174 files changed, 1797 insertions, 1028 deletions
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index fd6c51cc3acb..5a74a9c1e42c 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -451,7 +451,6 @@ static void acpi_processor_remove(struct acpi_device *device)
        /* Clean up. */
        per_cpu(processor_device_array, pr->id) = NULL;
        per_cpu(processors, pr->id) = NULL;
-        try_offline_node(cpu_to_node(pr->id));
        /* Remove the CPU. */
        get_online_cpus();
@@ -459,6 +458,8 @@ static void acpi_processor_remove(struct acpi_device *device)
        acpi_unmap_lsapic(pr->id);
        put_online_cpus();
+        try_offline_node(cpu_to_node(pr->id));
 out:
        free_cpumask_var(pr->throttling.shared_cpu_map);
        kfree(pr);
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index f68095756fb7..408f6b2a5fa8 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -31,6 +31,7 @@ static LIST_HEAD(bus_type_list);
 static DECLARE_RWSEM(bus_type_sem);
 #define PHYSICAL_NODE_STRING "physical_node"
+#define PHYSICAL_NODE_NAME_SIZE (sizeof(PHYSICAL_NODE_STRING) + 10)
 int register_acpi_bus_type(struct acpi_bus_type *type)
 {
@@ -78,41 +79,108 @@ static struct acpi_bus_type *acpi_get_bus_type(struct device *dev)
        return ret;
 }
-static acpi_status do_acpi_find_child(acpi_handle handle, u32 lvl_not_used,
+static acpi_status acpi_dev_present(acpi_handle handle, u32 lvl_not_used,
-                                      void *addr_p, void **ret_p)
+                                  void *not_used, void **ret_p)
 {
-        unsigned long long addr, sta;
+        struct acpi_device *adev = NULL;
-        acpi_status status;
-        status = acpi_evaluate_integer(handle, METHOD_NAME__ADR, NULL, &addr);
+        acpi_bus_get_device(handle, &adev);
-        if (ACPI_SUCCESS(status) && addr == *((u64 *)addr_p)) {
+        if (adev) {
                *ret_p = handle;
-                status = acpi_bus_get_status_handle(handle, &sta);
+                return AE_CTRL_TERMINATE;
-                if (ACPI_SUCCESS(status) && (sta & ACPI_STA_DEVICE_ENABLED))
-                        return AE_CTRL_TERMINATE;
        }
        return AE_OK;
 }
-acpi_handle acpi_get_child(acpi_handle parent, u64 address)
+static bool acpi_extra_checks_passed(acpi_handle handle, bool is_bridge)
 {
-        void *ret = NULL;
+        unsigned long long sta;
+        acpi_status status;
+        status = acpi_bus_get_status_handle(handle, &sta);
+        if (ACPI_FAILURE(status) || !(sta & ACPI_STA_DEVICE_ENABLED))
+                return false;
+        if (is_bridge) {
+                void *test = NULL;
+                /* Check if this object has at least one child device. */
+                acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, 1,
+                                    acpi_dev_present, NULL, NULL, &test);
+                return !!test;
+        }
+        return true;
+}
+struct find_child_context {
+        u64 addr;
+        bool is_bridge;
+        acpi_handle ret;
+        bool ret_checked;
+};
+static acpi_status do_find_child(acpi_handle handle, u32 lvl_not_used,
+                                 void *data, void **not_used)
+{
+        struct find_child_context *context = data;
+        unsigned long long addr;
+        acpi_status status;
-        if (!parent)
+        status = acpi_evaluate_integer(handle, METHOD_NAME__ADR, NULL, &addr);
-                return NULL;
+        if (ACPI_FAILURE(status) || addr != context->addr)
+                return AE_OK;
-        acpi_walk_namespace(ACPI_TYPE_DEVICE, parent, 1, NULL,
+        if (!context->ret) {
-                            do_acpi_find_child, &address, &ret);
+                /* This is the first matching object.  Save its handle. */
-        return (acpi_handle)ret;
+                context->ret = handle;
+                return AE_OK;
+        }
+        /*
+         * There is more than one matching object with the same _ADR value.
+         * That really is unexpected, so we are kind of beyond the scope of the
+         * spec here.  We have to choose which one to return, though.
+         *
+         * First, check if the previously found object is good enough and return
+         * its handle if so.  Second, check the same for the object that we've
+         * just found.
+         */
+        if (!context->ret_checked) {
+                if (acpi_extra_checks_passed(context->ret, context->is_bridge))
+                        return AE_CTRL_TERMINATE;
+                else
+                        context->ret_checked = true;
+        }
+        if (acpi_extra_checks_passed(handle, context->is_bridge)) {
+                context->ret = handle;
+                return AE_CTRL_TERMINATE;
+        }
+        return AE_OK;
 }
-EXPORT_SYMBOL(acpi_get_child);
+acpi_handle acpi_find_child(acpi_handle parent, u64 addr, bool is_bridge)
+{
+        if (parent) {
+                struct find_child_context context = {
+                        .addr = addr,
+                        .is_bridge = is_bridge,
+                };
+                acpi_walk_namespace(ACPI_TYPE_DEVICE, parent, 1, do_find_child,
+                                    NULL, &context, NULL);
+                return context.ret;
+        }
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(acpi_find_child);
 int acpi_bind_one(struct device *dev, acpi_handle handle)
 {
        struct acpi_device *acpi_dev;
        acpi_status status;
        struct acpi_device_physical_node *physical_node, *pn;
-        char physical_node_name[sizeof(PHYSICAL_NODE_STRING) + 2];
+        char physical_node_name[PHYSICAL_NODE_NAME_SIZE];
+        struct list_head *physnode_list;
+        unsigned int node_id;
        int retval = -EINVAL;
        if (ACPI_HANDLE(dev)) {
@@ -139,25 +207,27 @@ int acpi_bind_one(struct device *dev, acpi_handle handle)
        mutex_lock(&acpi_dev->physical_node_lock);
-        /* Sanity check. */
+        /*
-        list_for_each_entry(pn, &acpi_dev->physical_node_list, node)
+         * Keep the list sorted by node_id so that the IDs of removed nodes can
+         * be recycled easily.
+         */
+        physnode_list = &acpi_dev->physical_node_list;
+        node_id = 0;
+        list_for_each_entry(pn, &acpi_dev->physical_node_list, node) {
+                /* Sanity check. */
                if (pn->dev == dev) {
                        dev_warn(dev, "Already associated with ACPI node\n");
                        goto err_free;
                }
+                if (pn->node_id == node_id) {
-        /* allocate physical node id according to physical_node_id_bitmap */
+                        physnode_list = &pn->node;
-        physical_node->node_id =
+                        node_id++;
-                find_first_zero_bit(acpi_dev->physical_node_id_bitmap,
+                }
-                ACPI_MAX_PHYSICAL_NODE);
-        if (physical_node->node_id >= ACPI_MAX_PHYSICAL_NODE) {
-                retval = -ENOSPC;
-                goto err_free;
        }
-        set_bit(physical_node->node_id, acpi_dev->physical_node_id_bitmap);
+        physical_node->node_id = node_id;
        physical_node->dev = dev;
-        list_add_tail(&physical_node->node, &acpi_dev->physical_node_list);
+        list_add(&physical_node->node, physnode_list);
        acpi_dev->physical_node_count++;
        mutex_unlock(&acpi_dev->physical_node_lock);
@@ -208,7 +278,7 @@ int acpi_unbind_one(struct device *dev)
        mutex_lock(&acpi_dev->physical_node_lock);
        list_for_each_safe(node, next, &acpi_dev->physical_node_list) {
-                char physical_node_name[sizeof(PHYSICAL_NODE_STRING) + 2];
+                char physical_node_name[PHYSICAL_NODE_NAME_SIZE];
                entry = list_entry(node, struct acpi_device_physical_node,
                        node);
@@ -216,7 +286,6 @@ int acpi_unbind_one(struct device *dev)
                        continue;
                list_del(node);
-                clear_bit(entry->node_id, acpi_dev->physical_node_id_bitmap);
                acpi_dev->physical_node_count--;
diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
index aa1227a7e3f2..04a13784dd20 100644
--- a/drivers/acpi/proc.c
+++ b/drivers/acpi/proc.c
@@ -311,6 +311,8 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
                           dev->pnp.bus_id,
                           (u32) dev->wakeup.sleep_state);
+                mutex_lock(&dev->physical_node_lock);
                if (!dev->physical_node_count) {
                        seq_printf(seq, "%c%-8s\n",
                                dev->wakeup.flags.run_wake ? '*' : ' ',
@@ -338,6 +340,8 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
                                put_device(ldev);
                        }
                }
+                mutex_unlock(&dev->physical_node_lock);
        }
        mutex_unlock(&acpi_device_lock);
        return 0;
@@ -347,12 +351,16 @@ static void physical_device_enable_wakeup(struct acpi_device *adev)
 {
        struct acpi_device_physical_node *entry;
+        mutex_lock(&adev->physical_node_lock);
        list_for_each_entry(entry,
                &adev->physical_node_list, node)
                if (entry->dev && device_can_wakeup(entry->dev)) {
                        bool enable = !device_may_wakeup(entry->dev);
                        device_set_wakeup_enable(entry->dev, enable);
                }
+        mutex_unlock(&adev->physical_node_lock);
 }
 static ssize_t
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 0ec434d2586d..3270d3c8ba4e 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -689,7 +689,7 @@ static int acpi_video_bqc_quirk(struct acpi_video_device *device,
         * Some systems always report current brightness level as maximum
         * through _BQC, we need to test another value for them.
         */
-        test_level = current_level == max_level ? br->levels[2] : max_level;
+        test_level = current_level == max_level ? br->levels[3] : max_level;
        result = acpi_video_device_lcd_set_level(device, test_level);
        if (result)
@@ -908,9 +908,6 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                device->cap._DDC = 1;
        }
-        if (acpi_video_init_brightness(device))
-                return;
        if (acpi_video_backlight_support()) {
                struct backlight_properties props;
                struct pci_dev *pdev;
@@ -920,6 +917,9 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                static int count = 0;
                char *name;
+                result = acpi_video_init_brightness(device);
+                if (result)
+                        return;
                name = kasprintf(GFP_KERNEL, "acpi_video%d", count);
                if (!name)
                        return;
@@ -979,11 +979,6 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                if (result)
                        printk(KERN_ERR PREFIX "Create sysfs link\n");
-        } else {
-                /* Remove the brightness object. */
-                kfree(device->brightness->levels);
-                kfree(device->brightness);
-                device->brightness = NULL;
        }
 }
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 1c41722bb7e2..20fd337a5731 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -289,24 +289,24 @@ static int sata_pmp_configure(struct ata_device *dev, int print_info)
        /* Disable sending Early R_OK.
         * With "cached read" HDD testing and multiple ports busy on a SATA
-         * host controller, 3726 PMP will very rarely drop a deferred
+         * host controller, 3x26 PMP will very rarely drop a deferred
         * R_OK that was intended for the host. Symptom will be all
         * 5 drives under test will timeout, get reset, and recover.
         */
-        if (vendor == 0x1095 && devid == 0x3726) {
+        if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
                u32 reg;
                err_mask = sata_pmp_read(&ap->link, PMP_GSCR_SII_POL, &reg);
                if (err_mask) {
                        rc = -EIO;
-                        reason = "failed to read Sil3726 Private Register";
+                        reason = "failed to read Sil3x26 Private Register";
                        goto fail;
                }
                reg &= ~0x1;
                err_mask = sata_pmp_write(&ap->link, PMP_GSCR_SII_POL, reg);
                if (err_mask) {
                        rc = -EIO;
-                        reason = "failed to write Sil3726 Private Register";
+                        reason = "failed to write Sil3x26 Private Register";
                        goto fail;
                }
        }
@@ -383,8 +383,8 @@ static void sata_pmp_quirks(struct ata_port *ap)
        u16 devid = sata_pmp_gscr_devid(gscr);
        struct ata_link *link;
-        if (vendor == 0x1095 && devid == 0x3726) {
+        if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
-                /* sil3726 quirks */
+                /* sil3x26 quirks */
                ata_for_each_link(link, ap, EDGE) {
                        /* link reports offline after LPM */
                        link->flags |= ATA_LFLAG_NO_LPM;
diff --git a/drivers/ata/pata_imx.c b/drivers/ata/pata_imx.c
index 4ec7c04b3f82..26386f0b89a8 100644
--- a/drivers/ata/pata_imx.c
+++ b/drivers/ata/pata_imx.c
@@ -237,6 +237,7 @@ static const struct of_device_id imx_pata_dt_ids[] = {
                /* sentinel */
        }
 };
+MODULE_DEVICE_TABLE(of, imx_pata_dt_ids);
 static struct platform_driver pata_imx_driver = {
        .probe          = pata_imx_probe,
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 19720a0a4a65..851bd3f43ac6 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -293,6 +293,7 @@ static void fsl_sata_set_irq_coalescing(struct ata_host *host,
 {
        struct sata_fsl_host_priv *host_priv = host->private_data;
        void __iomem *hcr_base = host_priv->hcr_base;
+        unsigned long flags;
        if (count > ICC_MAX_INT_COUNT_THRESHOLD)
                count = ICC_MAX_INT_COUNT_THRESHOLD;
@@ -305,12 +306,12 @@ static void fsl_sata_set_irq_coalescing(struct ata_host *host,
                        (count > ICC_MIN_INT_COUNT_THRESHOLD))
                ticks = ICC_SAFE_INT_TICKS;
-        spin_lock(&host->lock);
+        spin_lock_irqsave(&host->lock, flags);
        iowrite32((count << 24 | ticks), hcr_base + ICC);
        intr_coalescing_count = count;
        intr_coalescing_ticks = ticks;
-        spin_unlock(&host->lock);
+        spin_unlock_irqrestore(&host->lock, flags);
        DPRINTK("interrupt coalescing, count = 0x%x, ticks = %x\n",
                        intr_coalescing_count, intr_coalescing_ticks);
diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
index d047d92a456f..e9a4f46d962e 100644
--- a/drivers/ata/sata_highbank.c
+++ b/drivers/ata/sata_highbank.c
@@ -86,11 +86,11 @@ struct ecx_plat_data {
 #define SGPIO_SIGNALS                   3
 #define ECX_ACTIVITY_BITS               0x300000
-#define ECX_ACTIVITY_SHIFT              2
+#define ECX_ACTIVITY_SHIFT              0
 #define ECX_LOCATE_BITS                 0x80000
 #define ECX_LOCATE_SHIFT                1
 #define ECX_FAULT_BITS                  0x400000
-#define ECX_FAULT_SHIFT                 0
+#define ECX_FAULT_SHIFT                 2
 static inline int sgpio_bit_shift(struct ecx_plat_data *pdata, u32 port,
                                u32 shift)
 {
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index e69102696533..3455f833e473 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -719,7 +719,8 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
                }
        }
-        return regcache_sync_block_raw_flush(map, &data, base, regtmp);
+        return regcache_sync_block_raw_flush(map, &data, base, regtmp +
+                        map->reg_stride);
 }
 int regcache_sync_block(struct regmap *map, void *block,
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 99cb944a002d..4d45dba7fb8f 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -906,16 +906,10 @@ bio_pageinc(struct bio *bio)
        int i;
        bio_for_each_segment(bv, bio, i) {
-                page = bv->bv_page;
                /* Non-zero page count for non-head members of
-                 * compound pages is no longer allowed by the kernel,
+                 * compound pages is no longer allowed by the kernel.
-                 * but this has never been seen here.
                 */
-                if (unlikely(PageCompound(page)))
+                page = compound_trans_head(bv->bv_page);
-                        if (compound_trans_head(page) != page) {
-                                pr_crit("page tail used for block I/O\n");
-                                BUG();
-                        }
                atomic_inc(&page->_count);
        }
 }
@@ -924,10 +918,13 @@ static void
 bio_pagedec(struct bio *bio)
 {
        struct bio_vec *bv;
+        struct page *page;
        int i;
-        bio_for_each_segment(bv, bio, i)
+        bio_for_each_segment(bv, bio, i) {
-                atomic_dec(&bv->bv_page->_count);
+                page = compound_trans_head(bv->bv_page);
+                atomic_dec(&page->_count);
+        }
 }
 static void
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 1b456fe9b87a..fc45567ad3ac 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -272,9 +272,12 @@ static struct port *find_port_by_devt_in_portdev(struct ports_device *portdev,
        unsigned long flags;
        spin_lock_irqsave(&portdev->ports_lock, flags);
-        list_for_each_entry(port, &portdev->ports, list)
+        list_for_each_entry(port, &portdev->ports, list) {
-                if (port->cdev->dev == dev)
+                if (port->cdev->dev == dev) {
+                        kref_get(&port->kref);
                        goto out;
+                }
+        }
        port = NULL;
 out:
        spin_unlock_irqrestore(&portdev->ports_lock, flags);
@@ -746,6 +749,10 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
        port = filp->private_data;
+        /* Port is hot-unplugged. */
+        if (!port->guest_connected)
+                return -ENODEV;
        if (!port_has_data(port)) {
                /*
                 * If nothing's connected on the host just return 0 in
@@ -762,7 +769,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
                if (ret < 0)
                        return ret;
        }
-        /* Port got hot-unplugged. */
+        /* Port got hot-unplugged while we were waiting above. */
        if (!port->guest_connected)
                return -ENODEV;
        /*
@@ -932,13 +939,25 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
        if (is_rproc_serial(port->out_vq->vdev))
                return -EINVAL;
+        /*
+         * pipe->nrbufs == 0 means there are no data to transfer,
+         * so this returns just 0 for no data.
+         */
+        pipe_lock(pipe);
+        if (!pipe->nrbufs) {
+                ret = 0;
+                goto error_out;
+        }
        ret = wait_port_writable(port, filp->f_flags & O_NONBLOCK);
        if (ret < 0)
-                return ret;
+                goto error_out;
        buf = alloc_buf(port->out_vq, 0, pipe->nrbufs);
-        if (!buf)
+        if (!buf) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto error_out;
+        }
        sgl.n = 0;
        sgl.len = 0;
@@ -946,12 +965,17 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
        sgl.sg = buf->sg;
        sg_init_table(sgl.sg, sgl.size);
        ret = __splice_from_pipe(pipe, &sd, pipe_to_sg);
+        pipe_unlock(pipe);
        if (likely(ret > 0))
                ret = __send_to_port(port, buf->sg, sgl.n, sgl.len, buf, true);
        if (unlikely(ret <= 0))
                free_buf(buf, true);
        return ret;
+error_out:
+        pipe_unlock(pipe);
+        return ret;
 }
 static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
@@ -1019,14 +1043,14 @@ static int port_fops_open(struct inode *inode, struct file *filp)
        struct port *port;
        int ret;
+        /* We get the port with a kref here */
        port = find_port_by_devt(cdev->dev);
+        if (!port) {
+                /* Port was unplugged before we could proceed */
+                return -ENXIO;
+        }
        filp->private_data = port;
-        /* Prevent against a port getting hot-unplugged at the same time */
-        spin_lock_irq(&port->portdev->ports_lock);
-        kref_get(&port->kref);
-        spin_unlock_irq(&port->portdev->ports_lock);
        /*
         * Don't allow opening of console port devices -- that's done
         * via /dev/hvc
@@ -1498,14 +1522,6 @@ static void remove_port(struct kref *kref)
        port = container_of(kref, struct port, kref);
-        sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
-        device_destroy(pdrvdata.class, port->dev->devt);
-        cdev_del(port->cdev);
-        kfree(port->name);
-        debugfs_remove(port->debugfs_file);
        kfree(port);
 }
@@ -1539,12 +1555,14 @@ static void unplug_port(struct port *port)
        spin_unlock_irq(&port->portdev->ports_lock);
        if (port->guest_connected) {
+                /* Let the app know the port is going down. */
+                send_sigio_to_port(port);
+                /* Do this after sigio is actually sent */
                port->guest_connected = false;
                port->host_connected = false;
-                wake_up_interruptible(&port->waitqueue);
-                /* Let the app know the port is going down. */
+                wake_up_interruptible(&port->waitqueue);
-                send_sigio_to_port(port);
        }
        if (is_console_port(port)) {
@@ -1563,6 +1581,14 @@ static void unplug_port(struct port *port)
         */
        port->portdev = NULL;
+        sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
+        device_destroy(pdrvdata.class, port->dev->devt);
+        cdev_del(port->cdev);
+        kfree(port->name);
+        debugfs_remove(port->debugfs_file);
        /*
         * Locks around here are not necessary - a port can't be
         * opened after we removed the port struct from ports_list
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index 1bdb882c845b..4e5739773c33 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -581,11 +581,15 @@ struct samsung_div_clock exynos4x12_div_clks[] __initdata = {
        DIV(none, "div_spi1_isp", "mout_spi1_isp", E4X12_DIV_ISP, 16, 4),
        DIV(none, "div_spi1_isp_pre", "div_spi1_isp", E4X12_DIV_ISP, 20, 8),
        DIV(none, "div_uart_isp", "mout_uart_isp", E4X12_DIV_ISP, 28, 4),
-        DIV(div_isp0, "div_isp0", "aclk200", E4X12_DIV_ISP0, 0, 3),
+        DIV_F(div_isp0, "div_isp0", "aclk200", E4X12_DIV_ISP0, 0, 3,
-        DIV(div_isp1, "div_isp1", "aclk200", E4X12_DIV_ISP0, 4, 3),
+                                                CLK_GET_RATE_NOCACHE, 0),
+        DIV_F(div_isp1, "div_isp1", "aclk200", E4X12_DIV_ISP0, 4, 3,
+                                                CLK_GET_RATE_NOCACHE, 0),
        DIV(none, "div_mpwm", "div_isp1", E4X12_DIV_ISP1, 0, 3),
-        DIV(div_mcuisp0, "div_mcuisp0", "aclk400_mcuisp", E4X12_DIV_ISP1, 4, 3),
+        DIV_F(div_mcuisp0, "div_mcuisp0", "aclk400_mcuisp", E4X12_DIV_ISP1,
-        DIV(div_mcuisp1, "div_mcuisp1", "div_mcuisp0", E4X12_DIV_ISP1, 8, 3),
+                                                4, 3, CLK_GET_RATE_NOCACHE, 0),
+        DIV_F(div_mcuisp1, "div_mcuisp1", "div_mcuisp0", E4X12_DIV_ISP1,
+                                                8, 3, CLK_GET_RATE_NOCACHE, 0),
        DIV(sclk_fimg2d, "sclk_fimg2d", "mout_g2d", DIV_DMC1, 0, 4),
 };
@@ -863,57 +867,57 @@ struct samsung_gate_clock exynos4x12_gate_clks[] __initdata = {
        GATE_DA(i2s0, "samsung-i2s.0", "i2s0", "aclk100",
                        E4X12_GATE_IP_MAUDIO, 3, 0, 0, "iis"),
        GATE(fimc_isp, "isp", "aclk200", E4X12_GATE_ISP0, 0,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(fimc_drc, "drc", "aclk200", E4X12_GATE_ISP0, 1,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(fimc_fd, "fd", "aclk200", E4X12_GATE_ISP0, 2,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(fimc_lite0, "lite0", "aclk200", E4X12_GATE_ISP0, 3,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(fimc_lite1, "lite1", "aclk200", E4X12_GATE_ISP0, 4,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(mcuisp, "mcuisp", "aclk200", E4X12_GATE_ISP0, 5,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(gicisp, "gicisp", "aclk200", E4X12_GATE_ISP0, 7,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(smmu_isp, "smmu_isp", "aclk200", E4X12_GATE_ISP0, 8,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(smmu_drc, "smmu_drc", "aclk200", E4X12_GATE_ISP0, 9,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(smmu_fd, "smmu_fd", "aclk200", E4X12_GATE_ISP0, 10,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(smmu_lite0, "smmu_lite0", "aclk200", E4X12_GATE_ISP0, 11,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(smmu_lite1, "smmu_lite1", "aclk200", E4X12_GATE_ISP0, 12,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(ppmuispmx, "ppmuispmx", "aclk200", E4X12_GATE_ISP0, 20,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(ppmuispx, "ppmuispx", "aclk200", E4X12_GATE_ISP0, 21,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(mcuctl_isp, "mcuctl_isp", "aclk200", E4X12_GATE_ISP0, 23,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(mpwm_isp, "mpwm_isp", "aclk200", E4X12_GATE_ISP0, 24,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(i2c0_isp, "i2c0_isp", "aclk200", E4X12_GATE_ISP0, 25,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(i2c1_isp, "i2c1_isp", "aclk200", E4X12_GATE_ISP0, 26,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(mtcadc_isp, "mtcadc_isp", "aclk200", E4X12_GATE_ISP0, 27,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(pwm_isp, "pwm_isp", "aclk200", E4X12_GATE_ISP0, 28,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(wdt_isp, "wdt_isp", "aclk200", E4X12_GATE_ISP0, 30,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(uart_isp, "uart_isp", "aclk200", E4X12_GATE_ISP0, 31,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(asyncaxim, "asyncaxim", "aclk200", E4X12_GATE_ISP1, 0,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(smmu_ispcx, "smmu_ispcx", "aclk200", E4X12_GATE_ISP1, 4,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(spi0_isp, "spi0_isp", "aclk200", E4X12_GATE_ISP1, 12,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(spi1_isp, "spi1_isp", "aclk200", E4X12_GATE_ISP1, 13,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
        GATE(g2d, "g2d", "aclk200", GATE_IP_DMC, 23, 0, 0),
 };
diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
index 5c205b60a82a..089d3e30e221 100644
--- a/drivers/clk/zynq/clkc.c
+++ b/drivers/clk/zynq/clkc.c
@@ -71,6 +71,7 @@ static DEFINE_SPINLOCK(armpll_lock);
 static DEFINE_SPINLOCK(ddrpll_lock);
 static DEFINE_SPINLOCK(iopll_lock);
 static DEFINE_SPINLOCK(armclk_lock);
+static DEFINE_SPINLOCK(swdtclk_lock);
 static DEFINE_SPINLOCK(ddrclk_lock);
 static DEFINE_SPINLOCK(dciclk_lock);
 static DEFINE_SPINLOCK(gem0clk_lock);
@@ -293,7 +294,7 @@ static void __init zynq_clk_setup(struct device_node *np)
        }
        clks[swdt] = clk_register_mux(NULL, clk_output_name[swdt],
                        swdt_ext_clk_mux_parents, 2, CLK_SET_RATE_PARENT,
-                        SLCR_SWDT_CLK_SEL, 0, 1, 0, &gem0clk_lock);
+                        SLCR_SWDT_CLK_SEL, 0, 1, 0, &swdtclk_lock);
        /* DDR clocks */
        clk = clk_register_divider(NULL, "ddr2x_div", "ddrpll", 0,
@@ -364,8 +365,9 @@ static void __init zynq_clk_setup(struct device_node *np)
                        CLK_SET_RATE_PARENT, SLCR_GEM0_CLK_CTRL, 20, 6,
                        CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                        &gem0clk_lock);
-        clk = clk_register_mux(NULL, "gem0_emio_mux", gem0_mux_parents, 2, 0,
+        clk = clk_register_mux(NULL, "gem0_emio_mux", gem0_mux_parents, 2,
-                        SLCR_GEM0_CLK_CTRL, 6, 1, 0, &gem0clk_lock);
+                        CLK_SET_RATE_PARENT, SLCR_GEM0_CLK_CTRL, 6, 1, 0,
+                        &gem0clk_lock);
        clks[gem0] = clk_register_gate(NULL, clk_output_name[gem0],
                        "gem0_emio_mux", CLK_SET_RATE_PARENT,
                        SLCR_GEM0_CLK_CTRL, 0, 0, &gem0clk_lock);
@@ -386,8 +388,9 @@ static void __init zynq_clk_setup(struct device_node *np)
                        CLK_SET_RATE_PARENT, SLCR_GEM1_CLK_CTRL, 20, 6,
                        CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                        &gem1clk_lock);
-        clk = clk_register_mux(NULL, "gem1_emio_mux", gem1_mux_parents, 2, 0,
+        clk = clk_register_mux(NULL, "gem1_emio_mux", gem1_mux_parents, 2,
-                        SLCR_GEM1_CLK_CTRL, 6, 1, 0, &gem1clk_lock);
+                        CLK_SET_RATE_PARENT, SLCR_GEM1_CLK_CTRL, 6, 1, 0,
+                        &gem1clk_lock);
        clks[gem1] = clk_register_gate(NULL, clk_output_name[gem1],
                        "gem1_emio_mux", CLK_SET_RATE_PARENT,
                        SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 0ceb2eff5a7e..f97cb3d8c5a2 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -221,8 +221,8 @@ static ssize_t store_down_threshold(struct dbs_data *dbs_data, const char *buf,
        return count;
 }
-static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
+static ssize_t store_ignore_nice_load(struct dbs_data *dbs_data,
-                size_t count)
+                const char *buf, size_t count)
 {
        struct cs_dbs_tuners *cs_tuners = dbs_data->tuners;
        unsigned int input, j;
@@ -235,10 +235,10 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
        if (input > 1)
                input = 1;
-        if (input == cs_tuners->ignore_nice) /* nothing to do */
+        if (input == cs_tuners->ignore_nice_load) /* nothing to do */
                return count;
-        cs_tuners->ignore_nice = input;
+        cs_tuners->ignore_nice_load = input;
        /* we need to re-evaluate prev_cpu_idle */
        for_each_online_cpu(j) {
@@ -246,7 +246,7 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
                dbs_info = &per_cpu(cs_cpu_dbs_info, j);
                dbs_info->cdbs.prev_cpu_idle = get_cpu_idle_time(j,
                                        &dbs_info->cdbs.prev_cpu_wall, 0);
-                if (cs_tuners->ignore_nice)
+                if (cs_tuners->ignore_nice_load)
                        dbs_info->cdbs.prev_cpu_nice =
                                kcpustat_cpu(j).cpustat[CPUTIME_NICE];
        }
@@ -279,7 +279,7 @@ show_store_one(cs, sampling_rate);
 show_store_one(cs, sampling_down_factor);
 show_store_one(cs, up_threshold);
 show_store_one(cs, down_threshold);
-show_store_one(cs, ignore_nice);
+show_store_one(cs, ignore_nice_load);
 show_store_one(cs, freq_step);
 declare_show_sampling_rate_min(cs);
@@ -287,7 +287,7 @@ gov_sys_pol_attr_rw(sampling_rate);
 gov_sys_pol_attr_rw(sampling_down_factor);
 gov_sys_pol_attr_rw(up_threshold);
 gov_sys_pol_attr_rw(down_threshold);
-gov_sys_pol_attr_rw(ignore_nice);
+gov_sys_pol_attr_rw(ignore_nice_load);
 gov_sys_pol_attr_rw(freq_step);
 gov_sys_pol_attr_ro(sampling_rate_min);
@@ -297,7 +297,7 @@ static struct attribute *dbs_attributes_gov_sys[] = {
        &sampling_down_factor_gov_sys.attr,
        &up_threshold_gov_sys.attr,
        &down_threshold_gov_sys.attr,
-        &ignore_nice_gov_sys.attr,
+        &ignore_nice_load_gov_sys.attr,
        &freq_step_gov_sys.attr,
        NULL
 };
@@ -313,7 +313,7 @@ static struct attribute *dbs_attributes_gov_pol[] = {
        &sampling_down_factor_gov_pol.attr,
        &up_threshold_gov_pol.attr,
        &down_threshold_gov_pol.attr,
-        &ignore_nice_gov_pol.attr,
+        &ignore_nice_load_gov_pol.attr,
        &freq_step_gov_pol.attr,
        NULL
 };
@@ -338,7 +338,7 @@ static int cs_init(struct dbs_data *dbs_data)
        tuners->up_threshold = DEF_FREQUENCY_UP_THRESHOLD;
        tuners->down_threshold = DEF_FREQUENCY_DOWN_THRESHOLD;
        tuners->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
-        tuners->ignore_nice = 0;
+        tuners->ignore_nice_load = 0;
        tuners->freq_step = DEF_FREQUENCY_STEP;
        dbs_data->tuners = tuners;
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 7b839a8db2a7..e59afaa9da23 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -47,9 +47,9 @@ void dbs_check_cpu(struct dbs_data *dbs_data, int cpu)
        unsigned int j;
        if (dbs_data->cdata->governor == GOV_ONDEMAND)
-                ignore_nice = od_tuners->ignore_nice;
+                ignore_nice = od_tuners->ignore_nice_load;
        else
-                ignore_nice = cs_tuners->ignore_nice;
+                ignore_nice = cs_tuners->ignore_nice_load;
        policy = cdbs->cur_policy;
@@ -298,12 +298,12 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                cs_tuners = dbs_data->tuners;
                cs_dbs_info = dbs_data->cdata->get_cpu_dbs_info_s(cpu);
                sampling_rate = cs_tuners->sampling_rate;
-                ignore_nice = cs_tuners->ignore_nice;
+                ignore_nice = cs_tuners->ignore_nice_load;
        } else {
                od_tuners = dbs_data->tuners;
                od_dbs_info = dbs_data->cdata->get_cpu_dbs_info_s(cpu);
                sampling_rate = od_tuners->sampling_rate;
-                ignore_nice = od_tuners->ignore_nice;
+                ignore_nice = od_tuners->ignore_nice_load;
                od_ops = dbs_data->cdata->gov_ops;
                io_busy = od_tuners->io_is_busy;
        }
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 6663ec3b3056..d5f12b4b11b8 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -165,7 +165,7 @@ struct cs_cpu_dbs_info_s {
 /* Per policy Governers sysfs tunables */
 struct od_dbs_tuners {
-        unsigned int ignore_nice;
+        unsigned int ignore_nice_load;
        unsigned int sampling_rate;
        unsigned int sampling_down_factor;
        unsigned int up_threshold;
@@ -175,7 +175,7 @@ struct od_dbs_tuners {
 };
 struct cs_dbs_tuners {
-        unsigned int ignore_nice;
+        unsigned int ignore_nice_load;
        unsigned int sampling_rate;
        unsigned int sampling_down_factor;
        unsigned int up_threshold;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 93eb5cbcc1f6..c087347d6688 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -403,8 +403,8 @@ static ssize_t store_sampling_down_factor(struct dbs_data *dbs_data,
        return count;
 }
-static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
+static ssize_t store_ignore_nice_load(struct dbs_data *dbs_data,
-                size_t count)
+                const char *buf, size_t count)
 {
        struct od_dbs_tuners *od_tuners = dbs_data->tuners;
        unsigned int input;
@@ -419,10 +419,10 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
        if (input > 1)
                input = 1;
-        if (input == od_tuners->ignore_nice) { /* nothing to do */
+        if (input == od_tuners->ignore_nice_load) { /* nothing to do */
                return count;
        }
-        od_tuners->ignore_nice = input;
+        od_tuners->ignore_nice_load = input;
        /* we need to re-evaluate prev_cpu_idle */
        for_each_online_cpu(j) {
@@ -430,7 +430,7 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
                dbs_info = &per_cpu(od_cpu_dbs_info, j);
                dbs_info->cdbs.prev_cpu_idle = get_cpu_idle_time(j,
                        &dbs_info->cdbs.prev_cpu_wall, od_tuners->io_is_busy);
-                if (od_tuners->ignore_nice)
+                if (od_tuners->ignore_nice_load)
                        dbs_info->cdbs.prev_cpu_nice =
                                kcpustat_cpu(j).cpustat[CPUTIME_NICE];
@@ -461,7 +461,7 @@ show_store_one(od, sampling_rate);
 show_store_one(od, io_is_busy);
 show_store_one(od, up_threshold);
 show_store_one(od, sampling_down_factor);
-show_store_one(od, ignore_nice);
+show_store_one(od, ignore_nice_load);
 show_store_one(od, powersave_bias);
 declare_show_sampling_rate_min(od);
@@ -469,7 +469,7 @@ gov_sys_pol_attr_rw(sampling_rate);
 gov_sys_pol_attr_rw(io_is_busy);
 gov_sys_pol_attr_rw(up_threshold);
 gov_sys_pol_attr_rw(sampling_down_factor);
-gov_sys_pol_attr_rw(ignore_nice);
+gov_sys_pol_attr_rw(ignore_nice_load);
 gov_sys_pol_attr_rw(powersave_bias);
 gov_sys_pol_attr_ro(sampling_rate_min);
@@ -478,7 +478,7 @@ static struct attribute *dbs_attributes_gov_sys[] = {
        &sampling_rate_gov_sys.attr,
        &up_threshold_gov_sys.attr,
        &sampling_down_factor_gov_sys.attr,
-        &ignore_nice_gov_sys.attr,
+        &ignore_nice_load_gov_sys.attr,
        &powersave_bias_gov_sys.attr,
        &io_is_busy_gov_sys.attr,
        NULL
@@ -494,7 +494,7 @@ static struct attribute *dbs_attributes_gov_pol[] = {
        &sampling_rate_gov_pol.attr,
        &up_threshold_gov_pol.attr,
        &sampling_down_factor_gov_pol.attr,
-        &ignore_nice_gov_pol.attr,
+        &ignore_nice_load_gov_pol.attr,
        &powersave_bias_gov_pol.attr,
        &io_is_busy_gov_pol.attr,
        NULL
@@ -544,7 +544,7 @@ static int od_init(struct dbs_data *dbs_data)
        }
        tuners->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
-        tuners->ignore_nice = 0;
+        tuners->ignore_nice_load = 0;
        tuners->powersave_bias = default_powersave_bias;
        tuners->io_is_busy = should_io_be_busy();
diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
index bb838b985077..9536852c504a 100644
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@@ -118,11 +118,6 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
                clk_put(cpuclk);
                return -EINVAL;
        }
-        ret = clk_set_rate(cpuclk, rate);
-        if (ret) {
-                clk_put(cpuclk);
-                return ret;
-        }
        /* clock table init */
        for (i = 2;
@@ -130,6 +125,12 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
             i++)
                loongson2_clockmod_table[i].frequency = (rate * i) / 8;
+        ret = clk_set_rate(cpuclk, rate);
+        if (ret) {
+                clk_put(cpuclk);
+                return ret;
+        }
        policy->cur = loongson2_cpufreq_get(policy->cpu);
        cpufreq_frequency_table_get_attr(&loongson2_clockmod_table[0],
diff --git a/drivers/dma/sh/shdma.c b/drivers/dma/sh/shdma.c
index b67f45f5c271..5039fbc88254 100644
--- a/drivers/dma/sh/shdma.c
+++ b/drivers/dma/sh/shdma.c
@@ -400,8 +400,8 @@ static size_t sh_dmae_get_partial(struct shdma_chan *schan,
                                                    shdma_chan);
        struct sh_dmae_desc *sh_desc = container_of(sdesc,
                                        struct sh_dmae_desc, shdma_desc);
-        return (sh_desc->hw.tcr - sh_dmae_readl(sh_chan, TCR)) <<
+        return sh_desc->hw.tcr -
-                sh_chan->xmit_shift;
+                (sh_dmae_readl(sh_chan, TCR) << sh_chan->xmit_shift);
 }
 /* Called from error IRQ or NMI */
diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c
index 98d670825a1a..6e8887fe6c1b 100644
--- a/drivers/gpu/drm/ast/ast_ttm.c
+++ b/drivers/gpu/drm/ast/ast_ttm.c
@@ -323,6 +323,7 @@ int ast_bo_create(struct drm_device *dev, int size, int align,
        astbo->gem.driver_private = NULL;
        astbo->bo.bdev = &ast->ttm.bdev;
+        astbo->bo.bdev->dev_mapping = dev->dev_mapping;
        ast_ttm_placement(astbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c
index 0047012045c2..69fd8f1ac8df 100644
--- a/drivers/gpu/drm/cirrus/cirrus_ttm.c
+++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c
@@ -328,6 +328,7 @@ int cirrus_bo_create(struct drm_device *dev, int size, int align,
        cirrusbo->gem.driver_private = NULL;
        cirrusbo->bo.bdev = &cirrus->ttm.bdev;
+        cirrusbo->bo.bdev->dev_mapping = dev->dev_mapping;
        cirrus_ttm_placement(cirrusbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 8bcce7866d36..f92da0a32f0d 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -708,7 +708,10 @@ int drm_calc_vbltimestamp_from_scanoutpos(struct drm_device *dev, int crtc,
        /* Subtract time delta from raw timestamp to get final
         * vblank_time timestamp for end of vblank.
