/* 0x0730: ctx_load */
-        0xc0008000,
+        0x99f094bd,
-        0x0002f602,
+        0x37008005,
-        0x0bfe04bd,
+        0x0009f602,
-        0x1f2af000,
+        0x0c0a04bd,
-        0xb60424b6,
+        0x0000b87e,
-        0x94bd0220,
+        0x0080f4bd,
-        0x800899f0,
+        0x0ff60289,
-        0xf6023700,
+        0x8004bd00,
-        0x04bd0009,
+        0xf602c100,
-        0x02810080,
+        0x04bd0002,
-        0xbd0002f6,
+        0x02830080,
-        0x0000d204,
-        0x25f08000,
-        0x88008002,
-        0x0002f602,
-        0x100104bd,
-        0xf0020042,
-        0x12fa0223,
-        0xbd03f805,
-        0x0899f094,
-        0x02170080,
-        0xbd0009f6,
-        0x81019804,
-        0x981814b6,
-        0x25b68002,
-        0x0512fd08,
-        0xbd1601b5,
-        0x0999f094,
-        0x02370080,
-        0xbd0009f6,
-        0x81008004,
-        0x0001f602,
-        0x010204bd,
-        0x02880080,
        0xbd0002f6,
-        0x01004104,
+        0x7e070f04,
-        0xfa0613f0,
+        0x80000718,
-        0x03f80501,
+        0xf602c000,
+        0x04bd0002,
+        0xf0000bfe,
+        0x24b61f2a,
+        0x0220b604,
        0x99f094bd,
-        0x17008009,
+        0x37008008,
        0x0009f602,
-        0x94bd04bd,
+        0x008004bd,
-        0x800599f0,
+        0x02f60281,
+        0xd204bd00,
+        0x80000000,
+        0x800225f0,
+        0xf6028800,
+        0x04bd0002,
+        0x00421001,
+        0x0223f002,
+        0xf80512fa,
+        0xf094bd03,
+        0x00800899,
+        0x09f60217,
+        0x9804bd00,
+        0x14b68101,
+        0x80029818,
+        0xfd0825b6,
+        0x01b50512,
+        0xf094bd16,
+        0x00800999,
+        0x09f60237,
+        0x8004bd00,
+        0xf6028100,
+        0x04bd0001,
+        0x00800102,
+        0x02f60288,
+        0x4104bd00,
+        0x13f00100,
+        0x0501fa06,
+        0x94bd03f8,
+        0x800999f0,
        0xf6021700,
        0x04bd0009,
-/* 0x07d6: ctx_chan */
+        0x99f094bd,
-        0xea7e00f8,
+        0x17008005,
-        0x0c0a0006,
+        0x0009f602,
-        0x0000b87e,
+        0x00f804bd,
-        0xd27e050f,
+/* 0x081c: ctx_chan */
-        0x00f80006,
+        0x0007307e,
-/* 0x07e8: ctx_mmio_exec */
+        0xb87e0c0a,
-        0x80410398,
+        0x050f0000,
+        0x0007187e,
+/* 0x082e: ctx_mmio_exec */
+        0x039800f8,
+        0x81008041,
+        0x0003f602,
+        0x34bd04bd,
+/* 0x083c: ctx_mmio_loop */
+        0xf4ff34c4,
+        0x00450e1b,
+        0x0653f002,
+        0xf80535fa,
+/* 0x084d: ctx_mmio_pull */
+        0x804e9803,
+        0x7e814f98,
+        0xb600008f,
+        0x12b60830,
+        0xdf1bf401,
+/* 0x0860: ctx_mmio_done */
+        0x80160398,
        0xf6028100,
        0x04bd0003,
-/* 0x07f6: ctx_mmio_loop */
+        0x414000b5,
-        0x34c434bd,
+        0x13f00100,
-        0x0e1bf4ff,
+        0x0601fa06,
-        0xf0020045,
+        0x00f803f8,
-        0x35fa0653,
+/* 0x087c: ctx_xfer */
-/* 0x0807: ctx_mmio_pull */
+        0x0080040e,
-        0x9803f805,
+        0x0ef60302,
-        0x4f98804e,
+/* 0x0887: ctx_xfer_idle */
-        0x008f7e81,
+        0x8e04bd00,
-        0x0830b600,
+        0xcf030000,
-        0xf40112b6,
+        0xe4f100ee,
-/* 0x081a: ctx_mmio_done */
+        0x1bf42000,
-        0x0398df1b,
+        0x0611f4f5,
-        0x81008016,
+/* 0x089b: ctx_xfer_pre */
-        0x0003f602,
+        0x0f0c02f4,
-        0x00b504bd,
+        0x06f97e10,
-        0x01004140,
+        0x1b11f400,
-        0xfa0613f0,
+/* 0x08a4: ctx_xfer_pre_load */
-        0x03f80601,
+        0xa87e020f,
-/* 0x0836: ctx_xfer */
+        0xb77e0006,
-        0x040e00f8,
+        0xc97e0006,
-        0x03020080,
+        0xf4bd0006,
-        0xbd000ef6,
+        0x0006a87e,
-/* 0x0841: ctx_xfer_idle */
+        0x0007307e,
-        0x00008e04,
+/* 0x08bc: ctx_xfer_exec */
-        0x00eecf03,
+        0xbd160198,
-        0x2000e4f1,
+        0x05008024,
-        0xf4f51bf4,
+        0x0002f601,
-        0x02f40611,
+        0x1fb204bd,
-/* 0x0855: ctx_xfer_pre */
+        0x41a5008e,
-        0x7e100f0c,
-        0xf40006b3,
-/* 0x085e: ctx_xfer_pre_load */
-        0x020f1b11,
-        0x0006627e,
-        0x0006717e,
-        0x0006837e,
-        0x627ef4bd,
-        0xea7e0006,
-/* 0x0876: ctx_xfer_exec */
-        0x01980006,
-        0x8024bd16,
-        0xf6010500,
-        0x04bd0002,
-        0x008e1fb2,
-        0x8f7e41a5,
-        0xfcf00000,
-        0x022cf001,
-        0xfd0124b6,
-        0xffb205f2,
-        0x41a5048e,
        0x00008f7e,
-        0x0002167e,
+        0xf001fcf0,
-        0xfc8024bd,
+        0x24b6022c,
-        0x02f60247,
+        0x05f2fd01,
-        0xf004bd00,
+        0x048effb2,
-        0x20b6012c,
+        0x8f7e41a5,
-        0x4afc8003,
+        0x167e0000,
-        0x0002f602,
+        0x24bd0002,
-        0xacf004bd,
+        0x0247fc80,
-        0x06a5f001,
+        0xbd0002f6,
-        0x0c98000b,
+        0x012cf004,
-        0x010d9800,
+        0x800320b6,
-        0x3d7e000e,
+        0xf6024afc,
-        0x080a0001,
+        0x04bd0002,
-        0x0000ec7e,
+        0xf001acf0,
-        0x00020a7e,
+        0x000b06a5,
-        0x0a1201f4,
+        0x98000c98,
-        0x00b87e0c,
+        0x000e010d,
-        0x7e050f00,
+        0x00013d7e,
-        0xf40006d2,
+        0xec7e080a,
-/* 0x08f2: ctx_xfer_post */
+        0x0a7e0000,
-        0x020f2d02,
+        0x01f40002,
-        0x0006627e,
+        0x7e0c0a12,
-        0xb37ef4bd,
+        0x0f0000b8,
-        0x277e0006,
+        0x07187e05,
-        0x717e0002,
+        0x2d02f400,
+/* 0x0938: ctx_xfer_post */
+        0xa87e020f,
        0xf4bd0006,
-        0x0006627e,
+        0x0006f97e,
-        0x981011f4,
+        0x0002277e,
-        0x11fd4001,
+        0x0006b77e,
-        0x070bf405,
+        0xa87ef4bd,
-        0x0007e87e,
+        0x11f40006,
-/* 0x091c: ctx_xfer_no_post_mmio */
+        0x40019810,
-/* 0x091c: ctx_xfer_done */
+        0xf40511fd,
-        0x000000f8,
+        0x2e7e070b,
-        0x00000000,
+/* 0x0962: ctx_xfer_no_post_mmio */
-        0x00000000,
+/* 0x0962: ctx_xfer_done */
-        0x00000000,
+        0x00f80008,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
-        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvc0.fuc.h b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvc0.fuc.h
index f8f7b278a13f..92dfe6a4ac87 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvc0.fuc.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvc0.fuc.h
@@ -528,10 +528,10 @@ uint32_t nvc0_grhub_code[] = {
        0x0001d001,
        0x17f104bd,
        0xf7f00100,
-        0xb521f502,
+        0x0d21f502,
-        0xc721f507,
+        0x1f21f508,
-        0x10f7f007,
+        0x10f7f008,
-        0x081421f5,
+        0x086c21f5,
        0x98000e98,
        0x21f5010f,
        0x14950150,
@@ -574,9 +574,9 @@ uint32_t nvc0_grhub_code[] = {
        0xb6800040,
        0x1bf40132,
        0x00f7f0be,
-        0x081421f5,
+        0x086c21f5,
        0xf500f7f0,
-        0xf107b521,
+        0xf1080d21,
        0xf0010007,
        0x01d00203,
        0xbd04bd00,
@@ -610,8 +610,8 @@ uint32_t nvc0_grhub_code[] = {
        0x09d00203,
        0xf404bd00,
        0x31f40132,
-        0xe821f502,
+        0x4021f502,
-        0xf094bd09,
+        0xf094bd0a,
        0x07f10799,
        0x03f01700,
        0x0009d002,
@@ -621,7 +621,7 @@ uint32_t nvc0_grhub_code[] = {
        0x0203f00f,
        0xbd0009d0,
        0x0131f404,
-        0x09e821f5,
+        0x0a4021f5,
        0x99f094bd,
        0x0007f106,
        0x0203f017,
@@ -631,7 +631,7 @@ uint32_t nvc0_grhub_code[] = {
        0x12b920f9,
        0x0132f402,
        0xf50232f4,
-        0xfc09e821,
+        0xfc0a4021,
        0x0007f120,
        0x0203f0c0,
        0xbd0002d0,
@@ -640,7 +640,7 @@ uint32_t nvc0_grhub_code[] = {
        0xf41f23c8,
        0x31f40d0b,
        0x0232f401,
-        0x09e821f5,
+        0x0a4021f5,
 /* 0x063c: chsw_done */
        0xf10127f0,
        0xf0c30007,
@@ -654,7 +654,7 @@ uint32_t nvc0_grhub_code[] = {
 /* 0x0660: main_not_ctx_switch */
        0xf401e4b0,
        0xf2b90d1b,
-        0x7821f502,
+        0xd021f502,
        0x460ef409,
 /* 0x0670: main_not_ctx_chan */
        0xf402e4b0,
@@ -664,8 +664,8 @@ uint32_t nvc0_grhub_code[] = {
        0x09d00203,
        0xf404bd00,
        0x32f40132,
-        0xe821f502,
+        0x4021f502,
-        0xf094bd09,
+        0xf094bd0a,
        0x07f10799,
        0x03f01700,
        0x0009d002,
@@ -710,18 +710,40 @@ uint32_t nvc0_grhub_code[] = {
 /* 0x072b: ih_no_ctxsw */
        0xe40421f4,
        0xf40400ab,
-        0xb7f1140b,
+        0xe7f16c0b,
+        0xe3f00708,
+        0x6821f440,
+        0xf102ffb9,
+        0xf0040007,
+        0x0fd00203,
+        0xf104bd00,
+        0xf00704e7,
+        0x21f440e3,
+        0x02ffb968,
+        0x030007f1,
+        0xd00203f0,
+        0x04bd000f,
+        0x9450fec7,
+        0xf7f102ee,
+        0xf3f00700,
+        0x00efbb40,
+        0xf16821f4,
+        0xf0020007,
+        0x0fd00203,
+        0xf004bd00,
+        0x21f503f7,
+        0xb7f1037e,
        0xbfb90100,
        0x44e7f102,
        0x40e3f001,
-/* 0x0743: ih_no_fwmthd */
+/* 0x079b: ih_no_fwmthd */
        0xf19d21f4,
-        0xbd0104b7,
+        0xbd0504b7,
        0xb4abffb0,
        0xf10f0bf4,
        0xf0070007,
        0x0bd00303,
-/* 0x075b: ih_no_other */
+/* 0x07b3: ih_no_other */
        0xf104bd00,
        0xf0010007,
        0x0ad00003,
@@ -731,36 +753,36 @@ uint32_t nvc0_grhub_code[] = {
        0xfc90fca0,
        0x0088fe80,
        0x32f480fc,
-/* 0x077f: ctx_4160s */
+/* 0x07d7: ctx_4160s */
        0xf001f800,
        0xffb901f7,
        0x60e7f102,
        0x40e3f041,
-/* 0x078f: ctx_4160s_wait */
+/* 0x07e7: ctx_4160s_wait */
        0xf19d21f4,
        0xf04160e7,
        0x21f440e3,
        0x02ffb968,
        0xf404ffc8,
        0x00f8f00b,
-/* 0x07a4: ctx_4160c */
+/* 0x07fc: ctx_4160c */
        0xffb9f4bd,
        0x60e7f102,
        0x40e3f041,
        0xf89d21f4,
-/* 0x07b5: ctx_4170s */
+/* 0x080d: ctx_4170s */
        0x10f5f000,
        0xf102ffb9,
        0xf04170e7,
        0x21f440e3,
-/* 0x07c7: ctx_4170w */
+/* 0x081f: ctx_4170w */
        0xf100f89d,
        0xf04170e7,
        0x21f440e3,
        0x02ffb968,
        0xf410f4f0,
        0x00f8f01b,
-/* 0x07dc: ctx_redswitch */
+/* 0x0834: ctx_redswitch */
        0x0200e7f1,
        0xf040e5f0,
        0xe5f020e5,
@@ -768,7 +790,7 @@ uint32_t nvc0_grhub_code[] = {
        0x0103f085,
        0xbd000ed0,
        0x08f7f004,
-/* 0x07f8: ctx_redswitch_delay */
+/* 0x0850: ctx_redswitch_delay */
        0xf401f2b6,
        0xe5f1fd1b,
        0xe5f10400,
@@ -776,7 +798,7 @@ uint32_t nvc0_grhub_code[] = {
        0x03f08500,
        0x000ed001,
        0x00f804bd,
-/* 0x0814: ctx_86c */
+/* 0x086c: ctx_86c */
        0x1b0007f1,
        0xd00203f0,
        0x04bd000f,
@@ -787,16 +809,16 @@ uint32_t nvc0_grhub_code[] = {
        0xa86ce7f1,
        0xf441e3f0,
        0x00f89d21,
-/* 0x083c: ctx_mem */
+/* 0x0894: ctx_mem */
        0x840007f1,
        0xd00203f0,
        0x04bd000f,
-/* 0x0848: ctx_mem_wait */
+/* 0x08a0: ctx_mem_wait */
        0x8400f7f1,
        0xcf02f3f0,
        0xfffd00ff,
        0xf31bf405,
-/* 0x085a: ctx_load */
+/* 0x08b2: ctx_load */
        0x94bd00f8,
        0xf10599f0,
        0xf00f0007,
@@ -814,7 +836,7 @@ uint32_t nvc0_grhub_code[] = {
        0x02d00203,
        0xf004bd00,
        0x21f507f7,
-        0x07f1083c,
+        0x07f10894,
        0x03f0c000,
        0x0002d002,
        0x0bfe04bd,
@@ -869,31 +891,31 @@ uint32_t nvc0_grhub_code[] = {
        0x03f01700,
        0x0009d002,
        0x00f804bd,
-/* 0x0978: ctx_chan */
+/* 0x09d0: ctx_chan */
-        0x077f21f5,
+        0x07d721f5,
-        0x085a21f5,
+        0x08b221f5,
        0xf40ca7f0,
        0xf7f0d021,
-        0x3c21f505,
+        0x9421f505,
-        0xa421f508,
+        0xfc21f508,
-/* 0x0993: ctx_mmio_exec */
+/* 0x09eb: ctx_mmio_exec */
        0x9800f807,
        0x07f14103,
        0x03f08100,
        0x0003d002,
        0x34bd04bd,
-/* 0x09a4: ctx_mmio_loop */
+/* 0x09fc: ctx_mmio_loop */
        0xf4ff34c4,
        0x57f10f1b,
        0x53f00200,
        0x0535fa06,
-/* 0x09b6: ctx_mmio_pull */
+/* 0x0a0e: ctx_mmio_pull */
        0x4e9803f8,
        0x814f9880,
        0xb69d21f4,
        0x12b60830,
        0xdf1bf401,
-/* 0x09c8: ctx_mmio_done */
+/* 0x0a20: ctx_mmio_done */
        0xf1160398,
        0xf0810007,
        0x03d00203,
@@ -902,30 +924,30 @@ uint32_t nvc0_grhub_code[] = {
        0x13f00100,
        0x0601fa06,
        0x00f803f8,
-/* 0x09e8: ctx_xfer */
+/* 0x0a40: ctx_xfer */
        0xf104e7f0,
        0xf0020007,
        0x0ed00303,
-/* 0x09f7: ctx_xfer_idle */
+/* 0x0a4f: ctx_xfer_idle */
        0xf104bd00,
        0xf00000e7,
        0xeecf03e3,
        0x00e4f100,
        0xf21bf420,
        0xf40611f4,
-/* 0x0a0e: ctx_xfer_pre */
+/* 0x0a66: ctx_xfer_pre */
        0xf7f01102,
-        0x1421f510,
+        0x6c21f510,
-        0x7f21f508,
+        0xd721f508,
        0x1c11f407,
-/* 0x0a1c: ctx_xfer_pre_load */
+/* 0x0a74: ctx_xfer_pre_load */
        0xf502f7f0,
-        0xf507b521,
+        0xf5080d21,
-        0xf507c721,
+        0xf5081f21,
-        0xbd07dc21,
+        0xbd083421,
-        0xb521f5f4,
+        0x0d21f5f4,
-        0x5a21f507,
+        0xb221f508,
-/* 0x0a35: ctx_xfer_exec */
+/* 0x0a8d: ctx_xfer_exec */
        0x16019808,
        0x07f124bd,
        0x03f00500,
@@ -960,23 +982,65 @@ uint32_t nvc0_grhub_code[] = {
        0x1301f402,
        0xf40ca7f0,
        0xf7f0d021,
-        0x3c21f505,
+        0x9421f505,
        0x3202f408,
-/* 0x0ac4: ctx_xfer_post */
+/* 0x0b1c: ctx_xfer_post */
        0xf502f7f0,
-        0xbd07b521,
+        0xbd080d21,
-        0x1421f5f4,
+        0x6c21f5f4,
        0x7f21f508,
-        0xc721f502,
+        0x1f21f502,
-        0xf5f4bd07,
+        0xf5f4bd08,
-        0xf407b521,
+        0xf4080d21,
        0x01981011,
        0x0511fd40,
        0xf5070bf4,
-/* 0x0aef: ctx_xfer_no_post_mmio */
+/* 0x0b47: ctx_xfer_no_post_mmio */
-        0xf5099321,
+        0xf509eb21,
-/* 0x0af3: ctx_xfer_done */
+/* 0x0b4b: ctx_xfer_done */
-        0xf807a421,
+        0xf807fc21,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvd7.fuc.h b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvd7.fuc.h
index 624215a005b0..62b0c7601d8b 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvd7.fuc.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvd7.fuc.h
@@ -528,10 +528,10 @@ uint32_t nvd7_grhub_code[] = {
        0x0001d001,
        0x17f104bd,
        0xf7f00100,
-        0xb521f502,
+        0x0d21f502,
-        0xc721f507,
+        0x1f21f508,
-        0x10f7f007,
+        0x10f7f008,
-        0x081421f5,
+        0x086c21f5,
        0x98000e98,
        0x21f5010f,
        0x14950150,
@@ -574,9 +574,9 @@ uint32_t nvd7_grhub_code[] = {
        0xb6800040,
        0x1bf40132,
        0x00f7f0be,
-        0x081421f5,
+        0x086c21f5,
        0xf500f7f0,
-        0xf107b521,
+        0xf1080d21,
        0xf0010007,
        0x01d00203,
        0xbd04bd00,
@@ -610,8 +610,8 @@ uint32_t nvd7_grhub_code[] = {
        0x09d00203,
        0xf404bd00,
        0x31f40132,
-        0xe821f502,
+        0x4021f502,
-        0xf094bd09,
+        0xf094bd0a,
        0x07f10799,
        0x03f01700,
        0x0009d002,
@@ -621,7 +621,7 @@ uint32_t nvd7_grhub_code[] = {
        0x0203f00f,
        0xbd0009d0,
        0x0131f404,
-        0x09e821f5,
+        0x0a4021f5,
        0x99f094bd,
        0x0007f106,
        0x0203f017,
@@ -631,7 +631,7 @@ uint32_t nvd7_grhub_code[] = {
        0x12b920f9,
        0x0132f402,
        0xf50232f4,
-        0xfc09e821,
+        0xfc0a4021,
        0x0007f120,
        0x0203f0c0,
        0xbd0002d0,
@@ -640,7 +640,7 @@ uint32_t nvd7_grhub_code[] = {
        0xf41f23c8,
        0x31f40d0b,
        0x0232f401,
-        0x09e821f5,
+        0x0a4021f5,
 /* 0x063c: chsw_done */
        0xf10127f0,
        0xf0c30007,
@@ -654,7 +654,7 @@ uint32_t nvd7_grhub_code[] = {
 /* 0x0660: main_not_ctx_switch */
        0xf401e4b0,
        0xf2b90d1b,
-        0x7821f502,
+        0xd021f502,
        0x460ef409,
 /* 0x0670: main_not_ctx_chan */
        0xf402e4b0,
@@ -664,8 +664,8 @@ uint32_t nvd7_grhub_code[] = {
        0x09d00203,
        0xf404bd00,
        0x32f40132,
-        0xe821f502,
+        0x4021f502,
-        0xf094bd09,
+        0xf094bd0a,
        0x07f10799,
        0x03f01700,
        0x0009d002,
@@ -710,18 +710,40 @@ uint32_t nvd7_grhub_code[] = {
 /* 0x072b: ih_no_ctxsw */
        0xe40421f4,
        0xf40400ab,
-        0xb7f1140b,
+        0xe7f16c0b,
+        0xe3f00708,
+        0x6821f440,
+        0xf102ffb9,
+        0xf0040007,
+        0x0fd00203,
+        0xf104bd00,
+        0xf00704e7,
+        0x21f440e3,
+        0x02ffb968,
+        0x030007f1,
+        0xd00203f0,
+        0x04bd000f,
+        0x9450fec7,
+        0xf7f102ee,
+        0xf3f00700,
+        0x00efbb40,
+        0xf16821f4,
+        0xf0020007,
+        0x0fd00203,
+        0xf004bd00,
+        0x21f503f7,
+        0xb7f1037e,
        0xbfb90100,
        0x44e7f102,
        0x40e3f001,
-/* 0x0743: ih_no_fwmthd */
+/* 0x079b: ih_no_fwmthd */
        0xf19d21f4,
-        0xbd0104b7,
+        0xbd0504b7,
        0xb4abffb0,
        0xf10f0bf4,
        0xf0070007,
        0x0bd00303,
-/* 0x075b: ih_no_other */
+/* 0x07b3: ih_no_other */
        0xf104bd00,
        0xf0010007,
        0x0ad00003,
@@ -731,36 +753,36 @@ uint32_t nvd7_grhub_code[] = {
        0xfc90fca0,
        0x0088fe80,
        0x32f480fc,
-/* 0x077f: ctx_4160s */
+/* 0x07d7: ctx_4160s */
        0xf001f800,
        0xffb901f7,
        0x60e7f102,
        0x40e3f041,
-/* 0x078f: ctx_4160s_wait */
+/* 0x07e7: ctx_4160s_wait */
        0xf19d21f4,
        0xf04160e7,
        0x21f440e3,
        0x02ffb968,
        0xf404ffc8,
        0x00f8f00b,
-/* 0x07a4: ctx_4160c */
+/* 0x07fc: ctx_4160c */
        0xffb9f4bd,
        0x60e7f102,
        0x40e3f041,
        0xf89d21f4,
-/* 0x07b5: ctx_4170s */
+/* 0x080d: ctx_4170s */
        0x10f5f000,
        0xf102ffb9,
        0xf04170e7,
        0x21f440e3,
-/* 0x07c7: ctx_4170w */
+/* 0x081f: ctx_4170w */
        0xf100f89d,
        0xf04170e7,
        0x21f440e3,
        0x02ffb968,
        0xf410f4f0,
        0x00f8f01b,
-/* 0x07dc: ctx_redswitch */
+/* 0x0834: ctx_redswitch */
        0x0200e7f1,
        0xf040e5f0,
        0xe5f020e5,
@@ -768,7 +790,7 @@ uint32_t nvd7_grhub_code[] = {
        0x0103f085,
        0xbd000ed0,
        0x08f7f004,
-/* 0x07f8: ctx_redswitch_delay */
+/* 0x0850: ctx_redswitch_delay */
        0xf401f2b6,
        0xe5f1fd1b,
        0xe5f10400,
@@ -776,7 +798,7 @@ uint32_t nvd7_grhub_code[] = {
        0x03f08500,
        0x000ed001,
        0x00f804bd,
-/* 0x0814: ctx_86c */
+/* 0x086c: ctx_86c */
        0x1b0007f1,
        0xd00203f0,
        0x04bd000f,
@@ -787,16 +809,16 @@ uint32_t nvd7_grhub_code[] = {
        0xa86ce7f1,
        0xf441e3f0,
        0x00f89d21,
-/* 0x083c: ctx_mem */
+/* 0x0894: ctx_mem */
        0x840007f1,
        0xd00203f0,
        0x04bd000f,
-/* 0x0848: ctx_mem_wait */
+/* 0x08a0: ctx_mem_wait */
        0x8400f7f1,
        0xcf02f3f0,
        0xfffd00ff,
        0xf31bf405,
-/* 0x085a: ctx_load */
+/* 0x08b2: ctx_load */
        0x94bd00f8,
        0xf10599f0,
        0xf00f0007,
@@ -814,7 +836,7 @@ uint32_t nvd7_grhub_code[] = {
        0x02d00203,
        0xf004bd00,
        0x21f507f7,
-        0x07f1083c,
+        0x07f10894,
        0x03f0c000,
        0x0002d002,
        0x0bfe04bd,
@@ -869,31 +891,31 @@ uint32_t nvd7_grhub_code[] = {
        0x03f01700,
        0x0009d002,
        0x00f804bd,
-/* 0x0978: ctx_chan */
+/* 0x09d0: ctx_chan */
-        0x077f21f5,
+        0x07d721f5,
-        0x085a21f5,
+        0x08b221f5,
        0xf40ca7f0,
        0xf7f0d021,
-        0x3c21f505,
+        0x9421f505,
-        0xa421f508,
+        0xfc21f508,
-/* 0x0993: ctx_mmio_exec */
+/* 0x09eb: ctx_mmio_exec */
        0x9800f807,
        0x07f14103,
        0x03f08100,
        0x0003d002,
        0x34bd04bd,
-/* 0x09a4: ctx_mmio_loop */
+/* 0x09fc: ctx_mmio_loop */
        0xf4ff34c4,
        0x57f10f1b,
        0x53f00200,
        0x0535fa06,
-/* 0x09b6: ctx_mmio_pull */
+/* 0x0a0e: ctx_mmio_pull */
        0x4e9803f8,
        0x814f9880,
        0xb69d21f4,
        0x12b60830,
        0xdf1bf401,
-/* 0x09c8: ctx_mmio_done */
+/* 0x0a20: ctx_mmio_done */
        0xf1160398,
        0xf0810007,
        0x03d00203,
@@ -902,30 +924,30 @@ uint32_t nvd7_grhub_code[] = {
        0x13f00100,
        0x0601fa06,
        0x00f803f8,
-/* 0x09e8: ctx_xfer */
+/* 0x0a40: ctx_xfer */
        0xf104e7f0,
        0xf0020007,
        0x0ed00303,
-/* 0x09f7: ctx_xfer_idle */
+/* 0x0a4f: ctx_xfer_idle */
        0xf104bd00,
        0xf00000e7,
        0xeecf03e3,
        0x00e4f100,
        0xf21bf420,
        0xf40611f4,
-/* 0x0a0e: ctx_xfer_pre */
+/* 0x0a66: ctx_xfer_pre */
        0xf7f01102,
-        0x1421f510,
+        0x6c21f510,
-        0x7f21f508,
+        0xd721f508,
        0x1c11f407,
-/* 0x0a1c: ctx_xfer_pre_load */
+/* 0x0a74: ctx_xfer_pre_load */
        0xf502f7f0,
-        0xf507b521,
+        0xf5080d21,
-        0xf507c721,
+        0xf5081f21,
-        0xbd07dc21,
+        0xbd083421,
-        0xb521f5f4,
+        0x0d21f5f4,
-        0x5a21f507,
+        0xb221f508,
-/* 0x0a35: ctx_xfer_exec */
+/* 0x0a8d: ctx_xfer_exec */
        0x16019808,
        0x07f124bd,
        0x03f00500,
@@ -960,23 +982,65 @@ uint32_t nvd7_grhub_code[] = {
        0x1301f402,
        0xf40ca7f0,
        0xf7f0d021,
-        0x3c21f505,
+        0x9421f505,
        0x3202f408,
-/* 0x0ac4: ctx_xfer_post */
+/* 0x0b1c: ctx_xfer_post */
        0xf502f7f0,
-        0xbd07b521,
+        0xbd080d21,
-        0x1421f5f4,
+        0x6c21f5f4,
        0x7f21f508,
-        0xc721f502,
+        0x1f21f502,
-        0xf5f4bd07,
+        0xf5f4bd08,
-        0xf407b521,
+        0xf4080d21,
        0x01981011,
        0x0511fd40,
        0xf5070bf4,
-/* 0x0aef: ctx_xfer_no_post_mmio */
+/* 0x0b47: ctx_xfer_no_post_mmio */
-        0xf5099321,
+        0xf509eb21,
-/* 0x0af3: ctx_xfer_done */
+/* 0x0b4b: ctx_xfer_done */
-        0xf807a421,
+        0xf807fc21,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnve0.fuc.h b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnve0.fuc.h
index 6547b3dfc7ed..51c3797d8537 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnve0.fuc.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnve0.fuc.h
@@ -528,10 +528,10 @@ uint32_t nve0_grhub_code[] = {
        0x0001d001,
        0x17f104bd,
        0xf7f00100,
-        0x7f21f502,
+        0xd721f502,
-        0x9121f507,
+        0xe921f507,
        0x10f7f007,
-        0x07de21f5,
+        0x083621f5,
        0x98000e98,
        0x21f5010f,
        0x14950150,
@@ -574,9 +574,9 @@ uint32_t nve0_grhub_code[] = {
        0xb6800040,
        0x1bf40132,
        0x00f7f0be,
-        0x07de21f5,
+        0x083621f5,
        0xf500f7f0,
-        0xf1077f21,
+        0xf107d721,
        0xf0010007,
        0x01d00203,
        0xbd04bd00,
@@ -610,8 +610,8 @@ uint32_t nve0_grhub_code[] = {
        0x09d00203,
        0xf404bd00,
        0x31f40132,
-        0xaa21f502,
+        0x0221f502,
-        0xf094bd09,
+        0xf094bd0a,
        0x07f10799,
        0x03f01700,
        0x0009d002,
@@ -621,7 +621,7 @@ uint32_t nve0_grhub_code[] = {
        0x0203f00f,
        0xbd0009d0,
        0x0131f404,
-        0x09aa21f5,
+        0x0a0221f5,
        0x99f094bd,
        0x0007f106,
        0x0203f017,
@@ -631,7 +631,7 @@ uint32_t nve0_grhub_code[] = {
        0x12b920f9,
        0x0132f402,
        0xf50232f4,
-        0xfc09aa21,
+        0xfc0a0221,
        0x0007f120,
        0x0203f0c0,
        0xbd0002d0,
@@ -640,7 +640,7 @@ uint32_t nve0_grhub_code[] = {
        0xf41f23c8,
        0x31f40d0b,
        0x0232f401,
-        0x09aa21f5,
+        0x0a0221f5,
 /* 0x063c: chsw_done */
        0xf10127f0,
        0xf0c30007,
@@ -654,7 +654,7 @@ uint32_t nve0_grhub_code[] = {
 /* 0x0660: main_not_ctx_switch */
        0xf401e4b0,
        0xf2b90d1b,
-        0x4221f502,
+        0x9a21f502,
        0x460ef409,
 /* 0x0670: main_not_ctx_chan */
        0xf402e4b0,
@@ -664,8 +664,8 @@ uint32_t nve0_grhub_code[] = {
        0x09d00203,
        0xf404bd00,
        0x32f40132,
-        0xaa21f502,
+        0x0221f502,
-        0xf094bd09,
+        0xf094bd0a,
        0x07f10799,
        0x03f01700,
        0x0009d002,
@@ -710,18 +710,40 @@ uint32_t nve0_grhub_code[] = {
 /* 0x072b: ih_no_ctxsw */
        0xe40421f4,
        0xf40400ab,
-        0xb7f1140b,
+        0xe7f16c0b,
+        0xe3f00708,
+        0x6821f440,
+        0xf102ffb9,
+        0xf0040007,
+        0x0fd00203,
+        0xf104bd00,
+        0xf00704e7,
+        0x21f440e3,
+        0x02ffb968,
+        0x030007f1,
+        0xd00203f0,
+        0x04bd000f,
+        0x9450fec7,
+        0xf7f102ee,
+        0xf3f00700,
+        0x00efbb40,
+        0xf16821f4,
+        0xf0020007,
+        0x0fd00203,
+        0xf004bd00,
+        0x21f503f7,
+        0xb7f1037e,
        0xbfb90100,
        0x44e7f102,
        0x40e3f001,
-/* 0x0743: ih_no_fwmthd */
+/* 0x079b: ih_no_fwmthd */
        0xf19d21f4,
-        0xbd0104b7,
+        0xbd0504b7,
        0xb4abffb0,
        0xf10f0bf4,
        0xf0070007,
        0x0bd00303,
-/* 0x075b: ih_no_other */
+/* 0x07b3: ih_no_other */
        0xf104bd00,
        0xf0010007,
        0x0ad00003,
@@ -731,19 +753,19 @@ uint32_t nve0_grhub_code[] = {
        0xfc90fca0,
        0x0088fe80,
        0x32f480fc,
-/* 0x077f: ctx_4170s */
+/* 0x07d7: ctx_4170s */
        0xf001f800,
        0xffb910f5,
        0x70e7f102,
        0x40e3f041,
        0xf89d21f4,
-/* 0x0791: ctx_4170w */
+/* 0x07e9: ctx_4170w */
        0x70e7f100,
        0x40e3f041,
        0xb96821f4,
        0xf4f002ff,
        0xf01bf410,
-/* 0x07a6: ctx_redswitch */
+/* 0x07fe: ctx_redswitch */
        0xe7f100f8,
        0xe5f00200,
        0x20e5f040,
@@ -751,7 +773,7 @@ uint32_t nve0_grhub_code[] = {
        0xf0850007,
        0x0ed00103,
        0xf004bd00,
-/* 0x07c2: ctx_redswitch_delay */
+/* 0x081a: ctx_redswitch_delay */
        0xf2b608f7,
        0xfd1bf401,
        0x0400e5f1,
@@ -759,7 +781,7 @@ uint32_t nve0_grhub_code[] = {
        0x850007f1,
        0xd00103f0,
        0x04bd000e,
-/* 0x07de: ctx_86c */
+/* 0x0836: ctx_86c */
        0x07f100f8,
        0x03f01b00,
        0x000fd002,
@@ -770,17 +792,17 @@ uint32_t nve0_grhub_code[] = {
        0xe7f102ff,
        0xe3f0a86c,
        0x9d21f441,
-/* 0x0806: ctx_mem */
+/* 0x085e: ctx_mem */
        0x07f100f8,
        0x03f08400,
        0x000fd002,
-/* 0x0812: ctx_mem_wait */
+/* 0x086a: ctx_mem_wait */
        0xf7f104bd,
        0xf3f08400,
        0x00ffcf02,
        0xf405fffd,
        0x00f8f31b,
-/* 0x0824: ctx_load */
+/* 0x087c: ctx_load */
        0x99f094bd,
        0x0007f105,
        0x0203f00f,
@@ -797,7 +819,7 @@ uint32_t nve0_grhub_code[] = {
        0x0203f083,
        0xbd0002d0,
        0x07f7f004,
-        0x080621f5,
+        0x085e21f5,
        0xc00007f1,
        0xd00203f0,
        0x04bd0002,
@@ -852,29 +874,29 @@ uint32_t nve0_grhub_code[] = {
        0x170007f1,
        0xd00203f0,
        0x04bd0009,
-/* 0x0942: ctx_chan */
+/* 0x099a: ctx_chan */
        0x21f500f8,
-        0xa7f00824,
+        0xa7f0087c,
        0xd021f40c,
        0xf505f7f0,
-        0xf8080621,
+        0xf8085e21,
-/* 0x0955: ctx_mmio_exec */
+/* 0x09ad: ctx_mmio_exec */
        0x41039800,
        0x810007f1,
        0xd00203f0,
        0x04bd0003,
-/* 0x0966: ctx_mmio_loop */
+/* 0x09be: ctx_mmio_loop */
        0x34c434bd,
        0x0f1bf4ff,
        0x020057f1,
        0xfa0653f0,
        0x03f80535,
-/* 0x0978: ctx_mmio_pull */
+/* 0x09d0: ctx_mmio_pull */
        0x98804e98,
        0x21f4814f,
        0x0830b69d,
        0xf40112b6,
-/* 0x098a: ctx_mmio_done */
+/* 0x09e2: ctx_mmio_done */
        0x0398df1b,
        0x0007f116,
        0x0203f081,
@@ -883,30 +905,30 @@ uint32_t nve0_grhub_code[] = {
        0x010017f1,
        0xfa0613f0,
        0x03f80601,
-/* 0x09aa: ctx_xfer */
+/* 0x0a02: ctx_xfer */
        0xe7f000f8,
        0x0007f104,
        0x0303f002,
        0xbd000ed0,
-/* 0x09b9: ctx_xfer_idle */
+/* 0x0a11: ctx_xfer_idle */
        0x00e7f104,
        0x03e3f000,
        0xf100eecf,
        0xf42000e4,
        0x11f4f21b,
        0x0d02f406,
-/* 0x09d0: ctx_xfer_pre */
+/* 0x0a28: ctx_xfer_pre */
        0xf510f7f0,
-        0xf407de21,
+        0xf4083621,
-/* 0x09da: ctx_xfer_pre_load */
+/* 0x0a32: ctx_xfer_pre_load */
        0xf7f01c11,
-        0x7f21f502,
+        0xd721f502,
-        0x9121f507,
+        0xe921f507,
-        0xa621f507,
+        0xfe21f507,
        0xf5f4bd07,
-        0xf5077f21,
+        0xf507d721,
-/* 0x09f3: ctx_xfer_exec */
+/* 0x0a4b: ctx_xfer_exec */
-        0x98082421,
+        0x98087c21,
        0x24bd1601,
        0x050007f1,
        0xd00103f0,
@@ -941,21 +963,21 @@ uint32_t nve0_grhub_code[] = {
        0xa7f01301,
        0xd021f40c,
        0xf505f7f0,
-        0xf4080621,
+        0xf4085e21,
-/* 0x0a82: ctx_xfer_post */
+/* 0x0ada: ctx_xfer_post */
        0xf7f02e02,
-        0x7f21f502,
+        0xd721f502,
        0xf5f4bd07,
-        0xf507de21,
+        0xf5083621,
        0xf5027f21,
-        0xbd079121,
+        0xbd07e921,
-        0x7f21f5f4,
+        0xd721f5f4,
        0x1011f407,
        0xfd400198,
        0x0bf40511,
-        0x5521f507,
+        0xad21f507,
-/* 0x0aad: ctx_xfer_no_post_mmio */
+/* 0x0b05: ctx_xfer_no_post_mmio */
-/* 0x0aad: ctx_xfer_done */
+/* 0x0b05: ctx_xfer_done */
        0x0000f809,
        0x00000000,
        0x00000000,
@@ -977,4 +999,46 @@ uint32_t nve0_grhub_code[] = {
        0x00000000,
        0x00000000,
        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
 };
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvf0.fuc.h b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvf0.fuc.h
index a5aee5a4302f..a0af4b703a8e 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvf0.fuc.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/hubnvf0.fuc.h
@@ -528,10 +528,10 @@ uint32_t nvf0_grhub_code[] = {
        0x0001d001,
        0x17f104bd,
        0xf7f00100,
-        0x7f21f502,
+        0xd721f502,
-        0x9121f507,
+        0xe921f507,
        0x10f7f007,
-        0x07de21f5,
+        0x083621f5,
        0x98000e98,
        0x21f5010f,
        0x14950150,
@@ -574,9 +574,9 @@ uint32_t nvf0_grhub_code[] = {
        0xb6800040,
        0x1bf40132,
        0x00f7f0be,
-        0x07de21f5,
+        0x083621f5,
        0xf500f7f0,
-        0xf1077f21,
+        0xf107d721,
        0xf0010007,
        0x01d00203,
        0xbd04bd00,
@@ -610,8 +610,8 @@ uint32_t nvf0_grhub_code[] = {
        0x09d00203,
        0xf404bd00,
        0x31f40132,
-        0xaa21f502,
+        0x0221f502,
-        0xf094bd09,
+        0xf094bd0a,
        0x07f10799,
        0x03f01700,
        0x0009d002,
@@ -621,7 +621,7 @@ uint32_t nvf0_grhub_code[] = {
        0x0203f037,
        0xbd0009d0,
        0x0131f404,
-        0x09aa21f5,
+        0x0a0221f5,
        0x99f094bd,
        0x0007f106,
        0x0203f017,
@@ -631,7 +631,7 @@ uint32_t nvf0_grhub_code[] = {
        0x12b920f9,
        0x0132f402,
        0xf50232f4,
-        0xfc09aa21,
+        0xfc0a0221,
        0x0007f120,
        0x0203f0c0,
        0xbd0002d0,
@@ -640,7 +640,7 @@ uint32_t nvf0_grhub_code[] = {
        0xf41f23c8,
        0x31f40d0b,
        0x0232f401,
-        0x09aa21f5,
+        0x0a0221f5,
 /* 0x063c: chsw_done */
        0xf10127f0,
        0xf0c30007,
@@ -654,7 +654,7 @@ uint32_t nvf0_grhub_code[] = {
 /* 0x0660: main_not_ctx_switch */
        0xf401e4b0,
        0xf2b90d1b,
-        0x4221f502,
+        0x9a21f502,
        0x460ef409,
 /* 0x0670: main_not_ctx_chan */
        0xf402e4b0,
@@ -664,8 +664,8 @@ uint32_t nvf0_grhub_code[] = {
        0x09d00203,
        0xf404bd00,
        0x32f40132,
-        0xaa21f502,
+        0x0221f502,
-        0xf094bd09,
+        0xf094bd0a,
        0x07f10799,
        0x03f01700,
        0x0009d002,
@@ -710,18 +710,40 @@ uint32_t nvf0_grhub_code[] = {
 /* 0x072b: ih_no_ctxsw */
        0xe40421f4,
        0xf40400ab,
-        0xb7f1140b,
+        0xe7f16c0b,
+        0xe3f00708,
+        0x6821f440,
+        0xf102ffb9,
+        0xf0040007,
+        0x0fd00203,
+        0xf104bd00,
+        0xf00704e7,
+        0x21f440e3,
+        0x02ffb968,
+        0x030007f1,
+        0xd00203f0,
+        0x04bd000f,
+        0x9450fec7,
+        0xf7f102ee,
+        0xf3f00700,
+        0x00efbb40,
+        0xf16821f4,
+        0xf0020007,
+        0x0fd00203,
+        0xf004bd00,
+        0x21f503f7,
+        0xb7f1037e,
        0xbfb90100,
        0x44e7f102,
        0x40e3f001,
-/* 0x0743: ih_no_fwmthd */
+/* 0x079b: ih_no_fwmthd */
        0xf19d21f4,
-        0xbd0104b7,
+        0xbd0504b7,
        0xb4abffb0,
        0xf10f0bf4,
        0xf0070007,
        0x0bd00303,
-/* 0x075b: ih_no_other */
+/* 0x07b3: ih_no_other */
        0xf104bd00,
        0xf0010007,
        0x0ad00003,
@@ -731,19 +753,19 @@ uint32_t nvf0_grhub_code[] = {
        0xfc90fca0,
        0x0088fe80,
        0x32f480fc,
-/* 0x077f: ctx_4170s */
+/* 0x07d7: ctx_4170s */
        0xf001f800,
        0xffb910f5,
        0x70e7f102,
        0x40e3f041,
        0xf89d21f4,
-/* 0x0791: ctx_4170w */
+/* 0x07e9: ctx_4170w */
        0x70e7f100,
        0x40e3f041,
        0xb96821f4,
        0xf4f002ff,
        0xf01bf410,
-/* 0x07a6: ctx_redswitch */
+/* 0x07fe: ctx_redswitch */
        0xe7f100f8,
        0xe5f00200,
        0x20e5f040,
@@ -751,7 +773,7 @@ uint32_t nvf0_grhub_code[] = {
        0xf0850007,
        0x0ed00103,
        0xf004bd00,
-/* 0x07c2: ctx_redswitch_delay */
+/* 0x081a: ctx_redswitch_delay */
        0xf2b608f7,
        0xfd1bf401,
        0x0400e5f1,
@@ -759,7 +781,7 @@ uint32_t nvf0_grhub_code[] = {
        0x850007f1,
        0xd00103f0,
        0x04bd000e,
-/* 0x07de: ctx_86c */
+/* 0x0836: ctx_86c */
        0x07f100f8,
        0x03f02300,
        0x000fd002,
@@ -770,17 +792,17 @@ uint32_t nvf0_grhub_code[] = {
        0xe7f102ff,
        0xe3f0a88c,
        0x9d21f441,
-/* 0x0806: ctx_mem */
+/* 0x085e: ctx_mem */
        0x07f100f8,
        0x03f08400,
        0x000fd002,
-/* 0x0812: ctx_mem_wait */
+/* 0x086a: ctx_mem_wait */
        0xf7f104bd,
        0xf3f08400,
        0x00ffcf02,
        0xf405fffd,
        0x00f8f31b,
-/* 0x0824: ctx_load */
+/* 0x087c: ctx_load */
        0x99f094bd,
        0x0007f105,
        0x0203f037,
@@ -797,7 +819,7 @@ uint32_t nvf0_grhub_code[] = {
        0x0203f083,
        0xbd0002d0,
        0x07f7f004,
-        0x080621f5,
+        0x085e21f5,
        0xc00007f1,
        0xd00203f0,
        0x04bd0002,
@@ -852,29 +874,29 @@ uint32_t nvf0_grhub_code[] = {
        0x170007f1,
        0xd00203f0,
        0x04bd0009,
-/* 0x0942: ctx_chan */
+/* 0x099a: ctx_chan */
        0x21f500f8,
-        0xa7f00824,
+        0xa7f0087c,
        0xd021f40c,
        0xf505f7f0,
-        0xf8080621,
+        0xf8085e21,
-/* 0x0955: ctx_mmio_exec */
+/* 0x09ad: ctx_mmio_exec */
        0x41039800,
        0x810007f1,
        0xd00203f0,
        0x04bd0003,
-/* 0x0966: ctx_mmio_loop */
+/* 0x09be: ctx_mmio_loop */
        0x34c434bd,
        0x0f1bf4ff,
        0x020057f1,
        0xfa0653f0,
        0x03f80535,
-/* 0x0978: ctx_mmio_pull */
+/* 0x09d0: ctx_mmio_pull */
        0x98804e98,
        0x21f4814f,
        0x0830b69d,
        0xf40112b6,
-/* 0x098a: ctx_mmio_done */
+/* 0x09e2: ctx_mmio_done */
        0x0398df1b,
        0x0007f116,
        0x0203f081,
@@ -883,30 +905,30 @@ uint32_t nvf0_grhub_code[] = {
        0x010017f1,
        0xfa0613f0,
        0x03f80601,
-/* 0x09aa: ctx_xfer */
+/* 0x0a02: ctx_xfer */
        0xe7f000f8,
        0x0007f104,
        0x0303f002,
        0xbd000ed0,
-/* 0x09b9: ctx_xfer_idle */
+/* 0x0a11: ctx_xfer_idle */
        0x00e7f104,
        0x03e3f000,
        0xf100eecf,
        0xf42000e4,
        0x11f4f21b,
        0x0d02f406,
-/* 0x09d0: ctx_xfer_pre */
+/* 0x0a28: ctx_xfer_pre */
        0xf510f7f0,
-        0xf407de21,
+        0xf4083621,
-/* 0x09da: ctx_xfer_pre_load */
+/* 0x0a32: ctx_xfer_pre_load */
        0xf7f01c11,
-        0x7f21f502,
+        0xd721f502,
-        0x9121f507,
+        0xe921f507,
-        0xa621f507,
+        0xfe21f507,
        0xf5f4bd07,
-        0xf5077f21,
+        0xf507d721,
-/* 0x09f3: ctx_xfer_exec */
+/* 0x0a4b: ctx_xfer_exec */
-        0x98082421,
+        0x98087c21,
        0x24bd1601,
        0x050007f1,
        0xd00103f0,
@@ -941,21 +963,21 @@ uint32_t nvf0_grhub_code[] = {
        0xa7f01301,
        0xd021f40c,
        0xf505f7f0,
-        0xf4080621,
+        0xf4085e21,
-/* 0x0a82: ctx_xfer_post */
+/* 0x0ada: ctx_xfer_post */
        0xf7f02e02,
-        0x7f21f502,
+        0xd721f502,
        0xf5f4bd07,
-        0xf507de21,
+        0xf5083621,
        0xf5027f21,
-        0xbd079121,
+        0xbd07e921,
-        0x7f21f5f4,
+        0xd721f5f4,
        0x1011f407,
        0xfd400198,
        0x0bf40511,
-        0x5521f507,
+        0xad21f507,
-/* 0x0aad: ctx_xfer_no_post_mmio */
+/* 0x0b05: ctx_xfer_no_post_mmio */
-/* 0x0aad: ctx_xfer_done */
+/* 0x0b05: ctx_xfer_done */
        0x0000f809,
        0x00000000,
        0x00000000,
@@ -977,4 +999,46 @@ uint32_t nvf0_grhub_code[] = {
        0x00000000,
        0x00000000,
        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
+        0x00000000,
 };
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/macros.fuc b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/macros.fuc
index a47d49db5232..2a0b0f844299 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/macros.fuc
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/macros.fuc
@@ -30,6 +30,12 @@
 #define GK110 0xf0
 #define GK208 0x108
+#define NV_PGRAPH_TRAPPED_ADDR                                         0x400704
+#define NV_PGRAPH_TRAPPED_DATA_LO                                      0x400708
+#define NV_PGRAPH_TRAPPED_DATA_HI                                      0x40070c
+#define NV_PGRAPH_FE_OBJECT_TABLE(n)                        ((n) * 4 + 0x400700)
 #define NV_PGRAPH_FECS_INTR_ACK                                        0x409004
 #define NV_PGRAPH_FECS_INTR                                            0x409008
 #define NV_PGRAPH_FECS_INTR_FWMTHD                                   0x00000400
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/os.h b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/os.h
index fd1d380de094..1718ae4e8224 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/fuc/os.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/fuc/os.h
@@ -3,5 +3,6 @@
 #define E_BAD_COMMAND  0x00000001
 #define E_CMD_OVERFLOW 0x00000002
+#define E_BAD_FWMTHD   0x00000003
 #endif
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c b/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
index 1a2d56493cf6..20665c21d80e 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nv50.c
@@ -976,7 +976,6 @@ nv50_graph_init(struct nouveau_object *object)
                break;
        case 0xa0:
        default:
-                nv_wr32(priv, 0x402cc0, 0x00000000);
                if (nv_device(priv)->chipset == 0xa0 ||
                    nv_device(priv)->chipset == 0xaa ||
                    nv_device(priv)->chipset == 0xac) {
@@ -991,10 +990,10 @@ nv50_graph_init(struct nouveau_object *object)
        /* zero out zcull regions */
        for (i = 0; i < 8; i++) {
-                nv_wr32(priv, 0x402c20 + (i * 8), 0x00000000);
+                nv_wr32(priv, 0x402c20 + (i * 0x10), 0x00000000);
-                nv_wr32(priv, 0x402c24 + (i * 8), 0x00000000);
+                nv_wr32(priv, 0x402c24 + (i * 0x10), 0x00000000);
-                nv_wr32(priv, 0x402c28 + (i * 8), 0x00000000);
+                nv_wr32(priv, 0x402c28 + (i * 0x10), 0x00000000);
-                nv_wr32(priv, 0x402c2c + (i * 8), 0x00000000);
+                nv_wr32(priv, 0x402c2c + (i * 0x10), 0x00000000);
        }
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
index bf7bdb1f291e..aa0838916354 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
@@ -789,17 +789,40 @@ nvc0_graph_ctxctl_debug(struct nvc0_graph_priv *priv)
 static void
 nvc0_graph_ctxctl_isr(struct nvc0_graph_priv *priv)
 {
-        u32 ustat = nv_rd32(priv, 0x409c18);
+        u32 stat = nv_rd32(priv, 0x409c18);
-        if (ustat & 0x00000001)
+        if (stat & 0x00000001) {
-                nv_error(priv, "CTXCTL ucode error\n");
+                u32 code = nv_rd32(priv, 0x409814);
-        if (ustat & 0x00080000)
+                if (code == E_BAD_FWMTHD) {
-                nv_error(priv, "CTXCTL watchdog timeout\n");
+                        u32 class = nv_rd32(priv, 0x409808);
-        if (ustat & ~0x00080001)
+                        u32  addr = nv_rd32(priv, 0x40980c);
-                nv_error(priv, "CTXCTL 0x%08x\n", ustat);
+                        u32  subc = (addr & 0x00070000) >> 16;
+                        u32  mthd = (addr & 0x00003ffc);
+                        u32  data = nv_rd32(priv, 0x409810);
+                        nv_error(priv, "FECS MTHD subc %d class 0x%04x "
+                                       "mthd 0x%04x data 0x%08x\n",
+                                 subc, class, mthd, data);
-        nvc0_graph_ctxctl_debug(priv);
+                        nv_wr32(priv, 0x409c20, 0x00000001);
-        nv_wr32(priv, 0x409c20, ustat);
+                        stat &= ~0x00000001;
+                } else {
+                        nv_error(priv, "FECS ucode error %d\n", code);
+                }
+        }
+        if (stat & 0x00080000) {
+                nv_error(priv, "FECS watchdog timeout\n");
+                nvc0_graph_ctxctl_debug(priv);
+                nv_wr32(priv, 0x409c20, 0x00080000);
+                stat &= ~0x00080000;
+        }
+        if (stat) {
+                nv_error(priv, "FECS 0x%08x\n", stat);
+                nvc0_graph_ctxctl_debug(priv);
+                nv_wr32(priv, 0x409c20, stat);
+        }
 }
 static void
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.h b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.h
index 75203a99d902..ffc289198dd8 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.h
@@ -38,6 +38,8 @@
 #include <engine/fifo.h>
 #include <engine/graph.h>
+#include "fuc/os.h"
 #define GPC_MAX 32
 #define TPC_MAX (GPC_MAX * 8)
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h b/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
index db1b39d08013..825f7bb46b67 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
@@ -84,6 +84,7 @@ extern struct nouveau_oclass *nv4e_i2c_oclass;
 extern struct nouveau_oclass *nv50_i2c_oclass;
 extern struct nouveau_oclass *nv94_i2c_oclass;
 extern struct nouveau_oclass *nvd0_i2c_oclass;
+extern struct nouveau_oclass *gf117_i2c_oclass;
 extern struct nouveau_oclass *nve0_i2c_oclass;
 static inline int
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nve0.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nve0.c
index 4ac1aa30ea11..0e62a3240144 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nve0.c
@@ -307,7 +307,6 @@ calc_clk(struct nve0_clock_priv *priv,
                info->dsrc = src0;
                if (div0) {
                        info->ddiv |= 0x80000000;
-                        info->ddiv |= div0 << 8;
                        info->ddiv |= div0;
                }
                if (div1D) {
@@ -352,7 +351,7 @@ nve0_clock_prog_0(struct nve0_clock_priv *priv, int clk)
 {
        struct nve0_clock_info *info = &priv->eng[clk];
        if (!info->ssel) {
-                nv_mask(priv, 0x1371d0 + (clk * 0x04), 0x80003f3f, info->ddiv);
+                nv_mask(priv, 0x1371d0 + (clk * 0x04), 0x8000003f, info->ddiv);
                nv_wr32(priv, 0x137160 + (clk * 0x04), info->dsrc);
        }
 }
@@ -389,7 +388,10 @@ static void
 nve0_clock_prog_3(struct nve0_clock_priv *priv, int clk)
 {
        struct nve0_clock_info *info = &priv->eng[clk];
-        nv_mask(priv, 0x137250 + (clk * 0x04), 0x00003f3f, info->mdiv);
+        if (info->ssel)
+                nv_mask(priv, 0x137250 + (clk * 0x04), 0x00003f00, info->mdiv);
+        else
+                nv_mask(priv, 0x137250 + (clk * 0x04), 0x0000003f, info->mdiv);
 }
 static void
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramfuc.h b/drivers/gpu/drm/nouveau/core/subdev/fb/ramfuc.h
index 0f57fcfe0bbf..2af9cfd2c60f 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramfuc.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramfuc.h
@@ -26,7 +26,7 @@ ramfuc_reg2(u32 addr1, u32 addr2)
        };
 }
-static inline struct ramfuc_reg
+static noinline struct ramfuc_reg
 ramfuc_reg(u32 addr)
 {
        return ramfuc_reg2(addr, addr);
@@ -107,7 +107,7 @@ ramfuc_nsec(struct ramfuc *ram, u32 nsec)
 #define ram_init(s,p)       ramfuc_init(&(s)->base, (p))
 #define ram_exec(s,e)       ramfuc_exec(&(s)->base, (e))
-#define ram_have(s,r)       ((s)->r_##r.addr != 0x000000)
+#define ram_have(s,r)       ((s)->r_##r.addr[0] != 0x000000)
 #define ram_rd32(s,r)       ramfuc_rd32(&(s)->base, &(s)->r_##r)
 #define ram_wr32(s,r,d)     ramfuc_wr32(&(s)->base, &(s)->r_##r, (d))
 #define ram_nuke(s,r)       ramfuc_nuke(&(s)->base, &(s)->r_##r)
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnve0.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnve0.c
index 84c7efbc4f38..c5b46e302319 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnve0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnve0.c
@@ -200,6 +200,7 @@ r1373f4_init(struct nve0_ramfuc *fuc)
        /* (re)program mempll, if required */
        if (ram->mode == 2) {
                ram_mask(fuc, 0x1373f4, 0x00010000, 0x00000000);
+                ram_mask(fuc, 0x132000, 0x80000000, 0x80000000);
                ram_mask(fuc, 0x132000, 0x00000001, 0x00000000);
                ram_mask(fuc, 0x132004, 0x103fffff, mcoef);
                ram_mask(fuc, 0x132000, 0x00000001, 0x00000001);
@@ -262,8 +263,8 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
        struct nve0_ram *ram = (void *)pfb->ram;
        struct nve0_ramfuc *fuc = &ram->fuc;
        struct nouveau_ram_data *next = ram->base.next;
-        int vc = !(next->bios.ramcfg_11_02_08);
+        int vc = !next->bios.ramcfg_11_02_08;
-        int mv = !(next->bios.ramcfg_11_02_04);
+        int mv = !next->bios.ramcfg_11_02_04;
        u32 mask, data;
        ram_mask(fuc, 0x10f808, 0x40000000, 0x40000000);
@@ -370,8 +371,8 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
                }
        }
-        if ( (next->bios.ramcfg_11_02_40) ||
+        if (next->bios.ramcfg_11_02_40 ||
-             (next->bios.ramcfg_11_07_10)) {
+            next->bios.ramcfg_11_07_10) {
                ram_mask(fuc, 0x132040, 0x00010000, 0x00010000);
                ram_nsec(fuc, 20000);
        }
@@ -417,7 +418,7 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
                ram_mask(fuc, 0x10f694, 0xff00ff00, data);
        }
-        if (ram->mode == 2 && (next->bios.ramcfg_11_08_10))
+        if (ram->mode == 2 && next->bios.ramcfg_11_08_10)
                data = 0x00000080;
        else
                data = 0x00000000;
@@ -425,13 +426,13 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
        mask = 0x00070000;
        data = 0x00000000;
-        if (!(next->bios.ramcfg_11_02_80))
+        if (!next->bios.ramcfg_11_02_80)
                data |= 0x03000000;
-        if (!(next->bios.ramcfg_11_02_40))
+        if (!next->bios.ramcfg_11_02_40)
                data |= 0x00002000;
-        if (!(next->bios.ramcfg_11_07_10))
+        if (!next->bios.ramcfg_11_07_10)
                data |= 0x00004000;
-        if (!(next->bios.ramcfg_11_07_08))
+        if (!next->bios.ramcfg_11_07_08)
                data |= 0x00000003;
        else
                data |= 0x74000000;
@@ -486,7 +487,7 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
        data = mask = 0x00000000;
        if (NOTE00(ramcfg_02_03 != 0)) {
-                data |= (next->bios.ramcfg_11_02_03) << 8;
+                data |= next->bios.ramcfg_11_02_03 << 8;
                mask |= 0x00000300;
        }
        if (NOTE00(ramcfg_01_10)) {
@@ -498,7 +499,7 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
        data = mask = 0x00000000;
        if (NOTE00(timing_30_07 != 0)) {
-                data |= (next->bios.timing_20_30_07) << 28;
+                data |= next->bios.timing_20_30_07 << 28;
                mask |= 0x70000000;
        }
        if (NOTE00(ramcfg_01_01)) {
@@ -510,7 +511,7 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
        data = mask = 0x00000000;
        if (NOTE00(timing_30_07 != 0)) {
-                data |= (next->bios.timing_20_30_07) << 28;
+                data |= next->bios.timing_20_30_07 << 28;
                mask |= 0x70000000;
        }
        if (NOTE00(ramcfg_01_02)) {
@@ -522,16 +523,16 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
        mask = 0x33f00000;
        data = 0x00000000;
-        if (!(next->bios.ramcfg_11_01_04))
+        if (!next->bios.ramcfg_11_01_04)
                data |= 0x20200000;
-        if (!(next->bios.ramcfg_11_07_80))
+        if (!next->bios.ramcfg_11_07_80)
                data |= 0x12800000;
        /*XXX: see note above about there probably being some condition
         *     for the 10f824 stuff that uses ramcfg 3...
         */
-        if ( (next->bios.ramcfg_11_03_f0)) {
+        if (next->bios.ramcfg_11_03_f0) {
                if (next->bios.rammap_11_08_0c) {
-                        if (!(next->bios.ramcfg_11_07_80))
+                        if (!next->bios.ramcfg_11_07_80)
                                mask |= 0x00000020;
                        else
                                data |= 0x00000020;
@@ -563,7 +564,7 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
                ram_wait(fuc, 0x100710, 0x80000000, 0x80000000, 200000);
        }
-        data = (next->bios.timing_20_30_07) << 8;
+        data = next->bios.timing_20_30_07 << 8;
        if (next->bios.ramcfg_11_01_01)
                data |= 0x80000000;
        ram_mask(fuc, 0x100778, 0x00000700, data);
@@ -588,7 +589,7 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
        ram_wr32(fuc, 0x10f310, 0x00000001); /* REFRESH */
        ram_wr32(fuc, 0x10f210, 0x80000000); /* REFRESH_AUTO = 1 */
-        if ((next->bios.ramcfg_11_08_10) && (ram->mode == 2) /*XXX*/) {
+        if (next->bios.ramcfg_11_08_10 && (ram->mode == 2) /*XXX*/) {
                u32 temp = ram_mask(fuc, 0x10f294, 0xff000000, 0x24000000);
                nve0_ram_train(fuc, 0xbc0e0000, 0xa4010000); /*XXX*/
                ram_nsec(fuc, 1000);
@@ -621,8 +622,8 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
        data  = ram_rd32(fuc, 0x10f978);
        data &= ~0x00046144;
        data |=  0x0000000b;
-        if (!(next->bios.ramcfg_11_07_08)) {
+        if (!next->bios.ramcfg_11_07_08) {
-                if (!(next->bios.ramcfg_11_07_04))
+                if (!next->bios.ramcfg_11_07_04)
                        data |= 0x0000200c;
                else
                        data |= 0x00000000;
@@ -636,11 +637,11 @@ nve0_ram_calc_gddr5(struct nouveau_fb *pfb, u32 freq)
                ram_wr32(fuc, 0x10f830, data);
        }
-        if (!(next->bios.ramcfg_11_07_08)) {
+        if (!next->bios.ramcfg_11_07_08) {
                data = 0x88020000;
-                if ( (next->bios.ramcfg_11_07_04))
+                if ( next->bios.ramcfg_11_07_04)
                        data |= 0x10000000;
-                if (!(next->bios.rammap_11_08_10))
+                if (!next->bios.rammap_11_08_10)
                        data |= 0x00080000;
        } else {
                data = 0xa40e0000;
@@ -689,8 +690,8 @@ nve0_ram_calc_sddr3(struct nouveau_fb *pfb, u32 freq)
        const u32 runk0 = ram->fN1 << 16;
        const u32 runk1 = ram->fN1;
        struct nouveau_ram_data *next = ram->base.next;
-        int vc = !(next->bios.ramcfg_11_02_08);
+        int vc = !next->bios.ramcfg_11_02_08;
-        int mv = !(next->bios.ramcfg_11_02_04);
+        int mv = !next->bios.ramcfg_11_02_04;
        u32 mask, data;
        ram_mask(fuc, 0x10f808, 0x40000000, 0x40000000);
@@ -705,7 +706,7 @@ nve0_ram_calc_sddr3(struct nouveau_fb *pfb, u32 freq)
        }
        ram_mask(fuc, 0x10f200, 0x00000800, 0x00000000);
-        if ((next->bios.ramcfg_11_03_f0))
+        if (next->bios.ramcfg_11_03_f0)
                ram_mask(fuc, 0x10f808, 0x04000000, 0x04000000);
        ram_wr32(fuc, 0x10f314, 0x00000001); /* PRECHARGE */
@@ -761,7 +762,7 @@ nve0_ram_calc_sddr3(struct nouveau_fb *pfb, u32 freq)
        ram_mask(fuc, 0x1373f4, 0x00000000, 0x00010010);
        data  = ram_rd32(fuc, 0x1373ec) & ~0x00030000;
-        data |= (next->bios.ramcfg_11_03_30) << 12;
+        data |= next->bios.ramcfg_11_03_30 << 16;
        ram_wr32(fuc, 0x1373ec, data);
        ram_mask(fuc, 0x1373f4, 0x00000003, 0x00000000);
        ram_mask(fuc, 0x1373f4, 0x00000010, 0x00000000);
@@ -793,8 +794,8 @@ nve0_ram_calc_sddr3(struct nouveau_fb *pfb, u32 freq)
                }
        }
-        if ( (next->bios.ramcfg_11_02_40) ||
+        if (next->bios.ramcfg_11_02_40 ||
-             (next->bios.ramcfg_11_07_10)) {
+            next->bios.ramcfg_11_07_10) {
                ram_mask(fuc, 0x132040, 0x00010000, 0x00010000);
                ram_nsec(fuc, 20000);
        }
@@ -810,13 +811,13 @@ nve0_ram_calc_sddr3(struct nouveau_fb *pfb, u32 freq)
        mask = 0x00010000;
        data = 0x00000000;
-        if (!(next->bios.ramcfg_11_02_80))
+        if (!next->bios.ramcfg_11_02_80)
                data |= 0x03000000;
-        if (!(next->bios.ramcfg_11_02_40))
+        if (!next->bios.ramcfg_11_02_40)
                data |= 0x00002000;
-        if (!(next->bios.ramcfg_11_07_10))
+        if (!next->bios.ramcfg_11_07_10)
                data |= 0x00004000;
-        if (!(next->bios.ramcfg_11_07_08))
+        if (!next->bios.ramcfg_11_07_08)
                data |= 0x00000003;
        else
                data |= 0x14000000;
@@ -844,16 +845,16 @@ nve0_ram_calc_sddr3(struct nouveau_fb *pfb, u32 freq)
        mask = 0x33f00000;
        data = 0x00000000;
-        if (!(next->bios.ramcfg_11_01_04))
+        if (!next->bios.ramcfg_11_01_04)
                data |= 0x20200000;
-        if (!(next->bios.ramcfg_11_07_80))
+        if (!next->bios.ramcfg_11_07_80)
                data |= 0x12800000;
        /*XXX: see note above about there probably being some condition
         *     for the 10f824 stuff that uses ramcfg 3...
         */
-        if ( (next->bios.ramcfg_11_03_f0)) {
+        if (next->bios.ramcfg_11_03_f0) {
                if (next->bios.rammap_11_08_0c) {
-                        if (!(next->bios.ramcfg_11_07_80))
+                        if (!next->bios.ramcfg_11_07_80)
                                mask |= 0x00000020;
                        else
                                data |= 0x00000020;
@@ -876,7 +877,7 @@ nve0_ram_calc_sddr3(struct nouveau_fb *pfb, u32 freq)
                data = next->bios.timing_20_2c_1fc0;
        ram_mask(fuc, 0x10f24c, 0x7f000000, data << 24);
-        ram_mask(fuc, 0x10f224, 0x001f0000, next->bios.timing_20_30_f8);
+        ram_mask(fuc, 0x10f224, 0x001f0000, next->bios.timing_20_30_f8 << 16);
        ram_wr32(fuc, 0x10f090, 0x4000007f);
        ram_nsec(fuc, 1000);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/i2c/gf117.c b/drivers/gpu/drm/nouveau/core/subdev/i2c/gf117.c
new file mode 100644
index 000000000000..fa891c39866b
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/core/subdev/i2c/gf117.c
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+#include "nv50.h"
+struct nouveau_oclass *
+gf117_i2c_oclass = &(struct nouveau_i2c_impl) {
+        .base.handle = NV_SUBDEV(I2C, 0xd7),
+        .base.ofuncs = &(struct nouveau_ofuncs) {
+                .ctor = _nouveau_i2c_ctor,
+                .dtor = _nouveau_i2c_dtor,
+                .init = _nouveau_i2c_init,
+                .fini = _nouveau_i2c_fini,
+        },
+        .sclass = nvd0_i2c_sclass,
+        .pad_x = &nv04_i2c_pad_oclass,
+        .pad_s = &nv04_i2c_pad_oclass,
+}.base;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/ibus/nve0.c b/drivers/gpu/drm/nouveau/core/subdev/ibus/nve0.c
index 7120124dceac..ebef970a0645 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/ibus/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/ibus/nve0.c
@@ -95,6 +95,23 @@ nve0_ibus_intr(struct nouveau_subdev *subdev)
 }
 static int
+nve0_ibus_init(struct nouveau_object *object)
+{
+        struct nve0_ibus_priv *priv = (void *)object;
+        int ret = nouveau_ibus_init(&priv->base);
+        if (ret == 0) {
+                nv_mask(priv, 0x122318, 0x0003ffff, 0x00001000);
+                nv_mask(priv, 0x12231c, 0x0003ffff, 0x00000200);
+                nv_mask(priv, 0x122310, 0x0003ffff, 0x00000800);
+                nv_mask(priv, 0x122348, 0x0003ffff, 0x00000100);
+                nv_mask(priv, 0x1223b0, 0x0003ffff, 0x00000fff);
+                nv_mask(priv, 0x122348, 0x0003ffff, 0x00000200);
+                nv_mask(priv, 0x122358, 0x0003ffff, 0x00002880);
+        }
+        return ret;
+}
+static int
 nve0_ibus_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
               struct nouveau_oclass *oclass, void *data, u32 size,
               struct nouveau_object **pobject)
@@ -117,7 +134,7 @@ nve0_ibus_oclass = {
        .ofuncs = &(struct nouveau_ofuncs) {
                .ctor = nve0_ibus_ctor,
                .dtor = _nouveau_ibus_dtor,
-                .init = _nouveau_ibus_init,
+                .init = nve0_ibus_init,
                .fini = _nouveau_ibus_fini,
        },
 };
diff --git a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/host.fuc b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/host.fuc
index 2284ecb1c9b8..c2bb616a8da5 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/host.fuc
+++ b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/host.fuc
@@ -83,7 +83,7 @@ host_send:
                // increment GET
                add b32 $r1 0x1
                and $r14 $r1 #fifo_qmaskf
-                nv_iowr(NV_PPWR_FIFO_GET(0), $r1)
+                nv_iowr(NV_PPWR_FIFO_GET(0), $r14)
                bra #host_send
        host_send_done:
        ret
diff --git a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nv108.fuc.h b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nv108.fuc.h
index 4bd43a99fdcc..39a5dc150a05 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nv108.fuc.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nv108.fuc.h
@@ -1018,7 +1018,7 @@ uint32_t nv108_pwr_code[] = {
        0xb600023f,
        0x1ec40110,
        0x04b0400f,
-        0xbd0001f6,
+        0xbd000ef6,
        0xc70ef404,
 /* 0x0328: host_send_done */
 /* 0x032a: host_recv */
diff --git a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nva3.fuc.h b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nva3.fuc.h
index 5a73fa620978..254205cd5166 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nva3.fuc.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nva3.fuc.h
@@ -1124,7 +1124,7 @@ uint32_t nva3_pwr_code[] = {
        0x0f1ec401,
        0x04b007f1,
        0xd00604b6,
-        0x04bd0001,
+        0x04bd000e,
 /* 0x03cb: host_send_done */
        0xf8ba0ef4,
 /* 0x03cd: host_recv */
diff --git a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nvc0.fuc.h b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nvc0.fuc.h
index 4dba00d2dd1a..7ac87405d01b 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nvc0.fuc.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nvc0.fuc.h
@@ -1124,7 +1124,7 @@ uint32_t nvc0_pwr_code[] = {
        0x0f1ec401,
        0x04b007f1,
        0xd00604b6,
-        0x04bd0001,
+        0x04bd000e,
 /* 0x03cb: host_send_done */
        0xf8ba0ef4,
 /* 0x03cd: host_recv */
diff --git a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nvd0.fuc.h b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nvd0.fuc.h
index 5e24c6bc041d..cd9ff1a73284 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nvd0.fuc.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/pwr/fuc/nvd0.fuc.h
@@ -1033,7 +1033,7 @@ uint32_t nvd0_pwr_code[] = {
        0xb6026b21,
        0x1ec40110,
        0xb007f10f,
-        0x0001d004,
+        0x000ed004,
        0x0ef404bd,
 /* 0x0365: host_send_done */
 /* 0x0367: host_recv */
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
index cfde9eb44ad0..6212537b90c5 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
@@ -192,11 +192,11 @@ alarm_timer_callback(struct nouveau_alarm *alarm)
        nouveau_therm_threshold_hyst_polling(therm, &sensor->thrs_shutdown,
                                             NOUVEAU_THERM_THRS_SHUTDOWN);
+        spin_unlock_irqrestore(&priv->sensor.alarm_program_lock, flags);
        /* schedule the next poll in one second */
        if (therm->temp_get(therm) >= 0 && list_empty(&alarm->head))
-                ptimer->alarm(ptimer, 1000 * 1000 * 1000, alarm);
+                ptimer->alarm(ptimer, 1000000000ULL, alarm);
-        spin_unlock_irqrestore(&priv->sensor.alarm_program_lock, flags);
 }
 void
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 26b5647188ef..47ad74255bf1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -736,6 +736,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                  fb->bits_per_pixel, fb->pitches[0], crtc->x, crtc->y,
                  new_bo->bo.offset };
+        /* Keep vblanks on during flip, for the target crtc of this flip */
+        drm_vblank_get(dev, nouveau_crtc(crtc)->index);
        /* Emit a page flip */
        if (nv_device(drm->device)->card_type >= NV_50) {
                ret = nv50_display_flip_next(crtc, fb, chan, swap_interval);
@@ -779,6 +782,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        return 0;
 fail_unreserve:
+        drm_vblank_put(dev, nouveau_crtc(crtc)->index);
        ttm_bo_unreserve(&old_bo->bo);
 fail_unpin:
        mutex_unlock(&chan->cli->mutex);
@@ -817,6 +821,9 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
                drm_send_vblank_event(dev, crtcid, s->event);
        }
+        /* Give up ownership of vblank for page-flipped crtc */
+        drm_vblank_put(dev, s->crtc);
        list_del(&s->head);
        if (ps)
                *ps = *s;
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index ddd83756b9a2..5425ffe3931d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -652,12 +652,12 @@ int nouveau_pmops_resume(struct device *dev)
        ret = nouveau_do_resume(drm_dev);
        if (ret)
                return ret;
-        if (drm_dev->mode_config.num_crtc)
-                nouveau_fbcon_set_suspend(drm_dev, 0);
-        nouveau_fbcon_zfill_all(drm_dev);
+        if (drm_dev->mode_config.num_crtc) {
-        if (drm_dev->mode_config.num_crtc)
                nouveau_display_resume(drm_dev);
+                nouveau_fbcon_set_suspend(drm_dev, 0);
+        }
        return 0;
 }
@@ -683,11 +683,12 @@ static int nouveau_pmops_thaw(struct device *dev)
        ret = nouveau_do_resume(drm_dev);
        if (ret)
                return ret;
-        if (drm_dev->mode_config.num_crtc)
-                nouveau_fbcon_set_suspend(drm_dev, 0);
+        if (drm_dev->mode_config.num_crtc) {
-        nouveau_fbcon_zfill_all(drm_dev);
-        if (drm_dev->mode_config.num_crtc)
                nouveau_display_resume(drm_dev);
+                nouveau_fbcon_set_suspend(drm_dev, 0);
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 64a42cfd3717..191665ee7f52 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -531,17 +531,10 @@ nouveau_fbcon_set_suspend(struct drm_device *dev, int state)
                if (state == 1)
                        nouveau_fbcon_save_disable_accel(dev);
                fb_set_suspend(drm->fbcon->helper.fbdev, state);
-                if (state == 0)
+                if (state == 0) {
                        nouveau_fbcon_restore_accel(dev);
+                        nouveau_fbcon_zfill(dev, drm->fbcon);
+                }
                console_unlock();
        }
 }
-void
-nouveau_fbcon_zfill_all(struct drm_device *dev)
-{
-        struct nouveau_drm *drm = nouveau_drm(dev);
-        if (drm->fbcon) {
-                nouveau_fbcon_zfill(dev, drm->fbcon);
-        }
-}
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.h b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
index fdfc0c94fbcc..fcff797d2084 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
@@ -61,7 +61,6 @@ void nouveau_fbcon_gpu_lockup(struct fb_info *info);
 int nouveau_fbcon_init(struct drm_device *dev);
 void nouveau_fbcon_fini(struct drm_device *dev);
 void nouveau_fbcon_set_suspend(struct drm_device *dev, int state);
-void nouveau_fbcon_zfill_all(struct drm_device *dev);
 void nouveau_fbcon_save_disable_accel(struct drm_device *dev);
 void nouveau_fbcon_restore_accel(struct drm_device *dev);
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index afdf607df3e6..4c534b7b04da 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1741,7 +1741,8 @@ nv50_sor_dpms(struct drm_encoder *encoder, int mode)
                }
        }
-        mthd  = (ffs(nv_encoder->dcb->sorconf.link) - 1) << 2;
+        mthd  = (ffs(nv_encoder->dcb->heads) - 1) << 3;
+        mthd |= (ffs(nv_encoder->dcb->sorconf.link) - 1) << 2;
        mthd |= nv_encoder->or;
        if (nv_encoder->dcb->type == DCB_OUTPUT_DP) {
diff --git a/drivers/gpu/drm/qxl/qxl_irq.c b/drivers/gpu/drm/qxl/qxl_irq.c
index 34d6a85e9023..0bf1e20c6e44 100644
--- a/drivers/gpu/drm/qxl/qxl_irq.c
+++ b/drivers/gpu/drm/qxl/qxl_irq.c
@@ -33,6 +33,9 @@ irqreturn_t qxl_irq_handler(int irq, void *arg)
        pending = xchg(&qdev->ram_header->int_pending, 0);
+        if (!pending)
+                return IRQ_NONE;
        atomic_inc(&qdev->irq_received);
        if (pending & QXL_INTERRUPT_DISPLAY) {
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 26c12a3fe430..30d242b25078 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1052,7 +1052,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
        int encoder_mode = atombios_get_encoder_mode(radeon_crtc->encoder);
        /* pass the actual clock to atombios_crtc_program_pll for DCE5,6 for HDMI */
-        if (ASIC_IS_DCE5(rdev) && !ASIC_IS_DCE8(rdev) &&
+        if (ASIC_IS_DCE5(rdev) &&
            (encoder_mode == ATOM_ENCODER_MODE_HDMI) &&
            (radeon_crtc->bpc > 8))
                clock = radeon_crtc->adjusted_clock;
@@ -1136,6 +1136,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
        u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE);
        u32 tmp, viewport_w, viewport_h;
        int r;
+        bool bypass_lut = false;
        /* no fb bound */
        if (!atomic && !crtc->primary->fb) {
@@ -1174,33 +1175,73 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
        radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
        radeon_bo_unreserve(rbo);
-        switch (target_fb->bits_per_pixel) {
+        switch (target_fb->pixel_format) {
-        case 8:
+        case DRM_FORMAT_C8:
                fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_8BPP) |
                             EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_INDEXED));
                break;
-        case 15:
+        case DRM_FORMAT_XRGB4444:
+        case DRM_FORMAT_ARGB4444:
+                fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_16BPP) |
+                             EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB4444));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN16);
+#endif
+                break;
+        case DRM_FORMAT_XRGB1555:
+        case DRM_FORMAT_ARGB1555:
                fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_16BPP) |
                             EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB1555));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN16);
+#endif
+                break;
+        case DRM_FORMAT_BGRX5551:
+        case DRM_FORMAT_BGRA5551:
+                fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_16BPP) |
+                             EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_BGRA5551));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN16);
+#endif
                break;
-        case 16:
+        case DRM_FORMAT_RGB565:
                fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_16BPP) |
                             EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB565));
 #ifdef __BIG_ENDIAN
                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN16);
 #endif
                break;
-        case 24:
+        case DRM_FORMAT_XRGB8888:
-        case 32:
+        case DRM_FORMAT_ARGB8888:
                fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_32BPP) |
                             EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB8888));
 #ifdef __BIG_ENDIAN
                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN32);
 #endif
                break;
+        case DRM_FORMAT_XRGB2101010:
+        case DRM_FORMAT_ARGB2101010:
+                fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_32BPP) |
+                             EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB2101010));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN32);
+#endif
+                /* Greater 8 bpc fb needs to bypass hw-lut to retain precision */
+                bypass_lut = true;
+                break;
+        case DRM_FORMAT_BGRX1010102:
+        case DRM_FORMAT_BGRA1010102:
+                fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_32BPP) |
+                             EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_BGRA1010102));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN32);
+#endif
+                /* Greater 8 bpc fb needs to bypass hw-lut to retain precision */
+                bypass_lut = true;
+                break;
        default:
-                DRM_ERROR("Unsupported screen depth %d\n",
+                DRM_ERROR("Unsupported screen format %s\n",
-                          target_fb->bits_per_pixel);
+                          drm_get_format_name(target_fb->pixel_format));
                return -EINVAL;
        }
@@ -1329,6 +1370,18 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
        WREG32(EVERGREEN_GRPH_CONTROL + radeon_crtc->crtc_offset, fb_format);
        WREG32(EVERGREEN_GRPH_SWAP_CONTROL + radeon_crtc->crtc_offset, fb_swap);
+        /*
+         * The LUT only has 256 slots for indexing by a 8 bpc fb. Bypass the LUT
+         * for > 8 bpc scanout to avoid truncation of fb indices to 8 msb's, to
+         * retain the full precision throughout the pipeline.
