206 files changed, 2652 insertions, 2564 deletions
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 657964e8ab7e..37fb19047603 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -65,6 +65,7 @@ struct lpss_private_data;
 struct lpss_device_desc {
        unsigned int flags;
+        const char *clk_con_id;
        unsigned int prv_offset;
        size_t prv_size_override;
        void (*setup)(struct lpss_private_data *pdata);
@@ -140,6 +141,7 @@ static struct lpss_device_desc lpt_i2c_dev_desc = {
 static struct lpss_device_desc lpt_uart_dev_desc = {
        .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_LTR,
+        .clk_con_id = "baudclk",
        .prv_offset = 0x800,
        .setup = lpss_uart_setup,
 };
@@ -156,6 +158,7 @@ static struct lpss_device_desc byt_pwm_dev_desc = {
 static struct lpss_device_desc byt_uart_dev_desc = {
        .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
+        .clk_con_id = "baudclk",
        .prv_offset = 0x800,
        .setup = lpss_uart_setup,
 };
@@ -313,7 +316,7 @@ out:
                return PTR_ERR(clk);
        pdata->clk = clk;
-        clk_register_clkdev(clk, NULL, devname);
+        clk_register_clkdev(clk, dev_desc->clk_con_id, devname);
        return 0;
 }
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index e7f718d6918a..b1def411c0b8 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -485,6 +485,14 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
        if (!pin || !dev->irq_managed || dev->irq <= 0)
                return;
+        /* Keep IOAPIC pin configuration when suspending */
+        if (dev->dev.power.is_prepared)
+                return;
+#ifdef  CONFIG_PM
+        if (dev->dev.power.runtime_status == RPM_SUSPENDING)
+                return;
+#endif
        entry = acpi_pci_irq_lookup(dev, pin);
        if (!entry)
                return;
@@ -505,6 +513,5 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
        if (gsi >= 0) {
                acpi_unregister_gsi(gsi);
                dev->irq_managed = 0;
-                dev->irq = 0;
        }
 }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 4c35f0822d06..ef150ebb4c30 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4737,7 +4737,7 @@ struct ata_queued_cmd *ata_qc_new_init(struct ata_device *dev, int tag)
                return NULL;
        /* libsas case */
-        if (!ap->scsi_host) {
+        if (ap->flags & ATA_FLAG_SAS_HOST) {
                tag = ata_sas_allocate_tag(ap);
                if (tag < 0)
                        return NULL;
@@ -4776,7 +4776,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
        tag = qc->tag;
        if (likely(ata_tag_valid(tag))) {
                qc->tag = ATA_TAG_POISON;
-                if (!ap->scsi_host)
+                if (ap->flags & ATA_FLAG_SAS_HOST)
                        ata_sas_free_tag(tag, ap);
        }
 }
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index beb8b27d4621..a13587b5c2be 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -243,4 +243,12 @@ extern struct regcache_ops regcache_rbtree_ops;
 extern struct regcache_ops regcache_lzo_ops;
 extern struct regcache_ops regcache_flat_ops;
+static inline const char *regmap_name(const struct regmap *map)
+{
+        if (map->dev)
+                return dev_name(map->dev);
+        return map->name;
+}
 #endif
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index d453a2c98ad0..81751a49d8bf 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -307,7 +307,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
        if (pos == 0) {
                memmove(blk + offset * map->cache_word_size,
                        blk, rbnode->blklen * map->cache_word_size);
-                bitmap_shift_right(present, present, offset, blklen);
+                bitmap_shift_left(present, present, offset, blklen);
        }
        /* update the rbnode block, its size and the base register */
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index f373c35f9e1d..87db9893b463 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -218,7 +218,7 @@ int regcache_read(struct regmap *map,
                ret = map->cache_ops->read(map, reg, value);
                if (ret == 0)
-                        trace_regmap_reg_read_cache(map->dev, reg, *value);
+                        trace_regmap_reg_read_cache(map, reg, *value);
                return ret;
        }
@@ -311,7 +311,7 @@ int regcache_sync(struct regmap *map)
        dev_dbg(map->dev, "Syncing %s cache\n",
                map->cache_ops->name);
        name = map->cache_ops->name;
-        trace_regcache_sync(map->dev, name, "start");
+        trace_regcache_sync(map, name, "start");
        if (!map->cache_dirty)
                goto out;
@@ -346,7 +346,7 @@ out:
        regmap_async_complete(map);
-        trace_regcache_sync(map->dev, name, "stop");
+        trace_regcache_sync(map, name, "stop");
        return ret;
 }
@@ -381,7 +381,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
        name = map->cache_ops->name;
        dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
-        trace_regcache_sync(map->dev, name, "start region");
+        trace_regcache_sync(map, name, "start region");
        if (!map->cache_dirty)
                goto out;
@@ -401,7 +401,7 @@ out:
        regmap_async_complete(map);
-        trace_regcache_sync(map->dev, name, "stop region");
+        trace_regcache_sync(map, name, "stop region");
        return ret;
 }
@@ -428,7 +428,7 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
        map->lock(map->lock_arg);
-        trace_regcache_drop_region(map->dev, min, max);
+        trace_regcache_drop_region(map, min, max);
        ret = map->cache_ops->drop(map, min, max);
@@ -455,7 +455,7 @@ void regcache_cache_only(struct regmap *map, bool enable)
        map->lock(map->lock_arg);
        WARN_ON(map->cache_bypass && enable);
        map->cache_only = enable;
-        trace_regmap_cache_only(map->dev, enable);
+        trace_regmap_cache_only(map, enable);
        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_only);
@@ -493,7 +493,7 @@ void regcache_cache_bypass(struct regmap *map, bool enable)
        map->lock(map->lock_arg);
        WARN_ON(map->cache_only && enable);
        map->cache_bypass = enable;
-        trace_regmap_cache_bypass(map->dev, enable);
+        trace_regmap_cache_bypass(map, enable);
        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_bypass);
@@ -608,7 +608,8 @@ static int regcache_sync_block_single(struct regmap *map, void *block,
        for (i = start; i < end; i++) {
                regtmp = block_base + (i * map->reg_stride);
-                if (!regcache_reg_present(cache_present, i))
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp))
                        continue;
                val = regcache_get_val(map, block, i);
@@ -677,7 +678,8 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
        for (i = start; i < end; i++) {
                regtmp = block_base + (i * map->reg_stride);
-                if (!regcache_reg_present(cache_present, i)) {
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp)) {
                        ret = regcache_sync_block_raw_flush(map, &data,
                                                            base, regtmp);
                        if (ret != 0)
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 6299a50a5960..a6c3f75b4b01 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -499,7 +499,8 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
                goto err_alloc;
        }
-        ret = request_threaded_irq(irq, NULL, regmap_irq_thread, irq_flags,
+        ret = request_threaded_irq(irq, NULL, regmap_irq_thread,
+                                   irq_flags | IRQF_ONESHOT,
                                   chip->name, d);
        if (ret != 0) {
                dev_err(map->dev, "Failed to request IRQ %d for %s: %d\n",
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index f99b098ddabf..dbfe6a69c3da 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1281,7 +1281,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
        if (map->async && map->bus->async_write) {
                struct regmap_async *async;
-                trace_regmap_async_write_start(map->dev, reg, val_len);
+                trace_regmap_async_write_start(map, reg, val_len);
                spin_lock_irqsave(&map->async_lock, flags);
                async = list_first_entry_or_null(&map->async_free,
@@ -1339,8 +1339,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                return ret;
        }
-        trace_regmap_hw_write_start(map->dev, reg,
+        trace_regmap_hw_write_start(map, reg, val_len / map->format.val_bytes);
-                                    val_len / map->format.val_bytes);
        /* If we're doing a single register write we can probably just
         * send the work_buf directly, otherwise try to do a gather
@@ -1372,8 +1371,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                kfree(buf);
        }
-        trace_regmap_hw_write_done(map->dev, reg,
+        trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
-                                   val_len / map->format.val_bytes);
        return ret;
 }
@@ -1407,12 +1405,12 @@ static int _regmap_bus_formatted_write(void *context, unsigned int reg,
        map->format.format_write(map, reg, val);
-        trace_regmap_hw_write_start(map->dev, reg, 1);
+        trace_regmap_hw_write_start(map, reg, 1);
        ret = map->bus->write(map->bus_context, map->work_buf,
                              map->format.buf_size);
-        trace_regmap_hw_write_done(map->dev, reg, 1);
+        trace_regmap_hw_write_done(map, reg, 1);
        return ret;
 }
@@ -1470,7 +1468,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
                dev_info(map->dev, "%x <= %x\n", reg, val);
 #endif
-        trace_regmap_reg_write(map->dev, reg, val);
+        trace_regmap_reg_write(map, reg, val);
        return map->reg_write(context, reg, val);
 }
@@ -1773,7 +1771,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
        for (i = 0; i < num_regs; i++) {
                int reg = regs[i].reg;
                int val = regs[i].def;
-                trace_regmap_hw_write_start(map->dev, reg, 1);
+                trace_regmap_hw_write_start(map, reg, 1);
                map->format.format_reg(u8, reg, map->reg_shift);
                u8 += reg_bytes + pad_bytes;
                map->format.format_val(u8, val, 0);
@@ -1788,7 +1786,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
        for (i = 0; i < num_regs; i++) {
                int reg = regs[i].reg;
-                trace_regmap_hw_write_done(map->dev, reg, 1);
+                trace_regmap_hw_write_done(map, reg, 1);
        }
        return ret;
 }
@@ -2059,15 +2057,13 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
         */
        u8[0] |= map->read_flag_mask;
-        trace_regmap_hw_read_start(map->dev, reg,
+        trace_regmap_hw_read_start(map, reg, val_len / map->format.val_bytes);
-                                   val_len / map->format.val_bytes);
        ret = map->bus->read(map->bus_context, map->work_buf,
                             map->format.reg_bytes + map->format.pad_bytes,
                             val, val_len);
-        trace_regmap_hw_read_done(map->dev, reg,
+        trace_regmap_hw_read_done(map, reg, val_len / map->format.val_bytes);
-                                  val_len / map->format.val_bytes);
        return ret;
 }
@@ -2123,7 +2119,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
                        dev_info(map->dev, "%x => %x\n", reg, *val);
 #endif
-                trace_regmap_reg_read(map->dev, reg, *val);
+                trace_regmap_reg_read(map, reg, *val);
                if (!map->cache_bypass)
                        regcache_write(map, reg, *val);
@@ -2480,7 +2476,7 @@ void regmap_async_complete_cb(struct regmap_async *async, int ret)
        struct regmap *map = async->map;
        bool wake;
-        trace_regmap_async_io_complete(map->dev);
+        trace_regmap_async_io_complete(map);
        spin_lock(&map->async_lock);
        list_move(&async->list, &map->async_free);
@@ -2525,7 +2521,7 @@ int regmap_async_complete(struct regmap *map)
        if (!map->bus || !map->bus->async_write)
                return 0;
-        trace_regmap_async_complete_start(map->dev);
+        trace_regmap_async_complete_start(map);
        wait_event(map->async_waitq, regmap_async_is_done(map));
@@ -2534,7 +2530,7 @@ int regmap_async_complete(struct regmap *map)
        map->async_ret = 0;
        spin_unlock_irqrestore(&map->async_lock, flags);
-        trace_regmap_async_complete_done(map->dev);
+        trace_regmap_async_complete_done(map);
        return ret;
 }
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index fae2dbbf5745..72d7028f779b 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -142,6 +142,7 @@ struct ports_device {
         * notification
         */
        struct work_struct control_work;
+        struct work_struct config_work;
        struct list_head ports;
@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_device *vdev)
        portdev = vdev->priv;
+        if (!use_multiport(portdev))
+                schedule_work(&portdev->config_work);
+}
+static void config_work_handler(struct work_struct *work)
+{
+        struct ports_device *portdev;
+        portdev = container_of(work, struct ports_device, control_work);
        if (!use_multiport(portdev)) {
+                struct virtio_device *vdev;
                struct port *port;
                u16 rows, cols;
+                vdev = portdev->vdev;
                virtio_cread(vdev, struct virtio_console_config, cols, &cols);
                virtio_cread(vdev, struct virtio_console_config, rows, &rows);
@@ -2040,12 +2052,14 @@ static int virtcons_probe(struct virtio_device *vdev)
        virtio_device_ready(portdev->vdev);
+        INIT_WORK(&portdev->config_work, &config_work_handler);
+        INIT_WORK(&portdev->control_work, &control_work_handler);
        if (multiport) {
                unsigned int nr_added_bufs;
                spin_lock_init(&portdev->c_ivq_lock);
                spin_lock_init(&portdev->c_ovq_lock);
-                INIT_WORK(&portdev->control_work, &control_work_handler);
                nr_added_bufs = fill_queue(portdev->c_ivq,
                                           &portdev->c_ivq_lock);
@@ -2113,6 +2127,8 @@ static void virtcons_remove(struct virtio_device *vdev)
        /* Finish up work that's lined up */
        if (use_multiport(portdev))
                cancel_work_sync(&portdev->control_work);
+        else
+                cancel_work_sync(&portdev->config_work);
        list_for_each_entry_safe(port, port2, &portdev->ports, list)
                unplug_port(port);
@@ -2164,6 +2180,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
        virtqueue_disable_cb(portdev->c_ivq);
        cancel_work_sync(&portdev->control_work);
+        cancel_work_sync(&portdev->config_work);
        /*
         * Once more: if control_work_handler() was running, it would
         * enable the cb as the last step.
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index db7f8bce7467..25006a8bb8e6 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -144,12 +144,6 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw,
                                   divider->flags);
 }
-/*
- * The reverse of DIV_ROUND_UP: The maximum number which
- * divided by m is r
- */
-#define MULT_ROUND_UP(r, m) ((r) * (m) + (m) - 1)
 static bool _is_valid_table_div(const struct clk_div_table *table,
                                                         unsigned int div)
 {
@@ -225,19 +219,24 @@ static int _div_round_closest(const struct clk_div_table *table,
                              unsigned long parent_rate, unsigned long rate,
                              unsigned long flags)
 {
-        int up, down, div;
+        int up, down;
+        unsigned long up_rate, down_rate;
-        up = down = div = DIV_ROUND_CLOSEST(parent_rate, rate);
+        up = DIV_ROUND_UP(parent_rate, rate);
+        down = parent_rate / rate;
        if (flags & CLK_DIVIDER_POWER_OF_TWO) {
-                up = __roundup_pow_of_two(div);
+                up = __roundup_pow_of_two(up);
-                down = __rounddown_pow_of_two(div);
+                down = __rounddown_pow_of_two(down);
        } else if (table) {
-                up = _round_up_table(table, div);
+                up = _round_up_table(table, up);
-                down = _round_down_table(table, div);
+                down = _round_down_table(table, down);
        }
-        return (up - div) <= (div - down) ? up : down;
+        up_rate = DIV_ROUND_UP(parent_rate, up);
+        down_rate = DIV_ROUND_UP(parent_rate, down);
+        return (rate - up_rate) <= (down_rate - rate) ? up : down;
 }
 static int _div_round(const struct clk_div_table *table,
@@ -313,7 +312,7 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
                        return i;
                }
                parent_rate = __clk_round_rate(__clk_get_parent(hw->clk),
-                                MULT_ROUND_UP(rate, i));
+                                               rate * i);
                now = DIV_ROUND_UP(parent_rate, i);
                if (_is_best_div(rate, now, best, flags)) {
                        bestdiv = i;
@@ -353,7 +352,7 @@ static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate,
                bestdiv = readl(divider->reg) >> divider->shift;
                bestdiv &= div_mask(divider->width);
                bestdiv = _get_div(divider->table, bestdiv, divider->flags);
-                return bestdiv;
+                return DIV_ROUND_UP(*prate, bestdiv);
        }
        return divider_round_rate(hw, rate, prate, divider->table,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index eb0152961d3c..237f23f68bfc 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1350,7 +1350,6 @@ static unsigned long clk_core_get_rate(struct clk_core *clk)
        return rate;
 }
-EXPORT_SYMBOL_GPL(clk_core_get_rate);
 /**
 * clk_get_rate - return the rate of clk
@@ -2171,6 +2170,32 @@ int clk_get_phase(struct clk *clk)
 }
 /**
+ * clk_is_match - check if two clk's point to the same hardware clock
+ * @p: clk compared against q
+ * @q: clk compared against p
+ *
+ * Returns true if the two struct clk pointers both point to the same hardware
+ * clock node. Put differently, returns true if struct clk *p and struct clk *q
+ * share the same struct clk_core object.
+ *
+ * Returns false otherwise. Note that two NULL clks are treated as matching.
+ */
+bool clk_is_match(const struct clk *p, const struct clk *q)
+{
+        /* trivial case: identical struct clk's or both NULL */
+        if (p == q)
+                return true;
+        /* true if clk->core pointers match. Avoid derefing garbage */
+        if (!IS_ERR_OR_NULL(p) && !IS_ERR_OR_NULL(q))
+                if (p->core == q->core)
+                        return true;
+        return false;
+}
+EXPORT_SYMBOL_GPL(clk_is_match);
+/**
 * __clk_init - initialize the data structures in a struct clk
 * @dev:        device initializing this clk, placeholder for now
 * @clk:        clk being initialized
diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c
index b0b562b9ce0e..e60feffc10a1 100644
--- a/drivers/clk/qcom/gcc-msm8960.c
+++ b/drivers/clk/qcom/gcc-msm8960.c
@@ -48,6 +48,17 @@ static struct clk_pll pll3 = {
        },
 };
+static struct clk_regmap pll4_vote = {
+        .enable_reg = 0x34c0,
+        .enable_mask = BIT(4),
+        .hw.init = &(struct clk_init_data){
+                .name = "pll4_vote",
+                .parent_names = (const char *[]){ "pll4" },
+                .num_parents = 1,
+                .ops = &clk_pll_vote_ops,
+        },
+};
 static struct clk_pll pll8 = {
        .l_reg = 0x3144,
        .m_reg = 0x3148,
@@ -3023,6 +3034,7 @@ static struct clk_branch rpm_msg_ram_h_clk = {
 static struct clk_regmap *gcc_msm8960_clks[] = {
        [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
        [PLL8] = &pll8.clkr,
        [PLL8_VOTE] = &pll8_vote,
        [PLL14] = &pll14.clkr,
@@ -3247,6 +3259,7 @@ static const struct qcom_reset_map gcc_msm8960_resets[] = {
 static struct clk_regmap *gcc_apq8064_clks[] = {
        [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
        [PLL8] = &pll8.clkr,
        [PLL8_VOTE] = &pll8_vote,
        [PLL14] = &pll14.clkr,
diff --git a/drivers/clk/qcom/lcc-ipq806x.c b/drivers/clk/qcom/lcc-ipq806x.c
index 121ffde25dc3..c9ff27b4648b 100644
--- a/drivers/clk/qcom/lcc-ipq806x.c
+++ b/drivers/clk/qcom/lcc-ipq806x.c
@@ -462,7 +462,6 @@ static struct platform_driver lcc_ipq806x_driver = {
        .remove         = lcc_ipq806x_remove,
        .driver         = {
                .name   = "lcc-ipq806x",
-                .owner  = THIS_MODULE,
                .of_match_table = lcc_ipq806x_match_table,
        },
 };
diff --git a/drivers/clk/qcom/lcc-msm8960.c b/drivers/clk/qcom/lcc-msm8960.c
index a75a408cfccd..e2c863295f00 100644
--- a/drivers/clk/qcom/lcc-msm8960.c
+++ b/drivers/clk/qcom/lcc-msm8960.c
@@ -417,8 +417,8 @@ static struct clk_rcg slimbus_src = {
                .mnctr_en_bit = 8,
                .mnctr_reset_bit = 7,
                .mnctr_mode_shift = 5,
-                .n_val_shift = 16,
+                .n_val_shift = 24,
-                .m_val_shift = 16,
+                .m_val_shift = 8,
                .width = 8,
        },
        .p = {
@@ -547,7 +547,7 @@ static int lcc_msm8960_probe(struct platform_device *pdev)
                return PTR_ERR(regmap);
        /* Use the correct frequency plan depending on speed of PLL4 */
-        val = regmap_read(regmap, 0x4, &val);
+        regmap_read(regmap, 0x4, &val);
        if (val == 0x12) {
                slimbus_src.freq_tbl = clk_tbl_aif_osr_492;
                mi2s_osr_src.freq_tbl = clk_tbl_aif_osr_492;
@@ -574,7 +574,6 @@ static struct platform_driver lcc_msm8960_driver = {
        .remove         = lcc_msm8960_remove,
        .driver         = {
                .name   = "lcc-msm8960",
-                .owner  = THIS_MODULE,
                .of_match_table = lcc_msm8960_match_table,
        },
 };
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 6ef89639a9f6..d21640634adf 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -84,7 +84,7 @@ static int ti_fapll_enable(struct clk_hw *hw)
        struct fapll_data *fd = to_fapll(hw);
        u32 v = readl_relaxed(fd->base);
-        v |= (1 << FAPLL_MAIN_PLLEN);
+        v |= FAPLL_MAIN_PLLEN;
        writel_relaxed(v, fd->base);
        return 0;
@@ -95,7 +95,7 @@ static void ti_fapll_disable(struct clk_hw *hw)
        struct fapll_data *fd = to_fapll(hw);
        u32 v = readl_relaxed(fd->base);
-        v &= ~(1 << FAPLL_MAIN_PLLEN);
+        v &= ~FAPLL_MAIN_PLLEN;
        writel_relaxed(v, fd->base);
 }
@@ -104,7 +104,7 @@ static int ti_fapll_is_enabled(struct clk_hw *hw)
        struct fapll_data *fd = to_fapll(hw);
        u32 v = readl_relaxed(fd->base);
-        return v & (1 << FAPLL_MAIN_PLLEN);
+        return v & FAPLL_MAIN_PLLEN;
 }
 static unsigned long ti_fapll_recalc_rate(struct clk_hw *hw,
diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
index bba62f9deefb..ec57ba2bbd87 100644
--- a/drivers/clocksource/time-efm32.c
+++ b/drivers/clocksource/time-efm32.c
@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
        clock_event_ddata.base = base;
        clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
-        setup_irq(irq, &efm32_clock_event_irq);
        clockevents_config_and_register(&clock_event_ddata.evtdev,
                                        DIV_ROUND_CLOSEST(rate, 1024),
                                        0xf, 0xffff);
+        setup_irq(irq, &efm32_clock_event_irq);
        return 0;
 err_get_irq:
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 02268448dc85..5dcbf90b8015 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -178,10 +178,6 @@ static void __init sun5i_timer_init(struct device_node *node)
        ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
-        ret = setup_irq(irq, &sun5i_timer_irq);
-        if (ret)
-                pr_warn("failed to setup irq %d\n", irq);
        /* Enable timer0 interrupt */
        val = readl(timer_base + TIMER_IRQ_EN_REG);
        writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
@@ -191,6 +187,10 @@ static void __init sun5i_timer_init(struct device_node *node)
        clockevents_config_and_register(&sun5i_clockevent, rate,
                                        TIMER_SYNC_TICKS, 0xffffffff);
+        ret = setup_irq(irq, &sun5i_timer_irq);
+        if (ret)
+                pr_warn("failed to setup irq %d\n", irq);
 }
 CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
                       sun5i_timer_init);
diff --git a/drivers/cpuidle/cpuidle-mvebu-v7.c b/drivers/cpuidle/cpuidle-mvebu-v7.c
index 38e68618513a..980151f34707 100644
--- a/drivers/cpuidle/cpuidle-mvebu-v7.c
+++ b/drivers/cpuidle/cpuidle-mvebu-v7.c
@@ -37,11 +37,11 @@ static int mvebu_v7_enter_idle(struct cpuidle_device *dev,
                deepidle = true;
        ret = mvebu_v7_cpu_suspend(deepidle);
+        cpu_pm_exit();
        if (ret)
                return ret;
-        cpu_pm_exit();
        return index;
 }
@@ -50,17 +50,17 @@ static struct cpuidle_driver armadaxp_idle_driver = {
        .states[0]              = ARM_CPUIDLE_WFI_STATE,
        .states[1]              = {
                .enter                  = mvebu_v7_enter_idle,
-                .exit_latency           = 10,
+                .exit_latency           = 100,
                .power_usage            = 50,
-                .target_residency       = 100,
+                .target_residency       = 1000,
                .name                   = "MV CPU IDLE",
                .desc                   = "CPU power down",
        },
        .states[2]              = {
                .enter                  = mvebu_v7_enter_idle,
-                .exit_latency           = 100,
+                .exit_latency           = 1000,
                .power_usage            = 5,
-                .target_residency       = 1000,
+                .target_residency       = 10000,
                .flags                  = MVEBU_V7_FLAG_DEEP_IDLE,
                .name                   = "MV CPU DEEP IDLE",
                .desc                   = "CPU and L2 Fabric power down",
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index 4a5fd245014e..83aa55d6fa5d 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -97,6 +97,12 @@
 #define DRIVER_NAME     "pl08xdmac"
+#define PL80X_DMA_BUSWIDTHS \
+        BIT(DMA_SLAVE_BUSWIDTH_UNDEFINED) | \
+        BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
+        BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | \
+        BIT(DMA_SLAVE_BUSWIDTH_4_BYTES)
 static struct amba_driver pl08x_amba_driver;
 struct pl08x_driver_data;
@@ -2070,6 +2076,10 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
        pl08x->memcpy.device_pause = pl08x_pause;
        pl08x->memcpy.device_resume = pl08x_resume;
        pl08x->memcpy.device_terminate_all = pl08x_terminate_all;
+        pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM);
+        pl08x->memcpy.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
        /* Initialize slave engine */
        dma_cap_set(DMA_SLAVE, pl08x->slave.cap_mask);
@@ -2086,6 +2096,10 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
        pl08x->slave.device_pause = pl08x_pause;
        pl08x->slave.device_resume = pl08x_resume;
        pl08x->slave.device_terminate_all = pl08x_terminate_all;
+        pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->slave.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        pl08x->slave.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
        /* Get the platform data */
        pl08x->pd = dev_get_platdata(&adev->dev);
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 1e1a4c567542..0b4fc6fb48ce 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -238,93 +238,126 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
 }
 /*
- * atc_get_current_descriptors -
+ * atc_get_desc_by_cookie - get the descriptor of a cookie
- * locate the descriptor which equal to physical address in DSCR
+ * @atchan: the DMA channel
- * @atchan: the channel we want to start
+ * @cookie: the cookie to get the descriptor for
- * @dscr_addr: physical descriptor address in DSCR
 */
-static struct at_desc *atc_get_current_descriptors(struct at_dma_chan *atchan,
+static struct at_desc *atc_get_desc_by_cookie(struct at_dma_chan *atchan,
-                                                        u32 dscr_addr)
+                                                dma_cookie_t cookie)
 {
-        struct at_desc  *desc, *_desc, *child, *desc_cur = NULL;
+        struct at_desc *desc, *_desc;
-        list_for_each_entry_safe(desc, _desc, &atchan->active_list, desc_node) {
+        list_for_each_entry_safe(desc, _desc, &atchan->queue, desc_node) {
-                if (desc->lli.dscr == dscr_addr) {
+                if (desc->txd.cookie == cookie)
-                        desc_cur = desc;
+                        return desc;
-                        break;
+        }
-                }
-                list_for_each_entry(child, &desc->tx_list, desc_node) {
+        list_for_each_entry_safe(desc, _desc, &atchan->active_list, desc_node) {
-                        if (child->lli.dscr == dscr_addr) {
+                if (desc->txd.cookie == cookie)
-                                desc_cur = child;
+                        return desc;
-                                break;
-                        }
-                }
        }
-        return desc_cur;
+        return NULL;
 }
-/*
+/**
- * atc_get_bytes_left -
+ * atc_calc_bytes_left - calculates the number of bytes left according to the
- * Get the number of bytes residue in dma buffer,
+ * value read from CTRLA.
- * @chan: the channel we want to start
+ *
+ * @current_len: the number of bytes left before reading CTRLA
+ * @ctrla: the value of CTRLA
+ * @desc: the descriptor containing the transfer width
+ */
+static inline int atc_calc_bytes_left(int current_len, u32 ctrla,
+                                        struct at_desc *desc)
+{
+        return current_len - ((ctrla & ATC_BTSIZE_MAX) << desc->tx_width);
+}
+/**
+ * atc_calc_bytes_left_from_reg - calculates the number of bytes left according
+ * to the current value of CTRLA.
+ *
+ * @current_len: the number of bytes left before reading CTRLA
+ * @atchan: the channel to read CTRLA for
+ * @desc: the descriptor containing the transfer width
+ */
+static inline int atc_calc_bytes_left_from_reg(int current_len,
+                        struct at_dma_chan *atchan, struct at_desc *desc)
+{
+        u32 ctrla = channel_readl(atchan, CTRLA);
+        return atc_calc_bytes_left(current_len, ctrla, desc);
+}
+/**
+ * atc_get_bytes_left - get the number of bytes residue for a cookie
+ * @chan: DMA channel
+ * @cookie: transaction identifier to check status of
 */
-static int atc_get_bytes_left(struct dma_chan *chan)
+static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
 {
        struct at_dma_chan      *atchan = to_at_dma_chan(chan);
-        struct at_dma           *atdma = to_at_dma(chan->device);
-        int     chan_id = atchan->chan_common.chan_id;
        struct at_desc *desc_first = atc_first_active(atchan);
-        struct at_desc *desc_cur;
+        struct at_desc *desc;
-        int ret = 0, count = 0;
+        int ret;
+        u32 ctrla, dscr;
        /*
-         * Initialize necessary values in the first time.
+         * If the cookie doesn't match to the currently running transfer then
-         * remain_desc record remain desc length.
+         * we can return the total length of the associated DMA transfer,
+         * because it is still queued.
         */
-        if (atchan->remain_desc == 0)
+        desc = atc_get_desc_by_cookie(atchan, cookie);
-                /* First descriptor embedds the transaction length */
+        if (desc == NULL)
-                atchan->remain_desc = desc_first->len;
+                return -EINVAL;
+        else if (desc != desc_first)
+                return desc->total_len;
-        /*
+        /* cookie matches to the currently running transfer */
-         * This happens when current descriptor transfer complete.
+        ret = desc_first->total_len;
-         * The residual buffer size should reduce current descriptor length.
-         */
-        if (unlikely(test_bit(ATC_IS_BTC, &atchan->status))) {
-                clear_bit(ATC_IS_BTC, &atchan->status);
-                desc_cur = atc_get_current_descriptors(atchan,
-                                                channel_readl(atchan, DSCR));
-                if (!desc_cur) {
-                        ret = -EINVAL;
-                        goto out;
-                }
-                count = (desc_cur->lli.ctrla & ATC_BTSIZE_MAX)
+        if (desc_first->lli.dscr) {
-                        << desc_first->tx_width;
+                /* hardware linked list transfer */
-                if (atchan->remain_desc < count) {
-                        ret = -EINVAL;
+                /*
-                        goto out;
+                 * Calculate the residue by removing the length of the child
+                 * descriptors already transferred from the total length.
+                 * To get the current child descriptor we can use the value of
+                 * the channel's DSCR register and compare it against the value
+                 * of the hardware linked list structure of each child
+                 * descriptor.
+                 */
+                ctrla = channel_readl(atchan, CTRLA);
+                rmb(); /* ensure CTRLA is read before DSCR */
+                dscr = channel_readl(atchan, DSCR);
+                /* for the first descriptor we can be more accurate */
+                if (desc_first->lli.dscr == dscr)
+                        return atc_calc_bytes_left(ret, ctrla, desc_first);
+                ret -= desc_first->len;
+                list_for_each_entry(desc, &desc_first->tx_list, desc_node) {
+                        if (desc->lli.dscr == dscr)
+                                break;
+                        ret -= desc->len;
                }
-                atchan->remain_desc -= count;
-                ret = atchan->remain_desc;
-        } else {
                /*
-                 * Get residual bytes when current
+                 * For the last descriptor in the chain we can calculate
-                 * descriptor transfer in progress.
+                 * the remaining bytes using the channel's register.
+                 * Note that the transfer width of the first and last
+                 * descriptor may differ.
                 */
-                count = (channel_readl(atchan, CTRLA) & ATC_BTSIZE_MAX)
+                if (!desc->lli.dscr)
-                                << (desc_first->tx_width);
+                        ret = atc_calc_bytes_left_from_reg(ret, atchan, desc);
-                ret = atchan->remain_desc - count;
+        } else {
+                /* single transfer */
+                ret = atc_calc_bytes_left_from_reg(ret, atchan, desc_first);
        }
-        /*
-         * Check fifo empty.