         */
-        etime = ktime_sub_ns(etime, delta_ns);
+        if (delta_ns < 0)
+                etime = ktime_add_ns(etime, -delta_ns);
+        else
+                etime = ktime_sub_ns(etime, delta_ns);
        *vblank_time = ktime_to_timeval(etime);
        DRM_DEBUG("crtc %d : v %d p(%d,%d)@ %ld.%ld -> %ld.%ld [e %d us, %d rep]\n",
diff --git a/drivers/gpu/drm/gma500/psb_intel_sdvo.c b/drivers/gpu/drm/gma500/psb_intel_sdvo.c
index 19e36603b23b..3bc8414533c9 100644
--- a/drivers/gpu/drm/gma500/psb_intel_sdvo.c
+++ b/drivers/gpu/drm/gma500/psb_intel_sdvo.c
@@ -500,7 +500,8 @@ static bool psb_intel_sdvo_read_response(struct psb_intel_sdvo *psb_intel_sdvo,
                                  &status))
                goto log_fail;
-        while (status == SDVO_CMD_STATUS_PENDING && retry--) {
+        while ((status == SDVO_CMD_STATUS_PENDING ||
+                status == SDVO_CMD_STATUS_TARGET_NOT_SPECIFIED) && retry--) {
                udelay(15);
                if (!psb_intel_sdvo_read_byte(psb_intel_sdvo,
                                          SDVO_I2C_CMD_STATUS,
diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
index dc53a527126b..9e6578330801 100644
--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
@@ -85,9 +85,17 @@ static void i915_gem_unmap_dma_buf(struct dma_buf_attachment *attachment,
                                   struct sg_table *sg,
                                   enum dma_data_direction dir)
 {
+        struct drm_i915_gem_object *obj = attachment->dmabuf->priv;
+        mutex_lock(&obj->base.dev->struct_mutex);
        dma_unmap_sg(attachment->dev, sg->sgl, sg->nents, dir);
        sg_free_table(sg);
        kfree(sg);
+        i915_gem_object_unpin_pages(obj);
+        mutex_unlock(&obj->base.dev->struct_mutex);
 }
 static void i915_gem_dmabuf_release(struct dma_buf *dma_buf)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index f2326fc60ac9..53cddd985406 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -752,6 +752,8 @@
                                        will not assert AGPBUSY# and will only
                                        be delivered when out of C3. */
 #define   INSTPM_FORCE_ORDERING                         (1<<7) /* GEN6+ */
+#define   INSTPM_TLB_INVALIDATE (1<<9)
+#define   INSTPM_SYNC_FLUSH     (1<<5)
 #define ACTHD           0x020c8
 #define FW_BLC          0x020d8
 #define FW_BLC2         0x020dc
@@ -1856,10 +1858,16 @@
 #define CRT_HOTPLUG_DETECT_VOLTAGE_475MV        (1 << 2)
 #define PORT_HOTPLUG_STAT       (dev_priv->info->display_mmio_offset + 0x61114)
-/* HDMI/DP bits are gen4+ */
+/*
-#define   PORTB_HOTPLUG_LIVE_STATUS               (1 << 29)
+ * HDMI/DP bits are gen4+
+ *
+ * WARNING: Bspec for hpd status bits on gen4 seems to be completely confused.
+ * Please check the detailed lore in the commit message for for experimental
+ * evidence.
+ */
+#define   PORTD_HOTPLUG_LIVE_STATUS               (1 << 29)
 #define   PORTC_HOTPLUG_LIVE_STATUS               (1 << 28)
-#define   PORTD_HOTPLUG_LIVE_STATUS               (1 << 27)
+#define   PORTB_HOTPLUG_LIVE_STATUS               (1 << 27)
 #define   PORTD_HOTPLUG_INT_STATUS              (3 << 21)
 #define   PORTC_HOTPLUG_INT_STATUS              (3 << 19)
 #define   PORTB_HOTPLUG_INT_STATUS              (3 << 17)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 5fb305840db8..be79f477a38f 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8269,9 +8269,11 @@ check_crtc_state(struct drm_device *dev)
                list_for_each_entry(encoder, &dev->mode_config.encoder_list,
                                    base.head) {
+                        enum pipe pipe;
                        if (encoder->base.crtc != &crtc->base)
                                continue;
-                        if (encoder->get_config)
+                        if (encoder->get_config &&
+                            encoder->get_hw_state(encoder, &pipe))
                                encoder->get_config(encoder, &pipe_config);
                }
@@ -10040,6 +10042,8 @@ struct intel_display_error_state {
        u32 power_well_driver;
+        int num_transcoders;
        struct intel_cursor_error_state {
                u32 control;
                u32 position;
@@ -10048,16 +10052,7 @@ struct intel_display_error_state {
        } cursor[I915_MAX_PIPES];
        struct intel_pipe_error_state {
-                enum transcoder cpu_transcoder;
-                u32 conf;
                u32 source;
-                u32 htotal;
-                u32 hblank;
-                u32 hsync;
-                u32 vtotal;
-                u32 vblank;
-                u32 vsync;
        } pipe[I915_MAX_PIPES];
        struct intel_plane_error_state {
@@ -10069,6 +10064,19 @@ struct intel_display_error_state {
                u32 surface;
                u32 tile_offset;
        } plane[I915_MAX_PIPES];
+        struct intel_transcoder_error_state {
+                enum transcoder cpu_transcoder;
+                u32 conf;
+                u32 htotal;
+                u32 hblank;
+                u32 hsync;
+                u32 vtotal;
+                u32 vblank;
+                u32 vsync;
+        } transcoder[4];
 };
 struct intel_display_error_state *
@@ -10076,9 +10084,17 @@ intel_display_capture_error_state(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct intel_display_error_state *error;
-        enum transcoder cpu_transcoder;
+        int transcoders[] = {
+                TRANSCODER_A,
+                TRANSCODER_B,
+                TRANSCODER_C,
+                TRANSCODER_EDP,
+        };
        int i;
+        if (INTEL_INFO(dev)->num_pipes == 0)
+                return NULL;
        error = kmalloc(sizeof(*error), GFP_ATOMIC);
        if (error == NULL)
                return NULL;
@@ -10087,9 +10103,6 @@ intel_display_capture_error_state(struct drm_device *dev)
                error->power_well_driver = I915_READ(HSW_PWR_WELL_DRIVER);
        for_each_pipe(i) {
-                cpu_transcoder = intel_pipe_to_cpu_transcoder(dev_priv, i);
-                error->pipe[i].cpu_transcoder = cpu_transcoder;
                if (INTEL_INFO(dev)->gen <= 6 || IS_VALLEYVIEW(dev)) {
                        error->cursor[i].control = I915_READ(CURCNTR(i));
                        error->cursor[i].position = I915_READ(CURPOS(i));
@@ -10113,14 +10126,25 @@ intel_display_capture_error_state(struct drm_device *dev)
                        error->plane[i].tile_offset = I915_READ(DSPTILEOFF(i));
                }
-                error->pipe[i].conf = I915_READ(PIPECONF(cpu_transcoder));
                error->pipe[i].source = I915_READ(PIPESRC(i));
-                error->pipe[i].htotal = I915_READ(HTOTAL(cpu_transcoder));
+        }
-                error->pipe[i].hblank = I915_READ(HBLANK(cpu_transcoder));
-                error->pipe[i].hsync = I915_READ(HSYNC(cpu_transcoder));
+        error->num_transcoders = INTEL_INFO(dev)->num_pipes;
-                error->pipe[i].vtotal = I915_READ(VTOTAL(cpu_transcoder));
+        if (HAS_DDI(dev_priv->dev))
-                error->pipe[i].vblank = I915_READ(VBLANK(cpu_transcoder));
+                error->num_transcoders++; /* Account for eDP. */
-                error->pipe[i].vsync = I915_READ(VSYNC(cpu_transcoder));
+        for (i = 0; i < error->num_transcoders; i++) {
+                enum transcoder cpu_transcoder = transcoders[i];
+                error->transcoder[i].cpu_transcoder = cpu_transcoder;
+                error->transcoder[i].conf = I915_READ(PIPECONF(cpu_transcoder));
+                error->transcoder[i].htotal = I915_READ(HTOTAL(cpu_transcoder));
+                error->transcoder[i].hblank = I915_READ(HBLANK(cpu_transcoder));
+                error->transcoder[i].hsync = I915_READ(HSYNC(cpu_transcoder));
+                error->transcoder[i].vtotal = I915_READ(VTOTAL(cpu_transcoder));
+                error->transcoder[i].vblank = I915_READ(VBLANK(cpu_transcoder));
+                error->transcoder[i].vsync = I915_READ(VSYNC(cpu_transcoder));
        }
        /* In the code above we read the registers without checking if the power
@@ -10142,22 +10166,16 @@ intel_display_print_error_state(struct drm_i915_error_state_buf *m,
 {
        int i;
+        if (!error)
+                return;
        err_printf(m, "Num Pipes: %d\n", INTEL_INFO(dev)->num_pipes);
        if (HAS_POWER_WELL(dev))
                err_printf(m, "PWR_WELL_CTL2: %08x\n",
                           error->power_well_driver);
        for_each_pipe(i) {
                err_printf(m, "Pipe [%d]:\n", i);
-                err_printf(m, "  CPU transcoder: %c\n",
-                           transcoder_name(error->pipe[i].cpu_transcoder));
-                err_printf(m, "  CONF: %08x\n", error->pipe[i].conf);
                err_printf(m, "  SRC: %08x\n", error->pipe[i].source);
-                err_printf(m, "  HTOTAL: %08x\n", error->pipe[i].htotal);
-                err_printf(m, "  HBLANK: %08x\n", error->pipe[i].hblank);
-                err_printf(m, "  HSYNC: %08x\n", error->pipe[i].hsync);
-                err_printf(m, "  VTOTAL: %08x\n", error->pipe[i].vtotal);
-                err_printf(m, "  VBLANK: %08x\n", error->pipe[i].vblank);
-                err_printf(m, "  VSYNC: %08x\n", error->pipe[i].vsync);
                err_printf(m, "Plane [%d]:\n", i);
                err_printf(m, "  CNTR: %08x\n", error->plane[i].control);
@@ -10178,5 +10196,17 @@ intel_display_print_error_state(struct drm_i915_error_state_buf *m,
                err_printf(m, "  POS: %08x\n", error->cursor[i].position);
                err_printf(m, "  BASE: %08x\n", error->cursor[i].base);
        }
+        for (i = 0; i < error->num_transcoders; i++) {
+                err_printf(m, "  CPU transcoder: %c\n",
+                           transcoder_name(error->transcoder[i].cpu_transcoder));
+                err_printf(m, "  CONF: %08x\n", error->transcoder[i].conf);
+                err_printf(m, "  HTOTAL: %08x\n", error->transcoder[i].htotal);
+                err_printf(m, "  HBLANK: %08x\n", error->transcoder[i].hblank);
+                err_printf(m, "  HSYNC: %08x\n", error->transcoder[i].hsync);
+                err_printf(m, "  VTOTAL: %08x\n", error->transcoder[i].vtotal);
+                err_printf(m, "  VBLANK: %08x\n", error->transcoder[i].vblank);
+                err_printf(m, "  VSYNC: %08x\n", error->transcoder[i].vsync);
+        }
 }
 #endif
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 67e2c1f1c9a8..5950888ae1d0 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -497,8 +497,11 @@ void intel_panel_set_backlight(struct drm_device *dev, u32 level, u32 max)
                goto out;
        }
-        /* scale to hardware */
+        /* scale to hardware, but be careful to not overflow */
-        level = level * freq / max;
+        if (freq < max)
+                level = level * freq / max;
+        else
+                level = freq / max * level;
        dev_priv->backlight.level = level;
        if (dev_priv->backlight.device)
@@ -515,6 +518,17 @@ void intel_panel_disable_backlight(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long flags;
+        /*
+         * Do not disable backlight on the vgaswitcheroo path. When switching
+         * away from i915, the other client may depend on i915 to handle the
+         * backlight. This will leave the backlight on unnecessarily when
+         * another client is not activated.
+         */
+        if (dev->switch_power_state == DRM_SWITCH_POWER_CHANGING) {
+                DRM_DEBUG_DRIVER("Skipping backlight disable on vga switch\n");
+                return;
+        }
        spin_lock_irqsave(&dev_priv->backlight.lock, flags);
        dev_priv->backlight.enabled = false;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index f895d1508df8..b0e4a0bd1313 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5063,8 +5063,26 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
                }
        } else {
                if (enable_requested) {
+                        unsigned long irqflags;
+                        enum pipe p;
                        I915_WRITE(HSW_PWR_WELL_DRIVER, 0);
+                        POSTING_READ(HSW_PWR_WELL_DRIVER);
                        DRM_DEBUG_KMS("Requesting to disable the power well\n");
+                        /*
+                         * After this, the registers on the pipes that are part
+                         * of the power well will become zero, so we have to
+                         * adjust our counters according to that.
+                         *
+                         * FIXME: Should we do this in general in
+                         * drm_vblank_post_modeset?
+                         */
+                        spin_lock_irqsave(&dev->vbl_lock, irqflags);
+                        for_each_pipe(p)
+                                if (p != PIPE_A)
+                                        dev->last_vblank[p] = 0;
+                        spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
                }
        }
 }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 664118d8c1d6..079ef0129e74 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -968,6 +968,18 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
        I915_WRITE(mmio, (u32)ring->status_page.gfx_addr);
        POSTING_READ(mmio);
+        /* Flush the TLB for this page */
+        if (INTEL_INFO(dev)->gen >= 6) {
+                u32 reg = RING_INSTPM(ring->mmio_base);
+                I915_WRITE(reg,
+                           _MASKED_BIT_ENABLE(INSTPM_TLB_INVALIDATE |
+                                              INSTPM_SYNC_FLUSH));
+                if (wait_for((I915_READ(reg) & INSTPM_SYNC_FLUSH) == 0,
+                             1000))
+                        DRM_ERROR("%s: wait for SyncFlush to complete for TLB invalidation timed out\n",
+                                  ring->name);
+        }
 }
 static int
diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
index 13878d5de063..d70e4a92773b 100644
--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
@@ -323,6 +323,7 @@ int mgag200_bo_create(struct drm_device *dev, int size, int align,
        mgabo->gem.driver_private = NULL;
        mgabo->bo.bdev = &mdev->ttm.bdev;
+        mgabo->bo.bdev->dev_mapping = dev->dev_mapping;
        mgag200_ttm_placement(mgabo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
diff --git a/drivers/gpu/drm/nouveau/core/core/mm.c b/drivers/gpu/drm/nouveau/core/core/mm.c
index d8291724dbd4..7a4e0891c5f8 100644
--- a/drivers/gpu/drm/nouveau/core/core/mm.c
+++ b/drivers/gpu/drm/nouveau/core/core/mm.c
@@ -98,6 +98,8 @@ nouveau_mm_head(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
        u32 splitoff;
        u32 s, e;
+        BUG_ON(!type);
        list_for_each_entry(this, &mm->free, fl_entry) {
                e = this->offset + this->length;
                s = this->offset;
@@ -162,6 +164,8 @@ nouveau_mm_tail(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
        struct nouveau_mm_node *prev, *this, *next;
        u32 mask = align - 1;
+        BUG_ON(!type);
        list_for_each_entry_reverse(this, &mm->free, fl_entry) {
                u32 e = this->offset + this->length;
                u32 s = this->offset;
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
index d5502267c30f..9d2cd2006250 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
@@ -20,8 +20,8 @@ nouveau_mc(void *obj)
        return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_MC];
 }
-#define nouveau_mc_create(p,e,o,d)                                             \
+#define nouveau_mc_create(p,e,o,m,d)                                           \
-        nouveau_mc_create_((p), (e), (o), sizeof(**d), (void **)d)
+        nouveau_mc_create_((p), (e), (o), (m), sizeof(**d), (void **)d)
 #define nouveau_mc_destroy(p) ({                                               \
        struct nouveau_mc *pmc = (p); _nouveau_mc_dtor(nv_object(pmc));        \
 })
@@ -33,7 +33,8 @@ nouveau_mc(void *obj)
 })
 int  nouveau_mc_create_(struct nouveau_object *, struct nouveau_object *,
-                        struct nouveau_oclass *, int, void **);
+                        struct nouveau_oclass *, const struct nouveau_mc_intr *,
+                        int, void **);
 void _nouveau_mc_dtor(struct nouveau_object *);
 int  _nouveau_mc_init(struct nouveau_object *);
 int  _nouveau_mc_fini(struct nouveau_object *, bool);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
index 19e3a9a63a02..ab7ef0ac9e34 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
@@ -40,15 +40,15 @@ nv49_ram_create(struct nouveau_object *parent, struct nouveau_object *engine,
                return ret;
        switch (pfb914 & 0x00000003) {
-        case 0x00000000: pfb->ram->type = NV_MEM_TYPE_DDR1; break;
+        case 0x00000000: ram->type = NV_MEM_TYPE_DDR1; break;
-        case 0x00000001: pfb->ram->type = NV_MEM_TYPE_DDR2; break;
+        case 0x00000001: ram->type = NV_MEM_TYPE_DDR2; break;
-        case 0x00000002: pfb->ram->type = NV_MEM_TYPE_GDDR3; break;
+        case 0x00000002: ram->type = NV_MEM_TYPE_GDDR3; break;
        case 0x00000003: break;
        }
-        pfb->ram->size  =  nv_rd32(pfb, 0x10020c) & 0xff000000;
+        ram->size  =  nv_rd32(pfb, 0x10020c) & 0xff000000;
-        pfb->ram->parts = (nv_rd32(pfb, 0x100200) & 0x00000003) + 1;
+        ram->parts = (nv_rd32(pfb, 0x100200) & 0x00000003) + 1;
-        pfb->ram->tags  =  nv_rd32(pfb, 0x100320);
+        ram->tags  =  nv_rd32(pfb, 0x100320);
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
index 7192aa6e5577..63a6aab86028 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
@@ -38,8 +38,8 @@ nv4e_ram_create(struct nouveau_object *parent, struct nouveau_object *engine,
        if (ret)
                return ret;
-        pfb->ram->size = nv_rd32(pfb, 0x10020c) & 0xff000000;
+        ram->size = nv_rd32(pfb, 0x10020c) & 0xff000000;
-        pfb->ram->type = NV_MEM_TYPE_STOLEN;
+        ram->type = NV_MEM_TYPE_STOLEN;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
index bcca883018f4..cce65cc56514 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
@@ -30,8 +30,9 @@ struct nvc0_ltcg_priv {
        struct nouveau_ltcg base;
        u32 part_nr;
        u32 subp_nr;
-        struct nouveau_mm tags;
        u32 num_tags;
+        u32 tag_base;
+        struct nouveau_mm tags;
        struct nouveau_mm_node *tag_ram;
 };
@@ -117,10 +118,6 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
        u32 tag_size, tag_margin, tag_align;
        int ret;
-        nv_wr32(priv, 0x17e8d8, priv->part_nr);
-        if (nv_device(pfb)->card_type >= NV_E0)
-                nv_wr32(priv, 0x17e000, priv->part_nr);
        /* tags for 1/4 of VRAM should be enough (8192/4 per GiB of VRAM) */
        priv->num_tags = (pfb->ram->size >> 17) / 4;
        if (priv->num_tags > (1 << 17))
@@ -142,7 +139,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
        tag_size += tag_align;
        tag_size  = (tag_size + 0xfff) >> 12; /* round up */
-        ret = nouveau_mm_tail(&pfb->vram, 0, tag_size, tag_size, 1,
+        ret = nouveau_mm_tail(&pfb->vram, 1, tag_size, tag_size, 1,
                              &priv->tag_ram);
        if (ret) {
                priv->num_tags = 0;
@@ -152,7 +149,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
                tag_base += tag_align - 1;
                ret = do_div(tag_base, tag_align);
-                nv_wr32(priv, 0x17e8d4, tag_base);
+                priv->tag_base = tag_base;
        }
        ret = nouveau_mm_init(&priv->tags, 0, priv->num_tags, 1);
@@ -182,8 +179,6 @@ nvc0_ltcg_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        }
        priv->subp_nr = nv_rd32(priv, 0x17e8dc) >> 28;
-        nv_mask(priv, 0x17e820, 0x00100000, 0x00000000); /* INTR_EN &= ~0x10 */
        ret = nvc0_ltcg_init_tag_ram(pfb, priv);
        if (ret)
                return ret;
@@ -209,13 +204,32 @@ nvc0_ltcg_dtor(struct nouveau_object *object)
        nouveau_ltcg_destroy(ltcg);
 }
+static int
+nvc0_ltcg_init(struct nouveau_object *object)
+{
+        struct nouveau_ltcg *ltcg = (struct nouveau_ltcg *)object;
+        struct nvc0_ltcg_priv *priv = (struct nvc0_ltcg_priv *)ltcg;
+        int ret;
+        ret = nouveau_ltcg_init(ltcg);
+        if (ret)
+                return ret;
+        nv_mask(priv, 0x17e820, 0x00100000, 0x00000000); /* INTR_EN &= ~0x10 */
+        nv_wr32(priv, 0x17e8d8, priv->part_nr);
+        if (nv_device(ltcg)->card_type >= NV_E0)
+                nv_wr32(priv, 0x17e000, priv->part_nr);
+        nv_wr32(priv, 0x17e8d4, priv->tag_base);
+        return 0;
+}
 struct nouveau_oclass
 nvc0_ltcg_oclass = {
        .handle = NV_SUBDEV(LTCG, 0xc0),
        .ofuncs = &(struct nouveau_ofuncs) {
                .ctor = nvc0_ltcg_ctor,
                .dtor = nvc0_ltcg_dtor,
-                .init = _nouveau_ltcg_init,
+                .init = nvc0_ltcg_init,
                .fini = _nouveau_ltcg_fini,
        },
 };
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
index 1c0330b8c9a4..ec9cd6f10f91 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
@@ -80,7 +80,9 @@ _nouveau_mc_dtor(struct nouveau_object *object)
 int
 nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
-                   struct nouveau_oclass *oclass, int length, void **pobject)
+                   struct nouveau_oclass *oclass,
+                   const struct nouveau_mc_intr *intr_map,
+                   int length, void **pobject)
 {
        struct nouveau_device *device = nv_device(parent);
        struct nouveau_mc *pmc;
@@ -92,6 +94,8 @@ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
        if (ret)
                return ret;
+        pmc->intr_map = intr_map;
        ret = request_irq(device->pdev->irq, nouveau_mc_intr,
                          IRQF_SHARED, "nouveau", pmc);
        if (ret < 0)
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
index 8c769715227b..64aa4edb0d9d 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
@@ -50,12 +50,11 @@ nv04_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv04_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nv04_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
index 51919371810f..d9891782bf28 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
@@ -36,12 +36,11 @@ nv44_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv44_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nv04_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
index f25fc5fc7dd1..2b1afe225db8 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
@@ -53,12 +53,11 @@ nv50_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv50_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv50_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nv50_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
index e82fd21b5041..0d57b4d3e001 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
@@ -54,12 +54,11 @@ nv98_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv98_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv98_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nv98_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
index c5da3babbc62..104175c5a2dd 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
@@ -57,12 +57,11 @@ nvc0_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nvc0_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nvc0_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nvc0_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/dispnv04/crtc.c b/drivers/gpu/drm/nouveau/dispnv04/crtc.c
index 0782bd2f1e04..6a13ffb53bdb 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/crtc.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/crtc.c
@@ -606,6 +606,24 @@ nv_crtc_mode_set_regs(struct drm_crtc *crtc, struct drm_display_mode * mode)
        regp->ramdac_a34 = 0x1;
 }
+static int
+nv_crtc_swap_fbs(struct drm_crtc *crtc, struct drm_framebuffer *old_fb)
+{
+        struct nv04_display *disp = nv04_display(crtc->dev);
+        struct nouveau_framebuffer *nvfb = nouveau_framebuffer(crtc->fb);
+        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+        int ret;
+        ret = nouveau_bo_pin(nvfb->nvbo, TTM_PL_FLAG_VRAM);
+        if (ret == 0) {
+                if (disp->image[nv_crtc->index])
+                        nouveau_bo_unpin(disp->image[nv_crtc->index]);
+                nouveau_bo_ref(nvfb->nvbo, &disp->image[nv_crtc->index]);
+        }
+        return ret;
+}
 /**
 * Sets up registers for the given mode/adjusted_mode pair.
 *
@@ -622,10 +640,15 @@ nv_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mode,
        struct drm_device *dev = crtc->dev;
        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
        struct nouveau_drm *drm = nouveau_drm(dev);
+        int ret;
        NV_DEBUG(drm, "CTRC mode on CRTC %d:\n", nv_crtc->index);
        drm_mode_debug_printmodeline(adjusted_mode);
+        ret = nv_crtc_swap_fbs(crtc, old_fb);
+        if (ret)
+                return ret;
        /* unlock must come after turning off FP_TG_CONTROL in output_prepare */
        nv_lock_vga_crtc_shadow(dev, nv_crtc->index, -1);
@@ -722,6 +745,7 @@ static void nv_crtc_commit(struct drm_crtc *crtc)
 static void nv_crtc_destroy(struct drm_crtc *crtc)
 {
+        struct nv04_display *disp = nv04_display(crtc->dev);
        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
        if (!nv_crtc)
@@ -729,6 +753,10 @@ static void nv_crtc_destroy(struct drm_crtc *crtc)
        drm_crtc_cleanup(crtc);
+        if (disp->image[nv_crtc->index])
+                nouveau_bo_unpin(disp->image[nv_crtc->index]);
+        nouveau_bo_ref(NULL, &disp->image[nv_crtc->index]);
        nouveau_bo_unmap(nv_crtc->cursor.nvbo);
        nouveau_bo_unpin(nv_crtc->cursor.nvbo);
        nouveau_bo_ref(NULL, &nv_crtc->cursor.nvbo);
@@ -754,6 +782,16 @@ nv_crtc_gamma_load(struct drm_crtc *crtc)
 }
 static void
+nv_crtc_disable(struct drm_crtc *crtc)
+{
+        struct nv04_display *disp = nv04_display(crtc->dev);
+        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+        if (disp->image[nv_crtc->index])
+                nouveau_bo_unpin(disp->image[nv_crtc->index]);
+        nouveau_bo_ref(NULL, &disp->image[nv_crtc->index]);
+}
+static void
 nv_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b, uint32_t start,
                  uint32_t size)
 {
@@ -791,7 +829,6 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
        struct drm_framebuffer *drm_fb;
        struct nouveau_framebuffer *fb;
        int arb_burst, arb_lwm;
-        int ret;
        NV_DEBUG(drm, "index %d\n", nv_crtc->index);
@@ -801,10 +838,8 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
                return 0;
        }
        /* If atomic, we want to switch to the fb we were passed, so
-         * now we update pointers to do that.  (We don't pin; just
+         * now we update pointers to do that.
-         * assume we're already pinned and update the base address.)
         */
        if (atomic) {
                drm_fb = passed_fb;
@@ -812,17 +847,6 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
        } else {
                drm_fb = crtc->fb;
                fb = nouveau_framebuffer(crtc->fb);
-                /* If not atomic, we can go ahead and pin, and unpin the
-                 * old fb we were passed.