+         */
+        WREG32_P(EVERGREEN_GRPH_LUT_10BIT_BYPASS_CONTROL + radeon_crtc->crtc_offset,
+                 (bypass_lut ? EVERGREEN_LUT_10BIT_BYPASS_EN : 0),
+                 ~EVERGREEN_LUT_10BIT_BYPASS_EN);
+        if (bypass_lut)
+                DRM_DEBUG_KMS("Bypassing hardware LUT due to 10 bit fb scanout.\n");
        WREG32(EVERGREEN_GRPH_SURFACE_OFFSET_X + radeon_crtc->crtc_offset, 0);
        WREG32(EVERGREEN_GRPH_SURFACE_OFFSET_Y + radeon_crtc->crtc_offset, 0);
        WREG32(EVERGREEN_GRPH_X_START + radeon_crtc->crtc_offset, 0);
@@ -1361,8 +1414,8 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
        tmp &= ~EVERGREEN_GRPH_SURFACE_UPDATE_H_RETRACE_EN;
        WREG32(EVERGREEN_GRPH_FLIP_CONTROL + radeon_crtc->crtc_offset, tmp);
-        /* set pageflip to happen anywhere in vblank interval */
+        /* set pageflip to happen only at start of vblank interval (front porch) */
-        WREG32(EVERGREEN_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 0);
+        WREG32(EVERGREEN_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 3);
        if (!atomic && fb && fb != crtc->primary->fb) {
                radeon_fb = to_radeon_framebuffer(fb);
@@ -1396,6 +1449,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
        u32 fb_swap = R600_D1GRPH_SWAP_ENDIAN_NONE;
        u32 tmp, viewport_w, viewport_h;
        int r;
+        bool bypass_lut = false;
        /* no fb bound */
        if (!atomic && !crtc->primary->fb) {
@@ -1433,18 +1487,30 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
        radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
        radeon_bo_unreserve(rbo);
-        switch (target_fb->bits_per_pixel) {
+        switch (target_fb->pixel_format) {
-        case 8:
+        case DRM_FORMAT_C8:
                fb_format =
                    AVIVO_D1GRPH_CONTROL_DEPTH_8BPP |
                    AVIVO_D1GRPH_CONTROL_8BPP_INDEXED;
                break;
-        case 15:
+        case DRM_FORMAT_XRGB4444:
+        case DRM_FORMAT_ARGB4444:
+                fb_format =
+                    AVIVO_D1GRPH_CONTROL_DEPTH_16BPP |
+                    AVIVO_D1GRPH_CONTROL_16BPP_ARGB4444;
+#ifdef __BIG_ENDIAN
+                fb_swap = R600_D1GRPH_SWAP_ENDIAN_16BIT;
+#endif
+                break;
+        case DRM_FORMAT_XRGB1555:
                fb_format =
                    AVIVO_D1GRPH_CONTROL_DEPTH_16BPP |
                    AVIVO_D1GRPH_CONTROL_16BPP_ARGB1555;
+#ifdef __BIG_ENDIAN
+                fb_swap = R600_D1GRPH_SWAP_ENDIAN_16BIT;
+#endif
                break;
-        case 16:
+        case DRM_FORMAT_RGB565:
                fb_format =
                    AVIVO_D1GRPH_CONTROL_DEPTH_16BPP |
                    AVIVO_D1GRPH_CONTROL_16BPP_RGB565;
@@ -1452,8 +1518,8 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
                fb_swap = R600_D1GRPH_SWAP_ENDIAN_16BIT;
 #endif
                break;
-        case 24:
+        case DRM_FORMAT_XRGB8888:
-        case 32:
+        case DRM_FORMAT_ARGB8888:
                fb_format =
                    AVIVO_D1GRPH_CONTROL_DEPTH_32BPP |
                    AVIVO_D1GRPH_CONTROL_32BPP_ARGB8888;
@@ -1461,9 +1527,20 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
                fb_swap = R600_D1GRPH_SWAP_ENDIAN_32BIT;
 #endif
                break;
+        case DRM_FORMAT_XRGB2101010:
+        case DRM_FORMAT_ARGB2101010:
+                fb_format =
+                    AVIVO_D1GRPH_CONTROL_DEPTH_32BPP |
+                    AVIVO_D1GRPH_CONTROL_32BPP_ARGB2101010;
+#ifdef __BIG_ENDIAN
+                fb_swap = R600_D1GRPH_SWAP_ENDIAN_32BIT;
+#endif
+                /* Greater 8 bpc fb needs to bypass hw-lut to retain precision */
+                bypass_lut = true;
+                break;
        default:
-                DRM_ERROR("Unsupported screen depth %d\n",
+                DRM_ERROR("Unsupported screen format %s\n",
-                          target_fb->bits_per_pixel);
+                          drm_get_format_name(target_fb->pixel_format));
                return -EINVAL;
        }
@@ -1502,6 +1579,13 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
        if (rdev->family >= CHIP_R600)
                WREG32(R600_D1GRPH_SWAP_CONTROL + radeon_crtc->crtc_offset, fb_swap);
+        /* LUT only has 256 slots for 8 bpc fb. Bypass for > 8 bpc scanout for precision */
+        WREG32_P(AVIVO_D1GRPH_LUT_SEL + radeon_crtc->crtc_offset,
+                 (bypass_lut ? AVIVO_LUT_10BIT_BYPASS_EN : 0), ~AVIVO_LUT_10BIT_BYPASS_EN);
+        if (bypass_lut)
+                DRM_DEBUG_KMS("Bypassing hardware LUT due to 10 bit fb scanout.\n");
        WREG32(AVIVO_D1GRPH_SURFACE_OFFSET_X + radeon_crtc->crtc_offset, 0);
        WREG32(AVIVO_D1GRPH_SURFACE_OFFSET_Y + radeon_crtc->crtc_offset, 0);
        WREG32(AVIVO_D1GRPH_X_START + radeon_crtc->crtc_offset, 0);
@@ -1530,8 +1614,8 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
        tmp &= ~AVIVO_D1GRPH_SURFACE_UPDATE_H_RETRACE_EN;
        WREG32(AVIVO_D1GRPH_FLIP_CONTROL + radeon_crtc->crtc_offset, tmp);
-        /* set pageflip to happen anywhere in vblank interval */
+        /* set pageflip to happen only at start of vblank interval (front porch) */
-        WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 0);
+        WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 3);
        if (!atomic && fb && fb != crtc->primary->fb) {
                radeon_fb = to_radeon_framebuffer(fb);
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index c5b1f2da3954..b1e11f8434e2 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -127,7 +127,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
        /* flags not zero */
        if (args.v1.ucReplyStatus == 2) {
                DRM_DEBUG_KMS("dp_aux_ch flags not zero\n");
-                r = -EBUSY;
+                r = -EIO;
                goto done;
        }
@@ -403,16 +403,18 @@ bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector)
 {
        struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
        u8 msg[DP_DPCD_SIZE];
-        int ret, i;
+        int ret;
+        char dpcd_hex_dump[DP_DPCD_SIZE * 3];
        ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg,
                               DP_DPCD_SIZE);
        if (ret > 0) {
                memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE);
-                DRM_DEBUG_KMS("DPCD: ");
-                for (i = 0; i < DP_DPCD_SIZE; i++)
+                hex_dump_to_buffer(dig_connector->dpcd, sizeof(dig_connector->dpcd),
-                        DRM_DEBUG_KMS("%02x ", msg[i]);
+                                   32, 1, dpcd_hex_dump, sizeof(dpcd_hex_dump), false);
-                DRM_DEBUG_KMS("\n");
+                DRM_DEBUG_KMS("DPCD: %s\n", dpcd_hex_dump);
                radeon_dp_probe_oui(radeon_connector);
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 2b2908440644..7d68203a3737 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -183,7 +183,6 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
        struct backlight_properties props;
        struct radeon_backlight_privdata *pdata;
        struct radeon_encoder_atom_dig *dig;
-        u8 backlight_level;
        char bl_name[16];
        /* Mac laptops with multiple GPUs use the gmux driver for backlight
@@ -222,12 +221,17 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
        pdata->encoder = radeon_encoder;
-        backlight_level = radeon_atom_get_backlight_level_from_reg(rdev);
        dig = radeon_encoder->enc_priv;
        dig->bl_dev = bd;
        bd->props.brightness = radeon_atom_backlight_get_brightness(bd);
+        /* Set a reasonable default here if the level is 0 otherwise
+         * fbdev will attempt to turn the backlight on after console
+         * unblanking and it will try and restore 0 which turns the backlight
+         * off again.
+         */
+        if (bd->props.brightness == 0)
+                bd->props.brightness = RADEON_MAX_BL_LEVEL;
        bd->props.power = FB_BLANK_UNBLANK;
        backlight_update_status(bd);
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 10dae4106c08..584090ac3eb9 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -1179,7 +1179,7 @@ static int ci_stop_dpm(struct radeon_device *rdev)
        tmp &= ~GLOBAL_PWRMGT_EN;
        WREG32_SMC(GENERAL_PWRMGT, tmp);
-        tmp = RREG32(SCLK_PWRMGT_CNTL);
+        tmp = RREG32_SMC(SCLK_PWRMGT_CNTL);
        tmp &= ~DYNAMIC_PM_EN;
        WREG32_SMC(SCLK_PWRMGT_CNTL, tmp);
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index dcd4518a9b08..c0ea66192fe0 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -2291,6 +2291,7 @@ static void cik_tiling_mode_table_init(struct radeon_device *rdev)
                                gb_tile_moden = 0;
                                break;
                        }
+                        rdev->config.cik.macrotile_mode_array[reg_offset] = gb_tile_moden;
                        WREG32(GB_MACROTILE_MODE0 + (reg_offset * 4), gb_tile_moden);
                }
        } else if (num_pipe_configs == 8) {
@@ -7376,6 +7377,7 @@ static inline u32 cik_get_ih_wptr(struct radeon_device *rdev)
                tmp = RREG32(IH_RB_CNTL);
                tmp |= IH_WPTR_OVERFLOW_CLEAR;
                WREG32(IH_RB_CNTL, tmp);
+                wptr &= ~RB_OVERFLOW;
        }
        return (wptr & rdev->ih.ptr_mask);
 }
@@ -7676,14 +7678,16 @@ restart_ih:
                        addr = RREG32(VM_CONTEXT1_PROTECTION_FAULT_ADDR);
                        status = RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS);
                        mc_client = RREG32(VM_CONTEXT1_PROTECTION_FAULT_MCCLIENT);
+                        /* reset addr and status */
+                        WREG32_P(VM_CONTEXT1_CNTL2, 1, ~1);
+                        if (addr == 0x0 && status == 0x0)
+                                break;
                        dev_err(rdev->dev, "GPU fault detected: %d 0x%08x\n", src_id, src_data);
                        dev_err(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_ADDR   0x%08X\n",
                                addr);
                        dev_err(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                                status);
                        cik_vm_decode_fault(rdev, status, addr, mc_client);
-                        /* reset addr and status */
-                        WREG32_P(VM_CONTEXT1_CNTL2, 1, ~1);
                        break;
                case 167: /* VCE */
                        DRM_DEBUG("IH: VCE int: 0x%08x\n", src_data);
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index ae88660f34ea..0c6e1b55d968 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -1752,12 +1752,12 @@
 #define         EOP_TC_WB_ACTION_EN                     (1 << 15) /* L2 */
 #define         EOP_TCL1_ACTION_EN                      (1 << 16)
 #define         EOP_TC_ACTION_EN                        (1 << 17) /* L2 */
+#define         EOP_TCL2_VOLATILE                       (1 << 24)
 #define         EOP_CACHE_POLICY(x)                     ((x) << 25)
                /* 0 - LRU
                 * 1 - Stream
                 * 2 - Bypass
                 */
-#define         EOP_TCL2_VOLATILE                       (1 << 27)
 #define         DATA_SEL(x)                             ((x) << 29)
                /* 0 - discard
                 * 1 - send low 32bit data
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index 5a9a5f4d7888..47d31e915758 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -1551,7 +1551,7 @@ int cypress_populate_smc_voltage_tables(struct radeon_device *rdev,
                table->voltageMaskTable.highMask[RV770_SMC_VOLTAGEMASK_VDDCI] = 0;
                table->voltageMaskTable.lowMask[RV770_SMC_VOLTAGEMASK_VDDCI] =
-                        cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
+                        cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index e2f605224e8c..15e4f28015e1 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -189,7 +189,7 @@ static const u32 evergreen_golden_registers[] =
        0x8c1c, 0xffffffff, 0x00001010,
        0x28350, 0xffffffff, 0x00000000,
        0xa008, 0xffffffff, 0x00010000,
-        0x5cc, 0xffffffff, 0x00000001,
+        0x5c4, 0xffffffff, 0x00000001,
        0x9508, 0xffffffff, 0x00000002,
        0x913c, 0x0000000f, 0x0000000a
 };
@@ -476,7 +476,7 @@ static const u32 cedar_golden_registers[] =
        0x8c1c, 0xffffffff, 0x00001010,
        0x28350, 0xffffffff, 0x00000000,
        0xa008, 0xffffffff, 0x00010000,
-        0x5cc, 0xffffffff, 0x00000001,
+        0x5c4, 0xffffffff, 0x00000001,
        0x9508, 0xffffffff, 0x00000002
 };
@@ -635,7 +635,7 @@ static const u32 juniper_mgcg_init[] =
 static const u32 supersumo_golden_registers[] =
 {
        0x5eb4, 0xffffffff, 0x00000002,
-        0x5cc, 0xffffffff, 0x00000001,
+        0x5c4, 0xffffffff, 0x00000001,
        0x7030, 0xffffffff, 0x00000011,
        0x7c30, 0xffffffff, 0x00000011,
        0x6104, 0x01000300, 0x00000000,
@@ -719,7 +719,7 @@ static const u32 sumo_golden_registers[] =
 static const u32 wrestler_golden_registers[] =
 {
        0x5eb4, 0xffffffff, 0x00000002,
-        0x5cc, 0xffffffff, 0x00000001,
+        0x5c4, 0xffffffff, 0x00000001,
        0x7030, 0xffffffff, 0x00000011,
        0x7c30, 0xffffffff, 0x00000011,
        0x6104, 0x01000300, 0x00000000,
@@ -2642,8 +2642,9 @@ void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *s
        for (i = 0; i < rdev->num_crtc; i++) {
                if (save->crtc_enabled[i]) {
                        tmp = RREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i]);
-                        if ((tmp & 0x3) != 0) {
+                        if ((tmp & 0x7) != 3) {
-                                tmp &= ~0x3;
+                                tmp &= ~0x7;
+                                tmp |= 0x3;
                                WREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i], tmp);
                        }
                        tmp = RREG32(EVERGREEN_GRPH_UPDATE + crtc_offsets[i]);
@@ -4755,6 +4756,7 @@ static u32 evergreen_get_ih_wptr(struct radeon_device *rdev)
                tmp = RREG32(IH_RB_CNTL);
                tmp |= IH_WPTR_OVERFLOW_CLEAR;
                WREG32(IH_RB_CNTL, tmp);
+                wptr &= ~RB_OVERFLOW;
        }
        return (wptr & rdev->ih.ptr_mask);
 }
@@ -5066,14 +5068,16 @@ restart_ih:
                case 147:
                        addr = RREG32(VM_CONTEXT1_PROTECTION_FAULT_ADDR);
                        status = RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS);
+                        /* reset addr and status */
+                        WREG32_P(VM_CONTEXT1_CNTL2, 1, ~1);
+                        if (addr == 0x0 && status == 0x0)
+                                break;
                        dev_err(rdev->dev, "GPU fault detected: %d 0x%08x\n", src_id, src_data);
                        dev_err(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_ADDR   0x%08X\n",
                                addr);
                        dev_err(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                                status);
                        cayman_vm_decode_fault(rdev, status, addr);
-                        /* reset addr and status */
-                        WREG32_P(VM_CONTEXT1_CNTL2, 1, ~1);
                        break;
                case 176: /* CP_INT in ring buffer */
                case 177: /* CP_INT in IB1 */
diff --git a/drivers/gpu/drm/radeon/evergreen_reg.h b/drivers/gpu/drm/radeon/evergreen_reg.h
index a0f63ff5a5e9..23bff590fb6e 100644
--- a/drivers/gpu/drm/radeon/evergreen_reg.h
+++ b/drivers/gpu/drm/radeon/evergreen_reg.h
@@ -116,6 +116,8 @@
 #       define EVERGREEN_GRPH_ARRAY_LINEAR_ALIGNED      1
 #       define EVERGREEN_GRPH_ARRAY_1D_TILED_THIN1      2
 #       define EVERGREEN_GRPH_ARRAY_2D_TILED_THIN1      4
+#define EVERGREEN_GRPH_LUT_10BIT_BYPASS_CONTROL         0x6808
+#       define EVERGREEN_LUT_10BIT_BYPASS_EN            (1 << 8)
 #define EVERGREEN_GRPH_SWAP_CONTROL                     0x680c
 #       define EVERGREEN_GRPH_ENDIAN_SWAP(x)            (((x) & 0x3) << 0)
 #       define EVERGREEN_GRPH_ENDIAN_NONE               0
@@ -237,7 +239,6 @@
 #       define EVERGREEN_CRTC_V_BLANK                   (1 << 0)
 #define EVERGREEN_CRTC_STATUS_POSITION                  0x6e90
 #define EVERGREEN_CRTC_STATUS_HV_COUNT                  0x6ea0
-#define EVERGREEN_MASTER_UPDATE_MODE                    0x6ef8
 #define EVERGREEN_CRTC_UPDATE_LOCK                      0x6ed4
 #define EVERGREEN_MASTER_UPDATE_LOCK                    0x6ef4
 #define EVERGREEN_MASTER_UPDATE_MODE                    0x6ef8
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 3f6e817d97ee..9ef8c38f2d66 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2726,7 +2726,7 @@ int kv_dpm_init(struct radeon_device *rdev)
        pi->caps_sclk_ds = true;
        pi->enable_auto_thermal_throttling = true;
        pi->disable_nb_ps3_in_battery = false;
-        pi->bapm_enable = false;
+        pi->bapm_enable = true;
        pi->voltage_drop_t = 0;
        pi->caps_sclk_throttle_low_notification = false;
        pi->caps_fps = false; /* true? */
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 004c931606c4..01fc4888e6fe 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -1315,7 +1315,7 @@ static void ni_populate_smc_voltage_tables(struct radeon_device *rdev,
                table->voltageMaskTable.highMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] = 0;
                table->voltageMaskTable.lowMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] =
-                        cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
+                        cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
        }
 }
diff --git a/drivers/gpu/drm/radeon/r500_reg.h b/drivers/gpu/drm/radeon/r500_reg.h
index 1dd0d32993d5..136b7bc7cd20 100644
--- a/drivers/gpu/drm/radeon/r500_reg.h
+++ b/drivers/gpu/drm/radeon/r500_reg.h
@@ -402,6 +402,7 @@
 * block and vice versa.  This applies to GRPH, CUR, etc.
 */
 #define AVIVO_D1GRPH_LUT_SEL                                    0x6108
+#       define AVIVO_LUT_10BIT_BYPASS_EN                        (1 << 8)
 #define AVIVO_D1GRPH_PRIMARY_SURFACE_ADDRESS                    0x6110
 #define R700_D1GRPH_PRIMARY_SURFACE_ADDRESS_HIGH                0x6914
 #define R700_D2GRPH_PRIMARY_SURFACE_ADDRESS_HIGH                0x6114
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index c66952d4b00c..3c69f58e46ef 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3795,6 +3795,7 @@ static u32 r600_get_ih_wptr(struct radeon_device *rdev)
                tmp = RREG32(IH_RB_CNTL);
                tmp |= IH_WPTR_OVERFLOW_CLEAR;
                WREG32(IH_RB_CNTL, tmp);
+                wptr &= ~RB_OVERFLOW;
        }
        return (wptr & rdev->ih.ptr_mask);
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 4b0bbf88d5c0..60c47f829122 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -102,6 +102,7 @@ extern int radeon_runtime_pm;
 extern int radeon_hard_reset;
 extern int radeon_vm_size;
 extern int radeon_vm_block_size;
+extern int radeon_deep_color;
 /*
 * Copy from radeon_drv.h so we don't have to include both and have conflicting
@@ -448,6 +449,7 @@ struct radeon_bo_va {
        /* protected by vm mutex */
        struct list_head                vm_list;
+        struct list_head                vm_status;
        /* constant after initialization */
        struct radeon_vm                *vm;
@@ -683,10 +685,9 @@ struct radeon_flip_work {
        struct work_struct              unpin_work;
        struct radeon_device            *rdev;
        int                             crtc_id;
-        struct drm_framebuffer          *fb;
+        uint64_t                        base;
        struct drm_pending_vblank_event *event;
        struct radeon_bo                *old_rbo;
-        struct radeon_bo                *new_rbo;
        struct radeon_fence             *fence;
 };
@@ -749,10 +750,6 @@ union radeon_irq_stat_regs {
        struct cik_irq_stat_regs cik;
 };
-#define RADEON_MAX_HPD_PINS 7
-#define RADEON_MAX_CRTCS 6
-#define RADEON_MAX_AFMT_BLOCKS 7
 struct radeon_irq {
        bool                            installed;
        spinlock_t                      lock;
@@ -871,6 +868,9 @@ struct radeon_vm {
        struct list_head                va;
        unsigned                        id;
+        /* BOs freed, but not yet updated in the PT */
+        struct list_head                freed;
        /* contains the page directory */
        struct radeon_bo                *page_directory;
        uint64_t                        pd_gpu_addr;
@@ -879,6 +879,8 @@ struct radeon_vm {
        /* array of page tables, one for each page directory entry */
        struct radeon_vm_pt             *page_tables;
+        struct radeon_bo_va             *ib_bo_va;
        struct mutex                    mutex;
        /* last fence for cs using this vm */
        struct radeon_fence             *fence;
@@ -2836,9 +2838,10 @@ void radeon_vm_fence(struct radeon_device *rdev,
 uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr);
 int radeon_vm_update_page_directory(struct radeon_device *rdev,
                                    struct radeon_vm *vm);
+int radeon_vm_clear_freed(struct radeon_device *rdev,
+                          struct radeon_vm *vm);
 int radeon_vm_bo_update(struct radeon_device *rdev,
-                        struct radeon_vm *vm,
+                        struct radeon_bo_va *bo_va,
-                        struct radeon_bo *bo,
                        struct ttm_mem_reg *mem);
 void radeon_vm_bo_invalidate(struct radeon_device *rdev,
                             struct radeon_bo *bo);
@@ -2851,8 +2854,8 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
                          struct radeon_bo_va *bo_va,
                          uint64_t offset,
                          uint32_t flags);
-int radeon_vm_bo_rmv(struct radeon_device *rdev,
+void radeon_vm_bo_rmv(struct radeon_device *rdev,
-                     struct radeon_bo_va *bo_va);
+                      struct radeon_bo_va *bo_va);
 /* audio */
 void r600_audio_update_hdmi(struct work_struct *work);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 30844814c25a..173f378428a9 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1227,11 +1227,19 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
                        rdev->clock.default_dispclk =
                                le32_to_cpu(firmware_info->info_21.ulDefaultDispEngineClkFreq);
                        if (rdev->clock.default_dispclk == 0) {
-                                if (ASIC_IS_DCE5(rdev))
+                                if (ASIC_IS_DCE6(rdev))
+                                        rdev->clock.default_dispclk = 60000; /* 600 Mhz */
+                                else if (ASIC_IS_DCE5(rdev))
                                        rdev->clock.default_dispclk = 54000; /* 540 Mhz */
                                else
                                        rdev->clock.default_dispclk = 60000; /* 600 Mhz */
                        }
+                        /* set a reasonable default for DP */
+                        if (ASIC_IS_DCE6(rdev) && (rdev->clock.default_dispclk < 53900)) {
+                                DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n",
+                                         rdev->clock.default_dispclk / 100);
+                                rdev->clock.default_dispclk = 60000;
+                        }
                        rdev->clock.dp_extclk =
                                le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq);
                        rdev->clock.current_dispclk = rdev->clock.default_dispclk;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 933c5c39654d..44831197e82e 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -199,6 +199,9 @@ int radeon_get_monitor_bpc(struct drm_connector *connector)
                }
        }
+        if ((radeon_deep_color == 0) && (bpc > 8))
+                bpc = 8;
        DRM_DEBUG("%s: Display bpc=%d, returned bpc=%d\n",
                          connector->name, connector->display_info.bpc, bpc);
@@ -1288,17 +1291,15 @@ static int radeon_dvi_mode_valid(struct drm_connector *connector,
                    (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) ||
                    (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B))
                        return MODE_OK;
-                else if (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_A) {
+                else if (ASIC_IS_DCE6(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
-                        if (ASIC_IS_DCE6(rdev)) {
+                        /* HDMI 1.3+ supports max clock of 340 Mhz */
-                                /* HDMI 1.3+ supports max clock of 340 Mhz */
+                        if (mode->clock > 340000)
-                                if (mode->clock > 340000)
-                                        return MODE_CLOCK_HIGH;
-                                else
-                                        return MODE_OK;
-                        } else
                                return MODE_CLOCK_HIGH;
-                } else
+                        else
+                                return MODE_OK;
+                } else {
                        return MODE_CLOCK_HIGH;
+                }
        }
        /* check against the max pixel clock */
@@ -1549,6 +1550,8 @@ out:
 static int radeon_dp_mode_valid(struct drm_connector *connector,
                                  struct drm_display_mode *mode)
 {
+        struct drm_device *dev = connector->dev;
+        struct radeon_device *rdev = dev->dev_private;
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
        struct radeon_connector_atom_dig *radeon_dig_connector = radeon_connector->con_priv;
@@ -1579,14 +1582,23 @@ static int radeon_dp_mode_valid(struct drm_connector *connector,
                                        return MODE_PANEL;
                        }
                }
-                return MODE_OK;
        } else {
                if ((radeon_dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
-                    (radeon_dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
+                    (radeon_dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP)) {
                        return radeon_dp_mode_valid_helper(connector, mode);
-                else
+                } else {
-                        return MODE_OK;
+                        if (ASIC_IS_DCE6(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                                /* HDMI 1.3+ supports max clock of 340 Mhz */
+                                if (mode->clock > 340000)
+                                        return MODE_CLOCK_HIGH;
+                        } else {
+                                if (mode->clock > 165000)
+                                        return MODE_CLOCK_HIGH;
+                        }
+                }
        }
+        return MODE_OK;
 }
 static const struct drm_connector_helper_funcs radeon_dp_connector_helper_funcs = {
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 71a143461478..ae763f60c8a0 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -461,13 +461,23 @@ static int radeon_bo_vm_update_pte(struct radeon_cs_parser *p,
                                   struct radeon_vm *vm)
 {
        struct radeon_device *rdev = p->rdev;
+        struct radeon_bo_va *bo_va;
        int i, r;
        r = radeon_vm_update_page_directory(rdev, vm);
        if (r)
                return r;
-        r = radeon_vm_bo_update(rdev, vm, rdev->ring_tmp_bo.bo,
+        r = radeon_vm_clear_freed(rdev, vm);
+        if (r)
+                return r;
+        if (vm->ib_bo_va == NULL) {
+                DRM_ERROR("Tmp BO not in VM!\n");
+                return -EINVAL;
+        }
+        r = radeon_vm_bo_update(rdev, vm->ib_bo_va,
                                &rdev->ring_tmp_bo.bo->tbo.mem);
        if (r)
                return r;
@@ -480,7 +490,13 @@ static int radeon_bo_vm_update_pte(struct radeon_cs_parser *p,
                        continue;
                bo = p->relocs[i].robj;
-                r = radeon_vm_bo_update(rdev, vm, bo, &bo->tbo.mem);
+                bo_va = radeon_vm_bo_find(vm, bo);
+                if (bo_va == NULL) {
+                        dev_err(rdev->dev, "bo %p not in vm %p\n", bo, vm);
+                        return -EINVAL;
+                }
+                r = radeon_vm_bo_update(rdev, bo_va, &bo->tbo.mem);
                if (r)
                        return r;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 03686fab842d..697add2cd4e3 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1056,36 +1056,36 @@ static void radeon_check_arguments(struct radeon_device *rdev)
        if (!radeon_check_pot_argument(radeon_vm_size)) {
                dev_warn(rdev->dev, "VM size (%d) must be a power of 2\n",
                         radeon_vm_size);
-                radeon_vm_size = 4096;
+                radeon_vm_size = 4;
        }
-        if (radeon_vm_size < 4) {
+        if (radeon_vm_size < 1) {
-                dev_warn(rdev->dev, "VM size (%d) to small, min is 4MB\n",
+                dev_warn(rdev->dev, "VM size (%d) to small, min is 1GB\n",
                         radeon_vm_size);
-                radeon_vm_size = 4096;
+                radeon_vm_size = 4;
        }
       /*
        * Max GPUVM size for Cayman, SI and CI are 40 bits.
        */
-        if (radeon_vm_size > 1024*1024) {
+        if (radeon_vm_size > 1024) {
-                dev_warn(rdev->dev, "VM size (%d) to large, max is 1TB\n",
+                dev_warn(rdev->dev, "VM size (%d) too large, max is 1TB\n",
                         radeon_vm_size);
-                radeon_vm_size = 4096;
+                radeon_vm_size = 4;
        }
        /* defines number of bits in page table versus page directory,
         * a page is 4KB so we have 12 bits offset, minimum 9 bits in the
         * page table and the remaining bits are in the page directory */
        if (radeon_vm_block_size < 9) {
-                dev_warn(rdev->dev, "VM page table size (%d) to small\n",
+                dev_warn(rdev->dev, "VM page table size (%d) too small\n",
                         radeon_vm_block_size);
                radeon_vm_block_size = 9;
        }
        if (radeon_vm_block_size > 24 ||
-            radeon_vm_size < (1ull << radeon_vm_block_size)) {
+            (radeon_vm_size * 1024) < (1ull << radeon_vm_block_size)) {
-                dev_warn(rdev->dev, "VM page table size (%d) to large\n",
+                dev_warn(rdev->dev, "VM page table size (%d) too large\n",
                         radeon_vm_block_size);
                radeon_vm_block_size = 9;
        }
@@ -1238,7 +1238,7 @@ int radeon_device_init(struct radeon_device *rdev,
        /* Adjust VM size here.
         * Max GPUVM size for cayman+ is 40 bits.
         */
-        rdev->vm_manager.max_pfn = radeon_vm_size << 8;
+        rdev->vm_manager.max_pfn = radeon_vm_size << 18;
        /* Set asic functions */
        r = radeon_asic_init(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 5ed617056b9c..bf25061c8ac4 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -66,7 +66,8 @@ static void avivo_crtc_load_lut(struct drm_crtc *crtc)
                             (radeon_crtc->lut_b[i] << 0));
        }
-        WREG32(AVIVO_D1GRPH_LUT_SEL + radeon_crtc->crtc_offset, radeon_crtc->crtc_id);
+        /* Only change bit 0 of LUT_SEL, other bits are set elsewhere */
+        WREG32_P(AVIVO_D1GRPH_LUT_SEL + radeon_crtc->crtc_offset, radeon_crtc->crtc_id, ~1);
 }
 static void dce4_crtc_load_lut(struct drm_crtc *crtc)
@@ -284,7 +285,6 @@ static void radeon_unpin_work_func(struct work_struct *__work)
 void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id)
 {
        struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
-        struct radeon_flip_work *work;
        unsigned long flags;
        u32 update_pending;
        int vpos, hpos;
@@ -294,8 +294,11 @@ void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id)
                return;
        spin_lock_irqsave(&rdev->ddev->event_lock, flags);
-        work = radeon_crtc->flip_work;
+        if (radeon_crtc->flip_status != RADEON_FLIP_SUBMITTED) {
-        if (work == NULL) {
+                DRM_DEBUG_DRIVER("radeon_crtc->flip_status = %d != "
+                                 "RADEON_FLIP_SUBMITTED(%d)\n",
+                                 radeon_crtc->flip_status,
+                                 RADEON_FLIP_SUBMITTED);
                spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
                return;
        }
@@ -343,12 +346,17 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
        spin_lock_irqsave(&rdev->ddev->event_lock, flags);
        work = radeon_crtc->flip_work;
-        if (work == NULL) {
+        if (radeon_crtc->flip_status != RADEON_FLIP_SUBMITTED) {
+                DRM_DEBUG_DRIVER("radeon_crtc->flip_status = %d != "
+                                 "RADEON_FLIP_SUBMITTED(%d)\n",
+                                 radeon_crtc->flip_status,
+                                 RADEON_FLIP_SUBMITTED);
                spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
                return;
        }
        /* Pageflip completed. Clean up. */
+        radeon_crtc->flip_status = RADEON_FLIP_NONE;
        radeon_crtc->flip_work = NULL;
        /* wakeup userspace */
@@ -357,8 +365,8 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
        spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
-        radeon_fence_unref(&work->fence);
+        drm_vblank_put(rdev->ddev, radeon_crtc->crtc_id);
-        radeon_irq_kms_pflip_irq_get(rdev, work->crtc_id);
+        radeon_irq_kms_pflip_irq_put(rdev, work->crtc_id);
        queue_work(radeon_crtc->flip_queue, &work->unpin_work);
 }
@@ -377,51 +385,108 @@ static void radeon_flip_work_func(struct work_struct *__work)
        struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[work->crtc_id];
        struct drm_crtc *crtc = &radeon_crtc->base;
-        struct drm_framebuffer *fb = work->fb;
-        uint32_t tiling_flags, pitch_pixels;
-        uint64_t base;
        unsigned long flags;
        int r;
        down_read(&rdev->exclusive_lock);
-        while (work->fence) {
+        if (work->fence) {
                r = radeon_fence_wait(work->fence, false);
                if (r == -EDEADLK) {
                        up_read(&rdev->exclusive_lock);
                        r = radeon_gpu_reset(rdev);
                        down_read(&rdev->exclusive_lock);
                }
+                if (r)
+                        DRM_ERROR("failed to wait on page flip fence (%d)!\n", r);
-                if (r) {
+                /* We continue with the page flip even if we failed to wait on
-                        DRM_ERROR("failed to wait on page flip fence (%d)!\n",
+                 * the fence, otherwise the DRM core and userspace will be
-                                  r);
+                 * confused about which BO the CRTC is scanning out
-                        goto cleanup;
+                 */
-                } else
-                        radeon_fence_unref(&work->fence);
+                radeon_fence_unref(&work->fence);
        }
+        /* We borrow the event spin lock for protecting flip_status */
+        spin_lock_irqsave(&crtc->dev->event_lock, flags);
+        /* set the proper interrupt */
+        radeon_irq_kms_pflip_irq_get(rdev, radeon_crtc->crtc_id);
+        /* do the flip (mmio) */
+        radeon_page_flip(rdev, radeon_crtc->crtc_id, work->base);
+        radeon_crtc->flip_status = RADEON_FLIP_SUBMITTED;
+        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+        up_read(&rdev->exclusive_lock);
+}
+static int radeon_crtc_page_flip(struct drm_crtc *crtc,
+                                 struct drm_framebuffer *fb,
+                                 struct drm_pending_vblank_event *event,
+                                 uint32_t page_flip_flags)
+{
+        struct drm_device *dev = crtc->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        struct radeon_framebuffer *old_radeon_fb;
+        struct radeon_framebuffer *new_radeon_fb;
+        struct drm_gem_object *obj;
+        struct radeon_flip_work *work;
+        struct radeon_bo *new_rbo;
+        uint32_t tiling_flags, pitch_pixels;
+        uint64_t base;
+        unsigned long flags;
+        int r;
+        work = kzalloc(sizeof *work, GFP_KERNEL);
+        if (work == NULL)
+                return -ENOMEM;
+        INIT_WORK(&work->flip_work, radeon_flip_work_func);
+        INIT_WORK(&work->unpin_work, radeon_unpin_work_func);
+        work->rdev = rdev;
+        work->crtc_id = radeon_crtc->crtc_id;
+        work->event = event;
+        /* schedule unpin of the old buffer */
+        old_radeon_fb = to_radeon_framebuffer(crtc->primary->fb);
+        obj = old_radeon_fb->obj;
+        /* take a reference to the old object */
+        drm_gem_object_reference(obj);
+        work->old_rbo = gem_to_radeon_bo(obj);
+        new_radeon_fb = to_radeon_framebuffer(fb);
+        obj = new_radeon_fb->obj;
+        new_rbo = gem_to_radeon_bo(obj);
+        spin_lock(&new_rbo->tbo.bdev->fence_lock);
+        if (new_rbo->tbo.sync_obj)
+                work->fence = radeon_fence_ref(new_rbo->tbo.sync_obj);
+        spin_unlock(&new_rbo->tbo.bdev->fence_lock);
        /* pin the new buffer */
-        DRM_DEBUG_DRIVER("flip-ioctl() cur_fbo = %p, cur_bbo = %p\n",
+        DRM_DEBUG_DRIVER("flip-ioctl() cur_rbo = %p, new_rbo = %p\n",
-                         work->old_rbo, work->new_rbo);
+                         work->old_rbo, new_rbo);
-        r = radeon_bo_reserve(work->new_rbo, false);
+        r = radeon_bo_reserve(new_rbo, false);
        if (unlikely(r != 0)) {
                DRM_ERROR("failed to reserve new rbo buffer before flip\n");
                goto cleanup;
        }
        /* Only 27 bit offset for legacy CRTC */
-        r = radeon_bo_pin_restricted(work->new_rbo, RADEON_GEM_DOMAIN_VRAM,
+        r = radeon_bo_pin_restricted(new_rbo, RADEON_GEM_DOMAIN_VRAM,
                                     ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27, &base);
        if (unlikely(r != 0)) {
-                radeon_bo_unreserve(work->new_rbo);
+                radeon_bo_unreserve(new_rbo);
                r = -EINVAL;
                DRM_ERROR("failed to pin new rbo buffer before flip\n");
                goto cleanup;
        }
-        radeon_bo_get_tiling_flags(work->new_rbo, &tiling_flags, NULL);
+        radeon_bo_get_tiling_flags(new_rbo, &tiling_flags, NULL);
-        radeon_bo_unreserve(work->new_rbo);
+        radeon_bo_unreserve(new_rbo);
        if (!ASIC_IS_AVIVO(rdev)) {
                /* crtc offset is from display base addr not FB location */
@@ -458,82 +523,24 @@ static void radeon_flip_work_func(struct work_struct *__work)
                }
                base &= ~7;
        }
+        work->base = base;
-        /* We borrow the event spin lock for protecting flip_work */
+        r = drm_vblank_get(crtc->dev, radeon_crtc->crtc_id);
-        spin_lock_irqsave(&crtc->dev->event_lock, flags);
+        if (r) {
+                DRM_ERROR("failed to get vblank before flip\n");
-        /* set the proper interrupt */
+                goto pflip_cleanup;
-        radeon_irq_kms_pflip_irq_get(rdev, radeon_crtc->crtc_id);
+        }
-        /* do the flip (mmio) */
-        radeon_page_flip(rdev, radeon_crtc->crtc_id, base);
-        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
-        up_read(&rdev->exclusive_lock);
-        return;
-cleanup:
-        drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
-        radeon_fence_unref(&work->fence);
-        kfree(work);
-        up_read(&rdev->exclusive_lock);
-}
-static int radeon_crtc_page_flip(struct drm_crtc *crtc,
-                                 struct drm_framebuffer *fb,
-                                 struct drm_pending_vblank_event *event,
-                                 uint32_t page_flip_flags)
-{
-        struct drm_device *dev = crtc->dev;
-        struct radeon_device *rdev = dev->dev_private;
-        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-        struct radeon_framebuffer *old_radeon_fb;
-        struct radeon_framebuffer *new_radeon_fb;
-        struct drm_gem_object *obj;
-        struct radeon_flip_work *work;
-        unsigned long flags;
-        work = kzalloc(sizeof *work, GFP_KERNEL);
-        if (work == NULL)
-                return -ENOMEM;
-        INIT_WORK(&work->flip_work, radeon_flip_work_func);
-        INIT_WORK(&work->unpin_work, radeon_unpin_work_func);
-        work->rdev = rdev;
-        work->crtc_id = radeon_crtc->crtc_id;
-        work->fb = fb;
-        work->event = event;
-        /* schedule unpin of the old buffer */
-        old_radeon_fb = to_radeon_framebuffer(crtc->primary->fb);
-        obj = old_radeon_fb->obj;
-        /* take a reference to the old object */
-        drm_gem_object_reference(obj);
-        work->old_rbo = gem_to_radeon_bo(obj);
-        new_radeon_fb = to_radeon_framebuffer(fb);
-        obj = new_radeon_fb->obj;
-        work->new_rbo = gem_to_radeon_bo(obj);
-        spin_lock(&work->new_rbo->tbo.bdev->fence_lock);
-        if (work->new_rbo->tbo.sync_obj)
-                work->fence = radeon_fence_ref(work->new_rbo->tbo.sync_obj);
-        spin_unlock(&work->new_rbo->tbo.bdev->fence_lock);
        /* We borrow the event spin lock for protecting flip_work */
        spin_lock_irqsave(&crtc->dev->event_lock, flags);
-        if (radeon_crtc->flip_work) {
+        if (radeon_crtc->flip_status != RADEON_FLIP_NONE) {
                DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
-                drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
+                r = -EBUSY;
-                radeon_fence_unref(&work->fence);
+                goto vblank_cleanup;
-                kfree(work);
-                return -EBUSY;
        }
+        radeon_crtc->flip_status = RADEON_FLIP_PENDING;
        radeon_crtc->flip_work = work;
        /* update crtc fb */
@@ -542,8 +549,27 @@ static int radeon_crtc_page_flip(struct drm_crtc *crtc,
        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
        queue_work(radeon_crtc->flip_queue, &work->flip_work);
        return 0;
+vblank_cleanup:
+        drm_vblank_put(crtc->dev, radeon_crtc->crtc_id);
+pflip_cleanup:
+        if (unlikely(radeon_bo_reserve(new_rbo, false) != 0)) {
+                DRM_ERROR("failed to reserve new rbo in error path\n");
+                goto cleanup;
+        }
+        if (unlikely(radeon_bo_unpin(new_rbo) != 0)) {
+                DRM_ERROR("failed to unpin new rbo in error path\n");
+        }
+        radeon_bo_unreserve(new_rbo);
+cleanup:
+        drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
+        radeon_fence_unref(&work->fence);
+        kfree(work);
+        return r;
 }
 static int
@@ -803,6 +829,10 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
        struct radeon_device *rdev = dev->dev_private;
        int ret = 0;
+        /* don't leak the edid if we already fetched it in detect() */
+        if (radeon_connector->edid)
+                goto got_edid;
        /* on hw with routers, select right port */
        if (radeon_connector->router.ddc_valid)
                radeon_router_select_ddc_port(radeon_connector);
@@ -841,6 +871,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
                        radeon_connector->edid = radeon_bios_get_hardcoded_edid(rdev);
        }
        if (radeon_connector->edid) {
+got_edid:
                drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
                ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
                drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 6e3017413386..e9e361084249 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -173,8 +173,9 @@ int radeon_dpm = -1;
 int radeon_aspm = -1;
 int radeon_runtime_pm = -1;
 int radeon_hard_reset = 0;
-int radeon_vm_size = 4096;
+int radeon_vm_size = 4;
 int radeon_vm_block_size = 9;
+int radeon_deep_color = 0;
 MODULE_PARM_DESC(no_wb, "Disable AGP writeback for scratch registers");
 module_param_named(no_wb, radeon_no_wb, int, 0444);
@@ -242,12 +243,15 @@ module_param_named(runpm, radeon_runtime_pm, int, 0444);
 MODULE_PARM_DESC(hard_reset, "PCI config reset (1 = force enable, 0 = disable (default))");
 module_param_named(hard_reset, radeon_hard_reset, int, 0444);
-MODULE_PARM_DESC(vm_size, "VM address space size in megabytes (default 4GB)");
+MODULE_PARM_DESC(vm_size, "VM address space size in gigabytes (default 4GB)");
 module_param_named(vm_size, radeon_vm_size, int, 0444);
 MODULE_PARM_DESC(vm_block_size, "VM page table size in bits (default 9)");
 module_param_named(vm_block_size, radeon_vm_block_size, int, 0444);
+MODULE_PARM_DESC(deep_color, "Deep Color support (1 = enable, 0 = disable (default))");
+module_param_named(deep_color, radeon_deep_color, int, 0444);
 static struct pci_device_id pciidlist[] = {
        radeon_PCI_IDS
 };
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 35d931881b4b..d25ae6acfd5a 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -579,7 +579,7 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
        /* new gpu have virtual address space support */
        if (rdev->family >= CHIP_CAYMAN) {
                struct radeon_fpriv *fpriv;
-                struct radeon_bo_va *bo_va;
+                struct radeon_vm *vm;
                int r;
                fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
@@ -587,7 +587,8 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                        return -ENOMEM;
                }
-                r = radeon_vm_init(rdev, &fpriv->vm);
+                vm = &fpriv->vm;
+                r = radeon_vm_init(rdev, vm);
                if (r) {
                        kfree(fpriv);
                        return r;
@@ -596,22 +597,23 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                if (rdev->accel_working) {
                        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
                        if (r) {
-                                radeon_vm_fini(rdev, &fpriv->vm);
+                                radeon_vm_fini(rdev, vm);
                                kfree(fpriv);
                                return r;
                        }
                        /* map the ib pool buffer read only into
                         * virtual address space */
-                        bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
+                        vm->ib_bo_va = radeon_vm_bo_add(rdev, vm,
-                                                 rdev->ring_tmp_bo.bo);
+                                                        rdev->ring_tmp_bo.bo);
-                        r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
+                        r = radeon_vm_bo_set_addr(rdev, vm->ib_bo_va,
+                                                  RADEON_VA_IB_OFFSET,
                                                  RADEON_VM_PAGE_READABLE |
                                                  RADEON_VM_PAGE_SNOOPED);
                        radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
                        if (r) {
-                                radeon_vm_fini(rdev, &fpriv->vm);
+                                radeon_vm_fini(rdev, vm);
                                kfree(fpriv);
                                return r;
                        }
@@ -640,21 +642,19 @@ void radeon_driver_postclose_kms(struct drm_device *dev,
        /* new gpu have virtual address space support */
        if (rdev->family >= CHIP_CAYMAN && file_priv->driver_priv) {
                struct radeon_fpriv *fpriv = file_priv->driver_priv;
-                struct radeon_bo_va *bo_va;
+                struct radeon_vm *vm = &fpriv->vm;
                int r;
                if (rdev->accel_working) {
                        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
                        if (!r) {
-                                bo_va = radeon_vm_bo_find(&fpriv->vm,
+                                if (vm->ib_bo_va)
-                                                          rdev->ring_tmp_bo.bo);
+                                        radeon_vm_bo_rmv(rdev, vm->ib_bo_va);
-                                if (bo_va)
-                                        radeon_vm_bo_rmv(rdev, bo_va);
                                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
                        }
                }
-                radeon_vm_fini(rdev, &fpriv->vm);
+                radeon_vm_fini(rdev, vm);
                kfree(fpriv);
                file_priv->driver_priv = NULL;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index ad0e4b8cc7e3..0592ddb0904b 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -46,6 +46,10 @@ struct radeon_device;
 #define to_radeon_encoder(x) container_of(x, struct radeon_encoder, base)
 #define to_radeon_framebuffer(x) container_of(x, struct radeon_framebuffer, base)
+#define RADEON_MAX_HPD_PINS 7
+#define RADEON_MAX_CRTCS 6
+#define RADEON_MAX_AFMT_BLOCKS 7
 enum radeon_rmx_type {
        RMX_OFF,
        RMX_FULL,
@@ -233,8 +237,8 @@ struct radeon_mode_info {
        struct card_info *atom_card_info;
        enum radeon_connector_table connector_table;
        bool mode_config_initialized;
-        struct radeon_crtc *crtcs[6];
+        struct radeon_crtc *crtcs[RADEON_MAX_CRTCS];
-        struct radeon_afmt *afmt[7];
+        struct radeon_afmt *afmt[RADEON_MAX_AFMT_BLOCKS];
        /* DVI-I properties */
        struct drm_property *coherent_mode_property;
        /* DAC enable load detect */
@@ -302,6 +306,12 @@ struct radeon_atom_ss {
        uint16_t amount;
 };
+enum radeon_flip_status {
+        RADEON_FLIP_NONE,
+        RADEON_FLIP_PENDING,
+        RADEON_FLIP_SUBMITTED
+};
 struct radeon_crtc {
        struct drm_crtc base;
        int crtc_id;
@@ -327,6 +337,7 @@ struct radeon_crtc {
        /* page flipping */
        struct workqueue_struct *flip_queue;
        struct radeon_flip_work *flip_work;
+        enum radeon_flip_status flip_status;
        /* pll sharing */
        struct radeon_atom_ss ss;
        bool ss_enabled;
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 12c663e86ca1..e447e390d09a 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -73,8 +73,10 @@ void radeon_pm_acpi_event_handler(struct radeon_device *rdev)
                        rdev->pm.dpm.ac_power = true;
                else
                        rdev->pm.dpm.ac_power = false;
-                if (rdev->asic->dpm.enable_bapm)
+                if (rdev->family == CHIP_ARUBA) {
-                        radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
+                        if (rdev->asic->dpm.enable_bapm)
+                                radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
+                }
                mutex_unlock(&rdev->pm.mutex);
        } else if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                if (rdev->pm.profile == PM_PROFILE_AUTO) {
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index 899d9126cad6..725d3669014f 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -332,6 +332,7 @@ struct radeon_bo_va *radeon_vm_bo_add(struct radeon_device *rdev,
        bo_va->ref_count = 1;
        INIT_LIST_HEAD(&bo_va->bo_list);
        INIT_LIST_HEAD(&bo_va->vm_list);
+        INIT_LIST_HEAD(&bo_va->vm_status);
        mutex_lock(&vm->mutex);
        list_add(&bo_va->vm_list, &vm->va);
@@ -468,6 +469,19 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
                head = &tmp->vm_list;
        }
+        if (bo_va->soffset) {
+                /* add a clone of the bo_va to clear the old address */
+                tmp = kzalloc(sizeof(struct radeon_bo_va), GFP_KERNEL);
+                if (!tmp) {
+                        mutex_unlock(&vm->mutex);
+                        return -ENOMEM;
+                }
+                tmp->soffset = bo_va->soffset;
+                tmp->eoffset = bo_va->eoffset;
+                tmp->vm = vm;
+                list_add(&tmp->vm_status, &vm->freed);
+        }
        bo_va->soffset = soffset;
        bo_va->eoffset = eoffset;
        bo_va->flags = flags;
@@ -495,7 +509,7 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
                mutex_unlock(&vm->mutex);
                r = radeon_bo_create(rdev, RADEON_VM_PTE_COUNT * 8,
-                                     RADEON_GPU_PAGE_SIZE, false, 
+                                     RADEON_GPU_PAGE_SIZE, true,
                                     RADEON_GEM_DOMAIN_VRAM, NULL, &pt);
                if (r)
                        return r;
@@ -823,25 +837,19 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
 * Object have to be reserved and mutex must be locked!
 */
 int radeon_vm_bo_update(struct radeon_device *rdev,
-                        struct radeon_vm *vm,
+                        struct radeon_bo_va *bo_va,
-                        struct radeon_bo *bo,
                        struct ttm_mem_reg *mem)
 {
+        struct radeon_vm *vm = bo_va->vm;
        struct radeon_ib ib;
-        struct radeon_bo_va *bo_va;
        unsigned nptes, ndw;
        uint64_t addr;
        int r;
-        bo_va = radeon_vm_bo_find(vm, bo);
-        if (bo_va == NULL) {
-                dev_err(rdev->dev, "bo %p not in vm %p\n", bo, vm);
-                return -EINVAL;
-        }
        if (!bo_va->soffset) {
                dev_err(rdev->dev, "bo %p don't has a mapping in vm %p\n",
-                        bo, vm);
+                        bo_va->bo, vm);
                return -EINVAL;
        }
@@ -868,7 +876,7 @@ int radeon_vm_bo_update(struct radeon_device *rdev,
        trace_radeon_vm_bo_update(bo_va);
-        nptes = radeon_bo_ngpu_pages(bo);
+        nptes = (bo_va->eoffset - bo_va->soffset) / RADEON_GPU_PAGE_SIZE;
        /* padding, etc. */
        ndw = 64;
@@ -911,33 +919,61 @@ int radeon_vm_bo_update(struct radeon_device *rdev,
 }
 /**
+ * radeon_vm_clear_freed - clear freed BOs in the PT
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ *
+ * Make sure all freed BOs are cleared in the PT.
+ * Returns 0 for success.
+ *
+ * PTs have to be reserved and mutex must be locked!
+ */
+int radeon_vm_clear_freed(struct radeon_device *rdev,
+                          struct radeon_vm *vm)
+{
+        struct radeon_bo_va *bo_va, *tmp;
+        int r;
+        list_for_each_entry_safe(bo_va, tmp, &vm->freed, vm_status) {
+                list_del(&bo_va->vm_status);
+                r = radeon_vm_bo_update(rdev, bo_va, NULL);
+                kfree(bo_va);
+                if (r)
+                        return r;
+        }
+        return 0;
+}
+/**
 * radeon_vm_bo_rmv - remove a bo to a specific vm
 *
 * @rdev: radeon_device pointer
 * @bo_va: requested bo_va
 *
 * Remove @bo_va->bo from the requested vm (cayman+).
- * Remove @bo_va->bo from the list of bos associated with the bo_va->vm and
- * remove the ptes for @bo_va in the page table.
- * Returns 0 for success.
 *
 * Object have to be reserved!
 */
-int radeon_vm_bo_rmv(struct radeon_device *rdev,
+void radeon_vm_bo_rmv(struct radeon_device *rdev,
-                     struct radeon_bo_va *bo_va)
+                      struct radeon_bo_va *bo_va)
 {
-        int r = 0;
+        struct radeon_vm *vm = bo_va->vm;
-        mutex_lock(&bo_va->vm->mutex);
+        list_del(&bo_va->bo_list);
-        if (bo_va->soffset)
-                r = radeon_vm_bo_update(rdev, bo_va->vm, bo_va->bo, NULL);
+        mutex_lock(&vm->mutex);
        list_del(&bo_va->vm_list);
-        mutex_unlock(&bo_va->vm->mutex);
-        list_del(&bo_va->bo_list);
-        kfree(bo_va);
+        if (bo_va->soffset) {
-        return r;
+                bo_va->bo = NULL;
+                list_add(&bo_va->vm_status, &vm->freed);
+        } else {
+                kfree(bo_va);
+        }
+        mutex_unlock(&vm->mutex);
 }
 /**
@@ -975,11 +1011,13 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
        int r;
        vm->id = 0;
+        vm->ib_bo_va = NULL;
        vm->fence = NULL;
        vm->last_flush = NULL;
        vm->last_id_use = NULL;
        mutex_init(&vm->mutex);
        INIT_LIST_HEAD(&vm->va);
+        INIT_LIST_HEAD(&vm->freed);
        pd_size = radeon_vm_directory_size(rdev);
        pd_entries = radeon_vm_num_pdes(rdev);
@@ -992,7 +1030,7 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
                return -ENOMEM;
        }
-        r = radeon_bo_create(rdev, pd_size, align, false,
+        r = radeon_bo_create(rdev, pd_size, align, true,
                             RADEON_GEM_DOMAIN_VRAM, NULL,
                             &vm->page_directory);
        if (r)
@@ -1034,7 +1072,8 @@ void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
                        kfree(bo_va);
                }
        }
+        list_for_each_entry_safe(bo_va, tmp, &vm->freed, vm_status)
+                kfree(bo_va);
        for (i = 0; i < radeon_vm_num_pdes(rdev); i++)
                radeon_bo_unref(&vm->page_tables[i].bo);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 237dd29d9f1c..3e21e869015f 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -406,8 +406,9 @@ void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
        for (i = 0; i < rdev->num_crtc; i++) {
                if (save->crtc_enabled[i]) {
                        tmp = RREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + crtc_offsets[i]);
-                        if ((tmp & 0x3) != 0) {
+                        if ((tmp & 0x7) != 3) {
-                                tmp &= ~0x3;
+                                tmp &= ~0x7;
+                                tmp |= 0x3;
                                WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + crtc_offsets[i], tmp);
                        }
                        tmp = RREG32(AVIVO_D1GRPH_UPDATE + crtc_offsets[i]);
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index da041a43d82e..3c76e1dcdf04 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2329,12 +2329,6 @@ void rv770_get_engine_memory_ss(struct radeon_device *rdev)
        pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
                                                       ASIC_INTERNAL_MEMORY_SS, 0);
-        /* disable ss, causes hangs on some cayman boards */
-        if (rdev->family == CHIP_CAYMAN) {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-        }
        if (pi->sclk_ss || pi->mclk_ss)
                pi->dynamic_ss = true;
        else
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 730cee2c34cf..9e854fd016da 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6103,6 +6103,7 @@ static inline u32 si_get_ih_wptr(struct radeon_device *rdev)
                tmp = RREG32(IH_RB_CNTL);
                tmp |= IH_WPTR_OVERFLOW_CLEAR;
                WREG32(IH_RB_CNTL, tmp);
+                wptr &= ~RB_OVERFLOW;
        }
        return (wptr & rdev->ih.ptr_mask);
 }
@@ -6376,14 +6377,16 @@ restart_ih:
                case 147:
                        addr = RREG32(VM_CONTEXT1_PROTECTION_FAULT_ADDR);
                        status = RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS);
+                        /* reset addr and status */
+                        WREG32_P(VM_CONTEXT1_CNTL2, 1, ~1);
+                        if (addr == 0x0 && status == 0x0)
+                                break;
                        dev_err(rdev->dev, "GPU fault detected: %d 0x%08x\n", src_id, src_data);
                        dev_err(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_ADDR   0x%08X\n",
                                addr);
                        dev_err(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                                status);
                        si_vm_decode_fault(rdev, status, addr);
-                        /* reset addr and status */
-                        WREG32_P(VM_CONTEXT1_CNTL2, 1, ~1);
                        break;
                case 176: /* RINGID0 CP_INT */
                        radeon_fence_process(rdev, RADEON_RING_TYPE_GFX_INDEX);
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 2a2822c03329..32e50be9c4ac 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1874,7 +1874,16 @@ int trinity_dpm_init(struct radeon_device *rdev)
        for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
                pi->at[i] = TRINITY_AT_DFLT;
-        pi->enable_bapm = false;
+        /* There are stability issues reported on with
+         * bapm enabled when switching between AC and battery
+         * power.  At the same time, some MSI boards hang
+         * if it's not enabled and dpm is enabled.  Just enable
+         * it for MSI boards right now.
+         */
+        if (rdev->pdev->subsystem_vendor == 0x1462)
+                pi->enable_bapm = true;
+        else
+                pi->enable_bapm = false;
        pi->enable_nbps_policy = true;
        pi->enable_sclk_ds = true;
        pi->enable_gfx_power_gating = true;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index a89ad938eacf..b031b48dbb3c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info)
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
-                vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
        }
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 800c8b60f7a2..5e79c6ad914f 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -810,7 +810,7 @@ config HID_ZYDACRON
 config HID_SENSOR_HUB
        tristate "HID Sensors framework support"
-        depends on HID
+        depends on HID && HAS_IOMEM
        select MFD_CORE
        default n
        ---help---
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 6d00bb9366fa..48b66bbffc94 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -323,6 +323,7 @@
 #define USB_VENDOR_ID_ETURBOTOUCH       0x22b9
 #define USB_DEVICE_ID_ETURBOTOUCH       0x0006
+#define USB_DEVICE_ID_ETURBOTOUCH_2968  0x2968
 #define USB_VENDOR_ID_EZKEY             0x0518
 #define USB_DEVICE_ID_BTC_8193          0x0002
@@ -715,6 +716,8 @@
 #define USB_VENDOR_ID_PENMOUNT          0x14e1
 #define USB_DEVICE_ID_PENMOUNT_PCI      0x3500
+#define USB_DEVICE_ID_PENMOUNT_1610     0x1610
+#define USB_DEVICE_ID_PENMOUNT_1640     0x1640
 #define USB_VENDOR_ID_PETALYNX          0x18b1
 #define USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE    0x0037
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 2451c7e5febd..578bbe65902b 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -428,6 +428,7 @@ static int rmi_raw_event(struct hid_device *hdev,
        return 0;
 }
+#ifdef CONFIG_PM
 static int rmi_post_reset(struct hid_device *hdev)
 {
        return rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
@@ -437,6 +438,7 @@ static int rmi_post_resume(struct hid_device *hdev)
 {
        return rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 }
+#endif /* CONFIG_PM */
 #define RMI4_MAX_PAGE 0xff
 #define RMI4_PAGE_SIZE 0x0100
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index a8d5c8faf8cf..e244e449cbba 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -159,17 +159,18 @@ int sensor_hub_register_callback(struct hid_sensor_hub_device *hsdev,
 {
        struct hid_sensor_hub_callbacks_list *callback;
        struct sensor_hub_data *pdata = hid_get_drvdata(hsdev->hdev);
+        unsigned long flags;
-        spin_lock(&pdata->dyn_callback_lock);
+        spin_lock_irqsave(&pdata->dyn_callback_lock, flags);
        list_for_each_entry(callback, &pdata->dyn_callback_list, list)
                if (callback->usage_id == usage_id &&
                                                callback->hsdev == hsdev) {
-                        spin_unlock(&pdata->dyn_callback_lock);
+                        spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
                        return -EINVAL;
                }
        callback = kzalloc(sizeof(*callback), GFP_ATOMIC);
        if (!callback) {
-                spin_unlock(&pdata->dyn_callback_lock);
+                spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
                return -ENOMEM;
        }
        callback->hsdev = hsdev;
@@ -177,7 +178,7 @@ int sensor_hub_register_callback(struct hid_sensor_hub_device *hsdev,
        callback->usage_id = usage_id;
        callback->priv = NULL;
        list_add_tail(&callback->list, &pdata->dyn_callback_list);
-        spin_unlock(&pdata->dyn_callback_lock);
+        spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
        return 0;
 }
@@ -188,8 +189,9 @@ int sensor_hub_remove_callback(struct hid_sensor_hub_device *hsdev,
 {
        struct hid_sensor_hub_callbacks_list *callback;
        struct sensor_hub_data *pdata = hid_get_drvdata(hsdev->hdev);
+        unsigned long flags;
-        spin_lock(&pdata->dyn_callback_lock);
+        spin_lock_irqsave(&pdata->dyn_callback_lock, flags);
        list_for_each_entry(callback, &pdata->dyn_callback_list, list)
                if (callback->usage_id == usage_id &&
                                                callback->hsdev == hsdev) {
@@ -197,7 +199,7 @@ int sensor_hub_remove_callback(struct hid_sensor_hub_device *hsdev,
                        kfree(callback);
                        break;
                }
-        spin_unlock(&pdata->dyn_callback_lock);
+        spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
        return 0;
 }
@@ -378,15 +380,16 @@ static int sensor_hub_suspend(struct hid_device *hdev, pm_message_t message)
 {
        struct sensor_hub_data *pdata = hid_get_drvdata(hdev);
        struct hid_sensor_hub_callbacks_list *callback;
+        unsigned long flags;
        hid_dbg(hdev, " sensor_hub_suspend\n");
-        spin_lock(&pdata->dyn_callback_lock);
+        spin_lock_irqsave(&pdata->dyn_callback_lock, flags);
        list_for_each_entry(callback, &pdata->dyn_callback_list, list) {
                if (callback->usage_callback->suspend)
                        callback->usage_callback->suspend(
                                        callback->hsdev, callback->priv);
        }
-        spin_unlock(&pdata->dyn_callback_lock);
+        spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
        return 0;
 }
@@ -395,15 +398,16 @@ static int sensor_hub_resume(struct hid_device *hdev)
 {
        struct sensor_hub_data *pdata = hid_get_drvdata(hdev);
        struct hid_sensor_hub_callbacks_list *callback;
+        unsigned long flags;
        hid_dbg(hdev, " sensor_hub_resume\n");
-        spin_lock(&pdata->dyn_callback_lock);
+        spin_lock_irqsave(&pdata->dyn_callback_lock, flags);
        list_for_each_entry(callback, &pdata->dyn_callback_list, list) {
                if (callback->usage_callback->resume)
                        callback->usage_callback->resume(
                                        callback->hsdev, callback->priv);
        }
-        spin_unlock(&pdata->dyn_callback_lock);
+        spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
        return 0;
 }
@@ -632,6 +636,7 @@ static int sensor_hub_probe(struct hid_device *hdev,
                        if (name == NULL) {
                                hid_err(hdev, "Failed MFD device name\n");
                                        ret = -ENOMEM;
+                                        kfree(hsdev);
                                        goto err_no_mem;
                        }
                        sd->hid_sensor_hub_client_devs[
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 59badc10a08c..31e6727cd009 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -49,6 +49,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_ETURBOTOUCH, USB_DEVICE_ID_ETURBOTOUCH, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_ETURBOTOUCH, USB_DEVICE_ID_ETURBOTOUCH_2968, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_PANTHERLORD, USB_DEVICE_ID_PANTHERLORD_TWIN_USB_JOYSTICK, HID_QUIRK_MULTI_INPUT | HID_QUIRK_SKIP_OUTPUT_REPORTS },
        { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
@@ -76,6 +77,8 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1610, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1640, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index e84f4526eb36..ae22e3c1fc4c 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -339,9 +339,13 @@ static void process_chn_event(u32 relid)
                 */
                do {
-                        hv_begin_read(&channel->inbound);
+                        if (read_state)
+                                hv_begin_read(&channel->inbound);
                        channel->onchannel_callback(arg);
-                        bytes_to_read = hv_end_read(&channel->inbound);
+                        if (read_state)
+                                bytes_to_read = hv_end_read(&channel->inbound);
+                        else
+                                bytes_to_read = 0;
                } while (read_state && (bytes_to_read != 0));
        } else {
                pr_err("no channel callback for relid - %u\n", relid);
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index eaaa3d843b80..23b2ce294c4c 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -246,8 +246,8 @@ void hv_fcopy_onchannelcallback(void *context)
                /*
                 * Send the information to the user-level daemon.
                 */
-                fcopy_send_data();
                schedule_delayed_work(&fcopy_work, 5*HZ);
+                fcopy_send_data();
                return;
        }
        icmsghdr->icflags = ICMSGHDRFLAG_TRANSACTION | ICMSGHDRFLAG_RESPONSE;
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index ea852537307e..521c14625b3a 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -127,6 +127,17 @@ kvp_work_func(struct work_struct *dummy)
        kvp_respond_to_host(NULL, HV_E_FAIL);
 }
+static void poll_channel(struct vmbus_channel *channel)
+{
+        if (channel->target_cpu != smp_processor_id())
+                smp_call_function_single(channel->target_cpu,
+                                         hv_kvp_onchannelcallback,
+                                         channel, true);
+        else
+                hv_kvp_onchannelcallback(channel);
+}
 static int kvp_handle_handshake(struct hv_kvp_msg *msg)
 {
        int ret = 1;
@@ -155,7 +166,7 @@ static int kvp_handle_handshake(struct hv_kvp_msg *msg)
                kvp_register(dm_reg_value);
                kvp_transaction.active = false;
                if (kvp_transaction.kvp_context)
-                        hv_kvp_onchannelcallback(kvp_transaction.kvp_context);
+                        poll_channel(kvp_transaction.kvp_context);
        }
        return ret;
 }
@@ -568,7 +579,7 @@ response_done:
        vmbus_sendpacket(channel, recv_buffer, buf_len, req_id,
                                VM_PKT_DATA_INBAND, 0);
+        poll_channel(channel);
 }
 /*
@@ -603,7 +614,7 @@ void hv_kvp_onchannelcallback(void *context)
                return;
        }
-        vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 2, &recvlen,
+        vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen,
                         &requestid);
        if (recvlen > 0) {
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index dd761806f0e8..3b9c9ef0deb8 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -319,7 +319,7 @@ static int util_probe(struct hv_device *dev,
                (struct hv_util_service *)dev_id->driver_data;
        int ret;
-        srv->recv_buffer = kmalloc(PAGE_SIZE * 2, GFP_KERNEL);
+        srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL);
        if (!srv->recv_buffer)
                return -ENOMEM;
        if (srv->util_init) {
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 08531a128f53..02d3d85829f3 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1052,7 +1052,7 @@ config SENSORS_PC87427
          will be called pc87427.
 config SENSORS_NTC_THERMISTOR
-        tristate "NTC thermistor support"
+        tristate "NTC thermistor support from Murata"
        depends on !OF || IIO=n || IIO
        help
          This driver supports NTC thermistors sensor reading and its
@@ -1060,7 +1060,8 @@ config SENSORS_NTC_THERMISTOR
          send notifications about the temperature.
          Currently, this driver supports
-          NCP15WB473, NCP18WB473, NCP21WB473, NCP03WB473, and NCP15WL333.
+          NCP15WB473, NCP18WB473, NCP21WB473, NCP03WB473, and NCP15WL333
+          from Murata.
          This driver can also be built as a module.  If so, the module
          will be called ntc-thermistor.
@@ -1176,6 +1177,7 @@ config SENSORS_DME1737
 config SENSORS_EMC1403
        tristate "SMSC EMC1403/23 thermal sensor"
        depends on I2C
+        select REGMAP_I2C
        help
          If you say yes here you get support for the SMSC EMC1403/23
          temperature monitoring chip.
diff --git a/drivers/hwmon/adc128d818.c b/drivers/hwmon/adc128d818.c
index 5ffd81f19d01..0625e50d7a6e 100644
--- a/drivers/hwmon/adc128d818.c
+++ b/drivers/hwmon/adc128d818.c
@@ -239,50 +239,50 @@ static ssize_t adc128_show_alarm(struct device *dev,
        return sprintf(buf, "%u\n", !!(alarms & mask));
 }
-static SENSOR_DEVICE_ATTR_2(in0_input, S_IWUSR | S_IRUGO,
+static SENSOR_DEVICE_ATTR_2(in0_input, S_IRUGO,
-                            adc128_show_in, adc128_set_in, 0, 0);
+                            adc128_show_in, NULL, 0, 0);
 static SENSOR_DEVICE_ATTR_2(in0_min, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 0, 1);
 static SENSOR_DEVICE_ATTR_2(in0_max, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 0, 2);
-static SENSOR_DEVICE_ATTR_2(in1_input, S_IWUSR | S_IRUGO,
+static SENSOR_DEVICE_ATTR_2(in1_input, S_IRUGO,
-                            adc128_show_in, adc128_set_in, 1, 0);
+                            adc128_show_in, NULL, 1, 0);
 static SENSOR_DEVICE_ATTR_2(in1_min, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 1, 1);
 static SENSOR_DEVICE_ATTR_2(in1_max, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 1, 2);
-static SENSOR_DEVICE_ATTR_2(in2_input, S_IWUSR | S_IRUGO,
+static SENSOR_DEVICE_ATTR_2(in2_input, S_IRUGO,
-                            adc128_show_in, adc128_set_in, 2, 0);
+                            adc128_show_in, NULL, 2, 0);
 static SENSOR_DEVICE_ATTR_2(in2_min, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 2, 1);
 static SENSOR_DEVICE_ATTR_2(in2_max, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 2, 2);
-static SENSOR_DEVICE_ATTR_2(in3_input, S_IWUSR | S_IRUGO,
+static SENSOR_DEVICE_ATTR_2(in3_input, S_IRUGO,
-                            adc128_show_in, adc128_set_in, 3, 0);
+                            adc128_show_in, NULL, 3, 0);
 static SENSOR_DEVICE_ATTR_2(in3_min, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 3, 1);
 static SENSOR_DEVICE_ATTR_2(in3_max, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 3, 2);
-static SENSOR_DEVICE_ATTR_2(in4_input, S_IWUSR | S_IRUGO,
+static SENSOR_DEVICE_ATTR_2(in4_input, S_IRUGO,
-                            adc128_show_in, adc128_set_in, 4, 0);
+                            adc128_show_in, NULL, 4, 0);
 static SENSOR_DEVICE_ATTR_2(in4_min, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 4, 1);
 static SENSOR_DEVICE_ATTR_2(in4_max, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 4, 2);
-static SENSOR_DEVICE_ATTR_2(in5_input, S_IWUSR | S_IRUGO,
+static SENSOR_DEVICE_ATTR_2(in5_input, S_IRUGO,
-                            adc128_show_in, adc128_set_in, 5, 0);
+                            adc128_show_in, NULL, 5, 0);
 static SENSOR_DEVICE_ATTR_2(in5_min, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 5, 1);
 static SENSOR_DEVICE_ATTR_2(in5_max, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 5, 2);
-static SENSOR_DEVICE_ATTR_2(in6_input, S_IWUSR | S_IRUGO,
+static SENSOR_DEVICE_ATTR_2(in6_input, S_IRUGO,
-                            adc128_show_in, adc128_set_in, 6, 0);
+                            adc128_show_in, NULL, 6, 0);
 static SENSOR_DEVICE_ATTR_2(in6_min, S_IWUSR | S_IRUGO,
                            adc128_show_in, adc128_set_in, 6, 1);
 static SENSOR_DEVICE_ATTR_2(in6_max, S_IWUSR | S_IRUGO,
diff --git a/drivers/hwmon/adm1021.c b/drivers/hwmon/adm1021.c
index 3eb4281689b5..d74241bb278c 100644
--- a/drivers/hwmon/adm1021.c
+++ b/drivers/hwmon/adm1021.c
@@ -185,7 +185,7 @@ static ssize_t set_temp_max(struct device *dev,
        struct adm1021_data *data = dev_get_drvdata(dev);
        struct i2c_client *client = data->client;
        long temp;
-        int err;
+        int reg_val, err;
        err = kstrtol(buf, 10, &temp);
        if (err)
@@ -193,10 +193,11 @@ static ssize_t set_temp_max(struct device *dev,
        temp /= 1000;
        mutex_lock(&data->update_lock);
-        data->temp_max[index] = clamp_val(temp, -128, 127);
+        reg_val = clamp_val(temp, -128, 127);
+        data->temp_max[index] = reg_val * 1000;
        if (!read_only)
                i2c_smbus_write_byte_data(client, ADM1021_REG_TOS_W(index),
-                                          data->temp_max[index]);
+                                          reg_val);
        mutex_unlock(&data->update_lock);
        return count;
@@ -210,7 +211,7 @@ static ssize_t set_temp_min(struct device *dev,
        struct adm1021_data *data = dev_get_drvdata(dev);
        struct i2c_client *client = data->client;
        long temp;
-        int err;
+        int reg_val, err;
        err = kstrtol(buf, 10, &temp);
        if (err)
@@ -218,10 +219,11 @@ static ssize_t set_temp_min(struct device *dev,
        temp /= 1000;
        mutex_lock(&data->update_lock);
-        data->temp_min[index] = clamp_val(temp, -128, 127);
+        reg_val = clamp_val(temp, -128, 127);
+        data->temp_min[index] = reg_val * 1000;
        if (!read_only)
                i2c_smbus_write_byte_data(client, ADM1021_REG_THYST_W(index),
-                                          data->temp_min[index]);
+                                          reg_val);
        mutex_unlock(&data->update_lock);
        return count;
diff --git a/drivers/hwmon/adm1029.c b/drivers/hwmon/adm1029.c
index 78339e880bd6..2804571b269e 100644
--- a/drivers/hwmon/adm1029.c
+++ b/drivers/hwmon/adm1029.c
@@ -232,6 +232,9 @@ static ssize_t set_fan_div(struct device *dev,
        /* Update the value */
        reg = (reg & 0x3F) | (val << 6);
+        /* Update the cache */
+        data->fan_div[attr->index] = reg;
        /* Write value */
        i2c_smbus_write_byte_data(client,
                                  ADM1029_REG_FAN_DIV[attr->index], reg);
diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c
index a8a540ca8c34..51c1a5a165ab 100644
--- a/drivers/hwmon/adm1031.c
+++ b/drivers/hwmon/adm1031.c
@@ -365,6 +365,7 @@ set_auto_temp_min(struct device *dev, struct device_attribute *attr,
        if (ret)
                return ret;
+        val = clamp_val(val, 0, 127000);
        mutex_lock(&data->update_lock);
        data->auto_temp[nr] = AUTO_TEMP_MIN_TO_REG(val, data->auto_temp[nr]);
        adm1031_write_value(client, ADM1031_REG_AUTO_TEMP(nr),
@@ -394,6 +395,7 @@ set_auto_temp_max(struct device *dev, struct device_attribute *attr,
        if (ret)
                return ret;
+        val = clamp_val(val, 0, 127000);
        mutex_lock(&data->update_lock);
        data->temp_max[nr] = AUTO_TEMP_MAX_TO_REG(val, data->auto_temp[nr],
                                                  data->pwm[nr]);
@@ -696,7 +698,7 @@ static ssize_t set_temp_min(struct device *dev, struct device_attribute *attr,
        if (ret)
                return ret;
-        val = clamp_val(val, -55000, nr == 0 ? 127750 : 127875);
+        val = clamp_val(val, -55000, 127000);
        mutex_lock(&data->update_lock);
        data->temp_min[nr] = TEMP_TO_REG(val);
        adm1031_write_value(client, ADM1031_REG_TEMP_MIN(nr),
@@ -717,7 +719,7 @@ static ssize_t set_temp_max(struct device *dev, struct device_attribute *attr,
        if (ret)
                return ret;
-        val = clamp_val(val, -55000, nr == 0 ? 127750 : 127875);
+        val = clamp_val(val, -55000, 127000);
        mutex_lock(&data->update_lock);
        data->temp_max[nr] = TEMP_TO_REG(val);
        adm1031_write_value(client, ADM1031_REG_TEMP_MAX(nr),
@@ -738,7 +740,7 @@ static ssize_t set_temp_crit(struct device *dev, struct device_attribute *attr,
        if (ret)
                return ret;
-        val = clamp_val(val, -55000, nr == 0 ? 127750 : 127875);
+        val = clamp_val(val, -55000, 127000);
        mutex_lock(&data->update_lock);
        data->temp_crit[nr] = TEMP_TO_REG(val);
        adm1031_write_value(client, ADM1031_REG_TEMP_CRIT(nr),
diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 0f4dea5ccf17..9ee3913850d6 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -515,7 +515,7 @@ static ssize_t set_temp_min(struct device *dev,
                return -EINVAL;
        temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
        mutex_lock(&data->lock);
        data->temp_min[attr->index] = temp;
@@ -549,7 +549,7 @@ static ssize_t set_temp_max(struct device *dev,
                return -EINVAL;
        temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
        mutex_lock(&data->lock);
        data->temp_max[attr->index] = temp;
@@ -826,7 +826,7 @@ static ssize_t set_pwm_tmin(struct device *dev,
                return -EINVAL;
        temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
        mutex_lock(&data->lock);
        data->pwm_tmin[attr->index] = temp;
diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c
index eea817296513..9f2be3dd28f3 100644
--- a/drivers/hwmon/amc6821.c
+++ b/drivers/hwmon/amc6821.c
@@ -704,7 +704,7 @@ static SENSOR_DEVICE_ATTR(temp1_max_alarm, S_IRUGO,
        get_temp_alarm, NULL, IDX_TEMP1_MAX);
 static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO,
        get_temp_alarm, NULL, IDX_TEMP1_CRIT);
-static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO,
        get_temp, NULL, IDX_TEMP2_INPUT);
 static SENSOR_DEVICE_ATTR(temp2_min, S_IRUGO | S_IWUSR, get_temp,
        set_temp, IDX_TEMP2_MIN);
diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c
index afd31042b452..d14ab3c45daa 100644
--- a/drivers/hwmon/da9052-hwmon.c
+++ b/drivers/hwmon/da9052-hwmon.c
@@ -194,7 +194,7 @@ static ssize_t da9052_hwmon_show_name(struct device *dev,
                                      struct device_attribute *devattr,
                                      char *buf)
 {
-        return sprintf(buf, "da9052-hwmon\n");
+        return sprintf(buf, "da9052\n");
 }
 static ssize_t show_label(struct device *dev,
diff --git a/drivers/hwmon/da9055-hwmon.c b/drivers/hwmon/da9055-hwmon.c
index 73b3865f1207..35eb7738d711 100644
--- a/drivers/hwmon/da9055-hwmon.c
+++ b/drivers/hwmon/da9055-hwmon.c
@@ -204,7 +204,7 @@ static ssize_t da9055_hwmon_show_name(struct device *dev,
                                      struct device_attribute *devattr,
                                      char *buf)
 {
-        return sprintf(buf, "da9055-hwmon\n");
+        return sprintf(buf, "da9055\n");
 }
 static ssize_t show_label(struct device *dev,
diff --git a/drivers/hwmon/emc2103.c b/drivers/hwmon/emc2103.c
index fd892dd48e4c..78002de46cb6 100644
--- a/drivers/hwmon/emc2103.c
+++ b/drivers/hwmon/emc2103.c
@@ -250,9 +250,7 @@ static ssize_t set_temp_min(struct device *dev, struct device_attribute *da,
        if (result < 0)
                return result;
-        val = DIV_ROUND_CLOSEST(val, 1000);
+        val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -63, 127);
-        if ((val < -63) || (val > 127))
-                return -EINVAL;
        mutex_lock(&data->update_lock);
        data->temp_min[nr] = val;
@@ -274,9 +272,7 @@ static ssize_t set_temp_max(struct device *dev, struct device_attribute *da,
        if (result < 0)
                return result;
-        val = DIV_ROUND_CLOSEST(val, 1000);
+        val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -63, 127);
-        if ((val < -63) || (val > 127))
-                return -EINVAL;
        mutex_lock(&data->update_lock);
        data->temp_max[nr] = val;
@@ -390,15 +386,14 @@ static ssize_t set_fan_target(struct device *dev, struct device_attribute *da,
 {
        struct emc2103_data *data = emc2103_update_device(dev);
        struct i2c_client *client = to_i2c_client(dev);
-        long rpm_target;
+        unsigned long rpm_target;
-        int result = kstrtol(buf, 10, &rpm_target);
+        int result = kstrtoul(buf, 10, &rpm_target);
        if (result < 0)
                return result;
        /* Datasheet states 16384 as maximum RPM target (table 3.2) */
-        if ((rpm_target < 0) || (rpm_target > 16384))
+        rpm_target = clamp_val(rpm_target, 0, 16384);
-                return -EINVAL;
        mutex_lock(&data->update_lock);
diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
index ba35e4d530b5..2566c43dd1e9 100644
--- a/drivers/hwmon/gpio-fan.c
+++ b/drivers/hwmon/gpio-fan.c
@@ -538,7 +538,7 @@ static int gpio_fan_probe(struct platform_device *pdev)
        /* Make this driver part of hwmon class. */
        fan_data->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev,
-                                                "gpio-fan", fan_data,
+                                                "gpio_fan", fan_data,
                                                gpio_fan_groups);
        if (IS_ERR(fan_data->hwmon_dev))
                return PTR_ERR(fan_data->hwmon_dev);
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index e76feb86a1d4..ae66f42c4d6d 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -163,6 +163,18 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 }
 static const struct of_device_id ntc_match[] = {
+        { .compatible = "murata,ncp15wb473",
+                .data = &ntc_thermistor_id[0] },
+        { .compatible = "murata,ncp18wb473",
+                .data = &ntc_thermistor_id[1] },
+        { .compatible = "murata,ncp21wb473",
+                .data = &ntc_thermistor_id[2] },
+        { .compatible = "murata,ncp03wb473",
+                .data = &ntc_thermistor_id[3] },
+        { .compatible = "murata,ncp15wl333",
+                .data = &ntc_thermistor_id[4] },
+        /* Usage of vendor name "ntc" is deprecated */
        { .compatible = "ntc,ncp15wb473",
                .data = &ntc_thermistor_id[0] },
        { .compatible = "ntc,ncp18wb473",
@@ -500,7 +512,7 @@ static int ntc_thermistor_probe(struct platform_device *pdev)
        }
        dev_info(&pdev->dev, "Thermistor type: %s successfully probed.\n",
-                                                                pdev->name);
+                                                                pdev_id->name);
        return 0;
 err_after_sysfs:
@@ -534,7 +546,7 @@ static struct platform_driver ntc_thermistor_driver = {
 module_platform_driver(ntc_thermistor_driver);
-MODULE_DESCRIPTION("NTC Thermistor Driver");
+MODULE_DESCRIPTION("NTC Thermistor Driver from Murata");
 MODULE_AUTHOR("MyungJoo Ham <myungjoo.ham@samsung.com>");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:ntc-thermistor");
diff --git a/drivers/hwmon/smsc47m192.c b/drivers/hwmon/smsc47m192.c
index efee4c59239f..34b9a601ad07 100644
--- a/drivers/hwmon/smsc47m192.c
+++ b/drivers/hwmon/smsc47m192.c
@@ -86,7 +86,7 @@ static inline u8 IN_TO_REG(unsigned long val, int n)
 */
 static inline s8 TEMP_TO_REG(int val)
 {
-        return clamp_val(SCALE(val, 1, 1000), -128000, 127000);
+        return SCALE(clamp_val(val, -128000, 127000), 1, 1000);
 }
 static inline int TEMP_FROM_REG(s8 val)
@@ -384,6 +384,8 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
        err = kstrtoul(buf, 10, &val);
        if (err)
                return err;
+        if (val > 255)
+                return -EINVAL;
        data->vrm = val;
        return count;
diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index 6ed76ceb9270..32487c19cbfc 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -249,7 +249,7 @@ static ssize_t show_##reg(struct device *dev, struct device_attribute *attr, \
        int nr = to_sensor_dev_attr(attr)->index; \
        struct w83l786ng_data *data = w83l786ng_update_device(dev); \
        return sprintf(buf, "%d\n", \
-                FAN_FROM_REG(data->fan[nr], DIV_FROM_REG(data->fan_div[nr]))); \
+                FAN_FROM_REG(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \
 }
 show_fan_reg(fan);
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 620d1004a1e7..9f7d5859cf65 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -676,6 +676,16 @@ config I2C_RIIC
          This driver can also be built as a module.  If so, the module
          will be called i2c-riic.