-         */
-        if (!(dma_readl(atdma, CHSR) & AT_DMA_EMPT(chan_id)))
-                atc_issue_pending(chan);
-out:
        return ret;
 }
@@ -539,8 +572,6 @@ static irqreturn_t at_dma_interrupt(int irq, void *dev_id)
                                        /* Give information to tasklet */
                                        set_bit(ATC_IS_ERROR, &atchan->status);
                                }
-                                if (pending & AT_DMA_BTC(i))
-                                        set_bit(ATC_IS_BTC, &atchan->status);
                                tasklet_schedule(&atchan->tasklet);
                                ret = IRQ_HANDLED;
                        }
@@ -653,14 +684,18 @@ atc_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
                desc->lli.ctrlb = ctrlb;
                desc->txd.cookie = 0;
+                desc->len = xfer_count << src_width;
                atc_desc_chain(&first, &prev, desc);
        }
        /* First descriptor of the chain embedds additional information */
        first->txd.cookie = -EBUSY;
-        first->len = len;
+        first->total_len = len;
+        /* set transfer width for the calculation of the residue */
        first->tx_width = src_width;
+        prev->tx_width = src_width;
        /* set end-of-link to the last link descriptor of list*/
        set_desc_eol(desc);
@@ -752,6 +787,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                                        | ATC_SRC_WIDTH(mem_width)
                                        | len >> mem_width;
                        desc->lli.ctrlb = ctrlb;
+                        desc->len = len;
                        atc_desc_chain(&first, &prev, desc);
                        total_len += len;
@@ -792,6 +828,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                                        | ATC_DST_WIDTH(mem_width)
                                        | len >> reg_width;
                        desc->lli.ctrlb = ctrlb;
+                        desc->len = len;
                        atc_desc_chain(&first, &prev, desc);
                        total_len += len;
@@ -806,8 +843,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
        /* First descriptor of the chain embedds additional information */
        first->txd.cookie = -EBUSY;
-        first->len = total_len;
+        first->total_len = total_len;
+        /* set transfer width for the calculation of the residue */
        first->tx_width = reg_width;
+        prev->tx_width = reg_width;
        /* first link descriptor of list is responsible of flags */
        first->txd.flags = flags; /* client is in control of this ack */
@@ -872,6 +912,7 @@ atc_dma_cyclic_fill_desc(struct dma_chan *chan, struct at_desc *desc,
                                | ATC_FC_MEM2PER
                                | ATC_SIF(atchan->mem_if)
                                | ATC_DIF(atchan->per_if);
+                desc->len = period_len;
                break;
        case DMA_DEV_TO_MEM:
@@ -883,6 +924,7 @@ atc_dma_cyclic_fill_desc(struct dma_chan *chan, struct at_desc *desc,
                                | ATC_FC_PER2MEM
                                | ATC_SIF(atchan->per_if)
                                | ATC_DIF(atchan->mem_if);
+                desc->len = period_len;
                break;
        default:
@@ -964,7 +1006,7 @@ atc_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
        /* First descriptor of the chain embedds additional information */
        first->txd.cookie = -EBUSY;
-        first->len = buf_len;
+        first->total_len = buf_len;
        first->tx_width = reg_width;
        return &first->txd;
@@ -1118,7 +1160,7 @@ atc_tx_status(struct dma_chan *chan,
        spin_lock_irqsave(&atchan->lock, flags);
        /*  Get number of bytes left in the active transactions */
-        bytes = atc_get_bytes_left(chan);
+        bytes = atc_get_bytes_left(chan, cookie);
        spin_unlock_irqrestore(&atchan->lock, flags);
@@ -1214,7 +1256,6 @@ static int atc_alloc_chan_resources(struct dma_chan *chan)
        spin_lock_irqsave(&atchan->lock, flags);
        atchan->descs_allocated = i;
-        atchan->remain_desc = 0;
        list_splice(&tmp_list, &atchan->free_list);
        dma_cookie_init(chan);
        spin_unlock_irqrestore(&atchan->lock, flags);
@@ -1257,7 +1298,6 @@ static void atc_free_chan_resources(struct dma_chan *chan)
        list_splice_init(&atchan->free_list, &list);
        atchan->descs_allocated = 0;
        atchan->status = 0;
-        atchan->remain_desc = 0;
        dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
 }
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index d6bba6c636c2..2727ca560572 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -181,8 +181,9 @@ struct at_lli {
 * @at_lli: hardware lli structure
 * @txd: support for the async_tx api
 * @desc_node: node on the channed descriptors list
- * @len: total transaction bytecount
+ * @len: descriptor byte count
 * @tx_width: transfer width
+ * @total_len: total transaction byte count
 */
 struct at_desc {
        /* FIRST values the hardware uses */
@@ -194,6 +195,7 @@ struct at_desc {
        struct list_head                desc_node;
        size_t                          len;
        u32                             tx_width;
+        size_t                          total_len;
 };
 static inline struct at_desc *
@@ -213,7 +215,6 @@ txd_to_at_desc(struct dma_async_tx_descriptor *txd)
 enum atc_status {
        ATC_IS_ERROR = 0,
        ATC_IS_PAUSED = 1,
-        ATC_IS_BTC = 2,
        ATC_IS_CYCLIC = 24,
 };
@@ -231,7 +232,6 @@ enum atc_status {
 * @save_cfg: configuration register that is saved on suspend/resume cycle
 * @save_dscr: for cyclic operations, preserve next descriptor address in
 *             the cyclic list on suspend/resume cycle
- * @remain_desc: to save remain desc length
 * @dma_sconfig: configuration for slave transfers, passed via
 * .device_config
 * @lock: serializes enqueue/dequeue operations to descriptors lists
@@ -251,7 +251,6 @@ struct at_dma_chan {
        struct tasklet_struct   tasklet;
        u32                     save_cfg;
        u32                     save_dscr;
-        u32                     remain_desc;
        struct dma_slave_config dma_sconfig;
        spinlock_t              lock;
diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
index 6565a361e7e5..b2c3ae071429 100644
--- a/drivers/dma/dw/platform.c
+++ b/drivers/dma/dw/platform.c
@@ -26,6 +26,8 @@
 #include "internal.h"
+#define DRV_NAME        "dw_dmac"
 static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
                                        struct of_dma *ofdma)
 {
@@ -284,7 +286,7 @@ static struct platform_driver dw_driver = {
        .remove         = dw_remove,
        .shutdown       = dw_shutdown,
        .driver = {
-                .name   = "dw_dmac",
+                .name   = DRV_NAME,
                .pm     = &dw_dev_pm_ops,
                .of_match_table = of_match_ptr(dw_dma_of_id_table),
                .acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
@@ -305,3 +307,4 @@ module_exit(dw_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 18c0a131e4e4..66a0efb9651d 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -531,6 +531,10 @@ static int sdma_run_channel0(struct sdma_engine *sdma)
                dev_err(sdma->dev, "Timeout waiting for CH0 ready\n");
        }
+        /* Set bits of CONFIG register with dynamic context switching */
+        if (readl(sdma->regs + SDMA_H_CONFIG) == 0)
+                writel_relaxed(SDMA_H_CONFIG_CSM, sdma->regs + SDMA_H_CONFIG);
        return ret ? 0 : -ETIMEDOUT;
 }
@@ -1394,9 +1398,6 @@ static int sdma_init(struct sdma_engine *sdma)
        writel_relaxed(ccb_phys, sdma->regs + SDMA_H_C0PTR);
-        /* Set bits of CONFIG register with given context switching mode */
-        writel_relaxed(SDMA_H_CONFIG_CSM, sdma->regs + SDMA_H_CONFIG);
        /* Initializes channel's priorities */
        sdma_set_channel_priority(&sdma->channel[0], 7);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 910ff8ab9c9c..d8135adb2238 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -645,6 +645,7 @@ static int create_sdma_queue_nocpsch(struct device_queue_manager *dqm,
        pr_debug("     sdma queue id: %d\n", q->properties.sdma_queue_id);
        pr_debug("     sdma engine id: %d\n", q->properties.sdma_engine_id);
+        init_sdma_vm(dqm, q, qpd);
        retval = mqd->init_mqd(mqd, &q->mqd, &q->mqd_mem_obj,
                                &q->gart_mqd_addr, &q->properties);
        if (retval != 0) {
@@ -652,7 +653,14 @@ static int create_sdma_queue_nocpsch(struct device_queue_manager *dqm,
                return retval;
        }
-        init_sdma_vm(dqm, q, qpd);
+        retval = mqd->load_mqd(mqd, q->mqd, 0,
+                                0, NULL);
+        if (retval != 0) {
+                deallocate_sdma_queue(dqm, q->sdma_id);
+                mqd->uninit_mqd(mqd, q->mqd, q->mqd_mem_obj);
+                return retval;
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
index e415a2a9207e..c7d298e62c96 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -44,7 +44,7 @@ static bool initialize(struct kernel_queue *kq, struct kfd_dev *dev,
        BUG_ON(!kq || !dev);
        BUG_ON(type != KFD_QUEUE_TYPE_DIQ && type != KFD_QUEUE_TYPE_HIQ);
-        pr_debug("kfd: In func %s initializing queue type %d size %d\n",
+        pr_debug("amdkfd: In func %s initializing queue type %d size %d\n",
                        __func__, KFD_QUEUE_TYPE_HIQ, queue_size);
        nop.opcode = IT_NOP;
@@ -69,12 +69,16 @@ static bool initialize(struct kernel_queue *kq, struct kfd_dev *dev,
        prop.doorbell_ptr = kfd_get_kernel_doorbell(dev, &prop.doorbell_off);
-        if (prop.doorbell_ptr == NULL)
+        if (prop.doorbell_ptr == NULL) {
+                pr_err("amdkfd: error init doorbell");
                goto err_get_kernel_doorbell;
+        }
        retval = kfd_gtt_sa_allocate(dev, queue_size, &kq->pq);
-        if (retval != 0)
+        if (retval != 0) {
+                pr_err("amdkfd: error init pq queues size (%d)\n", queue_size);
                goto err_pq_allocate_vidmem;
+        }
        kq->pq_kernel_addr = kq->pq->cpu_ptr;
        kq->pq_gpu_addr = kq->pq->gpu_addr;
@@ -165,10 +169,8 @@ err_rptr_allocate_vidmem:
 err_eop_allocate_vidmem:
        kfd_gtt_sa_free(dev, kq->pq);
 err_pq_allocate_vidmem:
-        pr_err("kfd: error init pq\n");
        kfd_release_kernel_doorbell(dev, prop.doorbell_ptr);
 err_get_kernel_doorbell:
-        pr_err("kfd: error init doorbell");
        return false;
 }
@@ -187,6 +189,8 @@ static void uninitialize(struct kernel_queue *kq)
        else if (kq->queue->properties.type == KFD_QUEUE_TYPE_DIQ)
                kfd_gtt_sa_free(kq->dev, kq->fence_mem_obj);
+        kq->mqd->uninit_mqd(kq->mqd, kq->queue->mqd, kq->queue->mqd_mem_obj);
        kfd_gtt_sa_free(kq->dev, kq->rptr_mem);
        kfd_gtt_sa_free(kq->dev, kq->wptr_mem);
        kq->ops_asic_specific.uninitialize(kq);
@@ -211,7 +215,7 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
        queue_address = (unsigned int *)kq->pq_kernel_addr;
        queue_size_dwords = kq->queue->properties.queue_size / sizeof(uint32_t);
-        pr_debug("kfd: In func %s\nrptr: %d\nwptr: %d\nqueue_address 0x%p\n",
+        pr_debug("amdkfd: In func %s\nrptr: %d\nwptr: %d\nqueue_address 0x%p\n",
                        __func__, rptr, wptr, queue_address);
        available_size = (rptr - 1 - wptr + queue_size_dwords) %
@@ -296,7 +300,7 @@ struct kernel_queue *kernel_queue_init(struct kfd_dev *dev,
        }
        if (kq->ops.initialize(kq, dev, type, KFD_KERNEL_QUEUE_SIZE) == false) {
-                pr_err("kfd: failed to init kernel queue\n");
+                pr_err("amdkfd: failed to init kernel queue\n");
                kfree(kq);
                return NULL;
        }
@@ -319,7 +323,7 @@ static __attribute__((unused)) void test_kq(struct kfd_dev *dev)
        BUG_ON(!dev);
-        pr_err("kfd: starting kernel queue test\n");
+        pr_err("amdkfd: starting kernel queue test\n");
        kq = kernel_queue_init(dev, KFD_QUEUE_TYPE_HIQ);
        BUG_ON(!kq);
@@ -330,7 +334,7 @@ static __attribute__((unused)) void test_kq(struct kfd_dev *dev)
                buffer[i] = kq->nop_packet;
        kq->ops.submit_packet(kq);
-        pr_err("kfd: ending kernel queue test\n");
+        pr_err("amdkfd: ending kernel queue test\n");
 }
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 6b6b07ff720b..f6d04c7b5115 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -43,9 +43,10 @@
 #include "drm_crtc_internal.h"
 #include "drm_internal.h"
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
+static struct drm_framebuffer *
-                                                        struct drm_mode_fb_cmd2 *r,
+internal_framebuffer_create(struct drm_device *dev,
-                                                        struct drm_file *file_priv);
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv);
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)                          \
@@ -2908,13 +2909,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
         */
        if (req->flags & DRM_MODE_CURSOR_BO) {
                if (req->handle) {
-                        fb = add_framebuffer_internal(dev, &fbreq, file_priv);
+                        fb = internal_framebuffer_create(dev, &fbreq, file_priv);
                        if (IS_ERR(fb)) {
                                DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
                                return PTR_ERR(fb);
                        }
-                        drm_framebuffer_reference(fb);
                } else {
                        fb = NULL;
                }
@@ -3267,9 +3266,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
        return 0;
 }
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
+static struct drm_framebuffer *
-                                                        struct drm_mode_fb_cmd2 *r,
+internal_framebuffer_create(struct drm_device *dev,
-                                                        struct drm_file *file_priv)
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv)
 {
        struct drm_mode_config *config = &dev->mode_config;
        struct drm_framebuffer *fb;
@@ -3301,12 +3301,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
                return fb;
        }
-        mutex_lock(&file_priv->fbs_lock);
-        r->fb_id = fb->base.id;
-        list_add(&fb->filp_head, &file_priv->fbs);
-        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-        mutex_unlock(&file_priv->fbs_lock);
        return fb;
 }
@@ -3328,15 +3322,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
 int drm_mode_addfb2(struct drm_device *dev,
                    void *data, struct drm_file *file_priv)
 {
+        struct drm_mode_fb_cmd2 *r = data;
        struct drm_framebuffer *fb;
        if (!drm_core_check_feature(dev, DRIVER_MODESET))
                return -EINVAL;
-        fb = add_framebuffer_internal(dev, data, file_priv);
+        fb = internal_framebuffer_create(dev, r, file_priv);
        if (IS_ERR(fb))
                return PTR_ERR(fb);
+        /* Transfer ownership to the filp for reaping on close */
+        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+        mutex_lock(&file_priv->fbs_lock);
+        r->fb_id = fb->base.id;
+        list_add(&fb->filp_head, &file_priv->fbs);
+        mutex_unlock(&file_priv->fbs_lock);
        return 0;
 }
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 9a5b68717ec8..379ab4555756 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -733,10 +733,14 @@ static bool check_txmsg_state(struct drm_dp_mst_topology_mgr *mgr,
                              struct drm_dp_sideband_msg_tx *txmsg)
 {
        bool ret;
-        mutex_lock(&mgr->qlock);
+        /*
+         * All updates to txmsg->state are protected by mgr->qlock, and the two
+         * cases we check here are terminal states. For those the barriers
+         * provided by the wake_up/wait_event pair are enough.
+         */
        ret = (txmsg->state == DRM_DP_SIDEBAND_TX_RX ||
               txmsg->state == DRM_DP_SIDEBAND_TX_TIMEOUT);
-        mutex_unlock(&mgr->qlock);
        return ret;
 }
@@ -1363,12 +1367,13 @@ static int process_single_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
        return 0;
 }
-/* must be called holding qlock */
 static void process_single_down_tx_qlock(struct drm_dp_mst_topology_mgr *mgr)
 {
        struct drm_dp_sideband_msg_tx *txmsg;
        int ret;
+        WARN_ON(!mutex_is_locked(&mgr->qlock));
        /* construct a chunk from the first msg in the tx_msg queue */
        if (list_empty(&mgr->tx_msg_downq)) {
                mgr->tx_down_in_progress = false;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 7fc6f8bd4821..1134526286c8 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -403,7 +403,7 @@ static int check_free_hole(u64 start, u64 end, u64 size, unsigned alignment)
                unsigned rem;
                rem = do_div(tmp, alignment);
-                if (tmp)
+                if (rem)
                        start += alignment - rem;
        }
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index a5e74612100e..0a6780367d28 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -50,7 +50,7 @@ config DRM_EXYNOS_DSI
 config DRM_EXYNOS_DP
        bool "EXYNOS DRM DP driver support"
-        depends on (DRM_EXYNOS_FIMD || DRM_EXYNOS7DECON) && ARCH_EXYNOS && (DRM_PTN3460=n || DRM_PTN3460=y || DRM_PTN3460=DRM_EXYNOS)
+        depends on (DRM_EXYNOS_FIMD || DRM_EXYNOS7_DECON) && ARCH_EXYNOS && (DRM_PTN3460=n || DRM_PTN3460=y || DRM_PTN3460=DRM_EXYNOS)
        default DRM_EXYNOS
        select DRM_PANEL
        help
diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
index 63f02e2380ae..970046199608 100644
--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
@@ -888,8 +888,8 @@ static int decon_probe(struct platform_device *pdev)
        of_node_put(i80_if_timings);
        ctx->regs = of_iomap(dev->of_node, 0);
-        if (IS_ERR(ctx->regs)) {
+        if (!ctx->regs) {
-                ret = PTR_ERR(ctx->regs);
+                ret = -ENOMEM;
                goto err_del_component;
        }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
deleted file mode 100644
index ba9b3d5ed672..000000000000
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Copyright (c) 2011 Samsung Electronics Co., Ltd.
- * Authors:
- *      Inki Dae <inki.dae@samsung.com>
- *      Joonyoung Shim <jy0922.shim@samsung.com>
- *      Seung-Woo Kim <sw0312.kim@samsung.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#include <drm/drmP.h>
-#include <drm/drm_crtc_helper.h>
-#include <drm/exynos_drm.h>
-#include "exynos_drm_drv.h"
-#include "exynos_drm_encoder.h"
-#include "exynos_drm_connector.h"
-#define to_exynos_connector(x)  container_of(x, struct exynos_drm_connector,\
-                                drm_connector)
-struct exynos_drm_connector {
-        struct drm_connector            drm_connector;
-        uint32_t                        encoder_id;
-        struct exynos_drm_display       *display;
-};
-static int exynos_drm_connector_get_modes(struct drm_connector *connector)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        struct edid *edid = NULL;
-        unsigned int count = 0;
-        int ret;
-        /*
-         * if get_edid() exists then get_edid() callback of hdmi side
-         * is called to get edid data through i2c interface else
-         * get timing from the FIMD driver(display controller).
-         *
-         * P.S. in case of lcd panel, count is always 1 if success
-         * because lcd panel has only one mode.
-         */
-        if (display->ops->get_edid) {
-                edid = display->ops->get_edid(display, connector);
-                if (IS_ERR_OR_NULL(edid)) {
-                        ret = PTR_ERR(edid);
-                        edid = NULL;
-                        DRM_ERROR("Panel operation get_edid failed %d\n", ret);
-                        goto out;
-                }
-                count = drm_add_edid_modes(connector, edid);
-                if (!count) {
-                        DRM_ERROR("Add edid modes failed %d\n", count);
-                        goto out;
-                }
-                drm_mode_connector_update_edid_property(connector, edid);
-        } else {
-                struct exynos_drm_panel_info *panel;
-                struct drm_display_mode *mode = drm_mode_create(connector->dev);
-                if (!mode) {
-                        DRM_ERROR("failed to create a new display mode.\n");
-                        return 0;
-                }
-                if (display->ops->get_panel)
-                        panel = display->ops->get_panel(display);
-                else {
-                        drm_mode_destroy(connector->dev, mode);
-                        return 0;
-                }
-                drm_display_mode_from_videomode(&panel->vm, mode);
-                mode->width_mm = panel->width_mm;
-                mode->height_mm = panel->height_mm;
-                connector->display_info.width_mm = mode->width_mm;
-                connector->display_info.height_mm = mode->height_mm;
-                mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
-                drm_mode_set_name(mode);
-                drm_mode_probed_add(connector, mode);
-                count = 1;
-        }
-out:
-        kfree(edid);
-        return count;
-}
-static int exynos_drm_connector_mode_valid(struct drm_connector *connector,
-                                            struct drm_display_mode *mode)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        int ret = MODE_BAD;
-        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (display->ops->check_mode)
-                if (!display->ops->check_mode(display, mode))
-                        ret = MODE_OK;
-        return ret;
-}
-static struct drm_encoder *exynos_drm_best_encoder(
-                struct drm_connector *connector)
-{
-        struct drm_device *dev = connector->dev;
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        return drm_encoder_find(dev, exynos_connector->encoder_id);
-}
-static struct drm_connector_helper_funcs exynos_connector_helper_funcs = {
-        .get_modes      = exynos_drm_connector_get_modes,
-        .mode_valid     = exynos_drm_connector_mode_valid,
-        .best_encoder   = exynos_drm_best_encoder,
-};
-static int exynos_drm_connector_fill_modes(struct drm_connector *connector,
-                                unsigned int max_width, unsigned int max_height)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        unsigned int width, height;
-        width = max_width;
-        height = max_height;
-        /*
-         * if specific driver want to find desired_mode using maxmum
-         * resolution then get max width and height from that driver.
-         */
-        if (display->ops->get_max_resol)
-                display->ops->get_max_resol(display, &width, &height);
-        return drm_helper_probe_single_connector_modes(connector, width,
-                                                        height);
-}
-/* get detection status of display device. */
-static enum drm_connector_status
-exynos_drm_connector_detect(struct drm_connector *connector, bool force)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        enum drm_connector_status status = connector_status_disconnected;
-        if (display->ops->is_connected) {
-                if (display->ops->is_connected(display))
-                        status = connector_status_connected;
-                else
-                        status = connector_status_disconnected;
-        }
-        return status;
-}
-static void exynos_drm_connector_destroy(struct drm_connector *connector)
-{
-        struct exynos_drm_connector *exynos_connector =
-                to_exynos_connector(connector);
-        drm_connector_unregister(connector);
-        drm_connector_cleanup(connector);
-        kfree(exynos_connector);
-}
-static struct drm_connector_funcs exynos_connector_funcs = {
-        .dpms           = drm_helper_connector_dpms,
-        .fill_modes     = exynos_drm_connector_fill_modes,
-        .detect         = exynos_drm_connector_detect,
-        .destroy        = exynos_drm_connector_destroy,
-};
-struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
-                                                   struct drm_encoder *encoder)
-{
-        struct exynos_drm_connector *exynos_connector;
-        struct exynos_drm_display *display = exynos_drm_get_display(encoder);
-        struct drm_connector *connector;
-        int type;
-        int err;
-        exynos_connector = kzalloc(sizeof(*exynos_connector), GFP_KERNEL);
-        if (!exynos_connector)
-                return NULL;
-        connector = &exynos_connector->drm_connector;
-        switch (display->type) {
-        case EXYNOS_DISPLAY_TYPE_HDMI:
-                type = DRM_MODE_CONNECTOR_HDMIA;
-                connector->interlace_allowed = true;
-                connector->polled = DRM_CONNECTOR_POLL_HPD;
-                break;
-        case EXYNOS_DISPLAY_TYPE_VIDI:
-                type = DRM_MODE_CONNECTOR_VIRTUAL;
-                connector->polled = DRM_CONNECTOR_POLL_HPD;
-                break;
-        default:
-                type = DRM_MODE_CONNECTOR_Unknown;
-                break;
-        }
-        drm_connector_init(dev, connector, &exynos_connector_funcs, type);
-        drm_connector_helper_add(connector, &exynos_connector_helper_funcs);
-        err = drm_connector_register(connector);
-        if (err)
-                goto err_connector;
-        exynos_connector->encoder_id = encoder->base.id;
-        exynos_connector->display = display;
-        connector->dpms = DRM_MODE_DPMS_OFF;
-        connector->encoder = encoder;
-        err = drm_mode_connector_attach_encoder(connector, encoder);
-        if (err) {
-                DRM_ERROR("failed to attach a connector to a encoder\n");
-                goto err_sysfs;
-        }
-        DRM_DEBUG_KMS("connector has been created\n");
-        return connector;
-err_sysfs:
-        drm_connector_unregister(connector);
-err_connector:
-        drm_connector_cleanup(connector);
-        kfree(exynos_connector);
-        return NULL;
-}
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.h b/drivers/gpu/drm/exynos/exynos_drm_connector.h
deleted file mode 100644
index 4eb20d78379a..000000000000
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (c) 2011 Samsung Electronics Co., Ltd.
- * Authors:
- *      Inki Dae <inki.dae@samsung.com>
- *      Joonyoung Shim <jy0922.shim@samsung.com>
- *      Seung-Woo Kim <sw0312.kim@samsung.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#ifndef _EXYNOS_DRM_CONNECTOR_H_
-#define _EXYNOS_DRM_CONNECTOR_H_
-struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
-                                                   struct drm_encoder *encoder);
-#endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 925fc69af1a0..c300e22da8ac 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -284,14 +284,9 @@ static void fimd_clear_channel(struct fimd_context *ctx)
        }
 }
-static int fimd_ctx_initialize(struct fimd_context *ctx,
+static int fimd_iommu_attach_devices(struct fimd_context *ctx,
                        struct drm_device *drm_dev)
 {
-        struct exynos_drm_private *priv;
-        priv = drm_dev->dev_private;
-        ctx->drm_dev = drm_dev;
-        ctx->pipe = priv->pipe++;
        /* attach this sub driver to iommu mapping if supported. */
        if (is_drm_iommu_supported(ctx->drm_dev)) {
@@ -313,7 +308,7 @@ static int fimd_ctx_initialize(struct fimd_context *ctx,
        return 0;
 }
-static void fimd_ctx_remove(struct fimd_context *ctx)
+static void fimd_iommu_detach_devices(struct fimd_context *ctx)
 {
        /* detach this sub driver from iommu mapping if supported. */
        if (is_drm_iommu_supported(ctx->drm_dev))
@@ -1056,25 +1051,23 @@ static int fimd_bind(struct device *dev, struct device *master, void *data)
 {
        struct fimd_context *ctx = dev_get_drvdata(dev);
        struct drm_device *drm_dev = data;
+        struct exynos_drm_private *priv = drm_dev->dev_private;
        int ret;
-        ret = fimd_ctx_initialize(ctx, drm_dev);
+        ctx->drm_dev = drm_dev;
-        if (ret) {
+        ctx->pipe = priv->pipe++;
-                DRM_ERROR("fimd_ctx_initialize failed.\n");
-                return ret;
-        }
        ctx->crtc = exynos_drm_crtc_create(drm_dev, ctx->pipe,
                                           EXYNOS_DISPLAY_TYPE_LCD,
                                           &fimd_crtc_ops, ctx);
-        if (IS_ERR(ctx->crtc)) {
-                fimd_ctx_remove(ctx);
-                return PTR_ERR(ctx->crtc);
-        }
        if (ctx->display)
                exynos_drm_create_enc_conn(drm_dev, ctx->display);
+        ret = fimd_iommu_attach_devices(ctx, drm_dev);
+        if (ret)
+                return ret;
        return 0;
 }
@@ -1086,10 +1079,10 @@ static void fimd_unbind(struct device *dev, struct device *master,
        fimd_dpms(ctx->crtc, DRM_MODE_DPMS_OFF);
+        fimd_iommu_detach_devices(ctx);
        if (ctx->display)
                exynos_dpi_remove(ctx->display);
-        fimd_ctx_remove(ctx);
 }
 static const struct component_ops fimd_component_ops = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index a5616872eee7..8ad5b7294eb4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -175,7 +175,7 @@ static int exynos_disable_plane(struct drm_plane *plane)
        struct exynos_drm_plane *exynos_plane = to_exynos_plane(plane);
        struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(plane->crtc);
-        if (exynos_crtc->ops->win_disable)
+        if (exynos_crtc && exynos_crtc->ops->win_disable)
                exynos_crtc->ops->win_disable(exynos_crtc,
                                              exynos_plane->zpos);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index e5daad5f75fb..5b205863b659 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2936,9 +2936,9 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        req = obj->last_read_req;
        /* Do this after OLR check to make sure we make forward progress polling
-         * on this IOCTL with a timeout <=0 (like busy ioctl)
+         * on this IOCTL with a timeout == 0 (like busy ioctl)
         */
-        if (args->timeout_ns <= 0) {
+        if (args->timeout_ns == 0) {
                ret = -ETIME;
                goto out;
        }
@@ -2948,7 +2948,8 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        i915_gem_request_reference(req);
        mutex_unlock(&dev->struct_mutex);
-        ret = __i915_wait_request(req, reset_counter, true, &args->timeout_ns,
+        ret = __i915_wait_request(req, reset_counter, true,
+                                  args->timeout_ns > 0 ? &args->timeout_ns : NULL,
                                  file->driver_priv);
        mutex_lock(&dev->struct_mutex);
        i915_gem_request_unreference(req);
@@ -4792,6 +4793,9 @@ i915_gem_init_hw(struct drm_device *dev)
        if (INTEL_INFO(dev)->gen < 6 && !intel_enable_gtt())
                return -EIO;
+        /* Double layer security blanket, see i915_gem_init() */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
        if (dev_priv->ellc_size)
                I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
@@ -4824,7 +4828,7 @@ i915_gem_init_hw(struct drm_device *dev)
        for_each_ring(ring, dev_priv, i) {
                ret = ring->init_hw(ring);
                if (ret)
-                        return ret;
+                        goto out;
        }
        for (i = 0; i < NUM_L3_SLICES(dev); i++)
@@ -4841,9 +4845,11 @@ i915_gem_init_hw(struct drm_device *dev)
                DRM_ERROR("Context enable failed %d\n", ret);
                i915_gem_cleanup_ringbuffer(dev);
-                return ret;
+                goto out;
        }
+out:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
        return ret;
 }
@@ -4877,6 +4883,14 @@ int i915_gem_init(struct drm_device *dev)
                dev_priv->gt.stop_ring = intel_logical_ring_stop;
        }
+        /* This is just a security blanket to placate dragons.
+         * On some systems, we very sporadically observe that the first TLBs
+         * used by the CS may be stale, despite us poking the TLB reset. If
+         * we hold the forcewake during initialisation these problems
+         * just magically go away.
+         */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
        ret = i915_gem_init_userptr(dev);
        if (ret)
                goto out_unlock;
@@ -4903,6 +4917,7 @@ int i915_gem_init(struct drm_device *dev)
        }
 out_unlock:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
        mutex_unlock(&dev->struct_mutex);
        return ret;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e730789b53b7..6d22128d97b1 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -37,6 +37,7 @@
 #include <drm/i915_drm.h>
 #include "i915_drv.h"
 #include "i915_trace.h"
+#include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_dp_helper.h>
 #include <drm/drm_crtc_helper.h>
@@ -2416,6 +2417,14 @@ out_unref_obj:
        return false;
 }
+/* Update plane->state->fb to match plane->fb after driver-internal updates */
+static void
+update_state_fb(struct drm_plane *plane)
+{
+        if (plane->fb != plane->state->fb)
+                drm_atomic_set_fb_for_plane(plane->state, plane->fb);
+}
 static void
 intel_find_plane_obj(struct intel_crtc *intel_crtc,
                     struct intel_initial_plane_config *plane_config)
@@ -2462,6 +2471,8 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
                        break;
                }
        }
+        update_state_fb(intel_crtc->base.primary);
 }
 static void i9xx_update_primary_plane(struct drm_crtc *crtc,
@@ -6602,6 +6613,10 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
+        val = I915_READ(DSPCNTR(plane));
+        if (!(val & DISPLAY_PLANE_ENABLE))
+                return;
        intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
        if (!intel_fb) {
                DRM_DEBUG_KMS("failed to alloc fb\n");
@@ -6610,8 +6625,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
        fb = &intel_fb->base;
-        val = I915_READ(DSPCNTR(plane));
        if (INTEL_INFO(dev)->gen >= 4)
                if (val & DISPPLANE_TILED)
                        plane_config->tiling = I915_TILING_X;
@@ -6650,6 +6663,7 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
                      plane_config->size);
        crtc->base.primary->fb = fb;
+        update_state_fb(crtc->base.primary);
 }
 static void chv_crtc_clock_get(struct intel_crtc *crtc,
@@ -7643,6 +7657,9 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
        fb = &intel_fb->base;
        val = I915_READ(PLANE_CTL(pipe, 0));
+        if (!(val & PLANE_CTL_ENABLE))
+                goto error;
        if (val & PLANE_CTL_TILED_MASK)
                plane_config->tiling = I915_TILING_X;
@@ -7687,6 +7704,7 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
                      plane_config->size);
        crtc->base.primary->fb = fb;
+        update_state_fb(crtc->base.primary);
        return;
 error:
@@ -7730,6 +7748,10 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
+        val = I915_READ(DSPCNTR(pipe));
+        if (!(val & DISPLAY_PLANE_ENABLE))
+                return;
        intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
        if (!intel_fb) {
                DRM_DEBUG_KMS("failed to alloc fb\n");
@@ -7738,8 +7760,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
        fb = &intel_fb->base;
-        val = I915_READ(DSPCNTR(pipe));
        if (INTEL_INFO(dev)->gen >= 4)
                if (val & DISPPLANE_TILED)
                        plane_config->tiling = I915_TILING_X;
@@ -7778,6 +7798,7 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
                      plane_config->size);
        crtc->base.primary->fb = fb;
+        update_state_fb(crtc->base.primary);
 }
 static bool ironlake_get_pipe_config(struct intel_crtc *crtc,
@@ -9716,7 +9737,7 @@ void intel_check_page_flip(struct drm_device *dev, int pipe)
        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        WARN_ON(!in_irq());
+        WARN_ON(!in_interrupt());
        if (crtc == NULL)
                return;
@@ -9816,6 +9837,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        drm_gem_object_reference(&obj->base);
        crtc->primary->fb = fb;
+        update_state_fb(crtc->primary);
        work->pending_flip_obj = obj;
@@ -9884,6 +9906,7 @@ cleanup_unpin:
 cleanup_pending:
        atomic_dec(&intel_crtc->unpin_work_count);
        crtc->primary->fb = old_fb;
+        update_state_fb(crtc->primary);
        drm_gem_object_unreference(&work->old_fb_obj->base);
        drm_gem_object_unreference(&obj->base);
        mutex_unlock(&dev->struct_mutex);
@@ -13718,6 +13741,7 @@ void intel_modeset_gem_init(struct drm_device *dev)
                                  to_intel_crtc(c)->pipe);
                        drm_framebuffer_unreference(c->primary->fb);
                        c->primary->fb = NULL;
+                        update_state_fb(c->primary);
                }
        }
        mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index c47a3baa53d5..4e8fb891d4ea 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -1048,8 +1048,14 @@ static void intel_uncore_fw_domains_init(struct drm_device *dev)
                /* We need to init first for ECOBUS access and then
                 * determine later if we want to reinit, in case of MT access is
-                 * not working
+                 * not working. In this stage we don't know which flavour this
+                 * ivb is, so it is better to reset also the gen6 fw registers
+                 * before the ecobus check.