-                 */
-                ret = nouveau_bo_pin(fb->nvbo, TTM_PL_FLAG_VRAM);
-                if (ret)
-                        return ret;
-                if (passed_fb) {
-                        struct nouveau_framebuffer *ofb = nouveau_framebuffer(passed_fb);
-                        nouveau_bo_unpin(ofb->nvbo);
-                }
        }
        nv_crtc->fb.offset = fb->nvbo->bo.offset;
@@ -877,6 +901,9 @@ static int
 nv04_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
                        struct drm_framebuffer *old_fb)
 {
+        int ret = nv_crtc_swap_fbs(crtc, old_fb);
+        if (ret)
+                return ret;
        return nv04_crtc_do_mode_set_base(crtc, old_fb, x, y, false);
 }
@@ -1027,6 +1054,7 @@ static const struct drm_crtc_helper_funcs nv04_crtc_helper_funcs = {
        .mode_set_base = nv04_crtc_mode_set_base,
        .mode_set_base_atomic = nv04_crtc_mode_set_base_atomic,
        .load_lut = nv_crtc_gamma_load,
+        .disable = nv_crtc_disable,
 };
 int
diff --git a/drivers/gpu/drm/nouveau/dispnv04/disp.h b/drivers/gpu/drm/nouveau/dispnv04/disp.h
index a0a031dad13f..9928187f0a7d 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/disp.h
+++ b/drivers/gpu/drm/nouveau/dispnv04/disp.h
@@ -81,6 +81,7 @@ struct nv04_display {
        uint32_t saved_vga_font[4][16384];
        uint32_t dac_users[4];
        struct nouveau_object *core;
+        struct nouveau_bo *image[2];
 };
 static inline struct nv04_display *
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 907d20ef6d4d..a03e75deacaf 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -577,6 +577,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                ret = nv50_display_flip_next(crtc, fb, chan, 0);
                if (ret)
                        goto fail_unreserve;
+        } else {
+                struct nv04_display *dispnv04 = nv04_display(dev);
+                nouveau_bo_ref(new_bo, &dispnv04->image[nouveau_crtc(crtc)->index]);
        }
        ret = nouveau_page_flip_emit(chan, old_bo, new_bo, s, &fence);
diff --git a/drivers/gpu/drm/nouveau/nv40_pm.c b/drivers/gpu/drm/nouveau/nv40_pm.c
index 3af5bcd0b203..625f80d53dc2 100644
--- a/drivers/gpu/drm/nouveau/nv40_pm.c
+++ b/drivers/gpu/drm/nouveau/nv40_pm.c
@@ -131,7 +131,7 @@ nv40_calc_pll(struct drm_device *dev, u32 reg, struct nvbios_pll *pll,
        if (clk < pll->vco1.max_freq)
                pll->vco2.max_freq = 0;
-        pclk->pll_calc(pclk, pll, clk, &coef);
+        ret = pclk->pll_calc(pclk, pll, clk, &coef);
        if (ret == 0)
                return -ERANGE;
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 0bfd55e08820..9953e1fbc46d 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -2548,9 +2548,6 @@ int btc_dpm_init(struct radeon_device *rdev)
 {
        struct rv7xx_power_info *pi;
        struct evergreen_power_info *eg_pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        u16 data_offset, size;
-        u8 frev, crev;
        struct atom_clock_dividers dividers;
        int ret;
@@ -2633,16 +2630,7 @@ int btc_dpm_init(struct radeon_device *rdev)
        eg_pi->vddci_control =
                radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_VDDCI, 0);
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
+        rv770_get_engine_memory_ss(rdev);
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = true;
-        }
        pi->asi = RV770_ASI_DFLT;
        pi->pasi = CYPRESS_HASI_DFLT;
@@ -2659,8 +2647,7 @@ int btc_dpm_init(struct radeon_device *rdev)
        pi->dynamic_pcie_gen2 = true;
-        if (pi->gfx_clock_gating &&
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
                pi->thermal_protection = true;
        else
                pi->thermal_protection = false;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 6dacec4e2090..8928bd109c16 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -2587,9 +2587,11 @@ u32 cik_compute_ring_get_rptr(struct radeon_device *rdev,
        if (rdev->wb.enabled) {
                rptr = le32_to_cpu(rdev->wb.wb[ring->rptr_offs/4]);
        } else {
+                mutex_lock(&rdev->srbm_mutex);
                cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
                rptr = RREG32(CP_HQD_PQ_RPTR);
                cik_srbm_select(rdev, 0, 0, 0, 0);
+                mutex_unlock(&rdev->srbm_mutex);
        }
        rptr = (rptr & ring->ptr_reg_mask) >> ring->ptr_reg_shift;
@@ -2604,9 +2606,11 @@ u32 cik_compute_ring_get_wptr(struct radeon_device *rdev,
        if (rdev->wb.enabled) {
                wptr = le32_to_cpu(rdev->wb.wb[ring->wptr_offs/4]);
        } else {
+                mutex_lock(&rdev->srbm_mutex);
                cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
                wptr = RREG32(CP_HQD_PQ_WPTR);
                cik_srbm_select(rdev, 0, 0, 0, 0);
+                mutex_unlock(&rdev->srbm_mutex);
        }
        wptr = (wptr & ring->ptr_reg_mask) >> ring->ptr_reg_shift;
@@ -2897,6 +2901,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
        WREG32(CP_CPF_DEBUG, tmp);
        /* init the pipes */
+        mutex_lock(&rdev->srbm_mutex);
        for (i = 0; i < (rdev->mec.num_pipe * rdev->mec.num_mec); i++) {
                int me = (i < 4) ? 1 : 2;
                int pipe = (i < 4) ? i : (i - 4);
@@ -2919,6 +2924,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                WREG32(CP_HPD_EOP_CONTROL, tmp);
        }
        cik_srbm_select(rdev, 0, 0, 0, 0);
+        mutex_unlock(&rdev->srbm_mutex);
        /* init the queues.  Just two for now. */
        for (i = 0; i < 2; i++) {
@@ -2972,6 +2978,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                mqd->static_thread_mgmt23[0] = 0xffffffff;
                mqd->static_thread_mgmt23[1] = 0xffffffff;
+                mutex_lock(&rdev->srbm_mutex);
                cik_srbm_select(rdev, rdev->ring[idx].me,
                                rdev->ring[idx].pipe,
                                rdev->ring[idx].queue, 0);
@@ -3099,6 +3106,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                WREG32(CP_HQD_ACTIVE, mqd->queue_state.cp_hqd_active);
                cik_srbm_select(rdev, 0, 0, 0, 0);
+                mutex_unlock(&rdev->srbm_mutex);
                radeon_bo_kunmap(rdev->ring[idx].mqd_obj);
                radeon_bo_unreserve(rdev->ring[idx].mqd_obj);
@@ -4320,6 +4328,7 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev)
        /* XXX SH_MEM regs */
        /* where to put LDS, scratch, GPUVM in FSA64 space */
+        mutex_lock(&rdev->srbm_mutex);
        for (i = 0; i < 16; i++) {
                cik_srbm_select(rdev, 0, 0, 0, i);
                /* CP and shaders */
@@ -4335,6 +4344,7 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev)
                /* XXX SDMA RLC - todo */
        }
        cik_srbm_select(rdev, 0, 0, 0, 0);
+        mutex_unlock(&rdev->srbm_mutex);
        cik_pcie_gart_tlb_flush(rdev);
        DRM_INFO("PCIE GART of %uM enabled (table at 0x%016llX).\n",
@@ -5954,6 +5964,8 @@ static int cik_startup(struct radeon_device *rdev)
        struct radeon_ring *ring;
        int r;
+        cik_mc_program(rdev);
        if (rdev->flags & RADEON_IS_IGP) {
                if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
                    !rdev->mec_fw || !rdev->sdma_fw || !rdev->rlc_fw) {
@@ -5985,7 +5997,6 @@ static int cik_startup(struct radeon_device *rdev)
        if (r)
                return r;
-        cik_mc_program(rdev);
        r = cik_pcie_gart_enable(rdev);
        if (r)
                return r;
@@ -6194,7 +6205,7 @@ int cik_suspend(struct radeon_device *rdev)
        radeon_vm_manager_fini(rdev);
        cik_cp_enable(rdev, false);
        cik_sdma_enable(rdev, false);
-        r600_uvd_rbc_stop(rdev);
+        r600_uvd_stop(rdev);
        radeon_uvd_suspend(rdev);
        cik_irq_suspend(rdev);
        radeon_wb_disable(rdev);
@@ -6358,6 +6369,7 @@ void cik_fini(struct radeon_device *rdev)
        radeon_vm_manager_fini(rdev);
        radeon_ib_pool_fini(rdev);
        radeon_irq_kms_fini(rdev);
+        r600_uvd_stop(rdev);
        radeon_uvd_fini(rdev);
        cik_pcie_gart_fini(rdev);
        r600_vram_scratch_fini(rdev);
@@ -6978,7 +6990,7 @@ int cik_uvd_resume(struct radeon_device *rdev)
        /* programm the VCPU memory controller bits 0-27 */
        addr = rdev->uvd.gpu_addr >> 3;
-        size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
+        size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
        WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
        WREG32(UVD_VCPU_CACHE_SIZE0, size);
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index 9bcdd174780f..7e5d0b570a30 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -2038,9 +2038,6 @@ int cypress_dpm_init(struct radeon_device *rdev)
 {
        struct rv7xx_power_info *pi;
        struct evergreen_power_info *eg_pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        uint16_t data_offset, size;
-        uint8_t frev, crev;
        struct atom_clock_dividers dividers;
        int ret;
@@ -2092,16 +2089,7 @@ int cypress_dpm_init(struct radeon_device *rdev)
        eg_pi->vddci_control =
                radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_VDDCI, 0);
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
+        rv770_get_engine_memory_ss(rdev);
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = true;
-        }
        pi->asi = RV770_ASI_DFLT;
        pi->pasi = CYPRESS_HASI_DFLT;
@@ -2122,8 +2110,7 @@ int cypress_dpm_init(struct radeon_device *rdev)
        pi->dynamic_pcie_gen2 = true;
-        if (pi->gfx_clock_gating &&
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
                pi->thermal_protection = true;
        else
                pi->thermal_protection = false;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 038dcac7670c..d5b49e33315e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -5106,6 +5106,8 @@ static int evergreen_startup(struct radeon_device *rdev)
        /* enable aspm */
        evergreen_program_aspm(rdev);
+        evergreen_mc_program(rdev);
        if (ASIC_IS_DCE5(rdev)) {
                if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
                        r = ni_init_microcode(rdev);
@@ -5133,7 +5135,6 @@ static int evergreen_startup(struct radeon_device *rdev)
        if (r)
                return r;
-        evergreen_mc_program(rdev);
        if (rdev->flags & RADEON_IS_AGP) {
                evergreen_agp_enable(rdev);
        } else {
@@ -5291,10 +5292,10 @@ int evergreen_resume(struct radeon_device *rdev)
 int evergreen_suspend(struct radeon_device *rdev)
 {
        r600_audio_fini(rdev);
+        r600_uvd_stop(rdev);
        radeon_uvd_suspend(rdev);
        r700_cp_stop(rdev);
        r600_dma_stop(rdev);
-        r600_uvd_rbc_stop(rdev);
        evergreen_irq_suspend(rdev);
        radeon_wb_disable(rdev);
        evergreen_pcie_gart_disable(rdev);
@@ -5429,6 +5430,7 @@ void evergreen_fini(struct radeon_device *rdev)
        radeon_ib_pool_fini(rdev);
        radeon_irq_kms_fini(rdev);
        evergreen_pcie_gart_fini(rdev);
+        r600_uvd_stop(rdev);
        radeon_uvd_fini(rdev);
        r600_vram_scratch_fini(rdev);
        radeon_gem_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index bb9ea3641312..b0e280058b9b 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -148,18 +148,40 @@ static void evergreen_audio_set_dto(struct drm_encoder *encoder, u32 clock)
        struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
        struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
        u32 base_rate = 24000;
+        u32 max_ratio = clock / base_rate;
+        u32 dto_phase;
+        u32 dto_modulo = clock;
+        u32 wallclock_ratio;
+        u32 dto_cntl;
        if (!dig || !dig->afmt)
                return;
+        if (max_ratio >= 8) {
+                dto_phase = 192 * 1000;
+                wallclock_ratio = 3;
+        } else if (max_ratio >= 4) {
+                dto_phase = 96 * 1000;
+                wallclock_ratio = 2;
+        } else if (max_ratio >= 2) {
+                dto_phase = 48 * 1000;
+                wallclock_ratio = 1;
+        } else {
+                dto_phase = 24 * 1000;
+                wallclock_ratio = 0;
+        }
+        dto_cntl = RREG32(DCCG_AUDIO_DTO0_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
+        dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
+        WREG32(DCCG_AUDIO_DTO0_CNTL, dto_cntl);
        /* XXX two dtos; generally use dto0 for hdmi */
        /* Express [24MHz / target pixel clock] as an exact rational
         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
         */
        WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
-        WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
+        WREG32(DCCG_AUDIO_DTO0_PHASE, dto_phase);
-        WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
+        WREG32(DCCG_AUDIO_DTO0_MODULE, dto_modulo);
 }
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index a7baf67aef6c..0d582ac1dc31 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -497,6 +497,9 @@
 #define DCCG_AUDIO_DTO0_MODULE            0x05b4
 #define DCCG_AUDIO_DTO0_LOAD              0x05b8
 #define DCCG_AUDIO_DTO0_CNTL              0x05bc
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO(x) (((x) & 7) << 0)
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK 7
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO_SHIFT 0
 #define DCCG_AUDIO_DTO1_PHASE             0x05c0
 #define DCCG_AUDIO_DTO1_MODULE            0x05c4
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 56bd4f3be4fe..ccb4f8b54852 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -794,9 +794,13 @@ int ni_init_microcode(struct radeon_device *rdev)
        if ((rdev->family >= CHIP_BARTS) && (rdev->family <= CHIP_CAYMAN)) {
                snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", chip_name);
                err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
-                if (err)
+                if (err) {
-                        goto out;
+                        printk(KERN_ERR
-                if (rdev->smc_fw->size != smc_req_size) {
+                               "smc: error loading firmware \"%s\"\n",
+                               fw_name);
+                        release_firmware(rdev->smc_fw);
+                        rdev->smc_fw = NULL;
+                } else if (rdev->smc_fw->size != smc_req_size) {
                        printk(KERN_ERR
                               "ni_mc: Bogus length %zu in firmware \"%s\"\n",
                               rdev->mc_fw->size, fw_name);
@@ -2079,6 +2083,8 @@ static int cayman_startup(struct radeon_device *rdev)
        /* enable aspm */
        evergreen_program_aspm(rdev);
+        evergreen_mc_program(rdev);
        if (rdev->flags & RADEON_IS_IGP) {
                if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
                        r = ni_init_microcode(rdev);
@@ -2107,7 +2113,6 @@ static int cayman_startup(struct radeon_device *rdev)
        if (r)
                return r;
-        evergreen_mc_program(rdev);
        r = cayman_pcie_gart_enable(rdev);
        if (r)
                return r;
@@ -2286,7 +2291,7 @@ int cayman_suspend(struct radeon_device *rdev)
        radeon_vm_manager_fini(rdev);
        cayman_cp_enable(rdev, false);
        cayman_dma_stop(rdev);
-        r600_uvd_rbc_stop(rdev);
+        r600_uvd_stop(rdev);
        radeon_uvd_suspend(rdev);
        evergreen_irq_suspend(rdev);
        radeon_wb_disable(rdev);
@@ -2418,6 +2423,7 @@ void cayman_fini(struct radeon_device *rdev)
        radeon_vm_manager_fini(rdev);
        radeon_ib_pool_fini(rdev);
        radeon_irq_kms_fini(rdev);
+        r600_uvd_stop(rdev);
        radeon_uvd_fini(rdev);
        cayman_pcie_gart_fini(rdev);
        r600_vram_scratch_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 4f9b9bc20daa..f0f5f748938a 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -4067,9 +4067,6 @@ int ni_dpm_init(struct radeon_device *rdev)
        struct rv7xx_power_info *pi;
        struct evergreen_power_info *eg_pi;
        struct ni_power_info *ni_pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        u16 data_offset, size;
-        u8 frev, crev;
        struct atom_clock_dividers dividers;
        int ret;
@@ -4162,16 +4159,7 @@ int ni_dpm_init(struct radeon_device *rdev)
        eg_pi->vddci_control =
                radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_VDDCI, 0);
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
+        rv770_get_engine_memory_ss(rdev);
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = true;
-        }
        pi->asi = RV770_ASI_DFLT;
        pi->pasi = CYPRESS_HASI_DFLT;
@@ -4188,8 +4176,7 @@ int ni_dpm_init(struct radeon_device *rdev)
        pi->dynamic_pcie_gen2 = true;
-        if (pi->gfx_clock_gating &&
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
                pi->thermal_protection = true;
        else
                pi->thermal_protection = false;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 10f712e37003..e66e72077350 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2299,9 +2299,13 @@ int r600_init_microcode(struct radeon_device *rdev)
        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_HEMLOCK)) {
                snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", smc_chip_name);
                err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
-                if (err)
+                if (err) {
-                        goto out;
+                        printk(KERN_ERR
-                if (rdev->smc_fw->size != smc_req_size) {
+                               "smc: error loading firmware \"%s\"\n",
+                               fw_name);
+                        release_firmware(rdev->smc_fw);
+                        rdev->smc_fw = NULL;
+                } else if (rdev->smc_fw->size != smc_req_size) {
                        printk(KERN_ERR
                               "smc: Bogus length %zu in firmware \"%s\"\n",
                               rdev->smc_fw->size, fw_name);
@@ -2697,12 +2701,29 @@ int r600_uvd_rbc_start(struct radeon_device *rdev)
        return 0;
 }
-void r600_uvd_rbc_stop(struct radeon_device *rdev)
+void r600_uvd_stop(struct radeon_device *rdev)
 {
        struct radeon_ring *ring = &rdev->ring[R600_RING_TYPE_UVD_INDEX];
        /* force RBC into idle state */
        WREG32(UVD_RBC_RB_CNTL, 0x11010101);
+        /* Stall UMC and register bus before resetting VCPU */
+        WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
+        WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
+        mdelay(1);
+        /* put VCPU into reset */
+        WREG32(UVD_SOFT_RESET, VCPU_SOFT_RESET);
+        mdelay(5);
+        /* disable VCPU clock */
+        WREG32(UVD_VCPU_CNTL, 0x0);
+        /* Unstall UMC and register bus */
+        WREG32_P(UVD_LMI_CTRL2, 0, ~(1 << 8));
+        WREG32_P(UVD_RB_ARB_CTRL, 0, ~(1 << 3));
        ring->ready = false;
 }
@@ -2722,6 +2743,11 @@ int r600_uvd_init(struct radeon_device *rdev)
        /* disable interupt */
        WREG32_P(UVD_MASTINT_EN, 0, ~(1 << 1));
+        /* Stall UMC and register bus before resetting VCPU */
+        WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
+        WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
+        mdelay(1);
        /* put LMI, VCPU, RBC etc... into reset */
        WREG32(UVD_SOFT_RESET, LMI_SOFT_RESET | VCPU_SOFT_RESET |
               LBSI_SOFT_RESET | RBC_SOFT_RESET | CSM_SOFT_RESET |
@@ -2751,10 +2777,6 @@ int r600_uvd_init(struct radeon_device *rdev)
        WREG32(UVD_MPC_SET_ALU, 0);
        WREG32(UVD_MPC_SET_MUX, 0x88);
-        /* Stall UMC */
-        WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
-        WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
        /* take all subblocks out of reset, except VCPU */
        WREG32(UVD_SOFT_RESET, VCPU_SOFT_RESET);
        mdelay(5);
@@ -3312,6 +3334,8 @@ static int r600_startup(struct radeon_device *rdev)
        /* enable pcie gen2 link */
        r600_pcie_gen2_enable(rdev);
+        r600_mc_program(rdev);
        if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
                r = r600_init_microcode(rdev);
                if (r) {
@@ -3324,7 +3348,6 @@ static int r600_startup(struct radeon_device *rdev)
        if (r)
                return r;
-        r600_mc_program(rdev);
        if (rdev->flags & RADEON_IS_AGP) {
                r600_agp_enable(rdev);
        } else {
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index f48240bb8c56..f264df5470f7 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -226,10 +226,29 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
        struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
        u32 base_rate = 24000;
+        u32 max_ratio = clock / base_rate;
+        u32 dto_phase;
+        u32 dto_modulo = clock;
+        u32 wallclock_ratio;
+        u32 dto_cntl;
        if (!dig || !dig->afmt)
                return;
+        if (max_ratio >= 8) {
+                dto_phase = 192 * 1000;
+                wallclock_ratio = 3;
+        } else if (max_ratio >= 4) {
+                dto_phase = 96 * 1000;
+                wallclock_ratio = 2;
+        } else if (max_ratio >= 2) {
+                dto_phase = 48 * 1000;
+                wallclock_ratio = 1;
+        } else {
+                dto_phase = 24 * 1000;
+                wallclock_ratio = 0;
+        }
        /* there are two DTOs selected by DCCG_AUDIO_DTO_SELECT.
         * doesn't matter which one you use.  Just use the first one.
         */
@@ -242,9 +261,21 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                /* according to the reg specs, this should DCE3.2 only, but in
                 * practice it seems to cover DCE3.0 as well.
                 */
-                WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
+                if (dig->dig_encoder == 0) {
-                WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
+                        dto_cntl = RREG32(DCCG_AUDIO_DTO0_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
-                WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
+                        dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
+                        WREG32(DCCG_AUDIO_DTO0_CNTL, dto_cntl);
+                        WREG32(DCCG_AUDIO_DTO0_PHASE, dto_phase);
+                        WREG32(DCCG_AUDIO_DTO0_MODULE, dto_modulo);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
+                } else {
+                        dto_cntl = RREG32(DCCG_AUDIO_DTO1_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
+                        dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
+                        WREG32(DCCG_AUDIO_DTO1_CNTL, dto_cntl);
+                        WREG32(DCCG_AUDIO_DTO1_PHASE, dto_phase);
+                        WREG32(DCCG_AUDIO_DTO1_MODULE, dto_modulo);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
+                }
        } else {
                /* according to the reg specs, this should be DCE2.0 and DCE3.0 */
                WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 8e3fe815edab..7c780839a7f4 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -933,6 +933,9 @@
 #define DCCG_AUDIO_DTO0_LOAD              0x051c
 #       define DTO_LOAD                   (1 << 31)
 #define DCCG_AUDIO_DTO0_CNTL              0x0520
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO(x) (((x) & 7) << 0)
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK 7
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO_SHIFT 0
 #define DCCG_AUDIO_DTO1_PHASE             0x0524
 #define DCCG_AUDIO_DTO1_MODULE            0x0528
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 2f08219c39b6..9f19259667df 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1468,7 +1468,6 @@ struct radeon_uvd {
        void                    *cpu_addr;
        uint64_t                gpu_addr;
        void                    *saved_bo;
-        unsigned                fw_size;
        atomic_t                handles[RADEON_MAX_UVD_HANDLES];
        struct drm_file         *filp[RADEON_MAX_UVD_HANDLES];
        struct delayed_work     idle_work;
@@ -2066,6 +2065,7 @@ struct radeon_device {
        const struct firmware *mec_fw;  /* CIK MEC firmware */
        const struct firmware *sdma_fw; /* CIK SDMA firmware */
        const struct firmware *smc_fw;  /* SMC firmware */
+        const struct firmware *uvd_fw;  /* UVD firmware */
        struct r600_blit r600_blit;
        struct r600_vram_scratch vram_scratch;
        int msi_enabled; /* msi enabled */
@@ -2095,6 +2095,8 @@ struct radeon_device {
        /* ACPI interface */
        struct radeon_atif              atif;
        struct radeon_atcs              atcs;
+        /* srbm instance registers */
+        struct mutex                    srbm_mutex;
 };
 int radeon_device_init(struct radeon_device *rdev,
@@ -2161,7 +2163,7 @@ void cik_mm_wdoorbell(struct radeon_device *rdev, u32 offset, u32 v);
                WREG32(reg, tmp_);                              \
        } while (0)
 #define WREG32_AND(reg, and) WREG32_P(reg, 0, and)
-#define WREG32_OR(reg, or) WREG32_P(reg, or, ~or)
+#define WREG32_OR(reg, or) WREG32_P(reg, or, ~(or))
 #define WREG32_PLL_P(reg, val, mask)                            \
        do {                                                    \
                uint32_t tmp_ = RREG32_PLL(reg);                \
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 902479fa737f..3d61d5aac18f 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -441,7 +441,7 @@ void rs780_dpm_debugfs_print_current_performance_level(struct radeon_device *rde
 /* uvd */
 int r600_uvd_init(struct radeon_device *rdev);
 int r600_uvd_rbc_start(struct radeon_device *rdev);
-void r600_uvd_rbc_stop(struct radeon_device *rdev);
+void r600_uvd_stop(struct radeon_device *rdev);
 int r600_uvd_ib_test(struct radeon_device *rdev, struct radeon_ring *ring);
 void r600_uvd_fence_emit(struct radeon_device *rdev,
                         struct radeon_fence *fence);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 82335e38ec4f..63398ae1dbf5 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1163,6 +1163,7 @@ int radeon_device_init(struct radeon_device *rdev,
        mutex_init(&rdev->gem.mutex);
        mutex_init(&rdev->pm.mutex);
        mutex_init(&rdev->gpu_clock_mutex);
+        mutex_init(&rdev->srbm_mutex);
        init_rwsem(&rdev->pm.mclk_lock);
        init_rwsem(&rdev->exclusive_lock);
        init_waitqueue_head(&rdev->irq.vblank_queue);
@@ -1519,6 +1520,7 @@ int radeon_gpu_reset(struct radeon_device *rdev)
        radeon_save_bios_scratch_regs(rdev);
        /* block TTM */
        resched = ttm_bo_lock_delayed_workqueue(&rdev->mman.bdev);
+        radeon_pm_suspend(rdev);
        radeon_suspend(rdev);
        for (i = 0; i < RADEON_NUM_RINGS; ++i) {
@@ -1564,6 +1566,7 @@ retry:
                }
        }
+        radeon_pm_resume(rdev);
        drm_helper_resume_force_mode(rdev->ddev);
        ttm_bo_unlock_delayed_workqueue(&rdev->mman.bdev, resched);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 7ddb0efe2408..ddb8f8e04eb5 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -782,7 +782,7 @@ int radeon_fence_driver_start_ring(struct radeon_device *rdev, int ring)
                } else {
                        /* put fence directly behind firmware */
-                        index = ALIGN(rdev->uvd.fw_size, 8);
+                        index = ALIGN(rdev->uvd_fw->size, 8);
                        rdev->fence_drv[ring].cpu_addr = rdev->uvd.cpu_addr + index;
                        rdev->fence_drv[ring].gpu_addr = rdev->uvd.gpu_addr + index;
                }
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 6a51d943ccf4..b990b1a2bd50 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -207,7 +207,6 @@ void radeon_gart_table_vram_free(struct radeon_device *rdev)
        if (rdev->gart.robj == NULL) {
                return;
        }
-        radeon_gart_table_vram_unpin(rdev);
        radeon_bo_unref(&rdev->gart.robj);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index f374c467aaca..c557850cd345 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -1176,7 +1176,14 @@ int radeon_pm_init(struct radeon_device *rdev)
        case CHIP_VERDE:
        case CHIP_OLAND:
        case CHIP_HAINAN:
-                if (radeon_dpm == 1)
+                /* DPM requires the RLC, RV770+ dGPU requires SMC */
+                if (!rdev->rlc_fw)
+                        rdev->pm.pm_method = PM_METHOD_PROFILE;
+                else if ((rdev->family >= CHIP_RV770) &&
+                         (!(rdev->flags & RADEON_IS_IGP)) &&
+                         (!rdev->smc_fw))
+                        rdev->pm.pm_method = PM_METHOD_PROFILE;
+                else if (radeon_dpm == 1)
                        rdev->pm.pm_method = PM_METHOD_DPM;
                else
                        rdev->pm.pm_method = PM_METHOD_PROFILE;
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 414fd145d20e..b79f4f5cdd62 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -56,7 +56,6 @@ static void radeon_uvd_idle_work_handler(struct work_struct *work);
 int radeon_uvd_init(struct radeon_device *rdev)
 {
-        const struct firmware *fw;
        unsigned long bo_size;
        const char *fw_name;
        int i, r;
@@ -105,14 +104,14 @@ int radeon_uvd_init(struct radeon_device *rdev)
                return -EINVAL;
        }
-        r = request_firmware(&fw, fw_name, rdev->dev);
+        r = request_firmware(&rdev->uvd_fw, fw_name, rdev->dev);
        if (r) {
                dev_err(rdev->dev, "radeon_uvd: Can't load firmware \"%s\"\n",
                        fw_name);
                return r;
        }
-        bo_size = RADEON_GPU_PAGE_ALIGN(fw->size + 8) +
+        bo_size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 8) +
                  RADEON_UVD_STACK_SIZE + RADEON_UVD_HEAP_SIZE;
        r = radeon_bo_create(rdev, bo_size, PAGE_SIZE, true,
                             RADEON_GEM_DOMAIN_VRAM, NULL, &rdev->uvd.vcpu_bo);
@@ -145,12 +144,6 @@ int radeon_uvd_init(struct radeon_device *rdev)
        radeon_bo_unreserve(rdev->uvd.vcpu_bo);
-        rdev->uvd.fw_size = fw->size;
-        memset(rdev->uvd.cpu_addr, 0, bo_size);
-        memcpy(rdev->uvd.cpu_addr, fw->data, fw->size);
-        release_firmware(fw);
        for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
                atomic_set(&rdev->uvd.handles[i], 0);
                rdev->uvd.filp[i] = NULL;
@@ -174,33 +167,60 @@ void radeon_uvd_fini(struct radeon_device *rdev)
        }
        radeon_bo_unref(&rdev->uvd.vcpu_bo);
+        release_firmware(rdev->uvd_fw);
 }
 int radeon_uvd_suspend(struct radeon_device *rdev)
 {
        unsigned size;
+        void *ptr;
+        int i;
        if (rdev->uvd.vcpu_bo == NULL)
                return 0;
+        for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i)
+                if (atomic_read(&rdev->uvd.handles[i]))
+                        break;
+        if (i == RADEON_MAX_UVD_HANDLES)
+                return 0;
        size = radeon_bo_size(rdev->uvd.vcpu_bo);
+        size -= rdev->uvd_fw->size;
+        ptr = rdev->uvd.cpu_addr;
+        ptr += rdev->uvd_fw->size;
        rdev->uvd.saved_bo = kmalloc(size, GFP_KERNEL);
-        memcpy(rdev->uvd.saved_bo, rdev->uvd.cpu_addr, size);
+        memcpy(rdev->uvd.saved_bo, ptr, size);
        return 0;
 }
 int radeon_uvd_resume(struct radeon_device *rdev)
 {
+        unsigned size;
+        void *ptr;
        if (rdev->uvd.vcpu_bo == NULL)
                return -EINVAL;
+        memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
+        size = radeon_bo_size(rdev->uvd.vcpu_bo);
+        size -= rdev->uvd_fw->size;
+        ptr = rdev->uvd.cpu_addr;
+        ptr += rdev->uvd_fw->size;
        if (rdev->uvd.saved_bo != NULL) {
-                unsigned size = radeon_bo_size(rdev->uvd.vcpu_bo);
+                memcpy(ptr, rdev->uvd.saved_bo, size);
-                memcpy(rdev->uvd.cpu_addr, rdev->uvd.saved_bo, size);
                kfree(rdev->uvd.saved_bo);
                rdev->uvd.saved_bo = NULL;
-        }
+        } else
+                memset(ptr, 0, size);
        return 0;
 }
@@ -215,8 +235,8 @@ void radeon_uvd_free_handles(struct radeon_device *rdev, struct drm_file *filp)
 {
        int i, r;
        for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
-                if (rdev->uvd.filp[i] == filp) {
+                uint32_t handle = atomic_read(&rdev->uvd.handles[i]);
-                        uint32_t handle = atomic_read(&rdev->uvd.handles[i]);
+                if (handle != 0 && rdev->uvd.filp[i] == filp) {
                        struct radeon_fence *fence;
                        r = radeon_uvd_get_destroy_msg(rdev,
@@ -336,9 +356,19 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
                return -EINVAL;
        }
+        if (bo->tbo.sync_obj) {
+                r = radeon_fence_wait(bo->tbo.sync_obj, false);
+                if (r) {
+                        DRM_ERROR("Failed waiting for UVD message (%d)!\n", r);
+                        return r;
+                }
+        }
        r = radeon_bo_kmap(bo, &ptr);
-        if (r)
+        if (r) {
+                DRM_ERROR("Failed mapping the UVD message (%d)!\n", r);
                return r;
+        }
        msg = ptr + offset;
@@ -364,8 +394,14 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
                radeon_bo_kunmap(bo);
                return 0;
        } else {
-                /* it's a create msg, no special handling needed */
                radeon_bo_kunmap(bo);
+                if (msg_type != 0) {
+                        DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
+                        return -EINVAL;
+                }
+                /* it's a create msg, no special handling needed */
        }
        /* create or decode, validate the handle */
@@ -388,7 +424,7 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
 static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                               int data0, int data1,
-                               unsigned buf_sizes[])
+                               unsigned buf_sizes[], bool *has_msg_cmd)
 {
        struct radeon_cs_chunk *relocs_chunk;
        struct radeon_cs_reloc *reloc;
@@ -417,7 +453,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
        if (cmd < 0x4) {
                if ((end - start) < buf_sizes[cmd]) {
-                        DRM_ERROR("buffer to small (%d / %d)!\n",
+                        DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd,
                                  (unsigned)(end - start), buf_sizes[cmd]);
                        return -EINVAL;
                }
@@ -442,9 +478,17 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
        }
        if (cmd == 0) {
+                if (*has_msg_cmd) {
+                        DRM_ERROR("More than one message in a UVD-IB!\n");
+                        return -EINVAL;
+                }
+                *has_msg_cmd = true;
                r = radeon_uvd_cs_msg(p, reloc->robj, offset, buf_sizes);
                if (r)
                        return r;
+        } else if (!*has_msg_cmd) {
+                DRM_ERROR("Message needed before other commands are send!\n");
+                return -EINVAL;
        }
        return 0;
@@ -453,7 +497,8 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
 static int radeon_uvd_cs_reg(struct radeon_cs_parser *p,
                             struct radeon_cs_packet *pkt,
                             int *data0, int *data1,
-                             unsigned buf_sizes[])
+                             unsigned buf_sizes[],
+                             bool *has_msg_cmd)
 {
        int i, r;
@@ -467,7 +512,8 @@ static int radeon_uvd_cs_reg(struct radeon_cs_parser *p,
                        *data1 = p->idx;
                        break;
                case UVD_GPCOM_VCPU_CMD:
-                        r = radeon_uvd_cs_reloc(p, *data0, *data1, buf_sizes);
+                        r = radeon_uvd_cs_reloc(p, *data0, *data1,
+                                                buf_sizes, has_msg_cmd);
                        if (r)
                                return r;
                        break;
@@ -488,6 +534,9 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p)
        struct radeon_cs_packet pkt;
        int r, data0 = 0, data1 = 0;
+        /* does the IB has a msg command */
+        bool has_msg_cmd = false;
        /* minimum buffer sizes */
        unsigned buf_sizes[] = {
                [0x00000000]    =       2048,
@@ -514,8 +563,8 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p)
                        return r;
                switch (pkt.type) {
                case RADEON_PACKET_TYPE0:
-                        r = radeon_uvd_cs_reg(p, &pkt, &data0,
+                        r = radeon_uvd_cs_reg(p, &pkt, &data0, &data1,
-                                              &data1, buf_sizes);
+                                              buf_sizes, &has_msg_cmd);
                        if (r)
                                return r;
                        break;
@@ -527,6 +576,12 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p)
                        return -EINVAL;
                }
        } while (p->idx < p->chunks[p->chunk_ib_idx].length_dw);
+        if (!has_msg_cmd) {
+                DRM_ERROR("UVD-IBs need a msg command!\n");
+                return -EINVAL;
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/rv6xx_dpm.c b/drivers/gpu/drm/radeon/rv6xx_dpm.c
index 363018c60412..bdd888b4db2b 100644
--- a/drivers/gpu/drm/radeon/rv6xx_dpm.c