+config I2C_RK3X
+        tristate "Rockchip RK3xxx I2C adapter"
+        depends on OF
+        help
+          Say Y here to include support for the I2C adapter in Rockchip RK3xxx
+          SoCs.
+          This driver can also be built as a module. If so, the module will
+          be called i2c-rk3x.
 config HAVE_S3C2410_I2C
        bool
        help
@@ -764,6 +774,19 @@ config I2C_STU300
          This driver can also be built as a module. If so, the module
          will be called i2c-stu300.
+config I2C_SUN6I_P2WI
+        tristate "Allwinner sun6i internal P2WI controller"
+        depends on RESET_CONTROLLER
+        depends on MACH_SUN6I || COMPILE_TEST
+        help
+          If you say yes to this option, support will be included for the
+          P2WI (Push/Pull 2 Wire Interface) controller embedded in some sunxi
+          SOCs.
+          The P2WI looks like an SMBus controller (which supports only byte
+          accesses), except that it only supports one slave device.
+          This interface is used to connect to specific PMIC devices (like the
+          AXP221).
 config I2C_TEGRA
        tristate "NVIDIA Tegra internal I2C controller"
        depends on ARCH_TEGRA
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index 298692cc6000..dd9a7f8e873f 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -66,6 +66,7 @@ obj-$(CONFIG_I2C_PXA)		+= i2c-pxa.o
 obj-$(CONFIG_I2C_PXA_PCI)       += i2c-pxa-pci.o
 obj-$(CONFIG_I2C_QUP)           += i2c-qup.o
 obj-$(CONFIG_I2C_RIIC)          += i2c-riic.o
+obj-$(CONFIG_I2C_RK3X)          += i2c-rk3x.o
 obj-$(CONFIG_I2C_S3C2410)       += i2c-s3c2410.o
 obj-$(CONFIG_I2C_S6000)         += i2c-s6000.o
 obj-$(CONFIG_I2C_SH7760)        += i2c-sh7760.o
@@ -74,6 +75,7 @@ obj-$(CONFIG_I2C_SIMTEC)	+= i2c-simtec.o
 obj-$(CONFIG_I2C_SIRF)          += i2c-sirf.o
 obj-$(CONFIG_I2C_ST)            += i2c-st.o
 obj-$(CONFIG_I2C_STU300)        += i2c-stu300.o
+obj-$(CONFIG_I2C_SUN6I_P2WI)    += i2c-sun6i-p2wi.o
 obj-$(CONFIG_I2C_TEGRA)         += i2c-tegra.o
 obj-$(CONFIG_I2C_VERSATILE)     += i2c-versatile.o
 obj-$(CONFIG_I2C_WMT)           += i2c-wmt.o
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
new file mode 100644
index 000000000000..a9791509966a
--- /dev/null
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -0,0 +1,763 @@
+/*
+ * Driver for I2C adapter in Rockchip RK3xxx SoC
+ *
+ * Max Schwarz <max.schwarz@online.de>
+ * based on the patches by Rockchip Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/errno.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/spinlock.h>
+#include <linux/clk.h>
+#include <linux/wait.h>
+#include <linux/mfd/syscon.h>
+#include <linux/regmap.h>
+/* Register Map */
+#define REG_CON        0x00 /* control register */
+#define REG_CLKDIV     0x04 /* clock divisor register */
+#define REG_MRXADDR    0x08 /* slave address for REGISTER_TX */
+#define REG_MRXRADDR   0x0c /* slave register address for REGISTER_TX */
+#define REG_MTXCNT     0x10 /* number of bytes to be transmitted */
+#define REG_MRXCNT     0x14 /* number of bytes to be received */
+#define REG_IEN        0x18 /* interrupt enable */
+#define REG_IPD        0x1c /* interrupt pending */
+#define REG_FCNT       0x20 /* finished count */
+/* Data buffer offsets */
+#define TXBUFFER_BASE 0x100
+#define RXBUFFER_BASE 0x200
+/* REG_CON bits */
+#define REG_CON_EN        BIT(0)
+enum {
+        REG_CON_MOD_TX = 0,      /* transmit data */
+        REG_CON_MOD_REGISTER_TX, /* select register and restart */
+        REG_CON_MOD_RX,          /* receive data */
+        REG_CON_MOD_REGISTER_RX, /* broken: transmits read addr AND writes
+                                  * register addr */
+};
+#define REG_CON_MOD(mod)  ((mod) << 1)
+#define REG_CON_MOD_MASK  (BIT(1) | BIT(2))
+#define REG_CON_START     BIT(3)
+#define REG_CON_STOP      BIT(4)
+#define REG_CON_LASTACK   BIT(5) /* 1: send NACK after last received byte */
+#define REG_CON_ACTACK    BIT(6) /* 1: stop if NACK is received */
+/* REG_MRXADDR bits */
+#define REG_MRXADDR_VALID(x) BIT(24 + (x)) /* [x*8+7:x*8] of MRX[R]ADDR valid */
+/* REG_IEN/REG_IPD bits */
+#define REG_INT_BTF       BIT(0) /* a byte was transmitted */
+#define REG_INT_BRF       BIT(1) /* a byte was received */
+#define REG_INT_MBTF      BIT(2) /* master data transmit finished */
+#define REG_INT_MBRF      BIT(3) /* master data receive finished */
+#define REG_INT_START     BIT(4) /* START condition generated */
+#define REG_INT_STOP      BIT(5) /* STOP condition generated */
+#define REG_INT_NAKRCV    BIT(6) /* NACK received */
+#define REG_INT_ALL       0x7f
+/* Constants */
+#define WAIT_TIMEOUT      200 /* ms */
+#define DEFAULT_SCL_RATE  (100 * 1000) /* Hz */
+enum rk3x_i2c_state {
+        STATE_IDLE,
+        STATE_START,
+        STATE_READ,
+        STATE_WRITE,
+        STATE_STOP
+};
+/**
+ * @grf_offset: offset inside the grf regmap for setting the i2c type
+ */
+struct rk3x_i2c_soc_data {
+        int grf_offset;
+};
+struct rk3x_i2c {
+        struct i2c_adapter adap;
+        struct device *dev;
+        struct rk3x_i2c_soc_data *soc_data;
+        /* Hardware resources */
+        void __iomem *regs;
+        struct clk *clk;
+        /* Settings */
+        unsigned int scl_frequency;
+        /* Synchronization & notification */
+        spinlock_t lock;
+        wait_queue_head_t wait;
+        bool busy;
+        /* Current message */
+        struct i2c_msg *msg;
+        u8 addr;
+        unsigned int mode;
+        bool is_last_msg;
+        /* I2C state machine */
+        enum rk3x_i2c_state state;
+        unsigned int processed; /* sent/received bytes */
+        int error;
+};
+static inline void i2c_writel(struct rk3x_i2c *i2c, u32 value,
+                              unsigned int offset)
+{
+        writel(value, i2c->regs + offset);
+}
+static inline u32 i2c_readl(struct rk3x_i2c *i2c, unsigned int offset)
+{
+        return readl(i2c->regs + offset);
+}
+/* Reset all interrupt pending bits */
+static inline void rk3x_i2c_clean_ipd(struct rk3x_i2c *i2c)
+{
+        i2c_writel(i2c, REG_INT_ALL, REG_IPD);
+}
+/**
+ * Generate a START condition, which triggers a REG_INT_START interrupt.
+ */
+static void rk3x_i2c_start(struct rk3x_i2c *i2c)
+{
+        u32 val;
+        rk3x_i2c_clean_ipd(i2c);
+        i2c_writel(i2c, REG_INT_START, REG_IEN);
+        /* enable adapter with correct mode, send START condition */
+        val = REG_CON_EN | REG_CON_MOD(i2c->mode) | REG_CON_START;
+        /* if we want to react to NACK, set ACTACK bit */
+        if (!(i2c->msg->flags & I2C_M_IGNORE_NAK))
+                val |= REG_CON_ACTACK;
+        i2c_writel(i2c, val, REG_CON);
+}
+/**
+ * Generate a STOP condition, which triggers a REG_INT_STOP interrupt.
+ *
+ * @error: Error code to return in rk3x_i2c_xfer
+ */
+static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error)
+{
+        unsigned int ctrl;
+        i2c->processed = 0;
+        i2c->msg = NULL;
+        i2c->error = error;
+        if (i2c->is_last_msg) {
+                /* Enable stop interrupt */
+                i2c_writel(i2c, REG_INT_STOP, REG_IEN);
+                i2c->state = STATE_STOP;
+                ctrl = i2c_readl(i2c, REG_CON);
+                ctrl |= REG_CON_STOP;
+                i2c_writel(i2c, ctrl, REG_CON);
+        } else {
+                /* Signal rk3x_i2c_xfer to start the next message. */
+                i2c->busy = false;
+                i2c->state = STATE_IDLE;
+                /*
+                 * The HW is actually not capable of REPEATED START. But we can
+                 * get the intended effect by resetting its internal state
+                 * and issuing an ordinary START.
+                 */
+                i2c_writel(i2c, 0, REG_CON);
+                /* signal that we are finished with the current msg */
+                wake_up(&i2c->wait);
+        }
+}
+/**
+ * Setup a read according to i2c->msg
+ */
+static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c)
+{
+        unsigned int len = i2c->msg->len - i2c->processed;
+        u32 con;
+        con = i2c_readl(i2c, REG_CON);
+        /*
+         * The hw can read up to 32 bytes at a time. If we need more than one
+         * chunk, send an ACK after the last byte of the current chunk.
+         */
+        if (unlikely(len > 32)) {
+                len = 32;
+                con &= ~REG_CON_LASTACK;
+        } else {
+                con |= REG_CON_LASTACK;
+        }
+        /* make sure we are in plain RX mode if we read a second chunk */
+        if (i2c->processed != 0) {
+                con &= ~REG_CON_MOD_MASK;
+                con |= REG_CON_MOD(REG_CON_MOD_RX);
+        }
+        i2c_writel(i2c, con, REG_CON);
+        i2c_writel(i2c, len, REG_MRXCNT);
+}
+/**
+ * Fill the transmit buffer with data from i2c->msg
+ */
+static void rk3x_i2c_fill_transmit_buf(struct rk3x_i2c *i2c)
+{
+        unsigned int i, j;
+        u32 cnt = 0;
+        u32 val;
+        u8 byte;
+        for (i = 0; i < 8; ++i) {
+                val = 0;
+                for (j = 0; j < 4; ++j) {
+                        if (i2c->processed == i2c->msg->len)
+                                break;
+                        if (i2c->processed == 0 && cnt == 0)
+                                byte = (i2c->addr & 0x7f) << 1;
+                        else
+                                byte = i2c->msg->buf[i2c->processed++];
+                        val |= byte << (j * 8);
+                        cnt++;
+                }
+                i2c_writel(i2c, val, TXBUFFER_BASE + 4 * i);
+                if (i2c->processed == i2c->msg->len)
+                        break;
+        }
+        i2c_writel(i2c, cnt, REG_MTXCNT);
+}
+/* IRQ handlers for individual states */
+static void rk3x_i2c_handle_start(struct rk3x_i2c *i2c, unsigned int ipd)
+{
+        if (!(ipd & REG_INT_START)) {
+                rk3x_i2c_stop(i2c, -EIO);
+                dev_warn(i2c->dev, "unexpected irq in START: 0x%x\n", ipd);
+                rk3x_i2c_clean_ipd(i2c);
+                return;
+        }
+        /* ack interrupt */
+        i2c_writel(i2c, REG_INT_START, REG_IPD);
+        /* disable start bit */
+        i2c_writel(i2c, i2c_readl(i2c, REG_CON) & ~REG_CON_START, REG_CON);
+        /* enable appropriate interrupts and transition */
+        if (i2c->mode == REG_CON_MOD_TX) {
+                i2c_writel(i2c, REG_INT_MBTF | REG_INT_NAKRCV, REG_IEN);
+                i2c->state = STATE_WRITE;
+                rk3x_i2c_fill_transmit_buf(i2c);
+        } else {
+                /* in any other case, we are going to be reading. */
+                i2c_writel(i2c, REG_INT_MBRF | REG_INT_NAKRCV, REG_IEN);
+                i2c->state = STATE_READ;
+                rk3x_i2c_prepare_read(i2c);
+        }
+}
+static void rk3x_i2c_handle_write(struct rk3x_i2c *i2c, unsigned int ipd)
+{
+        if (!(ipd & REG_INT_MBTF)) {
+                rk3x_i2c_stop(i2c, -EIO);
+                dev_err(i2c->dev, "unexpected irq in WRITE: 0x%x\n", ipd);
+                rk3x_i2c_clean_ipd(i2c);
+                return;
+        }
+        /* ack interrupt */
+        i2c_writel(i2c, REG_INT_MBTF, REG_IPD);
+        /* are we finished? */
+        if (i2c->processed == i2c->msg->len)
+                rk3x_i2c_stop(i2c, i2c->error);
+        else
+                rk3x_i2c_fill_transmit_buf(i2c);
+}
+static void rk3x_i2c_handle_read(struct rk3x_i2c *i2c, unsigned int ipd)
+{
+        unsigned int i;
+        unsigned int len = i2c->msg->len - i2c->processed;
+        u32 uninitialized_var(val);
+        u8 byte;
+        /* we only care for MBRF here. */
+        if (!(ipd & REG_INT_MBRF))
+                return;
+        /* ack interrupt */
+        i2c_writel(i2c, REG_INT_MBRF, REG_IPD);
+        /* read the data from receive buffer */
+        for (i = 0; i < len; ++i) {
+                if (i % 4 == 0)
+                        val = i2c_readl(i2c, RXBUFFER_BASE + (i / 4) * 4);
+                byte = (val >> ((i % 4) * 8)) & 0xff;
+                i2c->msg->buf[i2c->processed++] = byte;
+        }
+        /* are we finished? */
+        if (i2c->processed == i2c->msg->len)
+                rk3x_i2c_stop(i2c, i2c->error);
+        else
+                rk3x_i2c_prepare_read(i2c);
+}
+static void rk3x_i2c_handle_stop(struct rk3x_i2c *i2c, unsigned int ipd)
+{
+        unsigned int con;
+        if (!(ipd & REG_INT_STOP)) {
+                rk3x_i2c_stop(i2c, -EIO);
+                dev_err(i2c->dev, "unexpected irq in STOP: 0x%x\n", ipd);
+                rk3x_i2c_clean_ipd(i2c);
+                return;
+        }
+        /* ack interrupt */
+        i2c_writel(i2c, REG_INT_STOP, REG_IPD);
+        /* disable STOP bit */
+        con = i2c_readl(i2c, REG_CON);
+        con &= ~REG_CON_STOP;
+        i2c_writel(i2c, con, REG_CON);
+        i2c->busy = false;
+        i2c->state = STATE_IDLE;
+        /* signal rk3x_i2c_xfer that we are finished */
+        wake_up(&i2c->wait);
+}
+static irqreturn_t rk3x_i2c_irq(int irqno, void *dev_id)
+{
+        struct rk3x_i2c *i2c = dev_id;
+        unsigned int ipd;
+        spin_lock(&i2c->lock);
+        ipd = i2c_readl(i2c, REG_IPD);
+        if (i2c->state == STATE_IDLE) {
+                dev_warn(i2c->dev, "irq in STATE_IDLE, ipd = 0x%x\n", ipd);
+                rk3x_i2c_clean_ipd(i2c);
+                goto out;
+        }
+        dev_dbg(i2c->dev, "IRQ: state %d, ipd: %x\n", i2c->state, ipd);
+        /* Clean interrupt bits we don't care about */
+        ipd &= ~(REG_INT_BRF | REG_INT_BTF);
+        if (ipd & REG_INT_NAKRCV) {
+                /*
+                 * We got a NACK in the last operation. Depending on whether
+                 * IGNORE_NAK is set, we have to stop the operation and report
+                 * an error.
+                 */
+                i2c_writel(i2c, REG_INT_NAKRCV, REG_IPD);
+                ipd &= ~REG_INT_NAKRCV;
+                if (!(i2c->msg->flags & I2C_M_IGNORE_NAK))
+                        rk3x_i2c_stop(i2c, -ENXIO);
+        }
+        /* is there anything left to handle? */
+        if (unlikely(ipd == 0))
+                goto out;
+        switch (i2c->state) {
+        case STATE_START:
+                rk3x_i2c_handle_start(i2c, ipd);
+                break;
+        case STATE_WRITE:
+                rk3x_i2c_handle_write(i2c, ipd);
+                break;
+        case STATE_READ:
+                rk3x_i2c_handle_read(i2c, ipd);
+                break;
+        case STATE_STOP:
+                rk3x_i2c_handle_stop(i2c, ipd);
+                break;
+        case STATE_IDLE:
+                break;
+        }
+out:
+        spin_unlock(&i2c->lock);
+        return IRQ_HANDLED;
+}
+static void rk3x_i2c_set_scl_rate(struct rk3x_i2c *i2c, unsigned long scl_rate)
+{
+        unsigned long i2c_rate = clk_get_rate(i2c->clk);
+        unsigned int div;
+        /* SCL rate = (clk rate) / (8 * DIV) */
+        div = DIV_ROUND_UP(i2c_rate, scl_rate * 8);
+        /* The lower and upper half of the CLKDIV reg describe the length of
+         * SCL low & high periods. */
+        div = DIV_ROUND_UP(div, 2);
+        i2c_writel(i2c, (div << 16) | (div & 0xffff), REG_CLKDIV);
+}
+/**
+ * Setup I2C registers for an I2C operation specified by msgs, num.
+ *
+ * Must be called with i2c->lock held.
+ *
+ * @msgs: I2C msgs to process
+ * @num: Number of msgs
+ *
+ * returns: Number of I2C msgs processed or negative in case of error
+ */
+static int rk3x_i2c_setup(struct rk3x_i2c *i2c, struct i2c_msg *msgs, int num)
+{
+        u32 addr = (msgs[0].addr & 0x7f) << 1;
+        int ret = 0;
+        /*
+         * The I2C adapter can issue a small (len < 4) write packet before
+         * reading. This speeds up SMBus-style register reads.
+         * The MRXADDR/MRXRADDR hold the slave address and the slave register
+         * address in this case.
+         */
+        if (num >= 2 && msgs[0].len < 4 &&
+            !(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD)) {
+                u32 reg_addr = 0;
+                int i;
+                dev_dbg(i2c->dev, "Combined write/read from addr 0x%x\n",
+                        addr >> 1);
+                /* Fill MRXRADDR with the register address(es) */
+                for (i = 0; i < msgs[0].len; ++i) {
+                        reg_addr |= msgs[0].buf[i] << (i * 8);
+                        reg_addr |= REG_MRXADDR_VALID(i);
+                }
+                /* msgs[0] is handled by hw. */
+                i2c->msg = &msgs[1];
+                i2c->mode = REG_CON_MOD_REGISTER_TX;
+                i2c_writel(i2c, addr | REG_MRXADDR_VALID(0), REG_MRXADDR);
+                i2c_writel(i2c, reg_addr, REG_MRXRADDR);
+                ret = 2;
+        } else {
+                /*
+                 * We'll have to do it the boring way and process the msgs
+                 * one-by-one.
+                 */
+                if (msgs[0].flags & I2C_M_RD) {
+                        addr |= 1; /* set read bit */
+                        /*
+                         * We have to transmit the slave addr first. Use
+                         * MOD_REGISTER_TX for that purpose.
+                         */
+                        i2c->mode = REG_CON_MOD_REGISTER_TX;
+                        i2c_writel(i2c, addr | REG_MRXADDR_VALID(0),
+                                   REG_MRXADDR);
+                        i2c_writel(i2c, 0, REG_MRXRADDR);
+                } else {
+                        i2c->mode = REG_CON_MOD_TX;
+                }
+                i2c->msg = &msgs[0];
+                ret = 1;
+        }
+        i2c->addr = msgs[0].addr;
+        i2c->busy = true;
+        i2c->state = STATE_START;
+        i2c->processed = 0;
+        i2c->error = 0;
+        rk3x_i2c_clean_ipd(i2c);
+        return ret;
+}
+static int rk3x_i2c_xfer(struct i2c_adapter *adap,
+                         struct i2c_msg *msgs, int num)
+{
+        struct rk3x_i2c *i2c = (struct rk3x_i2c *)adap->algo_data;
+        unsigned long timeout, flags;
+        int ret = 0;
+        int i;
+        spin_lock_irqsave(&i2c->lock, flags);
+        clk_enable(i2c->clk);
+        /* The clock rate might have changed, so setup the divider again */
+        rk3x_i2c_set_scl_rate(i2c, i2c->scl_frequency);
+        i2c->is_last_msg = false;
+        /*
+         * Process msgs. We can handle more than one message at once (see
+         * rk3x_i2c_setup()).
+         */
+        for (i = 0; i < num; i += ret) {
+                ret = rk3x_i2c_setup(i2c, msgs + i, num - i);
+                if (ret < 0) {
+                        dev_err(i2c->dev, "rk3x_i2c_setup() failed\n");
+                        break;
+                }
+                if (i + ret >= num)
+                        i2c->is_last_msg = true;
+                spin_unlock_irqrestore(&i2c->lock, flags);
+                rk3x_i2c_start(i2c);
+                timeout = wait_event_timeout(i2c->wait, !i2c->busy,
+                                             msecs_to_jiffies(WAIT_TIMEOUT));
+                spin_lock_irqsave(&i2c->lock, flags);
+                if (timeout == 0) {
+                        dev_err(i2c->dev, "timeout, ipd: 0x%02x, state: %d\n",
+                                i2c_readl(i2c, REG_IPD), i2c->state);
+                        /* Force a STOP condition without interrupt */
+                        i2c_writel(i2c, 0, REG_IEN);
+                        i2c_writel(i2c, REG_CON_EN | REG_CON_STOP, REG_CON);
+                        i2c->state = STATE_IDLE;
+                        ret = -ETIMEDOUT;
+                        break;
+                }
+                if (i2c->error) {
+                        ret = i2c->error;
+                        break;
+                }
+        }
+        clk_disable(i2c->clk);
+        spin_unlock_irqrestore(&i2c->lock, flags);
+        return ret;
+}
+static u32 rk3x_i2c_func(struct i2c_adapter *adap)
+{
+        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING;
+}
+static const struct i2c_algorithm rk3x_i2c_algorithm = {
+        .master_xfer            = rk3x_i2c_xfer,
+        .functionality          = rk3x_i2c_func,
+};
+static struct rk3x_i2c_soc_data soc_data[3] = {
+        { .grf_offset = 0x154 }, /* rk3066 */
+        { .grf_offset = 0x0a4 }, /* rk3188 */
+        { .grf_offset = -1 },    /* no I2C switching needed */
+};
+static const struct of_device_id rk3x_i2c_match[] = {
+        { .compatible = "rockchip,rk3066-i2c", .data = (void *)&soc_data[0] },
+        { .compatible = "rockchip,rk3188-i2c", .data = (void *)&soc_data[1] },
+        { .compatible = "rockchip,rk3288-i2c", .data = (void *)&soc_data[2] },
+        {},
+};
+static int rk3x_i2c_probe(struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.of_node;
+        const struct of_device_id *match;
+        struct rk3x_i2c *i2c;
+        struct resource *mem;
+        int ret = 0;
+        int bus_nr;
+        u32 value;
+        int irq;
+        i2c = devm_kzalloc(&pdev->dev, sizeof(struct rk3x_i2c), GFP_KERNEL);
+        if (!i2c)
+                return -ENOMEM;
+        match = of_match_node(rk3x_i2c_match, np);
+        i2c->soc_data = (struct rk3x_i2c_soc_data *)match->data;
+        if (of_property_read_u32(pdev->dev.of_node, "clock-frequency",
+                                 &i2c->scl_frequency)) {
+                dev_info(&pdev->dev, "using default SCL frequency: %d\n",
+                         DEFAULT_SCL_RATE);
+                i2c->scl_frequency = DEFAULT_SCL_RATE;
+        }
+        if (i2c->scl_frequency == 0 || i2c->scl_frequency > 400 * 1000) {
+                dev_warn(&pdev->dev, "invalid SCL frequency specified.\n");
+                dev_warn(&pdev->dev, "using default SCL frequency: %d\n",
+                         DEFAULT_SCL_RATE);
+                i2c->scl_frequency = DEFAULT_SCL_RATE;
+        }
+        strlcpy(i2c->adap.name, "rk3x-i2c", sizeof(i2c->adap.name));
+        i2c->adap.owner = THIS_MODULE;
+        i2c->adap.algo = &rk3x_i2c_algorithm;
+        i2c->adap.retries = 3;
+        i2c->adap.dev.of_node = np;
+        i2c->adap.algo_data = i2c;
+        i2c->adap.dev.parent = &pdev->dev;
+        i2c->dev = &pdev->dev;
+        spin_lock_init(&i2c->lock);
+        init_waitqueue_head(&i2c->wait);
+        i2c->clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(i2c->clk)) {
+                dev_err(&pdev->dev, "cannot get clock\n");
+                return PTR_ERR(i2c->clk);
+        }
+        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        i2c->regs = devm_ioremap_resource(&pdev->dev, mem);
+        if (IS_ERR(i2c->regs))
+                return PTR_ERR(i2c->regs);
+        /* Try to set the I2C adapter number from dt */
+        bus_nr = of_alias_get_id(np, "i2c");
+        /*
+         * Switch to new interface if the SoC also offers the old one.
+         * The control bit is located in the GRF register space.
+         */
+        if (i2c->soc_data->grf_offset >= 0) {
+                struct regmap *grf;
+                grf = syscon_regmap_lookup_by_phandle(np, "rockchip,grf");
+                if (IS_ERR(grf)) {
+                        dev_err(&pdev->dev,
+                                "rk3x-i2c needs 'rockchip,grf' property\n");
+                        return PTR_ERR(grf);
+                }
+                if (bus_nr < 0) {
+                        dev_err(&pdev->dev, "rk3x-i2c needs i2cX alias");
+                        return -EINVAL;
+                }
+                /* 27+i: write mask, 11+i: value */
+                value = BIT(27 + bus_nr) | BIT(11 + bus_nr);
+                ret = regmap_write(grf, i2c->soc_data->grf_offset, value);
+                if (ret != 0) {
+                        dev_err(i2c->dev, "Could not write to GRF: %d\n", ret);
+                        return ret;
+                }
+        }
+        /* IRQ setup */
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "cannot find rk3x IRQ\n");
+                return irq;
+        }
+        ret = devm_request_irq(&pdev->dev, irq, rk3x_i2c_irq,
+                               0, dev_name(&pdev->dev), i2c);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "cannot request IRQ\n");
+                return ret;
+        }
+        platform_set_drvdata(pdev, i2c);
+        ret = clk_prepare(i2c->clk);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Could not prepare clock\n");
+                return ret;
+        }
+        ret = i2c_add_adapter(&i2c->adap);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Could not register adapter\n");
+                goto err_clk;
+        }
+        dev_info(&pdev->dev, "Initialized RK3xxx I2C bus at %p\n", i2c->regs);
+        return 0;
+err_clk:
+        clk_unprepare(i2c->clk);
+        return ret;
+}
+static int rk3x_i2c_remove(struct platform_device *pdev)
+{
+        struct rk3x_i2c *i2c = platform_get_drvdata(pdev);
+        i2c_del_adapter(&i2c->adap);
+        clk_unprepare(i2c->clk);
+        return 0;
+}
+static struct platform_driver rk3x_i2c_driver = {
+        .probe   = rk3x_i2c_probe,
+        .remove  = rk3x_i2c_remove,
+        .driver  = {
+                .owner = THIS_MODULE,
+                .name  = "rk3x-i2c",
+                .of_match_table = rk3x_i2c_match,
+        },
+};
+module_platform_driver(rk3x_i2c_driver);
+MODULE_DESCRIPTION("Rockchip RK3xxx I2C Bus driver");
+MODULE_AUTHOR("Max Schwarz <max.schwarz@online.de>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
new file mode 100644
index 000000000000..4d75d4759709
--- /dev/null
+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
@@ -0,0 +1,344 @@
+/*
+ * P2WI (Push-Pull Two Wire Interface) bus driver.
+ *
+ * Author: Boris BREZILLON <boris.brezillon@free-electrons.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ *
+ * The P2WI controller looks like an SMBus controller which only supports byte
+ * data transfers. But, it differs from standard SMBus protocol on several
+ * aspects:
+ * - it supports only one slave device, and thus drop the address field
+ * - it adds a parity bit every 8bits of data
+ * - only one read access is required to read a byte (instead of a write
+ *   followed by a read access in standard SMBus protocol)
+ * - there's no Ack bit after each byte transfer
+ *
+ * This means this bus cannot be used to interface with standard SMBus
+ * devices (the only known device to support this interface is the AXP221
+ * PMIC).
+ *
+ */
+#include <linux/clk.h>
+#include <linux/i2c.h>
+#include <linux/io.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/reset.h>
+/* P2WI registers */
+#define P2WI_CTRL               0x0
+#define P2WI_CCR                0x4
+#define P2WI_INTE               0x8
+#define P2WI_INTS               0xc
+#define P2WI_DADDR0             0x10
+#define P2WI_DADDR1             0x14
+#define P2WI_DLEN               0x18
+#define P2WI_DATA0              0x1c
+#define P2WI_DATA1              0x20
+#define P2WI_LCR                0x24
+#define P2WI_PMCR               0x28
+/* CTRL fields */
+#define P2WI_CTRL_START_TRANS           BIT(7)
+#define P2WI_CTRL_ABORT_TRANS           BIT(6)
+#define P2WI_CTRL_GLOBAL_INT_ENB        BIT(1)
+#define P2WI_CTRL_SOFT_RST              BIT(0)
+/* CLK CTRL fields */
+#define P2WI_CCR_SDA_OUT_DELAY(v)       (((v) & 0x7) << 8)
+#define P2WI_CCR_MAX_CLK_DIV            0xff
+#define P2WI_CCR_CLK_DIV(v)             ((v) & P2WI_CCR_MAX_CLK_DIV)
+/* STATUS fields */
+#define P2WI_INTS_TRANS_ERR_ID(v)       (((v) >> 8) & 0xff)
+#define P2WI_INTS_LOAD_BSY              BIT(2)
+#define P2WI_INTS_TRANS_ERR             BIT(1)
+#define P2WI_INTS_TRANS_OVER            BIT(0)
+/* DATA LENGTH fields*/
+#define P2WI_DLEN_READ                  BIT(4)
+#define P2WI_DLEN_DATA_LENGTH(v)        ((v - 1) & 0x7)
+/* LINE CTRL fields*/
+#define P2WI_LCR_SCL_STATE              BIT(5)
+#define P2WI_LCR_SDA_STATE              BIT(4)
+#define P2WI_LCR_SCL_CTL                BIT(3)
+#define P2WI_LCR_SCL_CTL_EN             BIT(2)
+#define P2WI_LCR_SDA_CTL                BIT(1)
+#define P2WI_LCR_SDA_CTL_EN             BIT(0)
+/* PMU MODE CTRL fields */
+#define P2WI_PMCR_PMU_INIT_SEND         BIT(31)
+#define P2WI_PMCR_PMU_INIT_DATA(v)      (((v) & 0xff) << 16)
+#define P2WI_PMCR_PMU_MODE_REG(v)       (((v) & 0xff) << 8)
+#define P2WI_PMCR_PMU_DEV_ADDR(v)       ((v) & 0xff)
+#define P2WI_MAX_FREQ                   6000000
+struct p2wi {
+        struct i2c_adapter adapter;
+        struct completion complete;
+        unsigned int status;
+        void __iomem *regs;
+        struct clk *clk;
+        struct reset_control *rstc;
+        int slave_addr;
+};
+static irqreturn_t p2wi_interrupt(int irq, void *dev_id)
+{
+        struct p2wi *p2wi = dev_id;
+        unsigned long status;
+        status = readl(p2wi->regs + P2WI_INTS);
+        p2wi->status = status;
+        /* Clear interrupts */
+        status &= (P2WI_INTS_LOAD_BSY | P2WI_INTS_TRANS_ERR |
+                   P2WI_INTS_TRANS_OVER);
+        writel(status, p2wi->regs + P2WI_INTS);
+        complete(&p2wi->complete);
+        return IRQ_HANDLED;
+}
+static u32 p2wi_functionality(struct i2c_adapter *adap)
+{
+        return I2C_FUNC_SMBUS_BYTE_DATA;
+}
+static int p2wi_smbus_xfer(struct i2c_adapter *adap, u16 addr,
+                           unsigned short flags, char read_write,
+                           u8 command, int size, union i2c_smbus_data *data)
+{
+        struct p2wi *p2wi = i2c_get_adapdata(adap);
+        unsigned long dlen = P2WI_DLEN_DATA_LENGTH(1);
+        if (p2wi->slave_addr >= 0 && addr != p2wi->slave_addr) {
+                dev_err(&adap->dev, "invalid P2WI address\n");
+                return -EINVAL;
+        }
+        if (!data)
+                return -EINVAL;
+        writel(command, p2wi->regs + P2WI_DADDR0);
+        if (read_write == I2C_SMBUS_READ)
+                dlen |= P2WI_DLEN_READ;
+        else
+                writel(data->byte, p2wi->regs + P2WI_DATA0);
+        writel(dlen, p2wi->regs + P2WI_DLEN);
+        if (readl(p2wi->regs + P2WI_CTRL) & P2WI_CTRL_START_TRANS) {
+                dev_err(&adap->dev, "P2WI bus busy\n");
+                return -EBUSY;
+        }
+        reinit_completion(&p2wi->complete);
+        writel(P2WI_INTS_LOAD_BSY | P2WI_INTS_TRANS_ERR | P2WI_INTS_TRANS_OVER,
+               p2wi->regs + P2WI_INTE);
+        writel(P2WI_CTRL_START_TRANS | P2WI_CTRL_GLOBAL_INT_ENB,
+               p2wi->regs + P2WI_CTRL);
+        wait_for_completion(&p2wi->complete);
+        if (p2wi->status & P2WI_INTS_LOAD_BSY) {
+                dev_err(&adap->dev, "P2WI bus busy\n");
+                return -EBUSY;
+        }
+        if (p2wi->status & P2WI_INTS_TRANS_ERR) {
+                dev_err(&adap->dev, "P2WI bus xfer error\n");
+                return -ENXIO;
+        }
+        if (read_write == I2C_SMBUS_READ)
+                data->byte = readl(p2wi->regs + P2WI_DATA0);
+        return 0;
+}
+static const struct i2c_algorithm p2wi_algo = {
+        .smbus_xfer = p2wi_smbus_xfer,
+        .functionality = p2wi_functionality,
+};
+static const struct of_device_id p2wi_of_match_table[] = {
+        { .compatible = "allwinner,sun6i-a31-p2wi" },
+        {}
+};
+MODULE_DEVICE_TABLE(of, p2wi_of_match_table);
+static int p2wi_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device_node *np = dev->of_node;
+        struct device_node *childnp;
+        unsigned long parent_clk_freq;
+        u32 clk_freq = 100000;
+        struct resource *r;
+        struct p2wi *p2wi;
+        u32 slave_addr;
+        int clk_div;
+        int irq;
+        int ret;
+        of_property_read_u32(np, "clock-frequency", &clk_freq);
+        if (clk_freq > P2WI_MAX_FREQ) {
+                dev_err(dev,
+                        "required clock-frequency (%u Hz) is too high (max = 6MHz)",
+                        clk_freq);
+                return -EINVAL;
+        }
+        if (of_get_child_count(np) > 1) {
+                dev_err(dev, "P2WI only supports one slave device\n");
+                return -EINVAL;
+        }
+        p2wi = devm_kzalloc(dev, sizeof(struct p2wi), GFP_KERNEL);
+        if (!p2wi)
+                return -ENOMEM;
+        p2wi->slave_addr = -1;
+        /*
+         * Authorize a p2wi node without any children to be able to use an
+         * i2c-dev from userpace.
+         * In this case the slave_addr is set to -1 and won't be checked when
+         * launching a P2WI transfer.
+         */
+        childnp = of_get_next_available_child(np, NULL);
+        if (childnp) {
+                ret = of_property_read_u32(childnp, "reg", &slave_addr);
+                if (ret) {
+                        dev_err(dev, "invalid slave address on node %s\n",
+                                childnp->full_name);
+                        return -EINVAL;
+                }
+                p2wi->slave_addr = slave_addr;
+        }
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        p2wi->regs = devm_ioremap_resource(dev, r);
+        if (IS_ERR(p2wi->regs))
+                return PTR_ERR(p2wi->regs);
+        strlcpy(p2wi->adapter.name, pdev->name, sizeof(p2wi->adapter.name));
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(dev, "failed to retrieve irq: %d\n", irq);
+                return irq;
+        }
+        p2wi->clk = devm_clk_get(dev, NULL);
+        if (IS_ERR(p2wi->clk)) {
+                ret = PTR_ERR(p2wi->clk);
+                dev_err(dev, "failed to retrieve clk: %d\n", ret);
+                return ret;
+        }
+        ret = clk_prepare_enable(p2wi->clk);
+        if (ret) {
+                dev_err(dev, "failed to enable clk: %d\n", ret);
+                return ret;
+        }
+        parent_clk_freq = clk_get_rate(p2wi->clk);
+        p2wi->rstc = devm_reset_control_get(dev, NULL);
+        if (IS_ERR(p2wi->rstc)) {
+                ret = PTR_ERR(p2wi->rstc);
+                dev_err(dev, "failed to retrieve reset controller: %d\n", ret);
+                goto err_clk_disable;
+        }
+        ret = reset_control_deassert(p2wi->rstc);
+        if (ret) {
+                dev_err(dev, "failed to deassert reset line: %d\n", ret);
+                goto err_clk_disable;
+        }
+        init_completion(&p2wi->complete);
+        p2wi->adapter.dev.parent = dev;
+        p2wi->adapter.algo = &p2wi_algo;
+        p2wi->adapter.owner = THIS_MODULE;
+        p2wi->adapter.dev.of_node = pdev->dev.of_node;
+        platform_set_drvdata(pdev, p2wi);
+        i2c_set_adapdata(&p2wi->adapter, p2wi);
+        ret = devm_request_irq(dev, irq, p2wi_interrupt, 0, pdev->name, p2wi);
+        if (ret) {
+                dev_err(dev, "can't register interrupt handler irq%d: %d\n",
+                        irq, ret);
+                goto err_reset_assert;
+        }
+        writel(P2WI_CTRL_SOFT_RST, p2wi->regs + P2WI_CTRL);
+        clk_div = parent_clk_freq / clk_freq;
+        if (!clk_div) {
+                dev_warn(dev,
+                         "clock-frequency is too high, setting it to %lu Hz\n",
+                         parent_clk_freq);
+                clk_div = 1;
+        } else if (clk_div > P2WI_CCR_MAX_CLK_DIV) {
+                dev_warn(dev,
+                         "clock-frequency is too low, setting it to %lu Hz\n",
+                         parent_clk_freq / P2WI_CCR_MAX_CLK_DIV);
+                clk_div = P2WI_CCR_MAX_CLK_DIV;
+        }
+        writel(P2WI_CCR_SDA_OUT_DELAY(1) | P2WI_CCR_CLK_DIV(clk_div),
+               p2wi->regs + P2WI_CCR);
+        ret = i2c_add_adapter(&p2wi->adapter);
+        if (!ret)
+                return 0;
+err_reset_assert:
+        reset_control_assert(p2wi->rstc);
+err_clk_disable:
+        clk_disable_unprepare(p2wi->clk);
+        return ret;
+}
+static int p2wi_remove(struct platform_device *dev)
+{
+        struct p2wi *p2wi = platform_get_drvdata(dev);
+        reset_control_assert(p2wi->rstc);
+        clk_disable_unprepare(p2wi->clk);
+        i2c_del_adapter(&p2wi->adapter);
+        return 0;
+}
+static struct platform_driver p2wi_driver = {
+        .probe  = p2wi_probe,
+        .remove = p2wi_remove,
+        .driver = {
+                .owner = THIS_MODULE,
+                .name = "i2c-sunxi-p2wi",
+                .of_match_table = p2wi_of_match_table,
+        },
+};
+module_platform_driver(p2wi_driver);
+MODULE_AUTHOR("Boris BREZILLON <boris.brezillon@free-electrons.com>");
+MODULE_DESCRIPTION("Allwinner P2WI driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig
index f7f9865b8b89..f6d313e528de 100644
--- a/drivers/i2c/muxes/Kconfig
+++ b/drivers/i2c/muxes/Kconfig
@@ -40,6 +40,7 @@ config I2C_MUX_PCA9541
 config I2C_MUX_PCA954x
        tristate "Philips PCA954x I2C Mux/switches"
+        depends on GPIOLIB
        help
          If you say yes here you get support for the Philips PCA954x
          I2C mux/switch devices.
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 8fb46aab2d87..a04c49f2a011 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -416,6 +416,7 @@ config BLK_DEV_CY82C693
 config BLK_DEV_CS5520
        tristate "Cyrix CS5510/20 MediaGX chipset support (VERY EXPERIMENTAL)"
+        depends on X86_32 || COMPILE_TEST
        select BLK_DEV_IDEDMA_PCI
        help
          Include support for PIO tuning and virtual DMA on the Cyrix MediaGX
@@ -426,6 +427,7 @@ config BLK_DEV_CS5520
 config BLK_DEV_CS5530
        tristate "Cyrix/National Semiconductor CS5530 MediaGX chipset support"
+        depends on X86_32 || COMPILE_TEST
        select BLK_DEV_IDEDMA_PCI
        help
          Include support for UDMA on the Cyrix MediaGX 5530 chipset. This
@@ -435,7 +437,7 @@ config BLK_DEV_CS5530
 config BLK_DEV_CS5535
        tristate "AMD CS5535 chipset support"
-        depends on X86 && !X86_64
+        depends on X86_32
        select BLK_DEV_IDEDMA_PCI
        help
          Include support for UDMA on the NSC/AMD CS5535 companion chipset.
@@ -486,6 +488,7 @@ config BLK_DEV_JMICRON
 config BLK_DEV_SC1200
        tristate "National SCx200 chipset support"
+        depends on X86_32 || COMPILE_TEST
        select BLK_DEV_IDEDMA_PCI
        help
          This driver adds support for the on-board IDE controller on the
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 2a744a91370e..a3d3b1733c49 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -853,8 +853,9 @@ static int init_irq (ide_hwif_t *hwif)
        if (irq_handler == NULL)
                irq_handler = ide_intr;
-        if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
+        if (!host->get_lock)
-                goto out_up;
+                if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
+                        goto out_up;
 #if !defined(__mc68000__)
        printk(KERN_INFO "%s at 0x%03lx-0x%03lx,0x%03lx on irq %d", hwif->name,
@@ -1533,7 +1534,8 @@ static void ide_unregister(ide_hwif_t *hwif)
        ide_proc_unregister_port(hwif);
-        free_irq(hwif->irq, hwif);
+        if (!hwif->host->get_lock)
+                free_irq(hwif->irq, hwif);
        device_unregister(hwif->portdev);
        device_unregister(&hwif->gendev);
diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index a7e68c81f89d..a077cc86421b 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -68,13 +68,13 @@
 /* Defaults values */
 #define BMA180_DEF_PMODE        0
 #define BMA180_DEF_BW           20
-#define BMA180_DEF_SCALE        250
+#define BMA180_DEF_SCALE        2452
 /* Available values for sysfs */
 #define BMA180_FLP_FREQ_AVAILABLE \
        "10 20 40 75 150 300"
 #define BMA180_SCALE_AVAILABLE \
-        "0.000130 0.000190 0.000250 0.000380 0.000500 0.000990 0.001980"
+        "0.001275 0.001863 0.002452 0.003727 0.004903 0.009709 0.019417"
 struct bma180_data {
        struct i2c_client *client;
@@ -94,7 +94,7 @@ enum bma180_axis {
 };
 static int bw_table[] = { 10, 20, 40, 75, 150, 300 }; /* Hz */
-static int scale_table[] = { 130, 190, 250, 380, 500, 990, 1980 };
+static int scale_table[] = { 1275, 1863, 2452, 3727, 4903, 9709, 19417 };
 static int bma180_get_acc_reg(struct bma180_data *data, enum bma180_axis axis)
 {
@@ -376,6 +376,8 @@ static int bma180_write_raw(struct iio_dev *indio_dev,
                mutex_unlock(&data->mutex);
                return ret;
        case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY:
+                if (val2)
+                        return -EINVAL;
                mutex_lock(&data->mutex);
                ret = bma180_set_bw(data, val);
                mutex_unlock(&data->mutex);
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index 69abf9163df7..54e464e4bb72 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -110,7 +110,6 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
        struct accel_3d_state *accel_state = iio_priv(indio_dev);
        int report_id = -1;
        u32 address;
-        int ret;
        int ret_type;
        s32 poll_value;
@@ -151,14 +150,12 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
                ret_type = IIO_VAL_INT;
                break;
        case IIO_CHAN_INFO_SAMP_FREQ:
-                ret = hid_sensor_read_samp_freq_value(
+                ret_type = hid_sensor_read_samp_freq_value(
                        &accel_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        case IIO_CHAN_INFO_HYSTERESIS:
-                ret = hid_sensor_read_raw_hyst_value(
+                ret_type = hid_sensor_read_raw_hyst_value(
                        &accel_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        default:
                ret_type = -EINVAL;
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 17aeea170566..2a5fa9a436e5 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -111,8 +111,14 @@ static const int mma8452_samp_freq[8][2] = {
        {6, 250000}, {1, 560000}
 };
+/* 
+ * Hardware has fullscale of -2G, -4G, -8G corresponding to raw value -2048
+ * The userspace interface uses m/s^2 and we declare micro units
+ * So scale factor is given by:
+ *      g * N * 1000000 / 2048 for N = 2, 4, 8 and g=9.80665
+ */
 static const int mma8452_scales[3][2] = {
-        {0, 977}, {0, 1953}, {0, 3906}
+        {0, 9577}, {0, 19154}, {0, 38307}
 };
 static ssize_t mma8452_show_samp_freq_avail(struct device *dev,
diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
index 39b4cb48d738..6eba301ee03d 100644
--- a/drivers/iio/adc/ad799x.c
+++ b/drivers/iio/adc/ad799x.c
@@ -427,9 +427,12 @@ static int ad799x_write_event_value(struct iio_dev *indio_dev,
        int ret;
        struct ad799x_state *st = iio_priv(indio_dev);
+        if (val < 0 || val > RES_MASK(chan->scan_type.realbits))
+                return -EINVAL;
        mutex_lock(&indio_dev->mlock);
        ret = ad799x_i2c_write16(st, ad799x_threshold_reg(chan, dir, info),
-                val);
+                val << chan->scan_type.shift);
        mutex_unlock(&indio_dev->mlock);
        return ret;
@@ -452,7 +455,8 @@ static int ad799x_read_event_value(struct iio_dev *indio_dev,
        mutex_unlock(&indio_dev->mlock);
        if (ret < 0)
                return ret;
-        *val = valin;
+        *val = (valin >> chan->scan_type.shift) &
+                RES_MASK(chan->scan_type.realbits);
        return IIO_VAL_INT;
 }
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 3b5bacd4d8da..2b6a9ce9927c 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -510,12 +510,11 @@ static int at91_adc_channel_init(struct iio_dev *idev)
        return idev->num_channels;
 }
-static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
+static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
                                             struct at91_adc_trigger *triggers,
                                             const char *trigger_name)
 {
        struct at91_adc_state *st = iio_priv(idev);
-        u8 value = 0;
        int i;
        for (i = 0; i < st->trigger_number; i++) {
@@ -528,15 +527,16 @@ static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
                        return -ENOMEM;
                if (strcmp(trigger_name, name) == 0) {
-                        value = triggers[i].value;
                        kfree(name);
-                        break;
+                        if (triggers[i].value == 0)
+                                return -EINVAL;
+                        return triggers[i].value;
                }
                kfree(name);
        }
-        return value;
+        return -EINVAL;
 }
 static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
@@ -546,14 +546,14 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
        struct iio_buffer *buffer = idev->buffer;
        struct at91_adc_reg_desc *reg = st->registers;
        u32 status = at91_adc_readl(st, reg->trigger_register);
-        u8 value;
+        int value;
        u8 bit;
        value = at91_adc_get_trigger_value_by_name(idev,
                                                   st->trigger_list,
                                                   idev->trig->name);
-        if (value == 0)
+        if (value < 0)
-                return -EINVAL;
+                return value;
        if (state) {
                st->buffer = kmalloc(idev->scan_bytes, GFP_KERNEL);
diff --git a/drivers/iio/adc/men_z188_adc.c b/drivers/iio/adc/men_z188_adc.c
index 6989c16aec2b..b58d6302521f 100644
--- a/drivers/iio/adc/men_z188_adc.c
+++ b/drivers/iio/adc/men_z188_adc.c
@@ -121,8 +121,8 @@ static int men_z188_probe(struct mcb_device *dev,
        indio_dev->num_channels = ARRAY_SIZE(z188_adc_iio_channels);
        mem = mcb_request_mem(dev, "z188-adc");
-        if (!mem)
+        if (IS_ERR(mem))
-                return -ENOMEM;
+                return PTR_ERR(mem);
        adc->base = ioremap(mem->start, resource_size(mem));
        if (adc->base == NULL)
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index a4db3026bec6..d5dc4c6ce86c 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -374,7 +374,7 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
                        return -EAGAIN;
                }
        }
-        map_val = chan->channel + TOTAL_CHANNELS;
+        map_val = adc_dev->channel_step[chan->scan_index];
        /*
         * We check the complete FIFO. We programmed just one entry but in case
diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
index 7de1c4c87942..eb86786e698e 100644
--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -645,6 +645,7 @@ int twl4030_get_madc_conversion(int channel_no)
        req.channels = (1 << channel_no);
        req.method = TWL4030_MADC_SW2;
        req.active = 0;
+        req.raw = 0;
        req.func_cb = NULL;
        ret = twl4030_madc_conversion(&req);
        if (ret < 0)
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index 73282cee0c81..a3109a6f4d86 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -75,6 +75,9 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                                        (s32)report_val);
        }
+        sensor_hub_get_feature(st->hsdev, st->power_state.report_id,
+                                        st->power_state.index,
+                                        &state_val);
        return 0;
 }
 EXPORT_SYMBOL(hid_sensor_power_state);
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index 40f4e4935d0d..fa034a3dad78 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -110,7 +110,6 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
        struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
        int report_id = -1;
        u32 address;
-        int ret;
        int ret_type;
        s32 poll_value;
@@ -151,14 +150,12 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
                ret_type = IIO_VAL_INT;
                break;
        case IIO_CHAN_INFO_SAMP_FREQ:
-                ret = hid_sensor_read_samp_freq_value(
+                ret_type = hid_sensor_read_samp_freq_value(
                        &gyro_state->common_attributes, val, val2);
-                        ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        case IIO_CHAN_INFO_HYSTERESIS:
-                ret = hid_sensor_read_raw_hyst_value(
+                ret_type = hid_sensor_read_raw_hyst_value(
                        &gyro_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        default:
                ret_type = -EINVAL;
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 36b1ae92e239..9f1a14009901 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -966,7 +966,7 @@ static int iio_buffer_update_demux(struct iio_dev *indio_dev,
        /* Now we have the two masks, work from least sig and build up sizes */
        for_each_set_bit(out_ind,
-                         indio_dev->active_scan_mask,
+                         buffer->scan_mask,
                         indio_dev->masklength) {
                in_ind = find_next_bit(indio_dev->active_scan_mask,
                                       indio_dev->masklength,
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
index 258a973a1fb8..bfbf4d419f41 100644
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -345,6 +345,9 @@ static int iio_device_add_event(struct iio_dev *indio_dev,
                        &indio_dev->event_interface->dev_attr_list);
                kfree(postfix);
+                if ((ret == -EBUSY) && (shared_by != IIO_SEPARATE))
+                        continue;
                if (ret)
                        return ret;
diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index d833d55052ea..c7497009d60a 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -183,7 +183,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
                else if (name && index >= 0) {
                        pr_err("ERROR: could not get IIO channel %s:%s(%i)\n",
                                np->full_name, name ? name : "", index);
-                        return chan;
+                        return NULL;
                }
                /*
@@ -193,8 +193,9 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
                 */
                np = np->parent;
                if (np && !of_get_property(np, "io-channel-ranges", NULL))
-                        break;
+                        return NULL;
        }
        return chan;
 }
@@ -317,6 +318,7 @@ struct iio_channel *iio_channel_get(struct device *dev,
                if (channel != NULL)
                        return channel;
        }
        return iio_channel_get_sys(name, channel_name);
 }
 EXPORT_SYMBOL_GPL(iio_channel_get);
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index f34c94380b41..96e71e103ea7 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -79,7 +79,6 @@ static int als_read_raw(struct iio_dev *indio_dev,
        struct als_state *als_state = iio_priv(indio_dev);
        int report_id = -1;
        u32 address;
-        int ret;
        int ret_type;
        s32 poll_value;
@@ -129,14 +128,12 @@ static int als_read_raw(struct iio_dev *indio_dev,
                ret_type = IIO_VAL_INT;
                break;
        case IIO_CHAN_INFO_SAMP_FREQ:
-                ret = hid_sensor_read_samp_freq_value(
+                ret_type = hid_sensor_read_samp_freq_value(
                                &als_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        case IIO_CHAN_INFO_HYSTERESIS:
-                ret = hid_sensor_read_raw_hyst_value(
+                ret_type = hid_sensor_read_raw_hyst_value(
                                &als_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        default:
                ret_type = -EINVAL;
diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
index d203ef4d892f..412bae86d6ae 100644
--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@@ -74,7 +74,6 @@ static int prox_read_raw(struct iio_dev *indio_dev,
        struct prox_state *prox_state = iio_priv(indio_dev);
        int report_id = -1;
        u32 address;
-        int ret;
        int ret_type;
        s32 poll_value;
@@ -125,14 +124,12 @@ static int prox_read_raw(struct iio_dev *indio_dev,
                ret_type = IIO_VAL_INT;
                break;
        case IIO_CHAN_INFO_SAMP_FREQ:
-                ret = hid_sensor_read_samp_freq_value(
+                ret_type = hid_sensor_read_samp_freq_value(
                                &prox_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        case IIO_CHAN_INFO_HYSTERESIS:
-                ret = hid_sensor_read_raw_hyst_value(
+                ret_type = hid_sensor_read_raw_hyst_value(
                                &prox_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        default:
                ret_type = -EINVAL;
diff --git a/drivers/iio/light/tcs3472.c b/drivers/iio/light/tcs3472.c
index fe063a0a21cd..752569985d1d 100644
--- a/drivers/iio/light/tcs3472.c
+++ b/drivers/iio/light/tcs3472.c
@@ -52,6 +52,7 @@
 struct tcs3472_data {
        struct i2c_client *client;
+        struct mutex lock;
        u8 enable;
        u8 control;
        u8 atime;
@@ -116,10 +117,17 @@ static int tcs3472_read_raw(struct iio_dev *indio_dev,
        switch (mask) {
        case IIO_CHAN_INFO_RAW:
+                if (iio_buffer_enabled(indio_dev))
+                        return -EBUSY;
+                mutex_lock(&data->lock);
                ret = tcs3472_req_data(data);
-                if (ret < 0)
+                if (ret < 0) {
+                        mutex_unlock(&data->lock);
                        return ret;
+                }
                ret = i2c_smbus_read_word_data(data->client, chan->address);
+                mutex_unlock(&data->lock);
                if (ret < 0)
                        return ret;
                *val = ret;
@@ -255,6 +263,7 @@ static int tcs3472_probe(struct i2c_client *client,
        data = iio_priv(indio_dev);
        i2c_set_clientdata(client, indio_dev);
        data->client = client;
+        mutex_init(&data->lock);
        indio_dev->dev.parent = &client->dev;
        indio_dev->info = &tcs3472_info;
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index 09ea5c481f4c..ea08313af0d2 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -373,8 +373,6 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val)
 {
        struct ak8975_data *data = iio_priv(indio_dev);
        struct i2c_client *client = data->client;
-        u16 meas_reg;
-        s16 raw;
        int ret;
        mutex_lock(&data->lock);
@@ -422,16 +420,11 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val)
                dev_err(&client->dev, "Read axis data fails\n");
                goto exit;
        }
-        meas_reg = ret;
        mutex_unlock(&data->lock);
-        /* Endian conversion of the measured values. */
-        raw = (s16) (le16_to_cpu(meas_reg));
        /* Clamp to valid range. */
-        raw = clamp_t(s16, raw, -4096, 4095);
+        *val = clamp_t(s16, ret, -4096, 4095);
-        *val = raw;
        return IIO_VAL_INT;
 exit:
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index 41cf29e2a371..b2b0937d5133 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -110,7 +110,6 @@ static int magn_3d_read_raw(struct iio_dev *indio_dev,
        struct magn_3d_state *magn_state = iio_priv(indio_dev);
        int report_id = -1;
        u32 address;
-        int ret;
        int ret_type;
        s32 poll_value;
@@ -153,14 +152,12 @@ static int magn_3d_read_raw(struct iio_dev *indio_dev,
                ret_type = IIO_VAL_INT;
                break;
        case IIO_CHAN_INFO_SAMP_FREQ:
-                ret = hid_sensor_read_samp_freq_value(
+                ret_type = hid_sensor_read_samp_freq_value(
                        &magn_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        case IIO_CHAN_INFO_HYSTERESIS:
-                ret = hid_sensor_read_raw_hyst_value(
+                ret_type = hid_sensor_read_raw_hyst_value(
                        &magn_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        default:
                ret_type = -EINVAL;
diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
index 1cd190c73788..2c0d2a4fed8c 100644
--- a/drivers/iio/pressure/hid-sensor-press.c
+++ b/drivers/iio/pressure/hid-sensor-press.c
@@ -78,7 +78,6 @@ static int press_read_raw(struct iio_dev *indio_dev,
        struct press_state *press_state = iio_priv(indio_dev);
        int report_id = -1;
        u32 address;
-        int ret;
        int ret_type;
        s32 poll_value;
@@ -128,14 +127,12 @@ static int press_read_raw(struct iio_dev *indio_dev,
                ret_type = IIO_VAL_INT;
                break;
        case IIO_CHAN_INFO_SAMP_FREQ:
-                ret = hid_sensor_read_samp_freq_value(
+                ret_type = hid_sensor_read_samp_freq_value(
                                &press_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        case IIO_CHAN_INFO_HYSTERESIS:
-                ret = hid_sensor_read_raw_hyst_value(
+                ret_type = hid_sensor_read_raw_hyst_value(
                                &press_state->common_attributes, val, val2);
-                ret_type = IIO_VAL_INT_PLUS_MICRO;
                break;
        default:
                ret_type = -EINVAL;
diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c
index ba6d0c520e63..01b2e0b18878 100644
--- a/drivers/iio/pressure/mpl3115.c
+++ b/drivers/iio/pressure/mpl3115.c
@@ -98,7 +98,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev,
                        mutex_unlock(&data->lock);
                        if (ret < 0)
                                return ret;
-                        *val = sign_extend32(be32_to_cpu(tmp) >> 12, 23);
+                        *val = be32_to_cpu(tmp) >> 12;
                        return IIO_VAL_INT;
                case IIO_TEMP: /* in 0.0625 celsius / LSB */
                        mutex_lock(&data->lock);
@@ -112,7 +112,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev,
                        mutex_unlock(&data->lock);
                        if (ret < 0)
                                return ret;
-                        *val = sign_extend32(be32_to_cpu(tmp) >> 20, 15);
+                        *val = sign_extend32(be32_to_cpu(tmp) >> 20, 11);
                        return IIO_VAL_INT;
                default:
                        return -EINVAL;
@@ -185,7 +185,7 @@ static const struct iio_chan_spec mpl3115_channels[] = {
                        BIT(IIO_CHAN_INFO_SCALE),
                .scan_index = 0,
                .scan_type = {
-                        .sign = 's',
+                        .sign = 'u',
                        .realbits = 20,
                        .storagebits = 32,
                        .shift = 12,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 5e153f6d4b48..768a0fb67dd6 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -432,8 +432,17 @@ static void arp_failure_discard(void *handle, struct sk_buff *skb)
 */
 static void act_open_req_arp_failure(void *handle, struct sk_buff *skb)
 {
+        struct c4iw_ep *ep = handle;
        printk(KERN_ERR MOD "ARP failure duing connect\n");
        kfree_skb(skb);
+        connect_reply_upcall(ep, -EHOSTUNREACH);
+        state_set(&ep->com, DEAD);
+        remove_handle(ep->com.dev, &ep->com.dev->atid_idr, ep->atid);
+        cxgb4_free_atid(ep->com.dev->rdev.lldi.tids, ep->atid);
+        dst_release(ep->dst);
+        cxgb4_l2t_release(ep->l2t);
+        c4iw_put_ep(&ep->com);
 }
 /*
@@ -658,7 +667,7 @@ static int send_connect(struct c4iw_ep *ep)
                opt2 |= T5_OPT_2_VALID;
                opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
        }
-        t4_set_arp_err_handler(skb, NULL, act_open_req_arp_failure);
+        t4_set_arp_err_handler(skb, ep, act_open_req_arp_failure);
        if (is_t4(ep->com.dev->rdev.lldi.adapter_type)) {
                if (ep->com.remote_addr.ss_family == AF_INET) {
@@ -2180,7 +2189,6 @@ static void reject_cr(struct c4iw_dev *dev, u32 hwtid, struct sk_buff *skb)
        PDBG("%s c4iw_dev %p tid %u\n", __func__, dev, hwtid);
        BUG_ON(skb_cloned(skb));
        skb_trim(skb, sizeof(struct cpl_tid_release));
-        skb_get(skb);
        release_tid(&dev->rdev, hwtid, skb);
        return;
 }
@@ -3917,7 +3925,7 @@ int __init c4iw_cm_init(void)
        return 0;
 }
-void __exit c4iw_cm_term(void)
+void c4iw_cm_term(void)
 {
        WARN_ON(!list_empty(&timeout_list));
        flush_workqueue(workq);
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index dd93aadc996e..7db82b24302b 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -696,6 +696,7 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
                pr_err(MOD "error allocating status page\n");
                goto err4;
        }
+        rdev->status_page->db_off = 0;
        return 0;
 err4:
        c4iw_rqtpool_destroy(rdev);
@@ -729,7 +730,6 @@ static void c4iw_dealloc(struct uld_ctx *ctx)
        if (ctx->dev->rdev.oc_mw_kva)
                iounmap(ctx->dev->rdev.oc_mw_kva);
        ib_dealloc_device(&ctx->dev->ibdev);
-        iwpm_exit(RDMA_NL_C4IW);
        ctx->dev = NULL;
 }
@@ -826,12 +826,6 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
                setup_debugfs(devp);
        }
-        ret = iwpm_init(RDMA_NL_C4IW);
-        if (ret) {
-                pr_err("port mapper initialization failed with %d\n", ret);
-                ib_dealloc_device(&devp->ibdev);
-                return ERR_PTR(ret);
-        }
        return devp;
 }
@@ -1332,6 +1326,15 @@ static int __init c4iw_init_module(void)
                pr_err("%s[%u]: Failed to add netlink callback\n"
                       , __func__, __LINE__);
+        err = iwpm_init(RDMA_NL_C4IW);
+        if (err) {
+                pr_err("port mapper initialization failed with %d\n", err);
+                ibnl_remove_client(RDMA_NL_C4IW);
+                c4iw_cm_term();
+                debugfs_remove_recursive(c4iw_debugfs_root);
+                return err;
+        }
        cxgb4_register_uld(CXGB4_ULD_RDMA, &c4iw_uld_info);
        return 0;
@@ -1349,6 +1352,7 @@ static void __exit c4iw_exit_module(void)
        }
        mutex_unlock(&dev_mutex);
        cxgb4_unregister_uld(CXGB4_ULD_RDMA);
+        iwpm_exit(RDMA_NL_C4IW);
        ibnl_remove_client(RDMA_NL_C4IW);
        c4iw_cm_term();
        debugfs_remove_recursive(c4iw_debugfs_root);
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 125bc5d1e175..361fff7a0742 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -908,7 +908,7 @@ int c4iw_destroy_ctrl_qp(struct c4iw_rdev *rdev);
 int c4iw_register_device(struct c4iw_dev *dev);
 void c4iw_unregister_device(struct c4iw_dev *dev);
 int __init c4iw_cm_init(void);
-void __exit c4iw_cm_term(void);
+void c4iw_cm_term(void);
 void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
                               struct c4iw_dev_ucontext *uctx);
 void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index d13ddf1c0033..bbbcf389272c 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -675,7 +675,7 @@ static int create_kernel_qp(struct mlx5_ib_dev *dev,
        int err;
        uuari = &dev->mdev.priv.uuari;
-        if (init_attr->create_flags & ~IB_QP_CREATE_SIGNATURE_EN)
+        if (init_attr->create_flags & ~(IB_QP_CREATE_SIGNATURE_EN | IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK))
                return -EINVAL;
        if (init_attr->qp_type == MLX5_IB_QPT_REG_UMR)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 1c4c0db05550..29ca0bb4f561 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -257,9 +257,10 @@ static int input_handle_abs_event(struct input_dev *dev,
 }
 static int input_get_disposition(struct input_dev *dev,
-                          unsigned int type, unsigned int code, int value)
+                          unsigned int type, unsigned int code, int *pval)
 {
        int disposition = INPUT_IGNORE_EVENT;
+        int value = *pval;
        switch (type) {
@@ -357,6 +358,7 @@ static int input_get_disposition(struct input_dev *dev,
                break;
        }
+        *pval = value;
        return disposition;
 }
@@ -365,7 +367,7 @@ static void input_handle_event(struct input_dev *dev,
 {
        int disposition;
-        disposition = input_get_disposition(dev, type, code, value);
+        disposition = input_get_disposition(dev, type, code, &value);
        if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event)
                dev->event(dev, type, code, value);
diff --git a/drivers/input/keyboard/st-keyscan.c b/drivers/input/keyboard/st-keyscan.c
index 758b48731415..de7be4f03d91 100644
--- a/drivers/input/keyboard/st-keyscan.c
+++ b/drivers/input/keyboard/st-keyscan.c
@@ -215,6 +215,7 @@ static int keyscan_probe(struct platform_device *pdev)
        return 0;
 }
+#ifdef CONFIG_PM_SLEEP
 static int keyscan_suspend(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
@@ -249,6 +250,7 @@ static int keyscan_resume(struct device *dev)
        mutex_unlock(&input->mutex);
        return retval;
 }
+#endif
 static SIMPLE_DEV_PM_OPS(keyscan_dev_pm_ops, keyscan_suspend, keyscan_resume);
diff --git a/drivers/input/misc/sirfsoc-onkey.c b/drivers/input/misc/sirfsoc-onkey.c
index e4104f9b2e6d..fed5102e1802 100644
--- a/drivers/input/misc/sirfsoc-onkey.c
+++ b/drivers/input/misc/sirfsoc-onkey.c
@@ -213,7 +213,7 @@ static struct platform_driver sirfsoc_pwrc_driver = {
 module_platform_driver(sirfsoc_pwrc_driver);
-MODULE_LICENSE("GPLv2");
+MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Binghua Duan <Binghua.Duan@csr.com>, Xianglong Du <Xianglong.Du@csr.com>");
 MODULE_DESCRIPTION("CSR Prima2 PWRC Driver");
 MODULE_ALIAS("platform:sirfsoc-pwrc");
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index ec772d962f06..ef9e0b8a9aa7 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -132,7 +132,8 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
                1232, 5710, 1156, 4696
        },
        {
-                (const char * const []){"LEN0034", "LEN0036", "LEN2004", NULL},
+                (const char * const []){"LEN0034", "LEN0036", "LEN2002",
+                                        "LEN2004", NULL},
                1024, 5112, 2024, 4832
        },
        {
@@ -168,7 +169,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
        "LEN0049",
        "LEN2000",
        "LEN2001", /* Edge E431 */
-        "LEN2002",
+        "LEN2002", /* Edge E531 */
        "LEN2003",
        "LEN2004", /* L440 */
        "LEN2005",
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 381b20d4c561..136b7b204f56 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -402,6 +402,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                },
        },
        {
+                /* Acer Aspire 5710 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5710"),
+                },
+        },
+        {
                /* Gericom Bellagio */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 977d05cd9e2e..e73cf2c71f35 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1217,9 +1217,9 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
                         * a=(pi*r^2)/C.
                         */
                        int a = data[5];
-                        int x_res  = input_abs_get_res(input, ABS_X);
+                        int x_res = input_abs_get_res(input, ABS_MT_POSITION_X);
-                        int y_res  = input_abs_get_res(input, ABS_Y);
+                        int y_res = input_abs_get_res(input, ABS_MT_POSITION_Y);
-                        width  = 2 * int_sqrt(a * WACOM_CONTACT_AREA_SCALE);
+                        width = 2 * int_sqrt(a * WACOM_CONTACT_AREA_SCALE);
                        height = width * y_res / x_res;
                }
@@ -1587,7 +1587,7 @@ static void wacom_abs_set_axis(struct input_dev *input_dev,
                input_abs_set_res(input_dev, ABS_X, features->x_resolution);
                input_abs_set_res(input_dev, ABS_Y, features->y_resolution);
        } else {
-                if (features->touch_max <= 2) {
+                if (features->touch_max == 1) {
                        input_set_abs_params(input_dev, ABS_X, 0,
                                features->x_max, features->x_fuzz, 0);
                        input_set_abs_params(input_dev, ABS_Y, 0,
@@ -1815,14 +1815,8 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
        case MTTPC:
        case MTTPC_B:
        case TABLETPC2FG:
-                if (features->device_type == BTN_TOOL_FINGER) {
+                if (features->device_type == BTN_TOOL_FINGER && features->touch_max > 1)
-                        unsigned int flags = INPUT_MT_DIRECT;
+                        input_mt_init_slots(input_dev, features->touch_max, INPUT_MT_DIRECT);
-                        if (wacom_wac->features.type == TABLETPC2FG)
-                                flags = 0;
-                        input_mt_init_slots(input_dev, features->touch_max, flags);
-                }
                /* fall through */
        case TABLETPC:
@@ -1883,10 +1877,6 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                        __set_bit(BTN_RIGHT, input_dev->keybit);
                        if (features->touch_max) {
-                                /* touch interface */
-                                unsigned int flags = INPUT_MT_POINTER;
-                                __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
                                if (features->pktlen == WACOM_PKGLEN_BBTOUCH3) {
                                        input_set_abs_params(input_dev,
                                                     ABS_MT_TOUCH_MAJOR,
@@ -1894,12 +1884,8 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                                        input_set_abs_params(input_dev,
                                                     ABS_MT_TOUCH_MINOR,
                                                     0, features->y_max, 0, 0);
-                                } else {
-                                        __set_bit(BTN_TOOL_FINGER, input_dev->keybit);
-                                        __set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
-                                        flags = 0;
                                }
-                                input_mt_init_slots(input_dev, features->touch_max, flags);
+                                input_mt_init_slots(input_dev, features->touch_max, INPUT_MT_POINTER);
                        } else {
                                /* buttons/keys only interface */
                                __clear_bit(ABS_X, input_dev->absbit);
diff --git a/drivers/input/touchscreen/ti_am335x_tsc.c b/drivers/input/touchscreen/ti_am335x_tsc.c
index 4e793a17361f..2ce649520fe0 100644
--- a/drivers/input/touchscreen/ti_am335x_tsc.c
+++ b/drivers/input/touchscreen/ti_am335x_tsc.c
@@ -359,9 +359,12 @@ static int titsc_parse_dt(struct platform_device *pdev,
         */
        err = of_property_read_u32(node, "ti,coordinate-readouts",
                        &ts_dev->coordinate_readouts);
-        if (err < 0)
+        if (err < 0) {
+                dev_warn(&pdev->dev, "please use 'ti,coordinate-readouts' instead\n");
                err = of_property_read_u32(node, "ti,coordiante-readouts",
                                &ts_dev->coordinate_readouts);
+        }
        if (err < 0)
                return err;
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index d4daa05efe60..499b4366a98d 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -45,7 +45,7 @@ struct pri_queue {
 struct pasid_state {
        struct list_head list;                  /* For global state-list */
        atomic_t count;                         /* Reference count */
-        atomic_t mmu_notifier_count;            /* Counting nested mmu_notifier
+        unsigned mmu_notifier_count;            /* Counting nested mmu_notifier
                                                   calls */
        struct task_struct *task;               /* Task bound to this PASID */
        struct mm_struct *mm;                   /* mm_struct for the faults */
@@ -53,7 +53,8 @@ struct pasid_state {
        struct pri_queue pri[PRI_QUEUE_SIZE];   /* PRI tag states */
        struct device_state *device_state;      /* Link to our device_state */
        int pasid;                              /* PASID index */
-        spinlock_t lock;                        /* Protect pri_queues */
+        spinlock_t lock;                        /* Protect pri_queues and
+                                                   mmu_notifer_count */
        wait_queue_head_t wq;                   /* To wait for count == 0 */
 };
@@ -431,15 +432,19 @@ static void mn_invalidate_range_start(struct mmu_notifier *mn,
 {
        struct pasid_state *pasid_state;
        struct device_state *dev_state;
+        unsigned long flags;
        pasid_state = mn_to_state(mn);
        dev_state   = pasid_state->device_state;
-        if (atomic_add_return(1, &pasid_state->mmu_notifier_count) == 1) {
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        if (pasid_state->mmu_notifier_count == 0) {
                amd_iommu_domain_set_gcr3(dev_state->domain,
                                          pasid_state->pasid,
                                          __pa(empty_page_table));
        }
+        pasid_state->mmu_notifier_count += 1;
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
 }
 static void mn_invalidate_range_end(struct mmu_notifier *mn,
@@ -448,15 +453,19 @@ static void mn_invalidate_range_end(struct mmu_notifier *mn,
 {
        struct pasid_state *pasid_state;
        struct device_state *dev_state;
+        unsigned long flags;
        pasid_state = mn_to_state(mn);
        dev_state   = pasid_state->device_state;
-        if (atomic_dec_and_test(&pasid_state->mmu_notifier_count)) {
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        pasid_state->mmu_notifier_count -= 1;
+        if (pasid_state->mmu_notifier_count == 0) {
                amd_iommu_domain_set_gcr3(dev_state->domain,
                                          pasid_state->pasid,
                                          __pa(pasid_state->mm->pgd));
        }
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
 }
 static void mn_release(struct mmu_notifier *mn, struct mm_struct *mm)
@@ -650,7 +659,6 @@ int amd_iommu_bind_pasid(struct pci_dev *pdev, int pasid,
                goto out;
        atomic_set(&pasid_state->count, 1);
-        atomic_set(&pasid_state->mmu_notifier_count, 0);
        init_waitqueue_head(&pasid_state->wq);
        spin_lock_init(&pasid_state->lock);
diff --git a/drivers/iommu/fsl_pamu.c b/drivers/iommu/fsl_pamu.c
index b99dd88e31b9..bb446d742a2d 100644
--- a/drivers/iommu/fsl_pamu.c
+++ b/drivers/iommu/fsl_pamu.c
@@ -170,10 +170,10 @@ int pamu_disable_liodn(int liodn)
 static unsigned int map_addrspace_size_to_wse(phys_addr_t addrspace_size)
 {
        /* Bug if not a power of 2 */
-        BUG_ON(!is_power_of_2(addrspace_size));
+        BUG_ON((addrspace_size & (addrspace_size - 1)));
        /* window size is 2^(WSE+1) bytes */
-        return __ffs(addrspace_size) - 1;
+        return fls64(addrspace_size) - 2;
 }
 /* Derive the PAACE window count encoding for the subwindow count */
@@ -351,7 +351,7 @@ int pamu_config_ppaace(int liodn, phys_addr_t win_addr, phys_addr_t win_size,
        struct paace *ppaace;
        unsigned long fspi;
-        if (!is_power_of_2(win_size) || win_size < PAMU_PAGE_SIZE) {
+        if ((win_size & (win_size - 1)) || win_size < PAMU_PAGE_SIZE) {
                pr_debug("window size too small or not a power of two %llx\n", win_size);
                return -EINVAL;
        }
@@ -464,7 +464,7 @@ int pamu_config_spaace(int liodn, u32 subwin_cnt, u32 subwin,
                return -ENOENT;
        }
-        if (!is_power_of_2(subwin_size) || subwin_size < PAMU_PAGE_SIZE) {
+        if ((subwin_size & (subwin_size - 1)) || subwin_size < PAMU_PAGE_SIZE) {
                pr_debug("subwindow size out of range, or not a power of 2\n");
                return -EINVAL;
        }
diff --git a/drivers/iommu/fsl_pamu_domain.c b/drivers/iommu/fsl_pamu_domain.c
index 93072ba44b1d..af47648301a9 100644
--- a/drivers/iommu/fsl_pamu_domain.c
+++ b/drivers/iommu/fsl_pamu_domain.c
@@ -301,7 +301,7 @@ static int check_size(u64 size, dma_addr_t iova)
         * Size must be a power of two and at least be equal
         * to PAMU page size.
         */
-        if (!is_power_of_2(size) || size < PAMU_PAGE_SIZE) {
+        if ((size & (size - 1)) || size < PAMU_PAGE_SIZE) {
                pr_debug("%s: size too small or not a power of two\n", __func__);
                return -EINVAL;
        }
@@ -335,11 +335,6 @@ static struct fsl_dma_domain *iommu_alloc_dma_domain(void)
        return domain;
 }
-static inline struct device_domain_info *find_domain(struct device *dev)
-{
-        return dev->archdata.iommu_domain;
-}
 static void remove_device_ref(struct device_domain_info *info, u32 win_cnt)
 {
        unsigned long flags;
@@ -380,7 +375,7 @@ static void attach_device(struct fsl_dma_domain *dma_domain, int liodn, struct d
         * Check here if the device is already attached to domain or not.
         * If the device is already attached to a domain detach it.
         */
-        old_domain_info = find_domain(dev);
+        old_domain_info = dev->archdata.iommu_domain;
        if (old_domain_info && old_domain_info->domain != dma_domain) {
                spin_unlock_irqrestore(&device_domain_lock, flags);
                detach_device(dev, old_domain_info->domain);
@@ -399,7 +394,7 @@ static void attach_device(struct fsl_dma_domain *dma_domain, int liodn, struct d
         * the info for the first LIODN as all
         * LIODNs share the same domain
         */
-        if (!old_domain_info)
+        if (!dev->archdata.iommu_domain)
                dev->archdata.iommu_domain = info;
        spin_unlock_irqrestore(&device_domain_lock, flags);
@@ -1042,12 +1037,15 @@ root_bus:
                        group = get_shared_pci_device_group(pdev);
        }
+        if (!group)
+                group = ERR_PTR(-ENODEV);
        return group;
 }
 static int fsl_pamu_add_device(struct device *dev)
 {
-        struct iommu_group *group = NULL;
+        struct iommu_group *group = ERR_PTR(-ENODEV);
        struct pci_dev *pdev;
        const u32 *prop;
        int ret, len;
@@ -1070,7 +1068,7 @@ static int fsl_pamu_add_device(struct device *dev)
                        group = get_device_iommu_group(dev);
        }
-        if (!group || IS_ERR(group))
+        if (IS_ERR(group))
                return PTR_ERR(group);
        ret = iommu_group_add_device(group, dev);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 6bb32773c3ac..51b6b77dc3e5 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3816,14 +3816,11 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
                                ((void *)rmrr) + rmrr->header.length,
                                rmrr->segment, rmrru->devices,
                                rmrru->devices_cnt);
-                        if (ret > 0)
+                        if(ret < 0)
-                                break;
-                        else if(ret < 0)
                                return ret;
                } else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
-                        if (dmar_remove_dev_scope(info, rmrr->segment,
+                        dmar_remove_dev_scope(info, rmrr->segment,
-                                rmrru->devices, rmrru->devices_cnt))
+                                rmrru->devices, rmrru->devices_cnt);
-                                break;
                }
        }
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index c887e6eebc41..574aba0eba4e 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -334,6 +334,15 @@ static void armada_mpic_send_doorbell(const struct cpumask *mask,
 static void armada_xp_mpic_smp_cpu_init(void)
 {
+        u32 control;
+        int nr_irqs, i;
+        control = readl(main_int_base + ARMADA_370_XP_INT_CONTROL);
+        nr_irqs = (control >> 2) & 0x3ff;
+        for (i = 0; i < nr_irqs; i++)
+                writel(i, per_cpu_int_base + ARMADA_370_XP_INT_SET_MASK_OFFS);
        /* Clear pending IPIs */
        writel(0, per_cpu_int_base + ARMADA_370_XP_IN_DRBEL_CAUSE_OFFS);
@@ -474,7 +483,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                                             struct device_node *parent)
 {
        struct resource main_int_res, per_cpu_int_res;
-        int parent_irq;
+        int parent_irq, nr_irqs, i;
        u32 control;
        BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@@ -496,9 +505,13 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
        BUG_ON(!per_cpu_int_base);
        control = readl(main_int_base + ARMADA_370_XP_INT_CONTROL);
+        nr_irqs = (control >> 2) & 0x3ff;
+        for (i = 0; i < nr_irqs; i++)
+                writel(i, main_int_base + ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS);
        armada_370_xp_mpic_domain =
-                irq_domain_add_linear(node, (control >> 2) & 0x3ff,
+                irq_domain_add_linear(node, nr_irqs,
                                &armada_370_xp_mpic_irq_ops, NULL);
        BUG_ON(!armada_370_xp_mpic_domain);
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 8ee2a36d5840..c15c840987d2 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -150,7 +150,7 @@ int __init brcmstb_l2_intc_of_init(struct device_node *np,
        /* Allocate a single Generic IRQ chip for this node */
        ret = irq_alloc_domain_generic_chips(data->domain, 32, 1,
-                                np->full_name, handle_level_irq, clr, 0, 0);
+                                np->full_name, handle_edge_irq, clr, 0, 0);
        if (ret) {
                pr_err("failed to allocate generic irq chip\n");
                goto out_free_domain;
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 7e11c9d6ae8c..7c131cf7cc13 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -42,6 +42,7 @@
 #include <linux/irqchip/chained_irq.h>
 #include <linux/irqchip/arm-gic.h>
+#include <asm/cputype.h>
 #include <asm/irq.h>
 #include <asm/exception.h>
 #include <asm/smp_plat.h>
@@ -954,7 +955,9 @@ void __init gic_init_bases(unsigned int gic_nr, int irq_start,
                }
                for_each_possible_cpu(cpu) {
-                        unsigned long offset = percpu_offset * cpu_logical_map(cpu);
+                        u32 mpidr = cpu_logical_map(cpu);
+                        u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+                        unsigned long offset = percpu_offset * core_id;
                        *per_cpu_ptr(gic->dist_base.percpu_base, cpu) = dist_base + offset;
                        *per_cpu_ptr(gic->cpu_base.percpu_base, cpu) = cpu_base + offset;
                }
@@ -1071,8 +1074,10 @@ gic_of_init(struct device_node *node, struct device_node *parent)
        gic_cnt++;
        return 0;
 }
+IRQCHIP_DECLARE(gic_400, "arm,gic-400", gic_of_init);
 IRQCHIP_DECLARE(cortex_a15_gic, "arm,cortex-a15-gic", gic_of_init);
 IRQCHIP_DECLARE(cortex_a9_gic, "arm,cortex-a9-gic", gic_of_init);
+IRQCHIP_DECLARE(cortex_a7_gic, "arm,cortex-a7-gic", gic_of_init);
 IRQCHIP_DECLARE(msm_8660_qgic, "qcom,msm-8660-qgic", gic_of_init);
 IRQCHIP_DECLARE(msm_qgic2, "qcom,msm-qgic2", gic_of_init);
diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
index 3fdda3a40269..6ce6bd3441bf 100644
--- a/drivers/irqchip/spear-shirq.c
+++ b/drivers/irqchip/spear-shirq.c
@@ -125,7 +125,7 @@ static struct spear_shirq spear320_shirq_ras2 = {
 };
 static struct spear_shirq spear320_shirq_ras3 = {
-        .irq_nr = 3,
+        .irq_nr = 7,
        .irq_bit_off = 0,
        .invalid_irq = 1,
        .regs = {
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index c44950d3eb7b..b7ae0a0dd5b6 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -2400,6 +2400,7 @@ allocerr:
 error:
        freeurbs(cs);
        usb_set_intfdata(interface, NULL);
+        usb_put_dev(udev);
        gigaset_freecs(cs);
        return rc;
 }
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index d9edcc94c2a8..97465ac5a2d5 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -16,7 +16,7 @@ config ISDN_DRV_HISAX
          also to the configuration option of the driver for your particular
          card, below.