                 */
+                __raw_i915_write32(dev_priv, FORCEWAKE, 0);
+                __raw_posting_read(dev_priv, ECOBUS);
                fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER,
                               FORCEWAKE_MT, FORCEWAKE_MT_ACK);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 29bd539af183..6efa8f38ff54 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -340,11 +340,13 @@ nvkm_devobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
                /* switch mmio to cpu's native endianness */
 #ifndef __BIG_ENDIAN
-                if (ioread32_native(map + 0x000004) != 0x00000000)
+                if (ioread32_native(map + 0x000004) != 0x00000000) {
 #else
-                if (ioread32_native(map + 0x000004) == 0x00000000)
+                if (ioread32_native(map + 0x000004) == 0x00000000) {
 #endif
                        iowrite32_native(0x01000001, map + 0x000004);
+                        ioread32_native(map);
+                }
                /* read boot0 and strapping information */
                boot0 = ioread32_native(map + 0x000000);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
index 539561ed3281..108d048da764 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
@@ -142,6 +142,49 @@ gm100_identify(struct nvkm_device *device)
                device->oclass[NVDEV_ENGINE_MSPPP  ] = &gf100_msppp_oclass;
 #endif
                break;
+        case 0x126:
+                device->cname = "GM206";
+                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nvkm_bios_oclass;
+                device->oclass[NVDEV_SUBDEV_GPIO   ] =  gk104_gpio_oclass;
+                device->oclass[NVDEV_SUBDEV_I2C    ] =  gm204_i2c_oclass;
+                device->oclass[NVDEV_SUBDEV_FUSE   ] = &gm107_fuse_oclass;
+#if 0
+                /* looks to be some non-trivial changes */
+                device->oclass[NVDEV_SUBDEV_CLK    ] = &gk104_clk_oclass;
+                /* priv ring says no to 0x10eb14 writes */
+                device->oclass[NVDEV_SUBDEV_THERM  ] = &gm107_therm_oclass;
+#endif
+                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
+                device->oclass[NVDEV_SUBDEV_DEVINIT] =  gm204_devinit_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  gk20a_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_BUS    ] =  gf100_bus_oclass;
+                device->oclass[NVDEV_SUBDEV_TIMER  ] = &gk20a_timer_oclass;
+                device->oclass[NVDEV_SUBDEV_FB     ] =  gm107_fb_oclass;
+                device->oclass[NVDEV_SUBDEV_LTC    ] =  gm107_ltc_oclass;
+                device->oclass[NVDEV_SUBDEV_IBUS   ] = &gk104_ibus_oclass;
+                device->oclass[NVDEV_SUBDEV_INSTMEM] =  nv50_instmem_oclass;
+                device->oclass[NVDEV_SUBDEV_MMU    ] = &gf100_mmu_oclass;
+                device->oclass[NVDEV_SUBDEV_BAR    ] = &gf100_bar_oclass;
+                device->oclass[NVDEV_SUBDEV_PMU    ] =  gk208_pmu_oclass;
+#if 0
+                device->oclass[NVDEV_SUBDEV_VOLT   ] = &nv40_volt_oclass;
+#endif
+                device->oclass[NVDEV_ENGINE_DMAOBJ ] =  gf110_dmaeng_oclass;
+#if 0
+                device->oclass[NVDEV_ENGINE_FIFO   ] =  gk208_fifo_oclass;
+                device->oclass[NVDEV_ENGINE_SW     ] =  gf100_sw_oclass;
+                device->oclass[NVDEV_ENGINE_GR     ] =  gm107_gr_oclass;
+#endif
+                device->oclass[NVDEV_ENGINE_DISP   ] =  gm204_disp_oclass;
+#if 0
+                device->oclass[NVDEV_ENGINE_CE0    ] = &gm204_ce0_oclass;
+                device->oclass[NVDEV_ENGINE_CE1    ] = &gm204_ce1_oclass;
+                device->oclass[NVDEV_ENGINE_CE2    ] = &gm204_ce2_oclass;
+                device->oclass[NVDEV_ENGINE_MSVLD  ] = &gk104_msvld_oclass;
+                device->oclass[NVDEV_ENGINE_MSPDEC ] = &gk104_mspdec_oclass;
+                device->oclass[NVDEV_ENGINE_MSPPP  ] = &gf100_msppp_oclass;
+#endif
+                break;
        default:
                nv_fatal(device, "unknown Maxwell chipset\n");
                return -EINVAL;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
index b038b6eb51db..043e4296084c 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
@@ -502,72 +502,57 @@ nv04_fifo_intr(struct nvkm_subdev *subdev)
 {
        struct nvkm_device *device = nv_device(subdev);
        struct nv04_fifo_priv *priv = (void *)subdev;
-        uint32_t status, reassign;
+        u32 mask = nv_rd32(priv, NV03_PFIFO_INTR_EN_0);
-        int cnt = 0;
+        u32 stat = nv_rd32(priv, NV03_PFIFO_INTR_0) & mask;
+        u32 reassign, chid, get, sem;
        reassign = nv_rd32(priv, NV03_PFIFO_CACHES) & 1;
-        while ((status = nv_rd32(priv, NV03_PFIFO_INTR_0)) && (cnt++ < 100)) {
+        nv_wr32(priv, NV03_PFIFO_CACHES, 0);
-                uint32_t chid, get;
-                nv_wr32(priv, NV03_PFIFO_CACHES, 0);
-                chid = nv_rd32(priv, NV03_PFIFO_CACHE1_PUSH1) & priv->base.max;
-                get  = nv_rd32(priv, NV03_PFIFO_CACHE1_GET);
-                if (status & NV_PFIFO_INTR_CACHE_ERROR) {
+        chid = nv_rd32(priv, NV03_PFIFO_CACHE1_PUSH1) & priv->base.max;
-                        nv04_fifo_cache_error(device, priv, chid, get);
+        get  = nv_rd32(priv, NV03_PFIFO_CACHE1_GET);
-                        status &= ~NV_PFIFO_INTR_CACHE_ERROR;
-                }
-                if (status & NV_PFIFO_INTR_DMA_PUSHER) {
+        if (stat & NV_PFIFO_INTR_CACHE_ERROR) {
-                        nv04_fifo_dma_pusher(device, priv, chid);
+                nv04_fifo_cache_error(device, priv, chid, get);
-                        status &= ~NV_PFIFO_INTR_DMA_PUSHER;
+                stat &= ~NV_PFIFO_INTR_CACHE_ERROR;
-                }
+        }
-                if (status & NV_PFIFO_INTR_SEMAPHORE) {
+        if (stat & NV_PFIFO_INTR_DMA_PUSHER) {
-                        uint32_t sem;
+                nv04_fifo_dma_pusher(device, priv, chid);
+                stat &= ~NV_PFIFO_INTR_DMA_PUSHER;
+        }
-                        status &= ~NV_PFIFO_INTR_SEMAPHORE;
+        if (stat & NV_PFIFO_INTR_SEMAPHORE) {
-                        nv_wr32(priv, NV03_PFIFO_INTR_0,
+                stat &= ~NV_PFIFO_INTR_SEMAPHORE;
-                                NV_PFIFO_INTR_SEMAPHORE);
+                nv_wr32(priv, NV03_PFIFO_INTR_0, NV_PFIFO_INTR_SEMAPHORE);
-                        sem = nv_rd32(priv, NV10_PFIFO_CACHE1_SEMAPHORE);
+                sem = nv_rd32(priv, NV10_PFIFO_CACHE1_SEMAPHORE);
-                        nv_wr32(priv, NV10_PFIFO_CACHE1_SEMAPHORE, sem | 0x1);
+                nv_wr32(priv, NV10_PFIFO_CACHE1_SEMAPHORE, sem | 0x1);
-                        nv_wr32(priv, NV03_PFIFO_CACHE1_GET, get + 4);
+                nv_wr32(priv, NV03_PFIFO_CACHE1_GET, get + 4);
-                        nv_wr32(priv, NV04_PFIFO_CACHE1_PULL0, 1);
+                nv_wr32(priv, NV04_PFIFO_CACHE1_PULL0, 1);
-                }
+        }
-                if (device->card_type == NV_50) {
+        if (device->card_type == NV_50) {
-                        if (status & 0x00000010) {
+                if (stat & 0x00000010) {
-                                status &= ~0x00000010;
+                        stat &= ~0x00000010;
-                                nv_wr32(priv, 0x002100, 0x00000010);
+                        nv_wr32(priv, 0x002100, 0x00000010);
-                        }
-                        if (status & 0x40000000) {
-                                nv_wr32(priv, 0x002100, 0x40000000);
-                                nvkm_fifo_uevent(&priv->base);
-                                status &= ~0x40000000;
-                        }
                }
-                if (status) {
+                if (stat & 0x40000000) {
-                        nv_warn(priv, "unknown intr 0x%08x, ch %d\n",
+                        nv_wr32(priv, 0x002100, 0x40000000);
-                                status, chid);
+                        nvkm_fifo_uevent(&priv->base);
-                        nv_wr32(priv, NV03_PFIFO_INTR_0, status);
+                        stat &= ~0x40000000;
-                        status = 0;
                }
-                nv_wr32(priv, NV03_PFIFO_CACHES, reassign);
        }
-        if (status) {
+        if (stat) {
-                nv_error(priv, "still angry after %d spins, halt\n", cnt);
+                nv_warn(priv, "unknown intr 0x%08x\n", stat);
-                nv_wr32(priv, 0x002140, 0);
+                nv_mask(priv, NV03_PFIFO_INTR_EN_0, stat, 0x00000000);
-                nv_wr32(priv, 0x000140, 0);
+                nv_wr32(priv, NV03_PFIFO_INTR_0, stat);
        }
-        nv_wr32(priv, 0x000100, 0x00000100);
+        nv_wr32(priv, NV03_PFIFO_CACHES, reassign);
 }
 static int
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
index 2e7ec389eea7..57e2c5b13123 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
@@ -1032,9 +1032,9 @@ gf100_grctx_generate_bundle(struct gf100_grctx *info)
        const int s = 8;
        const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
        mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
        mmio_refn(info, 0x418808, 0x00000000, s, b);
-        mmio_refn(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s));
 }
 void
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
index b52300d8861a..5e9454ba158f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
@@ -851,9 +851,9 @@ gk104_grctx_generate_bundle(struct gf100_grctx *info)
        const int s = 8;
        const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
        mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
        mmio_refn(info, 0x418808, 0x00000000, s, b);
-        mmio_refn(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s));
        mmio_wr32(info, 0x4064c8, (state_limit << 16) | token_limit);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
index 956f4dce960c..b2fae6e389e2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
@@ -871,9 +871,9 @@ gm107_grctx_generate_bundle(struct gf100_grctx *info)
        const int s = 8;
        const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
        mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
        mmio_refn(info, 0x418e24, 0x00000000, s, b);
-        mmio_refn(info, 0x418e28, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x418e28, 0x80000000 | (impl->bundle_size >> s));
        mmio_wr32(info, 0x4064c8, (state_limit << 16) | token_limit);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
index d1a89b2bd5c1..c4e1f085ee10 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
@@ -74,7 +74,11 @@ dcb_i2c_parse(struct nvkm_bios *bios, u8 idx, struct dcb_i2c_entry *info)
        u16 ent = dcb_i2c_entry(bios, idx, &ver, &len);
        if (ent) {
                if (ver >= 0x41) {
-                        if (!(nv_ro32(bios, ent) & 0x80000000))
+                        u32 ent_value = nv_ro32(bios, ent);
+                        u8 i2c_port = (ent_value >> 27) & 0x1f;
+                        u8 dpaux_port = (ent_value >> 22) & 0x1f;
+                        /* value 0x1f means unused according to DCB 4.x spec */
+                        if (i2c_port == 0x1f && dpaux_port == 0x1f)
                                info->type = DCB_I2C_UNUSED;
                        else
                                info->type = DCB_I2C_PMGR;
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index d13d1b5a859f..df09ca7c4889 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(struct radeon_fence *fence)
        return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
 }
+struct radeon_wait_cb {
+        struct fence_cb base;
+        struct task_struct *task;
+};
+static void
+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
+{
+        struct radeon_wait_cb *wait =
+                container_of(cb, struct radeon_wait_cb, base);
+        wake_up_process(wait->task);
+}
 static signed long radeon_fence_default_wait(struct fence *f, bool intr,
                                             signed long t)
 {
        struct radeon_fence *fence = to_radeon_fence(f);
        struct radeon_device *rdev = fence->rdev;
-        bool signaled;
+        struct radeon_wait_cb cb;
-        fence_enable_sw_signaling(&fence->base);
+        cb.task = current;
-        /*
+        if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
-         * This function has to return -EDEADLK, but cannot hold
+                return t;
-         * exclusive_lock during the wait because some callers
-         * may already hold it. This means checking needs_reset without
+        while (t > 0) {
-         * lock, and not fiddling with any gpu internals.
+                if (intr)
-         *
+                        set_current_state(TASK_INTERRUPTIBLE);
-         * The callback installed with fence_enable_sw_signaling will
+                else
-         * run before our wait_event_*timeout call, so we will see
+                        set_current_state(TASK_UNINTERRUPTIBLE);
-         * both the signaled fence and the changes to needs_reset.
-         */
+                /*
+                 * radeon_test_signaled must be called after
+                 * set_current_state to prevent a race with wake_up_process
+                 */
+                if (radeon_test_signaled(fence))
+                        break;
+                if (rdev->needs_reset) {
+                        t = -EDEADLK;
+                        break;
+                }
+                t = schedule_timeout(t);
+                if (t > 0 && intr && signal_pending(current))
+                        t = -ERESTARTSYS;
+        }
+        __set_current_state(TASK_RUNNING);
+        fence_remove_callback(f, &cb.base);
-        if (intr)
-                t = wait_event_interruptible_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-        else
-                t = wait_event_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-        if (t > 0 && !signaled)
-                return -EDEADLK;
        return t;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
index 061eaa9c19c7..122eb5693ba1 100644
--- a/drivers/gpu/drm/radeon/radeon_kfd.c
+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
@@ -153,7 +153,7 @@ void radeon_kfd_device_init(struct radeon_device *rdev)
                        .compute_vmid_bitmap = 0xFF00,
                        .first_compute_pipe = 1,
-                        .compute_pipe_count = 8 - 1,
+                        .compute_pipe_count = 4 - 1,
                };
                radeon_doorbell_get_kfd_info(rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 43e09942823e..318165d4855c 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -173,17 +173,6 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
                else
                        rbo->placements[i].lpfn = 0;
        }
-        /*
-         * Use two-ended allocation depending on the buffer size to
-         * improve fragmentation quality.
-         * 512kb was measured as the most optimal number.
-         */
-        if (rbo->tbo.mem.size > 512 * 1024) {
-                for (i = 0; i < c; i++) {
-                        rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
-                }
-        }
 }
 int radeon_bo_create(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index e088e5558da0..a7fb2735d4a9 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -7130,8 +7130,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
        if (!vclk || !dclk) {
-                /* keep the Bypass mode, put PLL to sleep */
+                /* keep the Bypass mode */
-                WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
                return 0;
        }
@@ -7147,8 +7146,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
        /* set VCO_MODE to 1 */
        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
-        /* toggle UPLL_SLEEP to 1 then back to 0 */
+        /* disable sleep mode */
-        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
        WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
        /* deassert UPLL_RESET */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 6c6b655defcf..e13b9cbc304e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                goto out_err1;
        }
-        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-                             (dev_priv->vram_size >> PAGE_SHIFT));
-        if (unlikely(ret != 0)) {
-                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-                goto out_err2;
-        }
-        dev_priv->has_gmr = true;
-        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-                                         VMW_PL_GMR) != 0) {
-                DRM_INFO("No GMR memory available. "
-                         "Graphics memory resources are very limited.\n");
-                dev_priv->has_gmr = false;
-        }
-        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-                dev_priv->has_mob = true;
-                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-                                   VMW_PL_MOB) != 0) {
-                        DRM_INFO("No MOB memory available. "
-                                 "3D will be disabled.\n");
-                        dev_priv->has_mob = false;
-                }
-        }
        dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
                                               dev_priv->mmio_size);
@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                goto out_no_fman;
        }
+        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+                             (dev_priv->vram_size >> PAGE_SHIFT));
+        if (unlikely(ret != 0)) {
+                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+                goto out_no_vram;
+        }
+        dev_priv->has_gmr = true;
+        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
+            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+                                         VMW_PL_GMR) != 0) {
+                DRM_INFO("No GMR memory available. "
+                         "Graphics memory resources are very limited.\n");
+                dev_priv->has_gmr = false;
+        }
+        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
+                dev_priv->has_mob = true;
+                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
+                                   VMW_PL_MOB) != 0) {
+                        DRM_INFO("No MOB memory available. "
+                                 "3D will be disabled.\n");
+                        dev_priv->has_mob = false;
+                }
+        }
        vmw_kms_save_vga(dev_priv);
        /* Start kms and overlay systems, needs fifo. */
@@ -838,6 +839,12 @@ out_no_fifo:
        vmw_kms_close(dev_priv);
 out_no_kms:
        vmw_kms_restore_vga(dev_priv);
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+out_no_vram:
        vmw_fence_manager_takedown(dev_priv->fman);
 out_no_fman:
        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
@@ -853,12 +860,6 @@ out_err4:
        iounmap(dev_priv->mmio_virt);
 out_err3:
        arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-out_err2:
        (void)ttm_bo_device_release(&dev_priv->bdev);
 out_err1:
        vmw_ttm_global_release(dev_priv);
@@ -887,6 +888,13 @@ static int vmw_driver_unload(struct drm_device *dev)
        }
        vmw_kms_close(dev_priv);
        vmw_overlay_close(dev_priv);
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
        vmw_fence_manager_takedown(dev_priv->fman);
        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
                drm_irq_uninstall(dev_priv->dev);
@@ -898,11 +906,6 @@ static int vmw_driver_unload(struct drm_device *dev)
        ttm_object_device_release(&dev_priv->tdev);
        iounmap(dev_priv->mmio_virt);
        arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
        (void)ttm_bo_device_release(&dev_priv->bdev);
        vmw_ttm_global_release(dev_priv);
@@ -1235,6 +1238,7 @@ static void vmw_remove(struct pci_dev *pdev)
 {
        struct drm_device *dev = pci_get_drvdata(pdev);
+        pci_disable_device(pdev);
        drm_put_dev(dev);
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 33176d05db35..654c8daeb5ab 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -890,7 +890,8 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
        ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
        if (unlikely(ret != 0)) {
                DRM_ERROR("Could not find or use MOB buffer.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
        }
        bo = &vmw_bo->base;
@@ -914,7 +915,7 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
 out_no_reloc:
        vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
        return ret;
 }
@@ -951,7 +952,8 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
        ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
        if (unlikely(ret != 0)) {
                DRM_ERROR("Could not find or use GMR region.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
        }
        bo = &vmw_bo->base;
@@ -974,7 +976,7 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
 out_no_reloc:
        vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
        return ret;
 }
@@ -2780,13 +2782,11 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
                                  NULL, arg->command_size, arg->throttle_us,
                                  (void __user *)(unsigned long)arg->fence_rep,
                                  NULL);
+        ttm_read_unlock(&dev_priv->reservation_sem);
        if (unlikely(ret != 0))
-                goto out_unlock;
+                return ret;
        vmw_kms_cursor_post_execbuf(dev_priv);
-out_unlock:
+        return 0;
-        ttm_read_unlock(&dev_priv->reservation_sem);
-        return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 8725b79e7847..07cda8cbbddb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
        int i;
        struct drm_mode_config *mode_config = &dev->mode_config;
-        ret = ttm_read_lock(&dev_priv->reservation_sem, true);
-        if (unlikely(ret != 0))
-                return ret;
        if (!arg->num_outputs) {
                struct drm_vmw_rect def_rect = {0, 0, 800, 600};
                vmw_du_update_layout(dev_priv, 1, &def_rect);
-                goto out_unlock;
+                return 0;
        }
        rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
        rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
                        GFP_KERNEL);
-        if (unlikely(!rects)) {
+        if (unlikely(!rects))
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto out_unlock;
-        }
        user_rects = (void __user *)(unsigned long)arg->rects;
        ret = copy_from_user(rects, user_rects, rects_size);
@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
 out_free:
        kfree(rects);
-out_unlock:
-        ttm_read_unlock(&dev_priv->reservation_sem);
        return ret;
 }
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 7c669c328c4c..56ce8c2b5530 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1959,6 +1959,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 204312bfab2c..9c4786759f16 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -586,6 +586,7 @@
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
 #define USB_DEVICE_ID_LOGITECH_T651     0xb00c
+#define USB_DEVICE_ID_LOGITECH_C077     0xc007
 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
@@ -898,6 +899,7 @@
 #define USB_VENDOR_ID_TIVO              0x150a
 #define USB_DEVICE_ID_TIVO_SLIDE_BT     0x1200
 #define USB_DEVICE_ID_TIVO_SLIDE        0x1201
+#define USB_DEVICE_ID_TIVO_SLIDE_PRO    0x1203
 #define USB_VENDOR_ID_TOPSEED           0x0766
 #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204
diff --git a/drivers/hid/hid-tivo.c b/drivers/hid/hid-tivo.c
index d790d8d71f7f..d98696927453 100644
--- a/drivers/hid/hid-tivo.c
+++ b/drivers/hid/hid-tivo.c
@@ -64,6 +64,7 @@ static const struct hid_device_id tivo_devices[] = {
        /* TiVo Slide Bluetooth remote, pairs with a Broadcom dongle */
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, tivo_devices);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 9be99a67bfe2..a82127753461 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -78,6 +78,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 046351cf17f3..bbe32d66e500 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -551,9 +551,13 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
           (features->type == CINTIQ && !(data[1] & 0x40)))
                return 1;
-        if (features->quirks & WACOM_QUIRK_MULTI_INPUT)
+        if (wacom->shared) {
                wacom->shared->stylus_in_proximity = true;
+                if (wacom->shared->touch_down)
+                        return 1;
+        }
        /* in Range while exiting */
        if (((data[1] & 0xfe) == 0x20) && wacom->reporting_data) {
                input_report_key(input, BTN_TOUCH, 0);
@@ -1043,27 +1047,28 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
        struct input_dev *input = wacom->input;
        unsigned char *data = wacom->data;
        int i;
-        int current_num_contacts = 0;
+        int current_num_contacts = data[61];
        int contacts_to_send = 0;
        int num_contacts_left = 4; /* maximum contacts per packet */
        int byte_per_packet = WACOM_BYTES_PER_24HDT_PACKET;
        int y_offset = 2;
+        static int contact_with_no_pen_down_count = 0;
        if (wacom->features.type == WACOM_27QHDT) {
                current_num_contacts = data[63];
                num_contacts_left = 10;
                byte_per_packet = WACOM_BYTES_PER_QHDTHID_PACKET;
                y_offset = 0;
-        } else {
-                current_num_contacts = data[61];
        }
        /*
         * First packet resets the counter since only the first
         * packet in series will have non-zero current_num_contacts.
         */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
        contacts_to_send = min(num_contacts_left, wacom->num_contacts_left);
@@ -1096,15 +1101,16 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
                                input_report_abs(input, ABS_MT_WIDTH_MINOR, min(w, h));
                                input_report_abs(input, ABS_MT_ORIENTATION, w > h);
                        }
+                        contact_with_no_pen_down_count++;
                }
        }
        input_mt_report_pointer_emulation(input, true);
        wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left <= 0)
+        if (wacom->num_contacts_left <= 0) {
                wacom->num_contacts_left = 0;
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+        }
        return 1;
 }
@@ -1116,6 +1122,7 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
        int current_num_contacts = data[2];
        int contacts_to_send = 0;
        int x_offset = 0;
+        static int contact_with_no_pen_down_count = 0;
        /* MTTPC does not support Height and Width */
        if (wacom->features.type == MTTPC || wacom->features.type == MTTPC_B)
@@ -1125,8 +1132,10 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
         * First packet resets the counter since only the first
         * packet in series will have non-zero current_num_contacts.
         */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
        /* There are at most 5 contacts per packet */
        contacts_to_send = min(5, wacom->num_contacts_left);
@@ -1147,15 +1156,16 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
                        int y = get_unaligned_le16(&data[offset + x_offset + 9]);
                        input_report_abs(input, ABS_MT_POSITION_X, x);
                        input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                }
        }
        input_mt_report_pointer_emulation(input, true);
        wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left < 0)
+        if (wacom->num_contacts_left <= 0) {
                wacom->num_contacts_left = 0;
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+        }
        return 1;
 }
@@ -1193,29 +1203,25 @@ static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 {
        unsigned char *data = wacom->data;
        struct input_dev *input = wacom->input;
-        bool prox;
+        bool prox = !wacom->shared->stylus_in_proximity;
        int x = 0, y = 0;
        if (wacom->features.touch_max > 1 || len > WACOM_PKGLEN_TPC2FG)
                return 0;
-        if (!wacom->shared->stylus_in_proximity) {
+        if (len == WACOM_PKGLEN_TPC1FG) {
-                if (len == WACOM_PKGLEN_TPC1FG) {
+                prox = prox && (data[0] & 0x01);
-                        prox = data[0] & 0x01;
+                x = get_unaligned_le16(&data[1]);
-                        x = get_unaligned_le16(&data[1]);
+                y = get_unaligned_le16(&data[3]);
-                        y = get_unaligned_le16(&data[3]);
+        } else if (len == WACOM_PKGLEN_TPC1FG_B) {
-                } else if (len == WACOM_PKGLEN_TPC1FG_B) {
+                prox = prox && (data[2] & 0x01);
-                        prox = data[2] & 0x01;
+                x = get_unaligned_le16(&data[3]);
-                        x = get_unaligned_le16(&data[3]);
+                y = get_unaligned_le16(&data[5]);
-                        y = get_unaligned_le16(&data[5]);
+        } else {
-                } else {
+                prox = prox && (data[1] & 0x01);
-                        prox = data[1] & 0x01;
+                x = le16_to_cpup((__le16 *)&data[2]);
-                        x = le16_to_cpup((__le16 *)&data[2]);
+                y = le16_to_cpup((__le16 *)&data[4]);
-                        y = le16_to_cpup((__le16 *)&data[4]);
+        }
-                }
-        } else
-                /* force touch out when pen is in prox */
-                prox = 0;
        if (prox) {
                input_report_abs(input, ABS_X, x);
@@ -1613,6 +1619,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
        struct input_dev *pad_input = wacom->pad_input;
        unsigned char *data = wacom->data;
        int i;
+        int contact_with_no_pen_down_count = 0;
        if (data[0] != 0x02)
            return 0;
@@ -1640,6 +1647,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
                        }
                        input_report_abs(input, ABS_MT_POSITION_X, x);
                        input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                }
        }
@@ -1649,11 +1657,12 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
        input_report_key(pad_input, BTN_FORWARD, (data[1] & 0x04) != 0);
        input_report_key(pad_input, BTN_BACK, (data[1] & 0x02) != 0);
        input_report_key(pad_input, BTN_RIGHT, (data[1] & 0x01) != 0);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
        return 1;
 }
-static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
+static int wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data, int last_touch_count)
 {
        struct wacom_features *features = &wacom->features;
        struct input_dev *input = wacom->input;
@@ -1661,7 +1670,7 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
        int slot = input_mt_get_slot_by_key(input, data[0]);
        if (slot < 0)
-                return;
+                return 0;
        touch = touch && !wacom->shared->stylus_in_proximity;
@@ -1693,7 +1702,9 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
                input_report_abs(input, ABS_MT_POSITION_Y, y);
                input_report_abs(input, ABS_MT_TOUCH_MAJOR, width);
                input_report_abs(input, ABS_MT_TOUCH_MINOR, height);
+                last_touch_count++;
        }
+        return last_touch_count;
 }
 static void wacom_bpt3_button_msg(struct wacom_wac *wacom, unsigned char *data)
@@ -1718,6 +1729,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
        unsigned char *data = wacom->data;
        int count = data[1] & 0x07;
        int i;
+        int contact_with_no_pen_down_count = 0;
        if (data[0] != 0x02)
            return 0;
@@ -1728,12 +1740,15 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
                int msg_id = data[offset];
                if (msg_id >= 2 && msg_id <= 17)
-                        wacom_bpt3_touch_msg(wacom, data + offset);
+                        contact_with_no_pen_down_count = 
+                            wacom_bpt3_touch_msg(wacom, data + offset,
+                                                 contact_with_no_pen_down_count);
                else if (msg_id == 128)
                        wacom_bpt3_button_msg(wacom, data + offset);
        }
        input_mt_report_pointer_emulation(input, true);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
        return 1;
 }
@@ -1759,6 +1774,9 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
                return 0;
        }
+        if (wacom->shared->touch_down)
+                return 0;
        prox = (data[1] & 0x20) == 0x20;
        /*
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 210cf4874cb7..edf274cabe81 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -679,9 +679,6 @@ static int i2c_device_remove(struct device *dev)
                status = driver->remove(client);
        }
-        if (dev->of_node)
-                irq_dispose_mapping(client->irq);
        dev_pm_domain_detach(&client->dev, true);
        return status;
 }
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 1793aea4a7d2..6eb738ca6d2f 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -1793,11 +1793,11 @@ static void idetape_setup(ide_drive_t *drive, idetape_tape_t *tape, int minor)
        tape->best_dsc_rw_freq = clamp_t(unsigned long, t, IDETAPE_DSC_RW_MIN,
                                         IDETAPE_DSC_RW_MAX);
        printk(KERN_INFO "ide-tape: %s <-> %s: %dKBps, %d*%dkB buffer, "
-                "%lums tDSC%s\n",
+                "%ums tDSC%s\n",
                drive->name, tape->name, *(u16 *)&tape->caps[14],
                (*(u16 *)&tape->caps[16] * 512) / tape->buffer_size,
                tape->buffer_size / 1024,
-                tape->best_dsc_rw_freq * 1000 / HZ,
+                jiffies_to_msecs(tape->best_dsc_rw_freq),
                (drive->dev_flags & IDE_DFLAG_USING_DMA) ? ", DMA" : "");
        ide_proc_register_driver(drive, tape->driver);
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index c7619716c31d..59040265e361 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -64,6 +64,14 @@ enum {
 #define GUID_TBL_BLK_NUM_ENTRIES 8
 #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
+/* Counters should be saturate once they reach their maximum value */
+#define ASSIGN_32BIT_COUNTER(counter, value) do {\
+        if ((value) > U32_MAX)                   \
+                counter = cpu_to_be32(U32_MAX); \
+        else                                     \
+                counter = cpu_to_be32(value);    \
+} while (0)
 struct mlx4_mad_rcv_buf {
        struct ib_grh grh;
        u8 payload[256];
@@ -806,10 +814,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
 static void edit_counter(struct mlx4_counter *cnt,
                                        struct ib_pma_portcounters *pma_cnt)
 {
-        pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
-        pma_cnt->port_rcv_data  = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
+                             (be64_to_cpu(cnt->tx_bytes) >> 2));
-        pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
-        pma_cnt->port_rcv_packets  = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
+                             (be64_to_cpu(cnt->rx_bytes) >> 2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
+                             be64_to_cpu(cnt->tx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
+                             be64_to_cpu(cnt->rx_frames));
 }
 static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ac6e2b710ea6..b972c0b41799 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2697,8 +2697,12 @@ static void handle_bonded_port_state_event(struct work_struct *work)
        spin_lock_bh(&ibdev->iboe.lock);
        for (i = 0; i < MLX4_MAX_PORTS; ++i) {
                struct net_device *curr_netdev = ibdev->iboe.netdevs[i];
+                enum ib_port_state curr_port_state;
-                enum ib_port_state curr_port_state =
+                if (!curr_netdev)
+                        continue;
+                curr_port_state =
                        (netif_running(curr_netdev) &&
                         netif_carrier_ok(curr_netdev)) ?
                        IB_PORT_ACTIVE : IB_PORT_DOWN;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index f2cceb6493a0..dda605836546 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -67,9 +67,6 @@
 #define X_MAX_POSITIVE 8176
 #define Y_MAX_POSITIVE 8176
-/* maximum ABS_MT_POSITION displacement (in mm) */
-#define DMAX 10
 /*****************************************************************************
 *      Stuff we need even when we do not want native Synaptics support
 ****************************************************************************/
@@ -123,32 +120,41 @@ void synaptics_reset(struct psmouse *psmouse)
 static bool cr48_profile_sensor;
+#define ANY_BOARD_ID 0
 struct min_max_quirk {
        const char * const *pnp_ids;
+        struct {
+                unsigned long int min, max;
+        } board_id;
        int x_min, x_max, y_min, y_max;
 };
 static const struct min_max_quirk min_max_pnpid_table[] = {
        {
                (const char * const []){"LEN0033", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                1024, 5052, 2258, 4832
        },
        {
-                (const char * const []){"LEN0035", "LEN0042", NULL},
+                (const char * const []){"LEN0042", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                1232, 5710, 1156, 4696
        },
        {
                (const char * const []){"LEN0034", "LEN0036", "LEN0037",
                                        "LEN0039", "LEN2002", "LEN2004",
                                        NULL},
+                {ANY_BOARD_ID, 2961},
                1024, 5112, 2024, 4832
        },
        {
                (const char * const []){"LEN2001", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                1024, 5022, 2508, 4832
        },
        {
                (const char * const []){"LEN2006", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                1264, 5675, 1171, 4688
        },
        { }
@@ -175,9 +181,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
        "LEN0041",
        "LEN0042", /* Yoga */
        "LEN0045",
-        "LEN0046",
        "LEN0047",
-        "LEN0048",
        "LEN0049",
        "LEN2000",
        "LEN2001", /* Edge E431 */
@@ -235,18 +239,39 @@ static int synaptics_model_id(struct psmouse *psmouse)
        return 0;
 }
+static int synaptics_more_extended_queries(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        unsigned char buf[3];
+        if (synaptics_send_cmd(psmouse, SYN_QUE_MEXT_CAPAB_10, buf))
+                return -1;
+        priv->ext_cap_10 = (buf[0]<<16) | (buf[1]<<8) | buf[2];
+        return 0;
+}
 /*
- * Read the board id from the touchpad
+ * Read the board id and the "More Extended Queries" from the touchpad
 * The board id is encoded in the "QUERY MODES" response
 */
-static int synaptics_board_id(struct psmouse *psmouse)
+static int synaptics_query_modes(struct psmouse *psmouse)
 {
        struct synaptics_data *priv = psmouse->private;
        unsigned char bid[3];
+        /* firmwares prior 7.5 have no board_id encoded */
+        if (SYN_ID_FULL(priv->identity) < 0x705)
+                return 0;
        if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
                return -1;
        priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
+        if (SYN_MEXT_CAP_BIT(bid[0]))
+                return synaptics_more_extended_queries(psmouse);
        return 0;
 }
@@ -346,7 +371,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
 {
        struct synaptics_data *priv = psmouse->private;
        unsigned char resp[3];
-        int i;
        if (SYN_ID_MAJOR(priv->identity) < 4)
                return 0;
@@ -358,17 +382,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
                }
        }
-        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
-                if (psmouse_matches_pnp_id(psmouse,
-                                           min_max_pnpid_table[i].pnp_ids)) {
-                        priv->x_min = min_max_pnpid_table[i].x_min;
-                        priv->x_max = min_max_pnpid_table[i].x_max;
-                        priv->y_min = min_max_pnpid_table[i].y_min;
-                        priv->y_max = min_max_pnpid_table[i].y_max;
-                        return 0;
-                }
-        }
        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
            SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
@@ -377,23 +390,69 @@ static int synaptics_resolution(struct psmouse *psmouse)
                } else {
                        priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                        priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried max coordinates: x [..%d], y [..%d]\n",
+                                     priv->x_max, priv->y_max);
                }
        }
-        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
+        if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
-            SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
+            (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
+             /*
+              * Firmware v8.1 does not report proper number of extended
+              * capabilities, but has been proven to report correct min
+              * coordinates.