+++ b/drivers/gpu/drm/radeon/rv6xx_dpm.c
@@ -1944,9 +1944,7 @@ static int rv6xx_parse_power_table(struct radeon_device *rdev)
 int rv6xx_dpm_init(struct radeon_device *rdev)
 {
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
+        struct radeon_atom_ss ss;
-        uint16_t data_offset, size;
-        uint8_t frev, crev;
        struct atom_clock_dividers dividers;
        struct rv6xx_power_info *pi;
        int ret;
@@ -1989,16 +1987,18 @@ int rv6xx_dpm_init(struct radeon_device *rdev)
        pi->gfx_clock_gating = true;
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
+        pi->sclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
-                                   &frev, &crev, &data_offset)) {
+                                                       ASIC_INTERNAL_ENGINE_SS, 0);
-                pi->sclk_ss = true;
+        pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
-                pi->mclk_ss = true;
+                                                       ASIC_INTERNAL_MEMORY_SS, 0);
+        /* Disable sclk ss, causes hangs on a lot of systems */
+        pi->sclk_ss = false;
+        if (pi->sclk_ss || pi->mclk_ss)
                pi->dynamic_ss = true;
-        } else {
+        else
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
                pi->dynamic_ss = false;
-        }
        pi->dynamic_pcie_gen2 = true;
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 30ea14e8854c..f5e92cfcc140 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -744,10 +744,10 @@ static void rv770_init_golden_registers(struct radeon_device *rdev)
                                                 (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers));
                radeon_program_register_sequence(rdev,
                                                 rv730_golden_registers,
-                                                 (const u32)ARRAY_SIZE(rv770_golden_registers));
+                                                 (const u32)ARRAY_SIZE(rv730_golden_registers));
                radeon_program_register_sequence(rdev,
                                                 rv730_mgcg_init,
-                                                 (const u32)ARRAY_SIZE(rv770_mgcg_init));
+                                                 (const u32)ARRAY_SIZE(rv730_mgcg_init));
                break;
        case CHIP_RV710:
                radeon_program_register_sequence(rdev,
@@ -758,18 +758,18 @@ static void rv770_init_golden_registers(struct radeon_device *rdev)
                                                 (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers));
                radeon_program_register_sequence(rdev,
                                                 rv710_golden_registers,
-                                                 (const u32)ARRAY_SIZE(rv770_golden_registers));
+                                                 (const u32)ARRAY_SIZE(rv710_golden_registers));
                radeon_program_register_sequence(rdev,
                                                 rv710_mgcg_init,
-                                                 (const u32)ARRAY_SIZE(rv770_mgcg_init));
+                                                 (const u32)ARRAY_SIZE(rv710_mgcg_init));
                break;
        case CHIP_RV740:
                radeon_program_register_sequence(rdev,
                                                 rv740_golden_registers,
-                                                 (const u32)ARRAY_SIZE(rv770_golden_registers));
+                                                 (const u32)ARRAY_SIZE(rv740_golden_registers));
                radeon_program_register_sequence(rdev,
                                                 rv740_mgcg_init,
-                                                 (const u32)ARRAY_SIZE(rv770_mgcg_init));
+                                                 (const u32)ARRAY_SIZE(rv740_mgcg_init));
                break;
        default:
                break;
@@ -813,7 +813,7 @@ int rv770_uvd_resume(struct radeon_device *rdev)
        /* programm the VCPU memory controller bits 0-27 */
        addr = rdev->uvd.gpu_addr >> 3;
-        size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
+        size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
        WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
        WREG32(UVD_VCPU_CACHE_SIZE0, size);
@@ -1829,6 +1829,8 @@ static int rv770_startup(struct radeon_device *rdev)
        /* enable pcie gen2 link */
        rv770_pcie_gen2_enable(rdev);
+        rv770_mc_program(rdev);
        if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
                r = r600_init_microcode(rdev);
                if (r) {
@@ -1841,7 +1843,6 @@ static int rv770_startup(struct radeon_device *rdev)
        if (r)
                return r;
-        rv770_mc_program(rdev);
        if (rdev->flags & RADEON_IS_AGP) {
                rv770_agp_enable(rdev);
        } else {
@@ -1983,6 +1984,7 @@ int rv770_resume(struct radeon_device *rdev)
 int rv770_suspend(struct radeon_device *rdev)
 {
        r600_audio_fini(rdev);
+        r600_uvd_stop(rdev);
        radeon_uvd_suspend(rdev);
        r700_cp_stop(rdev);
        r600_dma_stop(rdev);
@@ -2098,6 +2100,7 @@ void rv770_fini(struct radeon_device *rdev)
        radeon_ib_pool_fini(rdev);
        radeon_irq_kms_fini(rdev);
        rv770_pcie_gart_fini(rdev);
+        r600_uvd_stop(rdev);
        radeon_uvd_fini(rdev);
        r600_vram_scratch_fini(rdev);
        radeon_gem_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 2d347925f77d..094c67a29d0d 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2319,12 +2319,25 @@ int rv7xx_parse_power_table(struct radeon_device *rdev)
        return 0;
 }
+void rv770_get_engine_memory_ss(struct radeon_device *rdev)
+{
+        struct rv7xx_power_info *pi = rv770_get_pi(rdev);
+        struct radeon_atom_ss ss;
+        pi->sclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
+                                                       ASIC_INTERNAL_ENGINE_SS, 0);
+        pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
+                                                       ASIC_INTERNAL_MEMORY_SS, 0);
+        if (pi->sclk_ss || pi->mclk_ss)
+                pi->dynamic_ss = true;
+        else
+                pi->dynamic_ss = false;
+}
 int rv770_dpm_init(struct radeon_device *rdev)
 {
        struct rv7xx_power_info *pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        uint16_t data_offset, size;
-        uint8_t frev, crev;
        struct atom_clock_dividers dividers;
        int ret;
@@ -2369,16 +2382,7 @@ int rv770_dpm_init(struct radeon_device *rdev)
        pi->mvdd_control =
                radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_MVDDC, 0);
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
+        rv770_get_engine_memory_ss(rdev);
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = false;
-        }
        pi->asi = RV770_ASI_DFLT;
        pi->pasi = RV770_HASI_DFLT;
@@ -2393,8 +2397,7 @@ int rv770_dpm_init(struct radeon_device *rdev)
        pi->dynamic_pcie_gen2 = true;
-        if (pi->gfx_clock_gating &&
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
                pi->thermal_protection = true;
        else
                pi->thermal_protection = false;
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.h b/drivers/gpu/drm/radeon/rv770_dpm.h
index 96b1b2a62a8a..9244effc6b59 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.h
+++ b/drivers/gpu/drm/radeon/rv770_dpm.h
@@ -275,6 +275,7 @@ void rv770_set_uvd_clock_before_set_eng_clock(struct radeon_device *rdev,
 void rv770_set_uvd_clock_after_set_eng_clock(struct radeon_device *rdev,
                                             struct radeon_ps *new_ps,
                                             struct radeon_ps *old_ps);
+void rv770_get_engine_memory_ss(struct radeon_device *rdev);
 /* smc */
 int rv770_read_smc_soft_register(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 6ca904673a4f..daa8d2df8ec5 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -1663,9 +1663,13 @@ static int si_init_microcode(struct radeon_device *rdev)
        snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", chip_name);
        err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
-        if (err)
+        if (err) {
-                goto out;
+                printk(KERN_ERR
-        if (rdev->smc_fw->size != smc_req_size) {
+                       "smc: error loading firmware \"%s\"\n",
+                       fw_name);
+                release_firmware(rdev->smc_fw);
+                rdev->smc_fw = NULL;
+        } else if (rdev->smc_fw->size != smc_req_size) {
                printk(KERN_ERR
                       "si_smc: Bogus length %zu in firmware \"%s\"\n",
                       rdev->smc_fw->size, fw_name);
@@ -6418,6 +6422,8 @@ static int si_startup(struct radeon_device *rdev)
        /* enable aspm */
        si_program_aspm(rdev);
+        si_mc_program(rdev);
        if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
            !rdev->rlc_fw || !rdev->mc_fw) {
                r = si_init_microcode(rdev);
@@ -6437,7 +6443,6 @@ static int si_startup(struct radeon_device *rdev)
        if (r)
                return r;
-        si_mc_program(rdev);
        r = si_pcie_gart_enable(rdev);
        if (r)
                return r;
@@ -6621,7 +6626,7 @@ int si_suspend(struct radeon_device *rdev)
        si_cp_enable(rdev, false);
        cayman_dma_stop(rdev);
        if (rdev->has_uvd) {
-                r600_uvd_rbc_stop(rdev);
+                r600_uvd_stop(rdev);
                radeon_uvd_suspend(rdev);
        }
        si_irq_suspend(rdev);
@@ -6763,8 +6768,10 @@ void si_fini(struct radeon_device *rdev)
        radeon_vm_manager_fini(rdev);
        radeon_ib_pool_fini(rdev);
        radeon_irq_kms_fini(rdev);
-        if (rdev->has_uvd)
+        if (rdev->has_uvd) {
+                r600_uvd_stop(rdev);
                radeon_uvd_fini(rdev);
+        }
        si_pcie_gart_fini(rdev);
        r600_vram_scratch_fini(rdev);
        radeon_gem_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 41825575b403..88699e3cd868 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2903,7 +2903,8 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
 {
        struct ni_ps *ps = ni_get_ps(rps);
        struct radeon_clock_and_voltage_limits *max_limits;
-        bool disable_mclk_switching;
+        bool disable_mclk_switching = false;
+        bool disable_sclk_switching = false;
        u32 mclk, sclk;
        u16 vddc, vddci;
        int i;
@@ -2911,8 +2912,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
            ni_dpm_vblank_too_short(rdev))
                disable_mclk_switching = true;
-        else
-                disable_mclk_switching = false;
+        if (rps->vclk || rps->dclk) {
+                disable_mclk_switching = true;
+                disable_sclk_switching = true;
+        }
        if (rdev->pm.dpm.ac_power)
                max_limits = &rdev->pm.dpm.dyn_state.max_clock_voltage_on_ac;
@@ -2940,27 +2944,43 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
        if (disable_mclk_switching) {
                mclk  = ps->performance_levels[ps->performance_level_count - 1].mclk;
-                sclk = ps->performance_levels[0].sclk;
-                vddc = ps->performance_levels[0].vddc;
                vddci = ps->performance_levels[ps->performance_level_count - 1].vddci;
        } else {
-                sclk = ps->performance_levels[0].sclk;
                mclk = ps->performance_levels[0].mclk;
-                vddc = ps->performance_levels[0].vddc;
                vddci = ps->performance_levels[0].vddci;
        }
+        if (disable_sclk_switching) {
+                sclk = ps->performance_levels[ps->performance_level_count - 1].sclk;
+                vddc = ps->performance_levels[ps->performance_level_count - 1].vddc;
+        } else {
+                sclk = ps->performance_levels[0].sclk;
+                vddc = ps->performance_levels[0].vddc;
+        }
        /* adjusted low state */
        ps->performance_levels[0].sclk = sclk;
        ps->performance_levels[0].mclk = mclk;
        ps->performance_levels[0].vddc = vddc;
        ps->performance_levels[0].vddci = vddci;
-        for (i = 1; i < ps->performance_level_count; i++) {
+        if (disable_sclk_switching) {
-                if (ps->performance_levels[i].sclk < ps->performance_levels[i - 1].sclk)
+                sclk = ps->performance_levels[0].sclk;
-                        ps->performance_levels[i].sclk = ps->performance_levels[i - 1].sclk;
+                for (i = 1; i < ps->performance_level_count; i++) {
-                if (ps->performance_levels[i].vddc < ps->performance_levels[i - 1].vddc)
+                        if (sclk < ps->performance_levels[i].sclk)
-                        ps->performance_levels[i].vddc = ps->performance_levels[i - 1].vddc;
+                                sclk = ps->performance_levels[i].sclk;
+                }
+                for (i = 0; i < ps->performance_level_count; i++) {
+                        ps->performance_levels[i].sclk = sclk;
+                        ps->performance_levels[i].vddc = vddc;
+                }
+        } else {
+                for (i = 1; i < ps->performance_level_count; i++) {
+                        if (ps->performance_levels[i].sclk < ps->performance_levels[i - 1].sclk)
+                                ps->performance_levels[i].sclk = ps->performance_levels[i - 1].sclk;
+                        if (ps->performance_levels[i].vddc < ps->performance_levels[i - 1].vddc)
+                                ps->performance_levels[i].vddc = ps->performance_levels[i - 1].vddc;
+                }
        }
        if (disable_mclk_switching) {
@@ -6253,9 +6273,6 @@ int si_dpm_init(struct radeon_device *rdev)
        struct evergreen_power_info *eg_pi;
        struct ni_power_info *ni_pi;
        struct si_power_info *si_pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        u16 data_offset, size;
-        u8 frev, crev;
        struct atom_clock_dividers dividers;
        int ret;
        u32 mask;
@@ -6346,16 +6363,7 @@ int si_dpm_init(struct radeon_device *rdev)
        si_pi->vddc_phase_shed_control =
                radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_VDDC, VOLTAGE_OBJ_PHASE_LUT);
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
+        rv770_get_engine_memory_ss(rdev);
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = true;
-        }
        pi->asi = RV770_ASI_DFLT;
        pi->pasi = CYPRESS_HASI_DFLT;
@@ -6366,8 +6374,7 @@ int si_dpm_init(struct radeon_device *rdev)
        eg_pi->sclk_deep_sleep = true;
        si_pi->sclk_deep_sleep_above_low = false;
-        if (pi->gfx_clock_gating &&
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
                pi->thermal_protection = true;
        else
                pi->thermal_protection = false;
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 7a5764843bfb..cd33084c7860 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -488,8 +488,6 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
        if (djrcv_dev->querying_devices)
                return 0;
-        djrcv_dev->querying_devices = true;
        dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
        if (!dj_report)
                return -ENOMEM;
diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 0f34bca9f5e5..6099f50b28aa 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -215,7 +215,7 @@ static inline int adt7470_write_word_data(struct i2c_client *client, u8 reg,
                                          u16 value)
 {
        return i2c_smbus_write_byte_data(client, reg, value & 0xFF)
-               && i2c_smbus_write_byte_data(client, reg + 1, value >> 8);
+               || i2c_smbus_write_byte_data(client, reg + 1, value >> 8);
 }
 static void adt7470_init_client(struct i2c_client *client)
diff --git a/drivers/i2c/busses/i2c-kempld.c b/drivers/i2c/busses/i2c-kempld.c
index ccec916bc3eb..af8f65fb1c05 100644
--- a/drivers/i2c/busses/i2c-kempld.c
+++ b/drivers/i2c/busses/i2c-kempld.c
@@ -246,9 +246,9 @@ static void kempld_i2c_device_init(struct kempld_i2c_data *i2c)
                bus_frequency = KEMPLD_I2C_FREQ_MAX;
        if (pld->info.spec_major == 1)
-                prescale = pld->pld_clock / bus_frequency * 5 - 1000;
+                prescale = pld->pld_clock / (bus_frequency * 5) - 1000;
        else
-                prescale = pld->pld_clock / bus_frequency * 4 - 3000;
+                prescale = pld->pld_clock / (bus_frequency * 4) - 3000;
        if (prescale < 0)
                prescale = 0;
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index df8ff5aea5b5..e2e9a0dade96 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -493,7 +493,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
         * based on this empirical measurement and a lot of previous frobbing.
         */
        i2c->cmd_err = 0;
-        if (msg->len < 8) {
+        if (0) {        /* disable PIO mode until a proper fix is made */
                ret = mxs_i2c_pio_setup_xfer(adap, msg, flags);
                if (ret)
                        mxs_i2c_reset(i2c);
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 0ad208a69c29..3ceac3e91dde 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -60,7 +60,6 @@ static void tiadc_step_config(struct tiadc_device *adc_dev)
 {
        unsigned int stepconfig;
        int i, steps;
-        u32 step_en;
        /*
         * There are 16 configurable steps and 8 analog input
@@ -86,8 +85,7 @@ static void tiadc_step_config(struct tiadc_device *adc_dev)
                adc_dev->channel_step[i] = steps;
                steps++;
        }
-        step_en = get_adc_step_mask(adc_dev);
-        am335x_tsc_se_set(adc_dev->mfd_tscadc, step_en);
 }
 static const char * const chan_name_ain[] = {
@@ -142,10 +140,22 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
                int *val, int *val2, long mask)
 {
        struct tiadc_device *adc_dev = iio_priv(indio_dev);
-        int i;
+        int i, map_val;
-        unsigned int fifo1count, read;
+        unsigned int fifo1count, read, stepid;
        u32 step = UINT_MAX;
        bool found = false;
+        u32 step_en;
+        unsigned long timeout = jiffies + usecs_to_jiffies
+                                (IDLE_TIMEOUT * adc_dev->channels);
+        step_en = get_adc_step_mask(adc_dev);
+        am335x_tsc_se_set(adc_dev->mfd_tscadc, step_en);
+        /* Wait for ADC sequencer to complete sampling */
+        while (tiadc_readl(adc_dev, REG_ADCFSM) & SEQ_STATUS) {
+                if (time_after(jiffies, timeout))
+                        return -EAGAIN;
+                }
+        map_val = chan->channel + TOTAL_CHANNELS;
        /*
         * When the sub-system is first enabled,
@@ -170,12 +180,16 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
        fifo1count = tiadc_readl(adc_dev, REG_FIFO1CNT);
        for (i = 0; i < fifo1count; i++) {
                read = tiadc_readl(adc_dev, REG_FIFO1);
-                if (read >> 16 == step) {
+                stepid = read & FIFOREAD_CHNLID_MASK;
-                        *val = read & 0xfff;
+                stepid = stepid >> 0x10;
+                if (stepid == map_val) {
+                        read = read & FIFOREAD_DATA_MASK;
                        found = true;
+                        *val = read;
                }
        }
-        am335x_tsc_se_update(adc_dev->mfd_tscadc);
        if (found == false)
                return -EBUSY;
        return IIO_VAL_INT;
diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index ea8a4146620d..0dd9bb873130 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -127,12 +127,17 @@ static struct iio_trigger *iio_trigger_find_by_name(const char *name,
 void iio_trigger_poll(struct iio_trigger *trig, s64 time)
 {
        int i;
-        if (!trig->use_count)
-                for (i = 0; i < CONFIG_IIO_CONSUMERS_PER_TRIGGER; i++)
+        if (!atomic_read(&trig->use_count)) {
-                        if (trig->subirqs[i].enabled) {
+                atomic_set(&trig->use_count, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
-                                trig->use_count++;
+                for (i = 0; i < CONFIG_IIO_CONSUMERS_PER_TRIGGER; i++) {
+                        if (trig->subirqs[i].enabled)
                                generic_handle_irq(trig->subirq_base + i);
-                        }
+                        else
+                                iio_trigger_notify_done(trig);
+                }
+        }
 }
 EXPORT_SYMBOL(iio_trigger_poll);
@@ -146,19 +151,24 @@ EXPORT_SYMBOL(iio_trigger_generic_data_rdy_poll);
 void iio_trigger_poll_chained(struct iio_trigger *trig, s64 time)
 {
        int i;
-        if (!trig->use_count)
-                for (i = 0; i < CONFIG_IIO_CONSUMERS_PER_TRIGGER; i++)
+        if (!atomic_read(&trig->use_count)) {
-                        if (trig->subirqs[i].enabled) {
+                atomic_set(&trig->use_count, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
-                                trig->use_count++;
+                for (i = 0; i < CONFIG_IIO_CONSUMERS_PER_TRIGGER; i++) {
+                        if (trig->subirqs[i].enabled)
                                handle_nested_irq(trig->subirq_base + i);
-                        }
+                        else
+                                iio_trigger_notify_done(trig);
+                }
+        }
 }
 EXPORT_SYMBOL(iio_trigger_poll_chained);
 void iio_trigger_notify_done(struct iio_trigger *trig)
 {
-        trig->use_count--;
+        if (atomic_dec_and_test(&trig->use_count) && trig->ops &&
-        if (trig->use_count == 0 && trig->ops && trig->ops->try_reenable)
+                trig->ops->try_reenable)
                if (trig->ops->try_reenable(trig))
                        /* Missed an interrupt so launch new poll now */
                        iio_trigger_poll(trig, 0);
diff --git a/drivers/iio/light/adjd_s311.c b/drivers/iio/light/adjd_s311.c
index 5f4749e60b04..c1cd5698b8ae 100644
--- a/drivers/iio/light/adjd_s311.c
+++ b/drivers/iio/light/adjd_s311.c
@@ -232,7 +232,8 @@ static int adjd_s311_read_raw(struct iio_dev *indio_dev,
        switch (mask) {
        case IIO_CHAN_INFO_RAW:
-                ret = adjd_s311_read_data(indio_dev, chan->address, val);
+                ret = adjd_s311_read_data(indio_dev,
+                        ADJD_S311_DATA_REG(chan->address), val);
                if (ret < 0)
                        return ret;
                return IIO_VAL_INT;
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index dc112a7137fe..4296155090b2 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -959,23 +959,21 @@ out:
        return r;
 }
-static void remove_mapping(struct mq_policy *mq, dm_oblock_t oblock)
+static void mq_remove_mapping(struct dm_cache_policy *p, dm_oblock_t oblock)
 {
-        struct entry *e = hash_lookup(mq, oblock);
+        struct mq_policy *mq = to_mq_policy(p);
+        struct entry *e;
+        mutex_lock(&mq->lock);
+        e = hash_lookup(mq, oblock);
        BUG_ON(!e || !e->in_cache);
        del(mq, e);
        e->in_cache = false;
        push(mq, e);
-}
-static void mq_remove_mapping(struct dm_cache_policy *p, dm_oblock_t oblock)
-{
-        struct mq_policy *mq = to_mq_policy(p);
-        mutex_lock(&mq->lock);
-        remove_mapping(mq, oblock);
        mutex_unlock(&mq->lock);
 }
diff --git a/drivers/media/i2c/ml86v7667.c b/drivers/media/i2c/ml86v7667.c
index efdc873e58d1..a9857022f71d 100644
--- a/drivers/media/i2c/ml86v7667.c
+++ b/drivers/media/i2c/ml86v7667.c
@@ -117,7 +117,7 @@ static int ml86v7667_s_ctrl(struct v4l2_ctrl *ctrl)
 {
        struct v4l2_subdev *sd = to_sd(ctrl);
        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        int ret;
+        int ret = -EINVAL;
        switch (ctrl->id) {
        case V4L2_CID_BRIGHTNESS:
@@ -157,7 +157,7 @@ static int ml86v7667_s_ctrl(struct v4l2_ctrl *ctrl)
                break;
        }
-        return 0;
+        return ret;
 }
 static int ml86v7667_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
index df4ada880e42..bd9405df1bd6 100644
--- a/drivers/media/platform/coda.c
+++ b/drivers/media/platform/coda.c
@@ -1987,7 +1987,7 @@ MODULE_DEVICE_TABLE(platform, coda_platform_ids);
 #ifdef CONFIG_OF
 static const struct of_device_id coda_dt_ids[] = {
-        { .compatible = "fsl,imx27-vpu", .data = &coda_platform_ids[CODA_IMX27] },
+        { .compatible = "fsl,imx27-vpu", .data = &coda_devdata[CODA_IMX27] },
        { .compatible = "fsl,imx53-vpu", .data = &coda_devdata[CODA_IMX53] },
        { /* sentinel */ }
 };
diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c
index 553d87e5ceab..fd6289d60cde 100644
--- a/drivers/media/platform/s5p-g2d/g2d.c
+++ b/drivers/media/platform/s5p-g2d/g2d.c
@@ -784,6 +784,7 @@ static int g2d_probe(struct platform_device *pdev)
        }
        *vfd = g2d_videodev;
        vfd->lock = &dev->mutex;
+        vfd->v4l2_dev = &dev->v4l2_dev;
        ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
        if (ret) {
                v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c b/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
index 5296385153d5..4f6dd42c9adb 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
@@ -344,7 +344,7 @@ static int vidioc_g_fmt(struct file *file, void *priv, struct v4l2_format *f)
                pix_mp->num_planes = 2;
                /* Set pixelformat to the format in which MFC
                   outputs the decoded frame */
-                pix_mp->pixelformat = V4L2_PIX_FMT_NV12MT;
+                pix_mp->pixelformat = ctx->dst_fmt->fourcc;
                pix_mp->plane_fmt[0].bytesperline = ctx->buf_width;
                pix_mp->plane_fmt[0].sizeimage = ctx->luma_size;
                pix_mp->plane_fmt[1].bytesperline = ctx->buf_width;
@@ -382,10 +382,16 @@ static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f)
                        mfc_err("Unsupported format for source.\n");
                        return -EINVAL;
                }
-                if (!IS_MFCV6(dev) && (fmt->fourcc == V4L2_PIX_FMT_VP8)) {
+                if (fmt->codec_mode == S5P_FIMV_CODEC_NONE) {
-                        mfc_err("Not supported format.\n");
+                        mfc_err("Unknown codec\n");
                        return -EINVAL;
                }
+                if (!IS_MFCV6(dev)) {
+                        if (fmt->fourcc == V4L2_PIX_FMT_VP8) {
+                                mfc_err("Not supported format.\n");
+                                return -EINVAL;
+                        }
+                }
        } else if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
                fmt = find_format(f, MFC_FMT_RAW);
                if (!fmt) {
@@ -411,7 +417,6 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
        struct s5p_mfc_dev *dev = video_drvdata(file);
        struct s5p_mfc_ctx *ctx = fh_to_ctx(priv);
        int ret = 0;
-        struct s5p_mfc_fmt *fmt;
        struct v4l2_pix_format_mplane *pix_mp;
        mfc_debug_enter();
@@ -425,54 +430,32 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
                goto out;
        }
        if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
-                fmt = find_format(f, MFC_FMT_RAW);
+                /* dst_fmt is validated by call to vidioc_try_fmt */
-                if (!fmt) {
+                ctx->dst_fmt = find_format(f, MFC_FMT_RAW);
-                        mfc_err("Unsupported format for source.\n");
+                ret = 0;
-                        return -EINVAL;
-                }
-                if (!IS_MFCV6(dev) && (fmt->fourcc != V4L2_PIX_FMT_NV12MT)) {
-                        mfc_err("Not supported format.\n");
-                        return -EINVAL;
-                } else if (IS_MFCV6(dev) &&
-                                (fmt->fourcc == V4L2_PIX_FMT_NV12MT)) {
-                        mfc_err("Not supported format.\n");
-                        return -EINVAL;
-                }
-                ctx->dst_fmt = fmt;
-                mfc_debug_leave();
-                return ret;
-        } else if (f->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
-                mfc_err("Wrong type error for S_FMT : %d", f->type);
-                return -EINVAL;
-        }
-        fmt = find_format(f, MFC_FMT_DEC);
-        if (!fmt || fmt->codec_mode == S5P_MFC_CODEC_NONE) {
-                mfc_err("Unknown codec\n");
-                ret = -EINVAL;
                goto out;
-        }
+        } else if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
-        if (fmt->type != MFC_FMT_DEC) {
+                /* src_fmt is validated by call to vidioc_try_fmt */
-                mfc_err("Wrong format selected, you should choose "
+                ctx->src_fmt = find_format(f, MFC_FMT_DEC);
-                                        "format for decoding\n");
+                ctx->codec_mode = ctx->src_fmt->codec_mode;
+                mfc_debug(2, "The codec number is: %d\n", ctx->codec_mode);
+                pix_mp->height = 0;
+                pix_mp->width = 0;
+                if (pix_mp->plane_fmt[0].sizeimage)
+                        ctx->dec_src_buf_size = pix_mp->plane_fmt[0].sizeimage;
+                else
+                        pix_mp->plane_fmt[0].sizeimage = ctx->dec_src_buf_size =
+                                                                DEF_CPB_SIZE;
+                pix_mp->plane_fmt[0].bytesperline = 0;
+                ctx->state = MFCINST_INIT;
+                ret = 0;
+                goto out;
+        } else {
+                mfc_err("Wrong type error for S_FMT : %d", f->type);
                ret = -EINVAL;
                goto out;
        }
-        if (!IS_MFCV6(dev) && (fmt->fourcc == V4L2_PIX_FMT_VP8)) {
-                mfc_err("Not supported format.\n");
-                return -EINVAL;
-        }
-        ctx->src_fmt = fmt;
-        ctx->codec_mode = fmt->codec_mode;
-        mfc_debug(2, "The codec number is: %d\n", ctx->codec_mode);
-        pix_mp->height = 0;
-        pix_mp->width = 0;
-        if (pix_mp->plane_fmt[0].sizeimage)
-                ctx->dec_src_buf_size = pix_mp->plane_fmt[0].sizeimage;
-        else
-                pix_mp->plane_fmt[0].sizeimage = ctx->dec_src_buf_size =
-                                                                DEF_CPB_SIZE;
-        pix_mp->plane_fmt[0].bytesperline = 0;
-        ctx->state = MFCINST_INIT;
 out:
        mfc_debug_leave();
        return ret;
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
index 2549967b2f85..59e56f4c8ce3 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
@@ -906,6 +906,7 @@ static int vidioc_g_fmt(struct file *file, void *priv, struct v4l2_format *f)
 static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f)
 {
+        struct s5p_mfc_dev *dev = video_drvdata(file);
        struct s5p_mfc_fmt *fmt;
        struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
@@ -930,6 +931,18 @@ static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f)
                        return -EINVAL;
                }
+                if (!IS_MFCV6(dev)) {
+                        if (fmt->fourcc == V4L2_PIX_FMT_NV12MT_16X16) {
+                                mfc_err("Not supported format.\n");
+                                return -EINVAL;
+                        }
+                } else if (IS_MFCV6(dev)) {
+                        if (fmt->fourcc == V4L2_PIX_FMT_NV12MT) {
+                                mfc_err("Not supported format.\n");
+                                return -EINVAL;
+                        }
+                }
                if (fmt->num_planes != pix_fmt_mp->num_planes) {
                        mfc_err("failed to try output format\n");
                        return -EINVAL;
@@ -947,7 +960,6 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
 {
        struct s5p_mfc_dev *dev = video_drvdata(file);
        struct s5p_mfc_ctx *ctx = fh_to_ctx(priv);
-        struct s5p_mfc_fmt *fmt;
        struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
        int ret = 0;
@@ -960,13 +972,9 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
                goto out;
        }
        if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
-                fmt = find_format(f, MFC_FMT_ENC);
+                /* dst_fmt is validated by call to vidioc_try_fmt */
-                if (!fmt) {
+                ctx->dst_fmt = find_format(f, MFC_FMT_ENC);
-                        mfc_err("failed to set capture format\n");
-                        return -EINVAL;
-                }
                ctx->state = MFCINST_INIT;
-                ctx->dst_fmt = fmt;
                ctx->codec_mode = ctx->dst_fmt->codec_mode;
                ctx->enc_dst_buf_size = pix_fmt_mp->plane_fmt[0].sizeimage;
                pix_fmt_mp->plane_fmt[0].bytesperline = 0;
@@ -987,28 +995,8 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
                }
                mfc_debug(2, "Got instance number: %d\n", ctx->inst_no);
        } else if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
-                fmt = find_format(f, MFC_FMT_RAW);
+                /* src_fmt is validated by call to vidioc_try_fmt */
-                if (!fmt) {
+                ctx->src_fmt = find_format(f, MFC_FMT_RAW);
-                        mfc_err("failed to set output format\n");
-                        return -EINVAL;
-                }
-                if (!IS_MFCV6(dev) &&
-                                (fmt->fourcc == V4L2_PIX_FMT_NV12MT_16X16)) {
-                        mfc_err("Not supported format.\n");
-                        return -EINVAL;
-                } else if (IS_MFCV6(dev) &&
-                                (fmt->fourcc == V4L2_PIX_FMT_NV12MT)) {
-                        mfc_err("Not supported format.\n");
-                        return -EINVAL;
-                }
-                if (fmt->num_planes != pix_fmt_mp->num_planes) {
-                        mfc_err("failed to set output format\n");
-                        ret = -EINVAL;
-                        goto out;
-                }
-                ctx->src_fmt = fmt;
                ctx->img_width = pix_fmt_mp->width;
                ctx->img_height = pix_fmt_mp->height;
                mfc_debug(2, "codec number: %d\n", ctx->src_fmt->codec_mode);
diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c
index 4851cc2e4a4d..c4ff9739a7ae 100644
--- a/drivers/media/usb/em28xx/em28xx-i2c.c
+++ b/drivers/media/usb/em28xx/em28xx-i2c.c
@@ -726,7 +726,7 @@ static int em28xx_i2c_eeprom(struct em28xx *dev, unsigned bus,
        *eedata = data;
        *eedata_len = len;
-        dev_config = (void *)eedata;
+        dev_config = (void *)*eedata;
        switch (le16_to_cpu(dev_config->chip_conf) >> 4 & 0x3) {
        case 0:
diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
index cb694055ba7d..6e5070774dc2 100644
--- a/drivers/media/usb/hdpvr/hdpvr-core.c
+++ b/drivers/media/usb/hdpvr/hdpvr-core.c
@@ -303,6 +303,11 @@ static int hdpvr_probe(struct usb_interface *interface,
        dev->workqueue = 0;
+        /* init video transfer queues first of all */
+        /* to prevent oops in hdpvr_delete() on error paths */
+        INIT_LIST_HEAD(&dev->free_buff_list);
+        INIT_LIST_HEAD(&dev->rec_buff_list);
        /* register v4l2_device early so it can be used for printks */
        if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) {
                dev_err(&interface->dev, "v4l2_device_register failed\n");
@@ -325,10 +330,6 @@ static int hdpvr_probe(struct usb_interface *interface,
        if (!dev->workqueue)
                goto error;
-        /* init video transfer queues */
-        INIT_LIST_HEAD(&dev->free_buff_list);
-        INIT_LIST_HEAD(&dev->rec_buff_list);
        dev->options = hdpvr_default_options;
        if (default_video_input < HDPVR_VIDEO_INPUTS)
@@ -405,7 +406,7 @@ static int hdpvr_probe(struct usb_interface *interface,
                                    video_nr[atomic_inc_return(&dev_nr)]);
        if (retval < 0) {
                v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
-                goto error;
+                goto reg_fail;
        }
        /* let the user know what node this device is now attached to */
diff --git a/drivers/media/usb/usbtv/Kconfig b/drivers/media/usb/usbtv/Kconfig
index 8864436464bf..7c5b86006ee6 100644
--- a/drivers/media/usb/usbtv/Kconfig
+++ b/drivers/media/usb/usbtv/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_USBTV
        tristate "USBTV007 video capture support"
-        depends on VIDEO_DEV
+        depends on VIDEO_V4L2
        select VIDEOBUF2_VMALLOC
        ---help---
diff --git a/drivers/media/usb/usbtv/usbtv.c b/drivers/media/usb/usbtv/usbtv.c
index bf43f874685e..91650173941a 100644
--- a/drivers/media/usb/usbtv/usbtv.c
+++ b/drivers/media/usb/usbtv/usbtv.c
@@ -57,7 +57,7 @@
 #define USBTV_CHUNK_SIZE        256
 #define USBTV_CHUNK             240
 #define USBTV_CHUNKS            (USBTV_WIDTH * USBTV_HEIGHT \
-                                        / 2 / USBTV_CHUNK)
+                                        / 4 / USBTV_CHUNK)
 /* Chunk header. */
 #define USBTV_MAGIC_OK(chunk)   ((be32_to_cpu(chunk[0]) & 0xff000000) \
@@ -89,6 +89,7 @@ struct usbtv {
        /* Number of currently processed frame, useful find
         * out when a new one begins. */
        u32 frame_id;
+        int chunks_done;
        int iso_size;
        unsigned int sequence;
@@ -202,6 +203,26 @@ static int usbtv_setup_capture(struct usbtv *usbtv)
        return 0;
 }
+/* Copy data from chunk into a frame buffer, deinterlacing the data
+ * into every second line. Unfortunately, they don't align nicely into
+ * 720 pixel lines, as the chunk is 240 words long, which is 480 pixels.