-if ISDN_DRV_HISAX!=n
+if ISDN_DRV_HISAX
 comment "D-channel protocol features"
@@ -348,10 +348,6 @@ config HISAX_ENTERNOW_PCI
          This enables HiSax support for the Formula-n enter:now PCI
          ISDN card.
-endif
-if ISDN_DRV_HISAX
 config HISAX_DEBUG
        bool "HiSax debugging"
        help
@@ -420,11 +416,6 @@ config HISAX_FRITZ_PCIPNP
          (the latter also needs you to select "ISA Plug and Play support"
          from the menu "Plug and Play configuration")
-config HISAX_AVM_A1_PCMCIA
-        bool
-        depends on HISAX_AVM_A1_CS
-        default y
 endif
 endmenu
diff --git a/drivers/isdn/hisax/l3ni1.c b/drivers/isdn/hisax/l3ni1.c
index 0df6691d045c..8dc791bfaa6f 100644
--- a/drivers/isdn/hisax/l3ni1.c
+++ b/drivers/isdn/hisax/l3ni1.c
@@ -2059,13 +2059,17 @@ static int l3ni1_cmd_global(struct PStack *st, isdn_ctrl *ic)
                        memcpy(p, ic->parm.ni1_io.data, ic->parm.ni1_io.datalen); /* copy data */
                        l = (p - temp) + ic->parm.ni1_io.datalen; /* total length */
-                        if (ic->parm.ni1_io.timeout > 0)
+                        if (ic->parm.ni1_io.timeout > 0) {
-                                if (!(pc = ni1_new_l3_process(st, -1)))
+                                pc = ni1_new_l3_process(st, -1);
-                                { free_invoke_id(st, id);
+                                if (!pc) {
+                                        free_invoke_id(st, id);
                                        return (-2);
                                }
-                        pc->prot.ni1.ll_id = ic->parm.ni1_io.ll_id; /* remember id */
+                                /* remember id */
-                        pc->prot.ni1.proc = ic->parm.ni1_io.proc; /* and procedure */
+                                pc->prot.ni1.ll_id = ic->parm.ni1_io.ll_id;
+                                /* and procedure */
+                                pc->prot.ni1.proc = ic->parm.ni1_io.proc;
+                        }
                        if (!(skb = l3_alloc_skb(l)))
                        { free_invoke_id(st, id);
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 61ac63237446..62f0688d45a5 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -442,7 +442,7 @@ static int get_filter(void __user *arg, struct sock_filter **p)
 {
        struct sock_fprog uprog;
        struct sock_filter *code = NULL;
-        int len, err;
+        int len;
        if (copy_from_user(&uprog, arg, sizeof(uprog)))
                return -EFAULT;
@@ -458,12 +458,6 @@ static int get_filter(void __user *arg, struct sock_filter **p)
        if (IS_ERR(code))
                return PTR_ERR(code);
-        err = sk_chk_filter(code, uprog.len);
-        if (err) {
-                kfree(code);
-                return err;
-        }
        *p = code;
        return uprog.len;
 }
@@ -644,9 +638,15 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
                fprog.len = len;
                fprog.filter = code;
-                if (is->pass_filter)
+                if (is->pass_filter) {
                        sk_unattached_filter_destroy(is->pass_filter);
-                err = sk_unattached_filter_create(&is->pass_filter, &fprog);
+                        is->pass_filter = NULL;
+                }
+                if (fprog.filter != NULL)
+                        err = sk_unattached_filter_create(&is->pass_filter,
+                                                          &fprog);
+                else
+                        err = 0;
                kfree(code);
                return err;
@@ -663,9 +663,15 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
                fprog.len = len;
                fprog.filter = code;
-                if (is->active_filter)
+                if (is->active_filter) {
                        sk_unattached_filter_destroy(is->active_filter);
-                err = sk_unattached_filter_create(&is->active_filter, &fprog);
+                        is->active_filter = NULL;
+                }
+                if (fprog.filter != NULL)
+                        err = sk_unattached_filter_create(&is->active_filter,
+                                                          &fprog);
+                else
+                        err = 0;
                kfree(code);
                return err;
diff --git a/drivers/macintosh/smu.c b/drivers/macintosh/smu.c
index 23b4a3b28dbc..4eab93aa570b 100644
--- a/drivers/macintosh/smu.c
+++ b/drivers/macintosh/smu.c
@@ -1257,7 +1257,8 @@ static unsigned int smu_fpoll(struct file *file, poll_table *wait)
                if (pp->busy && pp->cmd.status != 1)
                        mask |= POLLIN;
                spin_unlock_irqrestore(&pp->lock, flags);
-        } if (pp->mode == smu_file_events) {
+        }
+        if (pp->mode == smu_file_events) {
                /* Not yet implemented */
        }
        return mask;
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 4e84095833db..d724459860d9 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1541,7 +1541,7 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign
        BUG_ON(block_size < 1 << SECTOR_SHIFT ||
               (block_size & (block_size - 1)));
-        c = kmalloc(sizeof(*c), GFP_KERNEL);
+        c = kzalloc(sizeof(*c), GFP_KERNEL);
        if (!c) {
                r = -ENOMEM;
                goto bad_client;
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 4ead4ba60656..d2899e7eb3aa 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -425,6 +425,15 @@ static int __open_metadata(struct dm_cache_metadata *cmd)
        disk_super = dm_block_data(sblock);
+        /* Verify the data block size hasn't changed */
+        if (le32_to_cpu(disk_super->data_block_size) != cmd->data_block_size) {
+                DMERR("changing the data block size (from %u to %llu) is not supported",
+                      le32_to_cpu(disk_super->data_block_size),
+                      (unsigned long long)cmd->data_block_size);
+                r = -EINVAL;
+                goto bad;
+        }
        r = __check_incompat_features(disk_super, cmd);
        if (r < 0)
                goto bad;
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 5f054c44b485..2c63326638b6 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -231,7 +231,7 @@ struct cache {
        /*
         * cache_size entries, dirty if set
         */
-        dm_cblock_t nr_dirty;
+        atomic_t nr_dirty;
        unsigned long *dirty_bitset;
        /*
@@ -492,7 +492,7 @@ static bool is_dirty(struct cache *cache, dm_cblock_t b)
 static void set_dirty(struct cache *cache, dm_oblock_t oblock, dm_cblock_t cblock)
 {
        if (!test_and_set_bit(from_cblock(cblock), cache->dirty_bitset)) {
-                cache->nr_dirty = to_cblock(from_cblock(cache->nr_dirty) + 1);
+                atomic_inc(&cache->nr_dirty);
                policy_set_dirty(cache->policy, oblock);
        }
 }
@@ -501,8 +501,7 @@ static void clear_dirty(struct cache *cache, dm_oblock_t oblock, dm_cblock_t cbl
 {
        if (test_and_clear_bit(from_cblock(cblock), cache->dirty_bitset)) {
                policy_clear_dirty(cache->policy, oblock);
-                cache->nr_dirty = to_cblock(from_cblock(cache->nr_dirty) - 1);
+                if (atomic_dec_return(&cache->nr_dirty) == 0)
-                if (!from_cblock(cache->nr_dirty))
                        dm_table_event(cache->ti->table);
        }
 }
@@ -2269,7 +2268,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        atomic_set(&cache->quiescing_ack, 0);
        r = -ENOMEM;
-        cache->nr_dirty = 0;
+        atomic_set(&cache->nr_dirty, 0);
        cache->dirty_bitset = alloc_bitset(from_cblock(cache->cache_size));
        if (!cache->dirty_bitset) {
                *error = "could not allocate dirty bitset";
@@ -2808,7 +2807,7 @@ static void cache_status(struct dm_target *ti, status_type_t type,
                residency = policy_residency(cache->policy);
-                DMEMIT("%u %llu/%llu %u %llu/%llu %u %u %u %u %u %u %llu ",
+                DMEMIT("%u %llu/%llu %u %llu/%llu %u %u %u %u %u %u %lu ",
                       (unsigned)(DM_CACHE_METADATA_BLOCK_SIZE >> SECTOR_SHIFT),
                       (unsigned long long)(nr_blocks_metadata - nr_free_blocks_metadata),
                       (unsigned long long)nr_blocks_metadata,
@@ -2821,7 +2820,7 @@ static void cache_status(struct dm_target *ti, status_type_t type,
                       (unsigned) atomic_read(&cache->stats.write_miss),
                       (unsigned) atomic_read(&cache->stats.demotion),
                       (unsigned) atomic_read(&cache->stats.promotion),
-                       (unsigned long long) from_cblock(cache->nr_dirty));
+                       (unsigned long) atomic_read(&cache->nr_dirty));
                if (writethrough_mode(&cache->features))
                        DMEMIT("1 writethrough ");
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 53b213226c01..4cba2d808afb 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Christophe Saout <christophe@saout.de>
+ * Copyright (C) 2003 Jana Saout <jana@saout.de>
 * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org>
 * Copyright (C) 2006-2009 Red Hat, Inc. All rights reserved.
 * Copyright (C) 2013 Milan Broz <gmazyland@gmail.com>
@@ -1996,6 +1996,6 @@ static void __exit dm_crypt_exit(void)
 module_init(dm_crypt_init);
 module_exit(dm_crypt_exit);
-MODULE_AUTHOR("Christophe Saout <christophe@saout.de>");
+MODULE_AUTHOR("Jana Saout <jana@saout.de>");
 MODULE_DESCRIPTION(DM_NAME " target for transparent encryption / decryption");
 MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 3842ac738f98..db404a0f7e2c 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -10,6 +10,7 @@
 #include <linux/device-mapper.h>
 #include <linux/bio.h>
+#include <linux/completion.h>
 #include <linux/mempool.h>
 #include <linux/module.h>
 #include <linux/sched.h>
@@ -32,7 +33,7 @@ struct dm_io_client {
 struct io {
        unsigned long error_bits;
        atomic_t count;
-        struct task_struct *sleeper;
+        struct completion *wait;
        struct dm_io_client *client;
        io_notify_fn callback;
        void *context;
@@ -121,8 +122,8 @@ static void dec_count(struct io *io, unsigned int region, int error)
                        invalidate_kernel_vmap_range(io->vma_invalidate_address,
                                                     io->vma_invalidate_size);
-                if (io->sleeper)
+                if (io->wait)
-                        wake_up_process(io->sleeper);
+                        complete(io->wait);
                else {
                        unsigned long r = io->error_bits;
@@ -387,6 +388,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
         */
        volatile char io_[sizeof(struct io) + __alignof__(struct io) - 1];
        struct io *io = (struct io *)PTR_ALIGN(&io_, __alignof__(struct io));
+        DECLARE_COMPLETION_ONSTACK(wait);
        if (num_regions > 1 && (rw & RW_MASK) != WRITE) {
                WARN_ON(1);
@@ -395,7 +397,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
        io->error_bits = 0;
        atomic_set(&io->count, 1); /* see dispatch_io() */
-        io->sleeper = current;
+        io->wait = &wait;
        io->client = client;
        io->vma_invalidate_address = dp->vma_invalidate_address;
@@ -403,15 +405,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
        dispatch_io(rw, num_regions, where, dp, io, 1);
-        while (1) {
+        wait_for_completion_io(&wait);
-                set_current_state(TASK_UNINTERRUPTIBLE);
-                if (!atomic_read(&io->count))
-                        break;
-                io_schedule();
-        }
-        set_current_state(TASK_RUNNING);
        if (error_bits)
                *error_bits = io->error_bits;
@@ -434,7 +428,7 @@ static int async_io(struct dm_io_client *client, unsigned int num_regions,
        io = mempool_alloc(client->pool, GFP_NOIO);
        io->error_bits = 0;
        atomic_set(&io->count, 1); /* see dispatch_io() */
-        io->sleeper = NULL;
+        io->wait = NULL;
        io->client = client;
        io->callback = fn;
        io->context = context;
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 3f6fd9d33ba3..f4167b013d99 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1611,8 +1611,9 @@ static int multipath_busy(struct dm_target *ti)
        spin_lock_irqsave(&m->lock, flags);
-        /* pg_init in progress, requeue until done */
+        /* pg_init in progress or no paths available */
-        if (!pg_ready(m)) {
+        if (m->pg_init_in_progress ||
+            (!m->nr_valid_paths && m->queue_if_no_path)) {
                busy = 1;
                goto out;
        }
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index b086a945edcb..e9d33ad59df5 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -613,6 +613,15 @@ static int __open_metadata(struct dm_pool_metadata *pmd)
        disk_super = dm_block_data(sblock);
+        /* Verify the data block size hasn't changed */
+        if (le32_to_cpu(disk_super->data_block_size) != pmd->data_block_size) {
+                DMERR("changing the data block size (from %u to %llu) is not supported",
+                      le32_to_cpu(disk_super->data_block_size),
+                      (unsigned long long)pmd->data_block_size);
+                r = -EINVAL;
+                goto bad_unlock_sblock;
+        }
        r = __check_incompat_features(disk_super, pmd);
        if (r < 0)
                goto bad_unlock_sblock;
diff --git a/drivers/md/dm-zero.c b/drivers/md/dm-zero.c
index c99003e0d47a..b9a64bbce304 100644
--- a/drivers/md/dm-zero.c
+++ b/drivers/md/dm-zero.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Christophe Saout <christophe@saout.de>
+ * Copyright (C) 2003 Jana Saout <jana@saout.de>
 *
 * This file is released under the GPL.
 */
@@ -79,6 +79,6 @@ static void __exit dm_zero_exit(void)
 module_init(dm_zero_init)
 module_exit(dm_zero_exit)
-MODULE_AUTHOR("Christophe Saout <christophe@saout.de>");
+MODULE_AUTHOR("Jana Saout <jana@saout.de>");
 MODULE_DESCRIPTION(DM_NAME " dummy target returning zeros");
 MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 437d99045ef2..32b958dbc499 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -54,6 +54,8 @@ static void do_deferred_remove(struct work_struct *w);
 static DECLARE_WORK(deferred_remove_work, do_deferred_remove);
+static struct workqueue_struct *deferred_remove_workqueue;
 /*
 * For bio-based dm.
 * One of these is allocated per bio.
@@ -276,16 +278,24 @@ static int __init local_init(void)
        if (r)
                goto out_free_rq_tio_cache;
+        deferred_remove_workqueue = alloc_workqueue("kdmremove", WQ_UNBOUND, 1);
+        if (!deferred_remove_workqueue) {
+                r = -ENOMEM;
+                goto out_uevent_exit;
+        }
        _major = major;
        r = register_blkdev(_major, _name);
        if (r < 0)
-                goto out_uevent_exit;
+                goto out_free_workqueue;
        if (!_major)
                _major = r;
        return 0;
+out_free_workqueue:
+        destroy_workqueue(deferred_remove_workqueue);
 out_uevent_exit:
        dm_uevent_exit();
 out_free_rq_tio_cache:
@@ -299,6 +309,7 @@ out_free_io_cache:
 static void local_exit(void)
 {
        flush_scheduled_work();
+        destroy_workqueue(deferred_remove_workqueue);
        kmem_cache_destroy(_rq_tio_cache);
        kmem_cache_destroy(_io_cache);
@@ -407,7 +418,7 @@ static void dm_blk_close(struct gendisk *disk, fmode_t mode)
        if (atomic_dec_and_test(&md->open_count) &&
            (test_bit(DMF_DEFERRED_REMOVE, &md->flags)))
-                schedule_work(&deferred_remove_work);
+                queue_work(deferred_remove_workqueue, &deferred_remove_work);
        dm_put(md);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 34846856dbc6..32fc19c540d4 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5599,7 +5599,7 @@ static int get_array_info(struct mddev * mddev, void __user * arg)
        if (mddev->in_sync)
                info.state = (1<<MD_SB_CLEAN);
        if (mddev->bitmap && mddev->bitmap_info.offset)
-                info.state = (1<<MD_SB_BITMAP_PRESENT);
+                info.state |= (1<<MD_SB_BITMAP_PRESENT);
        info.active_disks  = insync;
        info.working_disks = working;
        info.failed_disks  = failed;
@@ -7501,6 +7501,19 @@ void md_do_sync(struct md_thread *thread)
                            rdev->recovery_offset < j)
                                j = rdev->recovery_offset;
                rcu_read_unlock();
+                /* If there is a bitmap, we need to make sure all
+                 * writes that started before we added a spare
+                 * complete before we start doing a recovery.
+                 * Otherwise the write might complete and (via
+                 * bitmap_endwrite) set a bit in the bitmap after the
+                 * recovery has checked that bit and skipped that
+                 * region.
+                 */
+                if (mddev->bitmap) {
+                        mddev->pers->quiesce(mddev, 1);
+                        mddev->pers->quiesce(mddev, 0);
+                }
        }
        printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c
index 8637d2ed7623..2e3cdcfa0a67 100644
--- a/drivers/media/dvb-frontends/si2168.c
+++ b/drivers/media/dvb-frontends/si2168.c
@@ -60,7 +60,7 @@ static int si2168_cmd_execute(struct si2168 *s, struct si2168_cmd *cmd)
                                jiffies_to_msecs(jiffies) -
                                (jiffies_to_msecs(timeout) - TIMEOUT));
-                if (!(cmd->args[0] >> 7) & 0x01) {
+                if (!((cmd->args[0] >> 7) & 0x01)) {
                        ret = -ETIMEDOUT;
                        goto err_mutex_unlock;
                }
@@ -485,20 +485,6 @@ static int si2168_init(struct dvb_frontend *fe)
        if (ret)
                goto err;
-        cmd.args[0] = 0x05;
-        cmd.args[1] = 0x00;
-        cmd.args[2] = 0xaa;
-        cmd.args[3] = 0x4d;
-        cmd.args[4] = 0x56;
-        cmd.args[5] = 0x40;
-        cmd.args[6] = 0x00;
-        cmd.args[7] = 0x00;
-        cmd.wlen = 8;
-        cmd.rlen = 1;
-        ret = si2168_cmd_execute(s, &cmd);
-        if (ret)
-                goto err;
        /* cold state - try to download firmware */
        dev_info(&s->client->dev, "%s: found a '%s' in cold state\n",
                        KBUILD_MODNAME, si2168_ops.info.name);
diff --git a/drivers/media/dvb-frontends/si2168_priv.h b/drivers/media/dvb-frontends/si2168_priv.h
index 2a343e896f40..53f7f06ae343 100644
--- a/drivers/media/dvb-frontends/si2168_priv.h
+++ b/drivers/media/dvb-frontends/si2168_priv.h
@@ -22,7 +22,7 @@
 #include <linux/firmware.h>
 #include <linux/i2c-mux.h>
-#define SI2168_FIRMWARE "dvb-demod-si2168-01.fw"
+#define SI2168_FIRMWARE "dvb-demod-si2168-02.fw"
 /* state struct */
 struct si2168 {
diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
index 522fe00f5eee..9619be5d4827 100644
--- a/drivers/media/dvb-frontends/tda10071.c
+++ b/drivers/media/dvb-frontends/tda10071.c
@@ -668,6 +668,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
        struct dtv_frontend_properties *c = &fe->dtv_property_cache;
        int ret, i;
        u8 mode, rolloff, pilot, inversion, div;
+        fe_modulation_t modulation;
        dev_dbg(&priv->i2c->dev,
                        "%s: delivery_system=%d modulation=%d frequency=%d symbol_rate=%d inversion=%d pilot=%d rolloff=%d\n",
@@ -702,10 +703,13 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
        switch (c->delivery_system) {
        case SYS_DVBS:
+                modulation = QPSK;
                rolloff = 0;
                pilot = 2;
                break;
        case SYS_DVBS2:
+                modulation = c->modulation;
                switch (c->rolloff) {
                case ROLLOFF_20:
                        rolloff = 2;
@@ -750,7 +754,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
        for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
                if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
-                        c->modulation == TDA10071_MODCOD[i].modulation &&
+                        modulation == TDA10071_MODCOD[i].modulation &&
                        c->fec_inner == TDA10071_MODCOD[i].fec) {
                        mode = TDA10071_MODCOD[i].val;
                        dev_dbg(&priv->i2c->dev, "%s: mode found=%02x\n",
@@ -834,10 +838,10 @@ static int tda10071_get_frontend(struct dvb_frontend *fe)
        switch ((buf[1] >> 0) & 0x01) {
        case 0:
-                c->inversion = INVERSION_OFF;
+                c->inversion = INVERSION_ON;
                break;
        case 1:
-                c->inversion = INVERSION_ON;
+                c->inversion = INVERSION_OFF;
                break;
        }
@@ -856,7 +860,7 @@ static int tda10071_get_frontend(struct dvb_frontend *fe)
        if (ret)
                goto error;
-        c->symbol_rate = (buf[0] << 16) | (buf[1] << 8) | (buf[2] << 0);
+        c->symbol_rate = ((buf[0] << 16) | (buf[1] << 8) | (buf[2] << 0)) * 1000;
        return ret;
 error:
diff --git a/drivers/media/dvb-frontends/tda10071_priv.h b/drivers/media/dvb-frontends/tda10071_priv.h
index 4baf14bfb65a..420486192736 100644
--- a/drivers/media/dvb-frontends/tda10071_priv.h
+++ b/drivers/media/dvb-frontends/tda10071_priv.h
@@ -55,6 +55,7 @@ static struct tda10071_modcod {
        { SYS_DVBS2, QPSK,  FEC_8_9,  0x0a },
        { SYS_DVBS2, QPSK,  FEC_9_10, 0x0b },
        /* 8PSK */
+        { SYS_DVBS2, PSK_8, FEC_AUTO, 0x00 },
        { SYS_DVBS2, PSK_8, FEC_3_5,  0x0c },
        { SYS_DVBS2, PSK_8, FEC_2_3,  0x0d },
        { SYS_DVBS2, PSK_8, FEC_3_4,  0x0e },
diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index e65c760e4e8b..0006d6bf8c18 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -179,7 +179,7 @@ static const struct v4l2_file_operations ts_fops =
        .read     = vb2_fop_read,
        .poll     = vb2_fop_poll,
        .mmap     = vb2_fop_mmap,
-        .ioctl    = video_ioctl2,
+        .unlocked_ioctl = video_ioctl2,
 };
 static const struct v4l2_ioctl_ops ts_ioctl_ops = {
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index a7ed16497903..1e4ec697fb10 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -269,6 +269,7 @@ err:
                list_del(&buf->list);
                vb2_buffer_done(&buf->vb, VB2_BUF_STATE_QUEUED);
        }
+        spin_unlock_irqrestore(&common->irqlock, flags);
        return ret;
 }
diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c
index 5bb085b19bcb..b431b58f39e3 100644
--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -233,6 +233,7 @@ err:
                list_del(&buf->list);
                vb2_buffer_done(&buf->vb, VB2_BUF_STATE_QUEUED);
        }
+        spin_unlock_irqrestore(&common->irqlock, flags);
        return ret;
 }
diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
index 271a752cee54..fa4cc7b880aa 100644
--- a/drivers/media/tuners/si2157.c
+++ b/drivers/media/tuners/si2157.c
@@ -57,7 +57,7 @@ static int si2157_cmd_execute(struct si2157 *s, struct si2157_cmd *cmd)
                        jiffies_to_msecs(jiffies) -
                        (jiffies_to_msecs(timeout) - TIMEOUT));
-        if (!(buf[0] >> 7) & 0x01) {
+        if (!((buf[0] >> 7) & 0x01)) {
                ret = -ETIMEDOUT;
                goto err_mutex_unlock;
        } else {
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 021e4d35e4d7..7b9b75f60774 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -704,15 +704,41 @@ static int af9035_read_config(struct dvb_usb_device *d)
                if (ret < 0)
                        goto err;
-                if (tmp == 0x00)
+                dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
-                        dev_dbg(&d->udev->dev,
+                                __func__, i, tmp);
-                                        "%s: [%d]tuner not set, using default\n",
-                                        __func__, i);
+                /* tuner sanity check */
-                else
+                if (state->chip_type == 0x9135) {
+                        if (state->chip_version == 0x02) {
+                                /* IT9135 BX (v2) */
+                                switch (tmp) {
+                                case AF9033_TUNER_IT9135_60:
+                                case AF9033_TUNER_IT9135_61:
+                                case AF9033_TUNER_IT9135_62:
+                                        state->af9033_config[i].tuner = tmp;
+                                        break;
+                                }
+                        } else {
+                                /* IT9135 AX (v1) */
+                                switch (tmp) {
+                                case AF9033_TUNER_IT9135_38:
+                                case AF9033_TUNER_IT9135_51:
+                                case AF9033_TUNER_IT9135_52:
+                                        state->af9033_config[i].tuner = tmp;
+                                        break;
+                                }
+                        }
+                } else {
+                        /* AF9035 */
                        state->af9033_config[i].tuner = tmp;
+                }
-                dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
+                if (state->af9033_config[i].tuner != tmp) {
-                                __func__, i, state->af9033_config[i].tuner);
+                        dev_info(&d->udev->dev,
+                                        "%s: [%d] overriding tuner from %02x to %02x\n",
+                                        KBUILD_MODNAME, i, tmp,
+                                        state->af9033_config[i].tuner);
+                }
                switch (state->af9033_config[i].tuner) {
                case AF9033_TUNER_TUA9001:
diff --git a/drivers/media/usb/gspca/pac7302.c b/drivers/media/usb/gspca/pac7302.c
index 2fd1c5e31a0f..339adce7c7a5 100644
--- a/drivers/media/usb/gspca/pac7302.c
+++ b/drivers/media/usb/gspca/pac7302.c
@@ -928,6 +928,7 @@ static const struct usb_device_id device_table[] = {
        {USB_DEVICE(0x093a, 0x2620)},
        {USB_DEVICE(0x093a, 0x2621)},
        {USB_DEVICE(0x093a, 0x2622), .driver_info = FL_VFLIP},
+        {USB_DEVICE(0x093a, 0x2623), .driver_info = FL_VFLIP},
        {USB_DEVICE(0x093a, 0x2624), .driver_info = FL_VFLIP},
        {USB_DEVICE(0x093a, 0x2625)},
        {USB_DEVICE(0x093a, 0x2626)},
diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
index 0500c4175d5f..6bce01a674f9 100644
--- a/drivers/media/usb/hdpvr/hdpvr-video.c
+++ b/drivers/media/usb/hdpvr/hdpvr-video.c
@@ -82,7 +82,7 @@ static void hdpvr_read_bulk_callback(struct urb *urb)
 }
 /*=========================================================================*/
-/* bufffer bits */
+/* buffer bits */
 /* function expects dev->io_mutex to be hold by caller */
 int hdpvr_cancel_queue(struct hdpvr_device *dev)
@@ -926,7 +926,7 @@ static int hdpvr_s_ctrl(struct v4l2_ctrl *ctrl)
        case V4L2_CID_MPEG_AUDIO_ENCODING:
                if (dev->flags & HDPVR_FLAG_AC3_CAP) {
                        opt->audio_codec = ctrl->val;
-                        return hdpvr_set_audio(dev, opt->audio_input,
+                        return hdpvr_set_audio(dev, opt->audio_input + 1,
                                              opt->audio_codec);
                }
                return 0;
@@ -1198,7 +1198,7 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
        v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
                V4L2_CID_MPEG_AUDIO_ENCODING,
                ac3 ? V4L2_MPEG_AUDIO_ENCODING_AC3 : V4L2_MPEG_AUDIO_ENCODING_AAC,
-                0x7, V4L2_MPEG_AUDIO_ENCODING_AAC);
+                0x7, ac3 ? dev->options.audio_codec : V4L2_MPEG_AUDIO_ENCODING_AAC);
        v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
                V4L2_CID_MPEG_VIDEO_ENCODING,
                V4L2_MPEG_VIDEO_ENCODING_MPEG_4_AVC, 0x3,
diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
index 4ae54caadd03..ce1c9f5d9dee 100644
--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
@@ -610,10 +610,10 @@ struct v4l2_fract v4l2_calc_aspect_ratio(u8 hor_landscape, u8 vert_portrait)
                aspect.denominator = 9;
        } else if (ratio == 34) {
                aspect.numerator = 4;
-                aspect.numerator = 3;
+                aspect.denominator = 3;
        } else if (ratio == 68) {
                aspect.numerator = 15;
-                aspect.numerator = 9;
+                aspect.denominator = 9;
        } else {
                aspect.numerator = hor_landscape + 99;
                aspect.denominator = 100;
diff --git a/drivers/memstick/host/rtsx_pci_ms.c b/drivers/memstick/host/rtsx_pci_ms.c
index 2a635b6fdaf7..c880ba685754 100644
--- a/drivers/memstick/host/rtsx_pci_ms.c
+++ b/drivers/memstick/host/rtsx_pci_ms.c
@@ -601,6 +601,7 @@ static int rtsx_pci_ms_drv_remove(struct platform_device *pdev)
        pcr->slots[RTSX_MS_CARD].card_event = NULL;
        msh = host->msh;
        host->eject = true;
+        cancel_work_sync(&host->handle_req);
        mutex_lock(&host->host_mutex);
        if (host->req) {
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index ee8204cc31e9..6cc4b6acc22a 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -760,6 +760,7 @@ config MFD_SYSCON
 config MFD_DAVINCI_VOICECODEC
        tristate
        select MFD_CORE
+        select REGMAP_MMIO
 config MFD_TI_AM335X_TSCADC
        tristate "TI ADC / Touch Screen chip support"
@@ -1225,7 +1226,7 @@ config MFD_WM8994
          functionaltiy of the device other drivers must be enabled.
 config MFD_STW481X
-        bool "Support for ST Microelectronics STw481x"
+        tristate "Support for ST Microelectronics STw481x"
        depends on I2C && ARCH_NOMADIK
        select REGMAP_I2C
        select MFD_CORE
@@ -1248,7 +1249,7 @@ config MCP_SA11X0
 # Chip drivers
 config MCP_UCB1200
-        bool "Support for UCB1200 / UCB1300"
+        tristate "Support for UCB1200 / UCB1300"
        depends on MCP_SA11X0
        select MCP
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index a8ee4a36a1d8..cf2e6a198c6b 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -591,7 +591,7 @@ static int ab8500_irq_init(struct ab8500 *ab8500, struct device_node *np)
                num_irqs = AB8500_NR_IRQS;
        /* If ->irq_base is zero this will give a linear mapping */
-        ab8500->domain = irq_domain_add_simple(NULL,
+        ab8500->domain = irq_domain_add_simple(ab8500->dev->of_node,
                        num_irqs, 0,
                        &ab8500_irq_ops, ab8500);
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a43d0c467274..ee9402324a23 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -54,7 +54,7 @@ config AD525X_DPOT_SPI
 config ATMEL_PWM
        tristate "Atmel AT32/AT91 PWM support"
        depends on HAVE_CLK
-        depends on AVR32 || AT91SAM9263 || AT91SAM9RL || AT91SAM9G45
+        depends on AVR32 || ARCH_AT91SAM9263 || ARCH_AT91SAM9RL || ARCH_AT91SAM9G45
        help
          This option enables device driver support for the PWM channels
          on certain Atmel processors.  Pulse Width Modulation is used for
diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c
index 73068e50e56d..3250fc1df0aa 100644
--- a/drivers/misc/vexpress-syscfg.c
+++ b/drivers/misc/vexpress-syscfg.c
@@ -199,7 +199,7 @@ static struct regmap *vexpress_syscfg_regmap_init(struct device *dev,
        func = kzalloc(sizeof(*func) + sizeof(*func->template) * num,
                        GFP_KERNEL);
        if (!func)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        func->syscfg = syscfg;
        func->num_templates = num;
@@ -231,10 +231,14 @@ static struct regmap *vexpress_syscfg_regmap_init(struct device *dev,
        func->regmap = regmap_init(dev, NULL, func,
                        &vexpress_syscfg_regmap_config);
-        if (IS_ERR(func->regmap))
+        if (IS_ERR(func->regmap)) {
+                void *err = func->regmap;
                kfree(func);
-        else
+                return err;
-                list_add(&func->list, &syscfg->funcs);
+        }
+        list_add(&func->list, &syscfg->funcs);
        return func->regmap;
 }
diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
index 2421835d5daf..191617492181 100644
--- a/drivers/misc/vmw_balloon.c
+++ b/drivers/misc/vmw_balloon.c
@@ -17,7 +17,8 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
- * Maintained by: Dmitry Torokhov <dtor@vmware.com>
+ * Maintained by:       Xavier Deguillard <xdeguillard@vmware.com>
+ *                      Philip Moltmann <moltmann@vmware.com>
 */
 /*
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index e4ec355704a6..a7543ba3e190 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -52,6 +52,11 @@
 /* Atmel chips */
 #define AT49BV640D      0x02de
 #define AT49BV640DT     0x02db
+/* Sharp chips */
+#define LH28F640BFHE_PTTL90     0x00b0
+#define LH28F640BFHE_PBTL90     0x00b1
+#define LH28F640BFHE_PTTL70A    0x00b2
+#define LH28F640BFHE_PBTL70A    0x00b3
 static int cfi_intelext_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int cfi_intelext_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
@@ -258,6 +263,36 @@ static void fixup_st_m28w320cb(struct mtd_info *mtd)
                (cfi->cfiq->EraseRegionInfo[1] & 0xffff0000) | 0x3e;
 };
+static int is_LH28F640BF(struct cfi_private *cfi)
+{
+        /* Sharp LH28F640BF Family */
+        if (cfi->mfr == CFI_MFR_SHARP && (
+            cfi->id == LH28F640BFHE_PTTL90 || cfi->id == LH28F640BFHE_PBTL90 ||
+            cfi->id == LH28F640BFHE_PTTL70A || cfi->id == LH28F640BFHE_PBTL70A))
+                return 1;
+        return 0;
+}
+static void fixup_LH28F640BF(struct mtd_info *mtd)
+{
+        struct map_info *map = mtd->priv;
+        struct cfi_private *cfi = map->fldrv_priv;
+        struct cfi_pri_intelext *extp = cfi->cmdset_priv;
+        /* Reset the Partition Configuration Register on LH28F640BF
+         * to a single partition (PCR = 0x000): PCR is embedded into A0-A15. */
+        if (is_LH28F640BF(cfi)) {
+                printk(KERN_INFO "Reset Partition Config. Register: 1 Partition of 4 planes\n");
+                map_write(map, CMD(0x60), 0);
+                map_write(map, CMD(0x04), 0);
+                /* We have set one single partition thus
+                 * Simultaneous Operations are not allowed */
+                printk(KERN_INFO "cfi_cmdset_0001: Simultaneous Operations disabled\n");
+                extp->FeatureSupport &= ~512;
+        }
+}
 static void fixup_use_point(struct mtd_info *mtd)
 {
        struct map_info *map = mtd->priv;
@@ -309,6 +344,8 @@ static struct cfi_fixup cfi_fixup_table[] = {
        { CFI_MFR_ST, 0x00ba, /* M28W320CT */ fixup_st_m28w320ct },
        { CFI_MFR_ST, 0x00bb, /* M28W320CB */ fixup_st_m28w320cb },
        { CFI_MFR_INTEL, CFI_ID_ANY, fixup_unlock_powerup_lock },
+        { CFI_MFR_SHARP, CFI_ID_ANY, fixup_unlock_powerup_lock },
+        { CFI_MFR_SHARP, CFI_ID_ANY, fixup_LH28F640BF },
        { 0, 0, NULL }
 };
@@ -1649,6 +1686,12 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
        initial_adr = adr;
        cmd_adr = adr & ~(wbufsize-1);
+        /* Sharp LH28F640BF chips need the first address for the
+         * Page Buffer Program command. See Table 5 of
+         * LH28F320BF, LH28F640BF, LH28F128BF Series (Appendix FUM00701) */
+        if (is_LH28F640BF(cfi))
+                cmd_adr = adr;
        /* Let's determine this according to the interleave only once */
        write_cmd = (cfi->cfiq->P_ID != P_ID_INTEL_PERFORMANCE) ? CMD(0xe8) : CMD(0xe9);
diff --git a/drivers/mtd/devices/elm.c b/drivers/mtd/devices/elm.c
index 7df86948e6d4..b4f61c7fc161 100644
--- a/drivers/mtd/devices/elm.c
+++ b/drivers/mtd/devices/elm.c
@@ -475,6 +475,7 @@ static int elm_context_save(struct elm_info *info)
                                        ELM_SYNDROME_FRAGMENT_1 + offset);
                        regs->elm_syndrome_fragment_0[i] = elm_read_reg(info,
                                        ELM_SYNDROME_FRAGMENT_0 + offset);
+                        break;
                default:
                        return -EINVAL;
                }
@@ -520,6 +521,7 @@ static int elm_context_restore(struct elm_info *info)
                                        regs->elm_syndrome_fragment_1[i]);
                        elm_write_reg(info, ELM_SYNDROME_FRAGMENT_0 + offset,
                                        regs->elm_syndrome_fragment_0[i]);
+                        break;
                default:
                        return -EINVAL;
                }
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 41167e9e991e..4f3e80c68a26 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -4047,8 +4047,10 @@ int nand_scan_tail(struct mtd_info *mtd)
                ecc->layout->oobavail += ecc->layout->oobfree[i].length;
        mtd->oobavail = ecc->layout->oobavail;
-        /* ECC sanity check: warn noisily if it's too weak */
+        /* ECC sanity check: warn if it's too weak */
-        WARN_ON(!nand_ecc_strength_good(mtd));
+        if (!nand_ecc_strength_good(mtd))
+                pr_warn("WARNING: %s: the ECC used on your system is too weak compared to the one required by the NAND chip\n",
+                        mtd->name);
        /*
         * Set the number of read / write steps for one page depending on ECC
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index b04e7d059888..0431b46d9fd9 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -125,7 +125,7 @@ static struct ubi_ainf_volume *add_vol(struct ubi_attach_info *ai, int vol_id,
                parent = *p;
                av = rb_entry(parent, struct ubi_ainf_volume, rb);
-                if (vol_id < av->vol_id)
+                if (vol_id > av->vol_id)
                        p = &(*p)->rb_left;
                else
                        p = &(*p)->rb_right;
@@ -423,7 +423,7 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
                                pnum, err);
                        ret = err > 0 ? UBI_BAD_FASTMAP : err;
                        goto out;
-                } else if (ret == UBI_IO_BITFLIPS)
+                } else if (err == UBI_IO_BITFLIPS)
                        scrub = 1;
                /*
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 04f35f960cb8..701f86cd5993 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1025,10 +1025,14 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
                                 NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
                                 NETIF_F_HIGHDMA | NETIF_F_LRO)
+#define BOND_ENC_FEATURES       (NETIF_F_ALL_CSUM | NETIF_F_SG | NETIF_F_RXCSUM |\
+                                 NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL)
 static void bond_compute_features(struct bonding *bond)
 {
        unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
        netdev_features_t vlan_features = BOND_VLAN_FEATURES;
+        netdev_features_t enc_features  = BOND_ENC_FEATURES;
        struct net_device *bond_dev = bond->dev;
        struct list_head *iter;
        struct slave *slave;
@@ -1044,6 +1048,9 @@ static void bond_compute_features(struct bonding *bond)
                vlan_features = netdev_increment_features(vlan_features,
                        slave->dev->vlan_features, BOND_VLAN_FEATURES);
+                enc_features = netdev_increment_features(enc_features,
+                                                         slave->dev->hw_enc_features,
+                                                         BOND_ENC_FEATURES);
                dst_release_flag &= slave->dev->priv_flags;
                if (slave->dev->hard_header_len > max_hard_header_len)
                        max_hard_header_len = slave->dev->hard_header_len;
@@ -1054,6 +1061,7 @@ static void bond_compute_features(struct bonding *bond)
 done:
        bond_dev->vlan_features = vlan_features;
+        bond_dev->hw_enc_features = enc_features;
        bond_dev->hard_header_len = max_hard_header_len;
        bond_dev->gso_max_segs = gso_max_segs;
        netif_set_gso_max_size(bond_dev, gso_max_size);
@@ -3975,6 +3983,7 @@ void bond_setup(struct net_device *bond_dev)
                                NETIF_F_HW_VLAN_CTAG_FILTER;
        bond_dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM);
+        bond_dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
        bond_dev->features |= bond_dev->hw_features;
 }
@@ -4059,7 +4068,7 @@ static int bond_check_params(struct bond_params *params)
        }
        if (ad_select) {
-                bond_opt_initstr(&newval, lacp_rate);
+                bond_opt_initstr(&newval, ad_select);
                valptr = bond_opt_parse(bond_opt_get(BOND_OPT_AD_SELECT),
                                        &newval);
                if (!valptr) {
diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 824108cd9fd5..12430be6448a 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -287,7 +287,8 @@ static int c_can_plat_probe(struct platform_device *pdev)
                        break;
                }
-                priv->raminit_ctrlreg = devm_ioremap_resource(&pdev->dev, res);
+                priv->raminit_ctrlreg = devm_ioremap(&pdev->dev, res->start,
+                                                     resource_size(res));
                if (IS_ERR(priv->raminit_ctrlreg) || priv->instance < 0)
                        dev_info(&pdev->dev, "control memory is not used for raminit\n");
                else
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index dcf9196f6316..ea4d4f1a6411 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -52,6 +52,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/workqueue.h>
 #include <linux/can.h>
 #include <linux/can/skb.h>
@@ -85,6 +86,7 @@ struct slcan {
        struct tty_struct       *tty;           /* ptr to TTY structure      */
        struct net_device       *dev;           /* easy for intr handling    */
        spinlock_t              lock;
+        struct work_struct      tx_work;        /* Flushes transmit buffer   */
        /* These are pointers to the malloc()ed frame buffers. */
        unsigned char           rbuff[SLC_MTU]; /* receiver buffer           */
@@ -309,36 +311,46 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf)
        sl->dev->stats.tx_bytes += cf->can_dlc;
 }
-/*
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
- * Called by the driver when there's room for more data.  If we have
+static void slcan_transmit(struct work_struct *work)
- * more packets to send, we send them here.
- */
-static void slcan_write_wakeup(struct tty_struct *tty)
 {
+        struct slcan *sl = container_of(work, struct slcan, tx_work);
        int actual;
-        struct slcan *sl = (struct slcan *) tty->disc_data;
+        spin_lock_bh(&sl->lock);
        /* First make sure we're connected. */
-        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
+        if (!sl->tty || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) {
+                spin_unlock_bh(&sl->lock);
                return;
+        }
-        spin_lock_bh(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
                spin_unlock_bh(&sl->lock);
                netif_wake_queue(sl->dev);
                return;
        }
-        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
        spin_unlock_bh(&sl->lock);
 }
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slcan_write_wakeup(struct tty_struct *tty)
+{
+        struct slcan *sl = tty->disc_data;
+        schedule_work(&sl->tx_work);
+}
 /* Send a can_frame to a TTY queue. */
 static netdev_tx_t slc_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -528,6 +540,7 @@ static struct slcan *slc_alloc(dev_t line)
        sl->magic = SLCAN_MAGIC;
        sl->dev = dev;
        spin_lock_init(&sl->lock);
+        INIT_WORK(&sl->tx_work, slcan_transmit);
        slcan_devs[i] = dev;
        return sl;
@@ -626,8 +639,12 @@ static void slcan_close(struct tty_struct *tty)
        if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty)
                return;
+        spin_lock_bh(&sl->lock);
        tty->disc_data = NULL;
        sl->tty = NULL;
+        spin_unlock_bh(&sl->lock);
+        flush_work(&sl->tx_work);
        /* Flush network side */
        unregister_netdev(sl->dev);
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 28460676b8ca..d81e7167a8b5 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -736,6 +736,7 @@ static int emac_open(struct net_device *dev)
        ret = emac_mdio_probe(dev);
        if (ret < 0) {
+                free_irq(dev->irq, dev);
                netdev_err(dev, "cannot probe MDIO bus\n");
                return ret;
        }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index c83584a26713..5a1891faba8a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -339,7 +339,8 @@ static int xgbe_probe(struct platform_device *pdev)
        /* Calculate the number of Tx and Rx rings to be created */
        pdata->tx_ring_count = min_t(unsigned int, num_online_cpus(),
                                     pdata->hw_feat.tx_ch_cnt);
-        if (netif_set_real_num_tx_queues(netdev, pdata->tx_ring_count)) {
+        ret = netif_set_real_num_tx_queues(netdev, pdata->tx_ring_count);
+        if (ret) {
                dev_err(dev, "error setting real tx queue count\n");
                goto err_io;
        }
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 141160ef249a..5776e503e4c5 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -654,13 +654,13 @@ static int bcm_sysport_tx_poll(struct napi_struct *napi, int budget)
        work_done = bcm_sysport_tx_reclaim(ring->priv, ring);
-        if (work_done < budget) {
+        if (work_done == 0) {
                napi_complete(napi);
                /* re-enable TX interrupt */
                intrl2_1_mask_clear(ring->priv, BIT(ring->index));
        }
-        return work_done;
+        return 0;
 }
 static void bcm_sysport_tx_reclaim_all(struct bcm_sysport_priv *priv)
@@ -1254,28 +1254,17 @@ static inline void umac_enable_set(struct bcm_sysport_priv *priv,
                usleep_range(1000, 2000);
 }
-static inline int umac_reset(struct bcm_sysport_priv *priv)
+static inline void umac_reset(struct bcm_sysport_priv *priv)
 {
-        unsigned int timeout = 0;
        u32 reg;
-        int ret = 0;
-        umac_writel(priv, 0, UMAC_CMD);
-        while (timeout++ < 1000) {
-                reg = umac_readl(priv, UMAC_CMD);
-                if (!(reg & CMD_SW_RESET))
-                        break;
-                udelay(1);
-        }
-        if (timeout == 1000) {
-                dev_err(&priv->pdev->dev,
-                        "timeout waiting for MAC to come out of reset\n");
-                ret = -ETIMEDOUT;
-        }
-        return ret;
+        reg = umac_readl(priv, UMAC_CMD);
+        reg |= CMD_SW_RESET;
+        umac_writel(priv, reg, UMAC_CMD);
+        udelay(10);
+        reg = umac_readl(priv, UMAC_CMD);
+        reg &= ~CMD_SW_RESET;
+        umac_writel(priv, reg, UMAC_CMD);
 }
 static void umac_set_hw_addr(struct bcm_sysport_priv *priv,
@@ -1303,11 +1292,7 @@ static int bcm_sysport_open(struct net_device *dev)
        int ret;
        /* Reset UniMAC */
-        ret = umac_reset(priv);
+        umac_reset(priv);
-        if (ret) {
-                netdev_err(dev, "UniMAC reset failed\n");
-                return ret;
-        }
        /* Flush TX and RX FIFOs at TOPCTRL level */
        topctrl_flush(priv);
@@ -1589,12 +1574,6 @@ static int bcm_sysport_probe(struct platform_device *pdev)
        BUILD_BUG_ON(sizeof(struct bcm_tsb) != 8);
        dev->needed_headroom += sizeof(struct bcm_tsb);
-        /* We are interfaced to a switch which handles the multicast
-         * filtering for us, so we do not support programming any
-         * multicast hash table in this Ethernet MAC.
-         */
-        dev->flags &= ~IFF_MULTICAST;
        /* libphy will adjust the link state accordingly */
        netif_carrier_off(dev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 4cab09d3f807..8206a293e6b4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -346,6 +346,7 @@ struct sw_tx_bd {
        u8              flags;
 /* Set on the first BD descriptor when there is a split BD */
 #define BNX2X_TSO_SPLIT_BD              (1<<0)
+#define BNX2X_HAS_SECOND_PBD            (1<<1)
 };
 struct sw_rx_page {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 47c5814114e1..c43e7238de21 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -227,6 +227,12 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        --nbd;
        bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+        if (tx_buf->flags & BNX2X_HAS_SECOND_PBD) {
+                /* Skip second parse bd... */
+                --nbd;
+                bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+        }
        /* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
        if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
                tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
@@ -797,7 +803,8 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                return;
        }
-        bnx2x_frag_free(fp, new_data);
+        if (new_data)
+                bnx2x_frag_free(fp, new_data);
 drop:
        /* drop the packet and keep the buffer in the bin */
        DP(NETIF_MSG_RX_STATUS,
@@ -3888,6 +3895,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        /* set encapsulation flag in start BD */
                        SET_FLAG(tx_start_bd->general_data,
                                 ETH_TX_START_BD_TUNNEL_EXIST, 1);
+                        tx_buf->flags |= BNX2X_HAS_SECOND_PBD;
                        nbd++;
                } else if (xmit_type & XMIT_CSUM) {
                        /* Set PBD in checksum offload case w/o encapsulation */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index bd0600cf7266..25eddd90f482 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -379,6 +379,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                        break;
                case PORT_FIBRE:
                case PORT_DA:
+                case PORT_NONE:
                        if (!(bp->port.supported[0] & SUPPORTED_FIBRE ||
                              bp->port.supported[1] & SUPPORTED_FIBRE)) {
                                DP(BNX2X_MSG_ETHTOOL,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 2887034523e0..6a8b1453a1b9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12937,7 +12937,7 @@ static int bnx2x_get_num_non_def_sbs(struct pci_dev *pdev, int cnic_cnt)
         * without the default SB.
         * For VFs there is no default SB, then we return (index+1).
         */
-        pci_read_config_word(pdev, pdev->msix_cap + PCI_MSI_FLAGS, &control);
+        pci_read_config_word(pdev, pdev->msix_cap + PCI_MSIX_FLAGS, &control);
        index = control & PCI_MSIX_FLAGS_QSIZE;
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 5ba1cfbd60da..4e615debe472 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1149,6 +1149,11 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
                goto out;
        }
+        if (skb_padto(skb, ETH_ZLEN)) {
+                ret = NETDEV_TX_OK;
+                goto out;
+        }
        /* set the SKB transmit checksum */
        if (priv->desc_64b_en) {
                ret = bcmgenet_put_tx_csum(dev, skb);
@@ -1408,13 +1413,6 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv)
                if (cb->skb)
                        continue;
-                /* set the DMA descriptor length once and for all
-                 * it will only change if we support dynamically sizing
-                 * priv->rx_buf_len, but we do not
-                 */
-                dmadesc_set_length_status(priv, priv->rx_bd_assign_ptr,
-                                priv->rx_buf_len << DMA_BUFLENGTH_SHIFT);
                ret = bcmgenet_rx_refill(priv, cb);
                if (ret)
                        break;
@@ -2535,14 +2533,17 @@ static int bcmgenet_probe(struct platform_device *pdev)
        netif_set_real_num_tx_queues(priv->dev, priv->hw_params->tx_queues + 1);
        netif_set_real_num_rx_queues(priv->dev, priv->hw_params->rx_queues + 1);
-        err = register_netdev(dev);
+        /* libphy will determine the link state */
-        if (err)
+        netif_carrier_off(dev);
-                goto err_clk_disable;
        /* Turn off the main clock, WOL clock is handled separately */
        if (!IS_ERR(priv->clk))
                clk_disable_unprepare(priv->clk);
+        err = register_netdev(dev);
+        if (err)
+                goto err;
        return err;
 err_clk_disable:
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index 0f117105fed1..e23c993b1362 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -331,9 +331,9 @@ struct bcmgenet_mib_counters {
 #define  EXT_ENERGY_DET_MASK            (1 << 12)
 #define EXT_RGMII_OOB_CTRL              0x0C
-#define  RGMII_MODE_EN                  (1 << 0)
 #define  RGMII_LINK                     (1 << 4)
 #define  OOB_DISABLE                    (1 << 5)
+#define  RGMII_MODE_EN                  (1 << 6)
 #define  ID_MODE_DIS                    (1 << 16)
 #define EXT_GPHY_CTRL                   0x1C
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index df2792d8383d..8afa579e7c40 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -3224,7 +3224,7 @@ static int tg3_nvram_read_using_eeprom(struct tg3 *tp,
        return 0;
 }
-#define NVRAM_CMD_TIMEOUT 100
+#define NVRAM_CMD_TIMEOUT 5000
 static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
 {
@@ -3232,7 +3232,7 @@ static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
        tw32(NVRAM_CMD, nvram_cmd);
        for (i = 0; i < NVRAM_CMD_TIMEOUT; i++) {
-                udelay(10);
+                usleep_range(10, 40);
                if (tr32(NVRAM_CMD) & NVRAM_CMD_DONE) {
                        udelay(10);
                        break;
@@ -7854,8 +7854,8 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
                netif_wake_queue(tp->dev);
        }
-        segs = skb_gso_segment(skb, tp->dev->features & ~NETIF_F_TSO);
+        segs = skb_gso_segment(skb, tp->dev->features & ~(NETIF_F_TSO | NETIF_F_TSO6));
-        if (IS_ERR(segs))
+        if (IS_ERR(segs) || !segs)
                goto tg3_tso_bug_end;
        do {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 2f8d6b910383..a83271cf17c3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4057,22 +4057,19 @@ int cxgb4_unregister_uld(enum cxgb4_uld type)
 EXPORT_SYMBOL(cxgb4_unregister_uld);
 /* Check if netdev on which event is occured belongs to us or not. Return
- * suceess (1) if it belongs otherwise failure (0).
+ * success (true) if it belongs otherwise failure (false).
+ * Called with rcu_read_lock() held.
 */
-static int cxgb4_netdev(struct net_device *netdev)
+static bool cxgb4_netdev(const struct net_device *netdev)
 {
        struct adapter *adap;
        int i;
-        spin_lock(&adap_rcu_lock);
        list_for_each_entry_rcu(adap, &adap_rcu_list, rcu_node)
                for (i = 0; i < MAX_NPORTS; i++)
-                        if (adap->port[i] == netdev) {
+                        if (adap->port[i] == netdev)
-                                spin_unlock(&adap_rcu_lock);
+                                return true;
-                                return 1;
+        return false;
-                        }
-        spin_unlock(&adap_rcu_lock);
-        return 0;
 }
 static int clip_add(struct net_device *event_dev, struct inet6_ifaddr *ifa,
@@ -6396,6 +6393,7 @@ static void remove_one(struct pci_dev *pdev)
                        adapter->flags &= ~DEV_ENABLED;
                }
                pci_release_regions(pdev);
+                synchronize_rcu();
                kfree(adapter);
        } else
                pci_release_regions(pdev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index bba67681aeaa..931478e7bd28 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3962,6 +3962,7 @@ int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
                p->lport = j;
                p->rss_size = rss_size;
                memcpy(adap->port[i]->dev_addr, addr, ETH_ALEN);
+                adap->port[i]->dev_port = j;
                ret = ntohl(c.u.info.lstatus_to_modtype);
                p->mdio_addr = (ret & FW_PORT_CMD_MDIOCAP) ?
diff --git a/drivers/net/ethernet/dec/tulip/timer.c b/drivers/net/ethernet/dec/tulip/timer.c
index 768379b8aee9..523d9dde50a2 100644
--- a/drivers/net/ethernet/dec/tulip/timer.c
+++ b/drivers/net/ethernet/dec/tulip/timer.c
@@ -158,7 +158,7 @@ void comet_timer(unsigned long data)
 {
        struct net_device *dev = (struct net_device *)data;
        struct tulip_private *tp = netdev_priv(dev);
-        int next_tick = 60*HZ;
+        int next_tick = 2*HZ;
        if (tulip_debug > 1)
                netdev_dbg(dev, "Comet link status %04x partner capability %04x\n",
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 2e7c5553955e..c2f5d2d3b932 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -557,9 +557,7 @@ static inline u16 be_max_qs(struct be_adapter *adapter)
 #define be_pvid_tagging_enabled(adapter)        (adapter->pvid)
 /* Is BE in QNQ multi-channel mode */
-#define be_is_qnq_mode(adapter)         (adapter->mc_type == FLEX10 ||  \
+#define be_is_qnq_mode(adapter)         (adapter->function_mode & QNQ_MODE)
-                                         adapter->mc_type == vNIC1 ||   \
-                                         adapter->mc_type == UFP)
 #define lancer_chip(adapter)    (adapter->pdev->device == OC_DEVICE_ID3 || \
                                 adapter->pdev->device == OC_DEVICE_ID4)
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 3e0a6b243806..59b3c056f329 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1091,7 +1091,7 @@ struct be_cmd_resp_modify_eq_delay {
 * based on the skew/IPL.
 */
 #define RDMA_ENABLED                            0x4
-#define FLEX10_MODE                             0x400
+#define QNQ_MODE                                0x400
 #define VNIC_MODE                               0x20000
 #define UMC_ENABLED                             0x1000000
 struct be_cmd_req_query_fw_cfg {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 6822b3d76d85..1e187fb760f8 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2902,7 +2902,7 @@ static int be_open(struct net_device *netdev)
        for_all_evt_queues(adapter, eqo, i) {
                napi_enable(&eqo->napi);
                be_enable_busy_poll(eqo);
-                be_eq_notify(adapter, eqo->q.id, true, false, 0);
+                be_eq_notify(adapter, eqo->q.id, true, true, 0);
        }
        adapter->flags |= BE_FLAGS_NAPI_ENABLED;
@@ -3254,9 +3254,9 @@ err:
 static u8 be_convert_mc_type(u32 function_mode)
 {
-        if (function_mode & VNIC_MODE && function_mode & FLEX10_MODE)
+        if (function_mode & VNIC_MODE && function_mode & QNQ_MODE)
                return vNIC1;
-        else if (function_mode & FLEX10_MODE)
+        else if (function_mode & QNQ_MODE)
                return FLEX10;
        else if (function_mode & VNIC_MODE)
                return vNIC2;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 38d9d276ab8b..77037fd377b8 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -320,6 +320,11 @@ static void *swap_buffer(void *bufaddr, int len)
        return bufaddr;
 }
+static inline bool is_ipv4_pkt(struct sk_buff *skb)
+{
+        return skb->protocol == htons(ETH_P_IP) && ip_hdr(skb)->version == 4;
+}
 static int
 fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
 {
@@ -330,7 +335,8 @@ fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
        if (unlikely(skb_cow_head(skb, 0)))
                return -1;
-        ip_hdr(skb)->check = 0;
+        if (is_ipv4_pkt(skb))
+                ip_hdr(skb)->check = 0;
        *(__sum16 *)(skb->head + skb->csum_start + skb->csum_offset) = 0;
        return 0;
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index fab39e295441..36fc429298e3 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -2990,11 +2990,11 @@ static int ucc_geth_startup(struct ucc_geth_private *ugeth)
        if (ug_info->rxExtendedFiltering) {
                size += THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING;
                if (ug_info->largestexternallookupkeysize ==
-                    QE_FLTR_TABLE_LOOKUP_KEY_SIZE_8_BYTES)
+                    QE_FLTR_LARGEST_EXTERNAL_TABLE_LOOKUP_KEY_SIZE_8_BYTES)
                        size +=
                            THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_8;
                if (ug_info->largestexternallookupkeysize ==
-                    QE_FLTR_TABLE_LOOKUP_KEY_SIZE_16_BYTES)
+                    QE_FLTR_LARGEST_EXTERNAL_TABLE_LOOKUP_KEY_SIZE_16_BYTES)
                        size +=
                            THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_16;
        }
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index a2db388cc31e..ee74f9536b31 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1481,6 +1481,13 @@ static s32 igb_init_hw_82575(struct e1000_hw *hw)
        s32 ret_val;
        u16 i, rar_count = mac->rar_entry_count;
+        if ((hw->mac.type >= e1000_i210) &&
+            !(igb_get_flash_presence_i210(hw))) {
+                ret_val = igb_pll_workaround_i210(hw);
+                if (ret_val)
+                        return ret_val;
+        }
        /* Initialize identification LED */
        ret_val = igb_id_led_init(hw);
        if (ret_val) {
diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h
index 2a8bb35c2df2..217f8138851b 100644
--- a/drivers/net/ethernet/intel/igb/e1000_defines.h
+++ b/drivers/net/ethernet/intel/igb/e1000_defines.h
@@ -46,14 +46,15 @@
 #define E1000_CTRL_EXT_SDP3_DIR  0x00000800 /* SDP3 Data direction */
 /* Physical Func Reset Done Indication */
-#define E1000_CTRL_EXT_PFRSTD    0x00004000
+#define E1000_CTRL_EXT_PFRSTD   0x00004000
-#define E1000_CTRL_EXT_LINK_MODE_MASK 0x00C00000
+#define E1000_CTRL_EXT_SDLPE    0X00040000  /* SerDes Low Power Enable */
-#define E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES  0x00C00000
+#define E1000_CTRL_EXT_LINK_MODE_MASK   0x00C00000
-#define E1000_CTRL_EXT_LINK_MODE_1000BASE_KX  0x00400000
+#define E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES    0x00C00000
-#define E1000_CTRL_EXT_LINK_MODE_SGMII   0x00800000
+#define E1000_CTRL_EXT_LINK_MODE_1000BASE_KX    0x00400000
-#define E1000_CTRL_EXT_LINK_MODE_GMII   0x00000000
+#define E1000_CTRL_EXT_LINK_MODE_SGMII  0x00800000
-#define E1000_CTRL_EXT_EIAME          0x01000000
+#define E1000_CTRL_EXT_LINK_MODE_GMII   0x00000000
-#define E1000_CTRL_EXT_IRCA           0x00000001
+#define E1000_CTRL_EXT_EIAME    0x01000000
+#define E1000_CTRL_EXT_IRCA             0x00000001
 /* Interrupt delay cancellation */
 /* Driver loaded bit for FW */
 #define E1000_CTRL_EXT_DRV_LOAD       0x10000000
@@ -62,6 +63,7 @@
 /* packet buffer parity error detection enabled */
 /* descriptor FIFO parity error detection enable */
 #define E1000_CTRL_EXT_PBA_CLR          0x80000000 /* PBA Clear */
+#define E1000_CTRL_EXT_PHYPDEN          0x00100000
 #define E1000_I2CCMD_REG_ADDR_SHIFT     16
 #define E1000_I2CCMD_PHY_ADDR_SHIFT     24
 #define E1000_I2CCMD_OPCODE_READ        0x08000000
diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h
index 89925e405849..ce55ea5d750c 100644
--- a/drivers/net/ethernet/intel/igb/e1000_hw.h
+++ b/drivers/net/ethernet/intel/igb/e1000_hw.h
@@ -567,4 +567,7 @@ struct net_device *igb_get_hw_dev(struct e1000_hw *hw);
 /* These functions must be implemented by drivers */
 s32 igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
 s32 igb_write_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
+void igb_read_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value);
+void igb_write_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value);
 #endif /* _E1000_HW_H_ */
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c
index 337161f440dd..65d931669f81 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.c
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c
@@ -834,3 +834,69 @@ s32 igb_init_nvm_params_i210(struct e1000_hw *hw)
        }
        return ret_val;
 }
+/**
+ * igb_pll_workaround_i210
+ * @hw: pointer to the HW structure
+ *
+ * Works around an errata in the PLL circuit where it occasionally
+ * provides the wrong clock frequency after power up.
+ **/
+s32 igb_pll_workaround_i210(struct e1000_hw *hw)
+{
+        s32 ret_val;
+        u32 wuc, mdicnfg, ctrl, ctrl_ext, reg_val;
+        u16 nvm_word, phy_word, pci_word, tmp_nvm;
+        int i;
+        /* Get and set needed register values */
+        wuc = rd32(E1000_WUC);
+        mdicnfg = rd32(E1000_MDICNFG);
+        reg_val = mdicnfg & ~E1000_MDICNFG_EXT_MDIO;
+        wr32(E1000_MDICNFG, reg_val);
+        /* Get data from NVM, or set default */
+        ret_val = igb_read_invm_word_i210(hw, E1000_INVM_AUTOLOAD,
+                                          &nvm_word);
+        if (ret_val)
+                nvm_word = E1000_INVM_DEFAULT_AL;
+        tmp_nvm = nvm_word | E1000_INVM_PLL_WO_VAL;
+        for (i = 0; i < E1000_MAX_PLL_TRIES; i++) {
+                /* check current state directly from internal PHY */
+                igb_read_phy_reg_gs40g(hw, (E1000_PHY_PLL_FREQ_PAGE |
+                                         E1000_PHY_PLL_FREQ_REG), &phy_word);
+                if ((phy_word & E1000_PHY_PLL_UNCONF)
+                    != E1000_PHY_PLL_UNCONF) {
+                        ret_val = 0;
+                        break;
+                } else {
+                        ret_val = -E1000_ERR_PHY;
+                }
+                /* directly reset the internal PHY */
+                ctrl = rd32(E1000_CTRL);
+                wr32(E1000_CTRL, ctrl|E1000_CTRL_PHY_RST);
+                ctrl_ext = rd32(E1000_CTRL_EXT);
+                ctrl_ext |= (E1000_CTRL_EXT_PHYPDEN | E1000_CTRL_EXT_SDLPE);
+                wr32(E1000_CTRL_EXT, ctrl_ext);
+                wr32(E1000_WUC, 0);
+                reg_val = (E1000_INVM_AUTOLOAD << 4) | (tmp_nvm << 16);
+                wr32(E1000_EEARBC_I210, reg_val);
+                igb_read_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+                pci_word |= E1000_PCI_PMCSR_D3;
+                igb_write_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+                usleep_range(1000, 2000);
+                pci_word &= ~E1000_PCI_PMCSR_D3;
+                igb_write_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+                reg_val = (E1000_INVM_AUTOLOAD << 4) | (nvm_word << 16);
+                wr32(E1000_EEARBC_I210, reg_val);
+                /* restore WUC register */
+                wr32(E1000_WUC, wuc);
+        }
+        /* restore MDICNFG setting */
+        wr32(E1000_MDICNFG, mdicnfg);
+        return ret_val;
+}
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.h b/drivers/net/ethernet/intel/igb/e1000_i210.h
index 9f34976687ba..3442b6357d01 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.h
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.h
@@ -33,6 +33,7 @@ s32 igb_read_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr, u16 *data);
 s32 igb_write_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr, u16 data);
 s32 igb_init_nvm_params_i210(struct e1000_hw *hw);
 bool igb_get_flash_presence_i210(struct e1000_hw *hw);
+s32 igb_pll_workaround_i210(struct e1000_hw *hw);
 #define E1000_STM_OPCODE                0xDB00
 #define E1000_EEPROM_FLASH_SIZE_WORD    0x11
@@ -78,4 +79,15 @@ enum E1000_INVM_STRUCTURE_TYPE {
 #define NVM_LED_1_CFG_DEFAULT_I211      0x0184
 #define NVM_LED_0_2_CFG_DEFAULT_I211    0x200C
+/* PLL Defines */
+#define E1000_PCI_PMCSR                 0x44
+#define E1000_PCI_PMCSR_D3              0x03
+#define E1000_MAX_PLL_TRIES             5
+#define E1000_PHY_PLL_UNCONF            0xFF
+#define E1000_PHY_PLL_FREQ_PAGE         0xFC0000
+#define E1000_PHY_PLL_FREQ_REG          0x000E
+#define E1000_INVM_DEFAULT_AL           0x202F
+#define E1000_INVM_AUTOLOAD             0x0A
+#define E1000_INVM_PLL_WO_VAL           0x0010
 #endif
diff --git a/drivers/net/ethernet/intel/igb/e1000_regs.h b/drivers/net/ethernet/intel/igb/e1000_regs.h
index 1cc4b1a7e597..f5ba4e4eafb9 100644
--- a/drivers/net/ethernet/intel/igb/e1000_regs.h
+++ b/drivers/net/ethernet/intel/igb/e1000_regs.h
@@ -66,6 +66,7 @@
 #define E1000_PBA      0x01000  /* Packet Buffer Allocation - RW */
 #define E1000_PBS      0x01008  /* Packet Buffer Size */
 #define E1000_EEMNGCTL 0x01010  /* MNG EEprom Control */
+#define E1000_EEARBC_I210 0x12024  /* EEPROM Auto Read Bus Control */
 #define E1000_EEWR     0x0102C  /* EEPROM Write Register - RW */
 #define E1000_I2CCMD   0x01028  /* SFPI2C Command Register - RW */
 #define E1000_FRTIMER  0x01048  /* Free Running Timer - RW */
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index f145adbb55ac..a9537ba7a5a0 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -7215,6 +7215,20 @@ static int igb_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
        }
 }
+void igb_read_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value)
+{
+        struct igb_adapter *adapter = hw->back;
+        pci_read_config_word(adapter->pdev, reg, value);
+}
+void igb_write_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value)
+{
+        struct igb_adapter *adapter = hw->back;
+        pci_write_config_word(adapter->pdev, reg, *value);
+}
 s32 igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value)
 {
        struct igb_adapter *adapter = hw->back;
@@ -7578,6 +7592,8 @@ static int igb_sriov_reinit(struct pci_dev *dev)
        if (netif_running(netdev))
                igb_close(netdev);
+        else
+                igb_reset(adapter);
        igb_clear_interrupt_scheme(adapter);
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 45beca17fa50..dadd9a5f6323 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1207,7 +1207,7 @@ static u32 mvneta_txq_desc_csum(int l3_offs, int l3_proto,
        command =  l3_offs    << MVNETA_TX_L3_OFF_SHIFT;
        command |= ip_hdr_len << MVNETA_TX_IP_HLEN_SHIFT;
-        if (l3_proto == swab16(ETH_P_IP))
+        if (l3_proto == htons(ETH_P_IP))
                command |= MVNETA_TXD_IP_CSUM;
        else
                command |= MVNETA_TX_L3_IP6;
@@ -2529,7 +2529,7 @@ static void mvneta_adjust_link(struct net_device *ndev)
                        if (phydev->speed == SPEED_1000)
                                val |= MVNETA_GMAC_CONFIG_GMII_SPEED;
-                        else
+                        else if (phydev->speed == SPEED_100)
                                val |= MVNETA_GMAC_CONFIG_MII_SPEED;
                        mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val);
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 7f81ae66cc89..e912b6887d40 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4199,6 +4199,13 @@ static struct dmi_system_id skge_32bit_dma_boards[] = {
                        DMI_MATCH(DMI_BOARD_NAME, "P5NSLI")
                },
        },
+        {
+                .ident = "FUJITSU SIEMENS A8NE-FM",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTek Computer INC."),
+                        DMI_MATCH(DMI_BOARD_NAME, "A8NE-FM")
+                },
+        },
        {}
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index 80f725228f5b..56022d647837 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -294,8 +294,6 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
        init_completion(&cq->free);
        cq->irq = priv->eq_table.eq[cq->vector].irq;
-        cq->irq_affinity_change = false;
        return 0;
 err_radix:
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
index 4b2130760eed..82322b1c8411 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
@@ -128,11 +128,16 @@ int mlx4_en_activate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq,
                                        mlx4_warn(mdev, "Failed assigning an EQ to %s, falling back to legacy EQ's\n",
                                                  name);
                                }
                        }
                } else {
                        cq->vector = (cq->ring + 1 + priv->port) %
                                mdev->dev->caps.num_comp_vectors;
                }
+                cq->irq_desc =
+                        irq_to_desc(mlx4_eq_get_irq(mdev->dev,
+                                                    cq->vector));
        } else {
                /* For TX we use the same irq per
                ring we assigned for the RX    */
@@ -187,8 +192,6 @@ void mlx4_en_destroy_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq **pcq)
        mlx4_en_unmap_buffer(&cq->wqres.buf);
        mlx4_free_hwq_res(mdev->dev, &cq->wqres, cq->buf_size);
        if (priv->mdev->dev->caps.comp_pool && cq->vector) {
-                if (!cq->is_tx)
-                        irq_set_affinity_hint(cq->mcq.irq, NULL);
                mlx4_release_eq(priv->mdev->dev, cq->vector);
        }
        cq->vector = 0;
@@ -204,6 +207,7 @@ void mlx4_en_deactivate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq)
        if (!cq->is_tx) {
                napi_hash_del(&cq->napi);
                synchronize_rcu();
+                irq_set_affinity_hint(cq->mcq.irq, NULL);
        }
        netif_napi_del(&cq->napi);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index fa1a069e14e6..68d763d2d030 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -417,6 +417,8 @@ static int mlx4_en_get_coalesce(struct net_device *dev,
        coal->tx_coalesce_usecs = priv->tx_usecs;
        coal->tx_max_coalesced_frames = priv->tx_frames;
+        coal->tx_max_coalesced_frames_irq = priv->tx_work_limit;
        coal->rx_coalesce_usecs = priv->rx_usecs;
        coal->rx_max_coalesced_frames = priv->rx_frames;
@@ -426,6 +428,7 @@ static int mlx4_en_get_coalesce(struct net_device *dev,
        coal->rx_coalesce_usecs_high = priv->rx_usecs_high;
        coal->rate_sample_interval = priv->sample_interval;
        coal->use_adaptive_rx_coalesce = priv->adaptive_rx_coal;
        return 0;
 }
@@ -434,6 +437,9 @@ static int mlx4_en_set_coalesce(struct net_device *dev,
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
+        if (!coal->tx_max_coalesced_frames_irq)
+                return -EINVAL;
        priv->rx_frames = (coal->rx_max_coalesced_frames ==
                           MLX4_EN_AUTO_CONF) ?