+              */
+             SYN_ID_FULL(priv->identity) == 0x801)) {
                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
                        psmouse_warn(psmouse,
                                     "device claims to have min coordinates query, but I'm not able to read it.\n");
                } else {
                        priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                        priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried min coordinates: x [%d..], y [%d..]\n",
+                                     priv->x_min, priv->y_min);
                }
        }
        return 0;
 }
+/*
+ * Apply quirk(s) if the hardware matches
+ */
+static void synaptics_apply_quirks(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        int i;
+        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+                if (!psmouse_matches_pnp_id(psmouse,
+                                            min_max_pnpid_table[i].pnp_ids))
+                        continue;
+                if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
+                    priv->board_id < min_max_pnpid_table[i].board_id.min)
+                        continue;
+                if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
+                    priv->board_id > min_max_pnpid_table[i].board_id.max)
+                        continue;
+                priv->x_min = min_max_pnpid_table[i].x_min;
+                priv->x_max = min_max_pnpid_table[i].x_max;
+                priv->y_min = min_max_pnpid_table[i].y_min;
+                priv->y_max = min_max_pnpid_table[i].y_max;
+                psmouse_info(psmouse,
+                             "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
+                             priv->x_min, priv->x_max,
+                             priv->y_min, priv->y_max);
+                break;
+        }
+}
 static int synaptics_query_hardware(struct psmouse *psmouse)
 {
        if (synaptics_identify(psmouse))
@@ -402,13 +461,15 @@ static int synaptics_query_hardware(struct psmouse *psmouse)
                return -1;
        if (synaptics_firmware_id(psmouse))
                return -1;
-        if (synaptics_board_id(psmouse))
+        if (synaptics_query_modes(psmouse))
                return -1;
        if (synaptics_capability(psmouse))
                return -1;
        if (synaptics_resolution(psmouse))
                return -1;
+        synaptics_apply_quirks(psmouse);
        return 0;
 }
@@ -516,18 +577,22 @@ static int synaptics_is_pt_packet(unsigned char *buf)
        return (buf[0] & 0xFC) == 0x84 && (buf[3] & 0xCC) == 0xC4;
 }
-static void synaptics_pass_pt_packet(struct serio *ptport, unsigned char *packet)
+static void synaptics_pass_pt_packet(struct psmouse *psmouse,
+                                     struct serio *ptport,
+                                     unsigned char *packet)
 {
+        struct synaptics_data *priv = psmouse->private;
        struct psmouse *child = serio_get_drvdata(ptport);
        if (child && child->state == PSMOUSE_ACTIVATED) {
-                serio_interrupt(ptport, packet[1], 0);
+                serio_interrupt(ptport, packet[1] | priv->pt_buttons, 0);
                serio_interrupt(ptport, packet[4], 0);
                serio_interrupt(ptport, packet[5], 0);
                if (child->pktsize == 4)
                        serio_interrupt(ptport, packet[2], 0);
-        } else
+        } else {
                serio_interrupt(ptport, packet[1], 0);
+        }
 }
 static void synaptics_pt_activate(struct psmouse *psmouse)
@@ -605,6 +670,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
        }
 }
+static void synaptics_parse_ext_buttons(const unsigned char buf[],
+                                        struct synaptics_data *priv,
+                                        struct synaptics_hw_state *hw)
+{
+        unsigned int ext_bits =
+                (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
+        hw->ext_buttons = buf[4] & ext_mask;
+        hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
+}
 static bool is_forcepad;
 static int synaptics_parse_hw_state(const unsigned char buf[],
@@ -691,28 +768,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
                        hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
                }
-                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
                    ((buf[0] ^ buf[3]) & 0x02)) {
-                        switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+                        synaptics_parse_ext_buttons(buf, priv, hw);
-                        default:
-                                /*
-                                 * if nExtBtn is greater than 8 it should be
-                                 * considered invalid and treated as 0
-                                 */
-                                break;
-                        case 8:
-                                hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
-                        case 6:
-                                hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
-                        case 4:
-                                hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
-                        case 2:
-                                hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
-                        }
                }
        } else {
                hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
@@ -774,12 +832,54 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
        }
 }
+static void synaptics_report_ext_buttons(struct psmouse *psmouse,
+                                         const struct synaptics_hw_state *hw)
+{
+        struct input_dev *dev = psmouse->dev;
+        struct synaptics_data *priv = psmouse->private;
+        int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        char buf[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+        int i;
+        if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
+                return;
+        /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
+        if (SYN_ID_FULL(priv->identity) == 0x801 &&
+            !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
+                return;
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10)) {
+                for (i = 0; i < ext_bits; i++) {
+                        input_report_key(dev, BTN_0 + 2 * i,
+                                hw->ext_buttons & (1 << i));
+                        input_report_key(dev, BTN_1 + 2 * i,
+                                hw->ext_buttons & (1 << (i + ext_bits)));
+                }
+                return;
+        }
+        /*
+         * This generation of touchpads has the trackstick buttons
+         * physically wired to the touchpad. Re-route them through
+         * the pass-through interface.
+         */
+        if (!priv->pt_port)
+                return;
+        /* The trackstick expects at most 3 buttons */
+        priv->pt_buttons = SYN_CAP_EXT_BUTTON_STICK_L(hw->ext_buttons)      |
+                           SYN_CAP_EXT_BUTTON_STICK_R(hw->ext_buttons) << 1 |
+                           SYN_CAP_EXT_BUTTON_STICK_M(hw->ext_buttons) << 2;
+        synaptics_pass_pt_packet(psmouse, priv->pt_port, buf);
+}
 static void synaptics_report_buttons(struct psmouse *psmouse,
                                     const struct synaptics_hw_state *hw)
 {
        struct input_dev *dev = psmouse->dev;
        struct synaptics_data *priv = psmouse->private;
-        int i;
        input_report_key(dev, BTN_LEFT, hw->left);
        input_report_key(dev, BTN_RIGHT, hw->right);
@@ -792,8 +892,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
                input_report_key(dev, BTN_BACK, hw->down);
        }
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+        synaptics_report_ext_buttons(psmouse, hw);
-                input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
 }
 static void synaptics_report_mt_data(struct psmouse *psmouse,
@@ -813,7 +912,7 @@ static void synaptics_report_mt_data(struct psmouse *psmouse,
                pos[i].y = synaptics_invert_y(hw[i]->y);
        }
-        input_mt_assign_slots(dev, slot, pos, nsemi, DMAX * priv->x_res);
+        input_mt_assign_slots(dev, slot, pos, nsemi, 0);
        for (i = 0; i < nsemi; i++) {
                input_mt_slot(dev, slot[i]);
@@ -1014,7 +1113,8 @@ static psmouse_ret_t synaptics_process_byte(struct psmouse *psmouse)
                if (SYN_CAP_PASS_THROUGH(priv->capabilities) &&
                    synaptics_is_pt_packet(psmouse->packet)) {
                        if (priv->pt_port)
-                                synaptics_pass_pt_packet(priv->pt_port, psmouse->packet);
+                                synaptics_pass_pt_packet(psmouse, priv->pt_port,
+                                                         psmouse->packet);
                } else
                        synaptics_process_packet(psmouse);
@@ -1116,8 +1216,9 @@ static void set_input_params(struct psmouse *psmouse,
                __set_bit(BTN_BACK, dev->keybit);
        }
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
-                __set_bit(BTN_0 + i, dev->keybit);
+                for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+                        __set_bit(BTN_0 + i, dev->keybit);
        __clear_bit(EV_REL, dev->evbit);
        __clear_bit(REL_X, dev->relbit);
@@ -1125,7 +1226,8 @@ static void set_input_params(struct psmouse *psmouse,
        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
-                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
+                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
+                    !SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
                        __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
                /* Clickpads report only left button */
                __clear_bit(BTN_RIGHT, dev->keybit);
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index aedc3299b14e..ee4bd0d12b26 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -22,6 +22,7 @@
 #define SYN_QUE_EXT_CAPAB_0C            0x0c
 #define SYN_QUE_EXT_MAX_COORDS          0x0d
 #define SYN_QUE_EXT_MIN_COORDS          0x0f
+#define SYN_QUE_MEXT_CAPAB_10           0x10
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -53,6 +54,7 @@
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_MEXT_CAP_BIT(m)             ((m) & (1 << 1))
 /*
 * The following describes response for the 0x0c query.
@@ -89,6 +91,30 @@
 #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
 #define SYN_CAP_IMAGE_SENSOR(ex0c)      ((ex0c) & 0x000800)
+/*
+ * The following descibes response for the 0x10 query.
+ *
+ * byte mask    name                    meaning
+ * ---- ----    -------                 ------------
+ * 1    0x01    ext buttons are stick   buttons exported in the extended
+ *                                      capability are actually meant to be used
+ *                                      by the tracktick (pass-through).
+ * 1    0x02    SecurePad               the touchpad is a SecurePad, so it
+ *                                      contains a built-in fingerprint reader.
+ * 1    0xe0    more ext count          how many more extented queries are
+ *                                      available after this one.
+ * 2    0xff    SecurePad width         the width of the SecurePad fingerprint
+ *                                      reader.
+ * 3    0xff    SecurePad height        the height of the SecurePad fingerprint
+ *                                      reader.
+ */
+#define SYN_CAP_EXT_BUTTONS_STICK(ex10) ((ex10) & 0x010000)
+#define SYN_CAP_SECUREPAD(ex10)         ((ex10) & 0x020000)
+#define SYN_CAP_EXT_BUTTON_STICK_L(eb)  (!!((eb) & 0x01))
+#define SYN_CAP_EXT_BUTTON_STICK_M(eb)  (!!((eb) & 0x02))
+#define SYN_CAP_EXT_BUTTON_STICK_R(eb)  (!!((eb) & 0x04))
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
 #define SYN_MODE_RATE(m)                ((m) & (1 << 6))
@@ -143,6 +169,7 @@ struct synaptics_data {
        unsigned long int capabilities;         /* Capabilities */
        unsigned long int ext_cap;              /* Extended Capabilities */
        unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
+        unsigned long int ext_cap_10;           /* Ext Caps from 0x10 query */
        unsigned long int identity;             /* Identification */
        unsigned int x_res, y_res;              /* X/Y resolution in units/mm */
        unsigned int x_max, y_max;              /* Max coordinates (from FW) */
@@ -156,6 +183,7 @@ struct synaptics_data {
        bool disable_gesture;                   /* disable gestures */
        struct serio *pt_port;                  /* Pass-through serio port */
+        unsigned char pt_buttons;               /* Pass-through buttons */
        /*
         * Last received Advanced Gesture Mode (AGM) packet. An AGM packet
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index baa0d9786f50..1ae4e547b419 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -23,6 +23,7 @@ config IOMMU_IO_PGTABLE
 config IOMMU_IO_PGTABLE_LPAE
        bool "ARMv7/v8 Long Descriptor Format"
        select IOMMU_IO_PGTABLE
+        depends on ARM || ARM64 || COMPILE_TEST
        help
          Enable support for the ARM long descriptor pagetable format.
          This allocator supports 4K/2M/1G, 16K/32M and 64K/512M page
@@ -63,6 +64,7 @@ config MSM_IOMMU
        bool "MSM IOMMU Support"
        depends on ARM
        depends on ARCH_MSM8X60 || ARCH_MSM8960 || COMPILE_TEST
+        depends on BROKEN
        select IOMMU_API
        help
          Support for the IOMMUs found on certain Qualcomm SOCs.
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index 7ce52737c7a1..dc14fec4ede1 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -1186,8 +1186,15 @@ static const struct iommu_ops exynos_iommu_ops = {
 static int __init exynos_iommu_init(void)
 {
+        struct device_node *np;
        int ret;
+        np = of_find_matching_node(NULL, sysmmu_of_match);
+        if (!np)
+                return 0;
+        of_node_put(np);
        lv2table_kmem_cache = kmem_cache_create("exynos-iommu-lv2table",
                                LV2TABLE_SIZE, LV2TABLE_SIZE, 0, NULL);
        if (!lv2table_kmem_cache) {
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index 5a500edf00cc..b610a8dee238 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -56,7 +56,8 @@
        ((((d)->levels - ((l) - ARM_LPAE_START_LVL(d) + 1))             \
          * (d)->bits_per_level) + (d)->pg_shift)
-#define ARM_LPAE_PAGES_PER_PGD(d)       ((d)->pgd_size >> (d)->pg_shift)
+#define ARM_LPAE_PAGES_PER_PGD(d)                                       \
+        DIV_ROUND_UP((d)->pgd_size, 1UL << (d)->pg_shift)
 /*
 * Calculate the index at level l used to map virtual address a using the
@@ -66,7 +67,7 @@
        ((l) == ARM_LPAE_START_LVL(d) ? ilog2(ARM_LPAE_PAGES_PER_PGD(d)) : 0)
 #define ARM_LPAE_LVL_IDX(a,l,d)                                         \
-        (((a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                             \
+        (((u64)(a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                        \
         ((1 << ((d)->bits_per_level + ARM_LPAE_PGD_IDX(l,d))) - 1))
 /* Calculate the block/page mapping size at level l for pagetable in d. */
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index f59f857b702e..a4ba851825c2 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1376,6 +1376,13 @@ static int __init omap_iommu_init(void)
        struct kmem_cache *p;
        const unsigned long flags = SLAB_HWCACHE_ALIGN;
        size_t align = 1 << 10; /* L2 pagetable alignement */
+        struct device_node *np;
+        np = of_find_matching_node(NULL, omap_iommu_of_match);
+        if (!np)
+                return 0;
+        of_node_put(np);
        p = kmem_cache_create("iopte_cache", IOPTE_TABLE_SIZE, align, flags,
                              iopte_cachep_ctor);
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 6a8b1ec4a48a..9f74fddcd304 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1015,8 +1015,15 @@ static struct platform_driver rk_iommu_driver = {
 static int __init rk_iommu_init(void)
 {
+        struct device_node *np;
        int ret;
+        np = of_find_matching_node(NULL, rk_iommu_dt_ids);
+        if (!np)
+                return 0;
+        of_node_put(np);
        ret = bus_set_iommu(&platform_bus_type, &rk_iommu_ops);
        if (ret)
                return ret;
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 463c235acbdc..4387dae14e45 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -69,6 +69,7 @@ static void __iomem *per_cpu_int_base;
 static void __iomem *main_int_base;
 static struct irq_domain *armada_370_xp_mpic_domain;
 static u32 doorbell_mask_reg;
+static int parent_irq;
 #ifdef CONFIG_PCI_MSI
 static struct irq_domain *armada_370_xp_msi_domain;
 static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
@@ -356,6 +357,7 @@ static int armada_xp_mpic_secondary_init(struct notifier_block *nfb,
 {
        if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
                armada_xp_mpic_smp_cpu_init();
        return NOTIFY_OK;
 }
@@ -364,6 +366,20 @@ static struct notifier_block armada_370_xp_mpic_cpu_notifier = {
        .priority = 100,
 };
+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
+                                        unsigned long action, void *hcpu)
+{
+        if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
+                enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
+        return NOTIFY_OK;
+}
+static struct notifier_block mpic_cascaded_cpu_notifier = {
+        .notifier_call = mpic_cascaded_secondary_init,
+        .priority = 100,
+};
 #endif /* CONFIG_SMP */
 static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
@@ -539,7 +555,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                                             struct device_node *parent)
 {
        struct resource main_int_res, per_cpu_int_res;
-        int parent_irq, nr_irqs, i;
+        int nr_irqs, i;
        u32 control;
        BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@@ -587,6 +603,9 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
 #endif
        } else {
+#ifdef CONFIG_SMP
+                register_cpu_notifier(&mpic_cascaded_cpu_notifier);
+#endif
                irq_set_chained_handler(parent_irq,
                                        armada_370_xp_mpic_handle_cascade_irq);
        }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d8996bdf0f61..596b0a9eee99 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -416,13 +416,14 @@ static void its_send_single_command(struct its_node *its,
 {
        struct its_cmd_block *cmd, *sync_cmd, *next_cmd;
        struct its_collection *sync_col;
+        unsigned long flags;
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
        cmd = its_allocate_entry(its);
        if (!cmd) {             /* We're soooooo screewed... */
                pr_err_ratelimited("ITS can't allocate, dropping command\n");
-                raw_spin_unlock(&its->lock);
+                raw_spin_unlock_irqrestore(&its->lock, flags);
                return;
        }
        sync_col = builder(cmd, desc);
@@ -442,7 +443,7 @@ static void its_send_single_command(struct its_node *its,
 post:
        next_cmd = its_post_commands(its);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
        its_wait_for_range_completion(its, cmd, next_cmd);
 }
@@ -799,21 +800,43 @@ static int its_alloc_tables(struct its_node *its)
 {
        int err;
        int i;
-        int psz = PAGE_SIZE;
+        int psz = SZ_64K;
        u64 shr = GITS_BASER_InnerShareable;
        for (i = 0; i < GITS_BASER_NR_REGS; i++) {
                u64 val = readq_relaxed(its->base + GITS_BASER + i * 8);
                u64 type = GITS_BASER_TYPE(val);
                u64 entry_size = GITS_BASER_ENTRY_SIZE(val);
+                int order = get_order(psz);
+                int alloc_size;
                u64 tmp;
                void *base;
                if (type == GITS_BASER_TYPE_NONE)
                        continue;
-                /* We're lazy and only allocate a single page for now */
+                /*
-                base = (void *)get_zeroed_page(GFP_KERNEL);
+                 * Allocate as many entries as required to fit the
+                 * range of device IDs that the ITS can grok... The ID
+                 * space being incredibly sparse, this results in a
+                 * massive waste of memory.
+                 *
+                 * For other tables, only allocate a single page.
+                 */
+                if (type == GITS_BASER_TYPE_DEVICE) {
+                        u64 typer = readq_relaxed(its->base + GITS_TYPER);
+                        u32 ids = GITS_TYPER_DEVBITS(typer);
+                        order = get_order((1UL << ids) * entry_size);
+                        if (order >= MAX_ORDER) {
+                                order = MAX_ORDER - 1;
+                                pr_warn("%s: Device Table too large, reduce its page order to %u\n",
+                                        its->msi_chip.of_node->full_name, order);
+                        }
+                }
+                alloc_size = (1 << order) * PAGE_SIZE;
+                base = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
                if (!base) {
                        err = -ENOMEM;
                        goto out_free;
@@ -841,7 +864,7 @@ retry_baser:
                        break;
                }
-                val |= (PAGE_SIZE / psz) - 1;
+                val |= (alloc_size / psz) - 1;
                writeq_relaxed(val, its->base + GITS_BASER + i * 8);
                tmp = readq_relaxed(its->base + GITS_BASER + i * 8);
@@ -882,7 +905,7 @@ retry_baser:
                }
                pr_info("ITS: allocated %d %s @%lx (psz %dK, shr %d)\n",
-                        (int)(PAGE_SIZE / entry_size),
+                        (int)(alloc_size / entry_size),
                        its_base_type_string[type],
                        (unsigned long)virt_to_phys(base),
                        psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT);
@@ -1020,8 +1043,9 @@ static void its_cpu_init_collection(void)
 static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
 {
        struct its_device *its_dev = NULL, *tmp;
+        unsigned long flags;
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
        list_for_each_entry(tmp, &its->its_device_list, entry) {
                if (tmp->device_id == dev_id) {
@@ -1030,7 +1054,7 @@ static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
                }
        }
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
        return its_dev;
 }
@@ -1040,6 +1064,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 {
        struct its_device *dev;
        unsigned long *lpi_map;
+        unsigned long flags;
        void *itt;
        int lpi_base;
        int nr_lpis;
@@ -1056,7 +1081,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
        nr_ites = max(2UL, roundup_pow_of_two(nvecs));
        sz = nr_ites * its->ite_size;
        sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
-        itt = kmalloc(sz, GFP_KERNEL);
+        itt = kzalloc(sz, GFP_KERNEL);
        lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
        if (!dev || !itt || !lpi_map) {
@@ -1075,9 +1100,9 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
        dev->device_id = dev_id;
        INIT_LIST_HEAD(&dev->entry);
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
        list_add(&dev->entry, &its->its_device_list);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
        /* Bind the device to the first possible CPU */
        cpu = cpumask_first(cpu_online_mask);
@@ -1091,9 +1116,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 static void its_free_device(struct its_device *its_dev)
 {
-        raw_spin_lock(&its_dev->its->lock);
+        unsigned long flags;
+        raw_spin_lock_irqsave(&its_dev->its->lock, flags);
        list_del(&its_dev->entry);
-        raw_spin_unlock(&its_dev->its->lock);
+        raw_spin_unlock_irqrestore(&its_dev->its->lock, flags);
        kfree(its_dev->itt);
        kfree(its_dev);
 }
@@ -1112,31 +1139,69 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
        return 0;
 }
+struct its_pci_alias {
+        struct pci_dev  *pdev;
+        u32             dev_id;
+        u32             count;
+};
+static int its_pci_msi_vec_count(struct pci_dev *pdev)
+{
+        int msi, msix;
+        msi = max(pci_msi_vec_count(pdev), 0);
+        msix = max(pci_msix_vec_count(pdev), 0);
+        return max(msi, msix);
+}
+static int its_get_pci_alias(struct pci_dev *pdev, u16 alias, void *data)
+{
+        struct its_pci_alias *dev_alias = data;
+        dev_alias->dev_id = alias;
+        if (pdev != dev_alias->pdev)
+                dev_alias->count += its_pci_msi_vec_count(dev_alias->pdev);
+        return 0;
+}
 static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                           int nvec, msi_alloc_info_t *info)
 {
        struct pci_dev *pdev;
        struct its_node *its;
-        u32 dev_id;
        struct its_device *its_dev;
+        struct its_pci_alias dev_alias;
        if (!dev_is_pci(dev))
                return -EINVAL;
        pdev = to_pci_dev(dev);
-        dev_id = PCI_DEVID(pdev->bus->number, pdev->devfn);
+        dev_alias.pdev = pdev;
+        dev_alias.count = nvec;
+        pci_for_each_dma_alias(pdev, its_get_pci_alias, &dev_alias);
        its = domain->parent->host_data;
-        its_dev = its_find_device(its, dev_id);
+        its_dev = its_find_device(its, dev_alias.dev_id);
-        if (WARN_ON(its_dev))
+        if (its_dev) {
-                return -EINVAL;
+                /*
+                 * We already have seen this ID, probably through
+                 * another alias (PCI bridge of some sort). No need to
+                 * create the device.
+                 */
+                dev_dbg(dev, "Reusing ITT for devID %x\n", dev_alias.dev_id);
+                goto out;
+        }
-        its_dev = its_create_device(its, dev_id, nvec);
+        its_dev = its_create_device(its, dev_alias.dev_id, dev_alias.count);
        if (!its_dev)
                return -ENOMEM;
-        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n", nvec, ilog2(nvec));
+        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n",
+                dev_alias.count, ilog2(dev_alias.count));
+out:
        info->scratchpad[0].ptr = its_dev;
        info->scratchpad[1].ptr = dev;
        return 0;
@@ -1255,6 +1320,34 @@ static const struct irq_domain_ops its_domain_ops = {
        .deactivate             = its_irq_domain_deactivate,
 };
+static int its_force_quiescent(void __iomem *base)
+{
+        u32 count = 1000000;    /* 1s */
+        u32 val;
+        val = readl_relaxed(base + GITS_CTLR);
+        if (val & GITS_CTLR_QUIESCENT)
+                return 0;
+        /* Disable the generation of all interrupts to this ITS */
+        val &= ~GITS_CTLR_ENABLE;
+        writel_relaxed(val, base + GITS_CTLR);
+        /* Poll GITS_CTLR and wait until ITS becomes quiescent */
+        while (1) {
+                val = readl_relaxed(base + GITS_CTLR);
+                if (val & GITS_CTLR_QUIESCENT)
+                        return 0;
+                count--;
+                if (!count)
+                        return -EBUSY;
+                cpu_relax();
+                udelay(1);
+        }
+}
 static int its_probe(struct device_node *node, struct irq_domain *parent)
 {
        struct resource res;
@@ -1283,6 +1376,13 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
                goto out_unmap;
        }
+        err = its_force_quiescent(its_base);
+        if (err) {
+                pr_warn("%s: failed to quiesce, giving up\n",
+                        node->full_name);
+                goto out_unmap;
+        }
        pr_info("ITS: %s\n", node->full_name);
        its = kzalloc(sizeof(*its), GFP_KERNEL);
@@ -1323,7 +1423,7 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
        writeq_relaxed(baser, its->base + GITS_CBASER);
        tmp = readq_relaxed(its->base + GITS_CBASER);
        writeq_relaxed(0, its->base + GITS_CWRITER);
-        writel_relaxed(1, its->base + GITS_CTLR);
+        writel_relaxed(GITS_CTLR_ENABLE, its->base + GITS_CTLR);
        if ((tmp ^ baser) & GITS_BASER_SHAREABILITY_MASK) {
                pr_info("ITS: using cache flushing for cmd queue\n");
@@ -1382,12 +1482,11 @@ static bool gic_rdists_supports_plpis(void)
 int its_cpu_init(void)
 {
-        if (!gic_rdists_supports_plpis()) {
-                pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
-                return -ENXIO;
-        }
        if (!list_empty(&its_nodes)) {
+                if (!gic_rdists_supports_plpis()) {
+                        pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
+                        return -ENXIO;
+                }
                its_cpu_init_lpis();
                its_cpu_init_collection();
        }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 1c6dea2fbc34..fd8850def1b8 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -466,7 +466,7 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
                tlist |= 1 << (mpidr & 0xf);
                cpu = cpumask_next(cpu, mask);
-                if (cpu == nr_cpu_ids)
+                if (cpu >= nr_cpu_ids)
                        goto out;
                mpidr = cpu_logical_map(cpu);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 4634cf7d0ec3..471e1cdc1933 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -154,23 +154,25 @@ static inline unsigned int gic_irq(struct irq_data *d)
 static void gic_mask_irq(struct irq_data *d)
 {
        u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
        writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_CLEAR + (gic_irq(d) / 32) * 4);
        if (gic_arch_extn.irq_mask)
                gic_arch_extn.irq_mask(d);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 static void gic_unmask_irq(struct irq_data *d)
 {
        u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
        if (gic_arch_extn.irq_unmask)
                gic_arch_extn.irq_unmask(d);
        writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_SET + (gic_irq(d) / 32) * 4);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 static void gic_eoi_irq(struct irq_data *d)
@@ -188,6 +190,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
 {
        void __iomem *base = gic_dist_base(d);
        unsigned int gicirq = gic_irq(d);
+        unsigned long flags;
        int ret;
        /* Interrupt configuration for SGIs can't be changed */
@@ -199,14 +202,14 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
                            type != IRQ_TYPE_EDGE_RISING)
                return -EINVAL;
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
        if (gic_arch_extn.irq_set_type)
                gic_arch_extn.irq_set_type(d, type);
        ret = gic_configure_irq(gicirq, type, base, NULL);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
        return ret;
 }
@@ -227,6 +230,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
        void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
        unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
        u32 val, mask, bit;
+        unsigned long flags;
        if (!force)
                cpu = cpumask_any_and(mask_val, cpu_online_mask);
@@ -236,12 +240,12 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
        if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
                return -EINVAL;
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
        mask = 0xff << shift;
        bit = gic_cpu_map[cpu] << shift;
        val = readl_relaxed(reg) & ~mask;
        writel_relaxed(val | bit, reg);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
        return IRQ_SET_MASK_OK;
 }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 6a7447c304ac..358a574d9e8b 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1609,7 +1609,7 @@ icn_setup(char *line)
        if (ints[0] > 1)
                membase = (unsigned long)ints[2];
        if (str && *str) {
-                strcpy(sid, str);
+                strlcpy(sid, str, sizeof(sid));
                icn_id = sid;
                if ((p = strchr(sid, ','))) {
                        *p++ = 0;
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 37de0173b6d2..74adcd2c967e 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -289,9 +289,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
        struct request_queue *q = bdev_get_queue(where->bdev);
        unsigned short logical_block_size = queue_logical_block_size(q);
        sector_t num_sectors;
+        unsigned int uninitialized_var(special_cmd_max_sectors);
-        /* Reject unsupported discard requests */
+        /*
-        if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
+         * Reject unsupported discard and write same requests.
+         */
+        if (rw & REQ_DISCARD)
+                special_cmd_max_sectors = q->limits.max_discard_sectors;
+        else if (rw & REQ_WRITE_SAME)
+                special_cmd_max_sectors = q->limits.max_write_same_sectors;
+        if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
                dec_count(io, region, -EOPNOTSUPP);
                return;
        }
@@ -317,7 +324,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                store_io_and_region_in_bio(bio, io, region);
                if (rw & REQ_DISCARD) {
-                        num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
+                        num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
                        bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
                        remaining -= num_sectors;
                } else if (rw & REQ_WRITE_SAME) {
@@ -326,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                         */
                        dp->get_page(dp, &page, &len, &offset);
                        bio_add_page(bio, page, logical_block_size, offset);
-                        num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
+                        num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
                        bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
                        offset = 0;
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 8b204ae216ab..f83a0f3fc365 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -20,6 +20,8 @@
 #include <linux/log2.h>
 #include <linux/dm-kcopyd.h>
+#include "dm.h"
 #include "dm-exception-store.h"
 #define DM_MSG_PREFIX "snapshots"
@@ -291,12 +293,23 @@ struct origin {
 };
 /*
+ * This structure is allocated for each origin target
+ */
+struct dm_origin {
+        struct dm_dev *dev;
+        struct dm_target *ti;
+        unsigned split_boundary;
+        struct list_head hash_list;
+};
+/*
 * Size of the hash table for origin volumes. If we make this
 * the size of the minors list then it should be nearly perfect
 */
 #define ORIGIN_HASH_SIZE 256
 #define ORIGIN_MASK      0xFF
 static struct list_head *_origins;
+static struct list_head *_dm_origins;
 static struct rw_semaphore _origins_lock;
 static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
@@ -310,12 +323,22 @@ static int init_origin_hash(void)
        _origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
                           GFP_KERNEL);
        if (!_origins) {
-                DMERR("unable to allocate memory");
+                DMERR("unable to allocate memory for _origins");
                return -ENOMEM;
        }
        for (i = 0; i < ORIGIN_HASH_SIZE; i++)
                INIT_LIST_HEAD(_origins + i);
+        _dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
+                              GFP_KERNEL);
+        if (!_dm_origins) {
+                DMERR("unable to allocate memory for _dm_origins");
+                kfree(_origins);
+                return -ENOMEM;
+        }
+        for (i = 0; i < ORIGIN_HASH_SIZE; i++)
+                INIT_LIST_HEAD(_dm_origins + i);
        init_rwsem(&_origins_lock);
        return 0;
@@ -324,6 +347,7 @@ static int init_origin_hash(void)
 static void exit_origin_hash(void)
 {
        kfree(_origins);
+        kfree(_dm_origins);
 }
 static unsigned origin_hash(struct block_device *bdev)
@@ -350,6 +374,30 @@ static void __insert_origin(struct origin *o)
        list_add_tail(&o->hash_list, sl);
 }
+static struct dm_origin *__lookup_dm_origin(struct block_device *origin)
+{
+        struct list_head *ol;
+        struct dm_origin *o;
+        ol = &_dm_origins[origin_hash(origin)];
+        list_for_each_entry (o, ol, hash_list)
+                if (bdev_equal(o->dev->bdev, origin))
+                        return o;
+        return NULL;
+}
+static void __insert_dm_origin(struct dm_origin *o)
+{
+        struct list_head *sl = &_dm_origins[origin_hash(o->dev->bdev)];
+        list_add_tail(&o->hash_list, sl);
+}
+static void __remove_dm_origin(struct dm_origin *o)
+{
+        list_del(&o->hash_list);
+}
 /*
 * _origins_lock must be held when calling this function.
 * Returns number of snapshots registered using the supplied cow device, plus:
@@ -1840,9 +1888,40 @@ static int snapshot_preresume(struct dm_target *ti)
 static void snapshot_resume(struct dm_target *ti)
 {
        struct dm_snapshot *s = ti->private;
-        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL, *snap_merging = NULL;
+        struct dm_origin *o;
+        struct mapped_device *origin_md = NULL;
+        bool must_restart_merging = false;
        down_read(&_origins_lock);
+        o = __lookup_dm_origin(s->origin->bdev);
+        if (o)
+                origin_md = dm_table_get_md(o->ti->table);
+        if (!origin_md) {
+                (void) __find_snapshots_sharing_cow(s, NULL, NULL, &snap_merging);
+                if (snap_merging)
+                        origin_md = dm_table_get_md(snap_merging->ti->table);
+        }
+        if (origin_md == dm_table_get_md(ti->table))
+                origin_md = NULL;
+        if (origin_md) {
+                if (dm_hold(origin_md))
+                        origin_md = NULL;
+        }
+        up_read(&_origins_lock);
+        if (origin_md) {
+                dm_internal_suspend_fast(origin_md);
+                if (snap_merging && test_bit(RUNNING_MERGE, &snap_merging->state_bits)) {
+                        must_restart_merging = true;
+                        stop_merge(snap_merging);
+                }
+        }
+        down_read(&_origins_lock);
        (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
        if (snap_src && snap_dest) {
                down_write(&snap_src->lock);
@@ -1851,8 +1930,16 @@ static void snapshot_resume(struct dm_target *ti)
                up_write(&snap_dest->lock);
                up_write(&snap_src->lock);
        }
        up_read(&_origins_lock);
+        if (origin_md) {
+                if (must_restart_merging)
+                        start_merge(snap_merging);
+                dm_internal_resume_fast(origin_md);
+                dm_put(origin_md);
+        }
        /* Now we have correct chunk size, reregister */
        reregister_snapshot(s);
@@ -2133,11 +2220,6 @@ static int origin_write_extent(struct dm_snapshot *merging_snap,
 * Origin: maps a linear range of a device, with hooks for snapshotting.