+ * Therefore, we break down the chunk into two halves before copyting,
+ * so that we can interleave a line if needed. */
+static void usbtv_chunk_to_vbuf(u32 *frame, u32 *src, int chunk_no, int odd)
+{
+        int half;
+        for (half = 0; half < 2; half++) {
+                int part_no = chunk_no * 2 + half;
+                int line = part_no / 3;
+                int part_index = (line * 2 + !odd) * 3 + (part_no % 3);
+                u32 *dst = &frame[part_index * USBTV_CHUNK/2];
+                memcpy(dst, src, USBTV_CHUNK/2 * sizeof(*src));
+                src += USBTV_CHUNK/2;
+        }
+}
 /* Called for each 256-byte image chunk.
 * First word identifies the chunk, followed by 240 words of image
 * data and padding. */
@@ -218,17 +239,17 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
        frame_id = USBTV_FRAME_ID(chunk);
        odd = USBTV_ODD(chunk);
        chunk_no = USBTV_CHUNK_NO(chunk);
-        /* Deinterlace. TODO: Use interlaced frame format. */
-        chunk_no = (chunk_no - chunk_no % 3) * 2 + chunk_no % 3;
-        chunk_no += !odd * 3;
        if (chunk_no >= USBTV_CHUNKS)
                return;
        /* Beginning of a frame. */
-        if (chunk_no == 0)
+        if (chunk_no == 0) {
                usbtv->frame_id = frame_id;
+                usbtv->chunks_done = 0;
+        }
+        if (usbtv->frame_id != frame_id)
+                return;
        spin_lock_irqsave(&usbtv->buflock, flags);
        if (list_empty(&usbtv->bufs)) {
@@ -241,19 +262,23 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
        buf = list_first_entry(&usbtv->bufs, struct usbtv_buf, list);
        frame = vb2_plane_vaddr(&buf->vb, 0);
-        /* Copy the chunk. */
+        /* Copy the chunk data. */
-        memcpy(&frame[chunk_no * USBTV_CHUNK], &chunk[1],
+        usbtv_chunk_to_vbuf(frame, &chunk[1], chunk_no, odd);
-                        USBTV_CHUNK * sizeof(chunk[1]));
+        usbtv->chunks_done++;
        /* Last chunk in a frame, signalling an end */
-        if (usbtv->frame_id && chunk_no == USBTV_CHUNKS-1) {
+        if (odd && chunk_no == USBTV_CHUNKS-1) {
                int size = vb2_plane_size(&buf->vb, 0);
+                enum vb2_buffer_state state = usbtv->chunks_done ==
+                                                USBTV_CHUNKS ?
+                                                VB2_BUF_STATE_DONE :
+                                                VB2_BUF_STATE_ERROR;
                buf->vb.v4l2_buf.field = V4L2_FIELD_INTERLACED;
                buf->vb.v4l2_buf.sequence = usbtv->sequence++;
                v4l2_get_timestamp(&buf->vb.v4l2_buf.timestamp);
                vb2_set_plane_payload(&buf->vb, 0, size);
-                vb2_buffer_done(&buf->vb, VB2_BUF_STATE_DONE);
+                vb2_buffer_done(&buf->vb, state);
                list_del(&buf->list);
        }
@@ -518,7 +543,7 @@ static int usbtv_queue_setup(struct vb2_queue *vq,
        if (*nbuffers < 2)
                *nbuffers = 2;
        *nplanes = 1;
-        sizes[0] = USBTV_CHUNK * USBTV_CHUNKS * sizeof(u32);
+        sizes[0] = USBTV_WIDTH * USBTV_HEIGHT / 2 * sizeof(u32);
        return 0;
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 07f257d44a1e..e48cb339c0c6 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3714,11 +3714,17 @@ static int bond_neigh_init(struct neighbour *n)
 * The bonding ndo_neigh_setup is called at init time beofre any
 * slave exists. So we must declare proxy setup function which will
 * be used at run time to resolve the actual slave neigh param setup.
+ *
+ * It's also called by master devices (such as vlans) to setup their
+ * underlying devices. In that case - do nothing, we're already set up from
+ * our init.
 */
 static int bond_neigh_setup(struct net_device *dev,
                            struct neigh_parms *parms)
 {
-        parms->neigh_setup   = bond_neigh_init;
+        /* modify only our neigh_parms */
+        if (parms->dev == dev)
+                parms->neigh_setup = bond_neigh_init;
        return 0;
 }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 25723d8ee201..925ab8ec9329 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -649,7 +649,7 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
                if ((mc->ptr + rec_len) > mc->end)
                        goto decode_failed;
-                memcpy(cf->data, mc->ptr, rec_len);
+                memcpy(cf->data, mc->ptr, cf->can_dlc);
                mc->ptr += rec_len;
        }
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index f1b121ee5525..55d79cb53a79 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -199,7 +199,7 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
        struct arc_emac_priv *priv = netdev_priv(ndev);
        unsigned int work_done;
-        for (work_done = 0; work_done <= budget; work_done++) {
+        for (work_done = 0; work_done < budget; work_done++) {
                unsigned int *last_rx_bd = &priv->last_rx_bd;
                struct net_device_stats *stats = &priv->stats;
                struct buffer_state *rx_buff = &priv->rx_buff[*last_rx_bd];
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index d80e34b8285f..00b88cbfde25 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1333,6 +1333,8 @@ enum {
        BNX2X_SP_RTNL_VFPF_CHANNEL_DOWN,
        BNX2X_SP_RTNL_VFPF_STORM_RX_MODE,
        BNX2X_SP_RTNL_HYPERVISOR_VLAN,
+        BNX2X_SP_RTNL_TX_STOP,
+        BNX2X_SP_RTNL_TX_RESUME,
 };
 struct bnx2x_prev_path_list {
@@ -1502,6 +1504,7 @@ struct bnx2x {
 #define BC_SUPPORTS_DCBX_MSG_NON_PMF    (1 << 21)
 #define IS_VF_FLAG                      (1 << 22)
 #define INTERRUPTS_ENABLED_FLAG         (1 << 23)
+#define BC_SUPPORTS_RMMOD_CMD           (1 << 24)
 #define BP_NOMCP(bp)                    ((bp)->flags & NO_MCP_FLAG)
@@ -1830,6 +1833,8 @@ struct bnx2x {
        int fp_array_size;
        u32 dump_preset_idx;
+        bool                                    stats_started;
+        struct semaphore                        stats_sema;
 };
 /* Tx queues may be less or equal to Rx queues */
@@ -2451,4 +2456,6 @@ enum bnx2x_pci_bus_speed {
        BNX2X_PCI_LINK_SPEED_5000 = 5000,
        BNX2X_PCI_LINK_SPEED_8000 = 8000
 };
+void bnx2x_set_local_cmng(struct bnx2x *bp);
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index 0c94df47e0e8..fcf2761d8828 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -30,10 +30,8 @@
 #include "bnx2x_dcb.h"
 /* forward declarations of dcbx related functions */
-static int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp);
 static void bnx2x_pfc_set_pfc(struct bnx2x *bp);
 static void bnx2x_dcbx_update_ets_params(struct bnx2x *bp);
-static int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp);
 static void bnx2x_dcbx_get_ets_pri_pg_tbl(struct bnx2x *bp,
                                          u32 *set_configuration_ets_pg,
                                          u32 *pri_pg_tbl);
@@ -425,30 +423,52 @@ static void bnx2x_pfc_set_pfc(struct bnx2x *bp)
                bnx2x_pfc_clear(bp);
 }
-static int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp)
+int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp)
 {
        struct bnx2x_func_state_params func_params = {NULL};
+        int rc;
        func_params.f_obj = &bp->func_obj;
        func_params.cmd = BNX2X_F_CMD_TX_STOP;
+        __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
+        __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
        DP(BNX2X_MSG_DCB, "STOP TRAFFIC\n");
-        return bnx2x_func_state_change(bp, &func_params);
+        rc = bnx2x_func_state_change(bp, &func_params);
+        if (rc) {
+                BNX2X_ERR("Unable to hold traffic for HW configuration\n");
+                bnx2x_panic();
+        }
+        return rc;
 }
-static int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp)
+int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp)
 {
        struct bnx2x_func_state_params func_params = {NULL};
        struct bnx2x_func_tx_start_params *tx_params =
                &func_params.params.tx_start;
+        int rc;
        func_params.f_obj = &bp->func_obj;
        func_params.cmd = BNX2X_F_CMD_TX_START;
+        __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
+        __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
        bnx2x_dcbx_fw_struct(bp, tx_params);
        DP(BNX2X_MSG_DCB, "START TRAFFIC\n");
-        return bnx2x_func_state_change(bp, &func_params);
+        rc = bnx2x_func_state_change(bp, &func_params);
+        if (rc) {
+                BNX2X_ERR("Unable to resume traffic after HW configuration\n");
+                bnx2x_panic();
+        }
+        return rc;
 }
 static void bnx2x_dcbx_2cos_limit_update_ets_config(struct bnx2x *bp)
@@ -744,7 +764,9 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                        if (IS_MF(bp))
                                bnx2x_link_sync_notify(bp);
-                        bnx2x_dcbx_stop_hw_tx(bp);
+                        set_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state);
+                        schedule_delayed_work(&bp->sp_rtnl_task, 0);
                        return;
                }
@@ -753,7 +775,13 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                bnx2x_pfc_set_pfc(bp);
                bnx2x_dcbx_update_ets_params(bp);
-                bnx2x_dcbx_resume_hw_tx(bp);
+                /* ets may affect cmng configuration: reinit it in hw */
+                bnx2x_set_local_cmng(bp);
+                set_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state);
+                schedule_delayed_work(&bp->sp_rtnl_task, 0);
                return;
        case BNX2X_DCBX_STATE_TX_RELEASED:
@@ -2363,21 +2391,24 @@ static u8 bnx2x_dcbnl_get_featcfg(struct net_device *netdev, int featid,
                case DCB_FEATCFG_ATTR_PG:
                        if (bp->dcbx_local_feat.ets.enabled)
                                *flags |= DCB_FEATCFG_ENABLE;
-                        if (bp->dcbx_error & DCBX_LOCAL_ETS_ERROR)
+                        if (bp->dcbx_error & (DCBX_LOCAL_ETS_ERROR |
+                                              DCBX_REMOTE_MIB_ERROR))
                                *flags |= DCB_FEATCFG_ERROR;
                        break;
                case DCB_FEATCFG_ATTR_PFC:
                        if (bp->dcbx_local_feat.pfc.enabled)
                                *flags |= DCB_FEATCFG_ENABLE;
                        if (bp->dcbx_error & (DCBX_LOCAL_PFC_ERROR |
-                            DCBX_LOCAL_PFC_MISMATCH))
+                                              DCBX_LOCAL_PFC_MISMATCH |
+                                              DCBX_REMOTE_MIB_ERROR))
                                *flags |= DCB_FEATCFG_ERROR;
                        break;
                case DCB_FEATCFG_ATTR_APP:
                        if (bp->dcbx_local_feat.app.enabled)
                                *flags |= DCB_FEATCFG_ENABLE;
                        if (bp->dcbx_error & (DCBX_LOCAL_APP_ERROR |
-                            DCBX_LOCAL_APP_MISMATCH))
+                                              DCBX_LOCAL_APP_MISMATCH |
+                                              DCBX_REMOTE_MIB_ERROR))
                                *flags |= DCB_FEATCFG_ERROR;
                        break;
                default:
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
index 125bd1b6586f..804b8f64463e 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
@@ -199,4 +199,7 @@ extern const struct dcbnl_rtnl_ops bnx2x_dcbnl_ops;
 int bnx2x_dcbnl_update_applist(struct bnx2x *bp, bool delall);
 #endif /* BCM_DCBNL */
+int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp);
+int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp);
 #endif /* BNX2X_DCB_H */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
index 5018e52ae2ad..32767f6aa33f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
@@ -1300,6 +1300,9 @@ struct drv_func_mb {
        #define DRV_MSG_CODE_EEE_RESULTS_ACK            0xda000000
+        #define DRV_MSG_CODE_RMMOD                      0xdb000000
+        #define REQ_BC_VER_4_RMMOD_CMD                  0x0007080f
        #define DRV_MSG_CODE_SET_MF_BW                  0xe0000000
        #define REQ_BC_VER_4_SET_MF_BW                  0x00060202
        #define DRV_MSG_CODE_SET_MF_BW_ACK              0xe1000000
@@ -1372,6 +1375,8 @@ struct drv_func_mb {
        #define FW_MSG_CODE_EEE_RESULS_ACK              0xda100000
+        #define FW_MSG_CODE_RMMOD_ACK                   0xdb100000
        #define FW_MSG_CODE_SET_MF_BW_SENT              0xe0000000
        #define FW_MSG_CODE_SET_MF_BW_DONE              0xe1000000
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e06186c305d8..8bdc8b973007 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -2261,6 +2261,23 @@ static void bnx2x_set_requested_fc(struct bnx2x *bp)
                bp->link_params.req_fc_auto_adv = BNX2X_FLOW_CTRL_BOTH;
 }
+static void bnx2x_init_dropless_fc(struct bnx2x *bp)
+{
+        u32 pause_enabled = 0;
+        if (!CHIP_IS_E1(bp) && bp->dropless_fc && bp->link_vars.link_up) {
+                if (bp->link_vars.flow_ctrl & BNX2X_FLOW_CTRL_TX)
+                        pause_enabled = 1;
+                REG_WR(bp, BAR_USTRORM_INTMEM +
+                           USTORM_ETH_PAUSE_ENABLED_OFFSET(BP_PORT(bp)),
+                       pause_enabled);
+        }
+        DP(NETIF_MSG_IFUP | NETIF_MSG_LINK, "dropless_fc is %s\n",
+           pause_enabled ? "enabled" : "disabled");
+}
 int bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
 {
        int rc, cfx_idx = bnx2x_get_link_cfg_idx(bp);
@@ -2294,6 +2311,8 @@ int bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
                bnx2x_release_phy_lock(bp);
+                bnx2x_init_dropless_fc(bp);
                bnx2x_calc_fc_adv(bp);
                if (bp->link_vars.link_up) {
@@ -2315,6 +2334,8 @@ void bnx2x_link_set(struct bnx2x *bp)
                bnx2x_phy_init(&bp->link_params, &bp->link_vars);
                bnx2x_release_phy_lock(bp);
+                bnx2x_init_dropless_fc(bp);
                bnx2x_calc_fc_adv(bp);
        } else
                BNX2X_ERR("Bootcode is missing - can not set link\n");
@@ -2476,7 +2497,7 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
        input.port_rate = bp->link_vars.line_speed;
-        if (cmng_type == CMNG_FNS_MINMAX) {
+        if (cmng_type == CMNG_FNS_MINMAX && input.port_rate) {
                int vn;
                /* read mf conf from shmem */
@@ -2533,6 +2554,21 @@ static void storm_memset_cmng(struct bnx2x *bp,
        }
 }
+/* init cmng mode in HW according to local configuration */
+void bnx2x_set_local_cmng(struct bnx2x *bp)
+{
+        int cmng_fns = bnx2x_get_cmng_fns_mode(bp);
+        if (cmng_fns != CMNG_FNS_NONE) {
+                bnx2x_cmng_fns_init(bp, false, cmng_fns);
+                storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
+        } else {
+                /* rate shaping and fairness are disabled */
+                DP(NETIF_MSG_IFUP,
+                   "single function mode without fairness\n");
+        }
+}
 /* This function is called upon link interrupt */
 static void bnx2x_link_attn(struct bnx2x *bp)
 {
@@ -2541,20 +2577,9 @@ static void bnx2x_link_attn(struct bnx2x *bp)
        bnx2x_link_update(&bp->link_params, &bp->link_vars);
-        if (bp->link_vars.link_up) {
+        bnx2x_init_dropless_fc(bp);
-                /* dropless flow control */
+        if (bp->link_vars.link_up) {
-                if (!CHIP_IS_E1(bp) && bp->dropless_fc) {
-                        int port = BP_PORT(bp);
-                        u32 pause_enabled = 0;
-                        if (bp->link_vars.flow_ctrl & BNX2X_FLOW_CTRL_TX)
-                                pause_enabled = 1;
-                        REG_WR(bp, BAR_USTRORM_INTMEM +
-                               USTORM_ETH_PAUSE_ENABLED_OFFSET(port),
-                               pause_enabled);
-                }
                if (bp->link_vars.mac_type != MAC_TYPE_EMAC) {
                        struct host_port_stats *pstats;
@@ -2568,17 +2593,8 @@ static void bnx2x_link_attn(struct bnx2x *bp)
                        bnx2x_stats_handle(bp, STATS_EVENT_LINK_UP);
        }
-        if (bp->link_vars.link_up && bp->link_vars.line_speed) {
+        if (bp->link_vars.link_up && bp->link_vars.line_speed)
-                int cmng_fns = bnx2x_get_cmng_fns_mode(bp);
+                bnx2x_set_local_cmng(bp);
-                if (cmng_fns != CMNG_FNS_NONE) {
-                        bnx2x_cmng_fns_init(bp, false, cmng_fns);
-                        storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
-                } else
-                        /* rate shaping and fairness are disabled */
-                        DP(NETIF_MSG_IFUP,
-                           "single function mode without fairness\n");
-        }
        __bnx2x_link_report(bp);
@@ -9639,6 +9655,12 @@ sp_rtnl_not_reset:
                               &bp->sp_rtnl_state))
                bnx2x_pf_set_vfs_vlan(bp);
+        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state))
+                bnx2x_dcbx_stop_hw_tx(bp);
+        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state))
+                bnx2x_dcbx_resume_hw_tx(bp);
        /* work which needs rtnl lock not-taken (as it takes the lock itself and
         * can be called from other contexts as well)
         */
@@ -10362,6 +10384,10 @@ static void bnx2x_get_common_hwinfo(struct bnx2x *bp)
        bp->flags |= (val >= REQ_BC_VER_4_DCBX_ADMIN_MSG_NON_PMF) ?
                        BC_SUPPORTS_DCBX_MSG_NON_PMF : 0;
+        bp->flags |= (val >= REQ_BC_VER_4_RMMOD_CMD) ?
+                        BC_SUPPORTS_RMMOD_CMD : 0;
        boot_mode = SHMEM_RD(bp,
                        dev_info.port_feature_config[BP_PORT(bp)].mba_config) &
                        PORT_FEATURE_MBA_BOOT_AGENT_TYPE_MASK;
@@ -11137,6 +11163,9 @@ static bool bnx2x_get_dropless_info(struct bnx2x *bp)
        int tmp;
        u32 cfg;
+        if (IS_VF(bp))
+                return 0;
        if (IS_MF(bp) && !CHIP_IS_E1x(bp)) {
                /* Take function: tmp = func */
                tmp = BP_ABS_FUNC(bp);
@@ -11524,6 +11553,7 @@ static int bnx2x_init_bp(struct bnx2x *bp)
        mutex_init(&bp->port.phy_mutex);
        mutex_init(&bp->fw_mb_mutex);
        spin_lock_init(&bp->stats_lock);
+        sema_init(&bp->stats_sema, 1);
        INIT_DELAYED_WORK(&bp->sp_task, bnx2x_sp_task);
        INIT_DELAYED_WORK(&bp->sp_rtnl_task, bnx2x_sp_rtnl_task);
@@ -12817,13 +12847,17 @@ static void __bnx2x_remove(struct pci_dev *pdev,
        bnx2x_dcbnl_update_applist(bp, true);
 #endif
+        if (IS_PF(bp) &&
+            !BP_NOMCP(bp) &&
+            (bp->flags & BC_SUPPORTS_RMMOD_CMD))
+                bnx2x_fw_command(bp, DRV_MSG_CODE_RMMOD, 0);
        /* Close the interface - either directly or implicitly */
        if (remove_netdev) {
                unregister_netdev(dev);
        } else {
                rtnl_lock();
-                if (netif_running(dev))
+                dev_close(dev);
-                        bnx2x_close(dev);
                rtnl_unlock();
        }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 95861efb5051..ad83f4b48777 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1747,11 +1747,8 @@ void bnx2x_iov_init_dq(struct bnx2x *bp)
 void bnx2x_iov_init_dmae(struct bnx2x *bp)
 {
-        DP(BNX2X_MSG_IOV, "SRIOV is %s\n", IS_SRIOV(bp) ? "ON" : "OFF");
+        if (pci_find_ext_capability(bp->pdev, PCI_EXT_CAP_ID_SRIOV))
-        if (!IS_SRIOV(bp))
+                REG_WR(bp, DMAE_REG_BACKWARD_COMP_EN, 0);
-                return;
-        REG_WR(bp, DMAE_REG_BACKWARD_COMP_EN, 0);
 }
 static int bnx2x_vf_bus(struct bnx2x *bp, int vfid)
@@ -3084,8 +3081,9 @@ void bnx2x_disable_sriov(struct bnx2x *bp)
        pci_disable_sriov(bp->pdev);
 }
-static int bnx2x_vf_ndo_sanity(struct bnx2x *bp, int vfidx,
+static int bnx2x_vf_ndo_prep(struct bnx2x *bp, int vfidx,
-                               struct bnx2x_virtf *vf)
+                             struct bnx2x_virtf **vf,
+                             struct pf_vf_bulletin_content **bulletin)
 {
        if (bp->state != BNX2X_STATE_OPEN) {
                BNX2X_ERR("vf ndo called though PF is down\n");
@@ -3103,12 +3101,22 @@ static int bnx2x_vf_ndo_sanity(struct bnx2x *bp, int vfidx,
                return -EINVAL;
        }
-        if (!vf) {
+        /* init members */
+        *vf = BP_VF(bp, vfidx);
+        *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        if (!*vf) {
                BNX2X_ERR("vf ndo called but vf was null. vfidx was %d\n",
                          vfidx);
                return -EINVAL;
        }
+        if (!*bulletin) {
+                BNX2X_ERR("vf ndo called but Bulletin Board struct is null. vfidx was %d\n",
+                          vfidx);
+                return -EINVAL;
+        }
        return 0;
 }
@@ -3116,17 +3124,19 @@ int bnx2x_get_vf_config(struct net_device *dev, int vfidx,
                        struct ifla_vf_info *ivi)
 {
        struct bnx2x *bp = netdev_priv(dev);
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
-        struct bnx2x_vlan_mac_obj *mac_obj = &bnx2x_vfq(vf, 0, mac_obj);
+        struct pf_vf_bulletin_content *bulletin = NULL;
-        struct bnx2x_vlan_mac_obj *vlan_obj = &bnx2x_vfq(vf, 0, vlan_obj);
+        struct bnx2x_vlan_mac_obj *mac_obj;
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct bnx2x_vlan_mac_obj *vlan_obj;
        int rc;
-        /* sanity */
+        /* sanity and init */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
        if (rc)
                return rc;
-        if (!mac_obj || !vlan_obj || !bulletin) {
+        mac_obj = &bnx2x_vfq(vf, 0, mac_obj);
+        vlan_obj = &bnx2x_vfq(vf, 0, vlan_obj);
+        if (!mac_obj || !vlan_obj) {
                BNX2X_ERR("VF partially initialized\n");
                return -EINVAL;
        }
@@ -3183,11 +3193,11 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
 {
        struct bnx2x *bp = netdev_priv(dev);
        int rc, q_logical_state;
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct pf_vf_bulletin_content *bulletin = NULL;
-        /* sanity */
+        /* sanity and init */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
        if (rc)
                return rc;
        if (!is_valid_ether_addr(mac)) {
@@ -3249,11 +3259,11 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
 {
        struct bnx2x *bp = netdev_priv(dev);
        int rc, q_logical_state;
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct pf_vf_bulletin_content *bulletin = NULL;
-        /* sanity */
+        /* sanity and init */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
        if (rc)
                return rc;
@@ -3463,7 +3473,7 @@ int bnx2x_vf_pci_alloc(struct bnx2x *bp)
 alloc_mem_err:
        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
                       sizeof(struct bnx2x_vf_mbx_msg));
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
+        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
                       sizeof(union pf_vf_bulletin));
        return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 98366abd02bd..d63d1327b051 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -221,7 +221,8 @@ static int bnx2x_stats_comp(struct bnx2x *bp)
 * Statistics service functions
 */
-static void bnx2x_stats_pmf_update(struct bnx2x *bp)
+/* should be called under stats_sema */
+static void __bnx2x_stats_pmf_update(struct bnx2x *bp)
 {
        struct dmae_command *dmae;
        u32 opcode;
@@ -518,7 +519,8 @@ static void bnx2x_func_stats_init(struct bnx2x *bp)
        *stats_comp = 0;
 }
-static void bnx2x_stats_start(struct bnx2x *bp)
+/* should be called under stats_sema */
+static void __bnx2x_stats_start(struct bnx2x *bp)
 {
        /* vfs travel through here as part of the statistics FSM, but no action
         * is required
@@ -534,13 +536,34 @@ static void bnx2x_stats_start(struct bnx2x *bp)
        bnx2x_hw_stats_post(bp);
        bnx2x_storm_stats_post(bp);
+        bp->stats_started = true;
+}
+static void bnx2x_stats_start(struct bnx2x *bp)
+{
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
+        __bnx2x_stats_start(bp);
+        up(&bp->stats_sema);
 }
 static void bnx2x_stats_pmf_start(struct bnx2x *bp)
 {
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
        bnx2x_stats_comp(bp);
-        bnx2x_stats_pmf_update(bp);
+        __bnx2x_stats_pmf_update(bp);
-        bnx2x_stats_start(bp);
+        __bnx2x_stats_start(bp);
+        up(&bp->stats_sema);
+}
+static void bnx2x_stats_pmf_update(struct bnx2x *bp)
+{
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
+        __bnx2x_stats_pmf_update(bp);
+        up(&bp->stats_sema);
 }
 static void bnx2x_stats_restart(struct bnx2x *bp)
@@ -550,8 +573,11 @@ static void bnx2x_stats_restart(struct bnx2x *bp)
         */
        if (IS_VF(bp))
                return;
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
        bnx2x_stats_comp(bp);
-        bnx2x_stats_start(bp);
+        __bnx2x_stats_start(bp);
+        up(&bp->stats_sema);
 }
 static void bnx2x_bmac_stats_update(struct bnx2x *bp)
@@ -888,9 +914,7 @@ static int bnx2x_storm_stats_validate_counters(struct bnx2x *bp)
        /* Make sure we use the value of the counter
         * used for sending the last stats ramrod.
         */
-        spin_lock_bh(&bp->stats_lock);
        cur_stats_counter = bp->stats_counter - 1;
-        spin_unlock_bh(&bp->stats_lock);
        /* are storm stats valid? */
        if (le16_to_cpu(counters->xstats_counter) != cur_stats_counter) {
@@ -1227,12 +1251,18 @@ static void bnx2x_stats_update(struct bnx2x *bp)
 {
        u32 *stats_comp = bnx2x_sp(bp, stats_comp);
-        if (bnx2x_edebug_stats_stopped(bp))
+        /* we run update from timer context, so give up
+         * if somebody is in the middle of transition
+         */
+        if (down_trylock(&bp->stats_sema))
                return;
+        if (bnx2x_edebug_stats_stopped(bp) || !bp->stats_started)
+                goto out;
        if (IS_PF(bp)) {
                if (*stats_comp != DMAE_COMP_VAL)
-                        return;
+                        goto out;
                if (bp->port.pmf)
                        bnx2x_hw_stats_update(bp);
@@ -1242,7 +1272,7 @@ static void bnx2x_stats_update(struct bnx2x *bp)
                                BNX2X_ERR("storm stats were not updated for 3 times\n");
                                bnx2x_panic();
                        }
-                        return;
+                        goto out;
                }
        } else {
                /* vf doesn't collect HW statistics, and doesn't get completions
@@ -1256,7 +1286,7 @@ static void bnx2x_stats_update(struct bnx2x *bp)
        /* vf is done */
        if (IS_VF(bp))
-                return;
+                goto out;
        if (netif_msg_timer(bp)) {
                struct bnx2x_eth_stats *estats = &bp->eth_stats;
@@ -1267,6 +1297,9 @@ static void bnx2x_stats_update(struct bnx2x *bp)
        bnx2x_hw_stats_post(bp);
        bnx2x_storm_stats_post(bp);
+out:
+        up(&bp->stats_sema);
 }
 static void bnx2x_port_stats_stop(struct bnx2x *bp)
@@ -1332,6 +1365,11 @@ static void bnx2x_stats_stop(struct bnx2x *bp)
 {
        int update = 0;
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
+        bp->stats_started = false;
        bnx2x_stats_comp(bp);
        if (bp->port.pmf)
@@ -1348,6 +1386,8 @@ static void bnx2x_stats_stop(struct bnx2x *bp)
                bnx2x_hw_stats_post(bp);
                bnx2x_stats_comp(bp);
        }
+        up(&bp->stats_sema);
 }
 static void bnx2x_stats_do_nothing(struct bnx2x *bp)
@@ -1376,15 +1416,17 @@ static const struct {
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
 {
        enum bnx2x_stats_state state;
+        void (*action)(struct bnx2x *bp);
        if (unlikely(bp->panic))
                return;
        spin_lock_bh(&bp->stats_lock);
        state = bp->stats_state;
        bp->stats_state = bnx2x_stats_stm[state][event].next_state;
+        action = bnx2x_stats_stm[state][event].action;
        spin_unlock_bh(&bp->stats_lock);
-        bnx2x_stats_stm[state][event].action(bp);
+        action(bp);
        if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index ddebc7a5dda0..0da2214ef1b9 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17796,8 +17796,10 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
 done:
        if (state == pci_channel_io_perm_failure) {
-                tg3_napi_enable(tp);
+                if (netdev) {
-                dev_close(netdev);
+                        tg3_napi_enable(tp);
+                        dev_close(netdev);
+                }
                err = PCI_ERS_RESULT_DISCONNECT;
        } else {
                pci_disable_device(pdev);
@@ -17827,7 +17829,8 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
        rtnl_lock();
        if (pci_enable_device(pdev)) {
-                netdev_err(netdev, "Cannot re-enable PCI device after reset.\n");
+                dev_err(&pdev->dev,
+                        "Cannot re-enable PCI device after reset.\n");
                goto done;
        }
@@ -17835,7 +17838,7 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
        pci_restore_state(pdev);
        pci_save_state(pdev);
-        if (!netif_running(netdev)) {
+        if (!netdev || !netif_running(netdev)) {
                rc = PCI_ERS_RESULT_RECOVERED;
                goto done;
        }
@@ -17847,7 +17850,7 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
        rc = PCI_ERS_RESULT_RECOVERED;
 done:
-        if (rc != PCI_ERS_RESULT_RECOVERED && netif_running(netdev)) {
+        if (rc != PCI_ERS_RESULT_RECOVERED && netdev && netif_running(netdev)) {
                tg3_napi_enable(tp);
                dev_close(netdev);
        }
diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
index 687ec4a8bb48..9c89dc8fe105 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
@@ -455,11 +455,6 @@ static int alloc_pg_chunk(struct adapter *adapter, struct sge_fl *q,
                q->pg_chunk.offset = 0;
                mapping = pci_map_page(adapter->pdev, q->pg_chunk.page,
                                       0, q->alloc_size, PCI_DMA_FROMDEVICE);
-                if (unlikely(pci_dma_mapping_error(adapter->pdev, mapping))) {
-                        __free_pages(q->pg_chunk.page, order);
-                        q->pg_chunk.page = NULL;
-                        return -EIO;
-                }
                q->pg_chunk.mapping = mapping;
        }
        sd->pg_chunk = q->pg_chunk;
@@ -954,75 +949,40 @@ static inline unsigned int calc_tx_descs(const struct sk_buff *skb)
        return flits_to_desc(flits);
 }
-/*      map_skb - map a packet main body and its page fragments
- *      @pdev: the PCI device
- *      @skb: the packet
- *      @addr: placeholder to save the mapped addresses
- *
- *      map the main body of an sk_buff and its page fragments, if any.