                                MLX4_EN_RX_COAL_TARGET :
@@ -457,6 +463,7 @@ static int mlx4_en_set_coalesce(struct net_device *dev,
        priv->rx_usecs_high = coal->rx_coalesce_usecs_high;
        priv->sample_interval = coal->rate_sample_interval;
        priv->adaptive_rx_coal = coal->use_adaptive_rx_coalesce;
+        priv->tx_work_limit = coal->tx_max_coalesced_frames_irq;
        return mlx4_en_moderation_update(priv);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 7d4fb7bf2593..7345c43b019e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2336,7 +2336,7 @@ static void mlx4_en_add_vxlan_port(struct  net_device *dev,
        struct mlx4_en_priv *priv = netdev_priv(dev);
        __be16 current_port;
-        if (!(priv->mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS))
+        if (priv->mdev->dev->caps.tunnel_offload_mode != MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                return;
        if (sa_family == AF_INET6)
@@ -2473,6 +2473,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                        MLX4_WQE_CTRL_SOLICITED);
        priv->num_tx_rings_p_up = mdev->profile.num_tx_rings_p_up;
        priv->tx_ring_num = prof->tx_ring_num;
+        priv->tx_work_limit = MLX4_EN_DEFAULT_TX_WORK;
        priv->tx_ring = kzalloc(sizeof(struct mlx4_en_tx_ring *) * MAX_TX_RINGS,
                                GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index d2d415732d99..5535862f27cc 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -40,6 +40,7 @@
 #include <linux/if_ether.h>
 #include <linux/if_vlan.h>
 #include <linux/vmalloc.h>
+#include <linux/irq.h>
 #include "mlx4_en.h"
@@ -782,6 +783,7 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                                                             PKT_HASH_TYPE_L3);
                                        skb_record_rx_queue(gro_skb, cq->ring);
+                                        skb_mark_napi_id(gro_skb, &cq->napi);
                                        if (ring->hwtstamp_rx_filter == HWTSTAMP_FILTER_ALL) {
                                                timestamp = mlx4_en_get_cqe_ts(cqe);
@@ -896,16 +898,25 @@ int mlx4_en_poll_rx_cq(struct napi_struct *napi, int budget)
        /* If we used up all the quota - we're probably not done yet... */
        if (done == budget) {
+                int cpu_curr;
+                const struct cpumask *aff;
                INC_PERF_COUNTER(priv->pstats.napi_quota);
-                if (unlikely(cq->mcq.irq_affinity_change)) {
-                        cq->mcq.irq_affinity_change = false;
+                cpu_curr = smp_processor_id();
+                aff = irq_desc_get_irq_data(cq->irq_desc)->affinity;
+                if (unlikely(!cpumask_test_cpu(cpu_curr, aff))) {
+                        /* Current cpu is not according to smp_irq_affinity -
+                         * probably affinity changed. need to stop this NAPI
+                         * poll, and restart it on the right CPU
+                         */
                        napi_complete(napi);
                        mlx4_en_arm_cq(priv, cq);
                        return 0;
                }
        } else {
                /* Done for now */
-                cq->mcq.irq_affinity_change = false;
                napi_complete(napi);
                mlx4_en_arm_cq(priv, cq);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 8be7483f8236..5045bab59633 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -351,9 +351,8 @@ int mlx4_en_free_tx_buf(struct net_device *dev, struct mlx4_en_tx_ring *ring)
        return cnt;
 }
-static int mlx4_en_process_tx_cq(struct net_device *dev,
+static bool mlx4_en_process_tx_cq(struct net_device *dev,
-                                 struct mlx4_en_cq *cq,
+                                 struct mlx4_en_cq *cq)
-                                 int budget)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
        struct mlx4_cq *mcq = &cq->mcq;
@@ -372,9 +371,10 @@ static int mlx4_en_process_tx_cq(struct net_device *dev,
        int factor = priv->cqe_factor;
        u64 timestamp = 0;
        int done = 0;
+        int budget = priv->tx_work_limit;
        if (!priv->port_up)
-                return 0;
+                return true;
        index = cons_index & size_mask;
        cqe = &buf[(index << factor) + factor];
@@ -447,7 +447,7 @@ static int mlx4_en_process_tx_cq(struct net_device *dev,
                netif_tx_wake_queue(ring->tx_queue);
                ring->wake_queue++;
        }
-        return done;
+        return done < budget;
 }
 void mlx4_en_tx_irq(struct mlx4_cq *mcq)
@@ -467,24 +467,16 @@ int mlx4_en_poll_tx_cq(struct napi_struct *napi, int budget)
        struct mlx4_en_cq *cq = container_of(napi, struct mlx4_en_cq, napi);
        struct net_device *dev = cq->dev;
        struct mlx4_en_priv *priv = netdev_priv(dev);
-        int done;
+        int clean_complete;
-        done = mlx4_en_process_tx_cq(dev, cq, budget);
+        clean_complete = mlx4_en_process_tx_cq(dev, cq);
+        if (!clean_complete)
+                return budget;
-        /* If we used up all the quota - we're probably not done yet... */
+        napi_complete(napi);
-        if (done < budget) {
+        mlx4_en_arm_cq(priv, cq);
-                /* Done for now */
-                cq->mcq.irq_affinity_change = false;
+        return 0;
-                napi_complete(napi);
-                mlx4_en_arm_cq(priv, cq);
-                return done;
-        } else if (unlikely(cq->mcq.irq_affinity_change)) {
-                cq->mcq.irq_affinity_change = false;
-                napi_complete(napi);
-                mlx4_en_arm_cq(priv, cq);
-                return 0;
-        }
-        return budget;
 }
 static struct mlx4_en_tx_desc *mlx4_en_bounce_to_desc(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index d954ec1eac17..2a004b347e1d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -53,11 +53,6 @@ enum {
        MLX4_EQ_ENTRY_SIZE      = 0x20
 };
-struct mlx4_irq_notify {
-        void *arg;
-        struct irq_affinity_notify notify;
-};
 #define MLX4_EQ_STATUS_OK          ( 0 << 28)
 #define MLX4_EQ_STATUS_WRITE_FAIL  (10 << 28)
 #define MLX4_EQ_OWNER_SW           ( 0 << 24)
@@ -1088,57 +1083,6 @@ static void mlx4_unmap_clr_int(struct mlx4_dev *dev)
        iounmap(priv->clr_base);
 }
-static void mlx4_irq_notifier_notify(struct irq_affinity_notify *notify,
-                                     const cpumask_t *mask)
-{
-        struct mlx4_irq_notify *n = container_of(notify,
-                                                 struct mlx4_irq_notify,
-                                                 notify);
-        struct mlx4_priv *priv = (struct mlx4_priv *)n->arg;
-        struct radix_tree_iter iter;
-        void **slot;
-        radix_tree_for_each_slot(slot, &priv->cq_table.tree, &iter, 0) {
-                struct mlx4_cq *cq = (struct mlx4_cq *)(*slot);
-                if (cq->irq == notify->irq)
-                        cq->irq_affinity_change = true;
-        }
-}
-static void mlx4_release_irq_notifier(struct kref *ref)
-{
-        struct mlx4_irq_notify *n = container_of(ref, struct mlx4_irq_notify,
-                                                 notify.kref);
-        kfree(n);
-}
-static void mlx4_assign_irq_notifier(struct mlx4_priv *priv,
-                                     struct mlx4_dev *dev, int irq)
-{
-        struct mlx4_irq_notify *irq_notifier = NULL;
-        int err = 0;
-        irq_notifier = kzalloc(sizeof(*irq_notifier), GFP_KERNEL);
-        if (!irq_notifier) {
-                mlx4_warn(dev, "Failed to allocate irq notifier. irq %d\n",
-                          irq);
-                return;
-        }
-        irq_notifier->notify.irq = irq;
-        irq_notifier->notify.notify = mlx4_irq_notifier_notify;
-        irq_notifier->notify.release = mlx4_release_irq_notifier;
-        irq_notifier->arg = priv;
-        err = irq_set_affinity_notifier(irq, &irq_notifier->notify);
-        if (err) {
-                kfree(irq_notifier);
-                irq_notifier = NULL;
-                mlx4_warn(dev, "Failed to set irq notifier. irq %d\n", irq);
-        }
-}
 int mlx4_alloc_eq_table(struct mlx4_dev *dev)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
@@ -1409,8 +1353,6 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char *name, struct cpu_rmap *rmap,
                                continue;
                                /*we dont want to break here*/
                        }
-                        mlx4_assign_irq_notifier(priv, dev,
-                                                 priv->eq_table.eq[vec].irq);
                        eq_set_ci(&priv->eq_table.eq[vec], 1);
                }
@@ -1427,6 +1369,14 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char *name, struct cpu_rmap *rmap,
 }
 EXPORT_SYMBOL(mlx4_assign_eq);
+int mlx4_eq_get_irq(struct mlx4_dev *dev, int vec)
+{
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        return priv->eq_table.eq[vec].irq;
+}
+EXPORT_SYMBOL(mlx4_eq_get_irq);
 void mlx4_release_eq(struct mlx4_dev *dev, int vec)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
@@ -1438,9 +1388,6 @@ void mlx4_release_eq(struct mlx4_dev *dev, int vec)
                  Belonging to a legacy EQ*/
                mutex_lock(&priv->msix_ctl.pool_lock);
                if (priv->msix_ctl.pool_bm & 1ULL << i) {
-                        irq_set_affinity_notifier(
-                                priv->eq_table.eq[vec].irq,
-                                NULL);
                        free_irq(priv->eq_table.eq[vec].irq,
                                 &priv->eq_table.eq[vec]);
                        priv->msix_ctl.pool_bm &= ~(1ULL << i);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 5f42f6d6e4c6..82ab427290c3 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2439,7 +2439,8 @@ slave_start:
                            (num_vfs_argc > 1 || probe_vfs_argc > 1)) {
                                mlx4_err(dev,
                                         "Invalid syntax of num_vfs/probe_vfs with IB port - single port VFs syntax is only supported when all ports are configured as ethernet\n");
-                                goto err_close;
+                                err = -EINVAL;
+                                goto err_master_mfunc;
                        }
                        for (i = 0; i < sizeof(nvfs)/sizeof(nvfs[0]); i++) {
                                unsigned j;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 0e15295bedd6..d72a5a894fc6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -126,6 +126,8 @@ enum {
 #define MAX_TX_RINGS                    (MLX4_EN_MAX_TX_RING_P_UP * \
                                         MLX4_EN_NUM_UP)
+#define MLX4_EN_DEFAULT_TX_WORK         256
 /* Target number of packets to coalesce with interrupt moderation */
 #define MLX4_EN_RX_COAL_TARGET  44
 #define MLX4_EN_RX_COAL_TIME    0x10
@@ -343,6 +345,7 @@ struct mlx4_en_cq {
 #define CQ_USER_PEND (MLX4_EN_CQ_STATE_POLL | MLX4_EN_CQ_STATE_POLL_YIELD)
        spinlock_t poll_lock; /* protects from LLS/napi conflicts */
 #endif  /* CONFIG_NET_RX_BUSY_POLL */
+        struct irq_desc *irq_desc;
 };
 struct mlx4_en_port_profile {
@@ -542,6 +545,7 @@ struct mlx4_en_priv {
        __be32 ctrl_flags;
        u32 flags;
        u8 num_tx_rings_p_up;
+        u32 tx_work_limit;
        u32 tx_ring_num;
        u32 rx_ring_num;
        u32 rx_skb_size;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mr.c b/drivers/net/ethernet/mellanox/mlx5/core/mr.c
index ba0401d4af50..184c3615f479 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mr.c
@@ -94,6 +94,11 @@ int mlx5_core_create_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr,
        write_lock_irq(&table->lock);
        err = radix_tree_insert(&table->tree, mlx5_base_mkey(mr->key), mr);
        write_unlock_irq(&table->lock);
+        if (err) {
+                mlx5_core_warn(dev, "failed radix tree insert of mr 0x%x, %d\n",
+                               mlx5_base_mkey(mr->key), err);
+                mlx5_core_destroy_mkey(dev, mr);
+        }
        return err;
 }
@@ -104,12 +109,22 @@ int mlx5_core_destroy_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr)
        struct mlx5_mr_table *table = &dev->priv.mr_table;
        struct mlx5_destroy_mkey_mbox_in in;
        struct mlx5_destroy_mkey_mbox_out out;
+        struct mlx5_core_mr *deleted_mr;
        unsigned long flags;
        int err;
        memset(&in, 0, sizeof(in));
        memset(&out, 0, sizeof(out));
+        write_lock_irqsave(&table->lock, flags);
+        deleted_mr = radix_tree_delete(&table->tree, mlx5_base_mkey(mr->key));
+        write_unlock_irqrestore(&table->lock, flags);
+        if (!deleted_mr) {
+                mlx5_core_warn(dev, "failed radix tree delete of mr 0x%x\n",
+                               mlx5_base_mkey(mr->key));
+                return -ENOENT;
+        }
        in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_DESTROY_MKEY);
        in.mkey = cpu_to_be32(mlx5_mkey_to_idx(mr->key));
        err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
@@ -119,10 +134,6 @@ int mlx5_core_destroy_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr)
        if (out.hdr.status)
                return mlx5_cmd_status_to_err(&out.hdr);
-        write_lock_irqsave(&table->lock, flags);
-        radix_tree_delete(&table->tree, mlx5_base_mkey(mr->key));
-        write_unlock_irqrestore(&table->lock, flags);
        return err;
 }
 EXPORT_SYMBOL(mlx5_core_destroy_mkey);
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index be425ad5e824..61623e9af574 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -538,6 +538,7 @@ enum rtl_register_content {
        MagicPacket     = (1 << 5),     /* Wake up when receives a Magic Packet */
        LinkUp          = (1 << 4),     /* Wake up when the cable connection is re-established */
        Jumbo_En0       = (1 << 2),     /* 8168 only. Reserved in the 8168b */
+        Rdy_to_L23      = (1 << 1),     /* L23 Enable */
        Beacon_en       = (1 << 0),     /* 8168 only. Reserved in the 8168b */
        /* Config4 register */
@@ -4239,6 +4240,8 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
                RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
                break;
        case RTL_GIGA_MAC_VER_40:
+                RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
+                break;
        case RTL_GIGA_MAC_VER_41:
        case RTL_GIGA_MAC_VER_42:
        case RTL_GIGA_MAC_VER_43:
@@ -4897,6 +4900,21 @@ static void rtl_enable_clock_request(struct pci_dev *pdev)
                                 PCI_EXP_LNKCTL_CLKREQ_EN);
 }
+static void rtl_pcie_state_l2l3_enable(struct rtl8169_private *tp, bool enable)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+        u8 data;
+        data = RTL_R8(Config3);
+        if (enable)
+                data |= Rdy_to_L23;
+        else
+                data &= ~Rdy_to_L23;
+        RTL_W8(Config3, data);
+}
 #define R8168_CPCMD_QUIRK_MASK (\
        EnableBist | \
        Mac_dbgo_oe | \
@@ -5246,6 +5264,7 @@ static void rtl_hw_start_8411(struct rtl8169_private *tp)
        };
        rtl_hw_start_8168f(tp);
+        rtl_pcie_state_l2l3_enable(tp, false);
        rtl_ephy_init(tp, e_info_8168f_1, ARRAY_SIZE(e_info_8168f_1));
@@ -5284,6 +5303,8 @@ static void rtl_hw_start_8168g_1(struct rtl8169_private *tp)
        rtl_w1w0_eri(tp, 0x2fc, ERIAR_MASK_0001, 0x01, 0x06, ERIAR_EXGMAC);
        rtl_w1w0_eri(tp, 0x1b0, ERIAR_MASK_0011, 0x0000, 0x1000, ERIAR_EXGMAC);
+        rtl_pcie_state_l2l3_enable(tp, false);
 }
 static void rtl_hw_start_8168g_2(struct rtl8169_private *tp)
@@ -5536,6 +5557,8 @@ static void rtl_hw_start_8105e_1(struct rtl8169_private *tp)
        RTL_W8(DLLPR, RTL_R8(DLLPR) | PFM_EN);
        rtl_ephy_init(tp, e_info_8105e_1, ARRAY_SIZE(e_info_8105e_1));
+        rtl_pcie_state_l2l3_enable(tp, false);
 }
 static void rtl_hw_start_8105e_2(struct rtl8169_private *tp)
@@ -5571,6 +5594,8 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp)
        rtl_eri_write(tp, 0xc0, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
        rtl_eri_write(tp, 0xb8, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
        rtl_w1w0_eri(tp, 0x0d4, ERIAR_MASK_0011, 0x0e00, 0xff00, ERIAR_EXGMAC);
+        rtl_pcie_state_l2l3_enable(tp, false);
 }
 static void rtl_hw_start_8106(struct rtl8169_private *tp)
@@ -5583,6 +5608,8 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp)
        RTL_W32(MISC, (RTL_R32(MISC) | DISABLE_LAN_EN) & ~EARLY_TALLY_EN);
        RTL_W8(MCU, RTL_R8(MCU) | EN_NDP | EN_OOB_RESET);
        RTL_W8(DLLPR, RTL_R8(DLLPR) & ~PFM_EN);
+        rtl_pcie_state_l2l3_enable(tp, false);
 }
 static void rtl_hw_start_8101(struct net_device *dev)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index b3e148ef5683..9d3748361a1e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -320,11 +320,8 @@ static void dwmac1000_set_eee_timer(void __iomem *ioaddr, int ls, int tw)
 static void dwmac1000_ctrl_ane(void __iomem *ioaddr, bool restart)
 {
-        u32 value;
-        value = readl(ioaddr + GMAC_AN_CTRL);
        /* auto negotiation enable and External Loopback enable */
-        value = GMAC_AN_CTRL_ANE | GMAC_AN_CTRL_ELE;
+        u32 value = GMAC_AN_CTRL_ANE | GMAC_AN_CTRL_ELE;
        if (restart)
                value |= GMAC_AN_CTRL_RAN;
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 7e6628a91514..1e2bcf5f89e1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -145,7 +145,7 @@ static void enh_desc_get_ext_status(void *data, struct stmmac_extra_stats *x,
                        x->rx_msg_type_delay_req++;
                else if (p->des4.erx.msg_type == RDES_EXT_DELAY_RESP)
                        x->rx_msg_type_delay_resp++;
-                else if (p->des4.erx.msg_type == RDES_EXT_DELAY_REQ)
+                else if (p->des4.erx.msg_type == RDES_EXT_PDELAY_REQ)
                        x->rx_msg_type_pdelay_req++;
                else if (p->des4.erx.msg_type == RDES_EXT_PDELAY_RESP)
                        x->rx_msg_type_pdelay_resp++;
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index 1c24a8f368bd..d813bfb1a847 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -610,6 +610,13 @@ static int __vnet_tx_trigger(struct vnet_port *port)
        return err;
 }
+static inline bool port_is_up(struct vnet_port *vnet)
+{
+        struct vio_driver_state *vio = &vnet->vio;
+        return !!(vio->hs_state & VIO_HS_COMPLETE);
+}
 struct vnet_port *__tx_port_find(struct vnet *vp, struct sk_buff *skb)
 {
        unsigned int hash = vnet_hashfn(skb->data);
@@ -617,14 +624,19 @@ struct vnet_port *__tx_port_find(struct vnet *vp, struct sk_buff *skb)
        struct vnet_port *port;
        hlist_for_each_entry(port, hp, hash) {
+                if (!port_is_up(port))
+                        continue;
                if (ether_addr_equal(port->raddr, skb->data))
                        return port;
        }
-        port = NULL;
+        list_for_each_entry(port, &vp->port_list, list) {
-        if (!list_empty(&vp->port_list))
+                if (!port->switch_port)
-                port = list_entry(vp->port_list.next, struct vnet_port, list);
+                        continue;
+                if (!port_is_up(port))
-        return port;
+                        continue;
+                return port;
+        }
+        return NULL;
 }
 struct vnet_port *tx_port_find(struct vnet *vp, struct sk_buff *skb)
@@ -1083,6 +1095,24 @@ static struct vnet *vnet_find_or_create(const u64 *local_mac)
        return vp;
 }
+static void vnet_cleanup(void)
+{
+        struct vnet *vp;
+        struct net_device *dev;
+        mutex_lock(&vnet_list_mutex);
+        while (!list_empty(&vnet_list)) {
+                vp = list_first_entry(&vnet_list, struct vnet, list);
+                list_del(&vp->list);
+                dev = vp->dev;
+                /* vio_unregister_driver() should have cleaned up port_list */
+                BUG_ON(!list_empty(&vp->port_list));
+                unregister_netdev(dev);
+                free_netdev(dev);
+        }
+        mutex_unlock(&vnet_list_mutex);
+}
 static const char *local_mac_prop = "local-mac-address";
 static struct vnet *vnet_find_parent(struct mdesc_handle *hp,
@@ -1240,7 +1270,6 @@ static int vnet_port_remove(struct vio_dev *vdev)
                kfree(port);
-                unregister_netdev(vp->dev);
        }
        return 0;
 }
@@ -1268,6 +1297,7 @@ static int __init vnet_init(void)
 static void __exit vnet_exit(void)
 {
        vio_unregister_driver(&vnet_port_driver);
+        vnet_cleanup();
 }
 module_init(vnet_init);
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index ff380dac6629..b988d16cd34e 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1212,7 +1212,12 @@ static int cpsw_ndo_open(struct net_device *ndev)
        for_each_slave(priv, cpsw_slave_open, priv);
        /* Add default VLAN */
-        cpsw_add_default_vlan(priv);
+        if (!priv->data.dual_emac)
+                cpsw_add_default_vlan(priv);
+        else
+                cpsw_ale_add_vlan(priv->ale, priv->data.default_vlan,
+                                  ALE_ALL_PORTS << priv->host_port,
+                                  ALE_ALL_PORTS << priv->host_port, 0, 0);
        if (!cpsw_common_res_usage_state(priv)) {
                /* setup tx dma to fixed prio and zero offset */
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 14389f841d43..4c70360967c2 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2191,7 +2191,6 @@ static void tile_net_setup(struct net_device *dev)
 static void tile_net_dev_init(const char *name, const uint8_t *mac)
 {
        int ret;
-        int i;
        struct net_device *dev;
        struct tile_net_priv *priv;
diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c
index eb78203cd58e..2aa57270838f 100644
--- a/drivers/net/fddi/defxx.c
+++ b/drivers/net/fddi/defxx.c
@@ -291,7 +291,11 @@ static int		dfx_hw_dma_uninit(DFX_board_t *bp, PI_UINT32 type);
 static int              dfx_rcv_init(DFX_board_t *bp, int get_buffers);
 static void             dfx_rcv_queue_process(DFX_board_t *bp);
+#ifdef DYNAMIC_BUFFERS
 static void             dfx_rcv_flush(DFX_board_t *bp);
+#else
+static inline void      dfx_rcv_flush(DFX_board_t *bp) {}
+#endif
 static netdev_tx_t dfx_xmt_queue_pkt(struct sk_buff *skb,
                                     struct net_device *dev);
@@ -2849,7 +2853,7 @@ static int dfx_hw_dma_uninit(DFX_board_t *bp, PI_UINT32 type)
 *      Align an sk_buff to a boundary power of 2
 *
 */
+#ifdef DYNAMIC_BUFFERS
 static void my_skb_align(struct sk_buff *skb, int n)
 {
        unsigned long x = (unsigned long)skb->data;
@@ -2859,7 +2863,7 @@ static void my_skb_align(struct sk_buff *skb, int n)
        skb_reserve(skb, v - x);
 }
+#endif
 /*
 * ================
@@ -3074,10 +3078,7 @@ static void dfx_rcv_queue_process(
                                        break;
                                        }
                                else {
-#ifndef DYNAMIC_BUFFERS
+                                        if (!rx_in_place) {
-                                        if (! rx_in_place)
-#endif
-                                        {
                                                /* Receive buffer allocated, pass receive packet up */
                                                skb_copy_to_linear_data(skb,
@@ -3453,10 +3454,6 @@ static void dfx_rcv_flush( DFX_board_t *bp )
                }
        }
-#else
-static inline void dfx_rcv_flush( DFX_board_t *bp )
-{
-}
 #endif /* DYNAMIC_BUFFERS */
 /*
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index c041f63a6d30..d97d5f39a04e 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -189,7 +189,7 @@ static int netvsc_destroy_buf(struct netvsc_device *net_device)
                                   "unable to teardown send buffer's gpadl\n");
                        return ret;
                }
-                net_device->recv_buf_gpadl_handle = 0;
+                net_device->send_buf_gpadl_handle = 0;
        }
        if (net_device->send_buf) {
                /* Free up the receive buffer */
@@ -378,8 +378,10 @@ static int netvsc_init_buf(struct hv_device *device)
        net_device->send_section_map =
                kzalloc(net_device->map_words * sizeof(ulong), GFP_KERNEL);
-        if (net_device->send_section_map == NULL)
+        if (net_device->send_section_map == NULL) {
+                ret = -ENOMEM;
                goto cleanup;
+        }
        goto exit;
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 4517b149ed07..50899416f668 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -1137,6 +1137,8 @@ static int at86rf230_probe(struct spi_device *spi)
        dev->flags = IEEE802154_HW_OMIT_CKSUM | IEEE802154_HW_AACK;
        irq_type = irq_get_trigger_type(spi->irq);
+        if (!irq_type)
+                irq_type = IRQF_TRIGGER_RISING;
        if (irq_type & (IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING)) {
                irq_worker = at86rf230_irqwork;
                irq_handler = at86rf230_isr;
@@ -1168,7 +1170,8 @@ static int at86rf230_probe(struct spi_device *spi)
        if (rc)
                goto err_hw_init;
-        rc = devm_request_irq(&spi->dev, spi->irq, irq_handler, IRQF_SHARED,
+        rc = devm_request_irq(&spi->dev, spi->irq, irq_handler,
+                              IRQF_SHARED | irq_type,
                              dev_name(&spi->dev), lp);
        if (rc)
                goto err_hw_init;
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 6c622aedbae1..fdc1b418fa6a 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -16,9 +16,13 @@
 #include <linux/string.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/of_gpio.h>
+#include <linux/gpio/consumer.h>
 #define AT803X_INTR_ENABLE                      0x12
 #define AT803X_INTR_STATUS                      0x13
+#define AT803X_SMART_SPEED                      0x14
+#define AT803X_LED_CONTROL                      0x18
 #define AT803X_WOL_ENABLE                       0x01
 #define AT803X_DEVICE_ADDR                      0x03
 #define AT803X_LOC_MAC_ADDR_0_15_OFFSET         0x804C
@@ -35,10 +39,52 @@
 #define AT803X_DEBUG_SYSTEM_MODE_CTRL           0x05
 #define AT803X_DEBUG_RGMII_TX_CLK_DLY           BIT(8)
+#define ATH8030_PHY_ID 0x004dd076
+#define ATH8031_PHY_ID 0x004dd074
+#define ATH8035_PHY_ID 0x004dd072
 MODULE_DESCRIPTION("Atheros 803x PHY driver");
 MODULE_AUTHOR("Matus Ujhelyi");
 MODULE_LICENSE("GPL");
+struct at803x_priv {
+        bool phy_reset:1;
+        struct gpio_desc *gpiod_reset;
+};
+struct at803x_context {
+        u16 bmcr;
+        u16 advertise;
+        u16 control1000;
+        u16 int_enable;
+        u16 smart_speed;
+        u16 led_control;
+};
+/* save relevant PHY registers to private copy */
+static void at803x_context_save(struct phy_device *phydev,
+                                struct at803x_context *context)
+{
+        context->bmcr = phy_read(phydev, MII_BMCR);
+        context->advertise = phy_read(phydev, MII_ADVERTISE);
+        context->control1000 = phy_read(phydev, MII_CTRL1000);
+        context->int_enable = phy_read(phydev, AT803X_INTR_ENABLE);
+        context->smart_speed = phy_read(phydev, AT803X_SMART_SPEED);
+        context->led_control = phy_read(phydev, AT803X_LED_CONTROL);
+}
+/* restore relevant PHY registers from private copy */
+static void at803x_context_restore(struct phy_device *phydev,
+                                   const struct at803x_context *context)
+{
+        phy_write(phydev, MII_BMCR, context->bmcr);
+        phy_write(phydev, MII_ADVERTISE, context->advertise);
+        phy_write(phydev, MII_CTRL1000, context->control1000);
+        phy_write(phydev, AT803X_INTR_ENABLE, context->int_enable);
+        phy_write(phydev, AT803X_SMART_SPEED, context->smart_speed);
+        phy_write(phydev, AT803X_LED_CONTROL, context->led_control);
+}
 static int at803x_set_wol(struct phy_device *phydev,
                          struct ethtool_wolinfo *wol)
 {
@@ -142,6 +188,26 @@ static int at803x_resume(struct phy_device *phydev)
        return 0;
 }
+static int at803x_probe(struct phy_device *phydev)
+{
+        struct device *dev = &phydev->dev;
+        struct at803x_priv *priv;
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+        priv->gpiod_reset = devm_gpiod_get(dev, "reset");
+        if (IS_ERR(priv->gpiod_reset))
+                priv->gpiod_reset = NULL;
+        else
+                gpiod_direction_output(priv->gpiod_reset, 1);
+        phydev->priv = priv;
+        return 0;
+}
 static int at803x_config_init(struct phy_device *phydev)
 {
        int ret;
@@ -189,58 +255,99 @@ static int at803x_config_intr(struct phy_device *phydev)
        return err;
 }
+static void at803x_link_change_notify(struct phy_device *phydev)
+{
+        struct at803x_priv *priv = phydev->priv;
+        /*
+         * Conduct a hardware reset for AT8030 every time a link loss is
+         * signalled. This is necessary to circumvent a hardware bug that
+         * occurs when the cable is unplugged while TX packets are pending
+         * in the FIFO. In such cases, the FIFO enters an error mode it
+         * cannot recover from by software.
+         */
+        if (phydev->drv->phy_id == ATH8030_PHY_ID) {
+                if (phydev->state == PHY_NOLINK) {
+                        if (priv->gpiod_reset && !priv->phy_reset) {
+                                struct at803x_context context;
+                                at803x_context_save(phydev, &context);
+                                gpiod_set_value(priv->gpiod_reset, 0);
+                                msleep(1);
+                                gpiod_set_value(priv->gpiod_reset, 1);
+                                msleep(1);
+                                at803x_context_restore(phydev, &context);
+                                dev_dbg(&phydev->dev, "%s(): phy was reset\n",
+                                        __func__);
+                                priv->phy_reset = true;
+                        }
+                } else {
+                        priv->phy_reset = false;
+                }
+        }
+}
 static struct phy_driver at803x_driver[] = {
 {
        /* ATHEROS 8035 */
-        .phy_id         = 0x004dd072,
+        .phy_id                 = ATH8035_PHY_ID,
-        .name           = "Atheros 8035 ethernet",
+        .name                   = "Atheros 8035 ethernet",
-        .phy_id_mask    = 0xffffffef,
+        .phy_id_mask            = 0xffffffef,
-        .config_init    = at803x_config_init,
+        .probe                  = at803x_probe,
-        .set_wol        = at803x_set_wol,
+        .config_init            = at803x_config_init,
-        .get_wol        = at803x_get_wol,
+        .link_change_notify     = at803x_link_change_notify,
-        .suspend        = at803x_suspend,
+        .set_wol                = at803x_set_wol,
-        .resume         = at803x_resume,
+        .get_wol                = at803x_get_wol,
-        .features       = PHY_GBIT_FEATURES,
+        .suspend                = at803x_suspend,
-        .flags          = PHY_HAS_INTERRUPT,
+        .resume                 = at803x_resume,
-        .config_aneg    = genphy_config_aneg,
+        .features               = PHY_GBIT_FEATURES,
-        .read_status    = genphy_read_status,
+        .flags                  = PHY_HAS_INTERRUPT,
-        .driver         = {
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .driver                 = {
                .owner = THIS_MODULE,
        },
 }, {
        /* ATHEROS 8030 */
-        .phy_id         = 0x004dd076,
+        .phy_id                 = ATH8030_PHY_ID,
-        .name           = "Atheros 8030 ethernet",
+        .name                   = "Atheros 8030 ethernet",
-        .phy_id_mask    = 0xffffffef,
+        .phy_id_mask            = 0xffffffef,
-        .config_init    = at803x_config_init,
+        .probe                  = at803x_probe,
-        .set_wol        = at803x_set_wol,
+        .config_init            = at803x_config_init,
-        .get_wol        = at803x_get_wol,
+        .link_change_notify     = at803x_link_change_notify,
-        .suspend        = at803x_suspend,
+        .set_wol                = at803x_set_wol,
-        .resume         = at803x_resume,
+        .get_wol                = at803x_get_wol,
-        .features       = PHY_GBIT_FEATURES,
+        .suspend                = at803x_suspend,
-        .flags          = PHY_HAS_INTERRUPT,
+        .resume                 = at803x_resume,
-        .config_aneg    = genphy_config_aneg,
+        .features               = PHY_GBIT_FEATURES,
-        .read_status    = genphy_read_status,
+        .flags                  = PHY_HAS_INTERRUPT,
-        .driver         = {
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .driver                 = {
                .owner = THIS_MODULE,
        },
 }, {
        /* ATHEROS 8031 */
-        .phy_id         = 0x004dd074,
+        .phy_id                 = ATH8031_PHY_ID,
-        .name           = "Atheros 8031 ethernet",
+        .name                   = "Atheros 8031 ethernet",
-        .phy_id_mask    = 0xffffffef,
+        .phy_id_mask            = 0xffffffef,
-        .config_init    = at803x_config_init,
+        .probe                  = at803x_probe,
-        .set_wol        = at803x_set_wol,
+        .config_init            = at803x_config_init,
-        .get_wol        = at803x_get_wol,
+        .link_change_notify     = at803x_link_change_notify,
-        .suspend        = at803x_suspend,
+        .set_wol                = at803x_set_wol,
-        .resume         = at803x_resume,
+        .get_wol                = at803x_get_wol,
-        .features       = PHY_GBIT_FEATURES,
+        .suspend                = at803x_suspend,
-        .flags          = PHY_HAS_INTERRUPT,
+        .resume                 = at803x_resume,
-        .config_aneg    = genphy_config_aneg,
+        .features               = PHY_GBIT_FEATURES,
-        .read_status    = genphy_read_status,
+        .flags                  = PHY_HAS_INTERRUPT,
-        .ack_interrupt  = &at803x_ack_interrupt,
+        .config_aneg            = genphy_config_aneg,
-        .config_intr    = &at803x_config_intr,
+        .read_status            = genphy_read_status,
-        .driver         = {
+        .ack_interrupt          = &at803x_ack_interrupt,
+        .config_intr            = &at803x_config_intr,
+        .driver                 = {
                .owner = THIS_MODULE,
        },
 } };
@@ -260,9 +367,9 @@ module_init(atheros_init);
 module_exit(atheros_exit);
 static struct mdio_device_id __maybe_unused atheros_tbl[] = {
-        { 0x004dd076, 0xffffffef },
+        { ATH8030_PHY_ID, 0xffffffef },
-        { 0x004dd074, 0xffffffef },
+        { ATH8031_PHY_ID, 0xffffffef },
-        { 0x004dd072, 0xffffffef },
+        { ATH8035_PHY_ID, 0xffffffef },
        { }
 };
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 6a999e6814a0..9408157a246c 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1323,15 +1323,15 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
 {
        struct dp83640_private *dp83640 = phydev->priv;
-        if (!dp83640->hwts_rx_en)
-                return false;
        if (is_status_frame(skb, type)) {
                decode_status_frame(dp83640, skb);
                kfree_skb(skb);
                return true;
        }
+        if (!dp83640->hwts_rx_en)
+                return false;
        SKB_PTP_TYPE(skb) = type;
        skb_queue_tail(&dp83640->rx_queue, skb);
        schedule_work(&dp83640->ts_work);
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 2e58aa54484c..203651ebccb0 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -187,6 +187,50 @@ struct mii_bus *of_mdio_find_bus(struct device_node *mdio_bus_np)
        return d ? to_mii_bus(d) : NULL;
 }
 EXPORT_SYMBOL(of_mdio_find_bus);
+/* Walk the list of subnodes of a mdio bus and look for a node that matches the
+ * phy's address with its 'reg' property. If found, set the of_node pointer for
+ * the phy. This allows auto-probed pyh devices to be supplied with information
+ * passed in via DT.
+ */
+static void of_mdiobus_link_phydev(struct mii_bus *mdio,
+                                   struct phy_device *phydev)
+{
+        struct device *dev = &phydev->dev;
+        struct device_node *child;
+        if (dev->of_node || !mdio->dev.of_node)
+                return;
+        for_each_available_child_of_node(mdio->dev.of_node, child) {
+                int addr;
+                int ret;
+                ret = of_property_read_u32(child, "reg", &addr);
+                if (ret < 0) {
+                        dev_err(dev, "%s has invalid PHY address\n",
+                                child->full_name);
+                        continue;
+                }
+                /* A PHY must have a reg property in the range [0-31] */
+                if (addr >= PHY_MAX_ADDR) {
+                        dev_err(dev, "%s PHY address %i is too large\n",
+                                child->full_name, addr);
+                        continue;
+                }
+                if (addr == phydev->addr) {
+                        dev->of_node = child;
+                        return;
+                }
+        }
+}
+#else /* !IS_ENABLED(CONFIG_OF_MDIO) */
+static inline void of_mdiobus_link_phydev(struct mii_bus *mdio,
+                                          struct phy_device *phydev)
+{
+}
 #endif
 /**
@@ -211,6 +255,7 @@ int mdiobus_register(struct mii_bus *bus)
        bus->dev.parent = bus->parent;
        bus->dev.class = &mdio_bus_class;
+        bus->dev.driver = bus->parent->driver;
        bus->dev.groups = NULL;
        dev_set_name(&bus->dev, "%s", bus->id);
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 3bc079a67a3d..f7c61812ea4a 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -720,6 +720,9 @@ void phy_state_machine(struct work_struct *work)
        mutex_lock(&phydev->lock);
+        if (phydev->drv->link_change_notify)
+                phydev->drv->link_change_notify(phydev);
        switch (phydev->state) {
        case PHY_DOWN:
        case PHY_STARTING:
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 35d753d22f78..22c57be4dfa0 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -355,7 +355,7 @@ int phy_device_register(struct phy_device *phydev)
        phydev->bus->phy_map[phydev->addr] = phydev;
        /* Run all of the fixups for this PHY */
-        err = phy_init_hw(phydev);
+        err = phy_scan_fixups(phydev);
        if (err) {
                pr_err("PHY %d failed to initialize\n", phydev->addr);
                goto out;
@@ -575,6 +575,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                      u32 flags, phy_interface_t interface)
 {
        struct device *d = &phydev->dev;
+        struct module *bus_module;
        int err;
        /* Assume that if there is no driver, that it doesn't
@@ -599,6 +600,14 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                return -EBUSY;
        }
+        /* Increment the bus module reference count */
+        bus_module = phydev->bus->dev.driver ?
+                     phydev->bus->dev.driver->owner : NULL;
+        if (!try_module_get(bus_module)) {
+                dev_err(&dev->dev, "failed to get the bus module\n");
+                return -EIO;
+        }
        phydev->attached_dev = dev;
        dev->phydev = phydev;
@@ -664,6 +673,10 @@ EXPORT_SYMBOL(phy_attach);
 void phy_detach(struct phy_device *phydev)
 {
        int i;
+        if (phydev->bus->dev.driver)
+                module_put(phydev->bus->dev.driver->owner);
        phydev->attached_dev->phydev = NULL;
        phydev->attached_dev = NULL;
        phy_suspend(phydev);
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 91d6c1272fcf..d5b77ef3a210 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -539,7 +539,7 @@ static int get_filter(void __user *arg, struct sock_filter **p)
 {
        struct sock_fprog uprog;
        struct sock_filter *code = NULL;
-        int len, err;
+        int len;
        if (copy_from_user(&uprog, arg, sizeof(uprog)))
                return -EFAULT;
@@ -554,12 +554,6 @@ static int get_filter(void __user *arg, struct sock_filter **p)
        if (IS_ERR(code))
                return PTR_ERR(code);
-        err = sk_chk_filter(code, uprog.len);
-        if (err) {
-                kfree(code);
-                return err;
-        }
        *p = code;
        return uprog.len;
 }
@@ -763,10 +757,15 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                        };
                        ppp_lock(ppp);
-                        if (ppp->pass_filter)
+                        if (ppp->pass_filter) {
                                sk_unattached_filter_destroy(ppp->pass_filter);
-                        err = sk_unattached_filter_create(&ppp->pass_filter,
+                                ppp->pass_filter = NULL;
-                                                          &fprog);
+                        }
+                        if (fprog.filter != NULL)
+                                err = sk_unattached_filter_create(&ppp->pass_filter,
+                                                                  &fprog);
+                        else
+                                err = 0;
                        kfree(code);
                        ppp_unlock(ppp);
                }
@@ -784,10 +783,15 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                        };
                        ppp_lock(ppp);
-                        if (ppp->active_filter)
+                        if (ppp->active_filter) {
                                sk_unattached_filter_destroy(ppp->active_filter);
-                        err = sk_unattached_filter_create(&ppp->active_filter,
+                                ppp->active_filter = NULL;
-                                                          &fprog);
+                        }
+                        if (fprog.filter != NULL)
+                                err = sk_unattached_filter_create(&ppp->active_filter,
+                                                                  &fprog);
+                        else
+                                err = 0;
                        kfree(code);
                        ppp_unlock(ppp);
                }
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 2ea7efd11857..6c9c16d76935 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -675,7 +675,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
                                   dev->hard_header_len);
-                po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
+                po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
                po->chan.private = sk;
                po->chan.ops = &pppoe_chan_ops;
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index ad4a94e9ff57..87526443841f 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -83,6 +83,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/workqueue.h>
 #include "slip.h"
 #ifdef CONFIG_INET
 #include <linux/ip.h>
@@ -416,36 +417,46 @@ static void sl_encaps(struct slip *sl, unsigned char *icp, int len)
 #endif
 }
-/*
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
- * Called by the driver when there's room for more data.  If we have
+static void slip_transmit(struct work_struct *work)
- * more packets to send, we send them here.
- */
-static void slip_write_wakeup(struct tty_struct *tty)
 {
+        struct slip *sl = container_of(work, struct slip, tx_work);
        int actual;
-        struct slip *sl = tty->disc_data;
+        spin_lock_bh(&sl->lock);
        /* First make sure we're connected. */
-        if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
+        if (!sl->tty || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) {
+                spin_unlock_bh(&sl->lock);
                return;
+        }
-        spin_lock_bh(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
                spin_unlock_bh(&sl->lock);
                sl_unlock(sl);
                return;
        }
-        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
        spin_unlock_bh(&sl->lock);
 }
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slip_write_wakeup(struct tty_struct *tty)
+{
+        struct slip *sl = tty->disc_data;
+        schedule_work(&sl->tx_work);
+}
 static void sl_tx_timeout(struct net_device *dev)
 {
        struct slip *sl = netdev_priv(dev);
@@ -749,6 +760,7 @@ static struct slip *sl_alloc(dev_t line)
        sl->magic       = SLIP_MAGIC;
        sl->dev         = dev;
        spin_lock_init(&sl->lock);
+        INIT_WORK(&sl->tx_work, slip_transmit);
        sl->mode        = SL_MODE_DEFAULT;
 #ifdef CONFIG_SLIP_SMART
        /* initialize timer_list struct */
@@ -872,8 +884,12 @@ static void slip_close(struct tty_struct *tty)
        if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty)
                return;
+        spin_lock_bh(&sl->lock);
        tty->disc_data = NULL;
        sl->tty = NULL;
+        spin_unlock_bh(&sl->lock);
+        flush_work(&sl->tx_work);
        /* VSV = very important to remove timers */
 #ifdef CONFIG_SLIP_SMART
diff --git a/drivers/net/slip/slip.h b/drivers/net/slip/slip.h
index 67673cf1266b..cf32aadf508f 100644
--- a/drivers/net/slip/slip.h
+++ b/drivers/net/slip/slip.h
@@ -53,6 +53,7 @@ struct slip {
  struct tty_struct     *tty;           /* ptr to TTY structure         */
  struct net_device     *dev;           /* easy for intr handling       */
  spinlock_t            lock;
+  struct work_struct    tx_work;        /* Flushes transmit buffer      */
 #ifdef SL_INCLUDE_CSLIP
  struct slcompress     *slcomp;        /* for header compression       */
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 9ea4bfe5d318..2a32d9167d3b 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -341,6 +341,22 @@ next_desc:
                usb_driver_release_interface(driver, info->data);
                return -ENODEV;
        }
+        /* Some devices don't initialise properly. In particular
+         * the packet filter is not reset. There are devices that
+         * don't do reset all the way. So the packet filter should
+         * be set to a sane initial value.
+         */
+        usb_control_msg(dev->udev,
+                        usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
+                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED | USB_CDC_PACKET_TYPE_BROADCAST,
+                        intf->cur_altsetting->desc.bInterfaceNumber,
+                        NULL,
+                        0,
+                        USB_CTRL_SET_TIMEOUT
+                );
        return 0;
 bad_desc:
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index a3a05869309d..a4272ed62da8 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -258,10 +258,8 @@ struct hso_serial {
         * so as not to drop characters on the floor.
         */
        int  curr_rx_urb_idx;
-        u16  curr_rx_urb_offset;
        u8   rx_urb_filled[MAX_RX_URBS];
        struct tasklet_struct unthrottle_tasklet;
-        struct work_struct    retry_unthrottle_workqueue;
 };
 struct hso_device {
@@ -1252,14 +1250,6 @@ static	void hso_unthrottle(struct tty_struct *tty)
        tasklet_hi_schedule(&serial->unthrottle_tasklet);
 }
-static void hso_unthrottle_workfunc(struct work_struct *work)
-{
-        struct hso_serial *serial =
-            container_of(work, struct hso_serial,
-                         retry_unthrottle_workqueue);
-        hso_unthrottle_tasklet(serial);
-}
 /* open the requested serial port */
 static int hso_serial_open(struct tty_struct *tty, struct file *filp)
 {
@@ -1295,8 +1285,6 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
                tasklet_init(&serial->unthrottle_tasklet,
                             (void (*)(unsigned long))hso_unthrottle_tasklet,
                             (unsigned long)serial);
-                INIT_WORK(&serial->retry_unthrottle_workqueue,
-                          hso_unthrottle_workfunc);
                result = hso_start_serial_device(serial->parent, GFP_KERNEL);
                if (result) {
                        hso_stop_serial_device(serial->parent);
@@ -1345,7 +1333,6 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
                if (!usb_gone)
                        hso_stop_serial_device(serial->parent);
                tasklet_kill(&serial->unthrottle_tasklet);
-                cancel_work_sync(&serial->retry_unthrottle_workqueue);
        }
        if (!usb_gone)
@@ -2013,8 +2000,7 @@ static void ctrl_callback(struct urb *urb)
 static int put_rxbuf_data(struct urb *urb, struct hso_serial *serial)
 {
        struct tty_struct *tty;
-        int write_length_remaining = 0;
+        int count;
-        int curr_write_len;
        /* Sanity check */
        if (urb == NULL || serial == NULL) {
@@ -2024,29 +2010,28 @@ static int put_rxbuf_data(struct urb *urb, struct hso_serial *serial)
        tty = tty_port_tty_get(&serial->port);
+        if (tty && test_bit(TTY_THROTTLED, &tty->flags)) {
+                tty_kref_put(tty);
+                return -1;
+        }
        /* Push data to tty */
-        write_length_remaining = urb->actual_length -
-                serial->curr_rx_urb_offset;
        D1("data to push to tty");
-        while (write_length_remaining) {
+        count = tty_buffer_request_room(&serial->port, urb->actual_length);
-                if (tty && test_bit(TTY_THROTTLED, &tty->flags)) {
+        if (count >= urb->actual_length) {
-                        tty_kref_put(tty);
+                tty_insert_flip_string(&serial->port, urb->transfer_buffer,
-                        return -1;
+                                       urb->actual_length);
-                }
-                curr_write_len = tty_insert_flip_string(&serial->port,
-                        urb->transfer_buffer + serial->curr_rx_urb_offset,
-                        write_length_remaining);
-                serial->curr_rx_urb_offset += curr_write_len;
-                write_length_remaining -= curr_write_len;
                tty_flip_buffer_push(&serial->port);
+        } else {
+                dev_warn(&serial->parent->usb->dev,
+                         "dropping data, %d bytes lost\n", urb->actual_length);
        }
        tty_kref_put(tty);
-        if (write_length_remaining == 0) {
+        serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 0;
-                serial->curr_rx_urb_offset = 0;
-                serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 0;
+        return 0;
-        }
-        return write_length_remaining;
 }
@@ -2217,7 +2202,6 @@ static int hso_stop_serial_device(struct hso_device *hso_dev)
                }
        }
        serial->curr_rx_urb_idx = 0;
-        serial->curr_rx_urb_offset = 0;
        if (serial->tx_urb)
                usb_kill_urb(serial->tx_urb);
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index f9822bc75425..735f7dadb9a0 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -84,12 +84,13 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
        ctx = drvstate->ctx;
        if (usbnet_dev->status)
-                /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256
+                /* The wMaxCommand buffer must be big enough to hold
-                 * decimal (0x100)"
+                 * any message from the modem. Experience has shown
+                 * that some replies are more than 256 bytes long
                 */
                subdriver = usb_cdc_wdm_register(ctx->control,
                                                 &usbnet_dev->status->desc,
-                                                 256, /* wMaxCommand */
+                                                 1024, /* wMaxCommand */
                                                 huawei_cdc_ncm_wdm_manage_power);
        if (IS_ERR(subdriver)) {
                ret = PTR_ERR(subdriver);
@@ -193,6 +194,9 @@ static const struct usb_device_id huawei_cdc_ncm_devs[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x76),
          .driver_info = (unsigned long)&huawei_cdc_ncm_info,
        },
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x03, 0x16),
+          .driver_info = (unsigned long)&huawei_cdc_ncm_info,
+        },
        /* Terminating entry */
        {
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index cf62d7e8329f..22756db53dca 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -667,6 +667,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
        {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
        {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
+        {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
        {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
        {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
@@ -741,6 +742,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
        {QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
        {QMI_FIXED_INTF(0x19d2, 0x1426, 2)},    /* ZTE MF91 */
+        {QMI_FIXED_INTF(0x19d2, 0x1428, 2)},    /* Telewell TW-LTE 4G v2 */
        {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
        {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
        {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
@@ -756,6 +758,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x9054, 8)},    /* Sierra Wireless Modem */
        {QMI_FIXED_INTF(0x1199, 0x9055, 8)},    /* Netgear AirCard 341U */
        {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9057, 8)},
        {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
        {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 25431965a625..3eab74c7c554 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -282,7 +282,7 @@
 /* USB_DEV_STAT */
 #define STAT_SPEED_MASK         0x0006
 #define STAT_SPEED_HIGH         0x0000
-#define STAT_SPEED_FULL         0x0001
+#define STAT_SPEED_FULL         0x0002
 /* USB_TX_AGG */
 #define TX_AGG_MAX_THRESHOLD    0x03
@@ -1359,7 +1359,7 @@ static void r8152_csum_workaround(struct r8152 *tp, struct sk_buff *skb,
                struct sk_buff_head seg_list;
                struct sk_buff *segs, *nskb;
-                features &= ~(NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_TSO);
+                features &= ~(NETIF_F_SG | NETIF_F_IPV6_CSUM | NETIF_F_TSO6);
                segs = skb_gso_segment(skb, features);
                if (IS_ERR(segs) || !segs)
                        goto drop;
@@ -2292,9 +2292,8 @@ static void r8152b_exit_oob(struct r8152 *tp)
        /* rx share fifo credit full threshold */
        ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RXFIFO_CTRL0, RXFIFO_THR1_NORMAL);
-        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_DEV_STAT);
+        if (tp->udev->speed == USB_SPEED_FULL ||
-        ocp_data &= STAT_SPEED_MASK;
+            tp->udev->speed == USB_SPEED_LOW) {
-        if (ocp_data == STAT_SPEED_FULL) {
                /* rx share fifo credit near full threshold */
                ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RXFIFO_CTRL1,
                                RXFIFO_THR2_FULL);
@@ -3204,8 +3203,13 @@ static void rtl8152_get_ethtool_stats(struct net_device *dev,
        struct r8152 *tp = netdev_priv(dev);
        struct tally_counter tally;
+        if (usb_autopm_get_interface(tp->intf) < 0)
+                return;
        generic_ocp_read(tp, PLA_TALLYCNT, sizeof(tally), &tally, MCU_TYPE_PLA);
+        usb_autopm_put_interface(tp->intf);
        data[0] = le64_to_cpu(tally.tx_packets);
        data[1] = le64_to_cpu(tally.rx_packets);
        data[2] = le64_to_cpu(tally.tx_errors);
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 424db65e4396..d07bf4cb893f 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1714,6 +1714,18 @@ static int smsc95xx_resume(struct usb_interface *intf)
        return ret;
 }
+static int smsc95xx_reset_resume(struct usb_interface *intf)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+        int ret;
+        ret = smsc95xx_reset(dev);
+        if (ret < 0)
+                return ret;
+        return smsc95xx_resume(intf);
+}
 static void smsc95xx_rx_csum_offload(struct sk_buff *skb)
 {
        skb->csum = *(u16 *)(skb_tail_pointer(skb) - 2);
@@ -2004,7 +2016,7 @@ static struct usb_driver smsc95xx_driver = {
        .probe          = usbnet_probe,
        .suspend        = smsc95xx_suspend,
        .resume         = smsc95xx_resume,
-        .reset_resume   = smsc95xx_resume,
+        .reset_resume   = smsc95xx_reset_resume,
        .disconnect     = usbnet_disconnect,
        .disable_hub_initiated_lpm = 1,
        .supports_autosuspend = 1,
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 97394345e5dd..b76f7dcde0db 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2589,8 +2589,8 @@ vmxnet3_open(struct net_device *netdev)
        for (i = 0; i < adapter->num_tx_queues; i++)
                spin_lock_init(&adapter->tx_queue[i].tx_lock);
-        err = vmxnet3_create_queues(adapter, VMXNET3_DEF_TX_RING_SIZE,
+        err = vmxnet3_create_queues(adapter, adapter->tx_ring_size,
-                                    VMXNET3_DEF_RX_RING_SIZE,
+                                    adapter->rx_ring_size,
                                    VMXNET3_DEF_RX_RING_SIZE);
        if (err)
                goto queue_err;
@@ -2968,6 +2968,9 @@ vmxnet3_probe_device(struct pci_dev *pdev,
        adapter->netdev = netdev;
        adapter->pdev = pdev;
+        adapter->tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
+        adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
        spin_lock_init(&adapter->cmd_lock);
        adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
                                             sizeof(struct vmxnet3_adapter),
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index 40c1c7b0d9e0..b725fd9e7803 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -449,8 +449,8 @@ vmxnet3_get_ringparam(struct net_device *netdev,
        param->rx_mini_max_pending = 0;
        param->rx_jumbo_max_pending = 0;
-        param->rx_pending = adapter->rx_queue[0].rx_ring[0].size;
+        param->rx_pending = adapter->rx_ring_size;
-        param->tx_pending = adapter->tx_queue[0].tx_ring.size;
+        param->tx_pending = adapter->tx_ring_size;
        param->rx_mini_pending = 0;
        param->rx_jumbo_pending = 0;
 }
@@ -529,9 +529,11 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                         * size */
                        netdev_err(netdev, "failed to apply new sizes, "
                                   "try the default ones\n");
+                        new_rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
+                        new_tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
                        err = vmxnet3_create_queues(adapter,
-                                                    VMXNET3_DEF_TX_RING_SIZE,
+                                                    new_tx_ring_size,
-                                                    VMXNET3_DEF_RX_RING_SIZE,
+                                                    new_rx_ring_size,
                                                    VMXNET3_DEF_RX_RING_SIZE);
                        if (err) {
                                netdev_err(netdev, "failed to create queues "
@@ -545,6 +547,8 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                        netdev_err(netdev, "failed to re-activate, error %d."
                                   " Closing it\n", err);
        }
+        adapter->tx_ring_size = new_tx_ring_size;
+        adapter->rx_ring_size = new_rx_ring_size;
 out:
        clear_bit(VMXNET3_STATE_BIT_RESETTING, &adapter->state);
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 190569d02450..29ee77f2c97f 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -349,6 +349,11 @@ struct vmxnet3_adapter {
        u32     link_speed; /* in mbps */
        u64     tx_timeout_count;
+        /* Ring sizes */
+        u32 tx_ring_size;
+        u32 rx_ring_size;
        struct work_struct work;
        unsigned long  state;    /* VMXNET3_STATE_BIT_xxx */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index ade33ef82823..9f79192c9aa0 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -339,7 +339,7 @@ static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan,
        ndm->ndm_state = fdb->state;
        ndm->ndm_ifindex = vxlan->dev->ifindex;
        ndm->ndm_flags = fdb->flags;
-        ndm->ndm_type = NDA_DST;
+        ndm->ndm_type = RTN_UNICAST;
        if (send_eth && nla_put(skb, NDA_LLADDR, ETH_ALEN, &fdb->eth_addr))
                goto nla_put_failure;
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index 93ace042d0aa..1f041271f7fe 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -2363,7 +2363,7 @@ static char *type_strings[] = {
        "FarSync TE1"
 };
-static void
+static int
 fst_init_card(struct fst_card_info *card)
 {
        int i;
@@ -2374,24 +2374,21 @@ fst_init_card(struct fst_card_info *card)
         * we'll have to revise it in some way then.
         */
        for (i = 0; i < card->nports; i++) {
-                err = register_hdlc_device(card->ports[i].dev);
+                err = register_hdlc_device(card->ports[i].dev);
-                if (err < 0) {
+                if (err < 0) {
-                        int j;
                        pr_err("Cannot register HDLC device for port %d (errno %d)\n",
-                               i, -err);
+                                i, -err);
-                        for (j = i; j < card->nports; j++) {
+                        while (i--)
-                                free_netdev(card->ports[j].dev);
+                                unregister_hdlc_device(card->ports[i].dev);
-                                card->ports[j].dev = NULL;
+                        return err;
-                        }
+                }
-                        card->nports = i;
-                        break;
-                }
        }
        pr_info("%s-%s: %s IRQ%d, %d ports\n",
                port_to_dev(&card->ports[0])->name,
                port_to_dev(&card->ports[card->nports - 1])->name,
                type_strings[card->type], card->irq, card->nports);
+        return 0;
 }
 static const struct net_device_ops fst_ops = {
@@ -2447,15 +2444,12 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        /* Try to enable the device */
        if ((err = pci_enable_device(pdev)) != 0) {
                pr_err("Failed to enable card. Err %d\n", -err);
-                kfree(card);
+                goto enable_fail;
-                return err;
        }
        if ((err = pci_request_regions(pdev, "FarSync")) !=0) {
                pr_err("Failed to allocate regions. Err %d\n", -err);
-                pci_disable_device(pdev);
+                goto regions_fail;
-                kfree(card);
-                return err;
        }
        /* Get virtual addresses of memory regions */
@@ -2464,30 +2458,21 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        card->phys_ctlmem = pci_resource_start(pdev, 3);
        if ((card->mem = ioremap(card->phys_mem, FST_MEMSIZE)) == NULL) {
                pr_err("Physical memory remap failed\n");
-                pci_release_regions(pdev);
+                err = -ENODEV;
-                pci_disable_device(pdev);
+                goto ioremap_physmem_fail;
-                kfree(card);
-                return -ENODEV;
        }
        if ((card->ctlmem = ioremap(card->phys_ctlmem, 0x10)) == NULL) {
                pr_err("Control memory remap failed\n");
-                pci_release_regions(pdev);
+                err = -ENODEV;
-                pci_disable_device(pdev);
+                goto ioremap_ctlmem_fail;
-                iounmap(card->mem);
-                kfree(card);
-                return -ENODEV;
        }
        dbg(DBG_PCI, "kernel mem %p, ctlmem %p\n", card->mem, card->ctlmem);
        /* Register the interrupt handler */
        if (request_irq(pdev->irq, fst_intr, IRQF_SHARED, FST_DEV_NAME, card)) {
                pr_err("Unable to register interrupt %d\n", card->irq);
-                pci_release_regions(pdev);
+                err = -ENODEV;
-                pci_disable_device(pdev);
+                goto irq_fail;
-                iounmap(card->ctlmem);
-                iounmap(card->mem);
-                kfree(card);
-                return -ENODEV;
        }
        /* Record info we need */
@@ -2513,13 +2498,8 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                        while (i--)
                                free_netdev(card->ports[i].dev);
                        pr_err("FarSync: out of memory\n");
-                        free_irq(card->irq, card);
+                        err = -ENOMEM;
-                        pci_release_regions(pdev);
+                        goto hdlcdev_fail;
-                        pci_disable_device(pdev);
-                        iounmap(card->ctlmem);
-                        iounmap(card->mem);
-                        kfree(card);
-                        return -ENODEV;
                }
                card->ports[i].dev    = dev;
                card->ports[i].card   = card;
@@ -2565,9 +2545,16 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_set_drvdata(pdev, card);
        /* Remainder of card setup */
+        if (no_of_cards_added >= FST_MAX_CARDS) {
+                pr_err("FarSync: too many cards\n");
+                err = -ENOMEM;
+                goto card_array_fail;
+        }
        fst_card_array[no_of_cards_added] = card;
        card->card_no = no_of_cards_added++;    /* Record instance and bump it */
-        fst_init_card(card);
+        err = fst_init_card(card);
+        if (err)
+                goto init_card_fail;
        if (card->family == FST_FAMILY_TXU) {
                /*
                 * Allocate a dma buffer for transmit and receives
@@ -2577,29 +2564,46 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                                         &card->rx_dma_handle_card);
                if (card->rx_dma_handle_host == NULL) {
                        pr_err("Could not allocate rx dma buffer\n");
-                        fst_disable_intr(card);
+                        err = -ENOMEM;
-                        pci_release_regions(pdev);
+                        goto rx_dma_fail;
-                        pci_disable_device(pdev);
-                        iounmap(card->ctlmem);
-                        iounmap(card->mem);
-                        kfree(card);
-                        return -ENOMEM;
                }
                card->tx_dma_handle_host =
                    pci_alloc_consistent(card->device, FST_MAX_MTU,
                                         &card->tx_dma_handle_card);
                if (card->tx_dma_handle_host == NULL) {
                        pr_err("Could not allocate tx dma buffer\n");
-                        fst_disable_intr(card);
+                        err = -ENOMEM;
-                        pci_release_regions(pdev);
+                        goto tx_dma_fail;
-                        pci_disable_device(pdev);
-                        iounmap(card->ctlmem);
-                        iounmap(card->mem);
-                        kfree(card);
-                        return -ENOMEM;
                }
        }
        return 0;               /* Success */
+tx_dma_fail:
+        pci_free_consistent(card->device, FST_MAX_MTU,
+                            card->rx_dma_handle_host,
+                            card->rx_dma_handle_card);
+rx_dma_fail:
+        fst_disable_intr(card);
+        for (i = 0 ; i < card->nports ; i++)
+                unregister_hdlc_device(card->ports[i].dev);
+init_card_fail:
+        fst_card_array[card->card_no] = NULL;
+card_array_fail:
+        for (i = 0 ; i < card->nports ; i++)
+                free_netdev(card->ports[i].dev);
+hdlcdev_fail:
+        free_irq(card->irq, card);
+irq_fail:
+        iounmap(card->ctlmem);
+ioremap_ctlmem_fail:
+        iounmap(card->mem);
+ioremap_physmem_fail:
+        pci_release_regions(pdev);
+regions_fail:
+        pci_disable_device(pdev);
+enable_fail:
+        kfree(card);
+        return err;
 }
 /*
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 5895f1978691..fa9fdfa128c1 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -122,8 +122,12 @@ static int x25_asy_change_mtu(struct net_device *dev, int newmtu)
 {
        struct x25_asy *sl = netdev_priv(dev);
        unsigned char *xbuff, *rbuff;
-        int len = 2 * newmtu;
+        int len;
+        if (newmtu > 65534)
+                return -EINVAL;
+        len = 2 * newmtu;
        xbuff = kmalloc(len + 4, GFP_ATOMIC);
        rbuff = kmalloc(len + 4, GFP_ATOMIC);
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 82017f56e661..e6c56c5bb0f6 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -795,7 +795,11 @@ int ath10k_core_start(struct ath10k *ar)
        if (status)
                goto err_htc_stop;
-        ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                ar->free_vdev_map = (1 << TARGET_10X_NUM_VDEVS) - 1;
+        else
+                ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
        INIT_LIST_HEAD(&ar->arvifs);
        if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 6c102b1312ff..eebc860c3655 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -312,7 +312,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
        int msdu_len, msdu_chaining = 0;
        struct sk_buff *msdu;
        struct htt_rx_desc *rx_desc;
-        bool corrupted = false;
        lockdep_assert_held(&htt->rx_ring.lock);
@@ -439,9 +438,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) &
                                RX_MSDU_END_INFO0_LAST_MSDU;
-                if (msdu_chaining && !last_msdu)
-                        corrupted = true;
                if (last_msdu) {
                        msdu->next = NULL;
                        break;
@@ -457,20 +453,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                msdu_chaining = -1;
        /*
-         * Apparently FW sometimes reports weird chained MSDU sequences with
-         * more than one rx descriptor. This seems like a bug but needs more
-         * analyzing. For the time being fix it by dropping such sequences to
-         * avoid blowing up the host system.
-         */
-        if (corrupted) {
-                ath10k_warn("failed to pop chained msdus, dropping\n");
-                ath10k_htt_rx_free_msdu_chain(*head_msdu);
-                *head_msdu = NULL;
-                *tail_msdu = NULL;
-                msdu_chaining = -EINVAL;
-        }
-        /*
         * Don't refill the ring yet.
         *
         * First, the elements popped here are still in use - it is not
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 66acb2cbd9df..7c28cb55610b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -887,6 +887,15 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
                tx_info = IEEE80211_SKB_CB(skb);
                tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
+                /*
+                 * No aggregation session is running, but there may be frames
+                 * from a previous session or a failed attempt in the queue.
+                 * Send them out as normal data frames
+                 */
+                if (!tid->active)
+                        tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
                        bf->bf_state.bf_type = 0;
                        return bf;
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index e3f67b8d3f80..40fd9b7b1426 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -36,7 +36,7 @@ config B43_SSB
 choice
        prompt "Supported bus types"
        depends on B43
-        default B43_BCMA_AND_SSB
+        default B43_BUSES_BCMA_AND_SSB
 config B43_BUSES_BCMA_AND_SSB
        bool "BCMA and SSB"
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 32538ac5f7e4..0d6a0bb1f876 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5221,6 +5221,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
        /* We don't support 5 GHz on some PHYs yet */
        switch (dev->phy.type) {
        case B43_PHYTYPE_A:
+        case B43_PHYTYPE_G:
        case B43_PHYTYPE_N:
        case B43_PHYTYPE_LP:
        case B43_PHYTYPE_HT:
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 4f38f19b8e3d..6e6ef3fc2247 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
                break;
        case B43_PHYTYPE_G:
                status.band = IEEE80211_BAND_2GHZ;
-                /* chanid is the radio channel cookie value as used
+                /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
-                 * to tune the radio. */
+                 * has been modified to be compatible with N-PHY and others.
-                status.freq = chanid + 2400;
+                 */
+                if (dev->fw.rev >= 508)
+                        status.freq = ieee80211_channel_to_frequency(chanid, status.band);
+                else
+                        status.freq = chanid + 2400;
                break;
        case B43_PHYTYPE_N:
        case B43_PHYTYPE_LP:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 6db51a666f61..d06fcb05adf2 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1184,8 +1184,6 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
        bus->bus_priv.usb = bus_pub;
        dev_set_drvdata(dev, bus);
        bus->ops = &brcmf_usb_bus_ops;
-        bus->chip = bus_pub->devid;
-        bus->chiprev = bus_pub->chiprev;
        bus->proto_type = BRCMF_PROTO_BCDC;
        bus->always_use_fws_queue = true;
@@ -1194,6 +1192,9 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
                if (ret)
                        goto fail;
        }
+        bus->chip = bus_pub->devid;
+        bus->chiprev = bus_pub->chiprev;
        /* request firmware here */
        brcmf_fw_get_firmwares(dev, 0, brcmf_usb_get_fwname(devinfo), NULL,
                               brcmf_usb_probe_phase2);
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index ed50de6362ed..6dc5dd3ced44 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1068,13 +1068,6 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
        /* recalculate basic rates */
        iwl_calc_basic_rates(priv, ctx);
-        /*
-         * force CTS-to-self frames protection if RTS-CTS is not preferred
-         * one aggregation protection method
-         */
-        if (!priv->hw_params.use_rts_for_aggregation)
-                ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
        if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
            !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
                ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
@@ -1480,11 +1473,6 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
        else
                ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
-        if (bss_conf->use_cts_prot)
-                ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
-        else
-                ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
        memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
        if (vif->type == NL80211_IFTYPE_AP ||
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index 0aa7c0085c9f..b1a33322b9ba 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -88,6 +88,7 @@
 *      P2P client interfaces simultaneously if they are in different bindings.
 * @IWL_UCODE_TLV_FLAGS_P2P_BSS_PS_SCM: support power save on BSS station and
 *      P2P client interfaces simultaneously if they are in same bindings.
+ * @IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT: General support for uAPSD
 * @IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD: P2P client supports uAPSD power save
 * @IWL_UCODE_TLV_FLAGS_BCAST_FILTERING: uCode supports broadcast filtering.
 * @IWL_UCODE_TLV_FLAGS_GO_UAPSD: AP/GO interfaces support uAPSD clients
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 8b5302777632..8b79081d4885 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -667,10 +667,9 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
        if (vif->bss_conf.qos)
                cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_UPDATE_EDCA);
-        if (vif->bss_conf.use_cts_prot) {
+        if (vif->bss_conf.use_cts_prot)
                cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_TGG_PROTECT);
-                cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_SELF_CTS_EN);
-        }
        IWL_DEBUG_RATE(mvm, "use_cts_prot %d, ht_operation_mode %d\n",
                       vif->bss_conf.use_cts_prot,
                       vif->bss_conf.ht_operation_mode);
@@ -1073,8 +1072,12 @@ static int iwl_mvm_mac_ctxt_cmd_ap(struct iwl_mvm *mvm,
        /* Fill the common data for all mac context types */
        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
-        /* Also enable probe requests to pass */
+        /*
-        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST);
+         * pass probe requests and beacons from other APs (needed
+         * for ht protection)
+         */
+        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST |
+                                        MAC_FILTER_IN_BEACON);
        /* Fill the data specific for ap mode */
        iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.ap,
@@ -1095,6 +1098,13 @@ static int iwl_mvm_mac_ctxt_cmd_go(struct iwl_mvm *mvm,
        /* Fill the common data for all mac context types */
        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
+        /*
+         * pass probe requests and beacons from other APs (needed
+         * for ht protection)
+         */
+        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST |
+                                        MAC_FILTER_IN_BEACON);
        /* Fill the data specific for GO mode */
        iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.go.ap,
                                     action == FW_CTXT_ACTION_ADD);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 7215f5980186..98556d03c1ed 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -1159,8 +1159,12 @@ static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
        bcast_mac = &cmd->macs[mvmvif->id];
-        /* enable filtering only for associated stations */
+        /*
-        if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc)
+         * enable filtering only for associated stations, but not for P2P
+         * Clients
+         */
+        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
+            !vif->bss_conf.assoc)
                return;
        bcast_mac->default_discard = 1;
@@ -1237,10 +1241,6 @@ static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm,
        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
                return 0;
-        /* bcast filtering isn't supported for P2P client */
-        if (vif->p2p)
-                return 0;
        if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
                return 0;
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 4b6c7d4bd199..eac2b424f6a0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -588,9 +588,7 @@ static void iwl_build_scan_cmd(struct iwl_mvm *mvm,
                               struct iwl_scan_offload_cmd *scan,
                               struct iwl_mvm_scan_params *params)
 {
-        scan->channel_count =
+        scan->channel_count = req->n_channels;
-                mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels +
-                mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
        scan->quiet_time = cpu_to_le16(IWL_ACTIVE_QUIET_TIME);
        scan->quiet_plcp_th = cpu_to_le16(IWL_PLCP_QUIET_THRESH);
        scan->good_CRC_th = IWL_GOOD_CRC_TH_DEFAULT;
@@ -669,61 +667,37 @@ static void iwl_build_channel_cfg(struct iwl_mvm *mvm,
                                  struct cfg80211_sched_scan_request *req,
                                  struct iwl_scan_channel_cfg *channels,
                                  enum ieee80211_band band,
-                                  int *head, int *tail,
+                                  int *head,
                                  u32 ssid_bitmap,
                                  struct iwl_mvm_scan_params *params)
 {
-        struct ieee80211_supported_band *s_band;
+        int i, index = 0;
-        int n_channels = req->n_channels;
-        int i, j, index = 0;
-        bool partial;
-        /*
+        for (i = 0; i < req->n_channels; i++) {
-         * We have to configure all supported channels, even if we don't want to
+                struct ieee80211_channel *chan = req->channels[i];
-         * scan on them, but we have to send channels in the order that we want
-         * to scan. So add requested channels to head of the list and others to
+                if (chan->band != band)
-         * the end.
+                        continue;
-        */
-        s_band = &mvm->nvm_data->bands[band];
+                index = *head;
+                (*head)++;
-        for (i = 0; i < s_band->n_channels && *head <= *tail; i++) {
-                partial = false;
+                channels->channel_number[index] = cpu_to_le16(chan->hw_value);
-                for (j = 0; j < n_channels; j++)
-                        if (s_band->channels[i].center_freq ==
-                                                req->channels[j]->center_freq) {
-                                index = *head;
-                                (*head)++;
-                                /*
-                                 * Channels that came with the request will be
-                                 * in partial scan .
-                                 */
-                                partial = true;
-                                break;
-                        }
-                if (!partial) {
-                        index = *tail;
-                        (*tail)--;
-                }
-                channels->channel_number[index] =
-                        cpu_to_le16(ieee80211_frequency_to_channel(
-                                        s_band->channels[i].center_freq));
                channels->dwell_time[index][0] = params->dwell[band].active;
                channels->dwell_time[index][1] = params->dwell[band].passive;
                channels->iter_count[index] = cpu_to_le16(1);
                channels->iter_interval[index] = 0;
-                if (!(s_band->channels[i].flags & IEEE80211_CHAN_NO_IR))
+                if (!(chan->flags & IEEE80211_CHAN_NO_IR))
                        channels->type[index] |=
                                cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_ACTIVE);
                channels->type[index] |=
-                                cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_FULL);
+                                cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_FULL |
-                if (partial)
+                                            IWL_SCAN_OFFLOAD_CHANNEL_PARTIAL);
-                        channels->type[index] |=
-                                cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_PARTIAL);
-                if (s_band->channels[i].flags & IEEE80211_CHAN_NO_HT40)
+                if (chan->flags & IEEE80211_CHAN_NO_HT40)
                        channels->type[index] |=
                                cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_NARROW);
@@ -740,7 +714,6 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
        int band_2ghz = mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels;
        int band_5ghz = mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
        int head = 0;
-        int tail = band_2ghz + band_5ghz - 1;
        u32 ssid_bitmap;
        int cmd_len;
        int ret;
@@ -772,7 +745,7 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                                              &scan_cfg->scan_cmd.tx_cmd[0],
                                              scan_cfg->data);
                iwl_build_channel_cfg(mvm, req, &scan_cfg->channel_cfg,
-                                      IEEE80211_BAND_2GHZ, &head, &tail,
+                                      IEEE80211_BAND_2GHZ, &head,
                                      ssid_bitmap, &params);
        }
        if (band_5ghz) {
@@ -782,7 +755,7 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                                              scan_cfg->data +
                                                SCAN_OFFLOAD_PROBE_REQ_SIZE);
                iwl_build_channel_cfg(mvm, req, &scan_cfg->channel_cfg,
-                                      IEEE80211_BAND_5GHZ, &head, &tail,
+                                      IEEE80211_BAND_5GHZ, &head,
                                      ssid_bitmap, &params);
        }
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 7091a18d5a72..98950e45c7b0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -367,6 +367,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5510, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
@@ -380,7 +381,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x9200, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x9200, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 5b32106182f8..fe0f66f73507 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -185,6 +185,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
        skb_reserve(skb_aggr, headroom + sizeof(struct txpd));
        tx_info_aggr =  MWIFIEX_SKB_TXCB(skb_aggr);
+        memset(tx_info_aggr, 0, sizeof(*tx_info_aggr));
        tx_info_aggr->bss_type = tx_info_src->bss_type;
        tx_info_aggr->bss_num = tx_info_src->bss_num;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index e95dec91a561..b511613bba2d 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -220,6 +220,7 @@ mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
        }
        tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
        tx_info->bss_num = priv->bss_num;
        tx_info->bss_type = priv->bss_type;
        tx_info->pkt_len = pkt_len;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 8dee6c86f4f1..c161141f6c39 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -453,6 +453,7 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
        if (skb) {
                rx_info = MWIFIEX_SKB_RXCB(skb);
+                memset(rx_info, 0, sizeof(*rx_info));
                rx_info->bss_num = priv->bss_num;
                rx_info->bss_type = priv->bss_type;
        }
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index cbabc12fbda3..e91cd0fa5ca8 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -645,6 +645,7 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
        tx_info->bss_num = priv->bss_num;
        tx_info->bss_type = priv->bss_type;
        tx_info->pkt_len = skb->len;
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 574d4b597468..2cc9b6fca490 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -50,7 +50,7 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
                return -1;
        }
        mapping.len = size;
-        memcpy(skb->cb, &mapping, sizeof(mapping));
+        mwifiex_store_mapping(skb, &mapping);
        return 0;
 }
@@ -60,7 +60,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter,
        struct pcie_service_card *card = adapter->card;
        struct mwifiex_dma_mapping mapping;
-        MWIFIEX_SKB_PACB(skb, &mapping);
+        mwifiex_get_mapping(skb, &mapping);
        pci_unmap_single(card->dev, mapping.addr, mapping.len, flags);
 }
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index 5fce7e78a36e..70eb863c7249 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -150,6 +150,7 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
                return -1;
        tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
        tx_info->bss_num = priv->bss_num;
        tx_info->bss_type = priv->bss_type;
        tx_info->pkt_len = data_len - (sizeof(struct txpd) + INTF_HEADER_LEN);
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index e73034fbbde9..0e88364e0c67 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -605,6 +605,7 @@ int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
        }
        tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
        tx_info->bss_num = priv->bss_num;
        tx_info->bss_type = priv->bss_type;
@@ -760,6 +761,7 @@ int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
        skb->priority = MWIFIEX_PRIO_VI;
        tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
        tx_info->bss_num = priv->bss_num;
        tx_info->bss_type = priv->bss_type;
        tx_info->flags |= MWIFIEX_BUF_FLAG_TDLS_PKT;
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 37f26afd4314..fd7e5b9b4581 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -55,6 +55,7 @@ int mwifiex_handle_rx_packet(struct mwifiex_adapter *adapter,
                return -1;
        }
+        memset(rx_info, 0, sizeof(*rx_info));
        rx_info->bss_num = priv->bss_num;
        rx_info->bss_type = priv->bss_type;
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index 9a56bc61cb1d..b0601b91cc4f 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -175,6 +175,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
        }
        tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
        tx_info->bss_num = priv->bss_num;
        tx_info->bss_type = priv->bss_type;
        tx_info->flags |= MWIFIEX_BUF_FLAG_BRIDGED_PKT;
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index ddae57021397..caadb3737b9e 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -20,32 +20,55 @@
 #ifndef _MWIFIEX_UTIL_H_
 #define _MWIFIEX_UTIL_H_
+struct mwifiex_dma_mapping {
+        dma_addr_t addr;
+        size_t len;
+};
+struct mwifiex_cb {
+        struct mwifiex_dma_mapping dma_mapping;
+        union {
+                struct mwifiex_rxinfo rx_info;
+                struct mwifiex_txinfo tx_info;
+        };
+};
 static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_rxinfo *)(skb->cb + sizeof(dma_addr_t));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+        BUILD_BUG_ON(sizeof(struct mwifiex_cb) > sizeof(skb->cb));
+        return &cb->rx_info;
 }
 static inline struct mwifiex_txinfo *MWIFIEX_SKB_TXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_txinfo *)(skb->cb + sizeof(dma_addr_t));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+        return &cb->tx_info;
 }
-struct mwifiex_dma_mapping {
+static inline void mwifiex_store_mapping(struct sk_buff *skb,
-        dma_addr_t addr;
+                                         struct mwifiex_dma_mapping *mapping)
-        size_t len;
+{
-};
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+        memcpy(&cb->dma_mapping, mapping, sizeof(*mapping));
+}
-static inline void MWIFIEX_SKB_PACB(struct sk_buff *skb,
+static inline void mwifiex_get_mapping(struct sk_buff *skb,
-                                        struct mwifiex_dma_mapping *mapping)
+                                       struct mwifiex_dma_mapping *mapping)
 {
-        memcpy(mapping, skb->cb, sizeof(*mapping));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+        memcpy(mapping, &cb->dma_mapping, sizeof(*mapping));
 }
 static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb)
 {
        struct mwifiex_dma_mapping mapping;
-        MWIFIEX_SKB_PACB(skb, &mapping);
+        mwifiex_get_mapping(skb, &mapping);
        return mapping.addr;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 2f1cd929c6f6..a511cccc9f01 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
        /*
         * Detect if this device has an hardware controlled radio.
         */
-        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
+        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
                __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
+                /*
+                 * On this device RFKILL initialized during probe does not work.
+                 */
+                __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
+        }
        /*
         * Check if the BBP tuning should be enabled.
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index a49c3d73ea2c..832006b5aab1 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -229,6 +229,31 @@ static enum hrtimer_restart rt2800usb_tx_sta_fifo_timeout(struct hrtimer *timer)
 /*
 * Firmware functions
 */
+static int rt2800usb_autorun_detect(struct rt2x00_dev *rt2x00dev)
+{
+        __le32 *reg;
+        u32 fw_mode;
+        reg = kmalloc(sizeof(*reg), GFP_KERNEL);
+        if (reg == NULL)
+                return -ENOMEM;
+        /* cannot use rt2x00usb_register_read here as it uses different
+         * mode (MULTI_READ vs. DEVICE_MODE) and does not pass the
+         * magic value USB_MODE_AUTORUN (0x11) to the device, thus the
+         * returned value would be invalid.
+         */
+        rt2x00usb_vendor_request(rt2x00dev, USB_DEVICE_MODE,
+                                 USB_VENDOR_REQUEST_IN, 0, USB_MODE_AUTORUN,
+                                 reg, sizeof(*reg), REGISTER_TIMEOUT_FIRMWARE);
+        fw_mode = le32_to_cpu(*reg);
+        kfree(reg);
+        if ((fw_mode & 0x00000003) == 2)
+                return 1;
+        return 0;
+}
 static char *rt2800usb_get_firmware_name(struct rt2x00_dev *rt2x00dev)
 {
        return FIRMWARE_RT2870;
@@ -240,6 +265,7 @@ static int rt2800usb_write_firmware(struct rt2x00_dev *rt2x00dev,
        int status;
        u32 offset;
        u32 length;
+        int retval;
        /*
         * Check which section of the firmware we need.
@@ -257,8 +283,16 @@ static int rt2800usb_write_firmware(struct rt2x00_dev *rt2x00dev,
        /*
         * Write firmware to device.
         */
-        rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+        retval = rt2800usb_autorun_detect(rt2x00dev);
-                                      data + offset, length);
+        if (retval < 0)
+                return retval;
+        if (retval) {
+                rt2x00_info(rt2x00dev,
+                            "Firmware loading not required - NIC in AutoRun mode\n");
+        } else {
+                rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                              data + offset, length);
+        }
        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
        rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
@@ -735,11 +769,26 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
 /*
 * Device probe functions.
 */
+static int rt2800usb_efuse_detect(struct rt2x00_dev *rt2x00dev)
+{
+        int retval;
+        retval = rt2800usb_autorun_detect(rt2x00dev);
+        if (retval < 0)
+                return retval;
+        if (retval)
+                return 1;
+        return rt2800_efuse_detect(rt2x00dev);
+}
 static int rt2800usb_read_eeprom(struct rt2x00_dev *rt2x00dev)
 {
        int retval;
-        if (rt2800_efuse_detect(rt2x00dev))
+        retval = rt2800usb_efuse_detect(rt2x00dev);
+        if (retval < 0)
+                return retval;
+        if (retval)
                retval = rt2800_read_eeprom_efuse(rt2x00dev);
        else
                retval = rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 010b76505243..d13f25cd70d5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
        REQUIRE_SW_SEQNO,
        REQUIRE_HT_TX_DESC,
        REQUIRE_PS_AUTOWAKE,
+        REQUIRE_DELAYED_RFKILL,
        /*
         * Capabilities
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 2bde6729f5e6..4fa43a2eeb73 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
                return;
        /*
-         * Unregister extra components.
+         * Stop rfkill polling.
         */
-        rt2x00rfkill_unregister(rt2x00dev);
+        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_unregister(rt2x00dev);
        /*
         * Allow the HW to uninitialize.
@@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
        set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
+        /*
+         * Start rfkill polling.
+         */
+        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_register(rt2x00dev);
        return 0;
 }
@@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
        rt2x00link_register(rt2x00dev);
        rt2x00leds_register(rt2x00dev);
        rt2x00debug_register(rt2x00dev);
-        rt2x00rfkill_register(rt2x00dev);
+        /*
+         * Start rfkill polling.
+         */
+        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_register(rt2x00dev);
        return 0;
@@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
        clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
        /*
+         * Stop rfkill polling.
+         */
+        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_unregister(rt2x00dev);
+        /*
         * Disable radio.
         */
        rt2x00lib_disable_radio(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 212ac4842c16..004dff9b962d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        crypto.cipher = rt2x00crypto_key_to_cipher(key);
        if (crypto.cipher == CIPHER_NONE)
                return -EOPNOTSUPP;
+        if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
+                return -EOPNOTSUPP;
        crypto.cmd = cmd;
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index e7bcf62347d5..831b65f93feb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -93,6 +93,7 @@ enum rt2x00usb_mode_offset {
        USB_MODE_SLEEP = 7,     /* RT73USB */
        USB_MODE_FIRMWARE = 8,  /* RT73USB */
        USB_MODE_WAKEUP = 9,    /* RT73USB */
+        USB_MODE_AUTORUN = 17, /* RT2800USB */
 };
 /**
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 4dd7c4a1923b..2532ce85d718 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -222,6 +222,7 @@ struct xenvif {
        /* Queues */
        struct xenvif_queue *queues;
+        unsigned int num_queues; /* active queues, resource allocated */
        /* Miscellaneous private stuff. */
        struct net_device *dev;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 852da34b8961..9e97c7ca0ddd 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -137,32 +137,11 @@ static void xenvif_wake_queue_callback(unsigned long data)
        }
 }
-static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
-                               void *accel_priv, select_queue_fallback_t fallback)
-{
-        unsigned int num_queues = dev->real_num_tx_queues;
-        u32 hash;
-        u16 queue_index;
-        /* First, check if there is only one queue to optimise the
-         * single-queue or old frontend scenario.
-         */
-        if (num_queues == 1) {
-                queue_index = 0;
-        } else {
-                /* Use skb_get_hash to obtain an L4 hash if available */
-                hash = skb_get_hash(skb);
-                queue_index = hash % num_queues;
-        }
-        return queue_index;
-}
 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct xenvif *vif = netdev_priv(dev);
        struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
        u16 index;
        int min_slots_needed;
@@ -225,7 +204,7 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
 {
        struct xenvif *vif = netdev_priv(dev);
        struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
        unsigned long rx_bytes = 0;
        unsigned long rx_packets = 0;
        unsigned long tx_bytes = 0;
@@ -256,7 +235,7 @@ out:
 static void xenvif_up(struct xenvif *vif)
 {
        struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
        unsigned int queue_index;
        for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -272,7 +251,7 @@ static void xenvif_up(struct xenvif *vif)
 static void xenvif_down(struct xenvif *vif)
 {
        struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
        unsigned int queue_index;
        for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -379,7 +358,7 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
                                     struct ethtool_stats *stats, u64 * data)
 {
        struct xenvif *vif = netdev_priv(dev);
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
        int i;
        unsigned int queue_index;
        struct xenvif_stats *vif_stats;
@@ -424,7 +403,6 @@ static const struct net_device_ops xenvif_netdev_ops = {
        .ndo_fix_features = xenvif_fix_features,
        .ndo_set_mac_address = eth_mac_addr,
        .ndo_validate_addr   = eth_validate_addr,
-        .ndo_select_queue = xenvif_select_queue,
 };
 struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
@@ -438,7 +416,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
        snprintf(name, IFNAMSIZ - 1, "vif%u.%u", domid, handle);
        /* Allocate a netdev with the max. supported number of queues.
         * When the guest selects the desired number, it will be updated
-         * via netif_set_real_num_tx_queues().
+         * via netif_set_real_num_*_queues().
         */
        dev = alloc_netdev_mq(sizeof(struct xenvif), name, ether_setup,
                              xenvif_max_queues);
@@ -458,11 +436,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
        vif->dev = dev;
        vif->disabled = false;
-        /* Start out with no queues. The call below does not require
+        /* Start out with no queues. */
-         * rtnl_lock() as it happens before register_netdev().
-         */
        vif->queues = NULL;
-        netif_set_real_num_tx_queues(dev, 0);
+        vif->num_queues = 0;
        dev->netdev_ops = &xenvif_netdev_ops;
        dev->hw_features = NETIF_F_SG |
@@ -677,7 +653,7 @@ static void xenvif_wait_unmap_timeout(struct xenvif_queue *queue,
 void xenvif_disconnect(struct xenvif *vif)
 {
        struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
        unsigned int queue_index;
        if (netif_carrier_ok(vif->dev))
@@ -724,7 +700,7 @@ void xenvif_deinit_queue(struct xenvif_queue *queue)
 void xenvif_free(struct xenvif *vif)
 {
        struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
        unsigned int queue_index;
        /* Here we want to avoid timeout messages if an skb can be legitimately
         * stuck somewhere else. Realistically this could be an another vif's
@@ -748,12 +724,9 @@ void xenvif_free(struct xenvif *vif)
                xenvif_deinit_queue(queue);
        }
-        /* Free the array of queues. The call below does not require
-         * rtnl_lock() because it happens after unregister_netdev().
-         */
-        netif_set_real_num_tx_queues(vif->dev, 0);
        vfree(vif->queues);
        vif->queues = NULL;
+        vif->num_queues = 0;
        free_netdev(vif->dev);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 1844a47636b6..c65b636bcab9 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1030,14 +1030,21 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
 {
        struct gnttab_map_grant_ref *gop_map = *gopp_map;
        u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
+        /* This always points to the shinfo of the skb being checked, which
+         * could be either the first or the one on the frag_list
+         */
        struct skb_shared_info *shinfo = skb_shinfo(skb);
+        /* If this is non-NULL, we are currently checking the frag_list skb, and
+         * this points to the shinfo of the first one
+         */
+        struct skb_shared_info *first_shinfo = NULL;
        int nr_frags = shinfo->nr_frags;
+        const bool sharedslot = nr_frags &&
+                                frag_get_pending_idx(&shinfo->frags[0]) == pending_idx;
        int i, err;
-        struct sk_buff *first_skb = NULL;
        /* Check status of header. */
        err = (*gopp_copy)->status;
-        (*gopp_copy)++;
        if (unlikely(err)) {
                if (net_ratelimit())
                        netdev_dbg(queue->vif->dev,
@@ -1045,8 +1052,12 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
                                   (*gopp_copy)->status,
                                   pending_idx,
                                   (*gopp_copy)->source.u.ref);
-                xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_ERROR);
+                /* The first frag might still have this slot mapped */
+                if (!sharedslot)
+                        xenvif_idx_release(queue, pending_idx,
+                                           XEN_NETIF_RSP_ERROR);
        }
+        (*gopp_copy)++;
 check_frags:
        for (i = 0; i < nr_frags; i++, gop_map++) {
@@ -1062,8 +1073,19 @@ check_frags:
                                                pending_idx,
                                                gop_map->handle);
                        /* Had a previous error? Invalidate this fragment. */
-                        if (unlikely(err))
+                        if (unlikely(err)) {
                                xenvif_idx_unmap(queue, pending_idx);
+                                /* If the mapping of the first frag was OK, but
+                                 * the header's copy failed, and they are
+                                 * sharing a slot, send an error
+                                 */
+                                if (i == 0 && sharedslot)
+                                        xenvif_idx_release(queue, pending_idx,
+                                                           XEN_NETIF_RSP_ERROR);
+                                else
+                                        xenvif_idx_release(queue, pending_idx,
+                                                           XEN_NETIF_RSP_OKAY);
+                        }
                        continue;
                }
@@ -1075,42 +1097,53 @@ check_frags:
                                   gop_map->status,
                                   pending_idx,
                                   gop_map->ref);
                xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_ERROR);
                /* Not the first error? Preceding frags already invalidated. */
                if (err)
                        continue;
-                /* First error: invalidate preceding fragments. */
+                /* First error: if the header haven't shared a slot with the
+                 * first frag, release it as well.
+                 */
+                if (!sharedslot)
+                        xenvif_idx_release(queue,
+                                           XENVIF_TX_CB(skb)->pending_idx,
+                                           XEN_NETIF_RSP_OKAY);
+                /* Invalidate preceding fragments of this skb. */
                for (j = 0; j < i; j++) {
                        pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
                        xenvif_idx_unmap(queue, pending_idx);
+                        xenvif_idx_release(queue, pending_idx,
+                                           XEN_NETIF_RSP_OKAY);
+                }
+                /* And if we found the error while checking the frag_list, unmap
+                 * the first skb's frags
+                 */
+                if (first_shinfo) {
+                        for (j = 0; j < first_shinfo->nr_frags; j++) {
+                                pending_idx = frag_get_pending_idx(&first_shinfo->frags[j]);
+                                xenvif_idx_unmap(queue, pending_idx);
+                                xenvif_idx_release(queue, pending_idx,
+                                                   XEN_NETIF_RSP_OKAY);
+                        }
                }
                /* Remember the error: invalidate all subsequent fragments. */
                err = newerr;
        }
-        if (skb_has_frag_list(skb)) {
+        if (skb_has_frag_list(skb) && !first_shinfo) {
-                first_skb = skb;
+                first_shinfo = skb_shinfo(skb);
-                skb = shinfo->frag_list;
+                shinfo = skb_shinfo(skb_shinfo(skb)->frag_list);
-                shinfo = skb_shinfo(skb);
                nr_frags = shinfo->nr_frags;
                goto check_frags;
        }
-        /* There was a mapping error in the frag_list skb. We have to unmap
-         * the first skb's frags
-         */
-        if (first_skb && err) {
-                int j;
-                shinfo = skb_shinfo(first_skb);
-                for (j = 0; j < shinfo->nr_frags; j++) {
-                        pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
-                        xenvif_idx_unmap(queue, pending_idx);
-                }
-        }
        *gopp_map = gop_map;
        return err;
 }
@@ -1518,7 +1551,16 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
                /* Check the remap error code. */
                if (unlikely(xenvif_tx_check_gop(queue, skb, &gop_map, &gop_copy))) {
+                        /* If there was an error, xenvif_tx_check_gop is
+                         * expected to release all the frags which were mapped,
+                         * so kfree_skb shouldn't do it again
+                         */
                        skb_shinfo(skb)->nr_frags = 0;
+                        if (skb_has_frag_list(skb)) {
+                                struct sk_buff *nskb =
+                                                skb_shinfo(skb)->frag_list;
+                                skb_shinfo(nskb)->nr_frags = 0;
+                        }
                        kfree_skb(skb);
                        continue;
                }
@@ -1822,8 +1864,6 @@ void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
                           tx_unmap_op.status);
                BUG();
        }
-        xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_OKAY);
 }
 static inline int rx_work_todo(struct xenvif_queue *queue)
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 96c63dc2509e..3d85acd84bad 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -527,9 +527,7 @@ static void connect(struct backend_info *be)
        /* Use the number of queues requested by the frontend */
        be->vif->queues = vzalloc(requested_num_queues *
                                  sizeof(struct xenvif_queue));
-        rtnl_lock();
+        be->vif->num_queues = requested_num_queues;
-        netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
-        rtnl_unlock();
        for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) {
                queue = &be->vif->queues[queue_index];
@@ -546,9 +544,7 @@ static void connect(struct backend_info *be)
                         * earlier queues can be destroyed using the regular
                         * disconnect logic.