 */
-struct dm_origin {
-        struct dm_dev *dev;
-        unsigned split_boundary;
-};
 /*
 * Construct an origin mapping: <dev_path>
 * The context for an origin is merely a 'struct dm_dev *'
@@ -2166,6 +2248,7 @@ static int origin_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                goto bad_open;
        }
+        o->ti = ti;
        ti->private = o;
        ti->num_flush_bios = 1;
@@ -2180,6 +2263,7 @@ bad_alloc:
 static void origin_dtr(struct dm_target *ti)
 {
        struct dm_origin *o = ti->private;
        dm_put_device(ti, o->dev);
        kfree(o);
 }
@@ -2216,6 +2300,19 @@ static void origin_resume(struct dm_target *ti)
        struct dm_origin *o = ti->private;
        o->split_boundary = get_origin_minimum_chunksize(o->dev->bdev);
+        down_write(&_origins_lock);
+        __insert_dm_origin(o);
+        up_write(&_origins_lock);
+}
+static void origin_postsuspend(struct dm_target *ti)
+{
+        struct dm_origin *o = ti->private;
+        down_write(&_origins_lock);
+        __remove_dm_origin(o);
+        up_write(&_origins_lock);
 }
 static void origin_status(struct dm_target *ti, status_type_t type,
@@ -2258,12 +2355,13 @@ static int origin_iterate_devices(struct dm_target *ti,
 static struct target_type origin_target = {
        .name    = "snapshot-origin",
-        .version = {1, 8, 1},
+        .version = {1, 9, 0},
        .module  = THIS_MODULE,
        .ctr     = origin_ctr,
        .dtr     = origin_dtr,
        .map     = origin_map,
        .resume  = origin_resume,
+        .postsuspend = origin_postsuspend,
        .status  = origin_status,
        .merge   = origin_merge,
        .iterate_devices = origin_iterate_devices,
@@ -2271,7 +2369,7 @@ static struct target_type origin_target = {
 static struct target_type snapshot_target = {
        .name    = "snapshot",
-        .version = {1, 12, 0},
+        .version = {1, 13, 0},
        .module  = THIS_MODULE,
        .ctr     = snapshot_ctr,
        .dtr     = snapshot_dtr,
@@ -2285,7 +2383,7 @@ static struct target_type snapshot_target = {
 static struct target_type merge_target = {
        .name    = dm_snapshot_merge_target_name,
-        .version = {1, 2, 0},
+        .version = {1, 3, 0},
        .module  = THIS_MODULE,
        .ctr     = snapshot_ctr,
        .dtr     = snapshot_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 654773cb1eee..921aafd12aee 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2358,17 +2358,6 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                return DM_MAPIO_REMAPPED;
        case -ENODATA:
-                if (get_pool_mode(tc->pool) == PM_READ_ONLY) {
-                        /*
-                         * This block isn't provisioned, and we have no way
-                         * of doing so.
-                         */
-                        handle_unserviceable_bio(tc->pool, bio);
-                        cell_defer_no_holder(tc, virt_cell);
-                        return DM_MAPIO_SUBMITTED;
-                }
-                /* fall through */
        case -EWOULDBLOCK:
                thin_defer_cell(tc, virt_cell);
                return DM_MAPIO_SUBMITTED;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 73f28802dc7a..9b641b38b857 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2616,6 +2616,19 @@ void dm_get(struct mapped_device *md)
        BUG_ON(test_bit(DMF_FREEING, &md->flags));
 }
+int dm_hold(struct mapped_device *md)
+{
+        spin_lock(&_minor_lock);
+        if (test_bit(DMF_FREEING, &md->flags)) {
+                spin_unlock(&_minor_lock);
+                return -EBUSY;
+        }
+        dm_get(md);
+        spin_unlock(&_minor_lock);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dm_hold);
 const char *dm_device_name(struct mapped_device *md)
 {
        return md->name;
@@ -2638,10 +2651,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
        if (dm_request_based(md))
                flush_kthread_worker(&md->kworker);
+        /*
+         * Take suspend_lock so that presuspend and postsuspend methods
+         * do not race with internal suspend.
+         */
+        mutex_lock(&md->suspend_lock);
        if (!dm_suspended_md(md)) {
                dm_table_presuspend_targets(map);
                dm_table_postsuspend_targets(map);
        }
+        mutex_unlock(&md->suspend_lock);
        /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
        dm_put_live_table(md, srcu_idx);
@@ -3115,6 +3134,7 @@ void dm_internal_suspend_fast(struct mapped_device *md)
        flush_workqueue(md->wq);
        dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
 }
+EXPORT_SYMBOL_GPL(dm_internal_suspend_fast);
 void dm_internal_resume_fast(struct mapped_device *md)
 {
@@ -3126,6 +3146,7 @@ void dm_internal_resume_fast(struct mapped_device *md)
 done:
        mutex_unlock(&md->suspend_lock);
 }
+EXPORT_SYMBOL_GPL(dm_internal_resume_fast);
 /*-----------------------------------------------------------------
 * Event notification.
diff --git a/drivers/md/md.c b/drivers/md/md.c
index cadf9cc02b25..717daad71fb1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5080,7 +5080,8 @@ int md_run(struct mddev *mddev)
        }
        if (err) {
                mddev_detach(mddev);
-                pers->free(mddev, mddev->private);
+                if (mddev->private)
+                        pers->free(mddev, mddev->private);
                module_put(pers->owner);
                bitmap_destroy(mddev);
                return err;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index a13f738a7b39..3ed9f42ddca6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -467,8 +467,6 @@ static int raid0_run(struct mddev *mddev)
        dump_zones(mddev);
        ret = md_integrity_register(mddev);
-        if (ret)
-                raid0_free(mddev, conf);
        return ret;
 }
diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
index f38ec424872e..5615522f8d62 100644
--- a/drivers/mfd/kempld-core.c
+++ b/drivers/mfd/kempld-core.c
@@ -739,7 +739,7 @@ static int __init kempld_init(void)
                for (id = kempld_dmi_table;
                     id->matches[0].slot != DMI_NONE; id++)
                        if (strstr(id->ident, force_device_id))
-                                if (id->callback && id->callback(id))
+                                if (id->callback && !id->callback(id))
                                        break;
                if (id->matches[0].slot == DMI_NONE)
                        return -ENODEV;
diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
index ede50244f265..dbd907d7170e 100644
--- a/drivers/mfd/rtsx_usb.c
+++ b/drivers/mfd/rtsx_usb.c
@@ -196,18 +196,27 @@ EXPORT_SYMBOL_GPL(rtsx_usb_ep0_write_register);
 int rtsx_usb_ep0_read_register(struct rtsx_ucr *ucr, u16 addr, u8 *data)
 {
        u16 value;
+        u8 *buf;
+        int ret;
        if (!data)
                return -EINVAL;
-        *data = 0;
+        buf = kzalloc(sizeof(u8), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
        addr |= EP0_READ_REG_CMD << EP0_OP_SHIFT;
        value = swab16(addr);
-        return usb_control_msg(ucr->pusb_dev,
+        ret = usb_control_msg(ucr->pusb_dev,
                        usb_rcvctrlpipe(ucr->pusb_dev, 0), RTSX_USB_REQ_REG_OP,
                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                        value, 0, data, 1, 100);
+                        value, 0, buf, 1, 100);
+        *data = *buf;
+        kfree(buf);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(rtsx_usb_ep0_read_register);
@@ -288,18 +297,27 @@ static int rtsx_usb_get_status_with_bulk(struct rtsx_ucr *ucr, u16 *status)
 int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status)
 {
        int ret;
+        u16 *buf;
        if (!status)
                return -EINVAL;
-        if (polling_pipe == 0)
+        if (polling_pipe == 0) {
+                buf = kzalloc(sizeof(u16), GFP_KERNEL);
+                if (!buf)
+                        return -ENOMEM;
                ret = usb_control_msg(ucr->pusb_dev,
                                usb_rcvctrlpipe(ucr->pusb_dev, 0),
                                RTSX_USB_REQ_POLL,
                                USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                0, 0, status, 2, 100);
+                                0, 0, buf, 2, 100);
-        else
+                *status = *buf;
+                kfree(buf);
+        } else {
                ret = rtsx_usb_get_status_with_bulk(ucr, status);
+        }
        /* usb_control_msg may return positive when success */
        if (ret < 0)
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index e9f1d8d84613..c53f14a7ce54 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -124,7 +124,7 @@ int mmc_pwrseq_simple_alloc(struct mmc_host *host, struct device *dev)
                    PTR_ERR(pwrseq->reset_gpios[i]) != -ENOSYS) {
                        ret = PTR_ERR(pwrseq->reset_gpios[i]);
-                        while (--i)
+                        while (i--)
                                gpiod_put(pwrseq->reset_gpios[i]);
                        goto clk_put;
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 5b76a173cd95..5897d8d8fa5a 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -526,6 +526,7 @@ config MTD_NAND_SUNXI
 config MTD_NAND_HISI504
        tristate "Support for NAND controller on Hisilicon SoC Hip04"
+        depends on HAS_DMA
        help
          Enables support for NAND controller on Hisilicon SoC Hip04.
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 96b0b1d27df1..10b1f7a4fe50 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
        nand_writel(info, NDCR, ndcr | int_mask);
 }
+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
+{
+        if (info->ecc_bch) {
+                int timeout;
+                /*
+                 * According to the datasheet, when reading from NDDB
+                 * with BCH enabled, after each 32 bytes reads, we
+                 * have to make sure that the NDSR.RDDREQ bit is set.
+                 *
+                 * Drain the FIFO 8 32 bits reads at a time, and skip
+                 * the polling on the last read.
+                 */
+                while (len > 8) {
+                        __raw_readsl(info->mmio_base + NDDB, data, 8);
+                        for (timeout = 0;
+                             !(nand_readl(info, NDSR) & NDSR_RDDREQ);
+                             timeout++) {
+                                if (timeout >= 5) {
+                                        dev_err(&info->pdev->dev,
+                                                "Timeout on RDDREQ while draining the FIFO\n");
+                                        return;
+                                }
+                                mdelay(1);
+                        }
+                        data += 32;
+                        len -= 8;
+                }
+        }
+        __raw_readsl(info->mmio_base + NDDB, data, len);
+}
 static void handle_data_pio(struct pxa3xx_nand_info *info)
 {
        unsigned int do_bytes = min(info->data_size, info->chunk_size);
@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
                                      DIV_ROUND_UP(info->oob_size, 4));
                break;
        case STATE_PIO_READING:
-                __raw_readsl(info->mmio_base + NDDB,
+                drain_fifo(info,
-                             info->data_buff + info->data_buff_pos,
+                           info->data_buff + info->data_buff_pos,
-                             DIV_ROUND_UP(do_bytes, 4));
+                           DIV_ROUND_UP(do_bytes, 4));
                if (info->oob_size > 0)
-                        __raw_readsl(info->mmio_base + NDDB,
+                        drain_fifo(info,
-                                     info->oob_buff + info->oob_buff_pos,
+                                   info->oob_buff + info->oob_buff_pos,
-                                     DIV_ROUND_UP(info->oob_size, 4));
+                                   DIV_ROUND_UP(info->oob_size, 4));
                break;
        default:
                dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
@@ -1572,6 +1608,8 @@ static int alloc_nand_resource(struct platform_device *pdev)
        int ret, irq, cs;
        pdata = dev_get_platdata(&pdev->dev);
+        if (pdata->num_cs <= 0)
+                return -ENODEV;
        info = devm_kzalloc(&pdev->dev, sizeof(*info) + (sizeof(*mtd) +
                            sizeof(*host)) * pdata->num_cs, GFP_KERNEL);
        if (!info)
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index da4c79259f67..16e34b37d134 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -425,9 +425,10 @@ retry:
                                        ubi_warn(ubi, "corrupted VID header at PEB %d, LEB %d:%d",
                                                 pnum, vol_id, lnum);
                                        err = -EBADMSG;
-                                } else
+                                } else {
                                        err = -EINVAL;
                                        ubi_ro_mode(ubi);
+                                }
                        }
                        goto out_free;
                } else if (err == UBI_IO_BITFLIPS)
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index 98d73aab52fe..58808f651452 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -131,7 +131,7 @@ config CAN_RCAR
 config CAN_XILINXCAN
        tristate "Xilinx CAN"
-        depends on ARCH_ZYNQ || MICROBLAZE || COMPILE_TEST
+        depends on ARCH_ZYNQ || ARM64 || MICROBLAZE || COMPILE_TEST
        depends on COMMON_CLK && HAS_IOMEM
        ---help---
          Xilinx CAN driver. This driver supports both soft AXI CAN IP and
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index a316fa4b91ab..e97a08ce0b90 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -14,6 +14,7 @@
 * Copyright (C) 2015 Valeo S.A.
 */
+#include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
@@ -467,10 +468,11 @@ struct kvaser_usb {
 struct kvaser_usb_net_priv {
        struct can_priv can;
-        atomic_t active_tx_urbs;
+        spinlock_t tx_contexts_lock;
-        struct usb_anchor tx_submitted;
+        int active_tx_contexts;
        struct kvaser_usb_tx_urb_context tx_contexts[MAX_TX_URBS];
+        struct usb_anchor tx_submitted;
        struct completion start_comp, stop_comp;
        struct kvaser_usb *dev;
@@ -694,6 +696,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
        struct kvaser_usb_net_priv *priv;
        struct sk_buff *skb;
        struct can_frame *cf;
+        unsigned long flags;
        u8 channel, tid;
        channel = msg->u.tx_acknowledge_header.channel;
@@ -737,12 +740,15 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
        stats->tx_packets++;
        stats->tx_bytes += context->dlc;
-        can_get_echo_skb(priv->netdev, context->echo_index);
-        context->echo_index = MAX_TX_URBS;
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
-        atomic_dec(&priv->active_tx_urbs);
+        can_get_echo_skb(priv->netdev, context->echo_index);
+        context->echo_index = MAX_TX_URBS;
+        --priv->active_tx_contexts;
        netif_wake_queue(priv->netdev);
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 }
 static void kvaser_usb_simple_msg_callback(struct urb *urb)
@@ -803,17 +809,6 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
        return 0;
 }
-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
-{
-        int i;
-        usb_kill_anchored_urbs(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-        for (i = 0; i < MAX_TX_URBS; i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
-}
 static void kvaser_usb_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
                                                 const struct kvaser_usb_error_summary *es,
                                                 struct can_frame *cf)
@@ -1515,6 +1510,24 @@ error:
        return err;
 }
+static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
+{
+        int i;
+        priv->active_tx_contexts = 0;
+        for (i = 0; i < MAX_TX_URBS; i++)
+                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
+}
+/* This method might sleep. Do not call it in the atomic context
+ * of URB completions.
+ */
+static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+{
+        usb_kill_anchored_urbs(&priv->tx_submitted);
+        kvaser_usb_reset_tx_urb_contexts(priv);
+}
 static void kvaser_usb_unlink_all_urbs(struct kvaser_usb *dev)
 {
        int i;
@@ -1634,6 +1647,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        struct kvaser_msg *msg;
        int i, err, ret = NETDEV_TX_OK;
        u8 *msg_tx_can_flags = NULL;            /* GCC */
+        unsigned long flags;
        if (can_dropped_invalid_skb(netdev, skb))
                return NETDEV_TX_OK;
@@ -1687,12 +1701,21 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        if (cf->can_id & CAN_RTR_FLAG)
                *msg_tx_can_flags |= MSG_FLAG_REMOTE_FRAME;
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++) {
                if (priv->tx_contexts[i].echo_index == MAX_TX_URBS) {
                        context = &priv->tx_contexts[i];
+                        context->echo_index = i;
+                        can_put_echo_skb(skb, netdev, context->echo_index);
+                        ++priv->active_tx_contexts;
+                        if (priv->active_tx_contexts >= MAX_TX_URBS)
+                                netif_stop_queue(netdev);
                        break;
                }
        }
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
        /* This should never happen; it implies a flow control bug */
        if (!context) {
@@ -1704,7 +1727,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        }
        context->priv = priv;
-        context->echo_index = i;
        context->dlc = cf->can_dlc;
        msg->u.tx_can.tid = context->echo_index;
@@ -1716,18 +1738,17 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                          kvaser_usb_write_bulk_callback, context);
        usb_anchor_urb(urb, &priv->tx_submitted);
-        can_put_echo_skb(skb, netdev, context->echo_index);
-        atomic_inc(&priv->active_tx_urbs);
-        if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
-                netif_stop_queue(netdev);
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (unlikely(err)) {
+                spin_lock_irqsave(&priv->tx_contexts_lock, flags);
                can_free_echo_skb(netdev, context->echo_index);
+                context->echo_index = MAX_TX_URBS;
+                --priv->active_tx_contexts;
+                netif_wake_queue(netdev);
+                spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
-                atomic_dec(&priv->active_tx_urbs);
                usb_unanchor_urb(urb);
                stats->tx_dropped++;
@@ -1854,7 +1875,7 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
        struct kvaser_usb *dev = usb_get_intfdata(intf);
        struct net_device *netdev;
        struct kvaser_usb_net_priv *priv;
-        int i, err;
+        int err;
        err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
        if (err)
@@ -1868,19 +1889,17 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
        priv = netdev_priv(netdev);
+        init_usb_anchor(&priv->tx_submitted);
        init_completion(&priv->start_comp);
        init_completion(&priv->stop_comp);
-        init_usb_anchor(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
        priv->dev = dev;
        priv->netdev = netdev;
        priv->channel = channel;
+        spin_lock_init(&priv->tx_contexts_lock);
+        kvaser_usb_reset_tx_urb_contexts(priv);
        priv->can.state = CAN_STATE_STOPPED;
        priv->can.clock.freq = CAN_USB_CLOCK;
        priv->can.bittiming_const = &kvaser_usb_bittiming_const;
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 11d6e6561df1..15a8190a6f75 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 {
        struct pcnet32_private *lp;
        int i, media;
-        int fdx, mii, fset, dxsuflo;
+        int fdx, mii, fset, dxsuflo, sram;
        int chip_version;
        char *chipname;
        struct net_device *dev;
@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        }
        /* initialize variables */
-        fdx = mii = fset = dxsuflo = 0;
+        fdx = mii = fset = dxsuflo = sram = 0;
        chip_version = (chip_version >> 12) & 0xffff;
        switch (chip_version) {
@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                chipname = "PCnet/FAST III 79C973";     /* PCI */
                fdx = 1;
                mii = 1;
+                sram = 1;
                break;
        case 0x2626:
                chipname = "PCnet/Home 79C978"; /* PCI */
@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                chipname = "PCnet/FAST III 79C975";     /* PCI */
                fdx = 1;
                mii = 1;
+                sram = 1;
                break;
        case 0x2628:
                chipname = "PCnet/PRO 79C976";
@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                dxsuflo = 1;
        }
+        /*
+         * The Am79C973/Am79C975 controllers come with 12K of SRAM
+         * which we can use for the Tx/Rx buffers but most importantly,
+         * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
+         * Tx fifo underflows.
+         */
+        if (sram) {
+                /*
+                 * The SRAM is being configured in two steps. First we
+                 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
+                 * to the datasheet, each bit corresponds to a 512-byte
+                 * page so we can have at most 24 pages. The SRAM_SIZE
+                 * holds the value of the upper 8 bits of the 16-bit SRAM size.
+                 * The low 8-bits start at 0x00 and end at 0xff. So the
+                 * address range is from 0x0000 up to 0x17ff. Therefore,
+                 * the SRAM_SIZE is set to 0x17. The next step is to set
+                 * the BCR26:SRAM_BND midway through so the Tx and Rx
+                 * buffers can share the SRAM equally.
+                 */
+                a->write_bcr(ioaddr, 25, 0x17);
+                a->write_bcr(ioaddr, 26, 0xc);
+                /* And finally enable the NOUFLO bit */
+                a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
+        }
        dev = alloc_etherdev(sizeof(*lp));
        if (!dev) {
                ret = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index bef750a09027..996e215fc324 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12769,7 +12769,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 |
                NETIF_F_RXCSUM | NETIF_F_LRO | NETIF_F_GRO |
                NETIF_F_RXHASH | NETIF_F_HW_VLAN_CTAG_TX;
-        if (!CHIP_IS_E1x(bp)) {
+        if (!chip_is_e1x) {
                dev->hw_features |= NETIF_F_GSO_GRE | NETIF_F_GSO_UDP_TUNNEL |
                                    NETIF_F_GSO_IPIP | NETIF_F_GSO_SIT;
                dev->hw_enc_features =
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 853c38997c82..1abdfa123c6c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -1120,7 +1120,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
                }
                /* Installed successfully, update the cached header too. */
-                memcpy(card_fw, fs_fw, sizeof(*card_fw));
+                *card_fw = *fs_fw;
                card_fw_usable = 1;
                *reset = 0;     /* already reset as part of load_fw */
        }
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index 3b42556f7f8d..ed41559bae77 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -589,7 +589,7 @@ static void tulip_tx_timeout(struct net_device *dev)
                               (unsigned int)tp->rx_ring[i].buffer1,
                               (unsigned int)tp->rx_ring[i].buffer2,
                               buf[0], buf[1], buf[2]);
-                        for (j = 0; buf[j] != 0xee && j < 1600; j++)
+                        for (j = 0; ((j < 1600) && buf[j] != 0xee); j++)
                                if (j < 100)
                                        pr_cont(" %02x", buf[j]);
                        pr_cont(" j=%d\n", j);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 27de37aa90af..27b9fe99a9bd 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -354,6 +354,7 @@ struct be_vf_cfg {
        u16 vlan_tag;
        u32 tx_rate;
        u32 plink_tracking;
+        u32 privileges;
 };
 enum vf_state {
@@ -423,6 +424,7 @@ struct be_adapter {
        u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
        u8 __iomem *db;         /* Door Bell */
+        u8 __iomem *pcicfg;     /* On SH,BEx only. Shadow of PCI config space */
        struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
        struct be_dma_mem mbox_mem;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 36916cfa70f9..7f05f309e935 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1902,15 +1902,11 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 {
        int num_eqs, i = 0;
-        if (lancer_chip(adapter) && num > 8) {
+        while (num) {
-                while (num) {
+                num_eqs = min(num, 8);
-                        num_eqs = min(num, 8);
+                __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
-                        __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
+                i += num_eqs;
-                        i += num_eqs;
+                num -= num_eqs;
-                        num -= num_eqs;
-                }
-        } else {
-                __be_cmd_modify_eqd(adapter, set_eqd, num);
        }
        return 0;
@@ -1918,7 +1914,7 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num)
+                       u32 num, u32 domain)
 {
        struct be_mcc_wrb *wrb;
        struct be_cmd_req_vlan_config *req;
@@ -1936,6 +1932,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
        be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                               OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req),
                               wrb, NULL);
+        req->hdr.domain = domain;
        req->interface_id = if_id;
        req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index db761e8e42a3..a7634a3f052a 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -2256,7 +2256,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
 int be_cmd_get_fw_ver(struct be_adapter *adapter);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num);
+                       u32 num, u32 domain);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 0a816859aca5..e6b790f0d9dc 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1171,7 +1171,7 @@ static int be_vid_config(struct be_adapter *adapter)
        for_each_set_bit(i, adapter->vids, VLAN_N_VID)
                vids[num++] = cpu_to_le16(i);
-        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num);
+        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num, 0);
        if (status) {
                dev_err(dev, "Setting HW VLAN filtering failed\n");
                /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -1380,11 +1380,67 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
        return 0;
 }
+static int be_set_vf_tvt(struct be_adapter *adapter, int vf, u16 vlan)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        u16 vids[BE_NUM_VLANS_SUPPORTED];
+        int vf_if_id = vf_cfg->if_handle;
+        int status;
+        /* Enable Transparent VLAN Tagging */
+        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1, vf_if_id, 0);
+        if (status)
+                return status;
+        /* Clear pre-programmed VLAN filters on VF if any, if TVT is enabled */
+        vids[0] = 0;
+        status = be_cmd_vlan_config(adapter, vf_if_id, vids, 1, vf + 1);
+        if (!status)
+                dev_info(&adapter->pdev->dev,
+                         "Cleared guest VLANs on VF%d", vf);
+        /* After TVT is enabled, disallow VFs to program VLAN filters */
+        if (vf_cfg->privileges & BE_PRIV_FILTMGMT) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges &
+                                                  ~BE_PRIV_FILTMGMT, vf + 1);
+                if (!status)
+                        vf_cfg->privileges &= ~BE_PRIV_FILTMGMT;
+        }
+        return 0;
+}
+static int be_clear_vf_tvt(struct be_adapter *adapter, int vf)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        struct device *dev = &adapter->pdev->dev;
+        int status;
+        /* Reset Transparent VLAN Tagging. */
+        status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID, vf + 1,
+                                       vf_cfg->if_handle, 0);
+        if (status)
+                return status;
+        /* Allow VFs to program VLAN filtering */
+        if (!(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges |
+                                                  BE_PRIV_FILTMGMT, vf + 1);
+                if (!status) {
+                        vf_cfg->privileges |= BE_PRIV_FILTMGMT;
+                        dev_info(dev, "VF%d: FILTMGMT priv enabled", vf);
+                }
+        }
+        dev_info(dev,
+                 "Disable/re-enable i/f in VM to clear Transparent VLAN tag");
+        return 0;
+}
 static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 {
        struct be_adapter *adapter = netdev_priv(netdev);
        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
-        int status = 0;
+        int status;
        if (!sriov_enabled(adapter))
                return -EPERM;
@@ -1394,24 +1450,19 @@ static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
        if (vlan || qos) {
                vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan)
+                status = be_set_vf_tvt(adapter, vf, vlan);
-                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                                       vf_cfg->if_handle, 0);
        } else {
-                /* Reset Transparent Vlan Tagging. */
+                status = be_clear_vf_tvt(adapter, vf);
-                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
-                                               vf + 1, vf_cfg->if_handle, 0);
        }
        if (status) {
                dev_err(&adapter->pdev->dev,
-                        "VLAN %d config on VF %d failed : %#x\n", vlan,
+                        "VLAN %d config on VF %d failed : %#x\n", vlan, vf,
-                        vf, status);
+                        status);
                return be_cmd_status(status);
        }
        vf_cfg->vlan_tag = vlan;
        return 0;
 }
@@ -2772,14 +2823,12 @@ void be_detect_error(struct be_adapter *adapter)
                        }
                }
        } else {
-                pci_read_config_dword(adapter->pdev,
+                ue_lo = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_LOW);
-                                      PCICFG_UE_STATUS_LOW, &ue_lo);
+                ue_hi = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_HIGH);
-                pci_read_config_dword(adapter->pdev,
+                ue_lo_mask = ioread32(adapter->pcicfg +
-                                      PCICFG_UE_STATUS_HIGH, &ue_hi);
+                                      PCICFG_UE_STATUS_LOW_MASK);
-                pci_read_config_dword(adapter->pdev,
+                ue_hi_mask = ioread32(adapter->pcicfg +
-                                      PCICFG_UE_STATUS_LOW_MASK, &ue_lo_mask);
+                                      PCICFG_UE_STATUS_HI_MASK);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HI_MASK, &ue_hi_mask);
                ue_lo = (ue_lo & ~ue_lo_mask);
                ue_hi = (ue_hi & ~ue_hi_mask);
@@ -3339,7 +3388,6 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
                        u32 cap_flags, u32 vf)
 {
        u32 en_flags;
-        int status;
        en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                   BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |
@@ -3347,10 +3395,7 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
        en_flags &= cap_flags;
-        status = be_cmd_if_create(adapter, cap_flags, en_flags,
+        return be_cmd_if_create(adapter, cap_flags, en_flags, if_handle, vf);
-                                  if_handle, vf);
-        return status;
 }
 static int be_vfs_if_create(struct be_adapter *adapter)
@@ -3368,8 +3413,13 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                if (!BE3_chip(adapter)) {
                        status = be_cmd_get_profile_config(adapter, &res,
                                                           vf + 1);
-                        if (!status)
+                        if (!status) {
                                cap_flags = res.if_cap_flags;
+                                /* Prevent VFs from enabling VLAN promiscuous
+                                 * mode
+                                 */
+                                cap_flags &= ~BE_IF_FLAGS_VLAN_PROMISCUOUS;
+                        }
                }
                status = be_if_create(adapter, &vf_cfg->if_handle,
@@ -3403,7 +3453,6 @@ static int be_vf_setup(struct be_adapter *adapter)
        struct device *dev = &adapter->pdev->dev;
        struct be_vf_cfg *vf_cfg;
        int status, old_vfs, vf;
-        u32 privileges;
        old_vfs = pci_num_vf(adapter->pdev);
@@ -3433,15 +3482,18 @@ static int be_vf_setup(struct be_adapter *adapter)
        for_all_vfs(adapter, vf_cfg, vf) {
                /* Allow VFs to programs MAC/VLAN filters */
-                status = be_cmd_get_fn_privileges(adapter, &privileges, vf + 1);
+                status = be_cmd_get_fn_privileges(adapter, &vf_cfg->privileges,
-                if (!status && !(privileges & BE_PRIV_FILTMGMT)) {
+                                                  vf + 1);
+                if (!status && !(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
                        status = be_cmd_set_fn_privileges(adapter,
-                                                          privileges |
+                                                          vf_cfg->privileges |
                                                          BE_PRIV_FILTMGMT,
                                                          vf + 1);
-                        if (!status)
+                        if (!status) {
+                                vf_cfg->privileges |= BE_PRIV_FILTMGMT;
                                dev_info(dev, "VF%d has FILTMGMT privilege\n",
                                         vf);
+                        }
                }
                /* Allow full available bandwidth */
@@ -4820,24 +4872,37 @@ static int be_roce_map_pci_bars(struct be_adapter *adapter)
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
+        struct pci_dev *pdev = adapter->pdev;
        u8 __iomem *addr;
        if (BEx_chip(adapter) && be_physfn(adapter)) {
-                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                adapter->csr = pci_iomap(pdev, 2, 0);
                if (!adapter->csr)
                        return -ENOMEM;
        }
-        addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
+        addr = pci_iomap(pdev, db_bar(adapter), 0);
        if (!addr)
                goto pci_map_err;
        adapter->db = addr;
+        if (skyhawk_chip(adapter) || BEx_chip(adapter)) {
+                if (be_physfn(adapter)) {
+                        /* PCICFG is the 2nd BAR in BE2 */
+                        addr = pci_iomap(pdev, BE2_chip(adapter) ? 1 : 0, 0);
+                        if (!addr)
+                                goto pci_map_err;
+                        adapter->pcicfg = addr;
+                } else {
+                        adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+                }
+        }
        be_roce_map_pci_bars(adapter);
        return 0;
 pci_map_err:
-        dev_err(&adapter->pdev->dev, "Error in mapping PCI BARs\n");
+        dev_err(&pdev->dev, "Error in mapping PCI BARs\n");
        be_unmap_pci_bars(adapter);
        return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 99492b7e3713..78e1ce09b1ab 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1189,13 +1189,12 @@ static void
 fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
 {
        struct  fec_enet_private *fep;
-        struct bufdesc *bdp, *bdp_t;
+        struct bufdesc *bdp;
        unsigned short status;
        struct  sk_buff *skb;
        struct fec_enet_priv_tx_q *txq;
        struct netdev_queue *nq;
        int     index = 0;
-        int     i, bdnum;
        int     entries_free;
        fep = netdev_priv(ndev);
@@ -1216,29 +1215,18 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
                if (bdp == txq->cur_tx)
                        break;
-                bdp_t = bdp;
+                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp, fep);
-                bdnum = 1;
-                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                skb = txq->tx_skbuff[index];
-                while (!skb) {
-                        bdp_t = fec_enet_get_nextdesc(bdp_t, fep, queue_id);
-                        index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                        skb = txq->tx_skbuff[index];
-                        bdnum++;
-                }
-                if (skb_shinfo(skb)->nr_frags &&
-                    (status = bdp_t->cbd_sc) & BD_ENET_TX_READY)
-                        break;
-                for (i = 0; i < bdnum; i++) {
+                skb = txq->tx_skbuff[index];
-                        if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
-                                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                                 bdp->cbd_datlen, DMA_TO_DEVICE);
-                        bdp->cbd_bufaddr = 0;
-                        if (i < bdnum - 1)
-                                bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
-                }
                txq->tx_skbuff[index] = NULL;
+                if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
+                        dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
+                                        bdp->cbd_datlen, DMA_TO_DEVICE);
+                bdp->cbd_bufaddr = 0;
+                if (!skb) {
+                        bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
+                        continue;
+                }
                /* Check for errors. */
                if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
@@ -1479,8 +1467,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                        vlan_packet_rcvd = true;
-                        skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
+                        memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
-                                                       data, (2 * ETH_ALEN));
                        skb_pull(skb, VLAN_HLEN);
                }
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 072426a72745..cd7675ac5bf9 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1136,6 +1136,8 @@ restart_poll:
        ibmveth_replenish_task(adapter);
        if (frames_processed < budget) {
+                napi_complete(napi);
                /* We think we are done - reenable interrupts,
                 * then check once more to make sure we are done.
                 */
@@ -1144,8 +1146,6 @@ restart_poll:
                BUG_ON(lpar_rc != H_SUCCESS);
-                napi_complete(napi);
                if (ibmveth_rxq_pending_buffer(adapter) &&
                    napi_reschedule(napi)) {
                        lpar_rc = h_vio_signal(adapter->vdev->unit_address,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 2a210c4efb89..ebce5bb24df9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1698,8 +1698,6 @@ int mlx4_en_start_port(struct net_device *dev)
        /* Schedule multicast task to populate multicast list */
        queue_work(mdev->workqueue, &priv->rx_mode_task);
-        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
 #ifdef CONFIG_MLX4_EN_VXLAN
        if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                vxlan_get_rx_port(dev);
@@ -2853,6 +2851,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                queue_delayed_work(mdev->workqueue, &priv->service_task,
                                   SERVICE_TASK_DELAY);
+        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
        return 0;
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 2a8268e6be15..ebbe244e80dd 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -453,7 +453,7 @@ struct mlx4_en_port_stats {
        unsigned long rx_chksum_none;
        unsigned long rx_chksum_complete;
        unsigned long tx_chksum_offload;
-#define NUM_PORT_STATS          9
+#define NUM_PORT_STATS          10
 };
 struct mlx4_en_perf_stats {
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 5d093dc0f5f5..8678e39aba08 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2248,10 +2248,9 @@ static int smc_drv_probe(struct platform_device *pdev)
        const struct of_device_id *match = NULL;
        struct smc_local *lp;
        struct net_device *ndev;
-        struct resource *res;
+        struct resource *res, *ires;
        unsigned int __iomem *addr;
        unsigned long irq_flags = SMC_IRQ_FLAGS;
-        unsigned long irq_resflags;
        int ret;
        ndev = alloc_etherdev(sizeof(struct smc_local));
@@ -2343,19 +2342,16 @@ static int smc_drv_probe(struct platform_device *pdev)
                goto out_free_netdev;
        }
-        ndev->irq = platform_get_irq(pdev, 0);
+        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (ndev->irq <= 0) {
+        if (!ires) {
                ret = -ENODEV;
                goto out_release_io;
        }
-        /*
-         * If this platform does not specify any special irqflags, or if
+        ndev->irq = ires->start;
-         * the resource supplies a trigger, override the irqflags with
-         * the trigger flags from the resource.