- */
-static int map_skb(struct pci_dev *pdev, const struct sk_buff *skb,
-                   dma_addr_t *addr)
-{
-        const skb_frag_t *fp, *end;
-        const struct skb_shared_info *si;
-        *addr = pci_map_single(pdev, skb->data, skb_headlen(skb),
-                               PCI_DMA_TODEVICE);
-        if (pci_dma_mapping_error(pdev, *addr))
-                goto out_err;
-        si = skb_shinfo(skb);
-        end = &si->frags[si->nr_frags];
-        for (fp = si->frags; fp < end; fp++) {
-                *++addr = skb_frag_dma_map(&pdev->dev, fp, 0, skb_frag_size(fp),
-                                           DMA_TO_DEVICE);
-                if (pci_dma_mapping_error(pdev, *addr))
-                        goto unwind;
-        }
-        return 0;
-unwind:
-        while (fp-- > si->frags)
-                dma_unmap_page(&pdev->dev, *--addr, skb_frag_size(fp),
-                               DMA_TO_DEVICE);
-        pci_unmap_single(pdev, addr[-1], skb_headlen(skb), PCI_DMA_TODEVICE);
-out_err:
-        return -ENOMEM;
-}
 /**
- *      write_sgl - populate a scatter/gather list for a packet
+ *      make_sgl - populate a scatter/gather list for a packet
 *      @skb: the packet
 *      @sgp: the SGL to populate
 *      @start: start address of skb main body data to include in the SGL
 *      @len: length of skb main body data to include in the SGL
- *      @addr: the list of the mapped addresses
+ *      @pdev: the PCI device
 *
- *      Copies the scatter/gather list for the buffers that make up a packet
+ *      Generates a scatter/gather list for the buffers that make up a packet
 *      and returns the SGL size in 8-byte words.  The caller must size the SGL
 *      appropriately.
 */
-static inline unsigned int write_sgl(const struct sk_buff *skb,
+static inline unsigned int make_sgl(const struct sk_buff *skb,
                                    struct sg_ent *sgp, unsigned char *start,
-                                    unsigned int len, const dma_addr_t *addr)
+                                    unsigned int len, struct pci_dev *pdev)
 {
-        unsigned int i, j = 0, k = 0, nfrags;
+        dma_addr_t mapping;
+        unsigned int i, j = 0, nfrags;
        if (len) {
+                mapping = pci_map_single(pdev, start, len, PCI_DMA_TODEVICE);
                sgp->len[0] = cpu_to_be32(len);
-                sgp->addr[j++] = cpu_to_be64(addr[k++]);
+                sgp->addr[0] = cpu_to_be64(mapping);
+                j = 1;
        }
        nfrags = skb_shinfo(skb)->nr_frags;
        for (i = 0; i < nfrags; i++) {
                const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                mapping = skb_frag_dma_map(&pdev->dev, frag, 0, skb_frag_size(frag),
+                                           DMA_TO_DEVICE);
                sgp->len[j] = cpu_to_be32(skb_frag_size(frag));
-                sgp->addr[j] = cpu_to_be64(addr[k++]);
+                sgp->addr[j] = cpu_to_be64(mapping);
                j ^= 1;
                if (j == 0)
                        ++sgp;
@@ -1178,7 +1138,7 @@ static void write_tx_pkt_wr(struct adapter *adap, struct sk_buff *skb,
                            const struct port_info *pi,
                            unsigned int pidx, unsigned int gen,
                            struct sge_txq *q, unsigned int ndesc,
-                            unsigned int compl, const dma_addr_t *addr)
+                            unsigned int compl)
 {
        unsigned int flits, sgl_flits, cntrl, tso_info;
        struct sg_ent *sgp, sgl[MAX_SKB_FRAGS / 2 + 1];
@@ -1236,7 +1196,7 @@ static void write_tx_pkt_wr(struct adapter *adap, struct sk_buff *skb,
        }
        sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
-        sgl_flits = write_sgl(skb, sgp, skb->data, skb_headlen(skb), addr);
+        sgl_flits = make_sgl(skb, sgp, skb->data, skb_headlen(skb), adap->pdev);
        write_wr_hdr_sgl(ndesc, skb, d, pidx, q, sgl, flits, sgl_flits, gen,
                         htonl(V_WR_OP(FW_WROPCODE_TUNNEL_TX_PKT) | compl),
@@ -1267,7 +1227,6 @@ netdev_tx_t t3_eth_xmit(struct sk_buff *skb, struct net_device *dev)
        struct netdev_queue *txq;
        struct sge_qset *qs;
        struct sge_txq *q;
-        dma_addr_t addr[MAX_SKB_FRAGS + 1];
        /*
         * The chip min packet length is 9 octets but play safe and reject
@@ -1296,11 +1255,6 @@ netdev_tx_t t3_eth_xmit(struct sk_buff *skb, struct net_device *dev)
                return NETDEV_TX_BUSY;
        }
-        if (unlikely(map_skb(adap->pdev, skb, addr) < 0)) {
-                dev_kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
        q->in_use += ndesc;
        if (unlikely(credits - ndesc < q->stop_thres)) {
                t3_stop_tx_queue(txq, qs, q);
@@ -1358,7 +1312,7 @@ netdev_tx_t t3_eth_xmit(struct sk_buff *skb, struct net_device *dev)
        if (likely(!skb_shared(skb)))
                skb_orphan(skb);
-        write_tx_pkt_wr(adap, skb, pi, pidx, gen, q, ndesc, compl, addr);
+        write_tx_pkt_wr(adap, skb, pi, pidx, gen, q, ndesc, compl);
        check_ring_tx_db(adap, q);
        return NETDEV_TX_OK;
 }
@@ -1623,8 +1577,7 @@ static void setup_deferred_unmapping(struct sk_buff *skb, struct pci_dev *pdev,
 */
 static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
                          struct sge_txq *q, unsigned int pidx,
-                          unsigned int gen, unsigned int ndesc,
+                          unsigned int gen, unsigned int ndesc)
-                          const dma_addr_t *addr)
 {
        unsigned int sgl_flits, flits;
        struct work_request_hdr *from;
@@ -1645,9 +1598,9 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
        flits = skb_transport_offset(skb) / 8;
        sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
-        sgl_flits = write_sgl(skb, sgp, skb_transport_header(skb),
+        sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
-                             skb_tail_pointer(skb) -
+                             skb->tail - skb->transport_header,
-                             skb_transport_header(skb), addr);
+                             adap->pdev);
        if (need_skb_unmap()) {
                setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
                skb->destructor = deferred_unmap_destructor;
@@ -1705,11 +1658,6 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
                goto again;
        }
-        if (map_skb(adap->pdev, skb, (dma_addr_t *)skb->head)) {
-                spin_unlock(&q->lock);
-                return NET_XMIT_SUCCESS;
-        }
        gen = q->gen;
        q->in_use += ndesc;
        pidx = q->pidx;
@@ -1720,7 +1668,7 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
        }
        spin_unlock(&q->lock);
-        write_ofld_wr(adap, skb, q, pidx, gen, ndesc, (dma_addr_t *)skb->head);
+        write_ofld_wr(adap, skb, q, pidx, gen, ndesc);
        check_ring_tx_db(adap, q);
        return NET_XMIT_SUCCESS;
 }
@@ -1738,7 +1686,6 @@ static void restart_offloadq(unsigned long data)
        struct sge_txq *q = &qs->txq[TXQ_OFLD];
        const struct port_info *pi = netdev_priv(qs->netdev);
        struct adapter *adap = pi->adapter;
-        unsigned int written = 0;
        spin_lock(&q->lock);
 again:  reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
@@ -1758,14 +1705,10 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
                        break;
                }
-                if (map_skb(adap->pdev, skb, (dma_addr_t *)skb->head))
-                        break;
                gen = q->gen;
                q->in_use += ndesc;
                pidx = q->pidx;
                q->pidx += ndesc;
-                written += ndesc;
                if (q->pidx >= q->size) {
                        q->pidx -= q->size;
                        q->gen ^= 1;
@@ -1773,8 +1716,7 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
                __skb_unlink(skb, &q->sendq);
                spin_unlock(&q->lock);
-                write_ofld_wr(adap, skb, q, pidx, gen, ndesc,
+                write_ofld_wr(adap, skb, q, pidx, gen, ndesc);
-                             (dma_addr_t *)skb->head);
                spin_lock(&q->lock);
        }
        spin_unlock(&q->lock);
@@ -1784,9 +1726,8 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
        set_bit(TXQ_LAST_PKT_DB, &q->flags);
 #endif
        wmb();
-        if (likely(written))
+        t3_write_reg(adap, A_SG_KDOORBELL,
-                t3_write_reg(adap, A_SG_KDOORBELL,
+                     F_SELEGRCNTX | V_EGRCNTX(q->cntxt_id));
-                             F_SELEGRCNTX | V_EGRCNTX(q->cntxt_id));
 }
 /**
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 6e6e0a117ee2..8ec5d74ad44d 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -3048,6 +3048,9 @@ int be_cmd_get_func_config(struct be_adapter *adapter)
                adapter->max_event_queues = le16_to_cpu(desc->eq_count);
                adapter->if_cap_flags = le32_to_cpu(desc->cap_flags);
+                /* Clear flags that driver is not interested in */
+                adapter->if_cap_flags &=  BE_IF_CAP_FLAGS_WANT;
        }
 err:
        mutex_unlock(&adapter->mbox_lock);
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 5228d88c5a02..1b3b9e886412 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -563,6 +563,12 @@ enum be_if_flags {
        BE_IF_FLAGS_MULTICAST = 0x1000
 };
+#define BE_IF_CAP_FLAGS_WANT (BE_IF_FLAGS_RSS | BE_IF_FLAGS_PROMISCUOUS |\
+                         BE_IF_FLAGS_BROADCAST | BE_IF_FLAGS_VLAN_PROMISCUOUS |\
+                         BE_IF_FLAGS_VLAN | BE_IF_FLAGS_MCAST_PROMISCUOUS |\
+                         BE_IF_FLAGS_PASS_L3L4_ERRORS | BE_IF_FLAGS_MULTICAST |\
+                         BE_IF_FLAGS_UNTAGGED)
 /* An RX interface is an object with one or more MAC addresses and
 * filtering capabilities. */
 struct be_cmd_req_if_create {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 181edb522450..4559c35eea13 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2563,8 +2563,8 @@ static int be_close(struct net_device *netdev)
        /* Wait for all pending tx completions to arrive so that
         * all tx skbs are freed.
         */
-        be_tx_compl_clean(adapter);
        netif_tx_disable(netdev);
+        be_tx_compl_clean(adapter);
        be_rx_qs_destroy(adapter);
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index c896079728e1..ef94a591f9e5 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -931,17 +931,20 @@ static int skge_ring_alloc(struct skge_ring *ring, void *vaddr, u32 base)
 }
 /* Allocate and setup a new buffer for receiving */
-static void skge_rx_setup(struct skge_port *skge, struct skge_element *e,
+static int skge_rx_setup(struct skge_port *skge, struct skge_element *e,
-                          struct sk_buff *skb, unsigned int bufsize)
+                         struct sk_buff *skb, unsigned int bufsize)
 {
        struct skge_rx_desc *rd = e->desc;
-        u64 map;
+        dma_addr_t map;
        map = pci_map_single(skge->hw->pdev, skb->data, bufsize,
                             PCI_DMA_FROMDEVICE);
-        rd->dma_lo = map;
+        if (pci_dma_mapping_error(skge->hw->pdev, map))
-        rd->dma_hi = map >> 32;
+                return -1;
+        rd->dma_lo = lower_32_bits(map);
+        rd->dma_hi = upper_32_bits(map);
        e->skb = skb;
        rd->csum1_start = ETH_HLEN;
        rd->csum2_start = ETH_HLEN;
@@ -953,6 +956,7 @@ static void skge_rx_setup(struct skge_port *skge, struct skge_element *e,
        rd->control = BMU_OWN | BMU_STF | BMU_IRQ_EOF | BMU_TCP_CHECK | bufsize;
        dma_unmap_addr_set(e, mapaddr, map);
        dma_unmap_len_set(e, maplen, bufsize);
+        return 0;
 }
 /* Resume receiving using existing skb,
@@ -1014,7 +1018,10 @@ static int skge_rx_fill(struct net_device *dev)
                        return -ENOMEM;
                skb_reserve(skb, NET_IP_ALIGN);
-                skge_rx_setup(skge, e, skb, skge->rx_buf_size);
+                if (skge_rx_setup(skge, e, skb, skge->rx_buf_size) < 0) {
+                        dev_kfree_skb(skb);
+                        return -EIO;
+                }
        } while ((e = e->next) != ring->start);
        ring->to_clean = ring->start;
@@ -2544,7 +2551,7 @@ static int skge_up(struct net_device *dev)
        BUG_ON(skge->dma & 7);
-        if ((u64)skge->dma >> 32 != ((u64) skge->dma + skge->mem_size) >> 32) {
+        if (upper_32_bits(skge->dma) != upper_32_bits(skge->dma + skge->mem_size)) {
                dev_err(&hw->pdev->dev, "pci_alloc_consistent region crosses 4G boundary\n");
                err = -EINVAL;
                goto free_pci_mem;
@@ -2729,7 +2736,7 @@ static netdev_tx_t skge_xmit_frame(struct sk_buff *skb,
        struct skge_tx_desc *td;
        int i;
        u32 control, len;
-        u64 map;
+        dma_addr_t map;
        if (skb_padto(skb, ETH_ZLEN))
                return NETDEV_TX_OK;
@@ -2743,11 +2750,14 @@ static netdev_tx_t skge_xmit_frame(struct sk_buff *skb,
        e->skb = skb;
        len = skb_headlen(skb);
        map = pci_map_single(hw->pdev, skb->data, len, PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(hw->pdev, map))
+                goto mapping_error;
        dma_unmap_addr_set(e, mapaddr, map);
        dma_unmap_len_set(e, maplen, len);
-        td->dma_lo = map;
+        td->dma_lo = lower_32_bits(map);
-        td->dma_hi = map >> 32;
+        td->dma_hi = upper_32_bits(map);
        if (skb->ip_summed == CHECKSUM_PARTIAL) {
                const int offset = skb_checksum_start_offset(skb);
@@ -2778,14 +2788,16 @@ static netdev_tx_t skge_xmit_frame(struct sk_buff *skb,
                        map = skb_frag_dma_map(&hw->pdev->dev, frag, 0,
                                               skb_frag_size(frag), DMA_TO_DEVICE);
+                        if (dma_mapping_error(&hw->pdev->dev, map))
+                                goto mapping_unwind;
                        e = e->next;
                        e->skb = skb;
                        tf = e->desc;
                        BUG_ON(tf->control & BMU_OWN);
-                        tf->dma_lo = map;
+                        tf->dma_lo = lower_32_bits(map);
-                        tf->dma_hi = (u64) map >> 32;
+                        tf->dma_hi = upper_32_bits(map);
                        dma_unmap_addr_set(e, mapaddr, map);
                        dma_unmap_len_set(e, maplen, skb_frag_size(frag));
@@ -2815,6 +2827,26 @@ static netdev_tx_t skge_xmit_frame(struct sk_buff *skb,
        }
        return NETDEV_TX_OK;
+mapping_unwind:
+        e = skge->tx_ring.to_use;
+        pci_unmap_single(hw->pdev,
+                         dma_unmap_addr(e, mapaddr),
+                         dma_unmap_len(e, maplen),
+                         PCI_DMA_TODEVICE);
+        while (i-- > 0) {
+                e = e->next;
+                pci_unmap_page(hw->pdev,
+                               dma_unmap_addr(e, mapaddr),
+                               dma_unmap_len(e, maplen),
+                               PCI_DMA_TODEVICE);
+        }
+mapping_error:
+        if (net_ratelimit())
+                dev_warn(&hw->pdev->dev, "%s: tx mapping error\n", dev->name);
+        dev_kfree_skb(skb);
+        return NETDEV_TX_OK;
 }
@@ -3045,11 +3077,13 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                pci_dma_sync_single_for_cpu(skge->hw->pdev,
                                            dma_unmap_addr(e, mapaddr),
-                                            len, PCI_DMA_FROMDEVICE);
+                                            dma_unmap_len(e, maplen),
+                                            PCI_DMA_FROMDEVICE);
                skb_copy_from_linear_data(e->skb, skb->data, len);
                pci_dma_sync_single_for_device(skge->hw->pdev,
                                               dma_unmap_addr(e, mapaddr),
-                                               len, PCI_DMA_FROMDEVICE);
+                                               dma_unmap_len(e, maplen),
+                                               PCI_DMA_FROMDEVICE);
                skge_rx_reuse(e, skge->rx_buf_size);
        } else {
                struct sk_buff *nskb;
@@ -3058,13 +3092,17 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                if (!nskb)
                        goto resubmit;
+                if (skge_rx_setup(skge, e, nskb, skge->rx_buf_size) < 0) {
+                        dev_kfree_skb(nskb);
+                        goto resubmit;
+                }
                pci_unmap_single(skge->hw->pdev,
                                 dma_unmap_addr(e, mapaddr),
                                 dma_unmap_len(e, maplen),
                                 PCI_DMA_FROMDEVICE);
                skb = e->skb;
                prefetch(skb->data);
-                skge_rx_setup(skge, e, nskb, skge->rx_buf_size);
        }
        skb_put(skb, len);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c571de85d0f9..5472cbd34028 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -46,7 +46,7 @@
 #include "mlx5_core.h"
 enum {
-        CMD_IF_REV = 4,
+        CMD_IF_REV = 5,
 };
 enum {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index c02cbcfd0fb8..443cc4d7b024 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -268,7 +268,7 @@ static int mlx5_eq_int(struct mlx5_core_dev *dev, struct mlx5_eq *eq)
                case MLX5_EVENT_TYPE_PAGE_REQUEST:
                        {
                                u16 func_id = be16_to_cpu(eqe->data.req_pages.func_id);
-                                s16 npages = be16_to_cpu(eqe->data.req_pages.num_pages);
+                                s32 npages = be32_to_cpu(eqe->data.req_pages.num_pages);
                                mlx5_core_dbg(dev, "page request for func 0x%x, napges %d\n", func_id, npages);
                                mlx5_core_req_pages_handler(dev, func_id, npages);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw.c b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
index 72a5222447f5..f012658b6a92 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
@@ -113,7 +113,7 @@ int mlx5_cmd_query_hca_cap(struct mlx5_core_dev *dev,
        caps->log_max_srq = out->hca_cap.log_max_srqs & 0x1f;
        caps->local_ca_ack_delay = out->hca_cap.local_ca_ack_delay & 0x1f;
        caps->log_max_mcg = out->hca_cap.log_max_mcg;
-        caps->max_qp_mcg = be16_to_cpu(out->hca_cap.max_qp_mcg);
+        caps->max_qp_mcg = be32_to_cpu(out->hca_cap.max_qp_mcg) & 0xffffff;
        caps->max_ra_res_qp = 1 << (out->hca_cap.log_max_ra_res_qp & 0x3f);
        caps->max_ra_req_qp = 1 << (out->hca_cap.log_max_ra_req_qp & 0x3f);
        caps->max_srq_wqes = 1 << out->hca_cap.log_max_srq_sz;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 748f10a155c4..3e6670c4a7cd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -55,33 +55,9 @@ enum {
 };
 static DEFINE_SPINLOCK(health_lock);
 static LIST_HEAD(health_list);
 static struct work_struct health_work;
-static health_handler_t reg_handler;
-int mlx5_register_health_report_handler(health_handler_t handler)
-{
-        spin_lock_irq(&health_lock);
-        if (reg_handler) {
-                spin_unlock_irq(&health_lock);
-                return -EEXIST;
-        }
-        reg_handler = handler;
-        spin_unlock_irq(&health_lock);
-        return 0;
-}
-EXPORT_SYMBOL(mlx5_register_health_report_handler);
-void mlx5_unregister_health_report_handler(void)
-{
-        spin_lock_irq(&health_lock);
-        reg_handler = NULL;
-        spin_unlock_irq(&health_lock);
-}
-EXPORT_SYMBOL(mlx5_unregister_health_report_handler);
 static void health_care(struct work_struct *work)
 {
        struct mlx5_core_health *health, *n;
@@ -98,11 +74,8 @@ static void health_care(struct work_struct *work)
                priv = container_of(health, struct mlx5_priv, health);
                dev = container_of(priv, struct mlx5_core_dev, priv);
                mlx5_core_warn(dev, "handling bad device here\n");
+                /* nothing yet */
                spin_lock_irq(&health_lock);
-                if (reg_handler)
-                        reg_handler(dev->pdev, health->health,
-                                    sizeof(health->health));
                list_del_init(&health->list);
                spin_unlock_irq(&health_lock);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 4a3e137931a3..3a2408d44820 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -43,10 +43,16 @@ enum {
        MLX5_PAGES_TAKE         = 2
 };
+enum {
+        MLX5_BOOT_PAGES         = 1,
+        MLX5_INIT_PAGES         = 2,
+        MLX5_POST_INIT_PAGES    = 3
+};
 struct mlx5_pages_req {
        struct mlx5_core_dev *dev;
        u32     func_id;
-        s16     npages;
+        s32     npages;
        struct work_struct work;
 };
@@ -64,27 +70,23 @@ struct mlx5_query_pages_inbox {
 struct mlx5_query_pages_outbox {
        struct mlx5_outbox_hdr  hdr;
-        __be16                  num_boot_pages;
+        __be16                  rsvd;
        __be16                  func_id;
-        __be16                  init_pages;
+        __be32                  num_pages;
-        __be16                  num_pages;
 };
 struct mlx5_manage_pages_inbox {
        struct mlx5_inbox_hdr   hdr;
-        __be16                  rsvd0;
+        __be16                  rsvd;
        __be16                  func_id;
-        __be16                  rsvd1;
+        __be32                  num_entries;
-        __be16                  num_entries;
-        u8                      rsvd2[16];
        __be64                  pas[0];
 };
 struct mlx5_manage_pages_outbox {
        struct mlx5_outbox_hdr  hdr;
-        u8                      rsvd0[2];
+        __be32                  num_entries;
-        __be16                  num_entries;
+        u8                      rsvd[4];
-        u8                      rsvd1[20];
        __be64                  pas[0];
 };
@@ -146,7 +148,7 @@ static struct page *remove_page(struct mlx5_core_dev *dev, u64 addr)
 }
 static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
-                                s16 *pages, s16 *init_pages, u16 *boot_pages)
+                                s32 *npages, int boot)
 {
        struct mlx5_query_pages_inbox   in;
        struct mlx5_query_pages_outbox  out;
@@ -155,6 +157,8 @@ static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
        memset(&in, 0, sizeof(in));
        memset(&out, 0, sizeof(out));
        in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_QUERY_PAGES);
+        in.hdr.opmod = boot ? cpu_to_be16(MLX5_BOOT_PAGES) : cpu_to_be16(MLX5_INIT_PAGES);
        err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
        if (err)
                return err;
@@ -162,15 +166,7 @@ static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
        if (out.hdr.status)
                return mlx5_cmd_status_to_err(&out.hdr);
-        if (pages)
+        *npages = be32_to_cpu(out.num_pages);
-                *pages = be16_to_cpu(out.num_pages);
-        if (init_pages)
-                *init_pages = be16_to_cpu(out.init_pages);
-        if (boot_pages)
-                *boot_pages = be16_to_cpu(out.num_boot_pages);
        *func_id = be16_to_cpu(out.func_id);
        return err;
@@ -224,7 +220,7 @@ static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
        in->hdr.opcode = cpu_to_be16(MLX5_CMD_OP_MANAGE_PAGES);
        in->hdr.opmod = cpu_to_be16(MLX5_PAGES_GIVE);
        in->func_id = cpu_to_be16(func_id);
-        in->num_entries = cpu_to_be16(npages);
+        in->num_entries = cpu_to_be32(npages);
        err = mlx5_cmd_exec(dev, in, inlen, &out, sizeof(out));
        mlx5_core_dbg(dev, "err %d\n", err);
        if (err) {
@@ -292,7 +288,7 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
        in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_MANAGE_PAGES);
        in.hdr.opmod = cpu_to_be16(MLX5_PAGES_TAKE);
        in.func_id = cpu_to_be16(func_id);
-        in.num_entries = cpu_to_be16(npages);
+        in.num_entries = cpu_to_be32(npages);
        mlx5_core_dbg(dev, "npages %d, outlen %d\n", npages, outlen);
        err = mlx5_cmd_exec(dev, &in, sizeof(in), out, outlen);
        if (err) {
@@ -306,7 +302,7 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
                goto out_free;
        }
-        num_claimed = be16_to_cpu(out->num_entries);
+        num_claimed = be32_to_cpu(out->num_entries);
        if (nclaimed)
                *nclaimed = num_claimed;
@@ -345,7 +341,7 @@ static void pages_work_handler(struct work_struct *work)
 }
 void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
-                                 s16 npages)
+                                 s32 npages)
 {
        struct mlx5_pages_req *req;
@@ -364,20 +360,18 @@ void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
 int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot)
 {
-        u16 uninitialized_var(boot_pages);
-        s16 uninitialized_var(init_pages);
        u16 uninitialized_var(func_id);
+        s32 uninitialized_var(npages);
        int err;
-        err = mlx5_cmd_query_pages(dev, &func_id, NULL, &init_pages,
+        err = mlx5_cmd_query_pages(dev, &func_id, &npages, boot);
-                                   &boot_pages);
        if (err)
                return err;
+        mlx5_core_dbg(dev, "requested %d %s pages for func_id 0x%x\n",
+                      npages, boot ? "boot" : "init", func_id);
-        mlx5_core_dbg(dev, "requested %d init pages and %d boot pages for func_id 0x%x\n",
+        return give_pages(dev, func_id, npages, 0);
-                      init_pages, boot_pages, func_id);
-        return give_pages(dev, func_id, boot ? boot_pages : init_pages, 0);
 }
 static int optimal_reclaimed_pages(void)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 92da9980a0a0..9d4bb7f83904 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3266,6 +3266,11 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
        u8 val;
        int ret, max_sds_rings = adapter->max_sds_rings;
+        if (test_bit(__QLCNIC_RESETTING, &adapter->state)) {
+                netdev_info(netdev, "Device is resetting\n");
+                return -EBUSY;
+        }
        if (qlcnic_get_diag_lock(adapter)) {
                netdev_info(netdev, "Device in diagnostics mode\n");
                return -EBUSY;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 9f4b8d5f0865..345d987aede4 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -629,7 +629,8 @@ int qlcnic_83xx_idc_reattach_driver(struct qlcnic_adapter *adapter)
                return -EIO;
        }
-        qlcnic_set_drv_version(adapter);
+        if (adapter->portnum == 0)
+                qlcnic_set_drv_version(adapter);
        qlcnic_83xx_idc_attach_driver(adapter);
        return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index ee013fcc3322..bc05d016c859 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2165,7 +2165,8 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (err)
                goto err_out_disable_mbx_intr;
-        qlcnic_set_drv_version(adapter);
+        if (adapter->portnum == 0)
+                qlcnic_set_drv_version(adapter);
        pci_set_drvdata(pdev, adapter);
@@ -3085,7 +3086,8 @@ done:
        adapter->fw_fail_cnt = 0;
        adapter->flags &= ~QLCNIC_FW_HANG;
        clear_bit(__QLCNIC_RESETTING, &adapter->state);
-        qlcnic_set_drv_version(adapter);
+        if (adapter->portnum == 0)
+                qlcnic_set_drv_version(adapter);
        if (!qlcnic_clr_drv_state(adapter))
                qlcnic_schedule_work(adapter, qlcnic_fw_poll_work,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index 10ed82b3baca..660c3f5b2237 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -170,9 +170,9 @@ static int qlcnic_82xx_store_beacon(struct qlcnic_adapter *adapter,
        if (ahw->extra_capability[0] & QLCNIC_FW_CAPABILITY_2_BEACON) {
                err = qlcnic_get_beacon_state(adapter, &h_beacon_state);
-                if (!err) {
+                if (err) {
-                        dev_info(&adapter->pdev->dev,
+                        netdev_err(adapter->netdev,
-                                 "Failed to get current beacon state\n");
+                                   "Failed to get current beacon state\n");
                } else {
                        if (h_beacon_state == QLCNIC_BEACON_DISABLE)
                                ahw->beacon_state = 0;
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 6f35f8404d68..d2e591955bdd 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -524,6 +524,7 @@ rx_status_loop:
                                         PCI_DMA_FROMDEVICE);
                if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
                        dev->stats.rx_dropped++;
+                        kfree_skb(new_skb);
                        goto rx_next;
                }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index b5eb4195fc99..85e5c97191dd 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7088,7 +7088,7 @@ rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        RTL_W8(Cfg9346, Cfg9346_Unlock);
        RTL_W8(Config1, RTL_R8(Config1) | PMEnable);
-        RTL_W8(Config5, RTL_R8(Config5) & PMEStatus);
+        RTL_W8(Config5, RTL_R8(Config5) & (BWF | MWF | UWF | LanWake | PMEStatus));
        if ((RTL_R8(Config3) & (LinkUp | MagicPacket)) != 0)
                tp->features |= RTL_FEATURE_WOL;
        if ((RTL_R8(Config5) & (UWF | BWF | MWF)) != 0)
diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
index 2a469b27a506..30d744235d27 100644
--- a/drivers/net/ethernet/sfc/filter.c
+++ b/drivers/net/ethernet/sfc/filter.c
@@ -675,7 +675,7 @@ s32 efx_filter_insert_filter(struct efx_nic *efx, struct efx_filter_spec *spec,
                BUILD_BUG_ON(EFX_FILTER_INDEX_UC_DEF != 0);
                BUILD_BUG_ON(EFX_FILTER_INDEX_MC_DEF !=
                             EFX_FILTER_MC_DEF - EFX_FILTER_UC_DEF);
-                rep_index = spec->type - EFX_FILTER_INDEX_UC_DEF;
+                rep_index = spec->type - EFX_FILTER_UC_DEF;
                ins_index = rep_index;
                spin_lock_bh(&state->lock);
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index c9d942a5c335..1ef9d8a555aa 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -33,10 +33,15 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
        struct stmmac_priv *priv = (struct stmmac_priv *)p;
        unsigned int txsize = priv->dma_tx_size;
        unsigned int entry = priv->cur_tx % txsize;
-        struct dma_desc *desc = priv->dma_tx + entry;
+        struct dma_desc *desc;
        unsigned int nopaged_len = skb_headlen(skb);
        unsigned int bmax, len;
+        if (priv->extend_desc)
+                desc = (struct dma_desc *)(priv->dma_etx + entry);
+        else
+                desc = priv->dma_tx + entry;
        if (priv->plat->enh_desc)
                bmax = BUF_SIZE_8KiB;
        else
@@ -54,7 +59,11 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                                                STMMAC_RING_MODE);
                wmb();
                entry = (++priv->cur_tx) % txsize;
-                desc = priv->dma_tx + entry;
+                if (priv->extend_desc)
+                        desc = (struct dma_desc *)(priv->dma_etx + entry);
+                else
+                        desc = priv->dma_tx + entry;
                desc->des2 = dma_map_single(priv->device, skb->data + bmax,
                                            len, DMA_TO_DEVICE);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index f2ccb36e8685..0a9bb9d30c3f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -939,15 +939,20 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
        skb = __netdev_alloc_skb(priv->dev, priv->dma_buf_sz + NET_IP_ALIGN,
                                 GFP_KERNEL);
-        if (unlikely(skb == NULL)) {
+        if (!skb) {
                pr_err("%s: Rx init fails; skb is NULL\n", __func__);
-                return 1;
+                return -ENOMEM;
        }
        skb_reserve(skb, NET_IP_ALIGN);
        priv->rx_skbuff[i] = skb;
        priv->rx_skbuff_dma[i] = dma_map_single(priv->device, skb->data,
                                                priv->dma_buf_sz,
                                                DMA_FROM_DEVICE);
+        if (dma_mapping_error(priv->device, priv->rx_skbuff_dma[i])) {
+                pr_err("%s: DMA mapping error\n", __func__);
+                dev_kfree_skb_any(skb);
+                return -EINVAL;
+        }
        p->des2 = priv->rx_skbuff_dma[i];
@@ -958,6 +963,16 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
        return 0;
 }
+static void stmmac_free_rx_buffers(struct stmmac_priv *priv, int i)
+{
+        if (priv->rx_skbuff[i]) {
+                dma_unmap_single(priv->device, priv->rx_skbuff_dma[i],
+                                 priv->dma_buf_sz, DMA_FROM_DEVICE);
+                dev_kfree_skb_any(priv->rx_skbuff[i]);
+        }
+        priv->rx_skbuff[i] = NULL;
+}
 /**
 * init_dma_desc_rings - init the RX/TX descriptor rings
 * @dev: net device structure
@@ -965,13 +980,14 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
 * and allocates the socket buffers. It suppors the chained and ring
 * modes.