                         */
-                        rtnl_lock();
+                        be->vif->num_queues = queue_index;
-                        netif_set_real_num_tx_queues(be->vif->dev, queue_index);
-                        rtnl_unlock();
                        goto err;
                }
@@ -561,13 +557,19 @@ static void connect(struct backend_info *be)
                         * and also clean up any previously initialised queues.
                         */
                        xenvif_deinit_queue(queue);
-                        rtnl_lock();
+                        be->vif->num_queues = queue_index;
-                        netif_set_real_num_tx_queues(be->vif->dev, queue_index);
-                        rtnl_unlock();
                        goto err;
                }
        }
+        /* Initialisation completed, tell core driver the number of
+         * active queues.
+         */
+        rtnl_lock();
+        netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
+        netif_set_real_num_rx_queues(be->vif->dev, requested_num_queues);
+        rtnl_unlock();
        xenvif_carrier_on(be->vif);
        unregister_hotplug_status_watch(be);
@@ -582,13 +584,11 @@ static void connect(struct backend_info *be)
        return;
 err:
-        if (be->vif->dev->real_num_tx_queues > 0)
+        if (be->vif->num_queues > 0)
                xenvif_disconnect(be->vif); /* Clean up existing queues */
        vfree(be->vif->queues);
        be->vif->queues = NULL;
-        rtnl_lock();
+        be->vif->num_queues = 0;
-        netif_set_real_num_tx_queues(be->vif->dev, 0);
-        rtnl_unlock();
        return;
 }
@@ -596,7 +596,7 @@ err:
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue)
 {
        struct xenbus_device *dev = be->dev;
-        unsigned int num_queues = queue->vif->dev->real_num_tx_queues;
+        unsigned int num_queues = queue->vif->num_queues;
        unsigned long tx_ring_ref, rx_ring_ref;
        unsigned int tx_evtchn, rx_evtchn;
        int err;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 5a7872ac3566..055222bae6e4 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1287,7 +1287,7 @@ static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
        if (likely(netif_carrier_ok(dev) &&
                   RING_HAS_UNCONSUMED_RESPONSES(&queue->rx)))
-                        napi_schedule(&queue->napi);
+                napi_schedule(&queue->napi);
        return IRQ_HANDLED;
 }
@@ -1437,16 +1437,12 @@ static void xennet_end_access(int ref, void *page)
 static void xennet_disconnect_backend(struct netfront_info *info)
 {
        unsigned int i = 0;
-        struct netfront_queue *queue = NULL;
        unsigned int num_queues = info->netdev->real_num_tx_queues;
+        netif_carrier_off(info->netdev);
        for (i = 0; i < num_queues; ++i) {
-                /* Stop old i/f to prevent errors whilst we rebuild the state. */
+                struct netfront_queue *queue = &info->queues[i];
-                spin_lock_bh(&queue->rx_lock);
-                spin_lock_irq(&queue->tx_lock);
-                netif_carrier_off(queue->info->netdev);
-                spin_unlock_irq(&queue->tx_lock);
-                spin_unlock_bh(&queue->rx_lock);
                if (queue->tx_irq && (queue->tx_irq == queue->rx_irq))
                        unbind_from_irqhandler(queue->tx_irq, queue);
@@ -1457,6 +1453,8 @@ static void xennet_disconnect_backend(struct netfront_info *info)
                queue->tx_evtchn = queue->rx_evtchn = 0;
                queue->tx_irq = queue->rx_irq = 0;
+                napi_synchronize(&queue->napi);
                /* End access and free the pages */
                xennet_end_access(queue->tx_ring_ref, queue->tx.sring);
                xennet_end_access(queue->rx_ring_ref, queue->rx.sring);
@@ -1698,8 +1696,6 @@ static int xennet_init_queue(struct netfront_queue *queue)
                goto exit_free_tx;
        }
-        netif_napi_add(queue->info->netdev, &queue->napi, xennet_poll, 64);
        return 0;
 exit_free_tx:
@@ -1790,6 +1786,70 @@ error:
        return err;
 }
+static void xennet_destroy_queues(struct netfront_info *info)
+{
+        unsigned int i;
+        rtnl_lock();
+        for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
+                struct netfront_queue *queue = &info->queues[i];
+                if (netif_running(info->netdev))
+                        napi_disable(&queue->napi);
+                netif_napi_del(&queue->napi);
+        }
+        rtnl_unlock();
+        kfree(info->queues);
+        info->queues = NULL;
+}
+static int xennet_create_queues(struct netfront_info *info,
+                                unsigned int num_queues)
+{
+        unsigned int i;
+        int ret;
+        info->queues = kcalloc(num_queues, sizeof(struct netfront_queue),
+                               GFP_KERNEL);
+        if (!info->queues)
+                return -ENOMEM;
+        rtnl_lock();
+        for (i = 0; i < num_queues; i++) {
+                struct netfront_queue *queue = &info->queues[i];
+                queue->id = i;
+                queue->info = info;
+                ret = xennet_init_queue(queue);
+                if (ret < 0) {
+                        dev_warn(&info->netdev->dev, "only created %d queues\n",
+                                 num_queues);
+                        num_queues = i;
+                        break;
+                }
+                netif_napi_add(queue->info->netdev, &queue->napi,
+                               xennet_poll, 64);
+                if (netif_running(info->netdev))
+                        napi_enable(&queue->napi);
+        }
+        netif_set_real_num_tx_queues(info->netdev, num_queues);
+        rtnl_unlock();
+        if (num_queues == 0) {
+                dev_err(&info->netdev->dev, "no queues\n");
+                return -EINVAL;
+        }
+        return 0;
+}
 /* Common code used when first setting up, and when resuming. */
 static int talk_to_netback(struct xenbus_device *dev,
                           struct netfront_info *info)
@@ -1826,42 +1886,20 @@ static int talk_to_netback(struct xenbus_device *dev,
                goto out;
        }
-        /* Allocate array of queues */
+        if (info->queues)
-        info->queues = kcalloc(num_queues, sizeof(struct netfront_queue), GFP_KERNEL);
+                xennet_destroy_queues(info);
-        if (!info->queues) {
-                err = -ENOMEM;
+        err = xennet_create_queues(info, num_queues);
-                goto out;
+        if (err < 0)
-        }
+                goto destroy_ring;
-        rtnl_lock();
-        netif_set_real_num_tx_queues(info->netdev, num_queues);
-        rtnl_unlock();
        /* Create shared ring, alloc event channel -- for each queue */
        for (i = 0; i < num_queues; ++i) {
                queue = &info->queues[i];
-                queue->id = i;
-                queue->info = info;
-                err = xennet_init_queue(queue);
-                if (err) {
-                        /* xennet_init_queue() cleans up after itself on failure,
-                         * but we still have to clean up any previously initialised
-                         * queues. If i > 0, set num_queues to i, then goto
-                         * destroy_ring, which calls xennet_disconnect_backend()
-                         * to tidy up.
-                         */
-                        if (i > 0) {
-                                rtnl_lock();
-                                netif_set_real_num_tx_queues(info->netdev, i);
-                                rtnl_unlock();
-                                goto destroy_ring;
-                        } else {
-                                goto out;
-                        }
-                }
                err = setup_netfront(dev, queue, feature_split_evtchn);
                if (err) {
-                        /* As for xennet_init_queue(), setup_netfront() will tidy
+                        /* setup_netfront() will tidy up the current
-                         * up the current queue on error, but we need to clean up
+                         * queue on error, but we need to clean up
                         * those already allocated.
                         */
                        if (i > 0) {
@@ -2005,13 +2043,15 @@ static int xennet_connect(struct net_device *dev)
        /* By now, the queue structures have been set up */
        for (j = 0; j < num_queues; ++j) {
                queue = &np->queues[j];
-                spin_lock_bh(&queue->rx_lock);
-                spin_lock_irq(&queue->tx_lock);
                /* Step 1: Discard all pending TX packet fragments. */
+                spin_lock_irq(&queue->tx_lock);
                xennet_release_tx_bufs(queue);
+                spin_unlock_irq(&queue->tx_lock);
                /* Step 2: Rebuild the RX buffer freelist and the RX ring itself. */
+                spin_lock_bh(&queue->rx_lock);
                for (requeue_idx = 0, i = 0; i < NET_RX_RING_SIZE; i++) {
                        skb_frag_t *frag;
                        const struct page *page;
@@ -2035,6 +2075,8 @@ static int xennet_connect(struct net_device *dev)
                }
                queue->rx.req_prod_pvt = requeue_idx;
+                spin_unlock_bh(&queue->rx_lock);
        }
        /*
@@ -2046,13 +2088,17 @@ static int xennet_connect(struct net_device *dev)
        netif_carrier_on(np->netdev);
        for (j = 0; j < num_queues; ++j) {
                queue = &np->queues[j];
                notify_remote_via_irq(queue->tx_irq);
                if (queue->tx_irq != queue->rx_irq)
                        notify_remote_via_irq(queue->rx_irq);
-                xennet_tx_buf_gc(queue);
-                xennet_alloc_rx_buffers(queue);
+                spin_lock_irq(&queue->tx_lock);
+                xennet_tx_buf_gc(queue);
                spin_unlock_irq(&queue->tx_lock);
+                spin_lock_bh(&queue->rx_lock);
+                xennet_alloc_rx_buffers(queue);
                spin_unlock_bh(&queue->rx_lock);
        }
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 8368d96ae7b4..b9864806e9b8 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -227,7 +227,8 @@ static int __of_node_add(struct device_node *np)
        np->kobj.kset = of_kset;
        if (!np->parent) {
                /* Nodes without parents are new top level trees */
-                rc = kobject_add(&np->kobj, NULL, safe_name(&of_kset->kobj, "base"));
+                rc = kobject_add(&np->kobj, NULL, "%s",
+                                 safe_name(&of_kset->kobj, "base"));
        } else {
                name = safe_name(&np->parent->kobj, kbasename(np->full_name));
                if (!name || !name[0])
@@ -1960,9 +1961,9 @@ int of_attach_node(struct device_node *np)
        raw_spin_lock_irqsave(&devtree_lock, flags);
        np->sibling = np->parent->child;
-        np->allnext = of_allnodes;
+        np->allnext = np->parent->allnext;
+        np->parent->allnext = np;
        np->parent->child = np;
-        of_allnodes = np;
        of_node_clear_flag(np, OF_DETACHED);
        raw_spin_unlock_irqrestore(&devtree_lock, flags);
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index c4cddf0cd96d..9aa012e6ea0a 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -26,6 +26,54 @@
 #include <asm/setup.h>  /* for COMMAND_LINE_SIZE */
 #include <asm/page.h>
+/*
+ * of_fdt_limit_memory - limit the number of regions in the /memory node
+ * @limit: maximum entries
+ *
+ * Adjust the flattened device tree to have at most 'limit' number of
+ * memory entries in the /memory node. This function may be called
+ * any time after initial_boot_param is set.
+ */
+void of_fdt_limit_memory(int limit)
+{
+        int memory;
+        int len;
+        const void *val;
+        int nr_address_cells = OF_ROOT_NODE_ADDR_CELLS_DEFAULT;
+        int nr_size_cells = OF_ROOT_NODE_SIZE_CELLS_DEFAULT;
+        const uint32_t *addr_prop;
+        const uint32_t *size_prop;
+        int root_offset;
+        int cell_size;
+        root_offset = fdt_path_offset(initial_boot_params, "/");
+        if (root_offset < 0)
+                return;
+        addr_prop = fdt_getprop(initial_boot_params, root_offset,
+                                "#address-cells", NULL);
+        if (addr_prop)
+                nr_address_cells = fdt32_to_cpu(*addr_prop);
+        size_prop = fdt_getprop(initial_boot_params, root_offset,
+                                "#size-cells", NULL);
+        if (size_prop)
+                nr_size_cells = fdt32_to_cpu(*size_prop);
+        cell_size = sizeof(uint32_t)*(nr_address_cells + nr_size_cells);
+        memory = fdt_path_offset(initial_boot_params, "/memory");
+        if (memory > 0) {
+                val = fdt_getprop(initial_boot_params, memory, "reg", &len);
+                if (len > limit*cell_size) {
+                        len = limit*cell_size;
+                        pr_debug("Limiting number of entries to %d\n", limit);
+                        fdt_setprop(initial_boot_params, memory, "reg", val,
+                                        len);
+                }
+        }
+}
 /**
 * of_fdt_is_compatible - Return true if given node from the given blob has
 * compat in its compatible list
@@ -880,6 +928,21 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size)
        const u64 phys_offset = __pa(PAGE_OFFSET);
        base &= PAGE_MASK;
        size &= PAGE_MASK;
+        if (sizeof(phys_addr_t) < sizeof(u64)) {
+                if (base > ULONG_MAX) {
+                        pr_warning("Ignoring memory block 0x%llx - 0x%llx\n",
+                                        base, base + size);
+                        return;
+                }
+                if (base + size > ULONG_MAX) {
+                        pr_warning("Ignoring memory range 0x%lx - 0x%llx\n",
+                                        ULONG_MAX, base + size);
+                        size = ULONG_MAX - base;
+                }
+        }
        if (base + size < phys_offset) {
                pr_warning("Ignoring memory block 0x%llx - 0x%llx\n",
                           base, base + size);
@@ -922,7 +985,7 @@ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
 }
 #endif
-bool __init early_init_dt_scan(void *params)
+bool __init early_init_dt_verify(void *params)
 {
        if (!params)
                return false;
@@ -936,6 +999,12 @@ bool __init early_init_dt_scan(void *params)
                return false;
        }
+        return true;
+}
+void __init early_init_dt_scan_nodes(void)
+{
        /* Retrieve various information from the /chosen node */
        of_scan_flat_dt(early_init_dt_scan_chosen, boot_command_line);
@@ -944,7 +1013,17 @@ bool __init early_init_dt_scan(void *params)
        /* Setup memory, calling early_init_dt_add_memory_arch */
        of_scan_flat_dt(early_init_dt_scan_memory, NULL);
+}
+bool __init early_init_dt_scan(void *params)
+{
+        bool status;
+        status = early_init_dt_verify(params);
+        if (!status)
+                return false;
+        early_init_dt_scan_nodes();
        return true;
 }
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index fb4a59830648..401b2453da45 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -182,40 +182,6 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
 }
 EXPORT_SYMBOL(of_mdiobus_register);
-/**
- * of_mdiobus_link_phydev - Find a device node for a phy
- * @mdio: pointer to mii_bus structure
- * @phydev: phydev for which the of_node pointer should be set
- *
- * Walk the list of subnodes of a mdio bus and look for a node that matches the
- * phy's address with its 'reg' property. If found, set the of_node pointer for
- * the phy. This allows auto-probed pyh devices to be supplied with information
- * passed in via DT.
- */
-void of_mdiobus_link_phydev(struct mii_bus *mdio,
-                            struct phy_device *phydev)
-{
-        struct device *dev = &phydev->dev;
-        struct device_node *child;
-        if (dev->of_node || !mdio->dev.of_node)
-                return;
-        for_each_available_child_of_node(mdio->dev.of_node, child) {
-                int addr;
-                addr = of_mdio_parse_addr(&mdio->dev, child);
-                if (addr < 0)
-                        continue;
-                if (addr == phydev->addr) {
-                        dev->of_node = child;
-                        return;
-                }
-        }
-}
-EXPORT_SYMBOL(of_mdiobus_link_phydev);
 /* Helper function for of_phy_find_device */
 static int of_phy_match(struct device *dev, void *phy_np)
 {
@@ -323,11 +289,13 @@ int of_phy_register_fixed_link(struct device_node *np)
        fixed_link_node = of_get_child_by_name(np, "fixed-link");
        if (fixed_link_node) {
                status.link = 1;
-                status.duplex = of_property_read_bool(np, "full-duplex");
+                status.duplex = of_property_read_bool(fixed_link_node,
+                                                      "full-duplex");
                if (of_property_read_u32(fixed_link_node, "speed", &status.speed))
                        return -EINVAL;
-                status.pause = of_property_read_bool(np, "pause");
+                status.pause = of_property_read_bool(fixed_link_node, "pause");
-                status.asym_pause = of_property_read_bool(np, "asym-pause");
+                status.asym_pause = of_property_read_bool(fixed_link_node,
+                                                          "asym-pause");
                of_node_put(fixed_link_node);
                return fixed_phy_register(PHY_POLL, &status, np);
        }
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 6c48d73a7fd7..500436f9be7f 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -166,10 +166,6 @@ static void of_dma_configure(struct platform_device *pdev)
        int ret;
        struct device *dev = &pdev->dev;
-#if defined(CONFIG_MICROBLAZE)
-        pdev->archdata.dma_mask = 0xffffffffUL;
-#endif
        /*
         * Set default dma-mask to 32 bit. Drivers are expected to setup
         * the correct supported dma_mask.
diff --git a/drivers/parport/Kconfig b/drivers/parport/Kconfig
index 2872ece81f35..44333bd8f908 100644
--- a/drivers/parport/Kconfig
+++ b/drivers/parport/Kconfig
@@ -5,6 +5,12 @@
 # Parport configuration.
 #
+config ARCH_MIGHT_HAVE_PC_PARPORT
+        bool
+        help
+          Select this config option from the architecture Kconfig if
+          the architecture might have PC parallel port hardware.
 menuconfig PARPORT
        tristate "Parallel port support"
        depends on HAS_IOMEM
@@ -31,12 +37,6 @@ menuconfig PARPORT
          If unsure, say Y.
-config ARCH_MIGHT_HAVE_PC_PARPORT
-        bool
-        help
-          Select this config option from the architecture Kconfig if
-          the architecture might have PC parallel port hardware.
 if PARPORT
 config PARPORT_PC
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 63a54a340863..1c8592b0e146 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3135,8 +3135,13 @@ static int pci_af_flr(struct pci_dev *dev, int probe)
        if (probe)
                return 0;
-        /* Wait for Transaction Pending bit clean */
+        /*
-        if (pci_wait_for_pending(dev, pos + PCI_AF_STATUS, PCI_AF_STATUS_TP))
+         * Wait for Transaction Pending bit to clear.  A word-aligned test
+         * is used, so we use the conrol offset rather than status and shift
+         * the test bit to match.
+         */
+        if (pci_wait_for_pending(dev, pos + PCI_AF_CTRL,
+                                 PCI_AF_STATUS_TP << 8))
                goto clear;
        dev_err(&dev->dev, "transaction is not cleared; proceeding with reset anyway\n");
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index 16a2f067c242..64b98d242ea6 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -112,6 +112,7 @@ config PHY_EXYNOS5250_SATA
 config PHY_SUN4I_USB
        tristate "Allwinner sunxi SoC USB PHY driver"
        depends on ARCH_SUNXI && HAS_IOMEM && OF
+        depends on RESET_CONTROLLER
        select GENERIC_PHY
        help
          Enable this to support the transceiver that is part of Allwinner
@@ -122,6 +123,7 @@ config PHY_SUN4I_USB
 config PHY_SAMSUNG_USB2
        tristate "Samsung USB 2.0 PHY driver"
+        depends on HAS_IOMEM
        select GENERIC_PHY
        select MFD_SYSCON
        help
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index c64a2f3b2d62..49c446530101 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -614,8 +614,9 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
        return phy;
 put_dev:
-        put_device(&phy->dev);
+        put_device(&phy->dev);  /* calls phy_release() which frees resources */
-        ida_remove(&phy_ida, phy->id);
+        return ERR_PTR(ret);
 free_phy:
        kfree(phy);
        return ERR_PTR(ret);
@@ -799,7 +800,7 @@ static void phy_release(struct device *dev)
        phy = to_phy(dev);
        dev_vdbg(dev, "releasing '%s'\n", dev_name(dev));
-        ida_remove(&phy_ida, phy->id);
+        ida_simple_remove(&phy_ida, phy->id);
        kfree(phy);
 }
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index 7007c11fe07d..34b396146c8a 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -233,8 +233,8 @@ static int omap_usb2_probe(struct platform_device *pdev)
        if (phy_data->flags & OMAP_USB2_CALIBRATE_FALSE_DISCONNECT) {
                res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
                phy->phy_base = devm_ioremap_resource(&pdev->dev, res);
-                if (!phy->phy_base)
+                if (IS_ERR(phy->phy_base))
-                        return -ENOMEM;
+                        return PTR_ERR(phy->phy_base);
                phy->flags |= OMAP_USB2_CALIBRATE_FALSE_DISCONNECT;
        }
@@ -262,7 +262,6 @@ static int omap_usb2_probe(struct platform_device *pdev)
        otg->phy                = &phy->phy;
        platform_set_drvdata(pdev, phy);
-        pm_runtime_enable(phy->dev);
        generic_phy = devm_phy_create(phy->dev, &ops, NULL);
        if (IS_ERR(generic_phy))
@@ -270,10 +269,13 @@ static int omap_usb2_probe(struct platform_device *pdev)
        phy_set_drvdata(generic_phy, phy);
+        pm_runtime_enable(phy->dev);
        phy_provider = devm_of_phy_provider_register(phy->dev,
                        of_phy_simple_xlate);
-        if (IS_ERR(phy_provider))
+        if (IS_ERR(phy_provider)) {
+                pm_runtime_disable(phy->dev);
                return PTR_ERR(phy_provider);
+        }
        phy->wkupclk = devm_clk_get(phy->dev, "wkupclk");
        if (IS_ERR(phy->wkupclk)) {
@@ -317,6 +319,7 @@ static int omap_usb2_remove(struct platform_device *pdev)
        if (!IS_ERR(phy->optclk))
                clk_unprepare(phy->optclk);
        usb_remove_phy(&phy->phy);
+        pm_runtime_disable(phy->dev);
        return 0;
 }
diff --git a/drivers/phy/phy-samsung-usb2.c b/drivers/phy/phy-samsung-usb2.c
index 8a8c6bc8709a..1e69a32c221d 100644
--- a/drivers/phy/phy-samsung-usb2.c
+++ b/drivers/phy/phy-samsung-usb2.c
@@ -107,6 +107,7 @@ static const struct of_device_id samsung_usb2_phy_of_match[] = {
 #endif
        { },
 };
+MODULE_DEVICE_TABLE(of, samsung_usb2_phy_of_match);
 static int samsung_usb2_phy_probe(struct platform_device *pdev)
 {
diff --git a/drivers/pinctrl/berlin/berlin.c b/drivers/pinctrl/berlin/berlin.c
index edf5d2fd2b22..86db2235ab00 100644
--- a/drivers/pinctrl/berlin/berlin.c
+++ b/drivers/pinctrl/berlin/berlin.c
@@ -320,7 +320,7 @@ int berlin_pinctrl_probe(struct platform_device *pdev,
        regmap = dev_get_regmap(&pdev->dev, NULL);
        if (!regmap)
-                return PTR_ERR(regmap);
+                return -ENODEV;
        pctrl = devm_kzalloc(dev, sizeof(*pctrl), GFP_KERNEL);
        if (!pctrl)
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 1bd6363bc95e..9f43916637ca 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1431,7 +1431,7 @@ static void st_gpio_irqmux_handler(unsigned irq, struct irq_desc *desc)
        status = readl(info->irqmux_base);
-        for_each_set_bit(n, &status, ST_GPIO_PINS_PER_BANK)
+        for_each_set_bit(n, &status, info->nbanks)
                __gpio_irq_handler(&info->banks[n]);
        chained_irq_exit(chip, desc);
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index f1ca75e6d7b1..5f38c7f67834 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -211,6 +211,10 @@ static int sunxi_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
                        configlen++;
                pinconfig = kzalloc(configlen * sizeof(*pinconfig), GFP_KERNEL);
+                if (!pinconfig) {
+                        kfree(*map);
+                        return -ENOMEM;
+                }
                if (!of_property_read_u32(node, "allwinner,drive", &val)) {
                        u16 strength = (val + 1) * 10;
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index b81448b2c75d..a5c6cb773e5f 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -319,8 +319,7 @@ static int __init acpi_pnp_match(struct device *dev, void *_pnp)
        struct pnp_dev *pnp = _pnp;
        /* true means it matched */
-        return !acpi->physical_node_count
+        return pnp->data == acpi;
-            && compare_pnp_id(pnp->id, acpi_device_hid(acpi));
 }
 static struct acpi_device * __init acpi_pnp_find_companion(struct device *dev)
diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig
index 6aea373547f6..ee3de3421f2d 100644
--- a/drivers/ptp/Kconfig
+++ b/drivers/ptp/Kconfig
@@ -74,7 +74,7 @@ config DP83640_PHY
 config PTP_1588_CLOCK_PCH
        tristate "Intel PCH EG20T as PTP clock"
-        depends on X86 || COMPILE_TEST
+        depends on X86_32 || COMPILE_TEST
        depends on HAS_IOMEM && NET
        select PTP_1588_CLOCK
        help
diff --git a/drivers/rapidio/devices/tsi721_dma.c b/drivers/rapidio/devices/tsi721_dma.c
index 9b60b1f3261c..44341dc5b148 100644
--- a/drivers/rapidio/devices/tsi721_dma.c
+++ b/drivers/rapidio/devices/tsi721_dma.c
@@ -287,6 +287,12 @@ struct tsi721_tx_desc *tsi721_desc_get(struct tsi721_bdma_chan *bdma_chan)
                        "desc %p not ACKed\n", tx_desc);
        }
+        if (ret == NULL) {
+                dev_dbg(bdma_chan->dchan.device->dev,
+                        "%s: unable to obtain tx descriptor\n", __func__);
+                goto err_out;
+        }
        i = bdma_chan->wr_count_next % bdma_chan->bd_num;
        if (i == bdma_chan->bd_num - 1) {
                i = 0;
@@ -297,7 +303,7 @@ struct tsi721_tx_desc *tsi721_desc_get(struct tsi721_bdma_chan *bdma_chan)
        tx_desc->txd.phys = bdma_chan->bd_phys +
                                i * sizeof(struct tsi721_dma_desc);
        tx_desc->hw_desc = &((struct tsi721_dma_desc *)bdma_chan->bd_base)[i];
+err_out:
        spin_unlock_bh(&bdma_chan->lock);
        return ret;
diff --git a/drivers/regulator/as3722-regulator.c b/drivers/regulator/as3722-regulator.c
index 85585219ce82..ad9e0c9b7daf 100644
--- a/drivers/regulator/as3722-regulator.c
+++ b/drivers/regulator/as3722-regulator.c
@@ -433,6 +433,7 @@ static struct regulator_ops as3722_ldo3_extcntrl_ops = {
 };
 static const struct regulator_linear_range as3722_ldo_ranges[] = {
+        REGULATOR_LINEAR_RANGE(0, 0x00, 0x00, 0),
        REGULATOR_LINEAR_RANGE(825000, 0x01, 0x24, 25000),
        REGULATOR_LINEAR_RANGE(1725000, 0x40, 0x7F, 25000),
 };
@@ -609,6 +610,7 @@ static bool as3722_sd0_is_low_voltage(struct as3722_regulators *as3722_regs)
 }
 static const struct regulator_linear_range as3722_sd2345_ranges[] = {
+        REGULATOR_LINEAR_RANGE(0, 0x00, 0x00, 0),
        REGULATOR_LINEAR_RANGE(612500, 0x01, 0x40, 12500),
        REGULATOR_LINEAR_RANGE(1425000, 0x41, 0x70, 25000),
        REGULATOR_LINEAR_RANGE(2650000, 0x71, 0x7F, 50000),
diff --git a/drivers/regulator/bcm590xx-regulator.c b/drivers/regulator/bcm590xx-regulator.c
index 57544e254a78..58ece59367ae 100644
--- a/drivers/regulator/bcm590xx-regulator.c
+++ b/drivers/regulator/bcm590xx-regulator.c
@@ -119,6 +119,10 @@ static const unsigned int ldo_c_table[] = {
        2900000, 3000000, 3300000,
 };
+static const unsigned int ldo_vbus[] = {
+        5000000,
+};
 /* DCDC group CSR: supported voltages in microvolts */
 static const struct regulator_linear_range dcdc_csr_ranges[] = {
        REGULATOR_LINEAR_RANGE(860000, 2, 50, 10000),
@@ -192,6 +196,7 @@ static struct bcm590xx_info bcm590xx_regs[] = {
        BCM590XX_REG_TABLE(gpldo4, ldo_a_table),
        BCM590XX_REG_TABLE(gpldo5, ldo_a_table),
        BCM590XX_REG_TABLE(gpldo6, ldo_a_table),
+        BCM590XX_REG_TABLE(vbus, ldo_vbus),
 };
 struct bcm590xx_reg {
diff --git a/drivers/regulator/ltc3589.c b/drivers/regulator/ltc3589.c
index 110a99ee1162..c8105182b8b8 100644
--- a/drivers/regulator/ltc3589.c
+++ b/drivers/regulator/ltc3589.c
@@ -255,7 +255,7 @@ static int ltc3589_parse_regulators_dt(struct ltc3589 *ltc3589)
        struct device_node *node;
        int i, ret;
-        node = of_find_node_by_name(dev->of_node, "regulators");
+        node = of_get_child_by_name(dev->of_node, "regulators");
        if (!node) {
                dev_err(dev, "regulators node not found\n");
                return -EINVAL;
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 864ed02ce4b7..93b4ad842901 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -37,12 +37,14 @@ struct regs_info {
 };
 static const struct regulator_linear_range smps_low_ranges[] = {
+        REGULATOR_LINEAR_RANGE(0, 0x0, 0x0, 0),
        REGULATOR_LINEAR_RANGE(500000, 0x1, 0x6, 0),
        REGULATOR_LINEAR_RANGE(510000, 0x7, 0x79, 10000),
        REGULATOR_LINEAR_RANGE(1650000, 0x7A, 0x7f, 0),
 };
 static const struct regulator_linear_range smps_high_ranges[] = {
+        REGULATOR_LINEAR_RANGE(0, 0x0, 0x0, 0),
        REGULATOR_LINEAR_RANGE(1000000, 0x1, 0x6, 0),
        REGULATOR_LINEAR_RANGE(1020000, 0x7, 0x79, 20000),
        REGULATOR_LINEAR_RANGE(3300000, 0x7A, 0x7f, 0),
@@ -323,6 +325,10 @@ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
        if (rail_enable)
                palmas_smps_write(pmic->palmas,
                        palmas_regs_info[id].ctrl_addr, reg);
+        /* Switch the enable value to ensure this is used for enable */
+        pmic->desc[id].enable_val = pmic->current_reg_mode[id];
        return 0;
 }
@@ -962,6 +968,14 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                                return ret;
                        pmic->current_reg_mode[id] = reg &
                                        PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+                        pmic->desc[id].enable_reg =
+                                        PALMAS_BASE_TO_REG(PALMAS_SMPS_BASE,
+                                                palmas_regs_info[id].ctrl_addr);
+                        pmic->desc[id].enable_mask =
+                                        PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+                        /* set_mode overrides this value */
+                        pmic->desc[id].enable_val = SMPS_CTRL_MODE_ON;
                }
                pmic->desc[id].type = REGULATOR_VOLTAGE;
diff --git a/drivers/regulator/tps65218-regulator.c b/drivers/regulator/tps65218-regulator.c
index 69b4b7750410..9effe48c605e 100644
--- a/drivers/regulator/tps65218-regulator.c
+++ b/drivers/regulator/tps65218-regulator.c
@@ -209,7 +209,7 @@ static const struct regulator_desc regulators[] = {
                           1, -1, -1, TPS65218_REG_ENABLE1,
                           TPS65218_ENABLE1_DC6_EN, NULL, NULL, 0, 0),
        TPS65218_REGULATOR("LDO1", TPS65218_LDO_1, tps65218_ldo1_dcdc34_ops, 64,
-                           TPS65218_REG_CONTROL_DCDC4,
+                           TPS65218_REG_CONTROL_LDO1,
                           TPS65218_CONTROL_LDO1_MASK, TPS65218_REG_ENABLE2,
                           TPS65218_ENABLE2_LDO1_EN, NULL, ldo1_dcdc3_ranges,
                           2, 0),
@@ -240,6 +240,7 @@ static int tps65218_regulator_probe(struct platform_device *pdev)
        config.init_data = init_data;
        config.driver_data = tps;
        config.regmap = tps->regmap;
+        config.of_node = pdev->dev.of_node;
        rdev = devm_regulator_register(&pdev->dev, &regulators[id], &config);
        if (IS_ERR(rdev)) {
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index ce1743d0b679..5e343bab9458 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -44,7 +44,7 @@ config STE_MODEM_RPROC
 config DA8XX_REMOTEPROC
        tristate "DA8xx/OMAP-L13x remoteproc support"
        depends on ARCH_DAVINCI_DA8XX
-        select CMA
+        select CMA if MMU
        select REMOTEPROC
        select RPMSG
        help
diff --git a/drivers/rtc/rtc-puv3.c b/drivers/rtc/rtc-puv3.c
index 1ecfe3bd92ac..1cff2a21db67 100644
--- a/drivers/rtc/rtc-puv3.c
+++ b/drivers/rtc/rtc-puv3.c
@@ -71,7 +71,7 @@ static int puv3_rtc_setpie(struct device *dev, int enabled)
 {
        unsigned int tmp;
-        dev_debug(dev, "%s: pie=%d\n", __func__, enabled);
+        dev_dbg(dev, "%s: pie=%d\n", __func__, enabled);
        spin_lock_irq(&puv3_rtc_pie_lock);
        tmp = readl(RTC_RTSR) & ~RTC_RTSR_HZE;
@@ -140,7 +140,7 @@ static int puv3_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        rtc_tm_to_time(tm, &rtcalarm_count);
        writel(rtcalarm_count, RTC_RTAR);
-        puv3_rtc_setaie(&dev->dev, alrm->enabled);
+        puv3_rtc_setaie(dev, alrm->enabled);
        if (alrm->enabled)
                enable_irq_wake(puv3_rtc_alarmno);
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index ee0e85abe1fd..0f471750327e 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -593,7 +593,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
        dev_info->start = dcssblk_find_lowest_addr(dev_info);
        dev_info->end = dcssblk_find_highest_addr(dev_info);
-        dev_set_name(&dev_info->dev, dev_info->segment_name);
+        dev_set_name(&dev_info->dev, "%s", dev_info->segment_name);
        dev_info->dev.release = dcssblk_release_segment;
        dev_info->dev.groups = dcssblk_dev_attr_groups;
        INIT_LIST_HEAD(&dev_info->lh);
diff --git a/drivers/s390/char/Makefile b/drivers/s390/char/Makefile
index 629fcc275e92..78b6ace7edcb 100644
--- a/drivers/s390/char/Makefile
+++ b/drivers/s390/char/Makefile
@@ -19,7 +19,6 @@ obj-$(CONFIG_SCLP_VT220_TTY) += sclp_vt220.o
 obj-$(CONFIG_SCLP_CPI) += sclp_cpi.o
 obj-$(CONFIG_SCLP_ASYNC) += sclp_async.o
-obj-$(CONFIG_ZVM_WATCHDOG) += vmwatchdog.o
 obj-$(CONFIG_VMLOGRDR) += vmlogrdr.o
 obj-$(CONFIG_VMCP) += vmcp.o
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index 15b3459f8656..220acb4cbee5 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -633,7 +633,6 @@ raw3270_reset_device_cb(struct raw3270_request *rq, void *data)
        } else
                raw3270_writesf_readpart(rp);
        memset(&rp->init_reset, 0, sizeof(rp->init_reset));
-        memset(&rp->init_data, 0, sizeof(rp->init_data));
 }
 static int
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index cd9c91909596..b9a9f721716d 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -838,8 +838,6 @@ sclp_vt220_con_init(void)
 {
        int rc;
-        if (!CONSOLE_IS_SCLP)
-                return 0;
        rc = __sclp_vt220_init(sclp_console_pages);
        if (rc)
                return rc;
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index cf31d3321dab..a8848db7b09d 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -761,7 +761,7 @@ static int vmlogrdr_register_device(struct vmlogrdr_priv_t *priv)
        dev = kzalloc(sizeof(struct device), GFP_KERNEL);
        if (dev) {
-                dev_set_name(dev, priv->internal_name);
+                dev_set_name(dev, "%s", priv->internal_name);
                dev->bus = &iucv_bus;
                dev->parent = iucv_root;
                dev->driver = &vmlogrdr_driver;
diff --git a/drivers/s390/char/vmwatchdog.c b/drivers/s390/char/vmwatchdog.c
deleted file mode 100644
index d5eac985976b..000000000000
--- a/drivers/s390/char/vmwatchdog.c
+++ /dev/null
@@ -1,338 +0,0 @@
-/*
- * Watchdog implementation based on z/VM Watchdog Timer API
- *
- * Copyright IBM Corp. 2004, 2009
- *
- * The user space watchdog daemon can use this driver as
- * /dev/vmwatchdog to have z/VM execute the specified CP
- * command when the timeout expires. The default command is
- * "IPL", which which cause an immediate reboot.
- */
-#define KMSG_COMPONENT "vmwatchdog"
-#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
-#include <linux/init.h>
-#include <linux/fs.h>
-#include <linux/kernel.h>
-#include <linux/miscdevice.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/slab.h>
-#include <linux/suspend.h>
-#include <linux/watchdog.h>
-#include <asm/ebcdic.h>
-#include <asm/io.h>
-#include <asm/uaccess.h>
-#define MAX_CMDLEN 240
-#define MIN_INTERVAL 15
-static char vmwdt_cmd[MAX_CMDLEN] = "IPL";
-static bool vmwdt_conceal;
-static bool vmwdt_nowayout = WATCHDOG_NOWAYOUT;
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Arnd Bergmann <arndb@de.ibm.com>");
-MODULE_DESCRIPTION("z/VM Watchdog Timer");
-module_param_string(cmd, vmwdt_cmd, MAX_CMDLEN, 0644);
-MODULE_PARM_DESC(cmd, "CP command that is run when the watchdog triggers");
-module_param_named(conceal, vmwdt_conceal, bool, 0644);
-MODULE_PARM_DESC(conceal, "Enable the CONCEAL CP option while the watchdog "
-                " is active");
-module_param_named(nowayout, vmwdt_nowayout, bool, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started"
-                " (default=CONFIG_WATCHDOG_NOWAYOUT)");
-MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
-static unsigned int vmwdt_interval = 60;
-static unsigned long vmwdt_is_open;
-static int vmwdt_expect_close;
-static DEFINE_MUTEX(vmwdt_mutex);
-#define VMWDT_OPEN      0       /* devnode is open or suspend in progress */
-#define VMWDT_RUNNING   1       /* The watchdog is armed */
-enum vmwdt_func {
-        /* function codes */
-        wdt_init   = 0,
-        wdt_change = 1,
-        wdt_cancel = 2,
-        /* flags */
-        wdt_conceal = 0x80000000,
-};
-static int __diag288(enum vmwdt_func func, unsigned int timeout,
-                            char *cmd, size_t len)
-{
-        register unsigned long __func asm("2") = func;
-        register unsigned long __timeout asm("3") = timeout;
-        register unsigned long __cmdp asm("4") = virt_to_phys(cmd);
-        register unsigned long __cmdl asm("5") = len;
-        int err;
-        err = -EINVAL;
-        asm volatile(
-                "       diag    %1,%3,0x288\n"
-                "0:     la      %0,0\n"
-                "1:\n"
-                EX_TABLE(0b,1b)
-                : "+d" (err) : "d"(__func), "d"(__timeout),
-                  "d"(__cmdp), "d"(__cmdl) : "1", "cc");
-        return err;
-}
-static int vmwdt_keepalive(void)
-{
-        /* we allocate new memory every time to avoid having
-         * to track the state. static allocation is not an
-         * option since that might not be contiguous in real
-         * storage in case of a modular build */
-        static char *ebc_cmd;
-        size_t len;
-        int ret;
-        unsigned int func;
-        ebc_cmd = kmalloc(MAX_CMDLEN, GFP_KERNEL);
-        if (!ebc_cmd)
-                return -ENOMEM;
-        len = strlcpy(ebc_cmd, vmwdt_cmd, MAX_CMDLEN);
-        ASCEBC(ebc_cmd, MAX_CMDLEN);
-        EBC_TOUPPER(ebc_cmd, MAX_CMDLEN);
-        func = vmwdt_conceal ? (wdt_init | wdt_conceal) : wdt_init;
-        set_bit(VMWDT_RUNNING, &vmwdt_is_open);
-        ret = __diag288(func, vmwdt_interval, ebc_cmd, len);
-        WARN_ON(ret != 0);
-        kfree(ebc_cmd);
-        return ret;
-}
-static int vmwdt_disable(void)
-{
-        char cmd[] = {'\0'};
-        int ret = __diag288(wdt_cancel, 0, cmd, 0);
-        WARN_ON(ret != 0);
-        clear_bit(VMWDT_RUNNING, &vmwdt_is_open);
-        return ret;
-}
-static int __init vmwdt_probe(void)
-{
-        /* there is no real way to see if the watchdog is supported,
-         * so we try initializing it with a NOP command ("BEGIN")
-         * that won't cause any harm even if the following disable
-         * fails for some reason */
-        char ebc_begin[] = {
-                194, 197, 199, 201, 213
-        };
-        if (__diag288(wdt_init, 15, ebc_begin, sizeof(ebc_begin)) != 0)
-                return -EINVAL;
-        return vmwdt_disable();
-}
-static int vmwdt_open(struct inode *i, struct file *f)
-{
-        int ret;
-        if (test_and_set_bit(VMWDT_OPEN, &vmwdt_is_open))
-                return -EBUSY;
-        ret = vmwdt_keepalive();
-        if (ret)
-                clear_bit(VMWDT_OPEN, &vmwdt_is_open);
-        return ret ? ret : nonseekable_open(i, f);
-}
-static int vmwdt_close(struct inode *i, struct file *f)
-{
-        if (vmwdt_expect_close == 42)
-                vmwdt_disable();
-        vmwdt_expect_close = 0;
-        clear_bit(VMWDT_OPEN, &vmwdt_is_open);
-        return 0;
-}
-static struct watchdog_info vmwdt_info = {
-        .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING | WDIOF_MAGICCLOSE,
-        .firmware_version = 0,
-        .identity = "z/VM Watchdog Timer",
-};
-static int __vmwdt_ioctl(unsigned int cmd, unsigned long arg)
-{
-        switch (cmd) {
-        case WDIOC_GETSUPPORT:
-                if (copy_to_user((void __user *)arg, &vmwdt_info,
-                                        sizeof(vmwdt_info)))
-                        return -EFAULT;
-                return 0;
-        case WDIOC_GETSTATUS:
-        case WDIOC_GETBOOTSTATUS:
-                return put_user(0, (int __user *)arg);
-        case WDIOC_GETTEMP:
-                return -EINVAL;
-        case WDIOC_SETOPTIONS:
-                {
-                        int options, ret;
-                        if (get_user(options, (int __user *)arg))
-                                return -EFAULT;
-                        ret = -EINVAL;
-                        if (options & WDIOS_DISABLECARD) {
-                                ret = vmwdt_disable();
-                                if (ret)
-                                        return ret;
-                        }
-                        if (options & WDIOS_ENABLECARD) {
-                                ret = vmwdt_keepalive();
-                        }
-                        return ret;
-                }
-        case WDIOC_GETTIMEOUT:
-                return put_user(vmwdt_interval, (int __user *)arg);
-        case WDIOC_SETTIMEOUT:
-                {
-                        int interval;
-                        if (get_user(interval, (int __user *)arg))
-                                return -EFAULT;
-                        if (interval < MIN_INTERVAL)
-                                return -EINVAL;
-                        vmwdt_interval = interval;
-                }
-                return vmwdt_keepalive();
-        case WDIOC_KEEPALIVE:
-                return vmwdt_keepalive();
-        }
-        return -EINVAL;
-}
-static long vmwdt_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
-{
-        int rc;
-        mutex_lock(&vmwdt_mutex);
-        rc = __vmwdt_ioctl(cmd, arg);
-        mutex_unlock(&vmwdt_mutex);
-        return (long) rc;
-}
-static ssize_t vmwdt_write(struct file *f, const char __user *buf,
-                                size_t count, loff_t *ppos)
-{
-        if(count) {
-                if (!vmwdt_nowayout) {
-                        size_t i;
-                        /* note: just in case someone wrote the magic character
-                         * five months ago... */
-                        vmwdt_expect_close = 0;
-                        for (i = 0; i != count; i++) {
-                                char c;
-                                if (get_user(c, buf+i))
-                                        return -EFAULT;
-                                if (c == 'V')
-                                        vmwdt_expect_close = 42;
-                        }
-                }
-                /* someone wrote to us, we should restart timer */
-                vmwdt_keepalive();
-        }
-        return count;
-}
-static int vmwdt_resume(void)
-{
-        clear_bit(VMWDT_OPEN, &vmwdt_is_open);
-        return NOTIFY_DONE;
-}
-/*
- * It makes no sense to go into suspend while the watchdog is running.
- * Depending on the memory size, the watchdog might trigger, while we
- * are still saving the memory.
- * We reuse the open flag to ensure that suspend and watchdog open are
- * exclusive operations
- */
-static int vmwdt_suspend(void)
-{
-        if (test_and_set_bit(VMWDT_OPEN, &vmwdt_is_open)) {
-                pr_err("The system cannot be suspended while the watchdog"
-                        " is in use\n");
-                return notifier_from_errno(-EBUSY);
-        }
-        if (test_bit(VMWDT_RUNNING, &vmwdt_is_open)) {
-                clear_bit(VMWDT_OPEN, &vmwdt_is_open);
-                pr_err("The system cannot be suspended while the watchdog"
-                        " is running\n");
-                return notifier_from_errno(-EBUSY);
-        }
-        return NOTIFY_DONE;
-}
-/*
- * This function is called for suspend and resume.
- */
-static int vmwdt_power_event(struct notifier_block *this, unsigned long event,
-                             void *ptr)
-{
-        switch (event) {
-        case PM_POST_HIBERNATION:
-        case PM_POST_SUSPEND:
-                return vmwdt_resume();
-        case PM_HIBERNATION_PREPARE:
-        case PM_SUSPEND_PREPARE:
-                return vmwdt_suspend();
-        default:
-                return NOTIFY_DONE;
-        }
-}
-static struct notifier_block vmwdt_power_notifier = {
-        .notifier_call = vmwdt_power_event,
-};
-static const struct file_operations vmwdt_fops = {
-        .open    = &vmwdt_open,
-        .release = &vmwdt_close,
-        .unlocked_ioctl = &vmwdt_ioctl,
-        .write   = &vmwdt_write,
-        .owner   = THIS_MODULE,
-        .llseek  = noop_llseek,
-};
-static struct miscdevice vmwdt_dev = {
-        .minor      = WATCHDOG_MINOR,
-        .name       = "watchdog",
-        .fops       = &vmwdt_fops,
-};
-static int __init vmwdt_init(void)
-{
-        int ret;
-        ret = vmwdt_probe();
-        if (ret)
-                return ret;
-        ret = register_pm_notifier(&vmwdt_power_notifier);
-        if (ret)
-                return ret;
-        /*
-         * misc_register() has to be the last action in module_init(), because
-         * file operations will be available right after this.
-         */
-        ret = misc_register(&vmwdt_dev);
-        if (ret) {
-                unregister_pm_notifier(&vmwdt_power_notifier);
-                return ret;
-        }
-        return 0;
-}
-module_init(vmwdt_init);
-static void __exit vmwdt_exit(void)
-{
-        unregister_pm_notifier(&vmwdt_power_notifier);
-        misc_deregister(&vmwdt_dev);
-}
-module_exit(vmwdt_exit);
diff --git a/drivers/s390/cio/airq.c b/drivers/s390/cio/airq.c
index 445564c790f6..00bfbee0af9e 100644
--- a/drivers/s390/cio/airq.c
+++ b/drivers/s390/cio/airq.c
@@ -196,11 +196,11 @@ EXPORT_SYMBOL(airq_iv_release);
 */
 unsigned long airq_iv_alloc(struct airq_iv *iv, unsigned long num)
 {
-        unsigned long bit, i;
+        unsigned long bit, i, flags;
        if (!iv->avail || num == 0)
                return -1UL;
-        spin_lock(&iv->lock);
+        spin_lock_irqsave(&iv->lock, flags);
        bit = find_first_bit_inv(iv->avail, iv->bits);
        while (bit + num <= iv->bits) {
                for (i = 1; i < num; i++)
@@ -218,9 +218,8 @@ unsigned long airq_iv_alloc(struct airq_iv *iv, unsigned long num)
        }
        if (bit + num > iv->bits)
                bit = -1UL;
-        spin_unlock(&iv->lock);
+        spin_unlock_irqrestore(&iv->lock, flags);
        return bit;
 }
 EXPORT_SYMBOL(airq_iv_alloc);
@@ -232,11 +231,11 @@ EXPORT_SYMBOL(airq_iv_alloc);
 */
 void airq_iv_free(struct airq_iv *iv, unsigned long bit, unsigned long num)
 {
-        unsigned long i;
+        unsigned long i, flags;
        if (!iv->avail || num == 0)
                return;
-        spin_lock(&iv->lock);
+        spin_lock_irqsave(&iv->lock, flags);
        for (i = 0; i < num; i++) {
                /* Clear (possibly left over) interrupt bit */
                clear_bit_inv(bit + i, iv->vector);
@@ -248,7 +247,7 @@ void airq_iv_free(struct airq_iv *iv, unsigned long bit, unsigned long num)
                while (iv->end > 0 && !test_bit_inv(iv->end - 1, iv->avail))
                        iv->end--;
        }
-        spin_unlock(&iv->lock);
+        spin_unlock_irqrestore(&iv->lock, flags);
 }
 EXPORT_SYMBOL(airq_iv_free);
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index dfd7bc681c25..e443b0d0b236 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -184,7 +184,7 @@ static ssize_t ccwgroup_ungroup_store(struct device *dev,
                                      const char *buf, size_t count)
 {
        struct ccwgroup_device *gdev = to_ccwgroupdev(dev);
-        int rc;
+        int rc = 0;
        /* Prevent concurrent online/offline processing and ungrouping. */
        if (atomic_cmpxchg(&gdev->onoff, 0, 1) != 0)
@@ -196,11 +196,12 @@ static ssize_t ccwgroup_ungroup_store(struct device *dev,
        if (device_remove_file_self(dev, attr))
                ccwgroup_ungroup(gdev);
+        else
+                rc = -ENODEV;
 out:
        if (rc) {
-                if (rc != -EAGAIN)
+                /* Release onoff "lock" when ungrouping failed. */
-                        /* Release onoff "lock" when ungrouping failed. */
+                atomic_set(&gdev->onoff, 0);
-                        atomic_set(&gdev->onoff, 0);
                return rc;
        }
        return count;
@@ -227,6 +228,7 @@ static void ccwgroup_ungroup_workfn(struct work_struct *work)
                container_of(work, struct ccwgroup_device, ungroup_work);
        ccwgroup_ungroup(gdev);
+        put_device(&gdev->dev);
 }
 static void ccwgroup_release(struct device *dev)
@@ -412,8 +414,10 @@ static int ccwgroup_notifier(struct notifier_block *nb, unsigned long action,
 {
        struct ccwgroup_device *gdev = to_ccwgroupdev(data);
-        if (action == BUS_NOTIFY_UNBIND_DRIVER)
+        if (action == BUS_NOTIFY_UNBIND_DRIVER) {
+                get_device(&gdev->dev);
                schedule_work(&gdev->ungroup_work);
+        }
        return NOTIFY_OK;
 }
@@ -582,11 +586,7 @@ void ccwgroup_driver_unregister(struct ccwgroup_driver *cdriver)
                                         __ccwgroup_match_all))) {
                struct ccwgroup_device *gdev = to_ccwgroupdev(dev);
-                mutex_lock(&gdev->reg_mutex);
+                ccwgroup_ungroup(gdev);
-                __ccwgroup_remove_symlinks(gdev);
-                device_unregister(dev);
-                __ccwgroup_remove_cdev_refs(gdev);
-                mutex_unlock(&gdev->reg_mutex);
                put_device(dev);
        }
        driver_unregister(&cdriver->driver);
@@ -633,13 +633,7 @@ void ccwgroup_remove_ccwdev(struct ccw_device *cdev)
        get_device(&gdev->dev);
        spin_unlock_irq(cdev->ccwlock);
        /* Unregister group device. */
-        mutex_lock(&gdev->reg_mutex);
+        ccwgroup_ungroup(gdev);
-        if (device_is_registered(&gdev->dev)) {
-                __ccwgroup_remove_symlinks(gdev);
-                device_unregister(&gdev->dev);
-                __ccwgroup_remove_cdev_refs(gdev);
-        }
-        mutex_unlock(&gdev->reg_mutex);
        /* Release ccwgroup device reference for local processing. */
        put_device(&gdev->dev);
 }
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 77f9c92df4b9..2905d8b0ec95 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -602,6 +602,7 @@ void __init init_cio_interrupts(void)
 #ifdef CONFIG_CCW_CONSOLE
 static struct subchannel *console_sch;
+static struct lock_class_key console_sch_key;
 /*
 * Use cio_tsch to update the subchannel status and call the interrupt handler
@@ -686,6 +687,7 @@ struct subchannel *cio_probe_console(void)
        if (IS_ERR(sch))
                return sch;
+        lockdep_set_class(sch->lock, &console_sch_key);
        isc_register(CONSOLE_ISC);
        sch->config.isc = CONSOLE_ISC;
        sch->config.intparm = (u32)(addr_t)sch;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index d8d9b5b5cc56..dfef5e63cb7b 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -678,18 +678,11 @@ static const struct attribute_group *ccwdev_attr_groups[] = {
        NULL,
 };
-/* this is a simple abstraction for device_register that sets the
+static int ccw_device_add(struct ccw_device *cdev)
- * correct bus type and adds the bus specific files */
-static int ccw_device_register(struct ccw_device *cdev)
 {
        struct device *dev = &cdev->dev;
-        int ret;
        dev->bus = &ccw_bus_type;
-        ret = dev_set_name(&cdev->dev, "0.%x.%04x", cdev->private->dev_id.ssid,
-                           cdev->private->dev_id.devno);
-        if (ret)
-                return ret;
        return device_add(dev);
 }
@@ -764,22 +757,46 @@ static void ccw_device_todo(struct work_struct *work);
 static int io_subchannel_initialize_dev(struct subchannel *sch,
                                        struct ccw_device *cdev)
 {
-        cdev->private->cdev = cdev;
+        struct ccw_device_private *priv = cdev->private;
-        cdev->private->int_class = IRQIO_CIO;
+        int ret;
-        atomic_set(&cdev->private->onoff, 0);
+        priv->cdev = cdev;
+        priv->int_class = IRQIO_CIO;
+        priv->state = DEV_STATE_NOT_OPER;
+        priv->dev_id.devno = sch->schib.pmcw.dev;
+        priv->dev_id.ssid = sch->schid.ssid;
+        priv->schid = sch->schid;
+        INIT_WORK(&priv->todo_work, ccw_device_todo);
+        INIT_LIST_HEAD(&priv->cmb_list);
+        init_waitqueue_head(&priv->wait_q);
+        init_timer(&priv->timer);
+        atomic_set(&priv->onoff, 0);
+        cdev->ccwlock = sch->lock;
        cdev->dev.parent = &sch->dev;
        cdev->dev.release = ccw_device_release;
-        INIT_WORK(&cdev->private->todo_work, ccw_device_todo);
        cdev->dev.groups = ccwdev_attr_groups;
        /* Do first half of device_register. */
        device_initialize(&cdev->dev);
+        ret = dev_set_name(&cdev->dev, "0.%x.%04x", cdev->private->dev_id.ssid,
+                           cdev->private->dev_id.devno);
+        if (ret)
+                goto out_put;
        if (!get_device(&sch->dev)) {
-                /* Release reference from device_initialize(). */
+                ret = -ENODEV;
-                put_device(&cdev->dev);
+                goto out_put;
-                return -ENODEV;
        }
-        cdev->private->flags.initialized = 1;
+        priv->flags.initialized = 1;
+        spin_lock_irq(sch->lock);
+        sch_set_cdev(sch, cdev);
+        spin_unlock_irq(sch->lock);
        return 0;
+out_put:
+        /* Release reference from device_initialize(). */
+        put_device(&cdev->dev);
+        return ret;
 }
 static struct ccw_device * io_subchannel_create_ccwdev(struct subchannel *sch)
@@ -858,7 +875,7 @@ static void io_subchannel_register(struct ccw_device *cdev)
        dev_set_uevent_suppress(&sch->dev, 0);
        kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
        /* make it known to the system */
-        ret = ccw_device_register(cdev);
+        ret = ccw_device_add(cdev);
        if (ret) {
                CIO_MSG_EVENT(0, "Could not register ccw dev 0.%x.%04x: %d\n",
                              cdev->private->dev_id.ssid,
@@ -923,26 +940,11 @@ io_subchannel_recog_done(struct ccw_device *cdev)
 static void io_subchannel_recog(struct ccw_device *cdev, struct subchannel *sch)
 {
-        struct ccw_device_private *priv;
-        cdev->ccwlock = sch->lock;
-        /* Init private data. */
-        priv = cdev->private;
-        priv->dev_id.devno = sch->schib.pmcw.dev;
-        priv->dev_id.ssid = sch->schid.ssid;
-        priv->schid = sch->schid;
-        priv->state = DEV_STATE_NOT_OPER;
-        INIT_LIST_HEAD(&priv->cmb_list);
-        init_waitqueue_head(&priv->wait_q);
-        init_timer(&priv->timer);
        /* Increase counter of devices currently in recognition. */
        atomic_inc(&ccw_device_init_count);
        /* Start async. device sensing. */
        spin_lock_irq(sch->lock);
-        sch_set_cdev(sch, cdev);
        ccw_device_recognition(cdev);
        spin_unlock_irq(sch->lock);
 }
@@ -1083,7 +1085,7 @@ static int io_subchannel_probe(struct subchannel *sch)
                dev_set_uevent_suppress(&sch->dev, 0);
                kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
                cdev = sch_get_cdev(sch);
-                rc = ccw_device_register(cdev);
+                rc = ccw_device_add(cdev);
                if (rc) {
                        /* Release online reference. */
                        put_device(&cdev->dev);
@@ -1597,7 +1599,6 @@ int __init ccw_device_enable_console(struct ccw_device *cdev)
        if (rc)
                return rc;
        sch->driver = &io_subchannel_driver;
-        sch_set_cdev(sch, cdev);
        io_subchannel_recog(cdev, sch);
        /* Now wait for the async. recognition to come to an end. */
        spin_lock_irq(cdev->ccwlock);
@@ -1639,6 +1640,7 @@ struct ccw_device * __init ccw_device_create_console(struct ccw_driver *drv)
                put_device(&sch->dev);
                return ERR_PTR(-ENOMEM);
        }
+        set_io_private(sch, io_priv);
        cdev = io_subchannel_create_ccwdev(sch);
        if (IS_ERR(cdev)) {
                put_device(&sch->dev);
@@ -1646,7 +1648,6 @@ struct ccw_device * __init ccw_device_create_console(struct ccw_driver *drv)
                return cdev;
        }
        cdev->drv = drv;
-        set_io_private(sch, io_priv);
        ccw_device_set_int_class(cdev);
        return cdev;
 }
diff --git a/drivers/s390/cio/qdio_debug.c b/drivers/s390/cio/qdio_debug.c
index 4221b02085ad..f1f3baa8e6e4 100644
--- a/drivers/s390/cio/qdio_debug.c
+++ b/drivers/s390/cio/qdio_debug.c
@@ -7,6 +7,7 @@
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
 #include <linux/export.h>
+#include <linux/slab.h>
 #include <asm/debug.h>
 #include "qdio_debug.h"
 #include "qdio.h"
@@ -16,11 +17,51 @@ debug_info_t *qdio_dbf_error;
 static struct dentry *debugfs_root;
 #define QDIO_DEBUGFS_NAME_LEN   10
+#define QDIO_DBF_NAME_LEN       20
-void qdio_allocate_dbf(struct qdio_initialize *init_data,
+struct qdio_dbf_entry {
+        char dbf_name[QDIO_DBF_NAME_LEN];
+        debug_info_t *dbf_info;
+        struct list_head dbf_list;
+};
+static LIST_HEAD(qdio_dbf_list);
+static DEFINE_MUTEX(qdio_dbf_list_mutex);
+static debug_info_t *qdio_get_dbf_entry(char *name)
+{
+        struct qdio_dbf_entry *entry;
+        debug_info_t *rc = NULL;
+        mutex_lock(&qdio_dbf_list_mutex);
+        list_for_each_entry(entry, &qdio_dbf_list, dbf_list) {
+                if (strcmp(entry->dbf_name, name) == 0) {
+                        rc = entry->dbf_info;
+                        break;
+                }
+        }
+        mutex_unlock(&qdio_dbf_list_mutex);
+        return rc;
+}
+static void qdio_clear_dbf_list(void)
+{
+        struct qdio_dbf_entry *entry, *tmp;
+        mutex_lock(&qdio_dbf_list_mutex);
+        list_for_each_entry_safe(entry, tmp, &qdio_dbf_list, dbf_list) {
+                list_del(&entry->dbf_list);
+                debug_unregister(entry->dbf_info);
+                kfree(entry);
+        }
+        mutex_unlock(&qdio_dbf_list_mutex);
+}
+int qdio_allocate_dbf(struct qdio_initialize *init_data,
                       struct qdio_irq *irq_ptr)
 {
-        char text[20];
+        char text[QDIO_DBF_NAME_LEN];
+        struct qdio_dbf_entry *new_entry;
        DBF_EVENT("qfmt:%1d", init_data->q_format);
        DBF_HEX(init_data->adapter_name, 8);
@@ -38,11 +79,34 @@ void qdio_allocate_dbf(struct qdio_initialize *init_data,
        DBF_EVENT("irq:%8lx", (unsigned long)irq_ptr);
        /* allocate trace view for the interface */
-        snprintf(text, 20, "qdio_%s", dev_name(&init_data->cdev->dev));
+        snprintf(text, QDIO_DBF_NAME_LEN, "qdio_%s",
-        irq_ptr->debug_area = debug_register(text, 2, 1, 16);
+                                        dev_name(&init_data->cdev->dev));
-        debug_register_view(irq_ptr->debug_area, &debug_hex_ascii_view);
+        irq_ptr->debug_area = qdio_get_dbf_entry(text);
-        debug_set_level(irq_ptr->debug_area, DBF_WARN);
+        if (irq_ptr->debug_area)
-        DBF_DEV_EVENT(DBF_ERR, irq_ptr, "dbf created");
+                DBF_DEV_EVENT(DBF_ERR, irq_ptr, "dbf reused");
+        else {
+                irq_ptr->debug_area = debug_register(text, 2, 1, 16);
+                if (!irq_ptr->debug_area)
+                        return -ENOMEM;
+                if (debug_register_view(irq_ptr->debug_area,
+                                                &debug_hex_ascii_view)) {
+                        debug_unregister(irq_ptr->debug_area);
+                        return -ENOMEM;
+                }
+                debug_set_level(irq_ptr->debug_area, DBF_WARN);
+                DBF_DEV_EVENT(DBF_ERR, irq_ptr, "dbf created");
+                new_entry = kzalloc(sizeof(struct qdio_dbf_entry), GFP_KERNEL);
+                if (!new_entry) {
+                        debug_unregister(irq_ptr->debug_area);
+                        return -ENOMEM;
+                }
+                strlcpy(new_entry->dbf_name, text, QDIO_DBF_NAME_LEN);
+                new_entry->dbf_info = irq_ptr->debug_area;
+                mutex_lock(&qdio_dbf_list_mutex);
+                list_add(&new_entry->dbf_list, &qdio_dbf_list);
+                mutex_unlock(&qdio_dbf_list_mutex);
+        }
+        return 0;
 }
 static int qstat_show(struct seq_file *m, void *v)
@@ -300,6 +364,7 @@ int __init qdio_debug_init(void)
 void qdio_debug_exit(void)
 {
+        qdio_clear_dbf_list();
        debugfs_remove(debugfs_root);
        if (qdio_dbf_setup)
                debug_unregister(qdio_dbf_setup);
diff --git a/drivers/s390/cio/qdio_debug.h b/drivers/s390/cio/qdio_debug.h
index dfac9bfefea3..f33ce8577619 100644
--- a/drivers/s390/cio/qdio_debug.h
+++ b/drivers/s390/cio/qdio_debug.h
@@ -75,7 +75,7 @@ static inline void DBF_DEV_HEX(struct qdio_irq *dev, void *addr,
        }
 }
-void qdio_allocate_dbf(struct qdio_initialize *init_data,
+int qdio_allocate_dbf(struct qdio_initialize *init_data,
                       struct qdio_irq *irq_ptr);
 void qdio_setup_debug_entries(struct qdio_irq *irq_ptr,
                              struct ccw_device *cdev);
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 77466c4faabb..848e3b64ea6e 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -409,17 +409,16 @@ static inline void qdio_stop_polling(struct qdio_q *q)
                set_buf_state(q, q->u.in.ack_start, SLSB_P_INPUT_NOT_INIT);
 }
-static inline void account_sbals(struct qdio_q *q, int count)
+static inline void account_sbals(struct qdio_q *q, unsigned int count)
 {
-        int pos = 0;
+        int pos;
        q->q_stats.nr_sbal_total += count;
        if (count == QDIO_MAX_BUFFERS_MASK) {
                q->q_stats.nr_sbals[7]++;
                return;
        }
-        while (count >>= 1)
+        pos = ilog2(count);
-                pos++;
        q->q_stats.nr_sbals[pos]++;
 }
@@ -1234,12 +1233,10 @@ int qdio_free(struct ccw_device *cdev)
                return -ENODEV;
        DBF_EVENT("qfree:%4x", cdev->private->schid.sch_no);
+        DBF_DEV_EVENT(DBF_ERR, irq_ptr, "dbf abandoned");
        mutex_lock(&irq_ptr->setup_mutex);
-        if (irq_ptr->debug_area != NULL) {
+        irq_ptr->debug_area = NULL;
-                debug_unregister(irq_ptr->debug_area);
-                irq_ptr->debug_area = NULL;
-        }
        cdev->private->qdio_data = NULL;
        mutex_unlock(&irq_ptr->setup_mutex);
@@ -1276,7 +1273,8 @@ int qdio_allocate(struct qdio_initialize *init_data)
                goto out_err;
        mutex_init(&irq_ptr->setup_mutex);
-        qdio_allocate_dbf(init_data, irq_ptr);
+        if (qdio_allocate_dbf(init_data, irq_ptr))
+                goto out_rel;
        /*
         * Allocate a page for the chsc calls in qdio_establish.
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 8eec1653c9cc..4038437ff033 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -77,12 +77,12 @@ MODULE_ALIAS("z90crypt");
 * Module parameter
 */
 int ap_domain_index = -1;       /* Adjunct Processor Domain Index */
-module_param_named(domain, ap_domain_index, int, 0000);
+module_param_named(domain, ap_domain_index, int, S_IRUSR|S_IRGRP);
 MODULE_PARM_DESC(domain, "domain index for ap devices");
 EXPORT_SYMBOL(ap_domain_index);
 static int ap_thread_flag = 0;
-module_param_named(poll_thread, ap_thread_flag, int, 0000);
+module_param_named(poll_thread, ap_thread_flag, int, S_IRUSR|S_IRGRP);
 MODULE_PARM_DESC(poll_thread, "Turn on/off poll thread, default is 0 (off).");
 static struct device *ap_root_device = NULL;
@@ -901,10 +901,15 @@ static int ap_device_probe(struct device *dev)
        int rc;
        ap_dev->drv = ap_drv;
+        spin_lock_bh(&ap_device_list_lock);
+        list_add(&ap_dev->list, &ap_device_list);
+        spin_unlock_bh(&ap_device_list_lock);
        rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
-        if (!rc) {
+        if (rc) {
                spin_lock_bh(&ap_device_list_lock);
-                list_add(&ap_dev->list, &ap_device_list);
+                list_del_init(&ap_dev->list);
                spin_unlock_bh(&ap_device_list_lock);
        }
        return rc;
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 5222ebe15705..0e18c5dcd91f 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -356,7 +356,7 @@ struct zcrypt_ops *zcrypt_msgtype_request(unsigned char *name, int variant)
        zops = __ops_lookup(name, variant);
        if (!zops) {
-                request_module(name);
+                request_module("%s", name);
                zops = __ops_lookup(name, variant);
        }
        if ((!zops) || (!try_module_get(zops->owner)))
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 554349029628..56467df3d6de 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -4198,6 +4198,8 @@ static int hba_setup_cid_tbls(struct beiscsi_hba *phba)
                kfree(phba->ep_array);
                phba->ep_array = NULL;
                ret = -ENOMEM;
+                goto free_memory;
        }
        for (i = 0; i < phba->params.cxns_per_ctrl; i++) {
diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
index 6045aa78986a..07934b0b9ee1 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -1008,10 +1008,8 @@ int mgmt_set_ip(struct beiscsi_hba *phba,
                BE2_IPV6 : BE2_IPV4 ;
        rc = mgmt_get_if_info(phba, ip_type, &if_info);
-        if (rc) {
+        if (rc)
-                kfree(if_info);
                return rc;
-        }
        if (boot_proto == ISCSI_BOOTPROTO_DHCP) {
                if (if_info->dhcp_state) {
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index f54843023466..785d0d71781e 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -516,23 +516,17 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
        skb_pull(skb, sizeof(struct fcoe_hdr));
        fr_len = skb->len - sizeof(struct fcoe_crc_eof);
-        stats = per_cpu_ptr(lport->stats, get_cpu());
-        stats->RxFrames++;
-        stats->RxWords += fr_len / FCOE_WORD_TO_BYTE;
        fp = (struct fc_frame *)skb;
        fc_frame_init(fp);
        fr_dev(fp) = lport;
        fr_sof(fp) = hp->fcoe_sof;
        if (skb_copy_bits(skb, fr_len, &crc_eof, sizeof(crc_eof))) {
-                put_cpu();
                kfree_skb(skb);
                return;
        }
        fr_eof(fp) = crc_eof.fcoe_eof;
        fr_crc(fp) = crc_eof.fcoe_crc32;
        if (pskb_trim(skb, fr_len)) {
-                put_cpu();
                kfree_skb(skb);
                return;
        }
@@ -544,7 +538,6 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
                port = lport_priv(vn_port);
                if (!ether_addr_equal(port->data_src_addr, dest_mac)) {
                        BNX2FC_HBA_DBG(lport, "fpma mismatch\n");
-                        put_cpu();
                        kfree_skb(skb);
                        return;
                }
@@ -552,7 +545,6 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
        if (fh->fh_r_ctl == FC_RCTL_DD_SOL_DATA &&
            fh->fh_type == FC_TYPE_FCP) {
                /* Drop FCP data. We dont this in L2 path */
-                put_cpu();
                kfree_skb(skb);
                return;
        }
@@ -562,7 +554,6 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
                case ELS_LOGO:
                        if (ntoh24(fh->fh_s_id) == FC_FID_FLOGI) {
                                /* drop non-FIP LOGO */
-                                put_cpu();
                                kfree_skb(skb);
                                return;
                        }
@@ -572,22 +563,23 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
        if (fh->fh_r_ctl == FC_RCTL_BA_ABTS) {
                /* Drop incoming ABTS */
-                put_cpu();
                kfree_skb(skb);
                return;
        }
+        stats = per_cpu_ptr(lport->stats, smp_processor_id());
+        stats->RxFrames++;
+        stats->RxWords += fr_len / FCOE_WORD_TO_BYTE;
        if (le32_to_cpu(fr_crc(fp)) !=
                        ~crc32(~0, skb->data, fr_len)) {
                if (stats->InvalidCRCCount < 5)
                        printk(KERN_WARNING PFX "dropping frame with "
                               "CRC error\n");
                stats->InvalidCRCCount++;
-                put_cpu();
                kfree_skb(skb);
                return;
        }
-        put_cpu();
        fc_exch_recv(lport, fp);
 }
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 32a5e0a2a669..7bc47fc7c686 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -282,6 +282,8 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                                       arr_sz, GFP_KERNEL);
        if (!cmgr->free_list_lock) {
                printk(KERN_ERR PFX "failed to alloc free_list_lock\n");
+                kfree(cmgr->free_list);
+                cmgr->free_list = NULL;
                goto mem_err;
        }
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 2ebfb2bb0f42..7b23f21f22f1 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue)
        if (crq->valid & 0x80) {
                if (++queue->cur == queue->size)
                        queue->cur = 0;
+                /* Ensure the read of the valid bit occurs before reading any
+                 * other bits of the CRQ entry
+                 */
+                rmb();
        } else
                crq = NULL;
        spin_unlock_irqrestore(&queue->lock, flags);
@@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata,
 {
        struct vio_dev *vdev = to_vio_dev(hostdata->dev);
+        /*
+         * Ensure the command buffer is flushed to memory before handing it
+         * over to the VIOS to prevent it from fetching any stale data.
+         */
+        mb();
        return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2);
 }
@@ -797,7 +807,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code)
                                       evt->hostdata->dev);
                        if (evt->cmnd_done)
                                evt->cmnd_done(evt->cmnd);
-                } else if (evt->done)
+                } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT &&
+                           evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
                        evt->done(evt);
                free_event_struct(&evt->hostdata->pool, evt);
                spin_lock_irqsave(hostdata->host->host_lock, flags);
diff --git a/drivers/scsi/mvsas/mv_94xx.c b/drivers/scsi/mvsas/mv_94xx.c
index 1e4479f3331a..9270d15ff1a4 100644
--- a/drivers/scsi/mvsas/mv_94xx.c
+++ b/drivers/scsi/mvsas/mv_94xx.c
@@ -564,7 +564,7 @@ static void mvs_94xx_interrupt_enable(struct mvs_info *mvi)
        u32 tmp;
        tmp = mr32(MVS_GBL_CTL);
-        tmp |= (IRQ_SAS_A | IRQ_SAS_B);
+        tmp |= (MVS_IRQ_SAS_A | MVS_IRQ_SAS_B);
        mw32(MVS_GBL_INT_STAT, tmp);
        writel(tmp, regs + 0x0C);
        writel(tmp, regs + 0x10);
@@ -580,7 +580,7 @@ static void mvs_94xx_interrupt_disable(struct mvs_info *mvi)
        tmp = mr32(MVS_GBL_CTL);
-        tmp &= ~(IRQ_SAS_A | IRQ_SAS_B);
+        tmp &= ~(MVS_IRQ_SAS_A | MVS_IRQ_SAS_B);
        mw32(MVS_GBL_INT_STAT, tmp);
        writel(tmp, regs + 0x0C);
        writel(tmp, regs + 0x10);
@@ -596,7 +596,7 @@ static u32 mvs_94xx_isr_status(struct mvs_info *mvi, int irq)
        if (!(mvi->flags & MVF_FLAG_SOC)) {
                stat = mr32(MVS_GBL_INT_STAT);
-                if (!(stat & (IRQ_SAS_A | IRQ_SAS_B)))
+                if (!(stat & (MVS_IRQ_SAS_A | MVS_IRQ_SAS_B)))
                        return 0;
        }
        return stat;
@@ -606,8 +606,8 @@ static irqreturn_t mvs_94xx_isr(struct mvs_info *mvi, int irq, u32 stat)
 {
        void __iomem *regs = mvi->regs;
-        if (((stat & IRQ_SAS_A) && mvi->id == 0) ||
+        if (((stat & MVS_IRQ_SAS_A) && mvi->id == 0) ||
-                        ((stat & IRQ_SAS_B) && mvi->id == 1)) {
+                        ((stat & MVS_IRQ_SAS_B) && mvi->id == 1)) {
                mw32_f(MVS_INT_STAT, CINT_DONE);
                spin_lock(&mvi->lock);
diff --git a/drivers/scsi/mvsas/mv_94xx.h b/drivers/scsi/mvsas/mv_94xx.h
index 487aa6f97412..14e197497b46 100644
--- a/drivers/scsi/mvsas/mv_94xx.h
+++ b/drivers/scsi/mvsas/mv_94xx.h
@@ -150,35 +150,35 @@ enum chip_register_bits {
 enum pci_interrupt_cause {
        /*  MAIN_IRQ_CAUSE (R10200) Bits*/
-        IRQ_COM_IN_I2O_IOP0            = (1 << 0),
+        MVS_IRQ_COM_IN_I2O_IOP0        = (1 << 0),
-        IRQ_COM_IN_I2O_IOP1            = (1 << 1),
+        MVS_IRQ_COM_IN_I2O_IOP1        = (1 << 1),
-        IRQ_COM_IN_I2O_IOP2            = (1 << 2),
+        MVS_IRQ_COM_IN_I2O_IOP2        = (1 << 2),
-        IRQ_COM_IN_I2O_IOP3            = (1 << 3),
+        MVS_IRQ_COM_IN_I2O_IOP3        = (1 << 3),
-        IRQ_COM_OUT_I2O_HOS0           = (1 << 4),
+        MVS_IRQ_COM_OUT_I2O_HOS0       = (1 << 4),
-        IRQ_COM_OUT_I2O_HOS1           = (1 << 5),
+        MVS_IRQ_COM_OUT_I2O_HOS1       = (1 << 5),
-        IRQ_COM_OUT_I2O_HOS2           = (1 << 6),
+        MVS_IRQ_COM_OUT_I2O_HOS2       = (1 << 6),
-        IRQ_COM_OUT_I2O_HOS3           = (1 << 7),
+        MVS_IRQ_COM_OUT_I2O_HOS3       = (1 << 7),
-        IRQ_PCIF_TO_CPU_DRBL0          = (1 << 8),
+        MVS_IRQ_PCIF_TO_CPU_DRBL0      = (1 << 8),
-        IRQ_PCIF_TO_CPU_DRBL1          = (1 << 9),
+        MVS_IRQ_PCIF_TO_CPU_DRBL1      = (1 << 9),
-        IRQ_PCIF_TO_CPU_DRBL2          = (1 << 10),
+        MVS_IRQ_PCIF_TO_CPU_DRBL2      = (1 << 10),
-        IRQ_PCIF_TO_CPU_DRBL3          = (1 << 11),
+        MVS_IRQ_PCIF_TO_CPU_DRBL3      = (1 << 11),
-        IRQ_PCIF_DRBL0                 = (1 << 12),
+        MVS_IRQ_PCIF_DRBL0             = (1 << 12),
-        IRQ_PCIF_DRBL1                 = (1 << 13),
+        MVS_IRQ_PCIF_DRBL1             = (1 << 13),
-        IRQ_PCIF_DRBL2                 = (1 << 14),
+        MVS_IRQ_PCIF_DRBL2             = (1 << 14),
-        IRQ_PCIF_DRBL3                 = (1 << 15),
+        MVS_IRQ_PCIF_DRBL3             = (1 << 15),
-        IRQ_XOR_A                      = (1 << 16),
+        MVS_IRQ_XOR_A                  = (1 << 16),
-        IRQ_XOR_B                      = (1 << 17),
+        MVS_IRQ_XOR_B                  = (1 << 17),
-        IRQ_SAS_A                      = (1 << 18),
+        MVS_IRQ_SAS_A                  = (1 << 18),
-        IRQ_SAS_B                      = (1 << 19),
+        MVS_IRQ_SAS_B                  = (1 << 19),
-        IRQ_CPU_CNTRL                  = (1 << 20),
+        MVS_IRQ_CPU_CNTRL              = (1 << 20),
-        IRQ_GPIO                       = (1 << 21),
+        MVS_IRQ_GPIO                   = (1 << 21),
-        IRQ_UART                       = (1 << 22),
+        MVS_IRQ_UART                   = (1 << 22),
-        IRQ_SPI                        = (1 << 23),
+        MVS_IRQ_SPI                    = (1 << 23),
-        IRQ_I2C                        = (1 << 24),
+        MVS_IRQ_I2C                    = (1 << 24),
-        IRQ_SGPIO                      = (1 << 25),
+        MVS_IRQ_SGPIO                  = (1 << 25),
-        IRQ_COM_ERR                    = (1 << 29),
+        MVS_IRQ_COM_ERR                = (1 << 29),
-        IRQ_I2O_ERR                    = (1 << 30),
+        MVS_IRQ_I2O_ERR                = (1 << 30),
-        IRQ_PCIE_ERR                   = (1 << 31),
+        MVS_IRQ_PCIE_ERR               = (1 << 31),
 };
 union reg_phy_cfg {
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index c4f31b21feb8..e90c89f1d480 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -677,7 +677,7 @@ static void pm8001_init_sas_add(struct pm8001_hba_info *pm8001_ha)
 * pm8001_get_phy_settings_info : Read phy setting values.
 * @pm8001_ha : our hba.