+        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
-         */
+                irq_flags = ires->flags & IRQF_TRIGGER_MASK;
-        irq_resflags = irqd_get_trigger_type(irq_get_irq_data(ndev->irq));
-        if (irq_flags == -1 || irq_resflags & IRQF_TRIGGER_MASK)
-                irq_flags = irq_resflags & IRQF_TRIGGER_MASK;
        ret = smc_request_attrib(pdev, ndev);
        if (ret)
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index a495931a66a1..0e0fbb5842b3 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -498,9 +498,9 @@ static int w5100_napi_poll(struct napi_struct *napi, int budget)
        }
        if (rx_count < budget) {
+                napi_complete(napi);
                w5100_write(priv, W5100_IMR, IR_S0);
                mmiowb();
-                napi_complete(napi);
        }
        return rx_count;
diff --git a/drivers/net/ethernet/wiznet/w5300.c b/drivers/net/ethernet/wiznet/w5300.c
index 09322d9db578..4b310002258d 100644
--- a/drivers/net/ethernet/wiznet/w5300.c
+++ b/drivers/net/ethernet/wiznet/w5300.c
@@ -418,9 +418,9 @@ static int w5300_napi_poll(struct napi_struct *napi, int budget)
        }
        if (rx_count < budget) {
+                napi_complete(napi);
                w5300_write(priv, W5300_IMR, IR_S0);
                mmiowb();
-                napi_complete(napi);
        }
        return rx_count;
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index 3eed708a6182..1762ad3910b2 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -46,8 +46,7 @@ enum cx82310_status {
 };
 #define CMD_PACKET_SIZE 64
-/* first command after power on can take around 8 seconds */
+#define CMD_TIMEOUT     100
-#define CMD_TIMEOUT     15000
 #define CMD_REPLY_RETRY 5
 #define CX82310_MTU     1514
@@ -78,8 +77,9 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
        ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, CMD_EP), buf,
                           CMD_PACKET_SIZE, &actual_len, CMD_TIMEOUT);
        if (ret < 0) {
-                dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                if (cmd != CMD_GET_LINK_STATUS)
-                        cmd, ret);
+                        dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                                cmd, ret);
                goto end;
        }
@@ -90,8 +90,10 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
                                           buf, CMD_PACKET_SIZE, &actual_len,
                                           CMD_TIMEOUT);
                        if (ret < 0) {
-                                dev_err(&dev->udev->dev,
+                                if (cmd != CMD_GET_LINK_STATUS)
-                                        "reply receive error %d\n", ret);
+                                        dev_err(&dev->udev->dev,
+                                                "reply receive error %d\n",
+                                                ret);
                                goto end;
                        }
                        if (actual_len > 0)
@@ -134,6 +136,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
        int ret;
        char buf[15];
        struct usb_device *udev = dev->udev;
+        u8 link[3];
+        int timeout = 50;
        /* avoid ADSL modems - continue only if iProduct is "USB NET CARD" */
        if (usb_string(udev, udev->descriptor.iProduct, buf, sizeof(buf)) > 0
@@ -160,6 +164,20 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
        if (!dev->partial_data)
                return -ENOMEM;
+        /* wait for firmware to become ready (indicated by the link being up) */
+        while (--timeout) {
+                ret = cx82310_cmd(dev, CMD_GET_LINK_STATUS, true, NULL, 0,
+                                  link, sizeof(link));
+                /* the command can time out during boot - it's not an error */
+                if (!ret && link[0] == 1 && link[2] == 1)
+                        break;
+                msleep(500);
+        };
+        if (!timeout) {
+                dev_err(&udev->dev, "firmware not ready in time\n");
+                return -ETIMEDOUT;
+        }
        /* enable ethernet mode (?) */
        ret = cx82310_cmd(dev, CMD_ETHERNET_MODE, true, "\x01", 1, NULL, 0);
        if (ret) {
@@ -300,9 +318,18 @@ static const struct driver_info	cx82310_info = {
        .tx_fixup       = cx82310_tx_fixup,
 };
+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
+        .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+                       USB_DEVICE_ID_MATCH_DEV_INFO, \
+        .idVendor = (vend), \
+        .idProduct = (prod), \
+        .bDeviceClass = (cl), \
+        .bDeviceSubClass = (sc), \
+        .bDeviceProtocol = (pr)
 static const struct usb_device_id products[] = {
        {
-                USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
+                USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
                .driver_info = (unsigned long) &cx82310_info
        },
        { },
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f1ff3666f090..59b0e9754ae3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1448,8 +1448,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
 {
        int i;
-        for (i = 0; i < vi->max_queue_pairs; i++)
+        for (i = 0; i < vi->max_queue_pairs; i++) {
+                napi_hash_del(&vi->rq[i].napi);
                netif_napi_del(&vi->rq[i].napi);
+        }
        kfree(vi->rq);
        kfree(vi->sq);
@@ -1948,11 +1950,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
        cancel_delayed_work_sync(&vi->refill);
        if (netif_running(vi->dev)) {
-                for (i = 0; i < vi->max_queue_pairs; i++) {
+                for (i = 0; i < vi->max_queue_pairs; i++)
                        napi_disable(&vi->rq[i].napi);
-                        napi_hash_del(&vi->rq[i].napi);
-                        netif_napi_del(&vi->rq[i].napi);
-                }
        }
        remove_vq_common(vi);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 1e0a775ea882..f8528a4cf54f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1218,7 +1218,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                        goto drop;
                flags &= ~VXLAN_HF_RCO;
-                vni &= VXLAN_VID_MASK;
+                vni &= VXLAN_VNI_MASK;
        }
        /* For backwards compatibility, only allow reserved fields to be
@@ -1239,7 +1239,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                flags &= ~VXLAN_GBP_USED_BITS;
        }
-        if (flags || (vni & ~VXLAN_VID_MASK)) {
+        if (flags || vni & ~VXLAN_VNI_MASK) {
                /* If there are any unprocessed flags remaining treat
                 * this as a malformed packet. This behavior diverges from
                 * VXLAN RFC (RFC7348) which stipulates that bits in reserved
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index ccbdb05b28cd..75345c1e8c34 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5370,6 +5370,7 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
        case 0x432a: /* BCM4321 */
        case 0x432d: /* BCM4322 */
        case 0x4352: /* BCM43222 */
+        case 0x435a: /* BCM43228 */
        case 0x4333: /* BCM4331 */
        case 0x43a2: /* BCM4360 */
        case 0x43b3: /* BCM4352 */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 50cdf7090198..8eff2753abad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
        void *dcmd_buf = NULL, *wr_pointer;
        u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
-        brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
+        if (len < sizeof(*cmdhdr)) {
-                  cmdhdr->len);
+                brcmf_err("vendor command too short: %d\n", len);
+                return -EINVAL;
+        }
        vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
        ifp = vif->ifp;
-        len -= sizeof(struct brcmf_vndr_dcmd_hdr);
+        brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
+        if (cmdhdr->offset > len) {
+                brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
+                return -EINVAL;
+        }
+        len -= cmdhdr->offset;
        ret_len = cmdhdr->len;
        if (ret_len > 0 || len > 0) {
                if (len > BRCMF_DCMD_MAXLEN) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index c3817fae16c0..06f6cc08f451 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -95,7 +95,8 @@ static const struct iwl_eeprom_params iwl1000_eeprom_params = {
        .nvm_calib_ver = EEPROM_1000_TX_POWER_VERSION,  \
        .base_params = &iwl1000_base_params,                    \
        .eeprom_params = &iwl1000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl1000_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
@@ -121,7 +122,8 @@ const struct iwl_cfg iwl1000_bg_cfg = {
        .base_params = &iwl1000_base_params,                    \
        .eeprom_params = &iwl1000_eeprom_params,                \
        .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl100_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 100 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 21e5d0843a62..890b95f497d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -123,7 +123,9 @@ static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
        .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,          \
        .base_params = &iwl2000_base_params,                    \
        .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl2000_2bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 2200 BGN",
@@ -149,7 +151,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
        .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
        .base_params = &iwl2030_base_params,                    \
        .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl2030_2bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
@@ -170,7 +173,8 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
        .base_params = &iwl2000_base_params,                    \
        .eeprom_params = &iwl20x0_eeprom_params,                \
        .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl105_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 105 BGN",
@@ -197,7 +201,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
        .base_params = &iwl2030_base_params,                    \
        .eeprom_params = &iwl20x0_eeprom_params,                \
        .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl135_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 135 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 332bbede39e5..724194e23414 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -93,7 +93,8 @@ static const struct iwl_eeprom_params iwl5000_eeprom_params = {
        .nvm_calib_ver = EEPROM_5000_TX_POWER_VERSION,  \
        .base_params = &iwl5000_base_params,                    \
        .eeprom_params = &iwl5000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl5300_agn_cfg = {
        .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
@@ -158,7 +159,8 @@ const struct iwl_cfg iwl5350_agn_cfg = {
        .base_params = &iwl5000_base_params,                    \
        .eeprom_params = &iwl5000_eeprom_params,                \
        .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl5150_agn_cfg = {
        .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 8f2c3c8c6b84..21b2630763dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -145,7 +145,8 @@ static const struct iwl_eeprom_params iwl6000_eeprom_params = {
        .nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION,  \
        .base_params = &iwl6000_g2_base_params,                 \
        .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6005_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N 6205 AGN",
@@ -199,7 +200,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
        .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
        .base_params = &iwl6000_g2_base_params,                 \
        .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6030_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
@@ -235,7 +237,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
        .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
        .base_params = &iwl6000_g2_base_params,                 \
        .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6035_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
@@ -290,7 +293,8 @@ const struct iwl_cfg iwl130_bg_cfg = {
        .nvm_calib_ver = EEPROM_6000_TX_POWER_VERSION,  \
        .base_params = &iwl6000_base_params,                    \
        .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6000i_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
@@ -322,7 +326,8 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
        .base_params = &iwl6050_base_params,                    \
        .eeprom_params = &iwl6000_eeprom_params,                \
        .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6050_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
@@ -347,7 +352,8 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
        .base_params = &iwl6050_base_params,                    \
        .eeprom_params = &iwl6000_eeprom_params,                \
        .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6150_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 1ec4d55155f7..7810c41cf9a7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -793,7 +793,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
        if (!vif->bss_conf.assoc)
                smps_mode = IEEE80211_SMPS_AUTOMATIC;
-        if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+        if (mvmvif->phy_ctxt &&
+            IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
                               mvmvif->phy_ctxt->id))
                smps_mode = IEEE80211_SMPS_AUTOMATIC;
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index d530ef3da107..542ee74f290a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -832,7 +832,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
        if (!vif->bss_conf.assoc)
                smps_mode = IEEE80211_SMPS_AUTOMATIC;
-        if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+        if (mvmvif->phy_ctxt &&
+            data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
                smps_mode = IEEE80211_SMPS_AUTOMATIC;
        IWL_DEBUG_COEX(data->mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 1ff7ec08532d..09654e73a533 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -405,7 +405,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                        &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
-                if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER)
+                if ((mvm->fw->ucode_capa.capa[0] &
+                     IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
+                    (mvm->fw->ucode_capa.api[0] &
+                     IWL_UCODE_TLV_API_LQ_SS_PARAMS))
                        hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
                                IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
        }
@@ -2215,7 +2218,19 @@ static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
        mutex_lock(&mvm->mutex);
-        iwl_mvm_cancel_scan(mvm);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a hw_scan when it's already stopped.  This can
+         * happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_scan_completed() and the userspace called
+         * cancel scan scan before ieee80211_scan_work() could run.
+         * To handle that, simply return if the scan is not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if ((mvm->scan_status == IWL_MVM_SCAN_OS) ||
+            (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN))
+                iwl_mvm_cancel_scan(mvm);
        mutex_unlock(&mvm->mutex);
 }
@@ -2559,12 +2574,29 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
        int ret;
        mutex_lock(&mvm->mutex);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a sched_scan when it's already stopped.  This
+         * can happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_sched_scan_stopped() and the userspace called
+         * stop sched scan scan before ieee80211_sched_scan_stopped_work()
+         * could run.  To handle this, simply return if the scan is
+         * not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
+            !(mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
+                mutex_unlock(&mvm->mutex);
+                return 0;
+        }
        ret = iwl_mvm_scan_offload_stop(mvm, false);
        mutex_unlock(&mvm->mutex);
        iwl_mvm_wait_for_async_handlers(mvm);
        return ret;
 }
 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 194bd1f939ca..efa9688a4cf1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -134,9 +134,12 @@ enum rs_column_mode {
 #define MAX_NEXT_COLUMNS 7
 #define MAX_COLUMN_CHECKS 3
+struct rs_tx_column;
 typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
                                     struct ieee80211_sta *sta,
-                                     struct iwl_scale_tbl_info *tbl);
+                                     struct iwl_scale_tbl_info *tbl,
+                                     const struct rs_tx_column *next_col);
 struct rs_tx_column {
        enum rs_column_mode mode;
@@ -147,13 +150,15 @@ struct rs_tx_column {
 };
 static bool rs_ant_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                         struct iwl_scale_tbl_info *tbl)
+                         struct iwl_scale_tbl_info *tbl,
+                         const struct rs_tx_column *next_col)
 {
-        return iwl_mvm_bt_coex_is_ant_avail(mvm, tbl->rate.ant);
+        return iwl_mvm_bt_coex_is_ant_avail(mvm, next_col->ant);
 }
 static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          struct iwl_scale_tbl_info *tbl)
+                          struct iwl_scale_tbl_info *tbl,
+                          const struct rs_tx_column *next_col)
 {
        if (!sta->ht_cap.ht_supported)
                return false;
@@ -171,7 +176,8 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 }
 static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          struct iwl_scale_tbl_info *tbl)
+                          struct iwl_scale_tbl_info *tbl,
+                          const struct rs_tx_column *next_col)
 {
        if (!sta->ht_cap.ht_supported)
                return false;
@@ -180,7 +186,8 @@ static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 }
 static bool rs_sgi_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                         struct iwl_scale_tbl_info *tbl)
+                         struct iwl_scale_tbl_info *tbl,
+                         const struct rs_tx_column *next_col)
 {
        struct rs_rate *rate = &tbl->rate;
        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
@@ -1590,7 +1597,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
                for (j = 0; j < MAX_COLUMN_CHECKS; j++) {
                        allow_func = next_col->checks[j];
-                        if (allow_func && !allow_func(mvm, sta, tbl))
+                        if (allow_func && !allow_func(mvm, sta, tbl, next_col))
                                break;
                }
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 7e9aa3cb3254..c47c8051da77 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -1128,8 +1128,10 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
                return 0;
-        if (iwl_mvm_is_radio_killed(mvm))
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ret = 0;
                goto out;
+        }
        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
            (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN) ||
@@ -1148,16 +1150,14 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                IWL_DEBUG_SCAN(mvm, "Send stop %sscan failed %d\n",
                               sched ? "offloaded " : "", ret);
                iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
-                return ret;
+                goto out;
        }
        IWL_DEBUG_SCAN(mvm, "Successfully sent stop %sscan\n",
                       sched ? "offloaded " : "");
        ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
-        if (ret)
+out:
-                return ret;
        /*
         * Clear the scan status so the next scan requests will succeed. This
         * also ensures the Rx handler doesn't do anything, as the scan was
@@ -1167,7 +1167,6 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
        if (mvm->scan_status == IWL_MVM_SCAN_OS)
                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
-out:
        mvm->scan_status = IWL_MVM_SCAN_NONE;
        if (notify) {
@@ -1177,7 +1176,7 @@ out:
                        ieee80211_scan_completed(mvm->hw, true);
        }
-        return 0;
+        return ret;
 }
 static void iwl_mvm_unified_scan_fill_tx_cmd(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 54fafbf9a711..f8d6f306dd76 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -750,8 +750,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
         * request
         */
        list_for_each_entry(te_data, &mvm->time_event_list, list) {
-                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
+                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
-                    te_data->running) {
                        mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
                        is_p2p = true;
                        goto remove_te;
@@ -766,10 +765,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
         * request
         */
        list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
-                if (te_data->running) {
+                mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
-                        mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+                goto remove_te;
-                        goto remove_te;
-                }
        }
 remove_te:
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 1d4677460711..074f716020aa 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1386,8 +1386,11 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                }
                return true;
-        } else if (0x86DD == ether_type) {
+        } else if (ETH_P_IPV6 == ether_type) {
-                return true;
+                /* TODO: Handle any IPv6 cases that need special handling.
+                 * For now, always return false
+                 */
+                goto end;
        }
 end:
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index cab9f5257f57..997cf0901ac2 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -96,6 +96,7 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 static void make_tx_response(struct xenvif_queue *queue,
                             struct xen_netif_tx_request *txp,
                             s8       st);
+static void push_tx_responses(struct xenvif_queue *queue);
 static inline int tx_work_todo(struct xenvif_queue *queue);
@@ -655,15 +656,10 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
        unsigned long flags;
        do {
-                int notify;
                spin_lock_irqsave(&queue->response_lock, flags);
                make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
-                RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+                push_tx_responses(queue);
                spin_unlock_irqrestore(&queue->response_lock, flags);
-                if (notify)
-                        notify_remote_via_irq(queue->tx_irq);
                if (cons == end)
                        break;
                txp = RING_GET_REQUEST(&queue->tx, cons++);
@@ -1657,7 +1653,6 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 {
        struct pending_tx_info *pending_tx_info;
        pending_ring_idx_t index;
-        int notify;
        unsigned long flags;
        pending_tx_info = &queue->pending_tx_info[pending_idx];
@@ -1673,12 +1668,9 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
        index = pending_index(queue->pending_prod++);
        queue->pending_ring[index] = pending_idx;
-        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        push_tx_responses(queue);
        spin_unlock_irqrestore(&queue->response_lock, flags);
-        if (notify)
-                notify_remote_via_irq(queue->tx_irq);
 }
@@ -1699,6 +1691,15 @@ static void make_tx_response(struct xenvif_queue *queue,
        queue->tx.rsp_prod_pvt = ++i;
 }
+static void push_tx_responses(struct xenvif_queue *queue)
+{
+        int notify;
+        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        if (notify)
+                notify_remote_via_irq(queue->tx_irq);
+}
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                             u16      id,
                                             s8       st,
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 38d1c51f58b1..7bcaeec876c0 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -84,8 +84,7 @@ config OF_RESOLVE
        bool
 config OF_OVERLAY
-        bool
+        bool "Device Tree overlays"
-        depends on OF
        select OF_DYNAMIC
        select OF_RESOLVE
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 0a8aeb8523fe..8f165b112e03 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -714,16 +714,12 @@ static struct device_node *__of_find_node_by_path(struct device_node *parent,
                                                const char *path)
 {
        struct device_node *child;
-        int len = strchrnul(path, '/') - path;
+        int len;
-        int term;
+        len = strcspn(path, "/:");
        if (!len)
                return NULL;
-        term = strchrnul(path, ':') - path;
-        if (term < len)
-                len = term;
        __for_each_child_of_node(parent, child) {
                const char *name = strrchr(child->full_name, '/');
                if (WARN(!name, "malformed device_node %s\n", child->full_name))
@@ -768,8 +764,12 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
        /* The path could begin with an alias */
        if (*path != '/') {
-                char *p = strchrnul(path, '/');
+                int len;
-                int len = separator ? separator - path : p - path;
+                const char *p = separator;
+                if (!p)
+                        p = strchrnul(path, '/');
+                len = p - path;
                /* of_aliases must not be NULL */
                if (!of_aliases)
@@ -794,6 +794,8 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
                path++; /* Increment past '/' delimiter */
                np = __of_find_node_by_path(np, path);
                path = strchrnul(path, '/');
+                if (separator && separator < path)
+                        break;
        }
        raw_spin_unlock_irqrestore(&devtree_lock, flags);
        return np;
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 0d7765807f49..1a7980692f25 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
        struct device_node *p;
        const __be32 *intspec, *tmp, *addr;
        u32 intsize, intlen;
-        int i, res = -EINVAL;
+        int i, res;
        pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
        /* Get size of interrupt specifier */
        tmp = of_get_property(p, "#interrupt-cells", NULL);
-        if (tmp == NULL)
+        if (tmp == NULL) {
+                res = -EINVAL;
                goto out;
+        }
        intsize = be32_to_cpu(*tmp);
        pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
        /* Check index */
-        if ((index + 1) * intsize > intlen)
+        if ((index + 1) * intsize > intlen) {
+                res = -EINVAL;
                goto out;
+        }
        /* Copy intspec into irq structure */
        intspec += index * intsize;
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 352b4f28f82c..dee9270ba547 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -19,6 +19,7 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/idr.h>
 #include "of_private.h"
@@ -85,7 +86,7 @@ static int of_overlay_apply_single_device_node(struct of_overlay *ov,
                struct device_node *target, struct device_node *child)
 {
        const char *cname;
-        struct device_node *tchild, *grandchild;
+        struct device_node *tchild;
        int ret = 0;
        cname = kbasename(child->full_name);
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 0cf9a236d438..52c45c7df07f 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -92,6 +92,16 @@ static void __init of_selftest_find_node_by_name(void)
                 "option path test failed\n");
        of_node_put(np);
+        np = of_find_node_opts_by_path("/testcase-data:test/option", &options);
+        selftest(np && !strcmp("test/option", options),
+                 "option path test, subcase #1 failed\n");
+        of_node_put(np);
+        np = of_find_node_opts_by_path("/testcase-data/testcase-device1:test/option", &options);
+        selftest(np && !strcmp("test/option", options),
+                 "option path test, subcase #2 failed\n");
+        of_node_put(np);
        np = of_find_node_opts_by_path("/testcase-data:testoption", NULL);
        selftest(np, "NULL option path test failed\n");
        of_node_put(np);
@@ -102,6 +112,12 @@ static void __init of_selftest_find_node_by_name(void)
                 "option alias path test failed\n");
        of_node_put(np);
+        np = of_find_node_opts_by_path("testcase-alias:test/alias/option",
+                                       &options);
+        selftest(np && !strcmp("test/alias/option", options),
+                 "option alias path test, subcase #1 failed\n");
+        of_node_put(np);
        np = of_find_node_opts_by_path("testcase-alias:testaliasoption", NULL);
        selftest(np, "NULL option alias path test failed\n");
        of_node_put(np);
@@ -378,9 +394,9 @@ static void __init of_selftest_property_string(void)
        rc = of_property_match_string(np, "phandle-list-names", "first");
        selftest(rc == 0, "first expected:0 got:%i\n", rc);
        rc = of_property_match_string(np, "phandle-list-names", "second");
-        selftest(rc == 1, "second expected:0 got:%i\n", rc);
+        selftest(rc == 1, "second expected:1 got:%i\n", rc);
        rc = of_property_match_string(np, "phandle-list-names", "third");
-        selftest(rc == 2, "third expected:0 got:%i\n", rc);
+        selftest(rc == 2, "third expected:2 got:%i\n", rc);
        rc = of_property_match_string(np, "phandle-list-names", "fourth");
        selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
        rc = of_property_match_string(np, "missing-property", "blah");
@@ -478,7 +494,6 @@ static void __init of_selftest_changeset(void)
        struct device_node *n1, *n2, *n21, *nremove, *parent, *np;
        struct of_changeset chgset;
-        of_changeset_init(&chgset);
        n1 = __of_node_dup(NULL, "/testcase-data/changeset/n1");
        selftest(n1, "testcase setup failure\n");
        n2 = __of_node_dup(NULL, "/testcase-data/changeset/n2");
@@ -979,7 +994,7 @@ static int of_path_platform_device_exists(const char *path)
        return pdev != NULL;
 }
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
 /* get the i2c client device instantiated at the path */
 static struct i2c_client *of_path_to_i2c_client(const char *path)
@@ -1445,7 +1460,7 @@ static void of_selftest_overlay_11(void)
                return;
 }
-#if IS_ENABLED(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
+#if IS_BUILTIN(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
 struct selftest_i2c_bus_data {
        struct platform_device  *pdev;
@@ -1584,7 +1599,7 @@ static struct i2c_driver selftest_i2c_dev_driver = {
        .id_table = selftest_i2c_dev_id,
 };
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
 struct selftest_i2c_mux_data {
        int nchans;
@@ -1695,7 +1710,7 @@ static int of_selftest_overlay_i2c_init(void)
                        "could not register selftest i2c bus driver\n"))
                return ret;
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
        ret = i2c_add_driver(&selftest_i2c_mux_driver);
        if (selftest(ret == 0,
                        "could not register selftest i2c mux driver\n"))
@@ -1707,7 +1722,7 @@ static int of_selftest_overlay_i2c_init(void)
 static void of_selftest_overlay_i2c_cleanup(void)
 {
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
        i2c_del_driver(&selftest_i2c_mux_driver);
 #endif
        platform_driver_unregister(&selftest_i2c_bus_driver);
@@ -1814,7 +1829,7 @@ static void __init of_selftest_overlay(void)
        of_selftest_overlay_10();
        of_selftest_overlay_11();
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
        if (selftest(of_selftest_overlay_i2c_init() == 0, "i2c init failed\n"))
                goto out;
diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
index aab55474dd0d..ee082c0366ec 100644
--- a/drivers/pci/host/pci-xgene.c
+++ b/drivers/pci/host/pci-xgene.c
@@ -127,7 +127,7 @@ static bool xgene_pcie_hide_rc_bars(struct pci_bus *bus, int offset)
        return false;
 }
-static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
+static void __iomem *xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                              int offset)
 {
        struct xgene_pcie_port *port = bus->sysdata;
@@ -137,7 +137,7 @@ static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                return NULL;
        xgene_pcie_set_rtdid_reg(bus, devfn);
-        return xgene_pcie_get_cfg_base(bus);
+        return xgene_pcie_get_cfg_base(bus) + offset;
 }
 static struct pci_ops xgene_pcie_ops = {
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index aa012fb3834b..312f23a8429c 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -521,7 +521,8 @@ static ssize_t driver_override_store(struct device *dev,
        struct pci_dev *pdev = to_pci_dev(dev);
        char *driver_override, *old = pdev->driver_override, *cp;
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                return -EINVAL;
        driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -549,7 +550,7 @@ static ssize_t driver_override_show(struct device *dev,
 {
        struct pci_dev *pdev = to_pci_dev(dev);
-        return sprintf(buf, "%s\n", pdev->driver_override);
+        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
 }
 static DEVICE_ATTR_RW(driver_override);
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index 3bb49252a098..45f67c63d385 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -69,8 +69,7 @@ config YENTA
        tristate "CardBus yenta-compatible bridge support"
        depends on PCI
        select CARDBUS if !EXPERT
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
+        select PCCARD_NONSTATIC if PCMCIA != n
-        select PCCARD_PCI if PCMCIA !=n && !ISA
        ---help---
          This option enables support for CardBus host bridges.  Virtually
          all modern PCMCIA bridges are CardBus compatible.  A "bridge" is
@@ -110,8 +109,7 @@ config YENTA_TOSHIBA
 config PD6729
        tristate "Cirrus PD6729 compatible bridge support"
        depends on PCMCIA && PCI
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
+        select PCCARD_NONSTATIC
-        select PCCARD_PCI if PCMCIA !=n && !ISA
        help
          This provides support for the Cirrus PD6729 PCI-to-PCMCIA bridge
          device, found in some older laptops and PCMCIA card readers.
@@ -119,8 +117,7 @@ config PD6729
 config I82092
        tristate "i82092 compatible bridge support"
        depends on PCMCIA && PCI
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
+        select PCCARD_NONSTATIC
-        select PCCARD_PCI if PCMCIA !=n && !ISA
        help
          This provides support for the Intel I82092AA PCI-to-PCMCIA bridge device,
          found in some older laptops and more commonly in evaluation boards for the
@@ -291,9 +288,6 @@ config ELECTRA_CF
          Say Y here to support the CompactFlash controller on the
          PA Semi Electra eval board.
-config PCCARD_PCI
-        bool
 config PCCARD_NONSTATIC
        bool
diff --git a/drivers/pcmcia/Makefile b/drivers/pcmcia/Makefile
index f1a7ca04d89e..27e94b30cf96 100644
--- a/drivers/pcmcia/Makefile
+++ b/drivers/pcmcia/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_PCMCIA)				+= pcmcia.o
 pcmcia_rsrc-y                                   += rsrc_mgr.o
 pcmcia_rsrc-$(CONFIG_PCCARD_NONSTATIC)          += rsrc_nonstatic.o
 pcmcia_rsrc-$(CONFIG_PCCARD_IODYN)              += rsrc_iodyn.o
-pcmcia_rsrc-$(CONFIG_PCCARD_PCI)                += rsrc_pci.o
 obj-$(CONFIG_PCCARD)                            += pcmcia_rsrc.o
diff --git a/drivers/pcmcia/rsrc_pci.c b/drivers/pcmcia/rsrc_pci.c
deleted file mode 100644
index 1f67b3ba70fb..000000000000
--- a/drivers/pcmcia/rsrc_pci.c
+++ /dev/null
@@ -1,173 +0,0 @@
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/pci.h>
-#include <pcmcia/ss.h>
-#include <pcmcia/cistpl.h>
-#include "cs_internal.h"
-struct pcmcia_align_data {
-        unsigned long   mask;
-        unsigned long   offset;
-};
-static resource_size_t pcmcia_align(void *align_data,
-                                const struct resource *res,
-                                resource_size_t size, resource_size_t align)
-{
-        struct pcmcia_align_data *data = align_data;
-        resource_size_t start;
-        start = (res->start & ~data->mask) + data->offset;
-        if (start < res->start)
-                start += data->mask + 1;
-        return start;
-}
-static struct resource *find_io_region(struct pcmcia_socket *s,
-                                        unsigned long base, int num,
-                                        unsigned long align)
-{
-        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_IO,
-                                                dev_name(&s->dev));
-        struct pcmcia_align_data data;
-        int ret;
-        data.mask = align - 1;
-        data.offset = base & data.mask;
-        ret = pci_bus_alloc_resource(s->cb_dev->bus, res, num, 1,
-                                             base, 0, pcmcia_align, &data);
-        if (ret != 0) {
-                kfree(res);
-                res = NULL;
-        }
-        return res;
-}
-static int res_pci_find_io(struct pcmcia_socket *s, unsigned int attr,
-                        unsigned int *base, unsigned int num,
-                        unsigned int align, struct resource **parent)
-{
-        int i, ret = 0;
-        /* Check for an already-allocated window that must conflict with
-         * what was asked for.  It is a hack because it does not catch all
-         * potential conflicts, just the most obvious ones.