 */
-static void init_dma_desc_rings(struct net_device *dev)
+static int init_dma_desc_rings(struct net_device *dev)
 {
        int i;
        struct stmmac_priv *priv = netdev_priv(dev);
        unsigned int txsize = priv->dma_tx_size;
        unsigned int rxsize = priv->dma_rx_size;
        unsigned int bfsize = 0;
+        int ret = -ENOMEM;
        /* Set the max buffer size according to the DESC mode
         * and the MTU. Note that RING mode allows 16KiB bsize.
@@ -992,34 +1008,60 @@ static void init_dma_desc_rings(struct net_device *dev)
                                                          dma_extended_desc),
                                                   &priv->dma_rx_phy,
                                                   GFP_KERNEL);
+                if (!priv->dma_erx)
+                        goto err_dma;
                priv->dma_etx = dma_alloc_coherent(priv->device, txsize *
                                                   sizeof(struct
                                                          dma_extended_desc),
                                                   &priv->dma_tx_phy,
                                                   GFP_KERNEL);
-                if ((!priv->dma_erx) || (!priv->dma_etx))
+                if (!priv->dma_etx) {
-                        return;
+                        dma_free_coherent(priv->device, priv->dma_rx_size *
+                                        sizeof(struct dma_extended_desc),
+                                        priv->dma_erx, priv->dma_rx_phy);
+                        goto err_dma;
+                }
        } else {
                priv->dma_rx = dma_alloc_coherent(priv->device, rxsize *
                                                  sizeof(struct dma_desc),
                                                  &priv->dma_rx_phy,
                                                  GFP_KERNEL);
+                if (!priv->dma_rx)
+                        goto err_dma;
                priv->dma_tx = dma_alloc_coherent(priv->device, txsize *
                                                  sizeof(struct dma_desc),
                                                  &priv->dma_tx_phy,
                                                  GFP_KERNEL);
-                if ((!priv->dma_rx) || (!priv->dma_tx))
+                if (!priv->dma_tx) {
-                        return;
+                        dma_free_coherent(priv->device, priv->dma_rx_size *
+                                        sizeof(struct dma_desc),
+                                        priv->dma_rx, priv->dma_rx_phy);
+                        goto err_dma;
+                }
        }
        priv->rx_skbuff_dma = kmalloc_array(rxsize, sizeof(dma_addr_t),
                                            GFP_KERNEL);
+        if (!priv->rx_skbuff_dma)
+                goto err_rx_skbuff_dma;
        priv->rx_skbuff = kmalloc_array(rxsize, sizeof(struct sk_buff *),
                                        GFP_KERNEL);
+        if (!priv->rx_skbuff)
+                goto err_rx_skbuff;
        priv->tx_skbuff_dma = kmalloc_array(txsize, sizeof(dma_addr_t),
                                            GFP_KERNEL);
+        if (!priv->tx_skbuff_dma)
+                goto err_tx_skbuff_dma;
        priv->tx_skbuff = kmalloc_array(txsize, sizeof(struct sk_buff *),
                                        GFP_KERNEL);
+        if (!priv->tx_skbuff)
+                goto err_tx_skbuff;
        if (netif_msg_probe(priv)) {
                pr_debug("(%s) dma_rx_phy=0x%08x dma_tx_phy=0x%08x\n", __func__,
                         (u32) priv->dma_rx_phy, (u32) priv->dma_tx_phy);
@@ -1034,8 +1076,9 @@ static void init_dma_desc_rings(struct net_device *dev)
                else
                        p = priv->dma_rx + i;
-                if (stmmac_init_rx_buffers(priv, p, i))
+                ret = stmmac_init_rx_buffers(priv, p, i);
-                        break;
+                if (ret)
+                        goto err_init_rx_buffers;
                if (netif_msg_probe(priv))
                        pr_debug("[%p]\t[%p]\t[%x]\n", priv->rx_skbuff[i],
@@ -1081,20 +1124,44 @@ static void init_dma_desc_rings(struct net_device *dev)
        if (netif_msg_hw(priv))
                stmmac_display_rings(priv);
+        return 0;
+err_init_rx_buffers:
+        while (--i >= 0)
+                stmmac_free_rx_buffers(priv, i);
+        kfree(priv->tx_skbuff);
+err_tx_skbuff:
+        kfree(priv->tx_skbuff_dma);
+err_tx_skbuff_dma:
+        kfree(priv->rx_skbuff);
+err_rx_skbuff:
+        kfree(priv->rx_skbuff_dma);
+err_rx_skbuff_dma:
+        if (priv->extend_desc) {
+                dma_free_coherent(priv->device, priv->dma_tx_size *
+                                  sizeof(struct dma_extended_desc),
+                                  priv->dma_etx, priv->dma_tx_phy);
+                dma_free_coherent(priv->device, priv->dma_rx_size *
+                                  sizeof(struct dma_extended_desc),
+                                  priv->dma_erx, priv->dma_rx_phy);
+        } else {
+                dma_free_coherent(priv->device,
+                                priv->dma_tx_size * sizeof(struct dma_desc),
+                                priv->dma_tx, priv->dma_tx_phy);
+                dma_free_coherent(priv->device,
+                                priv->dma_rx_size * sizeof(struct dma_desc),
+                                priv->dma_rx, priv->dma_rx_phy);
+        }
+err_dma:
+        return ret;
 }
 static void dma_free_rx_skbufs(struct stmmac_priv *priv)
 {
        int i;
-        for (i = 0; i < priv->dma_rx_size; i++) {
+        for (i = 0; i < priv->dma_rx_size; i++)
-                if (priv->rx_skbuff[i]) {
+                stmmac_free_rx_buffers(priv, i);
-                        dma_unmap_single(priv->device, priv->rx_skbuff_dma[i],
-                                         priv->dma_buf_sz, DMA_FROM_DEVICE);
-                        dev_kfree_skb_any(priv->rx_skbuff[i]);
-                }
-                priv->rx_skbuff[i] = NULL;
-        }
 }
 static void dma_free_tx_skbufs(struct stmmac_priv *priv)
@@ -1560,12 +1627,17 @@ static int stmmac_open(struct net_device *dev)
        priv->dma_tx_size = STMMAC_ALIGN(dma_txsize);
        priv->dma_rx_size = STMMAC_ALIGN(dma_rxsize);
        priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
-        init_dma_desc_rings(dev);
+        ret = init_dma_desc_rings(dev);
+        if (ret < 0) {
+                pr_err("%s: DMA descriptors initialization failed\n", __func__);
+                goto dma_desc_error;
+        }
        /* DMA initialization and SW reset */
        ret = stmmac_init_dma_engine(priv);
        if (ret < 0) {
-                pr_err("%s: DMA initialization failed\n", __func__);
+                pr_err("%s: DMA engine initialization failed\n", __func__);
                goto init_error;
        }
@@ -1672,6 +1744,7 @@ wolirq_error:
 init_error:
        free_dma_desc_resources(priv);
+dma_desc_error:
        if (priv->phydev)
                phy_disconnect(priv->phydev);
 phy_error:
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index 1d6dc41f755d..d01cacf8a7c2 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -2100,7 +2100,7 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
                __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vid);
        }
-        netif_rx(skb);
+        netif_receive_skb(skb);
        stats->rx_bytes += pkt_len;
        stats->rx_packets++;
@@ -2884,6 +2884,7 @@ out:
        return ret;
 err_iounmap:
+        netif_napi_del(&vptr->napi);
        iounmap(regs);
 err_free_dev:
        free_netdev(netdev);
@@ -2904,6 +2905,7 @@ static int velocity_remove(struct device *dev)
        struct velocity_info *vptr = netdev_priv(netdev);
        unregister_netdev(netdev);
+        netif_napi_del(&vptr->napi);
        iounmap(vptr->mac_regs);
        free_netdev(netdev);
        velocity_nics--;
diff --git a/drivers/net/irda/via-ircc.c b/drivers/net/irda/via-ircc.c
index 51f2bc376101..2dcc60fb37f1 100644
--- a/drivers/net/irda/via-ircc.c
+++ b/drivers/net/irda/via-ircc.c
@@ -210,8 +210,7 @@ static int via_init_one(struct pci_dev *pcidev, const struct pci_device_id *id)
                        pci_write_config_byte(pcidev,0x42,(bTmp | 0xf0));
                        pci_write_config_byte(pcidev,0x5a,0xc0);
                        WriteLPCReg(0x28, 0x70 );
-                        if (via_ircc_open(pcidev, &info, 0x3076) == 0)
+                        rc = via_ircc_open(pcidev, &info, 0x3076);
-                                rc=0;
                } else
                        rc = -ENODEV; //IR not turn on   
        } else { //Not VT1211
@@ -249,8 +248,7 @@ static int via_init_one(struct pci_dev *pcidev, const struct pci_device_id *id)
                        info.irq=FirIRQ;
                        info.dma=FirDRQ1;
                        info.dma2=FirDRQ0;
-                        if (via_ircc_open(pcidev, &info, 0x3096) == 0)
+                        rc = via_ircc_open(pcidev, &info, 0x3096);
-                                rc=0;
                } else
                        rc = -ENODEV; //IR not turn on !!!!!
        }//Not VT1211
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index d0f9c2fd1d4f..16b43bf544b7 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -739,6 +739,10 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[])
                        return -EADDRNOTAVAIL;
        }
+        if (data && data[IFLA_MACVLAN_FLAGS] &&
+            nla_get_u16(data[IFLA_MACVLAN_FLAGS]) & ~MACVLAN_FLAG_NOPROMISC)
+                return -EINVAL;
        if (data && data[IFLA_MACVLAN_MODE]) {
                switch (nla_get_u32(data[IFLA_MACVLAN_MODE])) {
                case MACVLAN_MODE_PRIVATE:
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index a98fb0ed6aef..ea53abb20988 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -68,6 +68,8 @@ static const struct proto_ops macvtap_socket_ops;
 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
                      NETIF_F_TSO6 | NETIF_F_UFO)
 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
+#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
 /*
 * RCU usage:
 * The macvtap_queue and the macvlan_dev are loosely coupled, the
@@ -278,7 +280,8 @@ static int macvtap_forward(struct net_device *dev, struct sk_buff *skb)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct macvtap_queue *q = macvtap_get_queue(dev, skb);
-        netdev_features_t features;
+        netdev_features_t features = TAP_FEATURES;
        if (!q)
                goto drop;
@@ -287,9 +290,11 @@ static int macvtap_forward(struct net_device *dev, struct sk_buff *skb)
        skb->dev = dev;
        /* Apply the forward feature mask so that we perform segmentation
-         * according to users wishes.
+         * according to users wishes.  This only works if VNET_HDR is
+         * enabled.
         */
-        features = netif_skb_features(skb) & vlan->tap_features;
+        if (q->flags & IFF_VNET_HDR)
+                features |= vlan->tap_features;
        if (netif_needs_gso(skb, features)) {
                struct sk_buff *segs = __skb_gso_segment(skb, features, false);
@@ -818,10 +823,13 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
                skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
        }
-        if (vlan)
+        if (vlan) {
+                local_bh_disable();
                macvlan_start_xmit(skb, vlan->dev);
-        else
+                local_bh_enable();
+        } else {
                kfree_skb(skb);
+        }
        rcu_read_unlock();
        return total_len;
@@ -912,8 +920,11 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 done:
        rcu_read_lock();
        vlan = rcu_dereference(q->vlan);
-        if (vlan)
+        if (vlan) {
+                preempt_disable();
                macvlan_count_rx(vlan, copied - vnet_hdr_len, ret == 0, 0);
+                preempt_enable();
+        }
        rcu_read_unlock();
        return ret ? ret : copied;
@@ -1058,8 +1069,7 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
        /* tap_features are the same as features on tun/tap and
         * reflect user expectations.
         */
-        vlan->tap_features = vlan->dev->features &
+        vlan->tap_features = feature_mask;
-                            (feature_mask | ~TUN_OFFLOADS);
        vlan->set_features = features;
        netdev_update_features(vlan->dev);
@@ -1155,10 +1165,6 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
                            TUN_F_TSO_ECN | TUN_F_UFO))
                        return -EINVAL;
-                /* TODO: only accept frames with the features that
-                         got enabled for forwarded frames */
-                if (!(q->flags & IFF_VNET_HDR))
-                        return  -EINVAL;
                rtnl_lock();
                ret = set_offload(q, arg);
                rtnl_unlock();
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index 8e7af8354342..138de837977f 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -23,7 +23,7 @@
 #define RTL821x_INER_INIT       0x6400
 #define RTL821x_INSR            0x13
-#define RTL8211E_INER_LINK_STAT 0x10
+#define RTL8211E_INER_LINK_STATUS       0x400
 MODULE_DESCRIPTION("Realtek PHY driver");
 MODULE_AUTHOR("Johnson Leung");
@@ -57,7 +57,7 @@ static int rtl8211e_config_intr(struct phy_device *phydev)
        if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
                err = phy_write(phydev, RTL821x_INER,
-                                RTL8211E_INER_LINK_STAT);
+                                RTL8211E_INER_LINK_STATUS);
        else
                err = phy_write(phydev, RTL821x_INER, 0);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index db690a372260..71af122edf2d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1074,8 +1074,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
        u32 rxhash;
        if (!(tun->flags & TUN_NO_PI)) {
-                if ((len -= sizeof(pi)) > total_len)
+                if (len < sizeof(pi))
                        return -EINVAL;
+                len -= sizeof(pi);
                if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
                        return -EFAULT;
@@ -1083,8 +1084,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
        }
        if (tun->flags & TUN_VNET_HDR) {
-                if ((len -= tun->vnet_hdr_sz) > total_len)
+                if (len < tun->vnet_hdr_sz)
                        return -EINVAL;
+                len -= tun->vnet_hdr_sz;
                if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
                        return -EFAULT;
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index cba1d46e672e..86292e6aaf49 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2816,13 +2816,16 @@ exit:
 static int hso_get_config_data(struct usb_interface *interface)
 {
        struct usb_device *usbdev = interface_to_usbdev(interface);
-        u8 config_data[17];
+        u8 *config_data = kmalloc(17, GFP_KERNEL);
        u32 if_num = interface->altsetting->desc.bInterfaceNumber;
        s32 result;
+        if (!config_data)
+                return -ENOMEM;
        if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
                            0x86, 0xC0, 0, 0, config_data, 17,
                            USB_CTRL_SET_TIMEOUT) != 0x11) {
+                kfree(config_data);
                return -EIO;
        }
@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface)
        if (config_data[16] & 0x1)
                result |= HSO_INFO_CRC_BUG;
+        kfree(config_data);
        return result;
 }
@@ -2886,6 +2890,11 @@ static int hso_probe(struct usb_interface *interface,
        struct hso_shared_int *shared_int;
        struct hso_device *tmp_dev = NULL;
+        if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) {
+                dev_err(&interface->dev, "Not our interface\n");
+                return -ENODEV;
+        }
        if_num = interface->altsetting->desc.bInterfaceNumber;
        /* Get the interface/port specification from either driver_info or from
@@ -2895,10 +2904,6 @@ static int hso_probe(struct usb_interface *interface,
        else
                port_spec = hso_get_config_data(interface);
-        if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) {
-                dev_err(&interface->dev, "Not our interface\n");
-                return -ENODEV;
-        }
        /* Check if we need to switch to alt interfaces prior to port
         * configuration */
        if (interface->num_altsetting > 1)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f4c6db419ddb..767f7af3bd40 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1386,7 +1386,7 @@ static int vxlan_open(struct net_device *dev)
                return -ENOTCONN;
        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
-            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
+            vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                vxlan_sock_hold(vs);
                dev_hold(dev);
                queue_work(vxlan_wq, &vxlan->igmp_join);
@@ -1793,8 +1793,6 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
        struct vxlan_dev *vxlan = netdev_priv(dev);
-        flush_workqueue(vxlan_wq);
        spin_lock(&vn->sock_lock);
        hlist_del_rcu(&vxlan->hlist);
        spin_unlock(&vn->sock_lock);
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
index 7365674366f4..010b252be584 100644
--- a/drivers/net/wireless/cw1200/sta.c
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -1406,11 +1406,8 @@ static void cw1200_do_unjoin(struct cw1200_common *priv)
        if (!priv->join_status)
                goto done;
-        if (priv->join_status > CW1200_JOIN_STATUS_IBSS) {
+        if (priv->join_status == CW1200_JOIN_STATUS_AP)
-                wiphy_err(priv->hw->wiphy, "Unexpected: join status: %d\n",
+                goto done;
-                          priv->join_status);
-                BUG_ON(1);
-        }
        cancel_work_sync(&priv->update_filtering_work);
        cancel_work_sync(&priv->set_beacon_wakeup_period_work);
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index ac074731335a..e5090309824e 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -523,9 +523,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
        data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
-        memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
+        memcpy(extra, addr, sizeof(struct sockaddr) * data->length);
        data->flags = 1; /* has quality information */
-        memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
+        memcpy(extra + sizeof(struct sockaddr) * data->length, qual,
               sizeof(struct iw_quality) * data->length);
        kfree(addr);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index b9b2bb51e605..f2ed62e37340 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -4460,12 +4460,12 @@ il4965_irq_tasklet(struct il_priv *il)
                 * is killed. Hence update the killswitch state here. The
                 * rfkill handler will care about restarting if needed.
                 */
-                if (!test_bit(S_ALIVE, &il->status)) {
+                if (hw_rf_kill) {
-                        if (hw_rf_kill)
+                        set_bit(S_RFKILL, &il->status);
-                                set_bit(S_RFKILL, &il->status);
+                } else {
-                        else
+                        clear_bit(S_RFKILL, &il->status);
-                                clear_bit(S_RFKILL, &il->status);
                        wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
+                        il_force_reset(il, true);
                }
                handled |= CSR_INT_BIT_RF_KILL;
@@ -5334,6 +5334,9 @@ il4965_alive_start(struct il_priv *il)
        il->active_rate = RATES_MASK;
+        il_power_update_mode(il, true);
+        D_INFO("Updated power mode\n");
        if (il_is_associated(il)) {
                struct il_rxon_cmd *active_rxon =
                    (struct il_rxon_cmd *)&il->active;
@@ -5364,9 +5367,6 @@ il4965_alive_start(struct il_priv *il)
        D_INFO("ALIVE processing complete.\n");
        wake_up(&il->wait_command_queue);
-        il_power_update_mode(il, true);
-        D_INFO("Updated power mode\n");
        return;
 restart:
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 3195aad440dd..b03e22ef5462 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4660,6 +4660,7 @@ il_force_reset(struct il_priv *il, bool external)
        return 0;
 }
+EXPORT_SYMBOL(il_force_reset);
 int
 il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 822f1a00efbb..319387263e12 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1068,7 +1068,10 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                return;
-        if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+        if (!test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+                return;
+        if (ctx->vif)
                ieee80211_chswitch_done(ctx->vif, is_success);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index a70c7b9d9bad..ff8cc75c189d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -97,8 +97,6 @@
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS          (0x00000800)
-#define APMG_RTC_INT_STT_RFKILL         (0x10000000)
 /* Device system time */
 #define DEVICE_SYSTEM_TIME_REG 0xA0206C
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index ad9bbca99213..7fd6fbfbc1b3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -138,6 +138,20 @@ static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
        schedule_work(&mvm->roc_done_wk);
 }
+static bool iwl_mvm_te_check_disconnect(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif,
+                                        const char *errmsg)
+{
+        if (vif->type != NL80211_IFTYPE_STATION)
+                return false;
+        if (vif->bss_conf.assoc && vif->bss_conf.dtim_period)
+                return false;
+        if (errmsg)
+                IWL_ERR(mvm, "%s\n", errmsg);
+        ieee80211_connection_loss(vif);
+        return true;
+}
 /*
 * Handles a FW notification for an event that is known to the driver.
 *
@@ -163,8 +177,13 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
         * P2P Device discoveribility, while there are other higher priority
         * events in the system).
         */
-        WARN_ONCE(!le32_to_cpu(notif->status),
+        if (WARN_ONCE(!le32_to_cpu(notif->status),
-                  "Failed to schedule time event\n");
+                      "Failed to schedule time event\n")) {
+                if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, NULL)) {
+                        iwl_mvm_te_clear_data(mvm, te_data);
+                        return;
+                }
+        }
        if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_END) {
                IWL_DEBUG_TE(mvm,
@@ -180,14 +199,8 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                 * By now, we should have finished association
                 * and know the dtim period.
                 */
-                if (te_data->vif->type == NL80211_IFTYPE_STATION &&
+                iwl_mvm_te_check_disconnect(mvm, te_data->vif,
-                    (!te_data->vif->bss_conf.assoc ||
+                        "No assocation and the time event is over already...");
-                     !te_data->vif->bss_conf.dtim_period)) {
-                        IWL_ERR(mvm,
-                                "No assocation and the time event is over already...\n");
-                        ieee80211_connection_loss(te_data->vif);
-                }
                iwl_mvm_te_clear_data(mvm, te_data);
        } else if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_START) {
                te_data->running = true;
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index f600e68a410a..fd848cd1583e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -888,14 +888,6 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
                iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
                if (hw_rfkill) {
-                        /*
-                         * Clear the interrupt in APMG if the NIC is going down.
-                         * Note that when the NIC exits RFkill (else branch), we
-                         * can't access prph and the NIC will be reset in
-                         * start_hw anyway.
-                         */
-                        iwl_write_prph(trans, APMG_RTC_INT_STT_REG,
-                                       APMG_RTC_INT_STT_RFKILL);
                        set_bit(STATUS_RFKILL, &trans_pcie->status);
                        if (test_and_clear_bit(STATUS_HCMD_ACTIVE,
                                               &trans_pcie->status))
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 96cfcdd39079..390e2f058aff 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1502,16 +1502,16 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        spin_lock_init(&trans_pcie->reg_lock);
        init_waitqueue_head(&trans_pcie->ucode_write_waitq);
-        /* W/A - seems to solve weird behavior. We need to remove this if we
-         * don't want to stay in L1 all the time. This wastes a lot of power */
-        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
-                               PCIE_LINK_STATE_CLKPM);
        if (pci_enable_device(pdev)) {
                err = -ENODEV;
                goto out_no_pci;
        }
+        /* W/A - seems to solve weird behavior. We need to remove this if we
+         * don't want to stay in L1 all the time. This wastes a lot of power */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+                               PCIE_LINK_STATE_CLKPM);
        pci_set_master(pdev);
        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 4941f201d6c8..b8ba1f925e75 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -98,10 +98,12 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw)
                goto exit;
        err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4,
-            USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT);
+            USB_DIR_IN | 0x40, 0, 0, buf, sizeof(ret), ZD1201_FW_TIMEOUT);
        if (err < 0)
                goto exit;
+        memcpy(&ret, buf, sizeof(ret));
        if (ret & 0x80) {
                err = -EIO;
                goto exit;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 6bb7cf2de556..b10ba00cc3e6 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -392,6 +392,8 @@ static void __unflatten_device_tree(struct boot_param_header *blob,
        mem = (unsigned long)
                dt_alloc(size + 4, __alignof__(struct device_node));
+        memset((void *)mem, 0, size);
        ((__be32 *)mem)[size / 4] = cpu_to_be32(0xdeadbeef);
        pr_debug("  unflattening %lx...\n", mem);
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index dbdc5f7e2b29..01e264fb50e0 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -317,13 +317,20 @@ void acpi_pci_remove_bus(struct pci_bus *bus)
 /* ACPI bus type */
 static int acpi_pci_find_device(struct device *dev, acpi_handle *handle)
 {
-        struct pci_dev * pci_dev;
+        struct pci_dev *pci_dev = to_pci_dev(dev);
-        u64     addr;
+        bool is_bridge;
+        u64 addr;
-        pci_dev = to_pci_dev(dev);
+        /*
+         * pci_is_bridge() is not suitable here, because pci_dev->subordinate
+         * is set only after acpi_pci_find_device() has been called for the
+         * given device.
+         */
+        is_bridge = pci_dev->hdr_type == PCI_HEADER_TYPE_BRIDGE
+                        || pci_dev->hdr_type == PCI_HEADER_TYPE_CARDBUS;
        /* Please ref to ACPI spec for the syntax of _ADR */
        addr = (PCI_SLOT(pci_dev->devfn) << 16) | PCI_FUNC(pci_dev->devfn);
-        *handle = acpi_get_child(DEVICE_ACPI_HANDLE(dev->parent), addr);
+        *handle = acpi_find_child(ACPI_HANDLE(dev->parent), addr, is_bridge);
        if (!*handle)
                return -ENODEV;
        return 0;
diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
index c47fd1e5450b..94716c779800 100644
--- a/drivers/pinctrl/pinctrl-sunxi.c
+++ b/drivers/pinctrl/pinctrl-sunxi.c
@@ -278,6 +278,7 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
 {
        struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
        struct sunxi_pinctrl_group *g = &pctl->groups[group];
+        unsigned long flags;
        u32 val, mask;
        u16 strength;
        u8 dlevel;
@@ -295,22 +296,35 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
                 *   3: 40mA
                 */
                dlevel = strength / 10 - 1;
+                spin_lock_irqsave(&pctl->lock, flags);
                val = readl(pctl->membase + sunxi_dlevel_reg(g->pin));
                mask = DLEVEL_PINS_MASK << sunxi_dlevel_offset(g->pin);
                writel((val & ~mask) | dlevel << sunxi_dlevel_offset(g->pin),
                        pctl->membase + sunxi_dlevel_reg(g->pin));
+                spin_unlock_irqrestore(&pctl->lock, flags);
                break;
        case PIN_CONFIG_BIAS_PULL_UP:
+                spin_lock_irqsave(&pctl->lock, flags);
                val = readl(pctl->membase + sunxi_pull_reg(g->pin));
                mask = PULL_PINS_MASK << sunxi_pull_offset(g->pin);
                writel((val & ~mask) | 1 << sunxi_pull_offset(g->pin),
                        pctl->membase + sunxi_pull_reg(g->pin));
+                spin_unlock_irqrestore(&pctl->lock, flags);
                break;
        case PIN_CONFIG_BIAS_PULL_DOWN:
+                spin_lock_irqsave(&pctl->lock, flags);
                val = readl(pctl->membase + sunxi_pull_reg(g->pin));
                mask = PULL_PINS_MASK << sunxi_pull_offset(g->pin);
                writel((val & ~mask) | 2 << sunxi_pull_offset(g->pin),
                        pctl->membase + sunxi_pull_reg(g->pin));
+                spin_unlock_irqrestore(&pctl->lock, flags);
                break;
        default:
                break;
@@ -360,11 +374,17 @@ static void sunxi_pmx_set(struct pinctrl_dev *pctldev,
                                 u8 config)
 {
        struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
+        unsigned long flags;
+        u32 val, mask;
+        spin_lock_irqsave(&pctl->lock, flags);
-        u32 val = readl(pctl->membase + sunxi_mux_reg(pin));
+        val = readl(pctl->membase + sunxi_mux_reg(pin));
-        u32 mask = MUX_PINS_MASK << sunxi_mux_offset(pin);
+        mask = MUX_PINS_MASK << sunxi_mux_offset(pin);
        writel((val & ~mask) | config << sunxi_mux_offset(pin),
                pctl->membase + sunxi_mux_reg(pin));
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static int sunxi_pmx_enable(struct pinctrl_dev *pctldev,
@@ -464,8 +484,21 @@ static void sunxi_pinctrl_gpio_set(struct gpio_chip *chip,
        struct sunxi_pinctrl *pctl = dev_get_drvdata(chip->dev);
        u32 reg = sunxi_data_reg(offset);
        u8 index = sunxi_data_offset(offset);
+        unsigned long flags;
+        u32 regval;
+        spin_lock_irqsave(&pctl->lock, flags);
+        regval = readl(pctl->membase + reg);
-        writel((value & DATA_PINS_MASK) << index, pctl->membase + reg);
+        if (value)
+                regval |= BIT(index);
+        else
+                regval &= ~(BIT(index));
+        writel(regval, pctl->membase + reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static int sunxi_pinctrl_gpio_of_xlate(struct gpio_chip *gc,
@@ -526,6 +559,8 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
        struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
        u32 reg = sunxi_irq_cfg_reg(d->hwirq);
        u8 index = sunxi_irq_cfg_offset(d->hwirq);
+        unsigned long flags;
+        u32 regval;
        u8 mode;
        switch (type) {
@@ -548,7 +583,13 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
                return -EINVAL;
        }
-        writel((mode & IRQ_CFG_IRQ_MASK) << index, pctl->membase + reg);
+        spin_lock_irqsave(&pctl->lock, flags);
+        regval = readl(pctl->membase + reg);
+        regval &= ~IRQ_CFG_IRQ_MASK;
+        writel(regval | (mode << index), pctl->membase + reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
        return 0;
 }
@@ -560,14 +601,19 @@ static void sunxi_pinctrl_irq_mask_ack(struct irq_data *d)
        u8 ctrl_idx = sunxi_irq_ctrl_offset(d->hwirq);
        u32 status_reg = sunxi_irq_status_reg(d->hwirq);
        u8 status_idx = sunxi_irq_status_offset(d->hwirq);
+        unsigned long flags;
        u32 val;
+        spin_lock_irqsave(&pctl->lock, flags);
        /* Mask the IRQ */
        val = readl(pctl->membase + ctrl_reg);
        writel(val & ~(1 << ctrl_idx), pctl->membase + ctrl_reg);
        /* Clear the IRQ */
        writel(1 << status_idx, pctl->membase + status_reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static void sunxi_pinctrl_irq_mask(struct irq_data *d)
@@ -575,11 +621,16 @@ static void sunxi_pinctrl_irq_mask(struct irq_data *d)
        struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
        u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
        u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
+        unsigned long flags;
        u32 val;
+        spin_lock_irqsave(&pctl->lock, flags);
        /* Mask the IRQ */
        val = readl(pctl->membase + reg);
        writel(val & ~(1 << idx), pctl->membase + reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
@@ -588,6 +639,7 @@ static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
        struct sunxi_desc_function *func;
        u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
        u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
+        unsigned long flags;
        u32 val;
        func = sunxi_pinctrl_desc_find_function_by_pin(pctl,
@@ -597,9 +649,13 @@ static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
        /* Change muxing to INT mode */
        sunxi_pmx_set(pctl->pctl_dev, pctl->irq_array[d->hwirq], func->muxval);
+        spin_lock_irqsave(&pctl->lock, flags);
        /* Unmask the IRQ */
        val = readl(pctl->membase + reg);
        writel(val | (1 << idx), pctl->membase + reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static struct irq_chip sunxi_pinctrl_irq_chip = {
@@ -752,6 +808,8 @@ static int sunxi_pinctrl_probe(struct platform_device *pdev)
                return -ENOMEM;
        platform_set_drvdata(pdev, pctl);
+        spin_lock_init(&pctl->lock);
        pctl->membase = of_iomap(node, 0);
        if (!pctl->membase)
                return -ENOMEM;
diff --git a/drivers/pinctrl/pinctrl-sunxi.h b/drivers/pinctrl/pinctrl-sunxi.h
index d68047d8f699..01c494f8a14f 100644
--- a/drivers/pinctrl/pinctrl-sunxi.h
+++ b/drivers/pinctrl/pinctrl-sunxi.h
@@ -14,6 +14,7 @@
 #define __PINCTRL_SUNXI_H
 #include <linux/kernel.h>
+#include <linux/spinlock.h>
 #define PA_BASE 0
 #define PB_BASE 32
@@ -407,6 +408,7 @@ struct sunxi_pinctrl {
        unsigned                        ngroups;
        int                             irq;
        int                             irq_array[SUNXI_IRQ_NUMBER];
+        spinlock_t                      lock;
        struct pinctrl_dev              *pctl_dev;
 };
diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
index 0f9f8596b300..f9119525f557 100644
--- a/drivers/platform/olpc/olpc-ec.c
+++ b/drivers/platform/olpc/olpc-ec.c
@@ -330,7 +330,7 @@ static int __init olpc_ec_init_module(void)
        return platform_driver_register(&olpc_ec_plat_driver);
 }
-module_init(olpc_ec_init_module);
+arch_initcall(olpc_ec_init_module);
 MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 97bb05edcb5a..d6970f47ae72 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -53,7 +53,6 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_ALS_QUERY 0x3
 #define HPWMI_HARDWARE_QUERY 0x4
 #define HPWMI_WIRELESS_QUERY 0x5
-#define HPWMI_BIOS_QUERY 0x9
 #define HPWMI_HOTKEY_QUERY 0xc
 #define HPWMI_WIRELESS2_QUERY 0x1b
 #define HPWMI_POSTCODEERROR_QUERY 0x2a
@@ -293,19 +292,6 @@ static int hp_wmi_tablet_state(void)
        return (state & 0x4) ? 1 : 0;
 }
-static int hp_wmi_enable_hotkeys(void)
-{
-        int ret;
-        int query = 0x6e;
-        ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &query, sizeof(query),
-                                   0);
-        if (ret)
-                return -EINVAL;
-        return 0;
-}
 static int hp_wmi_set_block(void *data, bool blocked)
 {
        enum hp_wmi_radio r = (enum hp_wmi_radio) data;
@@ -1009,8 +995,6 @@ static int __init hp_wmi_init(void)
                err = hp_wmi_input_setup();
                if (err)
                        return err;
-                hp_wmi_enable_hotkeys();
        }
        if (bios_capable) {
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 2ac045f27f10..3a1b6bf326a8 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -2440,7 +2440,10 @@ static ssize_t sony_nc_gfx_switch_status_show(struct device *dev,
        if (pos < 0)
                return pos;
-        return snprintf(buffer, PAGE_SIZE, "%s\n", pos ? "speed" : "stamina");
+        return snprintf(buffer, PAGE_SIZE, "%s\n",
+                                        pos == SPEED ? "speed" :
+                                        pos == STAMINA ? "stamina" :
+                                        pos == AUTO ? "auto" : "unknown");
 }
 static int sony_nc_gfx_switch_setup(struct platform_device *pd,
@@ -4320,7 +4323,8 @@ static int sony_pic_add(struct acpi_device *device)
                goto err_free_resources;
        }
-        if (sonypi_compat_init())
+        result = sonypi_compat_init();
+        if (result)
                goto err_remove_input;
        /* request io port */
diff --git a/drivers/rtc/rtc-stmp3xxx.c b/drivers/rtc/rtc-stmp3xxx.c
index 767fee2ab340..26019531db15 100644
--- a/drivers/rtc/rtc-stmp3xxx.c
+++ b/drivers/rtc/rtc-stmp3xxx.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
+#include <linux/delay.h>
 #include <linux/rtc.h>
 #include <linux/slab.h>
 #include <linux/of_device.h>
@@ -119,24 +120,39 @@ static void stmp3xxx_wdt_register(struct platform_device *rtc_pdev)
 }
 #endif /* CONFIG_STMP3XXX_RTC_WATCHDOG */
-static void stmp3xxx_wait_time(struct stmp3xxx_rtc_data *rtc_data)
+static int stmp3xxx_wait_time(struct stmp3xxx_rtc_data *rtc_data)
 {
+        int timeout = 5000; /* 3ms according to i.MX28 Ref Manual */
        /*
-         * The datasheet doesn't say which way round the
+         * The i.MX28 Applications Processor Reference Manual, Rev. 1, 2010
-         * NEW_REGS/STALE_REGS bitfields go. In fact it's 0x1=P0,
+         * states:
-         * 0x2=P1, .., 0x20=P5, 0x40=ALARM, 0x80=SECONDS
+         * | The order in which registers are updated is
+         * | Persistent 0, 1, 2, 3, 4, 5, Alarm, Seconds.