 */
-void pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha)
+static int pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha)
 {
 #ifdef PM8001_READ_VPD
@@ -691,11 +691,15 @@ void pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha)
        payload.offset = 0;
        payload.length = 4096;
        payload.func_specific = kzalloc(4096, GFP_KERNEL);
+        if (!payload.func_specific)
+                return -ENOMEM;
        /* Read phy setting values from flash */
        PM8001_CHIP_DISP->get_nvmd_req(pm8001_ha, &payload);
        wait_for_completion(&completion);
        pm8001_set_phy_profile(pm8001_ha, sizeof(u8), payload.func_specific);
+        kfree(payload.func_specific);
 #endif
+        return 0;
 }
 #ifdef PM8001_USE_MSIX
@@ -879,8 +883,11 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
        pm8001_init_sas_add(pm8001_ha);
        /* phy setting support for motherboard controller */
        if (pdev->subsystem_vendor != PCI_VENDOR_ID_ADAPTEC2 &&
-                pdev->subsystem_vendor != 0)
+                pdev->subsystem_vendor != 0) {
-                pm8001_get_phy_settings_info(pm8001_ha);
+                rc = pm8001_get_phy_settings_info(pm8001_ha);
+                if (rc)
+                        goto err_out_shost;
+        }
        pm8001_post_sas_ha_init(shost, chip);
        rc = sas_register_ha(SHOST_TO_SAS_HA(shost));
        if (rc)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 4b188b0164e9..e632e14180cf 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1128,7 +1128,7 @@ static void qlt_24xx_retry_term_exchange(struct scsi_qla_host *vha,
        ctio->u.status1.flags =
            __constant_cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_1 |
                CTIO7_FLAGS_TERMINATE);
-        ctio->u.status1.ox_id = entry->fcp_hdr_le.ox_id;
+        ctio->u.status1.ox_id = cpu_to_le16(entry->fcp_hdr_le.ox_id);
        qla2x00_start_iocbs(vha, vha->req);
@@ -1262,6 +1262,7 @@ static void qlt_24xx_send_task_mgmt_ctio(struct scsi_qla_host *ha,
 {
        struct atio_from_isp *atio = &mcmd->orig_iocb.atio;
        struct ctio7_to_24xx *ctio;
+        uint16_t temp;
        ql_dbg(ql_dbg_tgt, ha, 0xe008,
            "Sending task mgmt CTIO7 (ha=%p, atio=%p, resp_code=%x\n",
@@ -1292,7 +1293,8 @@ static void qlt_24xx_send_task_mgmt_ctio(struct scsi_qla_host *ha,
        ctio->u.status1.flags = (atio->u.isp24.attr << 9) |
            __constant_cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_1 |
                CTIO7_FLAGS_SEND_STATUS);
-        ctio->u.status1.ox_id = swab16(atio->u.isp24.fcp_hdr.ox_id);
+        temp = be16_to_cpu(atio->u.isp24.fcp_hdr.ox_id);
+        ctio->u.status1.ox_id = cpu_to_le16(temp);
        ctio->u.status1.scsi_status =
            __constant_cpu_to_le16(SS_RESPONSE_INFO_LEN_VALID);
        ctio->u.status1.response_len = __constant_cpu_to_le16(8);
@@ -1513,6 +1515,7 @@ static int qlt_24xx_build_ctio_pkt(struct qla_tgt_prm *prm,
        struct ctio7_to_24xx *pkt;
        struct qla_hw_data *ha = vha->hw;
        struct atio_from_isp *atio = &prm->cmd->atio;
+        uint16_t temp;
        pkt = (struct ctio7_to_24xx *)vha->req->ring_ptr;
        prm->pkt = pkt;
@@ -1541,13 +1544,13 @@ static int qlt_24xx_build_ctio_pkt(struct qla_tgt_prm *prm,
        pkt->initiator_id[2] = atio->u.isp24.fcp_hdr.s_id[0];
        pkt->exchange_addr = atio->u.isp24.exchange_addr;
        pkt->u.status0.flags |= (atio->u.isp24.attr << 9);
-        pkt->u.status0.ox_id = swab16(atio->u.isp24.fcp_hdr.ox_id);
+        temp = be16_to_cpu(atio->u.isp24.fcp_hdr.ox_id);
+        pkt->u.status0.ox_id = cpu_to_le16(temp);
        pkt->u.status0.relative_offset = cpu_to_le32(prm->cmd->offset);
        ql_dbg(ql_dbg_tgt, vha, 0xe00c,
            "qla_target(%d): handle(cmd) -> %08x, timeout %d, ox_id %#x\n",
-            vha->vp_idx, pkt->handle, QLA_TGT_TIMEOUT,
+            vha->vp_idx, pkt->handle, QLA_TGT_TIMEOUT, temp);
-            le16_to_cpu(pkt->u.status0.ox_id));
        return 0;
 }
@@ -2619,6 +2622,7 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
        struct qla_hw_data *ha = vha->hw;
        request_t *pkt;
        int ret = 0;
+        uint16_t temp;
        ql_dbg(ql_dbg_tgt, vha, 0xe01c, "Sending TERM EXCH CTIO (ha=%p)\n", ha);
@@ -2655,7 +2659,8 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
        ctio24->u.status1.flags = (atio->u.isp24.attr << 9) |
            __constant_cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_1 |
                CTIO7_FLAGS_TERMINATE);
-        ctio24->u.status1.ox_id = swab16(atio->u.isp24.fcp_hdr.ox_id);
+        temp = be16_to_cpu(atio->u.isp24.fcp_hdr.ox_id);
+        ctio24->u.status1.ox_id = cpu_to_le16(temp);
        /* Most likely, it isn't needed */
        ctio24->u.status1.residual = get_unaligned((uint32_t *)
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index e0a58fd13f66..d1d24fb0160a 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -443,7 +443,7 @@ struct ctio7_to_24xx {
                        uint16_t reserved1;
                        __le16 flags;
                        uint32_t residual;
-                        uint16_t ox_id;
+                        __le16 ox_id;
                        uint16_t scsi_status;
                        uint32_t relative_offset;
                        uint32_t reserved2;
@@ -458,7 +458,7 @@ struct ctio7_to_24xx {
                        uint16_t sense_length;
                        uint16_t flags;
                        uint32_t residual;
-                        uint16_t ox_id;
+                        __le16 ox_id;
                        uint16_t scsi_status;
                        uint16_t response_len;
                        uint16_t reserved;
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index cbe38e5e7955..7e957918f33f 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -131,7 +131,7 @@ scmd_eh_abort_handler(struct work_struct *work)
                                    "aborting command %p\n", scmd));
                rtn = scsi_try_to_abort_cmd(sdev->host->hostt, scmd);
                if (rtn == SUCCESS) {
-                        scmd->result |= DID_TIME_OUT << 16;
+                        set_host_byte(scmd, DID_TIME_OUT);
                        if (scsi_host_eh_past_deadline(sdev->host)) {
                                SCSI_LOG_ERROR_RECOVERY(3,
                                        scmd_printk(KERN_INFO, scmd,
@@ -167,7 +167,7 @@ scmd_eh_abort_handler(struct work_struct *work)
                        scmd_printk(KERN_WARNING, scmd,
                                    "scmd %p terminate "
                                    "aborted command\n", scmd));
-                scmd->result |= DID_TIME_OUT << 16;
+                set_host_byte(scmd, DID_TIME_OUT);
                scsi_finish_command(scmd);
        }
 }
@@ -287,15 +287,15 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
        else if (host->hostt->eh_timed_out)
                rtn = host->hostt->eh_timed_out(scmd);
-        if (rtn == BLK_EH_NOT_HANDLED && !host->hostt->no_async_abort)
+        if (rtn == BLK_EH_NOT_HANDLED) {
-                if (scsi_abort_command(scmd) == SUCCESS)
+                if (!host->hostt->no_async_abort &&
+                    scsi_abort_command(scmd) == SUCCESS)
                        return BLK_EH_NOT_HANDLED;
-        scmd->result |= DID_TIME_OUT << 16;
+                set_host_byte(scmd, DID_TIME_OUT);
+                if (!scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD))
-        if (unlikely(rtn == BLK_EH_NOT_HANDLED &&
+                        rtn = BLK_EH_HANDLED;
-                     !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD)))
+        }
-                rtn = BLK_EH_HANDLED;
        return rtn;
 }
@@ -1777,7 +1777,7 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
                break;
        case DID_ABORT:
                if (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) {
-                        scmd->result |= DID_TIME_OUT << 16;
+                        set_host_byte(scmd, DID_TIME_OUT);
                        return SUCCESS;
                }
        case DID_NO_CONNECT:
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index f7e316368c99..3f50dfcb3227 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -733,6 +733,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                        scsi_next_command(cmd);
                        return;
                }
+        } else if (blk_rq_bytes(req) == 0 && result && !sense_deferred) {
+                /*
+                 * Certain non BLOCK_PC requests are commands that don't
+                 * actually transfer anything (FLUSH), so cannot use
+                 * good_bytes != blk_rq_bytes(req) as the signal for an error.
+                 * This sets the error explicitly for the problem case.
+                 */
+                error = __scsi_error_from_host_byte(cmd, result);
        }
        /* no bidi support for !REQ_TYPE_BLOCK_PC yet */
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index f80908f74ca9..521f5838594b 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -2549,6 +2549,7 @@ fc_rport_final_delete(struct work_struct *work)
                        fc_flush_devloss(shost);
                if (!cancel_delayed_work(&rport->dev_loss_work))
                        fc_flush_devloss(shost);
+                cancel_work_sync(&rport->scan_work);
                spin_lock_irqsave(shost->host_lock, flags);
                rport->flags &= ~FC_RPORT_DEVLOSS_PENDING;
        }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e9689d57ccb6..6825eda1114a 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2441,7 +2441,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
                }
                sdkp->DPOFUA = (data.device_specific & 0x10) != 0;
-                if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
+                if (sdp->broken_fua) {
+                        sd_first_printk(KERN_NOTICE, sdkp, "Disabling FUA\n");
+                        sdkp->DPOFUA = 0;
+                } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
                        sd_first_printk(KERN_NOTICE, sdkp,
                                  "Uses READ/WRITE(6), disabling FUA\n");
                        sdkp->DPOFUA = 0;
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 89ee5929eb6d..308256b5e4cb 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -237,6 +237,16 @@ static void virtscsi_req_done(struct virtqueue *vq)
        virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd);
 };
+static void virtscsi_poll_requests(struct virtio_scsi *vscsi)
+{
+        int i, num_vqs;
+        num_vqs = vscsi->num_queues;
+        for (i = 0; i < num_vqs; i++)
+                virtscsi_vq_done(vscsi, &vscsi->req_vqs[i],
+                                 virtscsi_complete_cmd);
+}
 static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf)
 {
        struct virtio_scsi_cmd *cmd = buf;
@@ -253,6 +263,8 @@ static void virtscsi_ctrl_done(struct virtqueue *vq)
        virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free);
 };
+static void virtscsi_handle_event(struct work_struct *work);
 static int virtscsi_kick_event(struct virtio_scsi *vscsi,
                               struct virtio_scsi_event_node *event_node)
 {
@@ -260,6 +272,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi,
        struct scatterlist sg;
        unsigned long flags;
+        INIT_WORK(&event_node->work, virtscsi_handle_event);
        sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event));
        spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags);
@@ -377,7 +390,6 @@ static void virtscsi_complete_event(struct virtio_scsi *vscsi, void *buf)
 {
        struct virtio_scsi_event_node *event_node = buf;
-        INIT_WORK(&event_node->work, virtscsi_handle_event);
        schedule_work(&event_node->work);
 }
@@ -589,6 +601,18 @@ static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd)
            cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED)
                ret = SUCCESS;
+        /*
+         * The spec guarantees that all requests related to the TMF have
+         * been completed, but the callback might not have run yet if
+         * we're using independent interrupts (e.g. MSI).  Poll the
+         * virtqueues once.
+         *
+         * In the abort case, sc->scsi_done will do nothing, because
+         * the block layer must have detected a timeout and as a result
+         * REQ_ATOM_COMPLETE has been set.
+         */
+        virtscsi_poll_requests(vscsi);
 out:
        mempool_free(cmd, virtscsi_cmd_pool);
        return ret;
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 79ace88030c4..20bd055ea2d1 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -396,7 +396,7 @@ config SPI_ROCKCHIP
 config SPI_RSPI
        tristate "Renesas RSPI/QSPI controller"
-        depends on (SUPERH && SH_DMAE_BASE) || ARCH_SHMOBILE
+        depends on SUPERH || ARCH_SHMOBILE || COMPILE_TEST
        help
          SPI driver for Renesas RSPI and QSPI blocks.
diff --git a/drivers/spi/spi-adi-v3.c b/drivers/spi/spi-adi-v3.c
index dcb2287c7f8a..19ea8fb78cc7 100644
--- a/drivers/spi/spi-adi-v3.c
+++ b/drivers/spi/spi-adi-v3.c
@@ -660,10 +660,9 @@ static int adi_spi_setup(struct spi_device *spi)
                struct adi_spi3_chip *chip_info = spi->controller_data;
                chip = kzalloc(sizeof(*chip), GFP_KERNEL);
-                if (!chip) {
+                if (!chip)
-                        dev_err(&spi->dev, "can not allocate chip data\n");
                        return -ENOMEM;
-                }
                if (chip_info) {
                        if (chip_info->control & ~ctl_reg) {
                                dev_err(&spi->dev,
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 92a6f0d93233..113c83f44b5c 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -597,21 +597,15 @@ static int atmel_spi_next_xfer_dma_submit(struct spi_master *master,
                goto err_exit;
        /* Send both scatterlists */
-        rxdesc = rxchan->device->device_prep_slave_sg(rxchan,
+        rxdesc = dmaengine_prep_slave_sg(rxchan, &as->dma.sgrx, 1,
-                                        &as->dma.sgrx,
+                                         DMA_FROM_DEVICE,
-                                        1,
+                                         DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                                        DMA_FROM_DEVICE,
-                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK,
-                                        NULL);
        if (!rxdesc)
                goto err_dma;
-        txdesc = txchan->device->device_prep_slave_sg(txchan,
+        txdesc = dmaengine_prep_slave_sg(txchan, &as->dma.sgtx, 1,
-                                        &as->dma.sgtx,
+                                         DMA_TO_DEVICE,
-                                        1,
+                                         DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                                        DMA_TO_DEVICE,
-                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK,
-                                        NULL);
        if (!txdesc)
                goto err_dma;
@@ -1018,7 +1012,7 @@ static int atmel_spi_setup(struct spi_device *spi)
        csr |= SPI_BF(DLYBCT, 0);
        /* chipselect must have been muxed as GPIO (e.g. in board setup) */
-        npcs_pin = (unsigned int)spi->controller_data;
+        npcs_pin = (unsigned long)spi->controller_data;
        if (gpio_is_valid(spi->cs_gpio))
                npcs_pin = spi->cs_gpio;
@@ -1253,7 +1247,7 @@ msg_done:
 static void atmel_spi_cleanup(struct spi_device *spi)
 {
        struct atmel_spi_device *asd = spi->controller_state;
-        unsigned                gpio = (unsigned) spi->controller_data;
+        unsigned                gpio = (unsigned long) spi->controller_data;
        if (!asd)
                return;
diff --git a/drivers/spi/spi-au1550.c b/drivers/spi/spi-au1550.c
index 67375a11d4bd..fb61464348a1 100644
--- a/drivers/spi/spi-au1550.c
+++ b/drivers/spi/spi-au1550.c
@@ -925,8 +925,7 @@ err_no_txdma:
        iounmap((void __iomem *)hw->regs);
 err_ioremap:
-        release_resource(hw->ioarea);
+        release_mem_region(r->start, sizeof(psc_spi_t));
-        kfree(hw->ioarea);
 err_no_iores:
 err_no_pdata:
@@ -946,8 +945,7 @@ static int au1550_spi_remove(struct platform_device *pdev)
        spi_bitbang_stop(&hw->bitbang);
        free_irq(hw->irq, hw);
        iounmap((void __iomem *)hw->regs);
-        release_resource(hw->ioarea);
+        release_mem_region(r->start, sizeof(psc_spi_t));
-        kfree(hw->ioarea);
        if (hw->usedma) {
                au1550_spi_dma_rxtmp_free(hw);
diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
index bb758978465d..562ff83debd9 100644
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -205,18 +205,30 @@ static void cdns_spi_chipselect(struct spi_device *spi, bool is_high)
 static void cdns_spi_config_clock_mode(struct spi_device *spi)
 {
        struct cdns_spi *xspi = spi_master_get_devdata(spi->master);
-        u32 ctrl_reg;
+        u32 ctrl_reg, new_ctrl_reg;
-        ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR_OFFSET);
+        new_ctrl_reg = ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR_OFFSET);
        /* Set the SPI clock phase and clock polarity */
-        ctrl_reg &= ~(CDNS_SPI_CR_CPHA_MASK | CDNS_SPI_CR_CPOL_MASK);
+        new_ctrl_reg &= ~(CDNS_SPI_CR_CPHA_MASK | CDNS_SPI_CR_CPOL_MASK);
        if (spi->mode & SPI_CPHA)
-                ctrl_reg |= CDNS_SPI_CR_CPHA_MASK;
+                new_ctrl_reg |= CDNS_SPI_CR_CPHA_MASK;
        if (spi->mode & SPI_CPOL)
-                ctrl_reg |= CDNS_SPI_CR_CPOL_MASK;
+                new_ctrl_reg |= CDNS_SPI_CR_CPOL_MASK;
-        cdns_spi_write(xspi, CDNS_SPI_CR_OFFSET, ctrl_reg);
+        if (new_ctrl_reg != ctrl_reg) {
+                /*
+                 * Just writing the CR register does not seem to apply the clock
+                 * setting changes. This is problematic when changing the clock
+                 * polarity as it will cause the SPI slave to see spurious clock
+                 * transitions. To workaround the issue toggle the ER register.
+                 */
+                cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
+                                   CDNS_SPI_ER_DISABLE_MASK);
+                cdns_spi_write(xspi, CDNS_SPI_CR_OFFSET, new_ctrl_reg);
+                cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
+                                   CDNS_SPI_ER_ENABLE_MASK);
+        }
 }
 /**
@@ -370,6 +382,12 @@ static irqreturn_t cdns_spi_irq(int irq, void *dev_id)
        return status;
 }
+static int cdns_prepare_message(struct spi_master *master,
+                                struct spi_message *msg)
+{
+        cdns_spi_config_clock_mode(msg->spi);
+        return 0;
+}
 /**
 * cdns_transfer_one - Initiates the SPI transfer
@@ -416,8 +434,6 @@ static int cdns_prepare_transfer_hardware(struct spi_master *master)
 {
        struct cdns_spi *xspi = spi_master_get_devdata(master);
-        cdns_spi_config_clock_mode(master->cur_msg->spi);
        cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
                       CDNS_SPI_ER_ENABLE_MASK);
@@ -532,6 +548,7 @@ static int cdns_spi_probe(struct platform_device *pdev)
                xspi->is_decoded_cs = 0;
        master->prepare_transfer_hardware = cdns_prepare_transfer_hardware;
+        master->prepare_message = cdns_prepare_message;
        master->transfer_one = cdns_transfer_one;
        master->unprepare_transfer_hardware = cdns_unprepare_transfer_hardware;
        master->set_cs = cdns_spi_chipselect;
@@ -647,7 +664,7 @@ static int __maybe_unused cdns_spi_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(cdns_spi_dev_pm_ops, cdns_spi_suspend,
                         cdns_spi_resume);
-static struct of_device_id cdns_spi_of_match[] = {
+static const struct of_device_id cdns_spi_of_match[] = {
        { .compatible = "xlnx,zynq-spi-r1p6" },
        { .compatible = "cdns,spi-r1p6" },
        { /* end of table */ }
diff --git a/drivers/spi/spi-clps711x.c b/drivers/spi/spi-clps711x.c
index 4cd62f636547..ce538dad526b 100644
--- a/drivers/spi/spi-clps711x.c
+++ b/drivers/spi/spi-clps711x.c
@@ -184,8 +184,6 @@ static int spi_clps711x_probe(struct platform_device *pdev)
        }
        master->max_speed_hz = clk_get_rate(hw->spi_clk);
-        platform_set_drvdata(pdev, master);
        hw->syscon = syscon_regmap_lookup_by_pdevname("syscon.3");
        if (IS_ERR(hw->syscon)) {
                ret = PTR_ERR(hw->syscon);
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 50f750989258..276a3884fb3c 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -30,6 +30,7 @@
 #include <linux/edma.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/of_gpio.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/spi_bitbang.h>
 #include <linux/slab.h>
@@ -38,8 +39,6 @@
 #define SPI_NO_RESOURCE         ((resource_size_t)-1)
-#define SPI_MAX_CHIPSELECT      2
 #define CS_DEFAULT      0xFF
 #define SPIFMT_PHASE_MASK       BIT(16)
@@ -142,7 +141,7 @@ struct davinci_spi {
        void                    (*get_rx)(u32 rx_data, struct davinci_spi *);
        u32                     (*get_tx)(struct davinci_spi *);
-        u8                      bytes_per_word[SPI_MAX_CHIPSELECT];
+        u8                      *bytes_per_word;
 };
 static struct davinci_spi_config davinci_spi_default_cfg;
@@ -213,13 +212,16 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)
        u8 chip_sel = spi->chip_select;
        u16 spidat1 = CS_DEFAULT;
        bool gpio_chipsel = false;
+        int gpio;
        dspi = spi_master_get_devdata(spi->master);
        pdata = &dspi->pdata;
-        if (pdata->chip_sel && chip_sel < pdata->num_chipselect &&
+        if (spi->cs_gpio >= 0) {
-                                pdata->chip_sel[chip_sel] != SPI_INTERN_CS)
+                /* SPI core parse and update master->cs_gpio */
                gpio_chipsel = true;
+                gpio = spi->cs_gpio;
+        }
        /*
         * Board specific chip select logic decides the polarity and cs
@@ -227,9 +229,9 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)
         */
        if (gpio_chipsel) {
                if (value == BITBANG_CS_ACTIVE)
-                        gpio_set_value(pdata->chip_sel[chip_sel], 0);
+                        gpio_set_value(gpio, spi->mode & SPI_CS_HIGH);
                else
-                        gpio_set_value(pdata->chip_sel[chip_sel], 1);
+                        gpio_set_value(gpio, !(spi->mode & SPI_CS_HIGH));
        } else {
                if (value == BITBANG_CS_ACTIVE) {
                        spidat1 |= SPIDAT1_CSHOLD_MASK;
@@ -392,17 +394,40 @@ static int davinci_spi_setup(struct spi_device *spi)
        int retval = 0;
        struct davinci_spi *dspi;
        struct davinci_spi_platform_data *pdata;
+        struct spi_master *master = spi->master;
+        struct device_node *np = spi->dev.of_node;
+        bool internal_cs = true;
+        unsigned long flags = GPIOF_DIR_OUT;
        dspi = spi_master_get_devdata(spi->master);
        pdata = &dspi->pdata;
+        flags |= (spi->mode & SPI_CS_HIGH) ? GPIOF_INIT_LOW : GPIOF_INIT_HIGH;
        if (!(spi->mode & SPI_NO_CS)) {
-                if ((pdata->chip_sel == NULL) ||
+                if (np && (master->cs_gpios != NULL) && (spi->cs_gpio >= 0)) {
-                    (pdata->chip_sel[spi->chip_select] == SPI_INTERN_CS))
+                        retval = gpio_request_one(spi->cs_gpio,
-                        set_io_bits(dspi->base + SPIPC0, 1 << spi->chip_select);
+                                                  flags, dev_name(&spi->dev));
+                        internal_cs = false;
+                } else if (pdata->chip_sel &&
+                           spi->chip_select < pdata->num_chipselect &&
+                           pdata->chip_sel[spi->chip_select] != SPI_INTERN_CS) {
+                        spi->cs_gpio = pdata->chip_sel[spi->chip_select];
+                        retval = gpio_request_one(spi->cs_gpio,
+                                                  flags, dev_name(&spi->dev));
+                        internal_cs = false;
+                }
+        }
+        if (retval) {
+                dev_err(&spi->dev, "GPIO %d setup failed (%d)\n",
+                        spi->cs_gpio, retval);
+                return retval;
        }
+        if (internal_cs)
+                set_io_bits(dspi->base + SPIPC0, 1 << spi->chip_select);
        if (spi->mode & SPI_READY)
                set_io_bits(dspi->base + SPIPC0, SPIPC0_SPIENA_MASK);
@@ -414,6 +439,12 @@ static int davinci_spi_setup(struct spi_device *spi)
        return retval;
 }
+static void davinci_spi_cleanup(struct spi_device *spi)
+{
+        if (spi->cs_gpio >= 0)
+                gpio_free(spi->cs_gpio);
+}
 static int davinci_spi_check_error(struct davinci_spi *dspi, int int_status)
 {
        struct device *sdev = dspi->bitbang.master->dev.parent;
@@ -812,6 +843,8 @@ static int spi_davinci_get_pdata(struct platform_device *pdev,
        /*
         * default num_cs is 1 and all chipsel are internal to the chip
+         * indicated by chip_sel being NULL or cs_gpios being NULL or
+         * set to -ENOENT. num-cs includes internal as well as gpios.
         * indicated by chip_sel being NULL. GPIO based CS is not
         * supported yet in DT bindings.
         */
@@ -850,7 +883,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
        struct resource *r;
        resource_size_t dma_rx_chan = SPI_NO_RESOURCE;
        resource_size_t dma_tx_chan = SPI_NO_RESOURCE;
-        int i = 0, ret = 0;
+        int ret = 0;
        u32 spipc0;
        master = spi_alloc_master(&pdev->dev, sizeof(struct davinci_spi));
@@ -876,6 +909,14 @@ static int davinci_spi_probe(struct platform_device *pdev)
        /* pdata in dspi is now updated and point pdata to that */
        pdata = &dspi->pdata;
+        dspi->bytes_per_word = devm_kzalloc(&pdev->dev,
+                                            sizeof(*dspi->bytes_per_word) *
+                                            pdata->num_chipselect, GFP_KERNEL);
+        if (dspi->bytes_per_word == NULL) {
+                ret = -ENOMEM;
+                goto free_master;
+        }
        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (r == NULL) {
                ret = -ENOENT;
@@ -915,6 +956,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
        master->num_chipselect = pdata->num_chipselect;
        master->bits_per_word_mask = SPI_BPW_RANGE_MASK(2, 16);
        master->setup = davinci_spi_setup;
+        master->cleanup = davinci_spi_cleanup;
        dspi->bitbang.chipselect = davinci_spi_chipselect;
        dspi->bitbang.setup_transfer = davinci_spi_setup_transfer;
@@ -962,14 +1004,6 @@ static int davinci_spi_probe(struct platform_device *pdev)
        spipc0 = SPIPC0_DIFUN_MASK | SPIPC0_DOFUN_MASK | SPIPC0_CLKFUN_MASK;
        iowrite32(spipc0, dspi->base + SPIPC0);
-        /* initialize chip selects */
-        if (pdata->chip_sel) {
-                for (i = 0; i < pdata->num_chipselect; i++) {
-                        if (pdata->chip_sel[i] != SPI_INTERN_CS)
-                                gpio_direction_output(pdata->chip_sel[i], 1);
-                }
-        }
        if (pdata->intr_line)
                iowrite32(SPI_INTLVL_1, dspi->base + SPILVL);
        else
diff --git a/drivers/spi/spi-dw-mmio.c b/drivers/spi/spi-dw-mmio.c
index a5cba14ac3d2..21ce0e36fa00 100644
--- a/drivers/spi/spi-dw-mmio.c
+++ b/drivers/spi/spi-dw-mmio.c
@@ -16,7 +16,9 @@
 #include <linux/spi/spi.h>
 #include <linux/scatterlist.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/of_gpio.h>
+#include <linux/of_platform.h>
 #include "spi-dw.h"
@@ -33,6 +35,7 @@ static int dw_spi_mmio_probe(struct platform_device *pdev)
        struct dw_spi *dws;
        struct resource *mem;
        int ret;
+        int num_cs;
        dwsmmio = devm_kzalloc(&pdev->dev, sizeof(struct dw_spi_mmio),
                        GFP_KERNEL);
@@ -68,9 +71,16 @@ static int dw_spi_mmio_probe(struct platform_device *pdev)
                return ret;
        dws->bus_num = pdev->id;
-        dws->num_cs = 4;
        dws->max_freq = clk_get_rate(dwsmmio->clk);
+        num_cs = 4;
+        if (pdev->dev.of_node)
+                of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
+        dws->num_cs = num_cs;
        if (pdev->dev.of_node) {
                int i;
@@ -114,12 +124,19 @@ static int dw_spi_mmio_remove(struct platform_device *pdev)
        return 0;
 }
+static const struct of_device_id dw_spi_mmio_of_match[] = {
+        { .compatible = "snps,dw-apb-ssi", },
+        { /* end of table */}
+};
+MODULE_DEVICE_TABLE(of, dw_spi_mmio_of_match);
 static struct platform_driver dw_spi_mmio_driver = {
        .probe          = dw_spi_mmio_probe,
        .remove         = dw_spi_mmio_remove,
        .driver         = {
                .name   = DRIVER_NAME,
                .owner  = THIS_MODULE,
+                .of_match_table = dw_spi_mmio_of_match,
        },
 };
 module_platform_driver(dw_spi_mmio_driver);
diff --git a/drivers/spi/spi-efm32.c b/drivers/spi/spi-efm32.c
index be44a3eeb5e8..6caeb1cac0f3 100644
--- a/drivers/spi/spi-efm32.c
+++ b/drivers/spi/spi-efm32.c
@@ -294,10 +294,16 @@ static void efm32_spi_probe_dt(struct platform_device *pdev,
        u32 location;
        int ret;
-        ret = of_property_read_u32(np, "efm32,location", &location);
+        ret = of_property_read_u32(np, "energymicro,location", &location);
+        if (ret)
+                /* fall back to wrongly namespaced property */
+                ret = of_property_read_u32(np, "efm32,location", &location);
        if (ret)
                /* fall back to old and (wrongly) generic property "location" */
                ret = of_property_read_u32(np, "location", &location);
        if (!ret) {
                dev_dbg(&pdev->dev, "using location %u\n", location);
        } else {
diff --git a/drivers/spi/spi-falcon.c b/drivers/spi/spi-falcon.c
index ba441ad9a007..f73b3004d6d3 100644
--- a/drivers/spi/spi-falcon.c
+++ b/drivers/spi/spi-falcon.c
@@ -425,8 +425,6 @@ static int falcon_sflash_probe(struct platform_device *pdev)
        master->unprepare_transfer_hardware = falcon_sflash_unprepare_xfer;
        master->dev.of_node = pdev->dev.of_node;
-        platform_set_drvdata(pdev, priv);
        ret = devm_spi_register_master(&pdev->dev, master);
        if (ret)
                spi_master_put(master);
diff --git a/drivers/spi/spi-fsl-lib.c b/drivers/spi/spi-fsl-lib.c
index 95212ea96c8d..e0b773fc29cb 100644
--- a/drivers/spi/spi-fsl-lib.c
+++ b/drivers/spi/spi-fsl-lib.c
@@ -196,7 +196,7 @@ int of_mpc8xxx_spi_probe(struct platform_device *ofdev)
        pinfo = devm_kzalloc(&ofdev->dev, sizeof(*pinfo), GFP_KERNEL);
        if (!pinfo)
-                return -ENOMEM;
+                return ret;
        pdata = &pinfo->pdata;
        dev->platform_data = pdata;
diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index 98ccd231bf00..9452f6740997 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -58,7 +58,7 @@ static struct fsl_spi_match_data of_fsl_spi_grlib_config = {
        .type = TYPE_GRLIB,
 };
-static struct of_device_id of_fsl_spi_match[] = {
+static const struct of_device_id of_fsl_spi_match[] = {
        {
                .compatible = "fsl,spi",
                .data = &of_fsl_spi_fsl_config,
diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
index e7ffcded4e14..5e91858f6f01 100644
--- a/drivers/spi/spi-omap-100k.c
+++ b/drivers/spi/spi-omap-100k.c
@@ -420,8 +420,6 @@ static int omap1_spi100k_probe(struct platform_device *pdev)
        master->min_speed_hz = OMAP1_SPI100K_MAX_FREQ/(1<<16);
        master->max_speed_hz = OMAP1_SPI100K_MAX_FREQ;
-        platform_set_drvdata(pdev, master);
        spi100k = spi_master_get_devdata(master);
        /*
diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c
index 0f5a0aa3b871..8bca90a19dd1 100644
--- a/drivers/spi/spi-omap-uwire.c
+++ b/drivers/spi/spi-omap-uwire.c
@@ -41,14 +41,15 @@
 #include <linux/err.h>
 #include <linux/clk.h>
 #include <linux/slab.h>
+#include <linux/device.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/spi_bitbang.h>
 #include <linux/module.h>
+#include <linux/io.h>
 #include <asm/irq.h>
 #include <mach/hardware.h>
-#include <asm/io.h>
 #include <asm/mach-types.h>
 #include <mach/mux.h>
@@ -447,7 +448,6 @@ static void uwire_off(struct uwire_spi *uwire)
 {
        uwire_write_reg(UWIRE_SR3, 0);
        clk_disable(uwire->ck);
-        clk_put(uwire->ck);
        spi_master_put(uwire->bitbang.master);
 }
@@ -463,7 +463,7 @@ static int uwire_probe(struct platform_device *pdev)
        uwire = spi_master_get_devdata(master);
-        uwire_base = ioremap(UWIRE_BASE_PHYS, UWIRE_IO_SIZE);
+        uwire_base = devm_ioremap(&pdev->dev, UWIRE_BASE_PHYS, UWIRE_IO_SIZE);
        if (!uwire_base) {
                dev_dbg(&pdev->dev, "can't ioremap UWIRE\n");
                spi_master_put(master);
@@ -472,12 +472,11 @@ static int uwire_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, uwire);
-        uwire->ck = clk_get(&pdev->dev, "fck");
+        uwire->ck = devm_clk_get(&pdev->dev, "fck");
        if (IS_ERR(uwire->ck)) {
                status = PTR_ERR(uwire->ck);
                dev_dbg(&pdev->dev, "no functional clock?\n");
                spi_master_put(master);
-                iounmap(uwire_base);
                return status;
        }
        clk_enable(uwire->ck);
@@ -507,7 +506,6 @@ static int uwire_probe(struct platform_device *pdev)
        status = spi_bitbang_start(&uwire->bitbang);
        if (status < 0) {
                uwire_off(uwire);
-                iounmap(uwire_base);
        }
        return status;
 }
@@ -520,7 +518,6 @@ static int uwire_remove(struct platform_device *pdev)
        spi_bitbang_stop(&uwire->bitbang);
        uwire_off(uwire);
-        iounmap(uwire_base);
        return 0;
 }
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index 4dc77df38864..68441fa448de 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -149,6 +149,7 @@ struct omap2_mcspi_cs {
        void __iomem            *base;
        unsigned long           phys;
        int                     word_len;
+        u16                     mode;
        struct list_head        node;
        /* Context save and restore shadow register */
        u32                     chconf0, chctrl0;
@@ -926,6 +927,8 @@ static int omap2_mcspi_setup_transfer(struct spi_device *spi,
        mcspi_write_chconf0(spi, l);
+        cs->mode = spi->mode;
        dev_dbg(&spi->dev, "setup: speed %d, sample %s edge, clk %s\n",
                        speed_hz,
                        (spi->mode & SPI_CPHA) ? "trailing" : "leading",
@@ -998,6 +1001,7 @@ static int omap2_mcspi_setup(struct spi_device *spi)
                        return -ENOMEM;
                cs->base = mcspi->base + spi->chip_select * 0x14;
                cs->phys = mcspi->phys + spi->chip_select * 0x14;
+                cs->mode = 0;
                cs->chconf0 = 0;
                cs->chctrl0 = 0;
                spi->controller_state = cs;
@@ -1079,6 +1083,16 @@ static void omap2_mcspi_work(struct omap2_mcspi *mcspi, struct spi_message *m)
        cs = spi->controller_state;
        cd = spi->controller_data;
+        /*
+         * The slave driver could have changed spi->mode in which case
+         * it will be different from cs->mode (the current hardware setup).
+         * If so, set par_override (even though its not a parity issue) so
+         * omap2_mcspi_setup_transfer will be called to configure the hardware
+         * with the correct mode on the first iteration of the loop below.
+         */
+        if (spi->mode != cs->mode)
+                par_override = 1;
        omap2_mcspi_set_enable(spi, 0);
        list_for_each_entry(t, &m->transfers, transfer_list) {
                if (t->tx_buf == NULL && t->rx_buf == NULL && t->len) {
diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
index d018a4aac3a1..c4675fa8b645 100644
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -16,6 +16,7 @@
 #include <linux/io.h>
 #include <linux/spi/spi.h>
 #include <linux/module.h>
+#include <linux/pm_runtime.h>
 #include <linux/of.h>
 #include <linux/clk.h>
 #include <linux/sizes.h>
@@ -23,6 +24,9 @@
 #define DRIVER_NAME                     "orion_spi"
+/* Runtime PM autosuspend timeout: PM is fairly light on this driver */
+#define SPI_AUTOSUSPEND_TIMEOUT         200
 #define ORION_NUM_CHIPSELECTS           1 /* only one slave is supported*/
 #define ORION_SPI_WAIT_RDY_MAX_LOOP     2000 /* in usec */
@@ -277,7 +281,6 @@ out:
        return xfer->len - count;
 }
 static int orion_spi_transfer_one_message(struct spi_master *master,
                                           struct spi_message *m)
 {
@@ -346,8 +349,6 @@ static int orion_spi_probe(struct platform_device *pdev)
        struct resource *r;
        unsigned long tclk_hz;
        int status = 0;
-        const u32 *iprop;
-        int size;
        master = spi_alloc_master(&pdev->dev, sizeof(*spi));
        if (master == NULL) {
@@ -358,10 +359,10 @@ static int orion_spi_probe(struct platform_device *pdev)
        if (pdev->id != -1)
                master->bus_num = pdev->id;
        if (pdev->dev.of_node) {
-                iprop = of_get_property(pdev->dev.of_node, "cell-index",
+                u32 cell_index;
-                                        &size);
+                if (!of_property_read_u32(pdev->dev.of_node, "cell-index",
-                if (iprop && size == sizeof(*iprop))
+                                          &cell_index))
-                        master->bus_num = *iprop;
+                        master->bus_num = cell_index;
        }
        /* we support only mode 0, and no options */
@@ -370,6 +371,7 @@ static int orion_spi_probe(struct platform_device *pdev)
        master->transfer_one_message = orion_spi_transfer_one_message;
        master->num_chipselect = ORION_NUM_CHIPSELECTS;
        master->bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16);
+        master->auto_runtime_pm = true;
        platform_set_drvdata(pdev, master);
@@ -382,8 +384,10 @@ static int orion_spi_probe(struct platform_device *pdev)
                goto out;
        }
-        clk_prepare(spi->clk);
+        status = clk_prepare_enable(spi->clk);
-        clk_enable(spi->clk);
+        if (status)
+                goto out;
        tclk_hz = clk_get_rate(spi->clk);
        master->max_speed_hz = DIV_ROUND_UP(tclk_hz, 4);
        master->min_speed_hz = DIV_ROUND_UP(tclk_hz, 30);
@@ -395,16 +399,27 @@ static int orion_spi_probe(struct platform_device *pdev)
                goto out_rel_clk;
        }
-        if (orion_spi_reset(spi) < 0)
+        pm_runtime_set_active(&pdev->dev);
-                goto out_rel_clk;
+        pm_runtime_use_autosuspend(&pdev->dev);
+        pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+        pm_runtime_enable(&pdev->dev);
+        status = orion_spi_reset(spi);
+        if (status < 0)
+                goto out_rel_pm;
+        pm_runtime_mark_last_busy(&pdev->dev);
+        pm_runtime_put_autosuspend(&pdev->dev);
        master->dev.of_node = pdev->dev.of_node;
-        status = devm_spi_register_master(&pdev->dev, master);
+        status = spi_register_master(master);
        if (status < 0)
-                goto out_rel_clk;
+                goto out_rel_pm;
        return status;
+out_rel_pm:
+        pm_runtime_disable(&pdev->dev);
 out_rel_clk:
        clk_disable_unprepare(spi->clk);
 out:
@@ -415,19 +430,45 @@ out:
 static int orion_spi_remove(struct platform_device *pdev)
 {
-        struct spi_master *master;
+        struct spi_master *master = platform_get_drvdata(pdev);
-        struct orion_spi *spi;
+        struct orion_spi *spi = spi_master_get_devdata(master);
-        master = platform_get_drvdata(pdev);
-        spi = spi_master_get_devdata(master);
+        pm_runtime_get_sync(&pdev->dev);
        clk_disable_unprepare(spi->clk);
+        spi_unregister_master(master);
+        pm_runtime_disable(&pdev->dev);
        return 0;
 }
 MODULE_ALIAS("platform:" DRIVER_NAME);
+#ifdef CONFIG_PM_RUNTIME
+static int orion_spi_runtime_suspend(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct orion_spi *spi = spi_master_get_devdata(master);
+        clk_disable_unprepare(spi->clk);
+        return 0;
+}
+static int orion_spi_runtime_resume(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct orion_spi *spi = spi_master_get_devdata(master);
+        return clk_prepare_enable(spi->clk);
+}
+#endif
+static const struct dev_pm_ops orion_spi_pm_ops = {
+        SET_RUNTIME_PM_OPS(orion_spi_runtime_suspend,
+                           orion_spi_runtime_resume,
+                           NULL)
+};
 static const struct of_device_id orion_spi_of_match_table[] = {
        { .compatible = "marvell,orion-spi", },
        {}
@@ -438,6 +479,7 @@ static struct platform_driver orion_spi_driver = {
        .driver = {
                .name   = DRIVER_NAME,
                .owner  = THIS_MODULE,
+                .pm     = &orion_spi_pm_ops,
                .of_match_table = of_match_ptr(orion_spi_of_match_table),
        },
        .probe          = orion_spi_probe,
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 66d2ae21e78e..1189cfd96477 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1417,7 +1417,7 @@ static void do_interrupt_dma_transfer(struct pl022 *pl022)
         * Default is to enable all interrupts except RX -
         * this will be enabled once TX is complete
         */
-        u32 irqflags = ENABLE_ALL_INTERRUPTS & ~SSP_IMSC_MASK_RXIM;
+        u32 irqflags = (u32)(ENABLE_ALL_INTERRUPTS & ~SSP_IMSC_MASK_RXIM);
        /* Enable target chip, if not already active */
        if (!pl022->next_msg_cs_active)
diff --git a/drivers/spi/spi-pxa2xx-dma.c b/drivers/spi/spi-pxa2xx-dma.c
index f6759dc0153b..c41ff148a2b4 100644
--- a/drivers/spi/spi-pxa2xx-dma.c
+++ b/drivers/spi/spi-pxa2xx-dma.c
@@ -368,7 +368,7 @@ int pxa2xx_spi_set_dma_burst_and_threshold(struct chip_data *chip,
         * otherwise we use the default. Also we use the default FIFO
         * thresholds for now.
         */
-        *burst_code = chip_info ? chip_info->dma_burst_size : 16;
+        *burst_code = chip_info ? chip_info->dma_burst_size : 1;
        *threshold = SSCR1_RxTresh(RX_THRESH_DFLT)
                   | SSCR1_TxTresh(TX_THRESH_DFLT);
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index a98df7eeb42d..fe792106bdc5 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -118,6 +118,7 @@ static void lpss_ssp_setup(struct driver_data *drv_data)
         */
        orig = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
+        /* Test SPI_CS_CONTROL_SW_MODE bit enabling */
        value = orig | SPI_CS_CONTROL_SW_MODE;
        writel(value, drv_data->ioaddr + offset + SPI_CS_CONTROL);
        value = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
@@ -126,10 +127,13 @@ static void lpss_ssp_setup(struct driver_data *drv_data)
                goto detection_done;
        }
-        value &= ~SPI_CS_CONTROL_SW_MODE;
+        orig = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
+        /* Test SPI_CS_CONTROL_SW_MODE bit disabling */
+        value = orig & ~SPI_CS_CONTROL_SW_MODE;
        writel(value, drv_data->ioaddr + offset + SPI_CS_CONTROL);
        value = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
-        if (value != orig) {
+        if (value != (orig & ~SPI_CS_CONTROL_SW_MODE)) {
                offset = 0x800;
                goto detection_done;
        }
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index fc1de86d3c8a..9f83d2950748 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -142,6 +142,7 @@ struct spi_qup {
        int                     w_size; /* bytes per SPI word */
        int                     tx_bytes;
        int                     rx_bytes;
+        int                     qup_v1;
 };
@@ -420,35 +421,12 @@ static int spi_qup_io_config(struct spi_device *spi, struct spi_transfer *xfer)
        config |= QUP_CONFIG_SPI_MODE;
        writel_relaxed(config, controller->base + QUP_CONFIG);
-        writel_relaxed(0, controller->base + QUP_OPERATIONAL_MASK);
+        /* only write to OPERATIONAL_MASK when register is present */
+        if (!controller->qup_v1)
+                writel_relaxed(0, controller->base + QUP_OPERATIONAL_MASK);
        return 0;
 }
-static void spi_qup_set_cs(struct spi_device *spi, bool enable)
-{
-        struct spi_qup *controller = spi_master_get_devdata(spi->master);
-        u32 iocontol, mask;
-        iocontol = readl_relaxed(controller->base + SPI_IO_CONTROL);
-        /* Disable auto CS toggle and use manual */
-        iocontol &= ~SPI_IO_C_MX_CS_MODE;
-        iocontol |= SPI_IO_C_FORCE_CS;
-        iocontol &= ~SPI_IO_C_CS_SELECT_MASK;
-        iocontol |= SPI_IO_C_CS_SELECT(spi->chip_select);
-        mask = SPI_IO_C_CS_N_POLARITY_0 << spi->chip_select;
-        if (enable)
-                iocontol |= mask;
-        else
-                iocontol &= ~mask;
-        writel_relaxed(iocontol, controller->base + SPI_IO_CONTROL);
-}
 static int spi_qup_transfer_one(struct spi_master *master,
                              struct spi_device *spi,
                              struct spi_transfer *xfer)
@@ -511,7 +489,7 @@ static int spi_qup_probe(struct platform_device *pdev)
        struct resource *res;
        struct device *dev;
        void __iomem *base;
-        u32 data, max_freq, iomode;
+        u32 max_freq, iomode;
        int ret, irq, size;
        dev = &pdev->dev;
@@ -554,15 +532,6 @@ static int spi_qup_probe(struct platform_device *pdev)
                return ret;
        }
-        data = readl_relaxed(base + QUP_HW_VERSION);
-        if (data < QUP_HW_VERSION_2_1_1) {
-                clk_disable_unprepare(cclk);
-                clk_disable_unprepare(iclk);
-                dev_err(dev, "v.%08x is not supported\n", data);
-                return -ENXIO;
-        }
        master = spi_alloc_master(dev, sizeof(struct spi_qup));
        if (!master) {
                clk_disable_unprepare(cclk);
@@ -571,12 +540,16 @@ static int spi_qup_probe(struct platform_device *pdev)
                return -ENOMEM;
        }
+        /* use num-cs unless not present or out of range */
+        if (of_property_read_u16(dev->of_node, "num-cs",
+                        &master->num_chipselect) ||
+                        (master->num_chipselect > SPI_NUM_CHIPSELECTS))
+                master->num_chipselect = SPI_NUM_CHIPSELECTS;
        master->bus_num = pdev->id;
        master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
-        master->num_chipselect = SPI_NUM_CHIPSELECTS;
        master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 32);
        master->max_speed_hz = max_freq;
-        master->set_cs = spi_qup_set_cs;
        master->transfer_one = spi_qup_transfer_one;
        master->dev.of_node = pdev->dev.of_node;
        master->auto_runtime_pm = true;
@@ -591,6 +564,10 @@ static int spi_qup_probe(struct platform_device *pdev)
        controller->cclk = cclk;
        controller->irq = irq;
+        /* set v1 flag if device is version 1 */
+        if (of_device_is_compatible(dev->of_node, "qcom,spi-qup-v1.1.1"))
+                controller->qup_v1 = 1;
        spin_lock_init(&controller->lock);
        init_completion(&controller->done);
@@ -614,8 +591,8 @@ static int spi_qup_probe(struct platform_device *pdev)
        size = QUP_IO_M_INPUT_FIFO_SIZE(iomode);
        controller->in_fifo_sz = controller->in_blk_sz * (2 << size);
-        dev_info(dev, "v.%08x IN:block:%d, fifo:%d, OUT:block:%d, fifo:%d\n",
+        dev_info(dev, "IN:block:%d, fifo:%d, OUT:block:%d, fifo:%d\n",
-                 data, controller->in_blk_sz, controller->in_fifo_sz,
+                 controller->in_blk_sz, controller->in_fifo_sz,
                 controller->out_blk_sz, controller->out_fifo_sz);
        writel_relaxed(1, base + QUP_SW_RESET);
@@ -628,10 +605,19 @@ static int spi_qup_probe(struct platform_device *pdev)
        writel_relaxed(0, base + QUP_OPERATIONAL);
        writel_relaxed(0, base + QUP_IO_M_MODES);
-        writel_relaxed(0, base + QUP_OPERATIONAL_MASK);
+        if (!controller->qup_v1)
+                writel_relaxed(0, base + QUP_OPERATIONAL_MASK);
        writel_relaxed(SPI_ERROR_CLK_UNDER_RUN | SPI_ERROR_CLK_OVER_RUN,
                       base + SPI_ERROR_FLAGS_EN);
+        /* if earlier version of the QUP, disable INPUT_OVERRUN */
+        if (controller->qup_v1)
+                writel_relaxed(QUP_ERROR_OUTPUT_OVER_RUN |
+                        QUP_ERROR_INPUT_UNDER_RUN | QUP_ERROR_OUTPUT_UNDER_RUN,
+                        base + QUP_ERROR_FLAGS_EN);
        writel_relaxed(0, base + SPI_CONFIG);
        writel_relaxed(SPI_IO_C_NO_TRI_STATE, base + SPI_IO_CONTROL);
@@ -640,16 +626,19 @@ static int spi_qup_probe(struct platform_device *pdev)
        if (ret)
                goto error;
-        ret = devm_spi_register_master(dev, master);
-        if (ret)
-                goto error;
        pm_runtime_set_autosuspend_delay(dev, MSEC_PER_SEC);
        pm_runtime_use_autosuspend(dev);
        pm_runtime_set_active(dev);
        pm_runtime_enable(dev);
+        ret = devm_spi_register_master(dev, master);
+        if (ret)
+                goto disable_pm;
        return 0;
+disable_pm:
+        pm_runtime_disable(&pdev->dev);
 error:
        clk_disable_unprepare(cclk);
        clk_disable_unprepare(iclk);
@@ -750,6 +739,7 @@ static int spi_qup_remove(struct platform_device *pdev)
 }
 static const struct of_device_id spi_qup_dt_match[] = {
+        { .compatible = "qcom,spi-qup-v1.1.1", },
        { .compatible = "qcom,spi-qup-v2.1.1", },
        { .compatible = "qcom,spi-qup-v2.2.1", },
        { }
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 10112745bb17..c850dfdfa9e3 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -477,7 +477,7 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
                                        tx->sgl, tx->nents, DMA_TO_DEVICE,
                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
                if (!desc_tx)
-                        return -EIO;
+                        goto no_dma;
                irq_mask |= SPCR_SPTIE;
        }
@@ -486,7 +486,7 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
                                        rx->sgl, rx->nents, DMA_FROM_DEVICE,
                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
                if (!desc_rx)
-                        return -EIO;
+                        goto no_dma;
                irq_mask |= SPCR_SPRIE;
        }
@@ -540,6 +540,12 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
                enable_irq(rspi->rx_irq);
        return ret;
+no_dma:
+        pr_warn_once("%s %s: DMA not available, falling back to PIO\n",
+                     dev_driver_string(&rspi->master->dev),
+                     dev_name(&rspi->master->dev));
+        return -EAGAIN;
 }
 static void rspi_receive_init(const struct rspi_data *rspi)
@@ -593,8 +599,10 @@ static int rspi_common_transfer(struct rspi_data *rspi,
        if (rspi->master->can_dma && __rspi_can_dma(rspi, xfer)) {
                /* rx_buf can be NULL on RSPI on SH in TX-only Mode */
-                return rspi_dma_transfer(rspi, &xfer->tx_sg,
+                ret = rspi_dma_transfer(rspi, &xfer->tx_sg,
-                                         xfer->rx_buf ? &xfer->rx_sg : NULL);
+                                        xfer->rx_buf ? &xfer->rx_sg : NULL);
+                if (ret != -EAGAIN)
+                        return ret;
        }
        ret = rspi_pio_transfer(rspi, xfer->tx_buf, xfer->rx_buf, xfer->len);
@@ -630,7 +638,6 @@ static int rspi_rz_transfer_one(struct spi_master *master,
                                struct spi_transfer *xfer)
 {
        struct rspi_data *rspi = spi_master_get_devdata(master);
-        int ret;
        rspi_rz_receive_init(rspi);
@@ -649,8 +656,11 @@ static int qspi_transfer_out(struct rspi_data *rspi, struct spi_transfer *xfer)
 {
        int ret;
-        if (rspi->master->can_dma && __rspi_can_dma(rspi, xfer))
+        if (rspi->master->can_dma && __rspi_can_dma(rspi, xfer)) {
-                return rspi_dma_transfer(rspi, &xfer->tx_sg, NULL);
+                ret = rspi_dma_transfer(rspi, &xfer->tx_sg, NULL);
+                if (ret != -EAGAIN)
+                        return ret;
+        }
        ret = rspi_pio_transfer(rspi, xfer->tx_buf, NULL, xfer->len);
        if (ret < 0)
@@ -664,8 +674,11 @@ static int qspi_transfer_out(struct rspi_data *rspi, struct spi_transfer *xfer)
 static int qspi_transfer_in(struct rspi_data *rspi, struct spi_transfer *xfer)
 {
-        if (rspi->master->can_dma && __rspi_can_dma(rspi, xfer))
+        if (rspi->master->can_dma && __rspi_can_dma(rspi, xfer)) {
-                return rspi_dma_transfer(rspi, NULL, &xfer->rx_sg);
+                int ret = rspi_dma_transfer(rspi, NULL, &xfer->rx_sg);
+                if (ret != -EAGAIN)
+                        return ret;
+        }
        return rspi_pio_transfer(rspi, NULL, xfer->rx_buf, xfer->len);
 }
@@ -927,19 +940,19 @@ static int rspi_request_dma(struct device *dev, struct spi_master *master,
        return 0;
 }
-static void rspi_release_dma(struct rspi_data *rspi)
+static void rspi_release_dma(struct spi_master *master)
 {
-        if (rspi->master->dma_tx)
+        if (master->dma_tx)
-                dma_release_channel(rspi->master->dma_tx);
+                dma_release_channel(master->dma_tx);
-        if (rspi->master->dma_rx)
+        if (master->dma_rx)
-                dma_release_channel(rspi->master->dma_rx);
+                dma_release_channel(master->dma_rx);
 }
 static int rspi_remove(struct platform_device *pdev)
 {
        struct rspi_data *rspi = platform_get_drvdata(pdev);
-        rspi_release_dma(rspi);
+        rspi_release_dma(rspi->master);
        pm_runtime_disable(&pdev->dev);
        return 0;
@@ -1141,7 +1154,7 @@ static int rspi_probe(struct platform_device *pdev)
        return 0;
 error3:
-        rspi_release_dma(rspi);
+        rspi_release_dma(master);
 error2:
        pm_runtime_disable(&pdev->dev);
 error1:
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index 75a56968b14c..1c36311935d7 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -197,7 +197,6 @@ struct s3c64xx_spi_driver_data {
        struct s3c64xx_spi_dma_data     tx_dma;
        struct s3c64xx_spi_port_config  *port_conf;
        unsigned int                    port_id;
-        bool                            cs_gpio;
 };
 static void flush_fifo(struct s3c64xx_spi_driver_data *sdd)
@@ -754,10 +753,8 @@ static struct s3c64xx_spi_csinfo *s3c64xx_get_slave_ctrldata(
 {
        struct s3c64xx_spi_csinfo *cs;
        struct device_node *slave_np, *data_np = NULL;
-        struct s3c64xx_spi_driver_data *sdd;
        u32 fb_delay = 0;
-        sdd = spi_master_get_devdata(spi->master);
        slave_np = spi->dev.of_node;
        if (!slave_np) {
                dev_err(&spi->dev, "device node not found\n");
@@ -776,17 +773,6 @@ static struct s3c64xx_spi_csinfo *s3c64xx_get_slave_ctrldata(
                return ERR_PTR(-ENOMEM);
        }
-        /* The CS line is asserted/deasserted by the gpio pin */
-        if (sdd->cs_gpio)
-                cs->line = of_get_named_gpio(data_np, "cs-gpio", 0);
-        if (!gpio_is_valid(cs->line)) {
-                dev_err(&spi->dev, "chip select gpio is not specified or invalid\n");
-                kfree(cs);
-                of_node_put(data_np);
-                return ERR_PTR(-EINVAL);
-        }
        of_property_read_u32(data_np, "samsung,spi-feedback-delay", &fb_delay);
        cs->fb_delay = fb_delay;
        of_node_put(data_np);
@@ -807,9 +793,16 @@ static int s3c64xx_spi_setup(struct spi_device *spi)
        int err;
        sdd = spi_master_get_devdata(spi->master);
-        if (!cs && spi->dev.of_node) {
+        if (spi->dev.of_node) {
                cs = s3c64xx_get_slave_ctrldata(spi);
                spi->controller_data = cs;
+        } else if (cs) {
+                /* On non-DT platforms the SPI core will set spi->cs_gpio
+                 * to -ENOENT. The GPIO pin used to drive the chip select
+                 * is defined by using platform data so spi->cs_gpio value
+                 * has to be override to have the proper GPIO pin number.
+                 */
+                spi->cs_gpio = cs->line;
        }
        if (IS_ERR_OR_NULL(cs)) {
@@ -818,18 +811,15 @@ static int s3c64xx_spi_setup(struct spi_device *spi)
        }
        if (!spi_get_ctldata(spi)) {
-                /* Request gpio only if cs line is asserted by gpio pins */
+                if (gpio_is_valid(spi->cs_gpio)) {
-                if (sdd->cs_gpio) {
+                        err = gpio_request_one(spi->cs_gpio, GPIOF_OUT_INIT_HIGH,
-                        err = gpio_request_one(cs->line, GPIOF_OUT_INIT_HIGH,
+                                               dev_name(&spi->dev));
-                                        dev_name(&spi->dev));
                        if (err) {
                                dev_err(&spi->dev,
                                        "Failed to get /CS gpio [%d]: %d\n",
-                                        cs->line, err);
+                                        spi->cs_gpio, err);
                                goto err_gpio_req;
                        }
-                        spi->cs_gpio = cs->line;
                }
                spi_set_ctldata(spi, cs);
@@ -884,7 +874,8 @@ setup_exit:
        /* setup() returns with device de-selected */
        writel(S3C64XX_SPI_SLAVE_SIG_INACT, sdd->regs + S3C64XX_SPI_SLAVE_SEL);
-        gpio_free(cs->line);
+        if (gpio_is_valid(spi->cs_gpio))
+                gpio_free(spi->cs_gpio);
        spi_set_ctldata(spi, NULL);
 err_gpio_req:
@@ -897,14 +888,21 @@ err_gpio_req:
 static void s3c64xx_spi_cleanup(struct spi_device *spi)
 {
        struct s3c64xx_spi_csinfo *cs = spi_get_ctldata(spi);
-        struct s3c64xx_spi_driver_data *sdd;
-        sdd = spi_master_get_devdata(spi->master);
+        if (gpio_is_valid(spi->cs_gpio)) {
-        if (spi->cs_gpio) {
                gpio_free(spi->cs_gpio);
                if (spi->dev.of_node)
                        kfree(cs);
+                else {
+                        /* On non-DT platforms, the SPI core sets
+                         * spi->cs_gpio to -ENOENT and .setup()
+                         * overrides it with the GPIO pin value
+                         * passed using platform data.
+                         */
+                        spi->cs_gpio = -ENOENT;
+                }
        }
        spi_set_ctldata(spi, NULL);
 }
@@ -1075,11 +1073,7 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
        sdd->cntrlr_info = sci;
        sdd->pdev = pdev;
        sdd->sfr_start = mem_res->start;
-        sdd->cs_gpio = true;
        if (pdev->dev.of_node) {
-                if (!of_find_property(pdev->dev.of_node, "cs-gpio", NULL))
-                        sdd->cs_gpio = false;
                ret = of_alias_get_id(pdev->dev.of_node, "spi");
                if (ret < 0) {
                        dev_err(&pdev->dev, "failed to get alias id, errno %d\n",
diff --git a/drivers/spi/spi-sh-hspi.c b/drivers/spi/spi-sh-hspi.c
index c8e795ef2e13..94b5faed21e2 100644
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -304,7 +304,7 @@ static int hspi_remove(struct platform_device *pdev)
        return 0;
 }
-static struct of_device_id hspi_of_match[] = {
+static const struct of_device_id hspi_of_match[] = {
        { .compatible = "renesas,hspi", },
        { /* sentinel */ }
 };
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 45b09142afe2..83c43707f093 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -680,8 +680,6 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)
        p = spi_master_get_devdata(master);
-        platform_set_drvdata(pdev, p);
        of_id = of_match_device(sh_msiof_match, &pdev->dev);
        if (of_id) {
                p->chipdata = of_id->data;
diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
index 1f56ef651d1a..b83dd733684c 100644
--- a/drivers/spi/spi-sh-sci.c
+++ b/drivers/spi/spi-sh-sci.c
@@ -175,9 +175,9 @@ static int sh_sci_spi_remove(struct platform_device *dev)
 {
        struct sh_sci_spi *sp = platform_get_drvdata(dev);
-        iounmap(sp->membase);
-        setbits(sp, PIN_INIT, 0);
        spi_bitbang_stop(&sp->bitbang);
+        setbits(sp, PIN_INIT, 0);
+        iounmap(sp->membase);
        spi_master_put(sp->bitbang.master);
        return 0;
 }
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index a3b0b9944bf0..4d8efb16573d 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -369,7 +369,7 @@ static int xilinx_spi_probe(struct platform_device *pdev)
                goto put_master;
        }
-        master->bus_num = pdev->dev.id;
+        master->bus_num = pdev->id;
        master->num_chipselect = num_cs;
        master->dev.of_node = pdev->dev.of_node;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index d4f9670b51bc..e6f076d5ffd5 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -345,14 +345,12 @@ static DEFINE_MUTEX(board_lock);
 struct spi_device *spi_alloc_device(struct spi_master *master)
 {
        struct spi_device       *spi;
-        struct device           *dev = master->dev.parent;
        if (!spi_master_get(master))
                return NULL;
        spi = kzalloc(sizeof(*spi), GFP_KERNEL);
        if (!spi) {
-                dev_err(dev, "cannot alloc spi_device\n");
                spi_master_put(master);
                return NULL;
        }
@@ -619,6 +617,8 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
        }
        ret = dma_map_sg(dev, sgt->sgl, sgt->nents, dir);
+        if (!ret)
+                ret = -ENOMEM;
        if (ret < 0) {
                sg_free_table(sgt);
                return ret;
@@ -647,8 +647,8 @@ static int __spi_map_msg(struct spi_master *master, struct spi_message *msg)
        if (!master->can_dma)
                return 0;
-        tx_dev = &master->dma_tx->dev->device;
+        tx_dev = master->dma_tx->device->dev;
-        rx_dev = &master->dma_rx->dev->device;
+        rx_dev = master->dma_rx->device->dev;
        list_for_each_entry(xfer, &msg->transfers, transfer_list) {
                if (!master->can_dma(master, msg->spi, xfer))
@@ -687,8 +687,8 @@ static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
        if (!master->cur_msg_mapped || !master->can_dma)
                return 0;
-        tx_dev = &master->dma_tx->dev->device;
+        tx_dev = master->dma_tx->device->dev;
-        rx_dev = &master->dma_rx->dev->device;
+        rx_dev = master->dma_rx->device->dev;
        list_for_each_entry(xfer, &msg->transfers, transfer_list) {
                if (!master->can_dma(master, msg->spi, xfer))
diff --git a/drivers/staging/android/timed_output.c b/drivers/staging/android/timed_output.c
index 2c617834dc46..c341ac11c5a3 100644
--- a/drivers/staging/android/timed_output.c
+++ b/drivers/staging/android/timed_output.c
@@ -97,7 +97,6 @@ void timed_output_dev_unregister(struct timed_output_dev *tdev)
 {
        tdev->enable(tdev, 0);
        device_destroy(timed_output_class, MKDEV(0, tdev->index));
-        dev_set_drvdata(tdev->dev, NULL);
 }
 EXPORT_SYMBOL_GPL(timed_output_dev_unregister);
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index 5d56428d508a..a2f6957e7ee9 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -651,6 +651,7 @@ config COMEDI_ADDI_APCI_1516
 config COMEDI_ADDI_APCI_1564
        tristate "ADDI-DATA APCI_1564 support"
+        select COMEDI_ADDI_WATCHDOG
        ---help---
          Enable support for ADDI-DATA APCI_1564 cards
diff --git a/drivers/staging/iio/Kconfig b/drivers/staging/iio/Kconfig
index b36feb080cba..fa38be0982f9 100644
--- a/drivers/staging/iio/Kconfig
+++ b/drivers/staging/iio/Kconfig
@@ -36,10 +36,11 @@ config IIO_SIMPLE_DUMMY_EVENTS
         Add some dummy events to the simple dummy driver.
 config IIO_SIMPLE_DUMMY_BUFFER
-       boolean "Buffered capture support"
+        boolean "Buffered capture support"
-       select IIO_KFIFO_BUF
+        select IIO_BUFFER
-       help
+        select IIO_KFIFO_BUF
-         Add buffered data capture to the simple dummy driver.
+        help
+          Add buffered data capture to the simple dummy driver.
 endif # IIO_SIMPLE_DUMMY
diff --git a/drivers/staging/iio/adc/ad7291.c b/drivers/staging/iio/adc/ad7291.c
index 357cef2a6f4c..7194bd138762 100644
--- a/drivers/staging/iio/adc/ad7291.c
+++ b/drivers/staging/iio/adc/ad7291.c
@@ -465,7 +465,7 @@ static int ad7291_probe(struct i2c_client *client,
        struct ad7291_platform_data *pdata = client->dev.platform_data;
        struct ad7291_chip_info *chip;
        struct iio_dev *indio_dev;
-        int ret = 0;
+        int ret;
        indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*chip));
        if (!indio_dev)
@@ -475,7 +475,7 @@ static int ad7291_probe(struct i2c_client *client,
        if (pdata && pdata->use_external_ref) {
                chip->reg = devm_regulator_get(&client->dev, "vref");
                if (IS_ERR(chip->reg))
-                        return ret;
+                        return PTR_ERR(chip->reg);
                ret = regulator_enable(chip->reg);
                if (ret)
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index dae8d1a9038e..52d7517b342e 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -846,6 +846,14 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val)
                        LRADC_CTRL1);
        mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+        /* Enable / disable the divider per requirement */
+        if (test_bit(chan, &lradc->is_divided))
+                mxs_lradc_reg_set(lradc, 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
+                        LRADC_CTRL2);
+        else
+                mxs_lradc_reg_clear(lradc,
+                        1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, LRADC_CTRL2);
        /* Clean the slot's previous content, then set new one. */
        mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(0),
                        LRADC_CTRL4);
@@ -961,15 +969,11 @@ static int mxs_lradc_write_raw(struct iio_dev *iio_dev,
                if (val == scale_avail[MXS_LRADC_DIV_DISABLED].integer &&
                    val2 == scale_avail[MXS_LRADC_DIV_DISABLED].nano) {
                        /* divider by two disabled */
-                        writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
-                               lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_CLR);
                        clear_bit(chan->channel, &lradc->is_divided);
                        ret = 0;
                } else if (val == scale_avail[MXS_LRADC_DIV_ENABLED].integer &&
                           val2 == scale_avail[MXS_LRADC_DIV_ENABLED].nano) {
                        /* divider by two enabled */
-                        writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
-                               lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_SET);
                        set_bit(chan->channel, &lradc->is_divided);
                        ret = 0;
                }
diff --git a/drivers/staging/iio/light/tsl2x7x_core.c b/drivers/staging/iio/light/tsl2x7x_core.c
index 9e0f2a9c73ae..ab338e3ddd05 100644
--- a/drivers/staging/iio/light/tsl2x7x_core.c
+++ b/drivers/staging/iio/light/tsl2x7x_core.c
@@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_dev *indio_dev)
        chip->tsl2x7x_config[TSL2X7X_PRX_COUNT] =
                        chip->tsl2x7x_settings.prox_pulse_count;
        chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] =
-        chip->tsl2x7x_settings.prox_thres_low;
+                        (chip->tsl2x7x_settings.prox_thres_low) & 0xFF;
+        chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] =
+                        (chip->tsl2x7x_settings.prox_thres_low >> 8) & 0xFF;
        chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] =
-                        chip->tsl2x7x_settings.prox_thres_high;
+                        (chip->tsl2x7x_settings.prox_thres_high) & 0xFF;
+        chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] =
+                        (chip->tsl2x7x_settings.prox_thres_high >> 8) & 0xFF;
        /* and make sure we're not already on */
        if (chip->tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) {
diff --git a/drivers/staging/imx-drm/parallel-display.c b/drivers/staging/imx-drm/parallel-display.c
index b5678328fc40..4ca61afdf622 100644
--- a/drivers/staging/imx-drm/parallel-display.c
+++ b/drivers/staging/imx-drm/parallel-display.c
@@ -173,6 +173,13 @@ static int imx_pd_register(struct drm_device *drm,
        if (ret)
                return ret;
+        /* set the connector's dpms to OFF so that
+         * drm_helper_connector_dpms() won't return
+         * immediately since the current state is ON
+         * at this point.
+         */
+        imxpd->connector.dpms = DRM_MODE_DPMS_OFF;
        drm_encoder_helper_add(&imxpd->encoder, &imx_pd_encoder_helper_funcs);
        drm_encoder_init(drm, &imxpd->encoder, &imx_pd_encoder_funcs,
                         DRM_MODE_ENCODER_NONE);
diff --git a/drivers/staging/media/omap4iss/Kconfig b/drivers/staging/media/omap4iss/Kconfig
index 78b0fba7047e..8afc6fee40c5 100644
--- a/drivers/staging/media/omap4iss/Kconfig
+++ b/drivers/staging/media/omap4iss/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_OMAP4
        bool "OMAP 4 Camera support"
-        depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API && I2C && ARCH_OMAP4
+        depends on VIDEO_V4L2=y && VIDEO_V4L2_SUBDEV_API && I2C=y && ARCH_OMAP4
        select VIDEOBUF2_DMA_CONTIG
        ---help---
          Driver for an OMAP 4 ISS controller.
diff --git a/drivers/staging/rtl8723au/hal/rtl8723a_hal_init.c b/drivers/staging/rtl8723au/hal/rtl8723a_hal_init.c
index 0acacab95a48..46f5abcbaeeb 100644
--- a/drivers/staging/rtl8723au/hal/rtl8723a_hal_init.c
+++ b/drivers/staging/rtl8723au/hal/rtl8723a_hal_init.c
@@ -298,7 +298,7 @@ int rtl8723a_FirmwareDownload(struct rtw_adapter *padapter)
        RT_TRACE(_module_hal_init_c_, _drv_info_, ("+%s\n", __func__));
        if (IS_8723A_A_CUT(pHalData->VersionID)) {
-                fw_name = "rtlwifi/rtl8723aufw.bin";
+                fw_name = "rtlwifi/rtl8723aufw_A.bin";
                RT_TRACE(_module_hal_init_c_, _drv_info_,
                         ("rtl8723a_FirmwareDownload: R8723FwImageArray_UMC "
                          "for RTL8723A A CUT\n"));
diff --git a/drivers/staging/rtl8723au/os_dep/os_intfs.c b/drivers/staging/rtl8723au/os_dep/os_intfs.c
index 4e32003a4437..1fb34386a4e5 100644
--- a/drivers/staging/rtl8723au/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723au/os_dep/os_intfs.c
@@ -29,7 +29,9 @@ MODULE_AUTHOR("Realtek Semiconductor Corp.");
 MODULE_AUTHOR("Larry Finger <Larry.Finger@lwfinger.net>");
 MODULE_AUTHOR("Jes Sorensen <Jes.Sorensen@redhat.com>");
 MODULE_VERSION(DRIVERVERSION);
-MODULE_FIRMWARE("rtlwifi/rtl8821aefw.bin");
+MODULE_FIRMWARE("rtlwifi/rtl8723aufw_A.bin");
+MODULE_FIRMWARE("rtlwifi/rtl8723aufw_B.bin");
+MODULE_FIRMWARE("rtlwifi/rtl8723aufw_B_NoBT.bin");
 /* module param defaults */
 static int rtw_chip_version = 0x00;
diff --git a/drivers/staging/rtl8723au/os_dep/usb_intf.c b/drivers/staging/rtl8723au/os_dep/usb_intf.c
index 8b25c1aa2025..ebb19b22f47f 100644
--- a/drivers/staging/rtl8723au/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8723au/os_dep/usb_intf.c
@@ -530,8 +530,10 @@ int rtw_resume_process23a(struct rtw_adapter *padapter)
        pwrpriv->bkeepfwalive = false;
        DBG_8723A("bkeepfwalive(%x)\n", pwrpriv->bkeepfwalive);
-        if (pm_netdev_open23a(pnetdev, true) != 0)
+        if (pm_netdev_open23a(pnetdev, true) != 0) {
+                up(&pwrpriv->lock);
                goto exit;
+        }
        netif_device_attach(pnetdev);
        netif_carrier_on(pnetdev);
diff --git a/drivers/staging/tidspbridge/core/tiomap3430.c b/drivers/staging/tidspbridge/core/tiomap3430.c
index 8945b4e3a2a6..cb50120ed7b5 100644
--- a/drivers/staging/tidspbridge/core/tiomap3430.c
+++ b/drivers/staging/tidspbridge/core/tiomap3430.c
@@ -280,8 +280,10 @@ static int bridge_brd_monitor(struct bridge_dev_context *dev_ctxt)
                                        OMAP3430_IVA2_MOD, OMAP2_CM_CLKSTCTRL);
                /* Wait until the state has moved to ON */
-                while (*pdata->dsp_prm_read(OMAP3430_IVA2_MOD, OMAP2_PM_PWSTST)&
+                while ((*pdata->dsp_prm_read)(OMAP3430_IVA2_MOD,
-                                        OMAP_INTRANSITION_MASK);
+                                              OMAP2_PM_PWSTST) &
+                                                OMAP_INTRANSITION_MASK)
+                        ;
                /* Disable Automatic transition */
                (*pdata->dsp_cm_write)(OMAP34XX_CLKSTCTRL_DISABLE_AUTO,
                                        OMAP3430_IVA2_MOD, OMAP2_CM_CLKSTCTRL);
diff --git a/drivers/staging/vt6655/bssdb.c b/drivers/staging/vt6655/bssdb.c
index 59679cd46816..69b80e80b011 100644
--- a/drivers/staging/vt6655/bssdb.c
+++ b/drivers/staging/vt6655/bssdb.c
@@ -981,7 +981,7 @@ start:
                pDevice->byERPFlag &= ~(WLAN_SET_ERP_USE_PROTECTION(1));
        }
-        {
+        if (pDevice->eCommandState == WLAN_ASSOCIATE_WAIT) {
                pDevice->byReAssocCount++;
                /* 10 sec timeout */
                if ((pDevice->byReAssocCount > 10) && (!pDevice->bLinkPass)) {
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 1d3908d044d0..5a5fd937a442 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -2318,6 +2318,7 @@ static  irqreturn_t  device_intr(int irq,  void *dev_instance) {
        int             handled = 0;
        unsigned char byData = 0;
        int             ii = 0;
+        unsigned long flags;
        MACvReadISR(pDevice->PortOffset, &pDevice->dwIsr);
@@ -2331,7 +2332,8 @@ static  irqreturn_t  device_intr(int irq,  void *dev_instance) {
        handled = 1;
        MACvIntDisable(pDevice->PortOffset);
-        spin_lock_irq(&pDevice->lock);
+        spin_lock_irqsave(&pDevice->lock, flags);
        //Make sure current page is 0
        VNSvInPortB(pDevice->PortOffset + MAC_REG_PAGE1SEL, &byOrgPageSel);
@@ -2560,7 +2562,8 @@ static  irqreturn_t  device_intr(int irq,  void *dev_instance) {
        if (byOrgPageSel == 1)
                MACvSelectPage1(pDevice->PortOffset);
-        spin_unlock_irq(&pDevice->lock);
+        spin_unlock_irqrestore(&pDevice->lock, flags);
        MACvIntEnable(pDevice->PortOffset, IMR_MASK_VALUE);
        return IRQ_RETVAL(handled);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 5663f4d19d02..1f4c794f5fcc 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1309,7 +1309,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
        if (cmd->data_direction != DMA_TO_DEVICE) {
                pr_err("Command ITT: 0x%08x received DataOUT for a"
                        " NON-WRITE command.\n", cmd->init_task_tag);
-                return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
+                return iscsit_dump_data_payload(conn, payload_length, 1);
        }
        se_cmd = &cmd->se_cmd;
        iscsit_mod_dataout_timer(cmd);
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 19b842c3e0b3..ab4915c0d933 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -174,7 +174,6 @@ static int chap_server_compute_md5(
        char *nr_out_ptr,
        unsigned int *nr_out_len)
 {
-        char *endptr;
        unsigned long id;
        unsigned char id_as_uchar;
        unsigned char digest[MD5_SIGNATURE_SIZE];
@@ -320,9 +319,14 @@ static int chap_server_compute_md5(
        }
        if (type == HEX)
-                id = simple_strtoul(&identifier[2], &endptr, 0);
+                ret = kstrtoul(&identifier[2], 0, &id);
        else
-                id = simple_strtoul(identifier, &endptr, 0);
+                ret = kstrtoul(identifier, 0, &id);
+        if (ret < 0) {
+                pr_err("kstrtoul() failed for CHAP identifier: %d\n", ret);
+                goto out;
+        }
        if (id > 255) {
                pr_err("chap identifier: %lu greater than 255\n", id);
                goto out;
@@ -351,6 +355,10 @@ static int chap_server_compute_md5(
                pr_err("Unable to convert incoming challenge\n");
                goto out;
        }
+        if (challenge_len > 1024) {
+                pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
+                goto out;
+        }
        /*
         * During mutual authentication, the CHAP_C generated by the
         * initiator must not match the original CHAP_C generated by
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index fecb69535a15..5e71ac609418 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1216,7 +1216,7 @@ old_sess_out:
 static int __iscsi_target_login_thread(struct iscsi_np *np)
 {
        u8 *buffer, zero_tsih = 0;
-        int ret = 0, rc, stop;
+        int ret = 0, rc;
        struct iscsi_conn *conn = NULL;
        struct iscsi_login *login;
        struct iscsi_portal_group *tpg = NULL;
@@ -1230,6 +1230,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
        if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                complete(&np->np_restart_comp);
+        } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
+                spin_unlock_bh(&np->np_thread_lock);
+                goto exit;
        } else {
                np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
        }
@@ -1422,10 +1425,8 @@ old_sess_out:
        }
 out:
-        stop = kthread_should_stop();
+        return 1;
-        /* Wait for another socket.. */
-        if (!stop)
-                return 1;
 exit:
        iscsi_stop_login_thread_timer(np);
        spin_lock_bh(&np->np_thread_lock);
@@ -1442,7 +1443,7 @@ int iscsi_target_login_thread(void *arg)
        allow_signal(SIGINT);
-        while (!kthread_should_stop()) {
+        while (1) {
                ret = __iscsi_target_login_thread(np);
                /*
                 * We break and exit here unless another sock_accept() call
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 53e157cb8c54..fd90b28f1d94 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -1295,6 +1295,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta
        login->login_failed = 1;
        iscsit_collect_login_stats(conn, status_class, status_detail);
+        memset(&login->rsp[0], 0, ISCSI_HDR_LEN);
        hdr     = (struct iscsi_login_rsp *)&login->rsp[0];
        hdr->opcode             = ISCSI_OP_LOGIN_RSP;
        hdr->status_class       = status_class;
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 6d2f37578b29..8c64b8776a96 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -239,6 +239,7 @@ static void tcm_loop_submission_work(struct work_struct *work)
        return;
 out_done:
+        kmem_cache_free(tcm_loop_cmd_cache, tl_cmd);
        sc->scsi_done(sc);
        return;
 }
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 11d26fe65bfb..98da90167159 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -616,6 +616,7 @@ void core_dev_unexport(
        dev->export_count--;
        spin_unlock(&hba->device_lock);
+        lun->lun_sep = NULL;
        lun->lun_se_dev = NULL;
 }
diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c
index a8aaf6ac2ae2..946562389ca8 100644
--- a/drivers/tc/tc.c
+++ b/drivers/tc/tc.c
@@ -129,7 +129,10 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus)
                tc_device_get_irq(tdev);
-                device_register(&tdev->dev);
+                if (device_register(&tdev->dev)) {
+                        put_device(&tdev->dev);
+                        goto out_err;
+                }
                list_add_tail(&tdev->node, &tbus->devices);
 out_err:
@@ -148,7 +151,10 @@ static int __init tc_init(void)
        INIT_LIST_HEAD(&tc_bus.devices);
        dev_set_name(&tc_bus.dev, "tc");
-        device_register(&tc_bus.dev);
+        if (device_register(&tc_bus.dev)) {
+                put_device(&tc_bus.dev);
+                return 0;
+        }
        if (tc_bus.info.slot_size) {
                unsigned int tc_clock = tc_get_speed(&tc_bus) / 100000;
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index a99c63152b8d..2c516f2eebed 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -306,7 +306,7 @@ static int imx_get_sensor_data(struct platform_device *pdev)
 {
        struct imx_thermal_data *data = platform_get_drvdata(pdev);
        struct regmap *map;
-        int t1, t2, n1, n2;
+        int t1, n1;
        int ret;
        u32 val;
        u64 temp64;
@@ -333,14 +333,10 @@ static int imx_get_sensor_data(struct platform_device *pdev)
        /*
         * Sensor data layout:
         *   [31:20] - sensor value @ 25C
-         *    [19:8] - sensor value of hot
-         *     [7:0] - hot temperature value
         * Use universal formula now and only need sensor value @ 25C
         * slope = 0.4297157 - (0.0015976 * 25C fuse)
         */
        n1 = val >> 20;
-        n2 = (val & 0xfff00) >> 8;
-        t2 = val & 0xff;
        t1 = 25; /* t1 always 25C */
        /*
@@ -366,16 +362,16 @@ static int imx_get_sensor_data(struct platform_device *pdev)
        data->c2 = n1 * data->c1 + 1000 * t1;
        /*
-         * Set the default passive cooling trip point to 20 °C below the
+         * Set the default passive cooling trip point,
-         * maximum die temperature. Can be changed from userspace.
+         * can be changed from userspace.
         */
-        data->temp_passive = 1000 * (t2 - 20);
+        data->temp_passive = IMX_TEMP_PASSIVE;
        /*
-         * The maximum die temperature is t2, let's give 5 °C cushion
+         * The maximum die temperature set to 20 C higher than
-         * for noise and possible temperature rise between measurements.
+         * IMX_TEMP_PASSIVE.