-         */
-        for (i = 0; i < MAX_IO_WIN; i++) {
-                if (!s->io[i].res)
-                        continue;
-                if (!*base)
-                        continue;
-                if ((s->io[i].res->start & (align-1)) == *base)
-                        return -EBUSY;
-        }
-        for (i = 0; i < MAX_IO_WIN; i++) {
-                struct resource *res = s->io[i].res;
-                unsigned int try;
-                if (res && (res->flags & IORESOURCE_BITS) !=
-                        (attr & IORESOURCE_BITS))
-                        continue;
-                if (!res) {
-                        if (align == 0)
-                                align = 0x10000;
-                        res = s->io[i].res = find_io_region(s, *base, num,
-                                                                align);
-                        if (!res)
-                                return -EINVAL;
-                        *base = res->start;
-                        s->io[i].res->flags =
-                                ((res->flags & ~IORESOURCE_BITS) |
-                                        (attr & IORESOURCE_BITS));
-                        s->io[i].InUse = num;
-                        *parent = res;
-                        return 0;
-                }
-                /* Try to extend top of window */
-                try = res->end + 1;
-                if ((*base == 0) || (*base == try)) {
-                        ret = adjust_resource(s->io[i].res, res->start,
-                                              resource_size(res) + num);
-                        if (ret)
-                                continue;
-                        *base = try;
-                        s->io[i].InUse += num;
-                        *parent = res;
-                        return 0;
-                }
-                /* Try to extend bottom of window */
-                try = res->start - num;
-                if ((*base == 0) || (*base == try)) {
-                        ret = adjust_resource(s->io[i].res,
-                                              res->start - num,
-                                              resource_size(res) + num);
-                        if (ret)
-                                continue;
-                        *base = try;
-                        s->io[i].InUse += num;
-                        *parent = res;
-                        return 0;
-                }
-        }
-        return -EINVAL;
-}
-static struct resource *res_pci_find_mem(u_long base, u_long num,
-                u_long align, int low, struct pcmcia_socket *s)
-{
-        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_MEM,
-                                                dev_name(&s->dev));
-        struct pcmcia_align_data data;
-        unsigned long min;
-        int ret;
-        if (align < 0x20000)
-                align = 0x20000;
-        data.mask = align - 1;
-        data.offset = base & data.mask;
-        min = 0;
-        if (!low)
-                min = 0x100000UL;
-        ret = pci_bus_alloc_resource(s->cb_dev->bus,
-                        res, num, 1, min, 0,
-                        pcmcia_align, &data);
-        if (ret != 0) {
-                kfree(res);
-                res = NULL;
-        }
-        return res;
-}
-static int res_pci_init(struct pcmcia_socket *s)
-{
-        if (!s->cb_dev || !(s->features & SS_CAP_PAGE_REGS)) {
-                dev_err(&s->dev, "not supported by res_pci\n");
-                return -EOPNOTSUPP;
-        }
-        return 0;
-}
-struct pccard_resource_ops pccard_nonstatic_ops = {
-        .validate_mem = NULL,
-        .find_io = res_pci_find_io,
-        .find_mem = res_pci_find_mem,
-        .init = res_pci_init,
-        .exit = NULL,
-};
-EXPORT_SYMBOL(pccard_nonstatic_ops);
diff --git a/drivers/phy/phy-armada375-usb2.c b/drivers/phy/phy-armada375-usb2.c
index 7c99ca256f05..8ccc3952c13d 100644
--- a/drivers/phy/phy-armada375-usb2.c
+++ b/drivers/phy/phy-armada375-usb2.c
@@ -37,7 +37,7 @@ static int armada375_usb_phy_init(struct phy *phy)
        struct armada375_cluster_phy *cluster_phy;
        u32 reg;
-        cluster_phy = dev_get_drvdata(phy->dev.parent);
+        cluster_phy = phy_get_drvdata(phy);
        if (!cluster_phy)
                return -ENODEV;
@@ -131,6 +131,7 @@ static int armada375_usb_phy_probe(struct platform_device *pdev)
        cluster_phy->reg = usb_cluster_base;
        dev_set_drvdata(dev, cluster_phy);
+        phy_set_drvdata(phy, cluster_phy);
        phy_provider = devm_of_phy_provider_register(&pdev->dev,
                                                     armada375_usb_phy_xlate);
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index a12d35338313..3791838f4bd4 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -52,7 +52,9 @@ static void devm_phy_consume(struct device *dev, void *res)
 static int devm_phy_match(struct device *dev, void *res, void *match_data)
 {
-        return res == match_data;
+        struct phy **phy = res;
+        return *phy == match_data;
 }
 /**
@@ -223,6 +225,7 @@ int phy_init(struct phy *phy)
        ret = phy_pm_runtime_get_sync(phy);
        if (ret < 0 && ret != -ENOTSUPP)
                return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
        mutex_lock(&phy->mutex);
        if (phy->init_count == 0 && phy->ops->init) {
@@ -231,8 +234,6 @@ int phy_init(struct phy *phy)
                        dev_err(&phy->dev, "phy init failed --> %d\n", ret);
                        goto out;
                }
-        } else {
-                ret = 0; /* Override possible ret == -ENOTSUPP */
        }
        ++phy->init_count;
@@ -253,6 +254,7 @@ int phy_exit(struct phy *phy)
        ret = phy_pm_runtime_get_sync(phy);
        if (ret < 0 && ret != -ENOTSUPP)
                return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
        mutex_lock(&phy->mutex);
        if (phy->init_count == 1 && phy->ops->exit) {
@@ -287,6 +289,7 @@ int phy_power_on(struct phy *phy)
        ret = phy_pm_runtime_get_sync(phy);
        if (ret < 0 && ret != -ENOTSUPP)
                return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
        mutex_lock(&phy->mutex);
        if (phy->power_count == 0 && phy->ops->power_on) {
@@ -295,8 +298,6 @@ int phy_power_on(struct phy *phy)
                        dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
                        goto out;
                }
-        } else {
-                ret = 0; /* Override possible ret == -ENOTSUPP */
        }
        ++phy->power_count;
        mutex_unlock(&phy->mutex);
diff --git a/drivers/phy/phy-exynos-dp-video.c b/drivers/phy/phy-exynos-dp-video.c
index f86cbe68ddaf..179cbf9451aa 100644
--- a/drivers/phy/phy-exynos-dp-video.c
+++ b/drivers/phy/phy-exynos-dp-video.c
@@ -30,28 +30,13 @@ struct exynos_dp_video_phy {
        const struct exynos_dp_video_phy_drvdata *drvdata;
 };
-static void exynos_dp_video_phy_pwr_isol(struct exynos_dp_video_phy *state,
-                                                        unsigned int on)
-{
-        unsigned int val;
-        if (IS_ERR(state->regs))
-                return;
-        val = on ? 0 : EXYNOS5_PHY_ENABLE;
-        regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
-                           EXYNOS5_PHY_ENABLE, val);
-}
 static int exynos_dp_video_phy_power_on(struct phy *phy)
 {
        struct exynos_dp_video_phy *state = phy_get_drvdata(phy);
        /* Disable power isolation on DP-PHY */
-        exynos_dp_video_phy_pwr_isol(state, 0);
+        return regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
+                                  EXYNOS5_PHY_ENABLE, EXYNOS5_PHY_ENABLE);
-        return 0;
 }
 static int exynos_dp_video_phy_power_off(struct phy *phy)
@@ -59,9 +44,8 @@ static int exynos_dp_video_phy_power_off(struct phy *phy)
        struct exynos_dp_video_phy *state = phy_get_drvdata(phy);
        /* Enable power isolation on DP-PHY */
-        exynos_dp_video_phy_pwr_isol(state, 1);
+        return regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
+                                  EXYNOS5_PHY_ENABLE, 0);
-        return 0;
 }
 static struct phy_ops exynos_dp_video_phy_ops = {
diff --git a/drivers/phy/phy-exynos-mipi-video.c b/drivers/phy/phy-exynos-mipi-video.c
index f017b2f2a54e..df7519a39ba0 100644
--- a/drivers/phy/phy-exynos-mipi-video.c
+++ b/drivers/phy/phy-exynos-mipi-video.c
@@ -43,7 +43,6 @@ struct exynos_mipi_video_phy {
        } phys[EXYNOS_MIPI_PHYS_NUM];
        spinlock_t slock;
        void __iomem *regs;
-        struct mutex mutex;
        struct regmap *regmap;
 };
@@ -59,8 +58,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
        else
                reset = EXYNOS4_MIPI_PHY_SRESETN;
-        if (state->regmap) {
+        spin_lock(&state->slock);
-                mutex_lock(&state->mutex);
+        if (!IS_ERR(state->regmap)) {
                regmap_read(state->regmap, offset, &val);
                if (on)
                        val |= reset;
@@ -72,11 +72,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
                else if (!(val & EXYNOS4_MIPI_PHY_RESET_MASK))
                        val &= ~EXYNOS4_MIPI_PHY_ENABLE;
                regmap_write(state->regmap, offset, val);
-                mutex_unlock(&state->mutex);
        } else {
                addr = state->regs + EXYNOS_MIPI_PHY_CONTROL(id / 2);
-                spin_lock(&state->slock);
                val = readl(addr);
                if (on)
                        val |= reset;
@@ -90,9 +88,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
                        val &= ~EXYNOS4_MIPI_PHY_ENABLE;
                writel(val, addr);
-                spin_unlock(&state->slock);
        }
+        spin_unlock(&state->slock);
        return 0;
 }
@@ -158,7 +156,6 @@ static int exynos_mipi_video_phy_probe(struct platform_device *pdev)
        dev_set_drvdata(dev, state);
        spin_lock_init(&state->slock);
-        mutex_init(&state->mutex);
        for (i = 0; i < EXYNOS_MIPI_PHYS_NUM; i++) {
                struct phy *phy = devm_phy_create(dev, NULL,
diff --git a/drivers/phy/phy-exynos4210-usb2.c b/drivers/phy/phy-exynos4210-usb2.c
index 236a52ad94eb..f30bbb0fb3b2 100644
--- a/drivers/phy/phy-exynos4210-usb2.c
+++ b/drivers/phy/phy-exynos4210-usb2.c
@@ -250,7 +250,6 @@ static const struct samsung_usb2_common_phy exynos4210_phys[] = {
                .power_on       = exynos4210_power_on,
                .power_off      = exynos4210_power_off,
        },
-        {},
 };
 const struct samsung_usb2_phy_config exynos4210_usb2_phy_config = {
diff --git a/drivers/phy/phy-exynos4x12-usb2.c b/drivers/phy/phy-exynos4x12-usb2.c
index 0b9de88579b1..765da90a536f 100644
--- a/drivers/phy/phy-exynos4x12-usb2.c
+++ b/drivers/phy/phy-exynos4x12-usb2.c
@@ -361,7 +361,6 @@ static const struct samsung_usb2_common_phy exynos4x12_phys[] = {
                .power_on       = exynos4x12_power_on,
                .power_off      = exynos4x12_power_off,
        },
-        {},
 };
 const struct samsung_usb2_phy_config exynos3250_usb2_phy_config = {
diff --git a/drivers/phy/phy-exynos5-usbdrd.c b/drivers/phy/phy-exynos5-usbdrd.c
index 04374018425f..e2a0be750ad9 100644
--- a/drivers/phy/phy-exynos5-usbdrd.c
+++ b/drivers/phy/phy-exynos5-usbdrd.c
@@ -531,7 +531,7 @@ static struct phy *exynos5_usbdrd_phy_xlate(struct device *dev,
 {
        struct exynos5_usbdrd_phy *phy_drd = dev_get_drvdata(dev);
-        if (WARN_ON(args->args[0] > EXYNOS5_DRDPHYS_NUM))
+        if (WARN_ON(args->args[0] >= EXYNOS5_DRDPHYS_NUM))
                return ERR_PTR(-ENODEV);
        return phy_drd->phys[args->args[0]].phy;
diff --git a/drivers/phy/phy-exynos5250-usb2.c b/drivers/phy/phy-exynos5250-usb2.c
index 1c139aa0d074..2ed1735a076a 100644
--- a/drivers/phy/phy-exynos5250-usb2.c
+++ b/drivers/phy/phy-exynos5250-usb2.c
@@ -391,7 +391,6 @@ static const struct samsung_usb2_common_phy exynos5250_phys[] = {
                .power_on       = exynos5250_power_on,
                .power_off      = exynos5250_power_off,
        },
-        {},
 };
 const struct samsung_usb2_phy_config exynos5250_usb2_phy_config = {
diff --git a/drivers/phy/phy-hix5hd2-sata.c b/drivers/phy/phy-hix5hd2-sata.c
index 34915b4202f1..d6b22659cac1 100644
--- a/drivers/phy/phy-hix5hd2-sata.c
+++ b/drivers/phy/phy-hix5hd2-sata.c
@@ -147,6 +147,9 @@ static int hix5hd2_sata_phy_probe(struct platform_device *pdev)
                return -ENOMEM;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
        priv->base = devm_ioremap(dev, res->start, resource_size(res));
        if (!priv->base)
                return -ENOMEM;
diff --git a/drivers/phy/phy-miphy28lp.c b/drivers/phy/phy-miphy28lp.c
index 9b2848e6115d..933435214acc 100644
--- a/drivers/phy/phy-miphy28lp.c
+++ b/drivers/phy/phy-miphy28lp.c
@@ -228,6 +228,7 @@ struct miphy28lp_dev {
        struct regmap *regmap;
        struct mutex miphy_mutex;
        struct miphy28lp_phy **phys;
+        int nphys;
 };
 struct miphy_initval {
@@ -1116,7 +1117,7 @@ static struct phy *miphy28lp_xlate(struct device *dev,
                return ERR_PTR(-EINVAL);
        }
-        for (index = 0; index < of_get_child_count(dev->of_node); index++)
+        for (index = 0; index < miphy_dev->nphys; index++)
                if (phynode == miphy_dev->phys[index]->phy->dev.of_node) {
                        miphy_phy = miphy_dev->phys[index];
                        break;
@@ -1138,6 +1139,7 @@ static struct phy *miphy28lp_xlate(struct device *dev,
 static struct phy_ops miphy28lp_ops = {
        .init = miphy28lp_init,
+        .owner = THIS_MODULE,
 };
 static int miphy28lp_probe_resets(struct device_node *node,
@@ -1200,16 +1202,15 @@ static int miphy28lp_probe(struct platform_device *pdev)
        struct miphy28lp_dev *miphy_dev;
        struct phy_provider *provider;
        struct phy *phy;
-        int chancount, port = 0;
+        int ret, port = 0;
-        int ret;
        miphy_dev = devm_kzalloc(&pdev->dev, sizeof(*miphy_dev), GFP_KERNEL);
        if (!miphy_dev)
                return -ENOMEM;
-        chancount = of_get_child_count(np);
+        miphy_dev->nphys = of_get_child_count(np);
-        miphy_dev->phys = devm_kzalloc(&pdev->dev, sizeof(phy) * chancount,
+        miphy_dev->phys = devm_kcalloc(&pdev->dev, miphy_dev->nphys,
-                                       GFP_KERNEL);
+                                       sizeof(*miphy_dev->phys), GFP_KERNEL);
        if (!miphy_dev->phys)
                return -ENOMEM;
diff --git a/drivers/phy/phy-miphy365x.c b/drivers/phy/phy-miphy365x.c
index 6c80154e8bff..51b459db9137 100644
--- a/drivers/phy/phy-miphy365x.c
+++ b/drivers/phy/phy-miphy365x.c
@@ -150,6 +150,7 @@ struct miphy365x_dev {
        struct regmap *regmap;
        struct mutex miphy_mutex;
        struct miphy365x_phy **phys;
+        int nphys;
 };
 /*
@@ -485,7 +486,7 @@ static struct phy *miphy365x_xlate(struct device *dev,
                return ERR_PTR(-EINVAL);
        }
-        for (index = 0; index < of_get_child_count(dev->of_node); index++)
+        for (index = 0; index < miphy_dev->nphys; index++)
                if (phynode == miphy_dev->phys[index]->phy->dev.of_node) {
                        miphy_phy = miphy_dev->phys[index];
                        break;
@@ -541,16 +542,15 @@ static int miphy365x_probe(struct platform_device *pdev)
        struct miphy365x_dev *miphy_dev;
        struct phy_provider *provider;
        struct phy *phy;
-        int chancount, port = 0;
+        int ret, port = 0;
-        int ret;
        miphy_dev = devm_kzalloc(&pdev->dev, sizeof(*miphy_dev), GFP_KERNEL);
        if (!miphy_dev)
                return -ENOMEM;
-        chancount = of_get_child_count(np);
+        miphy_dev->nphys = of_get_child_count(np);
-        miphy_dev->phys = devm_kzalloc(&pdev->dev, sizeof(phy) * chancount,
+        miphy_dev->phys = devm_kcalloc(&pdev->dev, miphy_dev->nphys,
-                                       GFP_KERNEL);
+                                       sizeof(*miphy_dev->phys), GFP_KERNEL);
        if (!miphy_dev->phys)
                return -ENOMEM;
diff --git a/drivers/phy/phy-omap-control.c b/drivers/phy/phy-omap-control.c
index efe724f97e02..93252e053a31 100644
--- a/drivers/phy/phy-omap-control.c
+++ b/drivers/phy/phy-omap-control.c
@@ -360,7 +360,7 @@ static void __exit omap_control_phy_exit(void)
 }
 module_exit(omap_control_phy_exit);
-MODULE_ALIAS("platform: omap_control_phy");
+MODULE_ALIAS("platform:omap_control_phy");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("OMAP Control Module PHY Driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index 6f4aef3db248..4757e765696a 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -296,10 +296,11 @@ static int omap_usb2_probe(struct platform_device *pdev)
                        dev_warn(&pdev->dev,
                                 "found usb_otg_ss_refclk960m, please fix DTS\n");
                }
-        } else {
-                clk_prepare(phy->optclk);
        }
+        if (!IS_ERR(phy->optclk))
+                clk_prepare(phy->optclk);
        usb_add_phy_dev(&phy->phy);
        return 0;
@@ -383,7 +384,7 @@ static struct platform_driver omap_usb2_driver = {
 module_platform_driver(omap_usb2_driver);
-MODULE_ALIAS("platform: omap_usb2");
+MODULE_ALIAS("platform:omap_usb2");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("OMAP USB2 phy driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-rockchip-usb.c b/drivers/phy/phy-rockchip-usb.c
index 22011c3b6a4b..7d4c33643768 100644
--- a/drivers/phy/phy-rockchip-usb.c
+++ b/drivers/phy/phy-rockchip-usb.c
@@ -61,8 +61,6 @@ static int rockchip_usb_phy_power_off(struct phy *_phy)
                return ret;
        clk_disable_unprepare(phy->clk);
-        if (ret)
-                return ret;
        return 0;
 }
@@ -78,8 +76,10 @@ static int rockchip_usb_phy_power_on(struct phy *_phy)
        /* Power up usb phy analog blocks by set siddq 0 */
        ret = rockchip_usb_phy_power(phy, 0);
-        if (ret)
+        if (ret) {
+                clk_disable_unprepare(phy->clk);
                return ret;
+        }
        return 0;
 }
diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
index 95c88f929f27..2ba610b72ca2 100644
--- a/drivers/phy/phy-ti-pipe3.c
+++ b/drivers/phy/phy-ti-pipe3.c
@@ -165,15 +165,11 @@ static int ti_pipe3_dpll_wait_lock(struct ti_pipe3 *phy)
                cpu_relax();
                val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_STATUS);
                if (val & PLL_LOCK)
-                        break;
+                        return 0;
        } while (!time_after(jiffies, timeout));
-        if (!(val & PLL_LOCK)) {
+        dev_err(phy->dev, "DPLL failed to lock\n");
-                dev_err(phy->dev, "DPLL failed to lock\n");
+        return -EBUSY;
-                return -EBUSY;
-        }
-        return 0;
 }
 static int ti_pipe3_dpll_program(struct ti_pipe3 *phy)
@@ -608,7 +604,7 @@ static struct platform_driver ti_pipe3_driver = {
 module_platform_driver(ti_pipe3_driver);
-MODULE_ALIAS("platform: ti_pipe3");
+MODULE_ALIAS("platform:ti_pipe3");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("TI PIPE3 phy driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 8e87f54671f3..bc42d6a8939f 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -666,7 +666,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)
        twl->dev                = &pdev->dev;
        twl->irq                = platform_get_irq(pdev, 0);
        twl->vbus_supplied      = false;
-        twl->linkstat           = -EINVAL;
        twl->linkstat           = OMAP_MUSB_UNKNOWN;
        twl->phy.dev            = twl->dev;
diff --git a/drivers/phy/phy-xgene.c b/drivers/phy/phy-xgene.c
index 29214a36ea28..2263cd010032 100644
--- a/drivers/phy/phy-xgene.c
+++ b/drivers/phy/phy-xgene.c
@@ -1704,7 +1704,6 @@ static int xgene_phy_probe(struct platform_device *pdev)
        for (i = 0; i < MAX_LANE; i++)
                ctx->sata_param.speed[i] = 2; /* Default to Gen3 */
-        ctx->dev = &pdev->dev;
        platform_set_drvdata(pdev, ctx);
        ctx->phy = devm_phy_create(ctx->dev, NULL, &xgene_phy_ops);
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 5afe03e28b91..2062c224e32f 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -66,6 +66,10 @@
 #define BYT_DIR_MASK            (BIT(1) | BIT(2))
 #define BYT_TRIG_MASK           (BIT(26) | BIT(25) | BIT(24))
+#define BYT_CONF0_RESTORE_MASK  (BYT_DIRECT_IRQ_EN | BYT_TRIG_MASK | \
+                                 BYT_PIN_MUX)
+#define BYT_VAL_RESTORE_MASK    (BYT_DIR_MASK | BYT_LEVEL)
 #define BYT_NGPIO_SCORE         102
 #define BYT_NGPIO_NCORE         28
 #define BYT_NGPIO_SUS           44
@@ -134,12 +138,18 @@ static struct pinctrl_gpio_range byt_ranges[] = {
        },
 };
+struct byt_gpio_pin_context {
+        u32 conf0;
+        u32 val;
+};
 struct byt_gpio {
        struct gpio_chip                chip;
        struct platform_device          *pdev;
        spinlock_t                      lock;
        void __iomem                    *reg_base;
        struct pinctrl_gpio_range       *range;
+        struct byt_gpio_pin_context     *saved_context;
 };
 #define to_byt_gpio(c)  container_of(c, struct byt_gpio, chip)
@@ -158,40 +168,62 @@ static void __iomem *byt_gpio_reg(struct gpio_chip *chip, unsigned offset,
        return vg->reg_base + reg_offset + reg;
 }
-static bool is_special_pin(struct byt_gpio *vg, unsigned offset)
+static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned offset)
+{
+        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        unsigned long flags;
+        u32 value;
+        spin_lock_irqsave(&vg->lock, flags);
+        value = readl(reg);
+        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+        writel(value, reg);
+        spin_unlock_irqrestore(&vg->lock, flags);
+}
+static u32 byt_get_gpio_mux(struct byt_gpio *vg, unsigned offset)
 {
        /* SCORE pin 92-93 */
        if (!strcmp(vg->range->name, BYT_SCORE_ACPI_UID) &&
                offset >= 92 && offset <= 93)
-                return true;
+                return 1;
        /* SUS pin 11-21 */
        if (!strcmp(vg->range->name, BYT_SUS_ACPI_UID) &&
                offset >= 11 && offset <= 21)
-                return true;
+                return 1;
-        return false;
+        return 0;
 }
 static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 {
        struct byt_gpio *vg = to_byt_gpio(chip);
        void __iomem *reg = byt_gpio_reg(chip, offset, BYT_CONF0_REG);
-        u32 value;
+        u32 value, gpio_mux;
-        bool special;
        /*
         * In most cases, func pin mux 000 means GPIO function.
         * But, some pins may have func pin mux 001 represents
-         * GPIO function. Only allow user to export pin with
+         * GPIO function.
-         * func pin mux preset as GPIO function by BIOS/FW.
+         *
+         * Because there are devices out there where some pins were not
+         * configured correctly we allow changing the mux value from
+         * request (but print out warning about that).
         */
        value = readl(reg) & BYT_PIN_MUX;
-        special = is_special_pin(vg, offset);
+        gpio_mux = byt_get_gpio_mux(vg, offset);
-        if ((special && value != 1) || (!special && value)) {
+        if (WARN_ON(gpio_mux != value)) {
-                dev_err(&vg->pdev->dev,
+                unsigned long flags;
-                        "pin %u cannot be used as GPIO.\n", offset);
-                return -EINVAL;
+                spin_lock_irqsave(&vg->lock, flags);
+                value = readl(reg) & ~BYT_PIN_MUX;
+                value |= gpio_mux;
+                writel(value, reg);
+                spin_unlock_irqrestore(&vg->lock, flags);
+                dev_warn(&vg->pdev->dev,
+                         "pin %u forcibly re-configured as GPIO\n", offset);
        }
        pm_runtime_get(&vg->pdev->dev);
@@ -202,14 +234,8 @@ static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 static void byt_gpio_free(struct gpio_chip *chip, unsigned offset)
 {
        struct byt_gpio *vg = to_byt_gpio(chip);
-        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
-        u32 value;
-        /* clear interrupt triggering */
-        value = readl(reg);
-        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
-        writel(value, reg);
+        byt_gpio_clear_triggering(vg, offset);
        pm_runtime_put(&vg->pdev->dev);
 }
@@ -236,23 +262,13 @@ static int byt_irq_type(struct irq_data *d, unsigned type)
        value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
                   BYT_TRIG_LVL);
-        switch (type) {
-        case IRQ_TYPE_LEVEL_HIGH:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_RISING:
-                value |= BYT_TRIG_POS;
-                break;
-        case IRQ_TYPE_LEVEL_LOW:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_FALLING:
-                value |= BYT_TRIG_NEG;
-                break;
-        case IRQ_TYPE_EDGE_BOTH:
-                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
-                break;
-        }
        writel(value, reg);
+        if (type & IRQ_TYPE_EDGE_BOTH)
+                __irq_set_handler_locked(d->irq, handle_edge_irq);
+        else if (type & IRQ_TYPE_LEVEL_MASK)
+                __irq_set_handler_locked(d->irq, handle_level_irq);
        spin_unlock_irqrestore(&vg->lock, flags);
        return 0;
@@ -410,58 +426,80 @@ static void byt_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
        struct irq_data *data = irq_desc_get_irq_data(desc);
        struct byt_gpio *vg = to_byt_gpio(irq_desc_get_handler_data(desc));
        struct irq_chip *chip = irq_data_get_irq_chip(data);
-        u32 base, pin, mask;
+        u32 base, pin;
        void __iomem *reg;
-        u32 pending;
+        unsigned long pending;
        unsigned virq;
-        int looplimit = 0;
        /* check from GPIO controller which pin triggered the interrupt */
        for (base = 0; base < vg->chip.ngpio; base += 32) {
                reg = byt_gpio_reg(&vg->chip, base, BYT_INT_STAT_REG);
+                pending = readl(reg);
-                while ((pending = readl(reg))) {
+                for_each_set_bit(pin, &pending, 32) {
-                        pin = __ffs(pending);
-                        mask = BIT(pin);
-                        /* Clear before handling so we can't lose an edge */
-                        writel(mask, reg);
                        virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
                        generic_handle_irq(virq);
-                        /* In case bios or user sets triggering incorretly a pin
-                         * might remain in "interrupt triggered" state.
-                         */
-                        if (looplimit++ > 32) {
-                                dev_err(&vg->pdev->dev,
-                                        "Gpio %d interrupt flood, disabling\n",
-                                        base + pin);
-                                reg = byt_gpio_reg(&vg->chip, base + pin,
-                                                   BYT_CONF0_REG);
-                                mask = readl(reg);
-                                mask &= ~(BYT_TRIG_NEG | BYT_TRIG_POS |
-                                          BYT_TRIG_LVL);
-                                writel(mask, reg);
-                                mask = readl(reg); /* flush */
-                                break;
-                        }
                }
        }
        chip->irq_eoi(data);
 }
+static void byt_irq_ack(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        void __iomem *reg;
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_INT_STAT_REG);
+        writel(BIT(offset % 32), reg);
+}
 static void byt_irq_unmask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        unsigned long flags;
+        void __iomem *reg;
+        u32 value;
+        spin_lock_irqsave(&vg->lock, flags);
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        value = readl(reg);
+        switch (irqd_get_trigger_type(d)) {
+        case IRQ_TYPE_LEVEL_HIGH:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_RISING:
+                value |= BYT_TRIG_POS;
+                break;
+        case IRQ_TYPE_LEVEL_LOW:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_FALLING:
+                value |= BYT_TRIG_NEG;
+                break;
+        case IRQ_TYPE_EDGE_BOTH:
+                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
+                break;
+        }
+        writel(value, reg);
+        spin_unlock_irqrestore(&vg->lock, flags);
 }
 static void byt_irq_mask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        byt_gpio_clear_triggering(vg, irqd_to_hwirq(d));
 }
 static struct irq_chip byt_irqchip = {
        .name = "BYT-GPIO",
+        .irq_ack = byt_irq_ack,
        .irq_mask = byt_irq_mask,
        .irq_unmask = byt_irq_unmask,
        .irq_set_type = byt_irq_type,
@@ -472,6 +510,21 @@ static void byt_gpio_irq_init_hw(struct byt_gpio *vg)
 {
        void __iomem *reg;
        u32 base, value;
+        int i;
+        /*
+         * Clear interrupt triggers for all pins that are GPIOs and
+         * do not use direct IRQ mode. This will prevent spurious
+         * interrupts from misconfigured pins.
+         */
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                value = readl(byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG));
+                if ((value & BYT_PIN_MUX) == byt_get_gpio_mux(vg, i) &&
+                    !(value & BYT_DIRECT_IRQ_EN)) {
+                        byt_gpio_clear_triggering(vg, i);
+                        dev_dbg(&vg->pdev->dev, "disabling GPIO %d\n", i);
+                }
+        }
        /* clear interrupt status trigger registers */
        for (base = 0; base < vg->chip.ngpio; base += 32) {
@@ -541,6 +594,11 @@ static int byt_gpio_probe(struct platform_device *pdev)
        gc->can_sleep = false;
        gc->dev = dev;
+#ifdef CONFIG_PM_SLEEP
+        vg->saved_context = devm_kcalloc(&pdev->dev, gc->ngpio,
+                                       sizeof(*vg->saved_context), GFP_KERNEL);
+#endif
        ret = gpiochip_add(gc);
        if (ret) {
                dev_err(&pdev->dev, "failed adding byt-gpio chip\n");
@@ -569,6 +627,69 @@ static int byt_gpio_probe(struct platform_device *pdev)
        return 0;
 }
+#ifdef CONFIG_PM_SLEEP
+static int byt_gpio_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg) & BYT_CONF0_RESTORE_MASK;
+                vg->saved_context[i].conf0 = value;
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg) & BYT_VAL_RESTORE_MASK;
+                vg->saved_context[i].val = value;
+        }
+        return 0;
+}
+static int byt_gpio_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg);
+                if ((value & BYT_CONF0_RESTORE_MASK) !=
+                     vg->saved_context[i].conf0) {
+                        value &= ~BYT_CONF0_RESTORE_MASK;
+                        value |= vg->saved_context[i].conf0;
+                        writel(value, reg);
+                        dev_info(dev, "restored pin %d conf0 %#08x", i, value);
+                }
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg);
+                if ((value & BYT_VAL_RESTORE_MASK) !=
+                     vg->saved_context[i].val) {
+                        u32 v;
+                        v = value & ~BYT_VAL_RESTORE_MASK;
+                        v |= vg->saved_context[i].val;
+                        if (v != value) {
+                                writel(v, reg);
+                                dev_dbg(dev, "restored pin %d val %#08x\n",
+                                        i, v);
+                        }
+                }
+        }
+        return 0;
+}
+#endif
 static int byt_gpio_runtime_suspend(struct device *dev)
 {
        return 0;
@@ -580,8 +701,9 @@ static int byt_gpio_runtime_resume(struct device *dev)
 }
 static const struct dev_pm_ops byt_gpio_pm_ops = {
-        .runtime_suspend = byt_gpio_runtime_suspend,
+        SET_LATE_SYSTEM_SLEEP_PM_OPS(byt_gpio_suspend, byt_gpio_resume)
-        .runtime_resume = byt_gpio_runtime_resume,
+        SET_RUNTIME_PM_OPS(byt_gpio_runtime_suspend, byt_gpio_runtime_resume,
+                           NULL)
 };
 static const struct acpi_device_id byt_gpio_acpi_match[] = {
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 3034fd03bced..82f691eeeec4 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1226,6 +1226,7 @@ static int chv_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 static int chv_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
                                     int value)
 {
+        chv_gpio_set(chip, offset, value);
        return pinctrl_gpio_direction_output(chip->base + offset);
 }
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index f4cd0b9b2438..a4814066ea08 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1477,28 +1477,25 @@ static void gpio_irq_ack(struct irq_data *d)
        /* the interrupt is already cleared before by reading ISR */
 }
-static unsigned int gpio_irq_startup(struct irq_data *d)
+static int gpio_irq_request_res(struct irq_data *d)
 {
        struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
        unsigned        pin = d->hwirq;
        int ret;
        ret = gpiochip_lock_as_irq(&at91_gpio->chip, pin);
-        if (ret) {
+        if (ret)
                dev_err(at91_gpio->chip.dev, "unable to lock pind %lu IRQ\n",
                        d->hwirq);
-                return ret;
-        }
+        return ret;
-        gpio_irq_unmask(d);
-        return 0;
 }
-static void gpio_irq_shutdown(struct irq_data *d)
+static void gpio_irq_release_res(struct irq_data *d)
 {
        struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
        unsigned        pin = d->hwirq;
-        gpio_irq_mask(d);
        gpiochip_unlock_as_irq(&at91_gpio->chip, pin);
 }
@@ -1577,8 +1574,8 @@ void at91_pinctrl_gpio_resume(void)
 static struct irq_chip gpio_irqchip = {
        .name           = "GPIO",
        .irq_ack        = gpio_irq_ack,
-        .irq_startup    = gpio_irq_startup,
+        .irq_request_resources = gpio_irq_request_res,
-        .irq_shutdown   = gpio_irq_shutdown,
+        .irq_release_resources = gpio_irq_release_res,
        .irq_disable    = gpio_irq_mask,
        .irq_mask       = gpio_irq_mask,
        .irq_unmask     = gpio_irq_unmask,
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
index 24c5d88f943f..3c68a8e5e0dd 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
@@ -1011,6 +1011,7 @@ static const struct sunxi_pinctrl_desc sun4i_a10_pinctrl_data = {
        .pins = sun4i_a10_pins,
        .npins = ARRAY_SIZE(sun4i_a10_pins),
        .irq_banks = 1,
+        .irq_read_needs_mux = true,
 };
 static int sun4i_a10_pinctrl_probe(struct platform_device *pdev)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 3d0744337736..f8e171b76693 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -29,6 +29,7 @@
 #include <linux/slab.h>
 #include "../core.h"
+#include "../../gpio/gpiolib.h"
 #include "pinctrl-sunxi.h"
 static struct irq_chip sunxi_pinctrl_edge_irq_chip;
@@ -464,10 +465,19 @@ static int sunxi_pinctrl_gpio_direction_input(struct gpio_chip *chip,
 static int sunxi_pinctrl_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
        struct sunxi_pinctrl *pctl = dev_get_drvdata(chip->dev);
        u32 reg = sunxi_data_reg(offset);
        u8 index = sunxi_data_offset(offset);
-        u32 val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+        u32 set_mux = pctl->desc->irq_read_needs_mux &&
+                        test_bit(FLAG_USED_AS_IRQ, &chip->desc[offset].flags);
+        u32 val;
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_INPUT);
+        val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_IRQ);
        return val;
 }
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index 5a51523a3459..e248e81a0f9e 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -77,6 +77,9 @@
 #define IRQ_LEVEL_LOW           0x03
 #define IRQ_EDGE_BOTH           0x04
+#define SUN4I_FUNC_INPUT        0
+#define SUN4I_FUNC_IRQ          6
 struct sunxi_desc_function {
        const char      *name;
        u8              muxval;
@@ -94,6 +97,7 @@ struct sunxi_pinctrl_desc {
        int                             npins;
        unsigned                        pin_base;
        unsigned                        irq_banks;
+        bool                            irq_read_needs_mux;
 };
 struct sunxi_pinctrl_function {
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index 97b5e4ee1ca4..63d4033eb683 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -73,7 +73,7 @@
 #define TIME_WINDOW_MAX_MSEC 40000
 #define TIME_WINDOW_MIN_MSEC 250
+#define ENERGY_UNIT_SCALE    1000 /* scale from driver unit to powercap unit */
 enum unit_type {
        ARBITRARY_UNIT, /* no translation */
        POWER_UNIT,
@@ -158,6 +158,7 @@ struct rapl_domain {
        struct rapl_power_limit rpl[NR_POWER_LIMITS];
        u64 attr_map; /* track capabilities */
        unsigned int state;
+        unsigned int domain_energy_unit;
        int package_id;
 };
 #define power_zone_to_rapl_domain(_zone) \
@@ -190,6 +191,7 @@ struct rapl_defaults {
        void (*set_floor_freq)(struct rapl_domain *rd, bool mode);
        u64 (*compute_time_window)(struct rapl_package *rp, u64 val,
                                bool to_raw);
+        unsigned int dram_domain_energy_unit;
 };
 static struct rapl_defaults *rapl_defaults;
@@ -227,7 +229,8 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
 static int rapl_write_data_raw(struct rapl_domain *rd,
                        enum rapl_primitives prim,
                        unsigned long long value);
-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
+                        enum unit_type type, u64 value,
                        int to_raw);
 static void package_power_limit_irq_save(int package_id);
@@ -305,7 +308,9 @@ static int get_energy_counter(struct powercap_zone *power_zone, u64 *energy_raw)
 static int get_max_energy_counter(struct powercap_zone *pcd_dev, u64 *energy)
 {
-        *energy = rapl_unit_xlate(0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
+        struct rapl_domain *rd = power_zone_to_rapl_domain(pcd_dev);
+        *energy = rapl_unit_xlate(rd, 0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
        return 0;
 }
@@ -639,6 +644,11 @@ static void rapl_init_domains(struct rapl_package *rp)
                        rd->msrs[4] = MSR_DRAM_POWER_INFO;
                        rd->rpl[0].prim_id = PL1_ENABLE;
                        rd->rpl[0].name = pl1_name;
+                        rd->domain_energy_unit =
+                                rapl_defaults->dram_domain_energy_unit;
+                        if (rd->domain_energy_unit)
+                                pr_info("DRAM domain energy unit %dpj\n",
+                                        rd->domain_energy_unit);
                        break;
                }
                if (mask) {
@@ -648,11 +658,13 @@ static void rapl_init_domains(struct rapl_package *rp)
        }
 }
-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
+                        enum unit_type type, u64 value,
                        int to_raw)
 {
        u64 units = 1;
        struct rapl_package *rp;
+        u64 scale = 1;
        rp = find_package_by_id(package);
        if (!rp)
@@ -663,7 +675,12 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
                units = rp->power_unit;
                break;
        case ENERGY_UNIT:
-                units = rp->energy_unit;
+                scale = ENERGY_UNIT_SCALE;
+                /* per domain unit takes precedence */
+                if (rd && rd->domain_energy_unit)
+                        units = rd->domain_energy_unit;
+                else
+                        units = rp->energy_unit;
                break;
        case TIME_UNIT:
                return rapl_defaults->compute_time_window(rp, value, to_raw);
@@ -673,11 +690,11 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
        };
        if (to_raw)
-                return div64_u64(value, units);
+                return div64_u64(value, units) * scale;
        value *= units;
-        return value;
+        return div64_u64(value, scale);
 }
 /* in the order of enum rapl_primitives */
@@ -773,7 +790,7 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
        final = value & rp->mask;
        final = final >> rp->shift;
        if (xlate)
-                *data = rapl_unit_xlate(rd->package_id, rp->unit, final, 0);
+                *data = rapl_unit_xlate(rd, rd->package_id, rp->unit, final, 0);
        else
                *data = final;
@@ -799,7 +816,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
                        "failed to read msr 0x%x on cpu %d\n", msr, cpu);
                return -EIO;
        }
-        value = rapl_unit_xlate(rd->package_id, rp->unit, value, 1);
+        value = rapl_unit_xlate(rd, rd->package_id, rp->unit, value, 1);
        msr_val &= ~rp->mask;
        msr_val |= value << rp->shift;
        if (wrmsrl_safe_on_cpu(cpu, msr, msr_val)) {
@@ -818,7 +835,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
 * calculate units differ on different CPUs.