+         * | (This list is in bitfield order, from LSB to MSB, as they would
+         * | appear in the STALE_REGS and NEW_REGS bitfields of the HW_RTC_STAT
+         * | register. For example, the Seconds register corresponds to
+         * | STALE_REGS or NEW_REGS containing 0x80.)
         */
-        while (readl(rtc_data->io + STMP3XXX_RTC_STAT) &
+        do {
-                        (0x80 << STMP3XXX_RTC_STAT_STALE_SHIFT))
+                if (!(readl(rtc_data->io + STMP3XXX_RTC_STAT) &
-                cpu_relax();
+                                (0x80 << STMP3XXX_RTC_STAT_STALE_SHIFT)))
+                        return 0;
+                udelay(1);
+        } while (--timeout > 0);
+        return (readl(rtc_data->io + STMP3XXX_RTC_STAT) &
+                (0x80 << STMP3XXX_RTC_STAT_STALE_SHIFT)) ? -ETIME : 0;
 }
 /* Time read/write */
 static int stmp3xxx_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm)
 {
+        int ret;
        struct stmp3xxx_rtc_data *rtc_data = dev_get_drvdata(dev);
-        stmp3xxx_wait_time(rtc_data);
+        ret = stmp3xxx_wait_time(rtc_data);
+        if (ret)
+                return ret;
        rtc_time_to_tm(readl(rtc_data->io + STMP3XXX_RTC_SECONDS), rtc_tm);
        return 0;
 }
@@ -146,8 +162,7 @@ static int stmp3xxx_rtc_set_mmss(struct device *dev, unsigned long t)
        struct stmp3xxx_rtc_data *rtc_data = dev_get_drvdata(dev);
        writel(t, rtc_data->io + STMP3XXX_RTC_SECONDS);
-        stmp3xxx_wait_time(rtc_data);
+        return stmp3xxx_wait_time(rtc_data);
-        return 0;
 }
 /* interrupt(s) handler */
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 17150a778984..451bf99582ff 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2392,6 +2392,12 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
                rc = cqr->intrc;
        else
                rc = -EIO;
+        /* kick tasklets */
+        dasd_schedule_device_bh(device);
+        if (device->block)
+                dasd_schedule_block_bh(device->block);
        return rc;
 }
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 1d4c8fe72752..c82fe65c4128 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -102,10 +102,13 @@ static void zfcp_erp_action_dismiss_port(struct zfcp_port *port)
        if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_INUSE)
                zfcp_erp_action_dismiss(&port->erp_action);
-        else
+        else {
-                shost_for_each_device(sdev, port->adapter->scsi_host)
+                spin_lock(port->adapter->scsi_host->host_lock);
+                __shost_for_each_device(sdev, port->adapter->scsi_host)
                        if (sdev_to_zfcp(sdev)->port == port)
                                zfcp_erp_action_dismiss_lun(sdev);
+                spin_unlock(port->adapter->scsi_host->host_lock);
+        }
 }
 static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
@@ -592,9 +595,11 @@ static void _zfcp_erp_lun_reopen_all(struct zfcp_port *port, int clear,
 {
        struct scsi_device *sdev;
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock(port->adapter->scsi_host->host_lock);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                if (sdev_to_zfcp(sdev)->port == port)
                        _zfcp_erp_lun_reopen(sdev, clear, id, 0);
+        spin_unlock(port->adapter->scsi_host->host_lock);
 }
 static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
@@ -1434,8 +1439,10 @@ void zfcp_erp_set_adapter_status(struct zfcp_adapter *adapter, u32 mask)
                atomic_set_mask(common_mask, &port->status);
        read_unlock_irqrestore(&adapter->port_list_lock, flags);
-        shost_for_each_device(sdev, adapter->scsi_host)
+        spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, adapter->scsi_host)
                atomic_set_mask(common_mask, &sdev_to_zfcp(sdev)->status);
+        spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
 }
 /**
@@ -1469,11 +1476,13 @@ void zfcp_erp_clear_adapter_status(struct zfcp_adapter *adapter, u32 mask)
        }
        read_unlock_irqrestore(&adapter->port_list_lock, flags);
-        shost_for_each_device(sdev, adapter->scsi_host) {
+        spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, adapter->scsi_host) {
                atomic_clear_mask(common_mask, &sdev_to_zfcp(sdev)->status);
                if (clear_counter)
                        atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
        }
+        spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
 }
 /**
@@ -1487,16 +1496,19 @@ void zfcp_erp_set_port_status(struct zfcp_port *port, u32 mask)
 {
        struct scsi_device *sdev;
        u32 common_mask = mask & ZFCP_COMMON_FLAGS;
+        unsigned long flags;
        atomic_set_mask(mask, &port->status);
        if (!common_mask)
                return;
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                if (sdev_to_zfcp(sdev)->port == port)
                        atomic_set_mask(common_mask,
                                        &sdev_to_zfcp(sdev)->status);
+        spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
 }
 /**
@@ -1511,6 +1523,7 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
        struct scsi_device *sdev;
        u32 common_mask = mask & ZFCP_COMMON_FLAGS;
        u32 clear_counter = mask & ZFCP_STATUS_COMMON_ERP_FAILED;
+        unsigned long flags;
        atomic_clear_mask(mask, &port->status);
@@ -1520,13 +1533,15 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
        if (clear_counter)
                atomic_set(&port->erp_counter, 0);
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                if (sdev_to_zfcp(sdev)->port == port) {
                        atomic_clear_mask(common_mask,
                                          &sdev_to_zfcp(sdev)->status);
                        if (clear_counter)
                                atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
                }
+        spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
 }
 /**
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index 665e3cfaaf85..de0598eaacd2 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -224,11 +224,9 @@ int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
 static int zfcp_qdio_sbal_check(struct zfcp_qdio *qdio)
 {
-        spin_lock_irq(&qdio->req_q_lock);
        if (atomic_read(&qdio->req_q_free) ||
            !(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
                return 1;
-        spin_unlock_irq(&qdio->req_q_lock);
        return 0;
 }
@@ -246,9 +244,8 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
 {
        long ret;
-        spin_unlock_irq(&qdio->req_q_lock);
+        ret = wait_event_interruptible_lock_irq_timeout(qdio->req_q_wq,
-        ret = wait_event_interruptible_timeout(qdio->req_q_wq,
+                       zfcp_qdio_sbal_check(qdio), qdio->req_q_lock, 5 * HZ);
-                               zfcp_qdio_sbal_check(qdio), 5 * HZ);
        if (!(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
                return -EIO;
@@ -262,7 +259,6 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
                zfcp_erp_adapter_reopen(qdio->adapter, 0, "qdsbg_1");
        }
-        spin_lock_irq(&qdio->req_q_lock);
        return -EIO;
 }
diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
index 3f01bbf0609f..890639274bcf 100644
--- a/drivers/s390/scsi/zfcp_sysfs.c
+++ b/drivers/s390/scsi/zfcp_sysfs.c
@@ -27,6 +27,16 @@ static ssize_t zfcp_sysfs_##_feat##_##_name##_show(struct device *dev,	       \
 static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO,                                    \
                     zfcp_sysfs_##_feat##_##_name##_show, NULL);
+#define ZFCP_DEFINE_ATTR_CONST(_feat, _name, _format, _value)                  \
+static ssize_t zfcp_sysfs_##_feat##_##_name##_show(struct device *dev,         \
+                                                   struct device_attribute *at,\
+                                                   char *buf)                  \
+{                                                                              \
+        return sprintf(buf, _format, _value);                                  \
+}                                                                              \
+static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO,                                    \
+                     zfcp_sysfs_##_feat##_##_name##_show, NULL);
 #define ZFCP_DEFINE_A_ATTR(_name, _format, _value)                           \
 static ssize_t zfcp_sysfs_adapter_##_name##_show(struct device *dev,         \
                                                 struct device_attribute *at,\
@@ -75,6 +85,8 @@ ZFCP_DEFINE_ATTR(zfcp_unit, unit, in_recovery, "%d\n",
 ZFCP_DEFINE_ATTR(zfcp_unit, unit, access_denied, "%d\n",
                 (zfcp_unit_sdev_status(unit) &
                  ZFCP_STATUS_COMMON_ACCESS_DENIED) != 0);
+ZFCP_DEFINE_ATTR_CONST(unit, access_shared, "%d\n", 0);
+ZFCP_DEFINE_ATTR_CONST(unit, access_readonly, "%d\n", 0);
 static ssize_t zfcp_sysfs_port_failed_show(struct device *dev,
                                           struct device_attribute *attr,
@@ -347,6 +359,8 @@ static struct attribute *zfcp_unit_attrs[] = {
        &dev_attr_unit_in_recovery.attr,
        &dev_attr_unit_status.attr,
        &dev_attr_unit_access_denied.attr,
+        &dev_attr_unit_access_shared.attr,
+        &dev_attr_unit_access_readonly.attr,
        NULL
 };
 static struct attribute_group zfcp_unit_attr_group = {
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 48b2918e0d65..92ff027746f2 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1353,7 +1353,6 @@ config SCSI_LPFC
        tristate "Emulex LightPulse Fibre Channel Support"
        depends on PCI && SCSI
        select SCSI_FC_ATTRS
-        select GENERIC_CSUM
        select CRC_T10DIF
        help
          This lpfc driver supports the Emulex LightPulse
diff --git a/drivers/scsi/fnic/fnic.h b/drivers/scsi/fnic/fnic.h
index b6d1f92ed33c..c18c68150e9f 100644
--- a/drivers/scsi/fnic/fnic.h
+++ b/drivers/scsi/fnic/fnic.h
@@ -38,7 +38,7 @@
 #define DRV_NAME                "fnic"
 #define DRV_DESCRIPTION         "Cisco FCoE HBA Driver"
-#define DRV_VERSION             "1.5.0.22"
+#define DRV_VERSION             "1.5.0.23"
 #define PFX                     DRV_NAME ": "
 #define DFX                     DRV_NAME "%d: "
diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
index 5f09d1814d26..42e15ee6e1bb 100644
--- a/drivers/scsi/fnic/fnic_main.c
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -642,19 +642,6 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                INIT_WORK(&fnic->fip_frame_work, fnic_handle_fip_frame);
                INIT_WORK(&fnic->event_work, fnic_handle_event);
                skb_queue_head_init(&fnic->fip_frame_queue);
-                spin_lock_irqsave(&fnic_list_lock, flags);
-                if (!fnic_fip_queue) {
-                        fnic_fip_queue =
-                                create_singlethread_workqueue("fnic_fip_q");
-                        if (!fnic_fip_queue) {
-                                spin_unlock_irqrestore(&fnic_list_lock, flags);
-                                printk(KERN_ERR PFX "fnic FIP work queue "
-                                                 "create failed\n");
-                                err = -ENOMEM;
-                                goto err_out_free_max_pool;
-                        }
-                }
-                spin_unlock_irqrestore(&fnic_list_lock, flags);
                INIT_LIST_HEAD(&fnic->evlist);
                INIT_LIST_HEAD(&fnic->vlans);
        } else {
@@ -960,6 +947,13 @@ static int __init fnic_init_module(void)
        spin_lock_init(&fnic_list_lock);
        INIT_LIST_HEAD(&fnic_list);
+        fnic_fip_queue = create_singlethread_workqueue("fnic_fip_q");
+        if (!fnic_fip_queue) {
+                printk(KERN_ERR PFX "fnic FIP work queue create failed\n");
+                err = -ENOMEM;
+                goto err_create_fip_workq;
+        }
        fnic_fc_transport = fc_attach_transport(&fnic_fc_functions);
        if (!fnic_fc_transport) {
                printk(KERN_ERR PFX "fc_attach_transport error\n");
@@ -978,6 +972,8 @@ static int __init fnic_init_module(void)
 err_pci_register:
        fc_release_transport(fnic_fc_transport);
 err_fc_transport:
+        destroy_workqueue(fnic_fip_queue);
+err_create_fip_workq:
        destroy_workqueue(fnic_event_queue);
 err_create_fnic_workq:
        kmem_cache_destroy(fnic_io_req_cache);
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 0177295599e0..1f0ca68409d4 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3547,11 +3547,21 @@ static int megasas_init_fw(struct megasas_instance *instance)
                break;
        }
-        /*
+        if (megasas_transition_to_ready(instance, 0)) {
-         * We expect the FW state to be READY
+                atomic_set(&instance->fw_reset_no_pci_access, 1);
-         */
+                instance->instancet->adp_reset
-        if (megasas_transition_to_ready(instance, 0))
+                        (instance, instance->reg_set);
-                goto fail_ready_state;
+                atomic_set(&instance->fw_reset_no_pci_access, 0);
+                dev_info(&instance->pdev->dev,
+                        "megasas: FW restarted successfully from %s!\n",
+                        __func__);
+                /*waitting for about 30 second before retry*/
+                ssleep(30);
+                if (megasas_transition_to_ready(instance, 0))
+                        goto fail_ready_state;
+        }
        /*
         * MSI-X host index 0 is common for all adapter.
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 3b1ea34e1f5a..eaa808e6ba91 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -1031,6 +1031,9 @@ int scsi_get_vpd_page(struct scsi_device *sdev, u8 page, unsigned char *buf,
 {
        int i, result;
+        if (sdev->skip_vpd_pages)
+                goto fail;
        /* Ask for all the pages supported by this device */
        result = scsi_vpd_inquiry(sdev, buf, 0, buf_len);
        if (result)
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 2168258fb2c3..74b88efde6ad 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -751,7 +751,7 @@ static void __virtscsi_set_affinity(struct virtio_scsi *vscsi, bool affinity)
                vscsi->affinity_hint_set = true;
        } else {
-                for (i = 0; i < vscsi->num_queues - VIRTIO_SCSI_VQ_BASE; i++)
+                for (i = 0; i < vscsi->num_queues; i++)
                        virtqueue_set_affinity(vscsi->req_vqs[i].vq, -1);
                vscsi->affinity_hint_set = false;
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 222d3e37fc28..707966bd5610 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -609,7 +609,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
                else
                        buf = (void *)t->tx_buf;
                t->tx_dma = dma_map_single(&spi->dev, buf,
-                                t->len, DMA_FROM_DEVICE);
+                                t->len, DMA_TO_DEVICE);
                if (!t->tx_dma) {
                        ret = -EFAULT;
                        goto err_tx_map;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index e25eba5713c1..b3b5125faa72 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -482,7 +482,7 @@ int comedi_device_attach(struct comedi_device *dev, struct comedi_devconfig *it)
                ret = comedi_device_postconfig(dev);
        if (ret < 0) {
                comedi_device_detach(dev);
-                module_put(dev->driver->module);
+                module_put(driv->module);
        }
        /* On success, the driver module count has been incremented. */
        return ret;
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index dcceed29d31a..81972fa47beb 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1811,10 +1811,12 @@ static int zcache_comp_init(void)
 #else
        if (*zcache_comp_name != '\0') {
                ret = crypto_has_comp(zcache_comp_name, 0, 0);
-                if (!ret)
+                if (!ret) {
                        pr_info("zcache: %s not supported\n",
                                        zcache_comp_name);
-                goto out;
+                        ret = 1;
+                        goto out;
+                }
        }
        if (!ret)
                strcpy(zcache_comp_name, "lzo");
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 609dbc2f7151..83b4ef4dfcf8 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1119,11 +1119,11 @@ static int usbtmc_probe(struct usb_interface *intf,
        /* Determine if it is a Rigol or not */
        data->rigol_quirk = 0;
        dev_dbg(&intf->dev, "Trying to find if device Vendor 0x%04X Product 0x%04X has the RIGOL quirk\n",
-                data->usb_dev->descriptor.idVendor,
+                le16_to_cpu(data->usb_dev->descriptor.idVendor),
-                data->usb_dev->descriptor.idProduct);
+                le16_to_cpu(data->usb_dev->descriptor.idProduct));
        for(n = 0; usbtmc_id_quirk[n].idVendor > 0; n++) {
-                if ((usbtmc_id_quirk[n].idVendor == data->usb_dev->descriptor.idVendor) &&
+                if ((usbtmc_id_quirk[n].idVendor == le16_to_cpu(data->usb_dev->descriptor.idVendor)) &&
-                    (usbtmc_id_quirk[n].idProduct == data->usb_dev->descriptor.idProduct)) {
+                    (usbtmc_id_quirk[n].idProduct == le16_to_cpu(data->usb_dev->descriptor.idProduct))) {
                        dev_dbg(&intf->dev, "Setting this device as having the RIGOL quirk\n");
                        data->rigol_quirk = 1;
                        break;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 4a8a1d68002c..558313de4911 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4798,7 +4798,8 @@ static void hub_events(void)
                                        hub->ports[i - 1]->child;
                                dev_dbg(hub_dev, "warm reset port %d\n", i);
-                                if (!udev) {
+                                if (!udev || !(portstatus &
+                                                USB_PORT_STAT_CONNECTION)) {
                                        status = hub_port_reset(hub, i,
                                                        NULL, HUB_BH_RESET_TIME,
                                                        true);
@@ -4808,8 +4809,8 @@ static void hub_events(void)
                                        usb_lock_device(udev);
                                        status = usb_reset_device(udev);
                                        usb_unlock_device(udev);
+                                        connect_change = 0;
                                }
-                                connect_change = 0;
                        }
                        if (connect_change)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index a63598895077..5b44cd47da5b 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -78,6 +78,12 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x04d8, 0x000c), .driver_info =
                        USB_QUIRK_CONFIG_INTF_STRINGS },
+        /* CarrolTouch 4000U */
+        { USB_DEVICE(0x04e7, 0x0009), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* CarrolTouch 4500U */
+        { USB_DEVICE(0x04e7, 0x0030), .driver_info = USB_QUIRK_RESET_RESUME },
        /* Samsung Android phone modem - ID conflict with SPH-I500 */
        { USB_DEVICE(0x04e8, 0x6601), .driver_info =
                        USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index f80d0330d548..8e3c878f38cf 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1391,21 +1391,20 @@ iso_stream_schedule (
                /* Behind the scheduling threshold? */
                if (unlikely(start < next)) {
+                        unsigned now2 = (now - base) & (mod - 1);
                        /* USB_ISO_ASAP: Round up to the first available slot */
                        if (urb->transfer_flags & URB_ISO_ASAP)
                                start += (next - start + period - 1) & -period;
                        /*
-                         * Not ASAP: Use the next slot in the stream.  If
+                         * Not ASAP: Use the next slot in the stream,
-                         * the entire URB falls before the threshold, fail.
+                         * no matter what.
                         */
-                        else if (start + span - period < next) {
+                        else if (start + span - period < now2) {
-                                ehci_dbg(ehci, "iso urb late %p (%u+%u < %u)\n",
+                                ehci_dbg(ehci, "iso underrun %p (%u+%u < %u)\n",
                                                urb, start + base,
-                                                span - period, next + base);
+                                                span - period, now2 + base);
-                                status = -EXDEV;
-                                goto fail;
                        }
                }
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 08613e241894..0f1d193fef02 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -304,6 +304,11 @@ static int __init ohci_pci_init(void)
        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
        ohci_init_driver(&ohci_pci_hc_driver, &pci_overrides);
+        /* Entries for the PCI suspend/resume callbacks are special */
+        ohci_pci_hc_driver.pci_suspend = ohci_suspend;
+        ohci_pci_hc_driver.pci_resume = ohci_resume;
        return pci_register_driver(&ohci_pci_driver);
 }
 module_init(ohci_pci_init);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index df6978abd7e6..6f8c2fd47675 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -24,6 +24,7 @@
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/dmapool.h>
+#include <linux/dma-mapping.h>
 #include "xhci.h"
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 41eb4fc33453..9478caa2f71f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -27,6 +27,7 @@
 #include <linux/moduleparam.h>
 #include <linux/slab.h>
 #include <linux/dmi.h>
+#include <linux/dma-mapping.h>
 #include "xhci.h"
diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index eb3c8c142fa9..eeb27208c0d1 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -830,7 +830,7 @@ static int adu_probe(struct usb_interface *interface,
        /* let the user know what node this device is now attached to */
        dev_info(&interface->dev, "ADU%d %s now attached to /dev/usb/adutux%d\n",
-                 udev->descriptor.idProduct, dev->serial_number,
+                 le16_to_cpu(udev->descriptor.idProduct), dev->serial_number,
                 (dev->minor - ADU_MINOR_BASE));
 exit:
        dbg(2, " %s : leave, return value %p (dev)", __func__, dev);
diff --git a/drivers/usb/phy/phy-fsl-usb.h b/drivers/usb/phy/phy-fsl-usb.h
index ca266280895d..e1859b8ef567 100644
--- a/drivers/usb/phy/phy-fsl-usb.h
+++ b/drivers/usb/phy/phy-fsl-usb.h
@@ -15,7 +15,7 @@
 * 675 Mass Ave, Cambridge, MA 02139, USA.
 */
-#include "otg_fsm.h"
+#include "phy-fsm-usb.h"
 #include <linux/usb/otg.h>
 #include <linux/ioctl.h>
diff --git a/drivers/usb/phy/phy-fsm-usb.c b/drivers/usb/phy/phy-fsm-usb.c
index c520b3548e7c..7f4596606e18 100644
--- a/drivers/usb/phy/phy-fsm-usb.c
+++ b/drivers/usb/phy/phy-fsm-usb.c
@@ -29,7 +29,7 @@
 #include <linux/usb/gadget.h>
 #include <linux/usb/otg.h>
-#include "phy-otg-fsm.h"
+#include "phy-fsm-usb.h"
 /* Change USB protocol when there is a protocol change */
 static int otg_set_protocol(struct otg_fsm *fsm, int protocol)
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 5a979729f8ec..58c17fdc85eb 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -2303,7 +2303,7 @@ static int keyspan_startup(struct usb_serial *serial)
        if (d_details == NULL) {
                dev_err(&serial->dev->dev, "%s - unknown product id %x\n",
                    __func__, le16_to_cpu(serial->dev->descriptor.idProduct));
-                return 1;
+                return -ENODEV;
        }
        /* Setup private data for serial driver */
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 51da424327b0..b01300164fc0 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -90,6 +90,7 @@ struct urbtracker {
        struct list_head        urblist_entry;
        struct kref             ref_count;
        struct urb              *urb;
+        struct usb_ctrlrequest  *setup;
 };
 enum mos7715_pp_modes {
@@ -271,6 +272,7 @@ static void destroy_urbtracker(struct kref *kref)
        struct mos7715_parport *mos_parport = urbtrack->mos_parport;
        usb_free_urb(urbtrack->urb);
+        kfree(urbtrack->setup);
        kfree(urbtrack);
        kref_put(&mos_parport->ref_count, destroy_mos_parport);
 }
@@ -355,7 +357,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
        struct urbtracker *urbtrack;
        int ret_val;
        unsigned long flags;
-        struct usb_ctrlrequest setup;
        struct usb_serial *serial = mos_parport->serial;
        struct usb_device *usbdev = serial->dev;
@@ -373,14 +374,20 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
                kfree(urbtrack);
                return -ENOMEM;
        }
-        setup.bRequestType = (__u8)0x40;
+        urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
-        setup.bRequest = (__u8)0x0e;
+        if (!urbtrack->setup) {
-        setup.wValue = get_reg_value(reg, dummy);
+                usb_free_urb(urbtrack->urb);
-        setup.wIndex = get_reg_index(reg);
+                kfree(urbtrack);
-        setup.wLength = 0;
+                return -ENOMEM;
+        }
+        urbtrack->setup->bRequestType = (__u8)0x40;
+        urbtrack->setup->bRequest = (__u8)0x0e;
+        urbtrack->setup->wValue = get_reg_value(reg, dummy);
+        urbtrack->setup->wIndex = get_reg_index(reg);
+        urbtrack->setup->wLength = 0;
        usb_fill_control_urb(urbtrack->urb, usbdev,
                             usb_sndctrlpipe(usbdev, 0),
-                             (unsigned char *)&setup,
+                             (unsigned char *)urbtrack->setup,
                             NULL, 0, async_complete, urbtrack);
        kref_init(&urbtrack->ref_count);
        INIT_LIST_HEAD(&urbtrack->urblist_entry);
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index d953d674f222..3bac4693c038 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -2193,7 +2193,7 @@ static int mos7810_check(struct usb_serial *serial)
 static int mos7840_probe(struct usb_serial *serial,
                                const struct usb_device_id *id)
 {
-        u16 product = serial->dev->descriptor.idProduct;
+        u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
        u8 *buf;
        int device_type;
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 375b5a400b6f..5c9f9b1d7736 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1536,14 +1536,15 @@ static int ti_download_firmware(struct ti_device *tdev)
        char buf[32];
        /* try ID specific firmware first, then try generic firmware */
-        sprintf(buf, "ti_usb-v%04x-p%04x.fw", dev->descriptor.idVendor,
+        sprintf(buf, "ti_usb-v%04x-p%04x.fw",
-            dev->descriptor.idProduct);
+                        le16_to_cpu(dev->descriptor.idVendor),
+                        le16_to_cpu(dev->descriptor.idProduct));
        status = request_firmware(&fw_p, buf, &dev->dev);
        if (status != 0) {
                buf[0] = '\0';
-                if (dev->descriptor.idVendor == MTS_VENDOR_ID) {
+                if (le16_to_cpu(dev->descriptor.idVendor) == MTS_VENDOR_ID) {
-                        switch (dev->descriptor.idProduct) {
+                        switch (le16_to_cpu(dev->descriptor.idProduct)) {
                        case MTS_CDMA_PRODUCT_ID:
                                strcpy(buf, "mts_cdma.fw");
                                break;
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 8257d30c4072..85365784040b 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -291,18 +291,18 @@ static void usb_wwan_indat_callback(struct urb *urb)
                        tty_flip_buffer_push(&port->port);
                } else
                        dev_dbg(dev, "%s: empty read urb received\n", __func__);
+        }
-                /* Resubmit urb so we continue receiving */
+        /* Resubmit urb so we continue receiving */
-                err = usb_submit_urb(urb, GFP_ATOMIC);
+        err = usb_submit_urb(urb, GFP_ATOMIC);
-                if (err) {
+        if (err) {
-                        if (err != -EPERM) {
+                if (err != -EPERM) {
-                                dev_err(dev, "%s: resubmit read urb failed. (%d)\n", __func__, err);
+                        dev_err(dev, "%s: resubmit read urb failed. (%d)\n",
-                                /* busy also in error unless we are killed */
+                                __func__, err);
-                                usb_mark_last_busy(port->serial->dev);
+                        /* busy also in error unless we are killed */
-                        }
-                } else {
                        usb_mark_last_busy(port->serial->dev);
                }
+        } else {
+                usb_mark_last_busy(port->serial->dev);
        }
 }
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 16968c899493..d3493ca0525d 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -1226,6 +1226,12 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb)
        }
        spin_lock_irqsave(&xfer->lock, flags);
        rpipe = xfer->ep->hcpriv;
+        if (rpipe == NULL) {
+                pr_debug("%s: xfer id 0x%08X has no RPIPE.  %s",
+                        __func__, wa_xfer_id(xfer),
+                        "Probably already aborted.\n" );
+                goto out_unlock;
+        }
        /* Check the delayed list -> if there, release and complete */
        spin_lock_irqsave(&wa->xfer_list_lock, flags2);
        if (!list_empty(&xfer->list_node) && xfer->seg == NULL)
@@ -1644,8 +1650,7 @@ static void wa_xfer_result_cb(struct urb *urb)
                        break;
                }
                usb_status = xfer_result->bTransferStatus & 0x3f;
-                if (usb_status == WA_XFER_STATUS_ABORTED
+                if (usb_status == WA_XFER_STATUS_NOT_FOUND)
-                    || usb_status == WA_XFER_STATUS_NOT_FOUND)
                        /* taken care of already */
                        break;
                xfer_id = xfer_result->dwTransferID;
diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c
index 3ba37713b1f9..dc09ebe4aba5 100644
--- a/drivers/video/mxsfb.c
+++ b/drivers/video/mxsfb.c
@@ -239,24 +239,6 @@ static const struct fb_bitfield def_rgb565[] = {
        }
 };
-static const struct fb_bitfield def_rgb666[] = {
-        [RED] = {
-                .offset = 16,
-                .length = 6,
-        },
-        [GREEN] = {
-                .offset = 8,
-                .length = 6,
-        },
-        [BLUE] = {
-                .offset = 0,
-                .length = 6,
-        },
-        [TRANSP] = {    /* no support for transparency */
-                .length = 0,
-        }
-};
 static const struct fb_bitfield def_rgb888[] = {
        [RED] = {
                .offset = 16,
@@ -309,9 +291,6 @@ static int mxsfb_check_var(struct fb_var_screeninfo *var,
                        break;
                case STMLCDIF_16BIT:
                case STMLCDIF_18BIT:
-                        /* 24 bit to 18 bit mapping */
-                        rgb = def_rgb666;
-                        break;
                case STMLCDIF_24BIT:
                        /* real 24 bit */
                        rgb = def_rgb888;
@@ -453,11 +432,6 @@ static int mxsfb_set_par(struct fb_info *fb_info)
                        return -EINVAL;
                case STMLCDIF_16BIT:
                case STMLCDIF_18BIT:
-                        /* 24 bit to 18 bit mapping */
-                        ctrl |= CTRL_DF24; /* ignore the upper 2 bits in
-                                            *  each colour component
-                                            */
-                        break;
                case STMLCDIF_24BIT:
                        /* real 24 bit */
                        break;
diff --git a/drivers/video/omap2/displays-new/connector-analog-tv.c b/drivers/video/omap2/displays-new/connector-analog-tv.c
index 5338f362293b..1b60698f141e 100644
--- a/drivers/video/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/omap2/displays-new/connector-analog-tv.c
@@ -28,6 +28,20 @@ struct panel_drv_data {
        bool invert_polarity;
 };
+static const struct omap_video_timings tvc_pal_timings = {
+        .x_res          = 720,
+        .y_res          = 574,
+        .pixel_clock    = 13500,
+        .hsw            = 64,
+        .hfp            = 12,
+        .hbp            = 68,
+        .vsw            = 5,
+        .vfp            = 5,
+        .vbp            = 41,
+        .interlace      = true,
+};
 #define to_panel_data(x) container_of(x, struct panel_drv_data, dssdev)
 static int tvc_connect(struct omap_dss_device *dssdev)
@@ -212,14 +226,14 @@ static int tvc_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        ddata->timings = omap_dss_pal_timings;
+        ddata->timings = tvc_pal_timings;
        dssdev = &ddata->dssdev;
        dssdev->driver = &tvc_driver;
        dssdev->dev = &pdev->dev;
        dssdev->type = OMAP_DISPLAY_TYPE_VENC;
        dssdev->owner = THIS_MODULE;
-        dssdev->panel.timings = omap_dss_pal_timings;
+        dssdev->panel.timings = tvc_pal_timings;
        r = omapdss_register_display(dssdev);
        if (r) {
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index a58ac435a9a4..5e8be462aed5 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -348,7 +348,7 @@ static void init_evtchn_cpu_bindings(void)
        for_each_possible_cpu(i)
                memset(per_cpu(cpu_evtchn_mask, i),
-                       (i == 0) ? ~0 : 0, sizeof(*per_cpu(cpu_evtchn_mask, i)));
+                       (i == 0) ? ~0 : 0, NR_EVENT_CHANNELS/8);
 }
 static inline void clear_evtchn(int port)
@@ -1493,8 +1493,10 @@ void rebind_evtchn_irq(int evtchn, int irq)
 /* Rebind an evtchn so that it gets delivered to a specific cpu */
 static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
 {
+        struct shared_info *s = HYPERVISOR_shared_info;
        struct evtchn_bind_vcpu bind_vcpu;
        int evtchn = evtchn_from_irq(irq);
+        int masked;
        if (!VALID_EVTCHN(evtchn))
                return -1;
@@ -1511,6 +1513,12 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
        bind_vcpu.vcpu = tcpu;
        /*
+         * Mask the event while changing the VCPU binding to prevent
+         * it being delivered on an unexpected VCPU.
+         */
+        masked = sync_test_and_set_bit(evtchn, BM(s->evtchn_mask));
+        /*
         * If this fails, it usually just indicates that we're dealing with a
         * virq or IPI channel, which don't actually need to be rebound. Ignore
         * it, but don't do the xenlinux-level rebind in that case.
@@ -1518,6 +1526,9 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
        if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
                bind_evtchn_to_cpu(evtchn, tcpu);
+        if (!masked)
+                unmask_evtchn(evtchn);
        return 0;
 }