         */
-        data->temp_critical = 1000 * (t2 - 5);
+        data->temp_critical = 1000 * 20 + data->temp_passive;
        return 0;
 }
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 04b1be7fa018..4b2b999b7611 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -156,8 +156,8 @@ static int of_thermal_bind(struct thermal_zone_device *thermal,
                        ret = thermal_zone_bind_cooling_device(thermal,
                                                tbp->trip_id, cdev,
-                                                tbp->min,
+                                                tbp->max,
-                                                tbp->max);
+                                                tbp->min);
                        if (ret)
                                return ret;
                }
@@ -712,11 +712,12 @@ thermal_of_build_thermal_zone(struct device_node *np)
        }
        i = 0;
-        for_each_child_of_node(child, gchild)
+        for_each_child_of_node(child, gchild) {
                ret = thermal_of_populate_bind_params(gchild, &tz->tbps[i++],
                                                      tz->trips, tz->ntrips);
                if (ret)
                        goto free_tbps;
+        }
 finish:
        of_node_put(child);
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index fdb07199d9c2..1967bee4f076 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -140,6 +140,12 @@ thermal_hwmon_lookup_temp(const struct thermal_hwmon_device *hwmon,
        return NULL;
 }
+static bool thermal_zone_crit_temp_valid(struct thermal_zone_device *tz)
+{
+        unsigned long temp;
+        return tz->ops->get_crit_temp && !tz->ops->get_crit_temp(tz, &temp);
+}
 int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
 {
        struct thermal_hwmon_device *hwmon;
@@ -189,21 +195,18 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
        if (result)
                goto free_temp_mem;
-        if (tz->ops->get_crit_temp) {
+        if (thermal_zone_crit_temp_valid(tz)) {
-                unsigned long temperature;
+                snprintf(temp->temp_crit.name,
-                if (!tz->ops->get_crit_temp(tz, &temperature)) {
+                                sizeof(temp->temp_crit.name),
-                        snprintf(temp->temp_crit.name,
-                                 sizeof(temp->temp_crit.name),
                                "temp%d_crit", hwmon->count);
-                        temp->temp_crit.attr.attr.name = temp->temp_crit.name;
+                temp->temp_crit.attr.attr.name = temp->temp_crit.name;
-                        temp->temp_crit.attr.attr.mode = 0444;
+                temp->temp_crit.attr.attr.mode = 0444;
-                        temp->temp_crit.attr.show = temp_crit_show;
+                temp->temp_crit.attr.show = temp_crit_show;
-                        sysfs_attr_init(&temp->temp_crit.attr.attr);
+                sysfs_attr_init(&temp->temp_crit.attr.attr);
-                        result = device_create_file(hwmon->device,
+                result = device_create_file(hwmon->device,
-                                                    &temp->temp_crit.attr);
+                                            &temp->temp_crit.attr);
-                        if (result)
+                if (result)
-                                goto unregister_input;
+                        goto unregister_input;
-                }
        }
        mutex_lock(&thermal_hwmon_list_lock);
@@ -250,7 +253,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
        }
        device_remove_file(hwmon->device, &temp->temp_input.attr);
-        if (tz->ops->get_crit_temp)
+        if (thermal_zone_crit_temp_valid(tz))
                device_remove_file(hwmon->device, &temp->temp_crit.attr);
        mutex_lock(&thermal_hwmon_list_lock);
diff --git a/drivers/thermal/ti-soc-thermal/ti-bandgap.c b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
index a1271b55103a..634b6ce0e63a 100644
--- a/drivers/thermal/ti-soc-thermal/ti-bandgap.c
+++ b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
@@ -1155,7 +1155,7 @@ static struct ti_bandgap *ti_bandgap_build(struct platform_device *pdev)
        /* register shadow for context save and restore */
        bgp->regval = devm_kzalloc(&pdev->dev, sizeof(*bgp->regval) *
                                   bgp->conf->sensor_count, GFP_KERNEL);
-        if (!bgp) {
+        if (!bgp->regval) {
                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
                return ERR_PTR(-ENOMEM);
        }
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index f95569dedc88..f44f1ba762c3 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1214,15 +1214,16 @@ static void n_tty_receive_parity_error(struct tty_struct *tty, unsigned char c)
 {
        struct n_tty_data *ldata = tty->disc_data;
-        if (I_IGNPAR(tty))
+        if (I_INPCK(tty)) {
-                return;
+                if (I_IGNPAR(tty))
-        if (I_PARMRK(tty)) {
+                        return;
-                put_tty_queue('\377', ldata);
+                if (I_PARMRK(tty)) {
-                put_tty_queue('\0', ldata);
+                        put_tty_queue('\377', ldata);
-                put_tty_queue(c, ldata);
+                        put_tty_queue('\0', ldata);
-        } else  if (I_INPCK(tty))
+                        put_tty_queue(c, ldata);
-                put_tty_queue('\0', ldata);
+                } else
-        else
+                        put_tty_queue('\0', ldata);
+        } else
                put_tty_queue(c, ldata);
        if (waitqueue_active(&tty->read_wait))
                wake_up_interruptible(&tty->read_wait);
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 27f7ad6b74c1..7a91c6d1eb7d 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -2357,7 +2357,7 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
        port->read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= UART_LSR_BI;
        /*
diff --git a/drivers/tty/serial/8250/8250_early.c b/drivers/tty/serial/8250/8250_early.c
index cfef801a49d4..4858b8a99d3b 100644
--- a/drivers/tty/serial/8250/8250_early.c
+++ b/drivers/tty/serial/8250/8250_early.c
@@ -144,8 +144,11 @@ static int __init early_serial8250_setup(struct earlycon_device *device,
        if (!(device->port.membase || device->port.iobase))
                return 0;
-        if (!device->baud)
+        if (!device->baud) {
                device->baud = probe_baud(&device->port);
+                snprintf(device->options, sizeof(device->options), "%u",
+                         device->baud);
+        }
        init_port(device);
diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
index 501667e3e3f5..323376668b72 100644
--- a/drivers/tty/serial/altera_uart.c
+++ b/drivers/tty/serial/altera_uart.c
@@ -185,6 +185,12 @@ static void altera_uart_set_termios(struct uart_port *port,
        uart_update_timeout(port, termios->c_cflag, baud);
        altera_uart_writel(port, baudclk, ALTERA_UART_DIVISOR_REG);
        spin_unlock_irqrestore(&port->lock, flags);
+        /*
+         * FIXME: port->read_status_mask and port->ignore_status_mask
+         * need to be initialized based on termios settings for
+         * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT
+         */
 }
 static void altera_uart_rx_chars(struct altera_uart *pp)
diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c
index 01c9e72433e1..971af1e22d0f 100644
--- a/drivers/tty/serial/amba-pl010.c
+++ b/drivers/tty/serial/amba-pl010.c
@@ -420,7 +420,7 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios,
        uap->port.read_status_mask = UART01x_RSR_OE;
        if (termios->c_iflag & INPCK)
                uap->port.read_status_mask |= UART01x_RSR_FE | UART01x_RSR_PE;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                uap->port.read_status_mask |= UART01x_RSR_BE;
        /*
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 908a6e3142a2..0e26dcbd5ea4 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1744,7 +1744,7 @@ pl011_set_termios(struct uart_port *port, struct ktermios *termios,
        port->read_status_mask = UART011_DR_OE | 255;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= UART011_DR_FE | UART011_DR_PE;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= UART011_DR_BE;
        /*
diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
index c9f5c9dcc15c..008c223eaf26 100644
--- a/drivers/tty/serial/arc_uart.c
+++ b/drivers/tty/serial/arc_uart.c
@@ -177,7 +177,7 @@ static void arc_serial_tx_chars(struct arc_uart_port *uart)
                uart->port.icount.tx++;
                uart->port.x_char = 0;
                sent = 1;
-        } else if (xmit->tail != xmit->head) {  /* TODO: uart_circ_empty */
+        } else if (!uart_circ_empty(xmit)) {
                ch = xmit->buf[xmit->tail];
                xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
                uart->port.icount.tx++;
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 3fceae099c44..c4f750314100 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1932,7 +1932,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
        port->read_status_mask = ATMEL_US_OVRE;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= (ATMEL_US_FRAME | ATMEL_US_PARE);
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= ATMEL_US_RXBRK;
        if (atmel_use_pdc_rx(port))
diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index a47421e4627c..231519022b73 100644
--- a/drivers/tty/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
@@ -567,7 +567,7 @@ static void bcm_uart_set_termios(struct uart_port *port,
                port->read_status_mask |= UART_FIFO_FRAMEERR_MASK;
                port->read_status_mask |= UART_FIFO_PARERR_MASK;
        }
-        if (new->c_iflag & (BRKINT))
+        if (new->c_iflag & (IGNBRK | BRKINT))
                port->read_status_mask |= UART_FIFO_BRKDET_MASK;
        port->ignore_status_mask = 0;
diff --git a/drivers/tty/serial/bfin_uart.c b/drivers/tty/serial/bfin_uart.c
index 869ceba2ec57..ac86a20992e9 100644
--- a/drivers/tty/serial/bfin_uart.c
+++ b/drivers/tty/serial/bfin_uart.c
@@ -833,7 +833,7 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
        port->read_status_mask = OE;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= (FE | PE);
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= BI;
        /*
diff --git a/drivers/tty/serial/dz.c b/drivers/tty/serial/dz.c
index 2f2b2e538a54..cdbbc788230a 100644
--- a/drivers/tty/serial/dz.c
+++ b/drivers/tty/serial/dz.c
@@ -625,7 +625,7 @@ static void dz_set_termios(struct uart_port *uport, struct ktermios *termios,
        dport->port.read_status_mask = DZ_OERR;
        if (termios->c_iflag & INPCK)
                dport->port.read_status_mask |= DZ_FERR | DZ_PERR;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                dport->port.read_status_mask |= DZ_BREAK;
        /* characters to ignore */
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index 5131b5ee6164..a514ee6f5406 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -25,7 +25,7 @@
 #include <asm/serial.h>
 static struct console early_con = {
-        .name =         "earlycon",
+        .name =         "uart", /* 8250 console switch requires this name */
        .flags =        CON_PRINTBUFFER | CON_BOOT,
        .index =        -1,
 };
diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
index b373f6416e8c..3b0ee9afd76f 100644
--- a/drivers/tty/serial/efm32-uart.c
+++ b/drivers/tty/serial/efm32-uart.c
@@ -407,7 +407,7 @@ static void efm32_uart_set_termios(struct uart_port *port,
        if (new->c_iflag & INPCK)
                port->read_status_mask |=
                        UARTn_RXDATAX_FERR | UARTn_RXDATAX_PERR;
-        if (new->c_iflag & (BRKINT | PARMRK))
+        if (new->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= SW_UARTn_RXDATAX_BERR;
        port->ignore_status_mask = 0;
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index c5eb897de9de..49385c86cfba 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -902,7 +902,7 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,
        sport->port.read_status_mask = 0;
        if (termios->c_iflag & INPCK)
                sport->port.read_status_mask |= (UARTSR1_FE | UARTSR1_PE);
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                sport->port.read_status_mask |= UARTSR1_FE;
        /* characters to ignore */
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index e2f93874989b..044e86d528ae 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -567,6 +567,9 @@ static void imx_start_tx(struct uart_port *port)
        struct imx_port *sport = (struct imx_port *)port;
        unsigned long temp;
+        if (uart_circ_empty(&port->state->xmit))
+                return;
        if (USE_IRDA(sport)) {
                /* half duplex in IrDA mode; have to disable receive mode */
                temp = readl(sport->port.membase + UCR4);
diff --git a/drivers/tty/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c
index 1d9420548e16..99b7b8697861 100644
--- a/drivers/tty/serial/ip22zilog.c
+++ b/drivers/tty/serial/ip22zilog.c
@@ -603,6 +603,8 @@ static void ip22zilog_start_tx(struct uart_port *port)
        } else {
                struct circ_buf *xmit = &port->state->xmit;
+                if (uart_circ_empty(xmit))
+                        return;
                writeb(xmit->buf[xmit->tail], &channel->data);
                ZSDELAY();
                ZS_WSYNC(channel);
@@ -850,7 +852,7 @@ ip22zilog_convert_to_zs(struct uart_ip22zilog_port *up, unsigned int cflag,
        up->port.read_status_mask = Rx_OVR;
        if (iflag & INPCK)
                up->port.read_status_mask |= CRC_ERR | PAR_ERR;
-        if (iflag & (BRKINT | PARMRK))
+        if (iflag & (IGNBRK | BRKINT | PARMRK))
                up->port.read_status_mask |= BRK_ABRT;
        up->port.ignore_status_mask = 0;
diff --git a/drivers/tty/serial/m32r_sio.c b/drivers/tty/serial/m32r_sio.c
index 9cd9b4eba9fc..5702828fb62e 100644
--- a/drivers/tty/serial/m32r_sio.c
+++ b/drivers/tty/serial/m32r_sio.c
@@ -266,9 +266,11 @@ static void m32r_sio_start_tx(struct uart_port *port)
        if (!(up->ier & UART_IER_THRI)) {
                up->ier |= UART_IER_THRI;
                serial_out(up, UART_IER, up->ier);
-                serial_out(up, UART_TX, xmit->buf[xmit->tail]);
+                if (!uart_circ_empty(xmit)) {
-                xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+                        serial_out(up, UART_TX, xmit->buf[xmit->tail]);
-                up->port.icount.tx++;
+                        xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+                        up->port.icount.tx++;
+                }
        }
        while((serial_in(up, UART_LSR) & UART_EMPTY) != UART_EMPTY);
 #else
@@ -737,7 +739,7 @@ static void m32r_sio_set_termios(struct uart_port *port,
        up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
        if (termios->c_iflag & INPCK)
                up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                up->port.read_status_mask |= UART_LSR_BI;
        /*
diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index 2a99d0c61b9e..ba285cd45b59 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -835,7 +835,7 @@ static void max310x_set_termios(struct uart_port *port,
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= MAX310X_LSR_RXPAR_BIT |
                                          MAX310X_LSR_FRERR_BIT;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= MAX310X_LSR_RXBRK_BIT;
        /* Set status ignore mask */
diff --git a/drivers/tty/serial/mcf.c b/drivers/tty/serial/mcf.c
index 0edfaf8cd269..a6f085717f94 100644
--- a/drivers/tty/serial/mcf.c
+++ b/drivers/tty/serial/mcf.c
@@ -248,6 +248,12 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
                mr1 |= MCFUART_MR1_PARITYNONE;
        }
+        /*
+         * FIXME: port->read_status_mask and port->ignore_status_mask
+         * need to be initialized based on termios settings for
+         * INPCK, IGNBRK, IGNPAR, PARMRK, BRKINT
+         */
        if (termios->c_cflag & CSTOPB)
                mr2 |= MCFUART_MR2_STOP2;
        else
diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c
index 52c930fac210..445799dc9846 100644
--- a/drivers/tty/serial/mfd.c
+++ b/drivers/tty/serial/mfd.c
@@ -977,7 +977,7 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
        up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
        if (termios->c_iflag & INPCK)
                up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                up->port.read_status_mask |= UART_LSR_BI;
        /* Characters to ignore */
diff --git a/drivers/tty/serial/mpsc.c b/drivers/tty/serial/mpsc.c
index e30a3ca3cea3..759c6a6fa74a 100644
--- a/drivers/tty/serial/mpsc.c
+++ b/drivers/tty/serial/mpsc.c
@@ -1458,7 +1458,7 @@ static void mpsc_set_termios(struct uart_port *port, struct ktermios *termios,
                pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_PE
                        | SDMA_DESC_CMDSTAT_FR;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                pi->port.read_status_mask |= SDMA_DESC_CMDSTAT_BR;
        /* Characters/events to ignore */
diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
index 778e376f197e..72000a6d5af0 100644
--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -582,7 +582,7 @@ static void msm_set_termios(struct uart_port *port, struct ktermios *termios,
        port->read_status_mask = 0;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= UART_SR_PAR_FRAME_ERR;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= UART_SR_RX_BREAK;
        uart_update_timeout(port, termios->c_cflag, baud);
@@ -991,7 +991,7 @@ static const struct of_device_id msm_uartdm_table[] = {
        { }
 };
-static int __init msm_serial_probe(struct platform_device *pdev)
+static int msm_serial_probe(struct platform_device *pdev)
 {
        struct msm_port *msm_port;
        struct resource *resource;
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 4b5b3c2fe328..86de4477d98a 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -604,7 +604,7 @@ static void mxs_auart_settermios(struct uart_port *u,
        if (termios->c_iflag & INPCK)
                u->read_status_mask |= AUART_STAT_PERR;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                u->read_status_mask |= AUART_STAT_BERR;
        /*
diff --git a/drivers/tty/serial/netx-serial.c b/drivers/tty/serial/netx-serial.c
index 0a4dd70d29eb..7a6745601d4e 100644
--- a/drivers/tty/serial/netx-serial.c
+++ b/drivers/tty/serial/netx-serial.c
@@ -419,7 +419,7 @@ netx_set_termios(struct uart_port *port, struct ktermios *termios,
        }
        port->read_status_mask = 0;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= SR_BE;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= SR_PE | SR_FE;
diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index e9d420ff3931..f7ad5b903055 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -653,6 +653,8 @@ static void pmz_start_tx(struct uart_port *port)
        } else {
                struct circ_buf *xmit = &port->state->xmit;
+                if (uart_circ_empty(xmit))
+                        goto out;
                write_zsdata(uap, xmit->buf[xmit->tail]);
                zssync(uap);
                xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
@@ -661,6 +663,7 @@ static void pmz_start_tx(struct uart_port *port)
                if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                        uart_write_wakeup(&uap->port);
        }
+ out:
        pmz_debug("pmz: start_tx() done.\n");
 }
@@ -1092,7 +1095,7 @@ static void pmz_convert_to_zs(struct uart_pmac_port *uap, unsigned int cflag,
        uap->port.read_status_mask = Rx_OVR;
        if (iflag & INPCK)
                uap->port.read_status_mask |= CRC_ERR | PAR_ERR;
-        if (iflag & (BRKINT | PARMRK))
+        if (iflag & (IGNBRK | BRKINT | PARMRK))
                uap->port.read_status_mask |= BRK_ABRT;
        uap->port.ignore_status_mask = 0;
diff --git a/drivers/tty/serial/pnx8xxx_uart.c b/drivers/tty/serial/pnx8xxx_uart.c
index de6c05c63683..2ba24a45c97f 100644
--- a/drivers/tty/serial/pnx8xxx_uart.c
+++ b/drivers/tty/serial/pnx8xxx_uart.c
@@ -477,7 +477,7 @@ pnx8xxx_set_termios(struct uart_port *port, struct ktermios *termios,
                sport->port.read_status_mask |=
                        FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE) |
                        FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR);
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                sport->port.read_status_mask |=
                        ISTAT_TO_SM(PNX8XXX_UART_INT_BREAK);
diff --git a/drivers/tty/serial/pxa.c b/drivers/tty/serial/pxa.c
index 9e7ee39f8b2a..c638c53cd2b6 100644
--- a/drivers/tty/serial/pxa.c
+++ b/drivers/tty/serial/pxa.c
@@ -492,7 +492,7 @@ serial_pxa_set_termios(struct uart_port *port, struct ktermios *termios,
        up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
        if (termios->c_iflag & INPCK)
                up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                up->port.read_status_mask |= UART_LSR_BI;
        /*
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 329337711bb0..c1d3ebdf3b97 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -66,7 +66,7 @@ static void dbg(const char *fmt, ...)
        char buff[256];
        va_start(va, fmt);
-        vscnprintf(buff, sizeof(buf), fmt, va);
+        vscnprintf(buff, sizeof(buff), fmt, va);
        va_end(va);
        printascii(buff);
diff --git a/drivers/tty/serial/sb1250-duart.c b/drivers/tty/serial/sb1250-duart.c
index a7cdec2962dd..771f361c47ea 100644
--- a/drivers/tty/serial/sb1250-duart.c
+++ b/drivers/tty/serial/sb1250-duart.c
@@ -596,7 +596,7 @@ static void sbd_set_termios(struct uart_port *uport, struct ktermios *termios,
        if (termios->c_iflag & INPCK)
                uport->read_status_mask |= M_DUART_FRM_ERR |
                                           M_DUART_PARITY_ERR;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                uport->read_status_mask |= M_DUART_RCVD_BRK;
        uport->ignore_status_mask = 0;
diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
index 5443b46345ed..e84b6a3bdd18 100644
--- a/drivers/tty/serial/sccnxp.c
+++ b/drivers/tty/serial/sccnxp.c
@@ -665,7 +665,7 @@ static void sccnxp_set_termios(struct uart_port *port,
        port->read_status_mask = SR_OVR;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= SR_PE | SR_FE;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= SR_BRK;
        /* Set status ignore mask */
diff --git a/drivers/tty/serial/serial_ks8695.c b/drivers/tty/serial/serial_ks8695.c
index e1caa99e3d3b..5c79bdab985d 100644
--- a/drivers/tty/serial/serial_ks8695.c
+++ b/drivers/tty/serial/serial_ks8695.c
@@ -437,7 +437,7 @@ static void ks8695uart_set_termios(struct uart_port *port, struct ktermios *term
        port->read_status_mask = URLS_URROE;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= (URLS_URFE | URLS_URPE);
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= URLS_URBI;
        /*
diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
index 60f49b9d7e39..ea8546092c7e 100644
--- a/drivers/tty/serial/serial_txx9.c
+++ b/drivers/tty/serial/serial_txx9.c
@@ -697,7 +697,7 @@ serial_txx9_set_termios(struct uart_port *port, struct ktermios *termios,
                TXX9_SIDISR_TDIS | TXX9_SIDISR_RDIS;
        if (termios->c_iflag & INPCK)
                up->port.read_status_mask |= TXX9_SIDISR_UFER | TXX9_SIDISR_UPER;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                up->port.read_status_mask |= TXX9_SIDISR_UBRK;
        /*
diff --git a/drivers/tty/serial/sirfsoc_uart.c b/drivers/tty/serial/sirfsoc_uart.c
index 1f2be48c92ce..9b4d71cff00d 100644
--- a/drivers/tty/serial/sirfsoc_uart.c
+++ b/drivers/tty/serial/sirfsoc_uart.c
@@ -896,7 +896,7 @@ static void sirfsoc_uart_set_termios(struct uart_port *port,
                if (termios->c_iflag & INPCK)
                        port->read_status_mask |= uint_en->sirfsoc_frm_err_en;
        }
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                        port->read_status_mask |= uint_en->sirfsoc_rxd_brk_en;
        if (sirfport->uart_reg->uart_type == SIRF_REAL_UART) {
                if (termios->c_iflag & IGNPAR)
diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
index c7f61ac27132..f48b1cc07eea 100644
--- a/drivers/tty/serial/st-asc.c
+++ b/drivers/tty/serial/st-asc.c
@@ -547,7 +547,7 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,
        ascport->port.read_status_mask = ASC_RXBUF_DUMMY_OE;
        if (termios->c_iflag & INPCK)
                ascport->port.read_status_mask |= ASC_RXBUF_FE | ASC_RXBUF_PE;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                ascport->port.read_status_mask |= ASC_RXBUF_DUMMY_BE;
        /*
diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
index 5faa8e905e98..2f57df9a71d9 100644
--- a/drivers/tty/serial/sunsab.c
+++ b/drivers/tty/serial/sunsab.c
@@ -427,6 +427,9 @@ static void sunsab_start_tx(struct uart_port *port)
        struct circ_buf *xmit = &up->port.state->xmit;
        int i;
+        if (uart_circ_empty(xmit))
+                return;
        up->interrupt_mask1 &= ~(SAB82532_IMR1_ALLS|SAB82532_IMR1_XPR);
        writeb(up->interrupt_mask1, &up->regs->w.imr1);
        
@@ -719,7 +722,7 @@ static void sunsab_convert_to_sab(struct uart_sunsab_port *up, unsigned int cfla
        if (iflag & INPCK)
                up->port.read_status_mask |= (SAB82532_ISR0_PERR |
                                              SAB82532_ISR0_FERR);
-        if (iflag & (BRKINT | PARMRK))
+        if (iflag & (IGNBRK | BRKINT | PARMRK))
                up->port.read_status_mask |= (SAB82532_ISR1_BRK << 8);
        /*
diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
index 9a0f24f83720..5326ae195e5f 100644
--- a/drivers/tty/serial/sunsu.c
+++ b/drivers/tty/serial/sunsu.c
@@ -834,7 +834,7 @@ sunsu_change_speed(struct uart_port *port, unsigned int cflag,
        up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
        if (iflag & INPCK)
                up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
-        if (iflag & (BRKINT | PARMRK))
+        if (iflag & (IGNBRK | BRKINT | PARMRK))
                up->port.read_status_mask |= UART_LSR_BI;
        /*
diff --git a/drivers/tty/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c
index a2c40ed287d2..02df3940b95e 100644
--- a/drivers/tty/serial/sunzilog.c
+++ b/drivers/tty/serial/sunzilog.c
@@ -703,6 +703,8 @@ static void sunzilog_start_tx(struct uart_port *port)
        } else {
                struct circ_buf *xmit = &port->state->xmit;
+                if (uart_circ_empty(xmit))
+                        return;
                writeb(xmit->buf[xmit->tail], &channel->data);
                ZSDELAY();
                ZS_WSYNC(channel);
@@ -915,7 +917,7 @@ sunzilog_convert_to_zs(struct uart_sunzilog_port *up, unsigned int cflag,
        up->port.read_status_mask = Rx_OVR;
        if (iflag & INPCK)
                up->port.read_status_mask |= CRC_ERR | PAR_ERR;
-        if (iflag & (BRKINT | PARMRK))
+        if (iflag & (IGNBRK | BRKINT | PARMRK))
                up->port.read_status_mask |= BRK_ABRT;
        up->port.ignore_status_mask = 0;
diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
index d569ca58bab6..1c52074c38df 100644
--- a/drivers/tty/serial/ucc_uart.c
+++ b/drivers/tty/serial/ucc_uart.c
@@ -936,7 +936,7 @@ static void qe_uart_set_termios(struct uart_port *port,
        port->read_status_mask = BD_SC_EMPTY | BD_SC_OV;
        if (termios->c_iflag & INPCK)
                port->read_status_mask |= BD_SC_FR | BD_SC_PR;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= BD_SC_BR;
        /*
diff --git a/drivers/tty/serial/vr41xx_siu.c b/drivers/tty/serial/vr41xx_siu.c
index a63c14bc9a24..db0c8a4ab03e 100644
--- a/drivers/tty/serial/vr41xx_siu.c
+++ b/drivers/tty/serial/vr41xx_siu.c
@@ -559,7 +559,7 @@ static void siu_set_termios(struct uart_port *port, struct ktermios *new,
        port->read_status_mask = UART_LSR_THRE | UART_LSR_OE | UART_LSR_DR;
        if (c_iflag & INPCK)
                port->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
-        if (c_iflag & (BRKINT | PARMRK))
+        if (c_iflag & (IGNBRK | BRKINT | PARMRK))
                port->read_status_mask |= UART_LSR_BI;
        port->ignore_status_mask = 0;
diff --git a/drivers/tty/serial/zs.c b/drivers/tty/serial/zs.c
index 6a169877109b..2b65bb7ffb8a 100644
--- a/drivers/tty/serial/zs.c
+++ b/drivers/tty/serial/zs.c
@@ -923,7 +923,7 @@ static void zs_set_termios(struct uart_port *uport, struct ktermios *termios,
        uport->read_status_mask = Rx_OVR;
        if (termios->c_iflag & INPCK)
                uport->read_status_mask |= FRM_ERR | PAR_ERR;
-        if (termios->c_iflag & (BRKINT | PARMRK))
+        if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
                uport->read_status_mask |= Rx_BRK;
        uport->ignore_status_mask = 0;
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 5e0f6ff2e2f5..b33b00b386de 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -3226,8 +3226,7 @@ int do_unbind_con_driver(const struct consw *csw, int first, int last, int deflt
        for (i = 0; i < MAX_NR_CON_DRIVER; i++) {
                con_back = &registered_con_driver[i];
-                if (con_back->con &&
+                if (con_back->con && con_back->con != csw) {
-                    !(con_back->flag & CON_DRIVER_FLAG_MODULE)) {
                        defcsw = con_back->con;
                        retval = 0;
                        break;
@@ -3332,6 +3331,7 @@ static int vt_unbind(struct con_driver *con)
 {
        const struct consw *csw = NULL;
        int i, more = 1, first = -1, last = -1, deflt = 0;
+        int ret;
        if (!con->con || !(con->flag & CON_DRIVER_FLAG_MODULE) ||
            con_is_graphics(con->con, con->first, con->last))
@@ -3357,8 +3357,10 @@ static int vt_unbind(struct con_driver *con)
                if (first != -1) {
                        console_lock();
-                        do_unbind_con_driver(csw, first, last, deflt);
+                        ret = do_unbind_con_driver(csw, first, last, deflt);
                        console_unlock();
+                        if (ret != 0)
+                                return ret;
                }
                first = -1;
@@ -3645,17 +3647,20 @@ err:
 */
 int do_unregister_con_driver(const struct consw *csw)
 {
-        int i, retval = -ENODEV;
+        int i;
        /* cannot unregister a bound driver */
        if (con_is_bound(csw))
-                goto err;
+                return -EBUSY;
+        if (csw == conswitchp)
+                return -EINVAL;
        for (i = 0; i < MAX_NR_CON_DRIVER; i++) {
                struct con_driver *con_driver = &registered_con_driver[i];
                if (con_driver->con == csw &&
-                    con_driver->flag & CON_DRIVER_FLAG_MODULE) {
+                    con_driver->flag & CON_DRIVER_FLAG_INIT) {
                        vtconsole_deinit_device(con_driver);
                        device_destroy(vtconsole_class,
                                       MKDEV(0, con_driver->node));
@@ -3666,12 +3671,11 @@ int do_unregister_con_driver(const struct consw *csw)
                        con_driver->flag = 0;
                        con_driver->first = 0;
                        con_driver->last = 0;
-                        retval = 0;
+                        return 0;
-                        break;
                }
        }
-err:
-        return retval;
+        return -ENODEV;
 }
 EXPORT_SYMBOL_GPL(do_unregister_con_driver);
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index e371f5af11f5..a673e5b6a2e0 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -655,7 +655,7 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
        if (mem->addr & ~PAGE_MASK)
                return -ENODEV;
-        if (vma->vm_end - vma->vm_start > PAGE_ALIGN(mem->size))
+        if (vma->vm_end - vma->vm_start > mem->size)
                return -EINVAL;
        vma->vm_ops = &uio_physical_vm_ops;
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 69425b3cb6b7..b8125aa64ad8 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1169,8 +1169,8 @@ static int ep_enable(struct usb_ep *ep,
        if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
                cap |= QH_IOS;
-        if (hwep->num)
-                cap |= QH_ZLT;
+        cap |= QH_ZLT;
        cap |= (hwep->ep.maxpacket << __ffs(QH_MAX_PKT)) & QH_MAX_PKT;
        /*
         * For ISO-TX, we set mult at QH as the largest value, and use
@@ -1321,6 +1321,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
        struct ci_hw_ep  *hwep  = container_of(ep,  struct ci_hw_ep, ep);
        struct ci_hw_req *hwreq = container_of(req, struct ci_hw_req, req);
        unsigned long flags;
+        struct td_node *node, *tmpnode;
        if (ep == NULL || req == NULL || hwreq->req.status != -EALREADY ||
                hwep->ep.desc == NULL || list_empty(&hwreq->queue) ||
@@ -1331,6 +1332,12 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
        hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
+        list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
+                dma_pool_free(hwep->td_pool, node->ptr, node->dma);
+                list_del(&node->td);
+                kfree(node);
+        }
        /* pop request */
        list_del_init(&hwreq->queue);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 879b66e13370..0e950ad8cb25 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -889,6 +889,25 @@ static int hub_usb3_port_disable(struct usb_hub *hub, int port1)
        if (!hub_is_superspeed(hub->hdev))
                return -EINVAL;
+        ret = hub_port_status(hub, port1, &portstatus, &portchange);
+        if (ret < 0)
+                return ret;
+        /*
+         * USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI
+         * Controller [1022:7814] will have spurious result making the following
+         * usb 3.0 device hotplugging route to the 2.0 root hub and recognized
+         * as high-speed device if we set the usb 3.0 port link state to
+         * Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we
+         * check the state here to avoid the bug.
+         */
+        if ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+                                USB_SS_PORT_LS_RX_DETECT) {
+                dev_dbg(&hub->ports[port1 - 1]->dev,
+                         "Not disabling port; link state is RxDetect\n");
+                return ret;
+        }
        ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED);
        if (ret)
                return ret;
@@ -1526,18 +1545,6 @@ static int hub_configure(struct usb_hub *hub,
                dev_dbg(hub_dev, "%umA bus power budget for each child\n",
                                hub->mA_per_port);
-        /* Update the HCD's internal representation of this hub before khubd
-         * starts getting port status changes for devices under the hub.
-         */
-        if (hcd->driver->update_hub_device) {
-                ret = hcd->driver->update_hub_device(hcd, hdev,
-                                &hub->tt, GFP_KERNEL);
-                if (ret < 0) {
-                        message = "can't update HCD hub info";
-                        goto fail;
-                }
-        }
        ret = hub_hub_status(hub, &hubstatus, &hubchange);
        if (ret < 0) {
                message = "can't get hub status";
@@ -1589,10 +1596,28 @@ static int hub_configure(struct usb_hub *hub,
                }
        }
        hdev->maxchild = i;
+        for (i = 0; i < hdev->maxchild; i++) {
+                struct usb_port *port_dev = hub->ports[i];
+                pm_runtime_put(&port_dev->dev);
+        }
        mutex_unlock(&usb_port_peer_mutex);
        if (ret < 0)
                goto fail;
+        /* Update the HCD's internal representation of this hub before khubd
+         * starts getting port status changes for devices under the hub.
+         */
+        if (hcd->driver->update_hub_device) {
+                ret = hcd->driver->update_hub_device(hcd, hdev,
+                                &hub->tt, GFP_KERNEL);
+                if (ret < 0) {
+                        message = "can't update HCD hub info";
+                        goto fail;
+                }
+        }
        usb_hub_adjust_deviceremovable(hdev, hub->descriptor);
        hub_activate(hub, HUB_INIT);
@@ -3458,7 +3483,8 @@ static int hub_suspend(struct usb_interface *intf, pm_message_t msg)
                struct usb_device *udev = port_dev->child;
                if (udev && udev->can_submit) {
-                        dev_warn(&port_dev->dev, "not suspended yet\n");
+                        dev_warn(&port_dev->dev, "device %s not suspended yet\n",
+                                        dev_name(&udev->dev));
                        if (PMSG_IS_AUTO(msg))
                                return -EBUSY;
                }
diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h
index 0a7cdc0ef0a9..326308e53961 100644
--- a/drivers/usb/core/hub.h
+++ b/drivers/usb/core/hub.h
@@ -84,6 +84,7 @@ struct usb_hub {
 * @dev: generic device interface
 * @port_owner: port's owner
 * @peer: related usb2 and usb3 ports (share the same connector)
+ * @req: default pm qos request for hubs without port power control
 * @connect_type: port's connect type
 * @location: opaque representation of platform connector location
 * @status_lock: synchronize port_event() vs usb_port_{suspend|resume}
@@ -95,6 +96,7 @@ struct usb_port {
        struct device dev;
        struct usb_dev_state *port_owner;
        struct usb_port *peer;
+        struct dev_pm_qos_request *req;
        enum usb_port_connect_type connect_type;
        usb_port_location_t location;
        struct mutex status_lock;
diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
index 62036faf56c0..fe1b6d0967e3 100644
--- a/drivers/usb/core/port.c
+++ b/drivers/usb/core/port.c
@@ -21,6 +21,8 @@
 #include "hub.h"
+static int usb_port_block_power_off;
 static const struct attribute_group *port_dev_group[];
 static ssize_t connect_type_show(struct device *dev,
@@ -66,6 +68,7 @@ static void usb_port_device_release(struct device *dev)
 {
        struct usb_port *port_dev = to_usb_port(dev);
+        kfree(port_dev->req);
        kfree(port_dev);
 }
@@ -142,6 +145,9 @@ static int usb_port_runtime_suspend(struct device *dev)
                        == PM_QOS_FLAGS_ALL)
                return -EAGAIN;
+        if (usb_port_block_power_off)
+                return -EBUSY;
        usb_autopm_get_interface(intf);
        retval = usb_hub_set_port_power(hdev, hub, port1, false);
        usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_CONNECTION);
@@ -190,11 +196,19 @@ static int link_peers(struct usb_port *left, struct usb_port *right)
        if (left->peer || right->peer) {
                struct usb_port *lpeer = left->peer;
                struct usb_port *rpeer = right->peer;
+                char *method;
-                WARN(1, "failed to peer %s and %s (%s -> %p) (%s -> %p)\n",
-                        dev_name(&left->dev), dev_name(&right->dev),
+                if (left->location && left->location == right->location)
-                        dev_name(&left->dev), lpeer,
+                        method = "location";
-                        dev_name(&right->dev), rpeer);
+                else
+                        method = "default";
+                pr_warn("usb: failed to peer %s and %s by %s (%s:%s) (%s:%s)\n",
+                        dev_name(&left->dev), dev_name(&right->dev), method,
+                        dev_name(&left->dev),
+                        lpeer ? dev_name(&lpeer->dev) : "none",
+                        dev_name(&right->dev),
+                        rpeer ? dev_name(&rpeer->dev) : "none");
                return -EBUSY;
        }
@@ -251,6 +265,7 @@ static void link_peers_report(struct usb_port *left, struct usb_port *right)
                dev_warn(&left->dev, "failed to peer to %s (%d)\n",
                                dev_name(&right->dev), rc);
                pr_warn_once("usb: port power management may be unreliable\n");
+                usb_port_block_power_off = 1;
        }
 }
@@ -386,9 +401,13 @@ int usb_hub_create_port_device(struct usb_hub *hub, int port1)
        int retval;
        port_dev = kzalloc(sizeof(*port_dev), GFP_KERNEL);
-        if (!port_dev) {
+        if (!port_dev)
-                retval = -ENOMEM;
+                return -ENOMEM;
-                goto exit;
+        port_dev->req = kzalloc(sizeof(*(port_dev->req)), GFP_KERNEL);
+        if (!port_dev->req) {
+                kfree(port_dev);
+                return -ENOMEM;
        }
        hub->ports[port1 - 1] = port_dev;
@@ -404,31 +423,53 @@ int usb_hub_create_port_device(struct usb_hub *hub, int port1)
                        port1);
        mutex_init(&port_dev->status_lock);
        retval = device_register(&port_dev->dev);
-        if (retval)
+        if (retval) {
-                goto error_register;
+                put_device(&port_dev->dev);
+                return retval;
+        }
+        /* Set default policy of port-poweroff disabled. */
+        retval = dev_pm_qos_add_request(&port_dev->dev, port_dev->req,
+                        DEV_PM_QOS_FLAGS, PM_QOS_FLAG_NO_POWER_OFF);
+        if (retval < 0) {
+                device_unregister(&port_dev->dev);
+                return retval;
+        }
        find_and_link_peer(hub, port1);
+        /*
+         * Enable runtime pm and hold a refernce that hub_configure()
+         * will drop once the PM_QOS_NO_POWER_OFF flag state has been set
+         * and the hub has been fully registered (hdev->maxchild set).
+         */
        pm_runtime_set_active(&port_dev->dev);
+        pm_runtime_get_noresume(&port_dev->dev);
+        pm_runtime_enable(&port_dev->dev);
+        device_enable_async_suspend(&port_dev->dev);
        /*
-         * Do not enable port runtime pm if the hub does not support
+         * Keep hidden the ability to enable port-poweroff if the hub
-         * power switching.  Also, userspace must have final say of
+         * does not support power switching.
-         * whether a port is permitted to power-off.  Do not enable
-         * runtime pm if we fail to expose pm_qos_no_power_off.
         */
-        if (hub_is_port_power_switchable(hub)
+        if (!hub_is_port_power_switchable(hub))
-                        && dev_pm_qos_expose_flags(&port_dev->dev,
+                return 0;
-                        PM_QOS_FLAG_NO_POWER_OFF) == 0)
-                pm_runtime_enable(&port_dev->dev);
-        device_enable_async_suspend(&port_dev->dev);
+        /* Attempt to let userspace take over the policy. */
-        return 0;
+        retval = dev_pm_qos_expose_flags(&port_dev->dev,
+                        PM_QOS_FLAG_NO_POWER_OFF);
+        if (retval < 0) {
+                dev_warn(&port_dev->dev, "failed to expose pm_qos_no_poweroff\n");
+                return 0;
+        }
-error_register:
+        /* Userspace owns the policy, drop the kernel 'no_poweroff' request. */
-        put_device(&port_dev->dev);
+        retval = dev_pm_qos_remove_request(port_dev->req);
-exit:
+        if (retval >= 0) {
-        return retval;
+                kfree(port_dev->req);
+                port_dev->req = NULL;
+        }
+        return 0;
 }
 void usb_hub_remove_port_device(struct usb_hub *hub, int port1)
diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
index 8eb996e4f058..261c3b428220 100644
--- a/drivers/usb/dwc3/Kconfig
+++ b/drivers/usb/dwc3/Kconfig
@@ -45,6 +45,7 @@ comment "Platform Glue Driver Support"
 config USB_DWC3_OMAP
        tristate "Texas Instruments OMAP5 and similar Platforms"
        depends on EXTCON && (ARCH_OMAP2PLUS || COMPILE_TEST)
+        depends on OF
        default USB_DWC3
        help
          Some platforms from Texas Instruments like OMAP5, DRA7xxx and
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 4af4c3567656..07a736acd0f2 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -322,7 +322,7 @@ static int dwc3_omap_remove_core(struct device *dev, void *c)
 {
        struct platform_device *pdev = to_platform_device(dev);
-        platform_device_unregister(pdev);
+        of_device_unregister(pdev);
        return 0;
 }
@@ -599,7 +599,7 @@ static int dwc3_omap_prepare(struct device *dev)
 {
        struct dwc3_omap        *omap = dev_get_drvdata(dev);
-        dwc3_omap_disable_irqs(omap);
+        dwc3_omap_write_irqmisc_set(omap, 0x00);
        return 0;
 }
@@ -607,8 +607,19 @@ static int dwc3_omap_prepare(struct device *dev)
 static void dwc3_omap_complete(struct device *dev)
 {
        struct dwc3_omap        *omap = dev_get_drvdata(dev);
+        u32                     reg;
-        dwc3_omap_enable_irqs(omap);
+        reg = (USBOTGSS_IRQMISC_OEVT |
+                        USBOTGSS_IRQMISC_DRVVBUS_RISE |
+                        USBOTGSS_IRQMISC_CHRGVBUS_RISE |
+                        USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
+                        USBOTGSS_IRQMISC_IDPULLUP_RISE |
+                        USBOTGSS_IRQMISC_DRVVBUS_FALL |
+                        USBOTGSS_IRQMISC_CHRGVBUS_FALL |
+                        USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
+                        USBOTGSS_IRQMISC_IDPULLUP_FALL);
+        dwc3_omap_write_irqmisc_set(omap, reg);
 }
 static int dwc3_omap_suspend(struct device *dev)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 9d64dd02c57e..dab7927d1009 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -828,10 +828,6 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
                        length, last ? " last" : "",
                        chain ? " chain" : "");
-        /* Skip the LINK-TRB on ISOC */
-        if (((dep->free_slot & DWC3_TRB_MASK) == DWC3_TRB_NUM - 1) &&
-                        usb_endpoint_xfer_isoc(dep->endpoint.desc))
-                dep->free_slot++;
        trb = &dep->trb_pool[dep->free_slot & DWC3_TRB_MASK];
@@ -843,6 +839,10 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
        }
        dep->free_slot++;
+        /* Skip the LINK-TRB on ISOC */
+        if (((dep->free_slot & DWC3_TRB_MASK) == DWC3_TRB_NUM - 1) &&
+                        usb_endpoint_xfer_isoc(dep->endpoint.desc))
+                dep->free_slot++;
        trb->size = DWC3_TRB_SIZE_LENGTH(length);
        trb->bpl = lower_32_bits(dma);
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 2ddcd635ca2a..97142146eead 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1145,15 +1145,15 @@ static struct configfs_item_operations interf_item_ops = {
        .store_attribute        = usb_os_desc_attr_store,
 };
-static ssize_t rndis_grp_compatible_id_show(struct usb_os_desc *desc,
+static ssize_t interf_grp_compatible_id_show(struct usb_os_desc *desc,
-                                            char *page)
+                                             char *page)
 {
        memcpy(page, desc->ext_compat_id, 8);
        return 8;
 }
-static ssize_t rndis_grp_compatible_id_store(struct usb_os_desc *desc,
+static ssize_t interf_grp_compatible_id_store(struct usb_os_desc *desc,
-                                             const char *page, size_t len)
+                                              const char *page, size_t len)
 {
        int l;
@@ -1171,20 +1171,20 @@ static ssize_t rndis_grp_compatible_id_store(struct usb_os_desc *desc,
        return len;
 }
-static struct usb_os_desc_attribute rndis_grp_attr_compatible_id =
+static struct usb_os_desc_attribute interf_grp_attr_compatible_id =
        __CONFIGFS_ATTR(compatible_id, S_IRUGO | S_IWUSR,
-                        rndis_grp_compatible_id_show,
+                        interf_grp_compatible_id_show,
-                        rndis_grp_compatible_id_store);
+                        interf_grp_compatible_id_store);
-static ssize_t rndis_grp_sub_compatible_id_show(struct usb_os_desc *desc,
+static ssize_t interf_grp_sub_compatible_id_show(struct usb_os_desc *desc,
-                                                char *page)
+                                                 char *page)
 {
        memcpy(page, desc->ext_compat_id + 8, 8);
        return 8;
 }
-static ssize_t rndis_grp_sub_compatible_id_store(struct usb_os_desc *desc,
+static ssize_t interf_grp_sub_compatible_id_store(struct usb_os_desc *desc,
-                                                 const char *page, size_t len)
+                                                  const char *page, size_t len)
 {
        int l;
@@ -1202,20 +1202,21 @@ static ssize_t rndis_grp_sub_compatible_id_store(struct usb_os_desc *desc,
        return len;
 }
-static struct usb_os_desc_attribute rndis_grp_attr_sub_compatible_id =
+static struct usb_os_desc_attribute interf_grp_attr_sub_compatible_id =
        __CONFIGFS_ATTR(sub_compatible_id, S_IRUGO | S_IWUSR,
-                        rndis_grp_sub_compatible_id_show,
+                        interf_grp_sub_compatible_id_show,
-                        rndis_grp_sub_compatible_id_store);
+                        interf_grp_sub_compatible_id_store);
 static struct configfs_attribute *interf_grp_attrs[] = {
-        &rndis_grp_attr_compatible_id.attr,
+        &interf_grp_attr_compatible_id.attr,
-        &rndis_grp_attr_sub_compatible_id.attr,
+        &interf_grp_attr_sub_compatible_id.attr,
        NULL
 };
 int usb_os_desc_prepare_interf_dir(struct config_group *parent,
                                   int n_interf,
                                   struct usb_os_desc **desc,
+                                   char **names,
                                   struct module *owner)
 {
        struct config_group **f_default_groups, *os_desc_group,
@@ -1257,8 +1258,8 @@ int usb_os_desc_prepare_interf_dir(struct config_group *parent,
                d = desc[n_interf];
                d->owner = owner;
                config_group_init_type_name(&d->group, "", interface_type);
-                config_item_set_name(&d->group.cg_item, "interface.%d",
+                config_item_set_name(&d->group.cg_item, "interface.%s",
-                                     n_interf);
+                                     names[n_interf]);
                interface_groups[n_interf] = &d->group;
        }
diff --git a/drivers/usb/gadget/configfs.h b/drivers/usb/gadget/configfs.h
index a14ac792c698..36c468c4f5e9 100644
--- a/drivers/usb/gadget/configfs.h
+++ b/drivers/usb/gadget/configfs.h
@@ -8,6 +8,7 @@ void unregister_gadget_item(struct config_item *item);
 int usb_os_desc_prepare_interf_dir(struct config_group *parent,
                                   int n_interf,
                                   struct usb_os_desc **desc,
+                                   char **names,
                                   struct module *owner);
 static inline struct usb_os_desc *to_usb_os_desc(struct config_item *item)
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 74202d67f911..8598c27c7d43 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1483,11 +1483,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
        ffs->ep0req->context = ffs;
        lang = ffs->stringtabs;
-        for (lang = ffs->stringtabs; *lang; ++lang) {
+        if (lang) {
-                struct usb_string *str = (*lang)->strings;
+                for (; *lang; ++lang) {
-                int id = first_id;
+                        struct usb_string *str = (*lang)->strings;
-                for (; str->s; ++id, ++str)
+                        int id = first_id;
-                        str->id = id;
+                        for (; str->s; ++id, ++str)
+                                str->id = id;
+                }
        }
        ffs->gadget = cdev->gadget;
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index eed3ad878047..9c41e9515b8e 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -687,7 +687,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
                f->os_desc_table = kzalloc(sizeof(*f->os_desc_table),
                                           GFP_KERNEL);
                if (!f->os_desc_table)
-                        return PTR_ERR(f->os_desc_table);
+                        return -ENOMEM;
                f->os_desc_n = 1;
                f->os_desc_table[0].os_desc = &rndis_opts->rndis_os_desc;
        }
@@ -905,6 +905,7 @@ static struct usb_function_instance *rndis_alloc_inst(void)
 {
        struct f_rndis_opts *opts;
        struct usb_os_desc *descs[1];
+        char *names[1];
        opts = kzalloc(sizeof(*opts), GFP_KERNEL);
        if (!opts)
@@ -922,8 +923,9 @@ static struct usb_function_instance *rndis_alloc_inst(void)
        INIT_LIST_HEAD(&opts->rndis_os_desc.ext_prop);
        descs[0] = &opts->rndis_os_desc;
+        names[0] = "rndis";
        usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
-                                       THIS_MODULE);
+                                       names, THIS_MODULE);
        config_group_init_type_name(&opts->func_inst.group, "",
                                    &rndis_func_type);
diff --git a/drivers/usb/gadget/gr_udc.c b/drivers/usb/gadget/gr_udc.c
index 99a37ed03e27..c7004ee89c90 100644
--- a/drivers/usb/gadget/gr_udc.c
+++ b/drivers/usb/gadget/gr_udc.c
@@ -1532,8 +1532,9 @@ static int gr_ep_enable(struct usb_ep *_ep,
                        "%s mode: multiple trans./microframe not valid\n",
                        (mode == 2 ? "Bulk" : "Control"));
                return -EINVAL;
-        } else if (nt == 0x11) {
+        } else if (nt == 0x3) {
-                dev_err(dev->dev, "Invalid value for trans./microframe\n");
+                dev_err(dev->dev,
+                        "Invalid value 0x3 for additional trans./microframe\n");
                return -EINVAL;
        } else if ((nt + 1) * max > buffer_size) {
                dev_err(dev->dev, "Hw buffer size %d < max payload %d * %d\n",
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index ee6c16416c30..2e4ce7704908 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1264,8 +1264,13 @@ dev_release (struct inode *inode, struct file *fd)
        kfree (dev->buf);
        dev->buf = NULL;
-        put_dev (dev);
+        /* other endpoints were all decoupled from this device */
+        spin_lock_irq(&dev->lock);
+        dev->state = STATE_DEV_DISABLED;
+        spin_unlock_irq(&dev->lock);
+        put_dev (dev);
        return 0;
 }
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 3d78a8844e43..97b027724ee7 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -1120,7 +1120,10 @@ void gether_disconnect(struct gether *link)
        DBG(dev, "%s\n", __func__);
+        netif_tx_lock(dev->net);
        netif_stop_queue(dev->net);
+        netif_tx_unlock(dev->net);
        netif_carrier_off(dev->net);
        /* disable endpoints, forcing (synchronous) completion
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 61b7817bd66b..03314f861bee 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -176,7 +176,7 @@ config USB_EHCI_HCD_AT91
 config USB_EHCI_MSM
        tristate "Support for Qualcomm QSD/MSM on-chip EHCI USB controller"
-        depends on ARCH_MSM
+        depends on ARCH_MSM || ARCH_QCOM
        select USB_EHCI_ROOT_HUB_TT
        ---help---
          Enables support for the USB Host controller present on the
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 4a6d3dd68572..2f3acebb577a 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -656,6 +656,14 @@ static const struct dmi_system_id ehci_dmi_nohandoff_table[] = {
                        DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"),
                },
        },
+        {
+                /* HASEE E200 */
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "HASEE"),
+                        DMI_MATCH(DMI_BOARD_NAME, "E210"),
+                        DMI_MATCH(DMI_BIOS_VERSION, "6.00"),
+                },
+        },
        { }
 };
@@ -665,9 +673,14 @@ static void ehci_bios_handoff(struct pci_dev *pdev,
 {
        int try_handoff = 1, tried_handoff = 0;
-        /* The Pegatron Lucid tablet sporadically waits for 98 seconds trying
+        /*
-         * the handoff on its unused controller.  Skip it. */
+         * The Pegatron Lucid tablet sporadically waits for 98 seconds trying
-        if (pdev->vendor == 0x8086 && pdev->device == 0x283a) {
+         * the handoff on its unused controller.  Skip it.
+         *
+         * The HASEE E200 hangs when the semaphore is set (bugzilla #77021).
+         */
+        if (pdev->vendor == 0x8086 && (pdev->device == 0x283a ||
+                        pdev->device == 0x27cc)) {
                if (dmi_check_system(ehci_dmi_nohandoff_table))
                        try_handoff = 0;
        }
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 6231ce6aa0c3..aa79e8749040 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -22,6 +22,7 @@
 #include <linux/slab.h>
+#include <linux/device.h>
 #include <asm/unaligned.h>
 #include "xhci.h"
@@ -287,7 +288,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
                if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue) {
                        struct xhci_command *command;
                        command = xhci_alloc_command(xhci, false, false,
-                                                     GFP_NOIO);
+                                                     GFP_NOWAIT);
                        if (!command) {
                                spin_unlock_irqrestore(&xhci->lock, flags);
                                xhci_free_command(xhci, cmd);
@@ -1139,7 +1140,9 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                 * including the USB 3.0 roothub, but only if CONFIG_PM_RUNTIME
                 * is enabled, so also enable remote wake here.
                 */
-                if (hcd->self.root_hub->do_remote_wakeup) {
+                if (hcd->self.root_hub->do_remote_wakeup
+                                && device_may_wakeup(hcd->self.controller)) {
                        if (t1 & PORT_CONNECT) {
                                t2 |= PORT_WKOC_E | PORT_WKDISC_E;
                                t2 &= ~PORT_WKCONN_E;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index d67ff71209f5..749fc68eb5c1 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1433,8 +1433,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                xhci_handle_cmd_reset_ep(xhci, slot_id, cmd_trb, cmd_comp_code);
                break;
        case TRB_RESET_DEV:
-                WARN_ON(slot_id != TRB_TO_SLOT_ID(
+                /* SLOT_ID field in reset device cmd completion event TRB is 0.
-                                le32_to_cpu(cmd_trb->generic.field[3])));
+                 * Use the SLOT_ID from the command TRB instead (xhci 4.6.11)
+                 */
+                slot_id = TRB_TO_SLOT_ID(
+                                le32_to_cpu(cmd_trb->generic.field[3]));
                xhci_handle_cmd_reset_dev(xhci, slot_id, event);
                break;
        case TRB_NEC_GET_FW:
@@ -3534,7 +3537,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci,
                return 0;
        max_burst = urb->ep->ss_ep_comp.bMaxBurst;
-        return roundup(total_packet_count, max_burst + 1) - 1;
+        return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
 }
 /*
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2b8d9a24af09..7436d5f5e67a 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -936,7 +936,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
 */
 int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 {
-        u32                     command, temp = 0;
+        u32                     command, temp = 0, status;
        struct usb_hcd          *hcd = xhci_to_hcd(xhci);
        struct usb_hcd          *secondary_hcd;
        int                     retval = 0;
@@ -1054,8 +1054,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 done:
        if (retval == 0) {
-                usb_hcd_resume_root_hub(hcd);
+                /* Resume root hubs only when have pending events. */
-                usb_hcd_resume_root_hub(xhci->shared_hcd);
+                status = readl(&xhci->op_regs->status);
+                if (status & STS_EINT) {
+                        usb_hcd_resume_root_hub(hcd);
+                        usb_hcd_resume_root_hub(xhci->shared_hcd);
+                }
        }
        /*
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 51a6da256772..829f446064ea 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -7,7 +7,7 @@
 #include <linux/moduleparam.h>
 #include <linux/scatterlist.h>
 #include <linux/mutex.h>
+#include <linux/timer.h>
 #include <linux/usb.h>
 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
@@ -484,6 +484,14 @@ alloc_sglist(int nents, int max, int vary)
        return sg;
 }
+static void sg_timeout(unsigned long _req)
+{
+        struct usb_sg_request   *req = (struct usb_sg_request *) _req;
+        req->status = -ETIMEDOUT;
+        usb_sg_cancel(req);
+}
 static int perform_sglist(
        struct usbtest_dev      *tdev,
        unsigned                iterations,
@@ -495,6 +503,9 @@ static int perform_sglist(
 {
        struct usb_device       *udev = testdev_to_usbdev(tdev);
        int                     retval = 0;
+        struct timer_list       sg_timer;
+        setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
        while (retval == 0 && iterations-- > 0) {
                retval = usb_sg_init(req, udev, pipe,
@@ -505,7 +516,10 @@ static int perform_sglist(
                if (retval)
                        break;
+                mod_timer(&sg_timer, jiffies +
+                                msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
                usb_sg_wait(req);
+                del_timer_sync(&sg_timer);
                retval = req->status;
                /* FIXME check resulting data pattern */
diff --git a/drivers/usb/musb/musb_am335x.c b/drivers/usb/musb/musb_am335x.c
index d2353781bd2d..1e58ed2361cc 100644
--- a/drivers/usb/musb/musb_am335x.c
+++ b/drivers/usb/musb/musb_am335x.c
@@ -19,21 +19,6 @@ err:
        return ret;
 }
-static int of_remove_populated_child(struct device *dev, void *d)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        of_device_unregister(pdev);
-        return 0;
-}
-static int am335x_child_remove(struct platform_device *pdev)
-{
-        device_for_each_child(&pdev->dev, NULL, of_remove_populated_child);
-        pm_runtime_disable(&pdev->dev);
-        return 0;
-}
 static const struct of_device_id am335x_child_of_match[] = {
        { .compatible = "ti,am33xx-usb" },
        {  },
@@ -42,13 +27,17 @@ MODULE_DEVICE_TABLE(of, am335x_child_of_match);
 static struct platform_driver am335x_child_driver = {
        .probe          = am335x_child_probe,
-        .remove         = am335x_child_remove,
        .driver         = {
                .name   = "am335x-usb-childs",
                .of_match_table = am335x_child_of_match,
        },
 };
-module_platform_driver(am335x_child_driver);
+static int __init am335x_child_init(void)
+{
+        return platform_driver_register(&am335x_child_driver);
+}
+module_init(am335x_child_init);
 MODULE_DESCRIPTION("AM33xx child devices");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 61da471b7aed..eff3c5cf84f4 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -849,7 +849,7 @@ b_host:
        }
        /* handle babble condition */
-        if (int_usb & MUSB_INTR_BABBLE)
+        if (int_usb & MUSB_INTR_BABBLE && is_host_active(musb))
                schedule_work(&musb->recover_work);
 #if 0
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index 7b8bbf53127e..5341bb223b7c 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -318,7 +318,7 @@ static void cppi41_dma_callback(void *private_data)
                }
                list_add_tail(&cppi41_channel->tx_check,
                                &controller->early_tx_list);
-                if (!hrtimer_active(&controller->early_tx)) {
+                if (!hrtimer_is_queued(&controller->early_tx)) {
                        hrtimer_start_range_ns(&controller->early_tx,
                                ktime_set(0, 140 * NSEC_PER_USEC),
                                40 * NSEC_PER_USEC,
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 51beb13c7e1a..09529f94e72d 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -494,10 +494,9 @@ static int dsps_musb_set_mode(struct musb *musb, u8 mode)
        struct dsps_glue *glue = dev_get_drvdata(dev->parent);
        const struct dsps_musb_wrapper *wrp = glue->wrp;
        void __iomem *ctrl_base = musb->ctrl_base;
-        void __iomem *base = musb->mregs;
        u32 reg;
-        reg = dsps_readl(base, wrp->mode);
+        reg = dsps_readl(ctrl_base, wrp->mode);
        switch (mode) {
        case MUSB_HOST:
@@ -510,7 +509,7 @@ static int dsps_musb_set_mode(struct musb *musb, u8 mode)
                 */
                reg |= (1 << wrp->iddig_mux);
-                dsps_writel(base, wrp->mode, reg);
+                dsps_writel(ctrl_base, wrp->mode, reg);
                dsps_writel(ctrl_base, wrp->phy_utmi, 0x02);
                break;
        case MUSB_PERIPHERAL:
@@ -523,10 +522,10 @@ static int dsps_musb_set_mode(struct musb *musb, u8 mode)
                 */
                reg |= (1 << wrp->iddig_mux);
-                dsps_writel(base, wrp->mode, reg);
+                dsps_writel(ctrl_base, wrp->mode, reg);
                break;
        case MUSB_OTG:
-                dsps_writel(base, wrp->phy_utmi, 0x02);
+                dsps_writel(ctrl_base, wrp->phy_utmi, 0x02);
                break;
        default:
                dev_err(glue->dev, "unsupported mode %d\n", mode);
diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index c2e45e632723..f202e5088461 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -274,7 +274,6 @@ static int ux500_probe(struct platform_device *pdev)
        musb->dev.parent                = &pdev->dev;
        musb->dev.dma_mask              = &pdev->dev.coherent_dma_mask;
        musb->dev.coherent_dma_mask     = pdev->dev.coherent_dma_mask;
-        musb->dev.of_node               = pdev->dev.of_node;
        glue->dev                       = &pdev->dev;
        glue->musb                      = musb;
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index ced34f39bdd4..c929370cdaa6 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -1229,7 +1229,9 @@ static void msm_otg_sm_work(struct work_struct *w)
                        motg->chg_state = USB_CHG_STATE_UNDEFINED;
                        motg->chg_type = USB_INVALID_CHARGER;
                }
-                pm_runtime_put_sync(otg->phy->dev);
+                if (otg->phy->state == OTG_STATE_B_IDLE)
+                        pm_runtime_put_sync(otg->phy->dev);
                break;
        case OTG_STATE_B_PERIPHERAL:
                dev_dbg(otg->phy->dev, "OTG_STATE_B_PERIPHERAL state\n");
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index d49f9c326035..4fd36530bfa3 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -681,6 +681,14 @@ usbhs_fifo_read_end:
                usbhs_pipe_number(pipe),
                pkt->length, pkt->actual, *is_done, pkt->zero);
+        /*
+         * Transmission end
+         */
+        if (*is_done) {
+                if (usbhs_pipe_is_dcp(pipe))
+                        usbhs_dcp_control_transfer_done(pipe);
+        }
 usbhs_fifo_read_busy:
        usbhsf_fifo_unselect(pipe, fifo);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 762e4a5f5ae9..330df5ce435b 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -153,6 +153,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
        { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
        { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+        { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
        { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
        { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
        { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index edf3b124583c..8a3813be1b28 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -720,7 +720,8 @@ static const struct usb_device_id id_table_combined[] = {
        { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
-        { USB_DEVICE(TESTO_VID, TESTO_USB_INTERFACE_PID) },
+        { USB_DEVICE(TESTO_VID, TESTO_1_PID) },
+        { USB_DEVICE(TESTO_VID, TESTO_3_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_GAMMA_SCOUT_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13M_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13S_PID) },
@@ -944,6 +945,8 @@ static const struct usb_device_id id_table_combined[] = {
        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+        /* Infineon Devices */
+        { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
        { }                                     /* Terminating entry */
 };
@@ -1566,14 +1569,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port)
        struct usb_device *udev = serial->dev;
        struct usb_interface *interface = serial->interface;
-        struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
+        struct usb_endpoint_descriptor *ep_desc;
        unsigned num_endpoints;
-        int i;
+        unsigned i;
        num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
        dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
+        if (!num_endpoints)
+                return;
        /* NOTE: some customers have programmed FT232R/FT245R devices
         * with an endpoint size of 0 - not good.  In this case, we
         * want to override the endpoint descriptor setting and use a
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 500474c48f4b..c4777bc6aee0 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -584,6 +584,12 @@
 #define RATOC_PRODUCT_ID_USB60F 0xb020
 /*
+ * Infineon Technologies
+ */
+#define INFINEON_VID            0x058b
+#define INFINEON_TRIBOARD_PID   0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
+/*
 * Acton Research Corp.
 */
 #define ACTON_VID               0x0647  /* Vendor ID */
@@ -798,7 +804,8 @@
 * Submitted by Colin Leroy
 */
 #define TESTO_VID                       0x128D
-#define TESTO_USB_INTERFACE_PID         0x0001
+#define TESTO_1_PID                     0x0001
+#define TESTO_3_PID                     0x0003
 /*
 * Mobility Electronics products.
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 59c3108cc136..a9688940543d 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -352,6 +352,9 @@ static void option_instat_callback(struct urb *urb);
 /* Zoom */
 #define ZOOM_PRODUCT_4597                       0x9607
+/* SpeedUp SU9800 usb 3g modem */
+#define SPEEDUP_PRODUCT_SU9800                  0x9800
 /* Haier products */
 #define HAIER_VENDOR_ID                         0x201e
 #define HAIER_PRODUCT_CE100                     0x2009
@@ -372,8 +375,12 @@ static void option_instat_callback(struct urb *urb);
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID                      0x0b3c
 #define OLIVETTI_PRODUCT_OLICARD100             0xc000
+#define OLIVETTI_PRODUCT_OLICARD120             0xc001
+#define OLIVETTI_PRODUCT_OLICARD140             0xc002
 #define OLIVETTI_PRODUCT_OLICARD145             0xc003
+#define OLIVETTI_PRODUCT_OLICARD155             0xc004
 #define OLIVETTI_PRODUCT_OLICARD200             0xc005
+#define OLIVETTI_PRODUCT_OLICARD160             0xc00a
 #define OLIVETTI_PRODUCT_OLICARD500             0xc00b
 /* Celot products */
@@ -1480,6 +1487,8 @@ static const struct usb_device_id option_ids[] = {
                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff),  /* ZTE MF91 */
                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff),  /* Telewell TW-LTE 4G v2 */
+                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
@@ -1577,6 +1586,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
          .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
        },
+        { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
        { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
        { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
        { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
@@ -1611,15 +1621,21 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
-        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155),
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
-                .driver_info = (kernel_ulong_t)&net_intf6_blacklist
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
-        },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160),
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
-                .driver_info = (kernel_ulong_t)&net_intf4_blacklist
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
-        },
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 9d38ddc8da49..866b5df36ed1 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -256,6 +256,10 @@ static int slave_configure(struct scsi_device *sdev)
                if (us->fflags & US_FL_WRITE_CACHE)
                        sdev->wce_default_on = 1;
+                /* A few buggy USB-ATA bridges don't understand FUA */
+                if (us->fflags & US_FL_BROKEN_FUA)
+                        sdev->broken_fua = 1;
        } else {
                /* Non-disk-type devices don't need to blacklist any pages
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 174a447868cd..80a5b366255f 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1936,6 +1936,13 @@ UNUSUAL_DEV(  0x14cd, 0x6600, 0x0201, 0x0201,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_IGNORE_RESIDUE ),
+/* Reported by Michael Büsch <m@bues.ch> */
+UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0114,
+                "JMicron",
+                "USB to ATA/ATAPI Bridge",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA ),
 /* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
 * JMicron responds to USN and several other SCSI ioctls with a
 * residue that causes subsequent I/O requests to fail.  */
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 971a760af4a1..8dae2f724a35 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -700,14 +700,6 @@ static void handle_rx_net(struct vhost_work *work)
        handle_rx(net);
 }
-static void vhost_net_free(void *addr)
-{
-        if (is_vmalloc_addr(addr))
-                vfree(addr);
-        else
-                kfree(addr);
-}
 static int vhost_net_open(struct inode *inode, struct file *f)
 {
        struct vhost_net *n;
@@ -723,7 +715,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
        }
        vqs = kmalloc(VHOST_NET_VQ_MAX * sizeof(*vqs), GFP_KERNEL);
        if (!vqs) {
-                vhost_net_free(n);
+                kvfree(n);
                return -ENOMEM;
        }
@@ -840,7 +832,7 @@ static int vhost_net_release(struct inode *inode, struct file *f)
         * since jobs can re-queue themselves. */
        vhost_net_flush(n);
        kfree(n->dev.vqs);
-        vhost_net_free(n);
+        kvfree(n);
        return 0;
 }
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 4f4ffa4c604e..69906cacd04f 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1503,14 +1503,6 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
        return 0;
 }
-static void vhost_scsi_free(struct vhost_scsi *vs)
-{
-        if (is_vmalloc_addr(vs))
-                vfree(vs);
-        else
-                kfree(vs);
-}
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
        struct vhost_scsi *vs;
@@ -1550,7 +1542,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
        return 0;
 err_vqs:
-        vhost_scsi_free(vs);
+        kvfree(vs);
 err_vs:
        return r;
 }
@@ -1569,7 +1561,7 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
        /* Jobs can re-queue themselves in evt kick handler. Do extra flush. */
        vhost_scsi_flush(vs);
        kfree(vs->dev.vqs);
-        vhost_scsi_free(vs);
+        kvfree(vs);
        return 0;
 }
diff --git a/drivers/video/console/dummycon.c b/drivers/video/console/dummycon.c
index b63860f7beab..40bec8d64b0a 100644
--- a/drivers/video/console/dummycon.c
+++ b/drivers/video/console/dummycon.c
@@ -77,3 +77,4 @@ const struct consw dummy_con = {
    .con_set_palette =  DUMMY,
    .con_scrolldelta =  DUMMY,
 };
+EXPORT_SYMBOL_GPL(dummy_con);
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index f267284b423b..6e6aa704fe84 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -1441,5 +1441,6 @@ const struct consw vga_con = {
        .con_build_attr = vgacon_build_attr,
        .con_invert_region = vgacon_invert_region,
 };
+EXPORT_SYMBOL(vga_con);
 MODULE_LICENSE("GPL");
diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index e683b6ef9594..d36e830d6fc6 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1057,6 +1057,7 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
                goto put_display_node;
        }
+        INIT_LIST_HEAD(&pdata->pwr_gpios);
        ret = -ENOMEM;
        for (i = 0; i < of_gpio_named_count(display_np, "atmel,power-control-gpio"); i++) {
                gpio = of_get_named_gpio_flags(display_np, "atmel,power-control-gpio",
@@ -1082,6 +1083,7 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
                        dev_err(dev, "set direction output gpio %d failed\n", gpio);
                        goto put_display_node;
                }
+                list_add(&og->list, &pdata->pwr_gpios);
        }
        if (is_gpio_power)
diff --git a/drivers/video/fbdev/bfin_adv7393fb.c b/drivers/video/fbdev/bfin_adv7393fb.c
index a54f7f7d763b..8fe41caac38e 100644
--- a/drivers/video/fbdev/bfin_adv7393fb.c
+++ b/drivers/video/fbdev/bfin_adv7393fb.c
@@ -408,7 +408,7 @@ static int bfin_adv7393_fb_probe(struct i2c_client *client,
        /* Workaround "PPI Does Not Start Properly In Specific Mode" */
        if (ANOMALY_05000400) {
                ret = gpio_request_one(P_IDENT(P_PPI0_FS3), GPIOF_OUT_INIT_LOW,
-                                        "PPI0_FS3")
+                                        "PPI0_FS3");
                if (ret) {
                        dev_err(&client->dev, "PPI0_FS3 GPIO request failed\n");
                        ret = -EBUSY;
diff --git a/drivers/video/fbdev/offb.c b/drivers/video/fbdev/offb.c
index 7d44d669d5b6..43a0a52fc527 100644
--- a/drivers/video/fbdev/offb.c
+++ b/drivers/video/fbdev/offb.c
@@ -91,15 +91,6 @@ extern boot_infos_t *boot_infos;
 #define AVIVO_DC_LUTB_WHITE_OFFSET_GREEN        0x6cd4
 #define AVIVO_DC_LUTB_WHITE_OFFSET_RED          0x6cd8
-#define FB_RIGHT_POS(p, bpp)         (fb_be_math(p) ? 0 : (32 - (bpp)))
-static inline u32 offb_cmap_byteswap(struct fb_info *info, u32 value)
-{
-        u32 bpp = info->var.bits_per_pixel;
-        return cpu_to_be32(value) >> FB_RIGHT_POS(info, bpp);
-}
    /*
     *  Set a single color register. The values supplied are already
     *  rounded down to the hardware's capabilities (according to the
@@ -129,7 +120,7 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                        mask <<= info->var.transp.offset;
                        value |= mask;
                }
-                pal[regno] = offb_cmap_byteswap(info, value);
+                pal[regno] = value;
                return 0;
        }
diff --git a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
index 99af9e88b2d8..2f0822ee3ff9 100644
--- a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
+++ b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
@@ -121,9 +121,11 @@ static void __init omapdss_add_to_list(struct device_node *node, bool root)
 {
        struct dss_conv_node *n = kmalloc(sizeof(struct dss_conv_node),
                GFP_KERNEL);
-        n->node = node;
+        if (n) {
-        n->root = root;
+                n->node = node;
-        list_add(&n->list, &dss_conv_list);
+                n->root = root;
+                list_add(&n->list, &dss_conv_list);
+        }
 }
 static bool __init omapdss_list_contains(const struct device_node *node)
diff --git a/drivers/video/fbdev/vt8500lcdfb.c b/drivers/video/fbdev/vt8500lcdfb.c
index a8f2b280f796..a1134c3f6c11 100644
--- a/drivers/video/fbdev/vt8500lcdfb.c
+++ b/drivers/video/fbdev/vt8500lcdfb.c
@@ -474,8 +474,6 @@ static int vt8500lcd_remove(struct platform_device *pdev)
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        release_mem_region(res->start, resource_size(res));
-        kfree(fbi);
        return 0;
 }
diff --git a/drivers/w1/masters/mxc_w1.c b/drivers/w1/masters/mxc_w1.c
index 67b067a3e2ab..a5df5e89d456 100644
--- a/drivers/w1/masters/mxc_w1.c
+++ b/drivers/w1/masters/mxc_w1.c
@@ -66,7 +66,7 @@ static u8 mxc_w1_ds2_reset_bus(void *data)
                udelay(100);
        }
-        return !!(reg_val & MXC_W1_CONTROL_PST);
+        return !(reg_val & MXC_W1_CONTROL_PST);
 }
 /*
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index c845527b503a..76dd54122f76 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1280,14 +1280,17 @@ config WATCHDOG_RTAS
 # S390 Architecture
-config ZVM_WATCHDOG
+config DIAG288_WATCHDOG
-        tristate "z/VM Watchdog Timer"
+        tristate "System z diag288 Watchdog"
        depends on S390
+        select WATCHDOG_CORE
        help
          IBM s/390 and zSeries machines running under z/VM 5.1 or later
          provide a virtual watchdog timer to their guest that cause a
          user define Control Program command to be executed after a
          timeout.
+          LPAR provides a very similar interface. This driver handles
+          both.
          To compile this driver as a module, choose M here. The module
          will be called vmwatchdog.
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index 7b8a91ed20e7..468c3204c3b1 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -153,6 +153,7 @@ obj-$(CONFIG_MEN_A21_WDT) += mena21_wdt.o
 obj-$(CONFIG_WATCHDOG_RTAS) += wdrtas.o
 # S390 Architecture
+obj-$(CONFIG_DIAG288_WATCHDOG) += diag288_wdt.o
 # SUPERH (sh + sh64) Architecture
 obj-$(CONFIG_SH_WDT) += shwdt.o
diff --git a/drivers/watchdog/diag288_wdt.c b/drivers/watchdog/diag288_wdt.c
new file mode 100644
index 000000000000..429494b6c822
--- /dev/null
+++ b/drivers/watchdog/diag288_wdt.c
@@ -0,0 +1,316 @@
+/*
+ * Watchdog driver for z/VM and LPAR using the diag 288 interface.
+ *
+ * Under z/VM, expiration of the watchdog will send a "system restart" command
+ * to CP.
+ *
+ * The command can be altered using the module parameter "cmd". This is
+ * not recommended because it's only supported on z/VM but not whith LPAR.
+ *
+ * On LPAR, the watchdog will always trigger a system restart. the module
+ * paramter cmd is meaningless here.
+ *
+ *
+ * Copyright IBM Corp. 2004, 2013
+ * Author(s): Arnd Bergmann (arndb@de.ibm.com)
+ *            Philipp Hachtmann (phacht@de.ibm.com)
+ *
+ */
+#define KMSG_COMPONENT "diag288_wdt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/slab.h>
+#include <linux/miscdevice.h>
+#include <linux/watchdog.h>
+#include <linux/suspend.h>
+#include <asm/ebcdic.h>
+#include <linux/io.h>
+#include <linux/uaccess.h>
+#define MAX_CMDLEN 240
+#define DEFAULT_CMD "SYSTEM RESTART"
+#define MIN_INTERVAL 15     /* Minimal time supported by diag88 */
+#define MAX_INTERVAL 3600   /* One hour should be enough - pure estimation */
+#define WDT_DEFAULT_TIMEOUT 30
+/* Function codes - init, change, cancel */
+#define WDT_FUNC_INIT 0
+#define WDT_FUNC_CHANGE 1
+#define WDT_FUNC_CANCEL 2
+#define WDT_FUNC_CONCEAL 0x80000000
+/* Action codes for LPAR watchdog */
+#define LPARWDT_RESTART 0
+static char wdt_cmd[MAX_CMDLEN] = DEFAULT_CMD;
+static bool conceal_on;
+static bool nowayout_info = WATCHDOG_NOWAYOUT;
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Arnd Bergmann <arndb@de.ibm.com>");
+MODULE_AUTHOR("Philipp Hachtmann <phacht@de.ibm.com>");
+MODULE_DESCRIPTION("System z diag288  Watchdog Timer");
+module_param_string(cmd, wdt_cmd, MAX_CMDLEN, 0644);
+MODULE_PARM_DESC(cmd, "CP command that is run when the watchdog triggers (z/VM only)");
+module_param_named(conceal, conceal_on, bool, 0644);
+MODULE_PARM_DESC(conceal, "Enable the CONCEAL CP option while the watchdog is active (z/VM only)");
+module_param_named(nowayout, nowayout_info, bool, 0444);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default = CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("vmwatchdog");
+static int __diag288(unsigned int func, unsigned int timeout,
+                     unsigned long action, unsigned int len)
+{
+        register unsigned long __func asm("2") = func;
+        register unsigned long __timeout asm("3") = timeout;
+        register unsigned long __action asm("4") = action;
+        register unsigned long __len asm("5") = len;
+        int err;
+        err = -EINVAL;
+        asm volatile(
+                "       diag    %1, %3, 0x288\n"
+                "0:     la      %0, 0\n"
+                "1:\n"
+                EX_TABLE(0b, 1b)
+                : "+d" (err) : "d"(__func), "d"(__timeout),
+                  "d"(__action), "d"(__len) : "1", "cc");
+        return err;
+}
+static int __diag288_vm(unsigned int  func, unsigned int timeout,
+                        char *cmd, size_t len)
+{
+        return __diag288(func, timeout, virt_to_phys(cmd), len);
+}
+static int __diag288_lpar(unsigned int func, unsigned int timeout,
+                          unsigned long action)
+{
+        return __diag288(func, timeout, action, 0);
+}
+static int wdt_start(struct watchdog_device *dev)
+{
+        char *ebc_cmd;
+        size_t len;
+        int ret;
+        unsigned int func;
+        ret = -ENODEV;
+        if (MACHINE_IS_VM) {
+                ebc_cmd = kmalloc(MAX_CMDLEN, GFP_KERNEL);
+                if (!ebc_cmd)
+                        return -ENOMEM;
+                len = strlcpy(ebc_cmd, wdt_cmd, MAX_CMDLEN);
+                ASCEBC(ebc_cmd, MAX_CMDLEN);
+                EBC_TOUPPER(ebc_cmd, MAX_CMDLEN);
+                func = conceal_on ? (WDT_FUNC_INIT | WDT_FUNC_CONCEAL)
+                        : WDT_FUNC_INIT;
+                ret = __diag288_vm(func, dev->timeout, ebc_cmd, len);
+                WARN_ON(ret != 0);
+                kfree(ebc_cmd);
+        }
+        if (MACHINE_IS_LPAR) {
+                ret = __diag288_lpar(WDT_FUNC_INIT,
+                                     dev->timeout, LPARWDT_RESTART);
+        }
+        if (ret) {
+                pr_err("The watchdog cannot be activated\n");
+                return ret;
+        }
+        pr_info("The watchdog was activated\n");
+        return 0;
+}
+static int wdt_stop(struct watchdog_device *dev)
+{
+        int ret;
+        ret = __diag288(WDT_FUNC_CANCEL, 0, 0, 0);
+        pr_info("The watchdog was deactivated\n");
+        return ret;
+}
+static int wdt_ping(struct watchdog_device *dev)
+{
+        char *ebc_cmd;
+        size_t len;
+        int ret;
+        unsigned int func;
+        ret = -ENODEV;
+        if (MACHINE_IS_VM) {
+                ebc_cmd = kmalloc(MAX_CMDLEN, GFP_KERNEL);
+                if (!ebc_cmd)
+                        return -ENOMEM;
+                len = strlcpy(ebc_cmd, wdt_cmd, MAX_CMDLEN);
+                ASCEBC(ebc_cmd, MAX_CMDLEN);
+                EBC_TOUPPER(ebc_cmd, MAX_CMDLEN);
+                /*
+                 * It seems to be ok to z/VM to use the init function to
+                 * retrigger the watchdog. On LPAR WDT_FUNC_CHANGE must
+                 * be used when the watchdog is running.
+                 */
+                func = conceal_on ? (WDT_FUNC_INIT | WDT_FUNC_CONCEAL)
+                        : WDT_FUNC_INIT;
+                ret = __diag288_vm(func, dev->timeout, ebc_cmd, len);
+                WARN_ON(ret != 0);
+                kfree(ebc_cmd);
+        }
+        if (MACHINE_IS_LPAR)
+                ret = __diag288_lpar(WDT_FUNC_CHANGE, dev->timeout, 0);
+        if (ret)
+                pr_err("The watchdog timer cannot be started or reset\n");
+        return ret;
+}
+static int wdt_set_timeout(struct watchdog_device * dev, unsigned int new_to)
+{
+        dev->timeout = new_to;
+        return wdt_ping(dev);
+}
+static struct watchdog_ops wdt_ops = {
+        .owner = THIS_MODULE,
+        .start = wdt_start,
+        .stop = wdt_stop,
+        .ping = wdt_ping,
+        .set_timeout = wdt_set_timeout,
+};
+static struct watchdog_info wdt_info = {
+        .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE,
+        .firmware_version = 0,
+        .identity = "z Watchdog",
+};
+static struct watchdog_device wdt_dev = {
+        .parent = NULL,
+        .info = &wdt_info,
+        .ops = &wdt_ops,
+        .bootstatus = 0,
+        .timeout = WDT_DEFAULT_TIMEOUT,
+        .min_timeout = MIN_INTERVAL,
+        .max_timeout = MAX_INTERVAL,
+};
+/*
+ * It makes no sense to go into suspend while the watchdog is running.
+ * Depending on the memory size, the watchdog might trigger, while we
+ * are still saving the memory.
+ * We reuse the open flag to ensure that suspend and watchdog open are
+ * exclusive operations
+ */
+static int wdt_suspend(void)
+{
+        if (test_and_set_bit(WDOG_DEV_OPEN, &wdt_dev.status)) {
+                pr_err("Linux cannot be suspended while the watchdog is in use\n");
+                return notifier_from_errno(-EBUSY);
+        }
+        if (test_bit(WDOG_ACTIVE, &wdt_dev.status)) {
+                clear_bit(WDOG_DEV_OPEN, &wdt_dev.status);
+                pr_err("Linux cannot be suspended while the watchdog is in use\n");
+                return notifier_from_errno(-EBUSY);
+        }
+        return NOTIFY_DONE;
+}
+static int wdt_resume(void)
+{
+        clear_bit(WDOG_DEV_OPEN, &wdt_dev.status);
+        return NOTIFY_DONE;
+}
+static int wdt_power_event(struct notifier_block *this, unsigned long event,
+                           void *ptr)
+{
+        switch (event) {
+        case PM_POST_HIBERNATION:
+        case PM_POST_SUSPEND:
+                return wdt_resume();
+        case PM_HIBERNATION_PREPARE:
+        case PM_SUSPEND_PREPARE:
+                return wdt_suspend();
+        default:
+                return NOTIFY_DONE;
+        }
+}
+static struct notifier_block wdt_power_notifier = {
+        .notifier_call = wdt_power_event,
+};
+static int __init diag288_init(void)
+{
+        int ret;
+        char ebc_begin[] = {
+                194, 197, 199, 201, 213
+        };
+        watchdog_set_nowayout(&wdt_dev, nowayout_info);
+        if (MACHINE_IS_VM) {
+                pr_info("The watchdog device driver detected a z/VM environment\n");
+                if (__diag288_vm(WDT_FUNC_INIT, 15,
+                                 ebc_begin, sizeof(ebc_begin)) != 0) {
+                        pr_err("The watchdog cannot be initialized\n");
+                        return -EINVAL;
+                }
+        } else if (MACHINE_IS_LPAR) {
+                pr_info("The watchdog device driver detected an LPAR environment\n");
+                if (__diag288_lpar(WDT_FUNC_INIT, 30, LPARWDT_RESTART)) {
+                        pr_err("The watchdog cannot be initialized\n");
+                        return -EINVAL;
+                }
+        } else {
+                pr_err("Linux runs in an environment that does not support the diag288 watchdog\n");
+                return -ENODEV;
+        }
+        if (__diag288_lpar(WDT_FUNC_CANCEL, 0, 0)) {
+                pr_err("The watchdog cannot be deactivated\n");
+                return -EINVAL;
+        }
+        ret = register_pm_notifier(&wdt_power_notifier);
+        if (ret)
+                return ret;
+        ret = watchdog_register_device(&wdt_dev);
+        if (ret)
+                unregister_pm_notifier(&wdt_power_notifier);
+        return ret;
+}
+static void __exit diag288_exit(void)
+{
+        watchdog_unregister_device(&wdt_dev);
+        unregister_pm_notifier(&wdt_power_notifier);
+}
+module_init(diag288_init);
+module_exit(diag288_exit);
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index b7a506f2bb14..5c660c77f03b 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -426,20 +426,18 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                 * p2m are consistent.
                 */
                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                        unsigned long p;
-                        struct page   *scratch_page = get_balloon_scratch_page();
                        if (!PageHighMem(page)) {
+                                struct page *scratch_page = get_balloon_scratch_page();
                                ret = HYPERVISOR_update_va_mapping(
                                                (unsigned long)__va(pfn << PAGE_SHIFT),
                                                pfn_pte(page_to_pfn(scratch_page),
                                                        PAGE_KERNEL_RO), 0);
                                BUG_ON(ret);
-                        }
-                        p = page_to_pfn(scratch_page);
-                        __set_phys_to_machine(pfn, pfn_to_mfn(p));
-                        put_balloon_scratch_page();
+                                put_balloon_scratch_page();
+                        }
+                        __set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
                }
 #endif
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 6d325bda76da..eeba7544f0cd 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1168,7 +1168,8 @@ int gnttab_resume(void)
 int gnttab_suspend(void)
 {
-        gnttab_interface->unmap_frames();
+        if (!xen_feature(XENFEAT_auto_translated_physmap))
+                gnttab_interface->unmap_frames();
        return 0;
 }
@@ -1194,18 +1195,20 @@ static int gnttab_expand(unsigned int req_entries)
 int gnttab_init(void)
 {
        int i;
+        unsigned long max_nr_grant_frames;
        unsigned int max_nr_glist_frames, nr_glist_frames;
        unsigned int nr_init_grefs;
        int ret;
        gnttab_request_version();
+        max_nr_grant_frames = gnttab_max_grant_frames();
        nr_grant_frames = 1;
        /* Determine the maximum number of frames required for the
         * grant reference free list on the current hypervisor.
         */
        BUG_ON(grefs_per_grant_frame == 0);
-        max_nr_glist_frames = (gnttab_max_grant_frames() *
+        max_nr_glist_frames = (max_nr_grant_frames *
                               grefs_per_grant_frame / RPP);
        gnttab_list = kmalloc(max_nr_glist_frames * sizeof(grant_ref_t *),
@@ -1222,6 +1225,11 @@ int gnttab_init(void)
                }
        }
+        ret = arch_gnttab_init(max_nr_grant_frames,
+                               nr_status_frames(max_nr_grant_frames));
+        if (ret < 0)
+                goto ini_nomem;
        if (gnttab_setup() < 0) {
                ret = -ENODEV;
                goto ini_nomem;
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index c3667b202f2f..5f1e1f3cd186 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -88,7 +88,6 @@ static int xen_suspend(void *data)
        if (!si->cancelled) {
                xen_irq_resume();
-                xen_console_resume();
                xen_timer_resume();
        }
@@ -135,6 +134,10 @@ static void do_suspend(void)
        err = stop_machine(xen_suspend, &si, cpumask_of(0));
+        /* Resume console as early as possible. */
+        if (!si.cancelled)
+                xen_console_resume();
        raw_notifier_call_chain(&xen_resume_notifier, 0, NULL);
        dpm_resume_start(si.cancelled ? PMSG_THAW : PMSG_RESTORE);