 * We convert the units to below format based on CPUs.
 * i.e.
- * energy unit: microJoules : Represented in microJoules by default
+ * energy unit: picoJoules  : Represented in picoJoules by default
 * power unit : microWatts  : Represented in milliWatts by default
 * time unit  : microseconds: Represented in seconds by default
 */
@@ -834,7 +851,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
        }
        value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit = 1000000 / (1 << value);
+        rp->energy_unit = ENERGY_UNIT_SCALE * 1000000 / (1 << value);
        value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
        rp->power_unit = 1000000 / (1 << value);
@@ -842,7 +859,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
        value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
        rp->time_unit = 1000000 / (1 << value);
-        pr_debug("Core CPU package %d energy=%duJ, time=%dus, power=%duW\n",
+        pr_debug("Core CPU package %d energy=%dpJ, time=%dus, power=%duW\n",
                rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
        return 0;
@@ -859,7 +876,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
                return -ENODEV;
        }
        value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit = 1 << value;
+        rp->energy_unit = ENERGY_UNIT_SCALE * 1 << value;
        value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
        rp->power_unit = (1 << value) * 1000;
@@ -867,7 +884,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
        value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
        rp->time_unit = 1000000 / (1 << value);
-        pr_debug("Atom package %d energy=%duJ, time=%dus, power=%duW\n",
+        pr_debug("Atom package %d energy=%dpJ, time=%dus, power=%duW\n",
                rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
        return 0;
@@ -1017,6 +1034,13 @@ static const struct rapl_defaults rapl_defaults_core = {
        .compute_time_window = rapl_compute_time_window_core,
 };
+static const struct rapl_defaults rapl_defaults_hsw_server = {
+        .check_unit = rapl_check_unit_core,
+        .set_floor_freq = set_floor_freq_default,
+        .compute_time_window = rapl_compute_time_window_core,
+        .dram_domain_energy_unit = 15300,
+};
 static const struct rapl_defaults rapl_defaults_atom = {
        .check_unit = rapl_check_unit_atom,
        .set_floor_freq = set_floor_freq_atom,
@@ -1037,7 +1061,7 @@ static const struct x86_cpu_id rapl_ids[] = {
        RAPL_CPU(0x3a, rapl_defaults_core),/* Ivy Bridge */
        RAPL_CPU(0x3c, rapl_defaults_core),/* Haswell */
        RAPL_CPU(0x3d, rapl_defaults_core),/* Broadwell */
-        RAPL_CPU(0x3f, rapl_defaults_core),/* Haswell */
+        RAPL_CPU(0x3f, rapl_defaults_hsw_server),/* Haswell servers */
        RAPL_CPU(0x45, rapl_defaults_core),/* Haswell ULT */
        RAPL_CPU(0x4C, rapl_defaults_atom),/* Braswell */
        RAPL_CPU(0x4A, rapl_defaults_atom),/* Tangier */
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 1245dca79009..a4a8a6dc60c4 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1839,10 +1839,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
        }
        if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, true);
+                if (!rdev->ena_gpio_state) {
-                if (ret < 0)
+                        ret = regulator_ena_gpio_ctrl(rdev, true);
-                        return ret;
+                        if (ret < 0)
-                rdev->ena_gpio_state = 1;
+                                return ret;
+                        rdev->ena_gpio_state = 1;
+                }
        } else if (rdev->desc->ops->enable) {
                ret = rdev->desc->ops->enable(rdev);
                if (ret < 0)
@@ -1939,10 +1941,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
        trace_regulator_disable(rdev_get_name(rdev));
        if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, false);
+                if (rdev->ena_gpio_state) {
-                if (ret < 0)
+                        ret = regulator_ena_gpio_ctrl(rdev, false);
-                        return ret;
+                        if (ret < 0)
-                rdev->ena_gpio_state = 0;
+                                return ret;
+                        rdev->ena_gpio_state = 0;
+                }
        } else if (rdev->desc->ops->disable) {
                ret = rdev->desc->ops->disable(rdev);
@@ -3626,12 +3630,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
                                 config->ena_gpio, ret);
                        goto wash;
                }
-                if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-                        rdev->ena_gpio_state = 1;
-                if (config->ena_gpio_invert)
-                        rdev->ena_gpio_state = !rdev->ena_gpio_state;
        }
        /* set regulator constraints */
@@ -3800,9 +3798,11 @@ int regulator_suspend_finish(void)
        list_for_each_entry(rdev, &regulator_list, list) {
                mutex_lock(&rdev->mutex);
                if (rdev->use_count > 0  || rdev->constraints->always_on) {
-                        error = _regulator_do_enable(rdev);
+                        if (!_regulator_is_enabled(rdev)) {
-                        if (error)
+                                error = _regulator_do_enable(rdev);
-                                ret = error;
+                                if (error)
+                                        ret = error;
+                        }
                } else {
                        if (!have_full_constraints())
                                goto unlock;
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 9205f433573c..18198316b6cf 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -1572,6 +1572,10 @@ static int palmas_regulators_probe(struct platform_device *pdev)
        if (!pmic)
                return -ENOMEM;
+        if (of_device_is_compatible(node, "ti,tps659038-pmic"))
+                palmas_generic_regs_info[PALMAS_REG_REGEN2].ctrl_addr =
+                                                        TPS659038_REGEN2_CTRL;
        pmic->dev = &pdev->dev;
        pmic->palmas = palmas;
        palmas->pmic = pmic;
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index e2cffe01b807..fb991ec76423 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -17,6 +17,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/err.h>
+#include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 92f6af6da699..73354ee27877 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -951,6 +951,7 @@ static int rpmsg_probe(struct virtio_device *vdev)
        void *bufs_va;
        int err = 0, i;
        size_t total_buf_space;
+        bool notify;
        vrp = kzalloc(sizeof(*vrp), GFP_KERNEL);
        if (!vrp)
@@ -1030,8 +1031,22 @@ static int rpmsg_probe(struct virtio_device *vdev)
                }
        }
+        /*
+         * Prepare to kick but don't notify yet - we can't do this before
+         * device is ready.
+         */
+        notify = virtqueue_kick_prepare(vrp->rvq);
+        /* From this point on, we can notify and get callbacks. */
+        virtio_device_ready(vdev);
        /* tell the remote processor it can start sending messages */
-        virtqueue_kick(vrp->rvq);
+        /*
+         * this might be concurrent with callbacks, but we are only
+         * doing notify, not a full kick here, so that's ok.
+         */
+        if (notify)
+                virtqueue_notify(vrp->rvq);
        dev_info(&vdev->dev, "rpmsg host is online\n");
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index b4f7744f6751..b283a1a573b3 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -324,7 +324,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
                ret = IRQ_HANDLED;
        }
-        spin_lock(&suspended_lock);
+        spin_unlock(&suspended_lock);
        return ret;
 }
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 4241eeab3386..f4cf6851fae9 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443_rtc_data = {
 static struct s3c_rtc_data const s3c6410_rtc_data = {
        .max_user_freq          = 32768,
+        .needs_src_clk          = true,
        .irq_handler            = s3c6410_rtc_irq,
        .set_freq               = s3c6410_rtc_setfreq,
        .enable_tick            = s3c6410_rtc_enable_tick,
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 9219953ee949..d9afc51af7d3 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6815,7 +6815,8 @@ static struct ata_port_operations ipr_sata_ops = {
 };
 static struct ata_port_info sata_port_info = {
-        .flags          = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA,
+        .flags          = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
+                          ATA_FLAG_SAS_HOST,
        .pio_mask       = ATA_PIO4_ONLY,
        .mwdma_mask     = ATA_MWDMA2,
        .udma_mask      = ATA_UDMA6,
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 932d9cc98d2f..9c706d8c1441 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -547,7 +547,8 @@ static struct ata_port_operations sas_sata_ops = {
 };
 static struct ata_port_info sata_port_info = {
-        .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | ATA_FLAG_NCQ,
+        .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | ATA_FLAG_NCQ |
+                 ATA_FLAG_SAS_HOST,
        .pio_mask = ATA_PIO4,
        .mwdma_mask = ATA_MWDMA2,
        .udma_mask = ATA_UDMA6,
diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
index 62b58d38ce2e..60de66252fa2 100644
--- a/drivers/scsi/libsas/sas_discover.c
+++ b/drivers/scsi/libsas/sas_discover.c
@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
        struct sas_discovery_event *ev = to_sas_discovery_event(work);
        struct asd_sas_port *port = ev->port;
        struct sas_ha_struct *ha = port->ha;
+        struct domain_device *ddev = port->port_dev;
        /* prevent revalidation from finding sata links in recovery */
        mutex_lock(&ha->disco_mutex);
@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
        SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
                    task_pid_nr(current));
-        if (port->port_dev)
+        if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
-                res = sas_ex_revalidate_domain(port->port_dev);
+                     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
+                res = sas_ex_revalidate_domain(ddev);
        SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
                    port->id, task_pid_nr(current), res);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 99f43b7fc9ab..ab4879e12ea7 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -1596,7 +1596,7 @@ static int tcm_qla2xxx_check_initiator_node_acl(
        /*
         * Finally register the new FC Nexus with TCM
         */
-        __transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+        transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
        return 0;
 }
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index 3ce39d10fafb..4f8c798e0633 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -108,7 +108,8 @@ static void dw_spi_dma_tx_done(void *arg)
 {
        struct dw_spi *dws = arg;
-        if (test_and_clear_bit(TX_BUSY, &dws->dma_chan_busy) & BIT(RX_BUSY))
+        clear_bit(TX_BUSY, &dws->dma_chan_busy);
+        if (test_bit(RX_BUSY, &dws->dma_chan_busy))
                return;
        dw_spi_xfer_done(dws);
 }
@@ -156,7 +157,8 @@ static void dw_spi_dma_rx_done(void *arg)
 {
        struct dw_spi *dws = arg;
-        if (test_and_clear_bit(RX_BUSY, &dws->dma_chan_busy) & BIT(TX_BUSY))
+        clear_bit(RX_BUSY, &dws->dma_chan_busy);
+        if (test_bit(TX_BUSY, &dws->dma_chan_busy))
                return;
        dw_spi_xfer_done(dws);
 }
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index ff9cdbdb6672..2b2c359f5a50 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -498,7 +498,7 @@ static int spi_qup_probe(struct platform_device *pdev)
        struct resource *res;
        struct device *dev;
        void __iomem *base;
-        u32 max_freq, iomode;
+        u32 max_freq, iomode, num_cs;
        int ret, irq, size;
        dev = &pdev->dev;
@@ -550,10 +550,11 @@ static int spi_qup_probe(struct platform_device *pdev)
        }
        /* use num-cs unless not present or out of range */
-        if (of_property_read_u16(dev->of_node, "num-cs",
+        if (of_property_read_u32(dev->of_node, "num-cs", &num_cs) ||
-                        &master->num_chipselect) ||
+            num_cs > SPI_NUM_CHIPSELECTS)
-                        (master->num_chipselect > SPI_NUM_CHIPSELECTS))
                master->num_chipselect = SPI_NUM_CHIPSELECTS;
+        else
+                master->num_chipselect = num_cs;
        master->bus_num = pdev->id;
        master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index c64a3e59fce3..57a195041dc7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1105,13 +1105,14 @@ void spi_finalize_current_message(struct spi_master *master)
                                "failed to unprepare message: %d\n", ret);
                }
        }
+        trace_spi_message_done(mesg);
        master->cur_msg_prepared = false;
        mesg->state = NULL;
        if (mesg->complete)
                mesg->complete(mesg->context);
-        trace_spi_message_done(mesg);
 }
 EXPORT_SYMBOL_GPL(spi_finalize_current_message);
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 4324282afe49..03b2a90b9ac0 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -330,16 +330,6 @@ static void device_init_registers(struct vnt_private *pDevice)
        /* zonetype initial */
        pDevice->byOriginalZonetype = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
-        /* Get RFType */
-        pDevice->byRFType = SROMbyReadEmbedded(pDevice->PortOffset, EEP_OFS_RFTYPE);
-        /* force change RevID for VT3253 emu */
-        if ((pDevice->byRFType & RF_EMU) != 0)
-                        pDevice->byRevId = 0x80;
-        pDevice->byRFType &= RF_MASK;
-        pr_debug("pDevice->byRFType = %x\n", pDevice->byRFType);
        if (!pDevice->bZoneRegExist)
                pDevice->byZoneType = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
@@ -1187,12 +1177,14 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
 {
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
        PSTxDesc head_td;
-        u32 dma_idx = TYPE_AC0DMA;
+        u32 dma_idx;
        unsigned long flags;
        spin_lock_irqsave(&priv->lock, flags);
-        if (!ieee80211_is_data(hdr->frame_control))
+        if (ieee80211_is_data(hdr->frame_control))
+                dma_idx = TYPE_AC0DMA;
+        else
                dma_idx = TYPE_TXDMA0;
        if (AVAIL_TD(priv, dma_idx) < 1) {
@@ -1206,6 +1198,9 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
        head_td->pTDInfo->skb = skb;
+        if (dma_idx == TYPE_AC0DMA)
+                head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
        priv->iTDUsed[dma_idx]++;
        /* Take ownership */
@@ -1234,13 +1229,10 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
        head_td->buff_addr = cpu_to_le32(head_td->pTDInfo->skb_dma);
-        if (dma_idx == TYPE_AC0DMA) {
+        if (head_td->pTDInfo->byFlags & TD_FLAGS_NETIF_SKB)
-                head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
                MACvTransmitAC0(priv->PortOffset);
-        } else {
+        else
                MACvTransmit0(priv->PortOffset);
-        }
        spin_unlock_irqrestore(&priv->lock, flags);
@@ -1778,6 +1770,12 @@ vt6655_probe(struct pci_dev *pcid, const struct pci_device_id *ent)
        MACvInitialize(priv->PortOffset);
        MACvReadEtherAddress(priv->PortOffset, priv->abyCurrentNetAddr);
+        /* Get RFType */
+        priv->byRFType = SROMbyReadEmbedded(priv->PortOffset, EEP_OFS_RFTYPE);
+        priv->byRFType &= RF_MASK;
+        dev_dbg(&pcid->dev, "RF Type = %x\n", priv->byRFType);
        device_get_options(priv);
        device_set_options(priv);
        /* Mask out the options cannot be set to the chip */
diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
index 941b2adca95a..7626f635f160 100644
--- a/drivers/staging/vt6655/rf.c
+++ b/drivers/staging/vt6655/rf.c
@@ -794,6 +794,7 @@ bool RFbSetPower(
                break;
        case RATE_6M:
        case RATE_9M:
+        case RATE_12M:
        case RATE_18M:
                byPwr = priv->abyOFDMPwrTbl[uCH];
                if (priv->byRFType == RF_UW2452)
diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
index c42cde59f598..c4286ccac320 100644
--- a/drivers/staging/vt6656/rf.c
+++ b/drivers/staging/vt6656/rf.c
@@ -640,6 +640,7 @@ int vnt_rf_setpower(struct vnt_private *priv, u32 rate, u32 channel)
                break;
        case RATE_6M:
        case RATE_9M:
+        case RATE_12M:
        case RATE_18M:
        case RATE_24M:
        case RATE_36M:
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 50bad55a0c42..2accb6e47beb 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4256,11 +4256,17 @@ int iscsit_close_connection(
        pr_debug("Closing iSCSI connection CID %hu on SID:"
                " %u\n", conn->cid, sess->sid);
        /*
-         * Always up conn_logout_comp just in case the RX Thread is sleeping
+         * Always up conn_logout_comp for the traditional TCP case just in case
-         * and the logout response never got sent because the connection
+         * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
-         * failed.
+         * response never got sent because the connection failed.
+         *
+         * However for iser-target, isert_wait4logout() is using conn_logout_comp
+         * to signal logout response TX interrupt completion.  Go ahead and skip
+         * this for iser since isert_rx_opcode() does not wait on logout failure,
+         * and to avoid iscsi_conn pointer dereference in iser-target code.
         */
-        complete(&conn->conn_logout_comp);
+        if (conn->conn_transport->transport_type == ISCSI_TCP)
+                complete(&conn->conn_logout_comp);
        iscsi_release_thread_set(conn);
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 1c197bad6132..bdd8731a4daa 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -22,7 +22,6 @@
 #include <target/target_core_fabric.h>
 #include <target/iscsi/iscsi_target_core.h>
-#include <target/iscsi/iscsi_transport.h>
 #include "iscsi_target_seq_pdu_list.h"
 #include "iscsi_target_tq.h"
 #include "iscsi_target_erl0.h"
@@ -940,8 +939,7 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
        if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
                spin_unlock_bh(&conn->state_lock);
-                if (conn->conn_transport->transport_type == ISCSI_TCP)
+                iscsit_close_connection(conn);
-                        iscsit_close_connection(conn);
                return;
        }
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 6b3c32954689..c36bd7c29136 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -953,11 +953,8 @@ static int tcm_loop_make_nexus(
                transport_free_session(tl_nexus->se_sess);
                goto out;
        }
-        /*
+        /* Now, register the SAS I_T Nexus as active. */
-         * Now, register the SAS I_T Nexus as active with the call to
+        transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
-         * transport_register_session()
-         */
-        __transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
                        tl_nexus->se_sess, tl_nexus);
        tl_tpg->tl_nexus = tl_nexus;
        pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated"
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 58f49ff69b14..79b4ec3ca2db 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -650,6 +650,18 @@ static u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)
        return aligned_max_sectors;
 }
+bool se_dev_check_wce(struct se_device *dev)
+{
+        bool wce = false;
+        if (dev->transport->get_write_cache)
+                wce = dev->transport->get_write_cache(dev);
+        else if (dev->dev_attrib.emulate_write_cache > 0)
+                wce = true;
+        return wce;
+}
 int se_dev_set_max_unmap_lba_count(
        struct se_device *dev,
        u32 max_unmap_lba_count)
@@ -767,6 +779,16 @@ int se_dev_set_emulate_fua_write(struct se_device *dev, int flag)
                pr_err("Illegal value %d\n", flag);
                return -EINVAL;
        }
+        if (flag &&
+            dev->transport->get_write_cache) {
+                pr_err("emulate_fua_write not supported for this device\n");
+                return -EINVAL;
+        }
+        if (dev->export_count) {
+                pr_err("emulate_fua_write cannot be changed with active"
+                       " exports: %d\n", dev->export_count);
+                return -EINVAL;
+        }
        dev->dev_attrib.emulate_fua_write = flag;
        pr_debug("dev[%p]: SE Device Forced Unit Access WRITEs: %d\n",
                        dev, dev->dev_attrib.emulate_fua_write);
@@ -801,7 +823,11 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
                pr_err("emulate_write_cache not supported for this device\n");
                return -EINVAL;
        }
+        if (dev->export_count) {
+                pr_err("emulate_write_cache cannot be changed with active"
+                       " exports: %d\n", dev->export_count);
+                return -EINVAL;
+        }
        dev->dev_attrib.emulate_write_cache = flag;
        pr_debug("dev[%p]: SE Device WRITE_CACHE_EMULATION flag: %d\n",
                        dev, dev->dev_attrib.emulate_write_cache);
@@ -1534,8 +1560,6 @@ int target_configure_device(struct se_device *dev)
        ret = dev->transport->configure_device(dev);
        if (ret)
                goto out;
-        dev->dev_flags |= DF_CONFIGURED;
        /*
         * XXX: there is not much point to have two different values here..
         */
@@ -1597,6 +1621,8 @@ int target_configure_device(struct se_device *dev)
        list_add_tail(&dev->g_dev_node, &g_device_list);
        mutex_unlock(&g_device_mutex);
+        dev->dev_flags |= DF_CONFIGURED;
        return 0;
 out_free_alua:
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 1045dcd7bf65..f6c954c4635f 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -1121,7 +1121,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
        struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
        struct scsi_device *sd = pdv->pdv_sd;
-        return sd->type;
+        return (sd) ? sd->type : TYPE_NO_LUN;
 }
 static sector_t pscsi_get_blocks(struct se_device *dev)
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 9a2f9d3a6e70..3e7297411110 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -708,8 +708,7 @@ sbc_check_dpofua(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb)
                }
        }
        if (cdb[1] & 0x8) {
-                if (!dev->dev_attrib.emulate_fua_write ||
+                if (!dev->dev_attrib.emulate_fua_write || !se_dev_check_wce(dev)) {
-                    !dev->dev_attrib.emulate_write_cache) {
                        pr_err("Got CDB: 0x%02x with FUA bit set, but device"
                               " does not advertise support for FUA write\n",
                               cdb[0]);
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 460e93109473..6c8bd6bc175c 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -454,19 +454,6 @@ check_scsi_name:
 }
 EXPORT_SYMBOL(spc_emulate_evpd_83);
-static bool
-spc_check_dev_wce(struct se_device *dev)
-{
-        bool wce = false;
-        if (dev->transport->get_write_cache)
-                wce = dev->transport->get_write_cache(dev);
-        else if (dev->dev_attrib.emulate_write_cache > 0)
-                wce = true;
-        return wce;
-}
 /* Extended INQUIRY Data VPD Page */
 static sense_reason_t
 spc_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
@@ -490,7 +477,7 @@ spc_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
        buf[5] = 0x07;
        /* If WriteCache emulation is enabled, set V_SUP */
-        if (spc_check_dev_wce(dev))
+        if (se_dev_check_wce(dev))
                buf[6] = 0x01;
        /* If an LBA map is present set R_SUP */
        spin_lock(&cmd->se_dev->t10_alua.lba_map_lock);
@@ -897,7 +884,7 @@ static int spc_modesense_caching(struct se_cmd *cmd, u8 pc, u8 *p)
        if (pc == 1)
                goto out;
-        if (spc_check_dev_wce(dev))
+        if (se_dev_check_wce(dev))
                p[2] = 0x04; /* Write Cache Enable */
        p[12] = 0x20; /* Disabled Read Ahead */
@@ -1009,7 +996,7 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
             (cmd->se_deve->lun_flags & TRANSPORT_LUNFLAGS_READ_ONLY)))
                spc_modesense_write_protect(&buf[length], type);
-        if ((spc_check_dev_wce(dev)) &&
+        if ((se_dev_check_wce(dev)) &&
            (dev->dev_attrib.emulate_fua_write > 0))
                spc_modesense_dpofua(&buf[length], type);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 0adc0f650213..ac3cbabdbdf0 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2389,6 +2389,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
        list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
 out:
        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+        if (ret && ack_kref)
+                target_put_sess_cmd(se_sess, se_cmd);
        return ret;
 }
 EXPORT_SYMBOL(target_get_sess_cmd);
diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
index 97b486c3dda1..583e755d8091 100644
--- a/drivers/target/tcm_fc/tfc_io.c
+++ b/drivers/target/tcm_fc/tfc_io.c
@@ -359,7 +359,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
                ep = fc_seq_exch(seq);
                if (ep) {
                        lport = ep->lp;
-                        if (lport && (ep->xid <= lport->lro_xid))
+                        if (lport && (ep->xid <= lport->lro_xid)) {
                                /*
                                 * "ddp_done" trigger invalidation of HW
                                 * specific DDP context
@@ -374,6 +374,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
                                 * identified using ep->xid)
                                 */
                                cmd->was_ddp_setup = 0;
+                        }
                }
        }
 }
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 2ab229ddee38..6ae5b8560e4d 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -119,7 +119,10 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
                        dw8250_force_idle(p);
                        writeb(value, p->membase + (UART_LCR << p->regshift));
                }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
        }
 }
@@ -163,7 +166,10 @@ static void dw8250_serial_outq(struct uart_port *p, int offset, int value)
                        __raw_writeq(value & 0xff,
                                     p->membase + (UART_LCR << p->regshift));
                }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
        }
 }
 #endif /* CONFIG_64BIT */
@@ -187,7 +193,10 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
                        dw8250_force_idle(p);
                        writel(value, p->membase + (UART_LCR << p->regshift));
                }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
        }
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index ff451048c1ac..4bfb7ac0239f 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -929,6 +929,13 @@ __acquires(hwep->lock)
        return retval;
 }
+static int otg_a_alt_hnp_support(struct ci_hdrc *ci)
+{
+        dev_warn(&ci->gadget.dev,
+                "connect the device to an alternate port if you want HNP\n");
+        return isr_setup_status_phase(ci);
+}
 /**
 * isr_setup_packet_handler: setup packet handler
 * @ci: UDC descriptor
@@ -1061,6 +1068,10 @@ __acquires(ci->lock)
                                                        ci);
                                }
                                break;
+                        case USB_DEVICE_A_ALT_HNP_SUPPORT:
+                                if (ci_otg_is_fsm_mode(ci))
+                                        err = otg_a_alt_hnp_support(ci);
+                                break;
                        default:
                                goto delegate;
                        }
diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
index c6b35b77dab7..61d538aa2346 100644
--- a/drivers/usb/common/usb-otg-fsm.c
+++ b/drivers/usb/common/usb-otg-fsm.c
@@ -150,9 +150,9 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                break;
        case OTG_STATE_B_PERIPHERAL:
                otg_chrg_vbus(fsm, 0);
-                otg_loc_conn(fsm, 1);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_GADGET);
+                otg_loc_conn(fsm, 1);
                break;
        case OTG_STATE_B_WAIT_ACON:
                otg_chrg_vbus(fsm, 0);
@@ -213,10 +213,10 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                break;
        case OTG_STATE_A_PERIPHERAL:
-                otg_loc_conn(fsm, 1);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_GADGET);
                otg_drv_vbus(fsm, 1);
+                otg_loc_conn(fsm, 1);
                otg_add_timer(fsm, A_BIDL_ADIS);
                break;
        case OTG_STATE_A_WAIT_VFALL:
diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
index 02e3e2d4ea56..6cf047878dba 100644
--- a/drivers/usb/dwc2/core_intr.c
+++ b/drivers/usb/dwc2/core_intr.c
@@ -377,6 +377,9 @@ static void dwc2_handle_disconnect_intr(struct dwc2_hsotg *hsotg)
                dwc2_is_host_mode(hsotg) ? "Host" : "Device",
                dwc2_op_state_str(hsotg));
+        if (hsotg->op_state == OTG_STATE_A_HOST)
+                dwc2_hcd_disconnect(hsotg);
        /* Change to L3 (OFF) state */
        hsotg->lx_state = DWC2_L3;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index af98b096af2f..175c9956cbe3 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -144,10 +144,9 @@ struct ffs_io_data {
        bool read;
        struct kiocb *kiocb;
-        const struct iovec *iovec;
+        struct iov_iter data;
-        unsigned long nr_segs;
+        const void *to_free;
-        char __user *buf;
+        char *buf;
-        size_t len;
        struct mm_struct *mm;
        struct work_struct work;
@@ -649,29 +648,10 @@ static void ffs_user_copy_worker(struct work_struct *work)
                                         io_data->req->actual;
        if (io_data->read && ret > 0) {
-                int i;
-                size_t pos = 0;
-                /*
-                 * Since req->length may be bigger than io_data->len (after
-                 * being rounded up to maxpacketsize), we may end up with more
-                 * data then user space has space for.
-                 */
-                ret = min_t(int, ret, io_data->len);
                use_mm(io_data->mm);
-                for (i = 0; i < io_data->nr_segs; i++) {
+                ret = copy_to_iter(io_data->buf, ret, &io_data->data);
-                        size_t len = min_t(size_t, ret - pos,
+                if (iov_iter_count(&io_data->data))
-                                        io_data->iovec[i].iov_len);
+                        ret = -EFAULT;
-                        if (!len)
-                                break;
-                        if (unlikely(copy_to_user(io_data->iovec[i].iov_base,
-                                                 &io_data->buf[pos], len))) {
-                                ret = -EFAULT;
-                                break;
-                        }
-                        pos += len;
-                }
                unuse_mm(io_data->mm);
        }
@@ -684,7 +664,7 @@ static void ffs_user_copy_worker(struct work_struct *work)
        io_data->kiocb->private = NULL;
        if (io_data->read)
-                kfree(io_data->iovec);
+                kfree(io_data->to_free);
        kfree(io_data->buf);
        kfree(io_data);
 }
@@ -743,6 +723,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                 * before the waiting completes, so do not assign to 'gadget' earlier
                 */
                struct usb_gadget *gadget = epfile->ffs->gadget;
+                size_t copied;
                spin_lock_irq(&epfile->ffs->eps_lock);
                /* In the meantime, endpoint got disabled or changed. */
@@ -750,34 +731,21 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                        spin_unlock_irq(&epfile->ffs->eps_lock);
                        return -ESHUTDOWN;
                }
+                data_len = iov_iter_count(&io_data->data);
                /*
                 * Controller may require buffer size to be aligned to
                 * maxpacketsize of an out endpoint.
                 */
-                data_len = io_data->read ?
+                if (io_data->read)
-                           usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
+                        data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
-                           io_data->len;
                spin_unlock_irq(&epfile->ffs->eps_lock);
                data = kmalloc(data_len, GFP_KERNEL);
                if (unlikely(!data))
                        return -ENOMEM;
-                if (io_data->aio && !io_data->read) {
+                if (!io_data->read) {
-                        int i;
+                        copied = copy_from_iter(data, data_len, &io_data->data);
-                        size_t pos = 0;
+                        if (copied != data_len) {
-                        for (i = 0; i < io_data->nr_segs; i++) {
-                                if (unlikely(copy_from_user(&data[pos],
-                                             io_data->iovec[i].iov_base,
-                                             io_data->iovec[i].iov_len))) {
-                                        ret = -EFAULT;
-                                        goto error;
-                                }
-                                pos += io_data->iovec[i].iov_len;
-                        }
-                } else {
-                        if (!io_data->read &&
-                            unlikely(__copy_from_user(data, io_data->buf,
-                                                      io_data->len))) {
                                ret = -EFAULT;
                                goto error;
                        }
@@ -876,10 +844,8 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                                 */
                                ret = ep->status;
                                if (io_data->read && ret > 0) {
-                                        ret = min_t(size_t, ret, io_data->len);
+                                        ret = copy_to_iter(data, ret, &io_data->data);
+                                        if (unlikely(iov_iter_count(&io_data->data)))
-                                        if (unlikely(copy_to_user(io_data->buf,
-                                                data, ret)))
                                                ret = -EFAULT;
                                }
                        }
@@ -898,37 +864,6 @@ error:
        return ret;
 }
-static ssize_t
-ffs_epfile_write(struct file *file, const char __user *buf, size_t len,
-                 loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-        ENTER();
-        io_data.aio = false;
-        io_data.read = false;
-        io_data.buf = (char * __user)buf;
-        io_data.len = len;
-        return ffs_epfile_io(file, &io_data);
-}
-static ssize_t
-ffs_epfile_read(struct file *file, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-        ENTER();
-        io_data.aio = false;
-        io_data.read = true;
-        io_data.buf = buf;
-        io_data.len = len;
-        return ffs_epfile_io(file, &io_data);
-}
 static int
 ffs_epfile_open(struct inode *inode, struct file *file)
 {
@@ -965,67 +900,86 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
        return value;
 }
-static ssize_t ffs_epfile_aio_write(struct kiocb *kiocb,
+static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
-                                    const struct iovec *iovec,
-                                    unsigned long nr_segs, loff_t loff)
 {
-        struct ffs_io_data *io_data;
+        struct ffs_io_data io_data, *p = &io_data;
+        ssize_t res;
        ENTER();
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
+        if (!is_sync_kiocb(kiocb)) {
-        if (unlikely(!io_data))
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
-                return -ENOMEM;
+                if (unlikely(!p))
+                        return -ENOMEM;
+                p->aio = true;
+        } else {
+                p->aio = false;
+        }
-        io_data->aio = true;
+        p->read = false;
-        io_data->read = false;
+        p->kiocb = kiocb;
-        io_data->kiocb = kiocb;
+        p->data = *from;
-        io_data->iovec = iovec;
+        p->mm = current->mm;
-        io_data->nr_segs = nr_segs;
-        io_data->len = kiocb->ki_nbytes;
-        io_data->mm = current->mm;
-        kiocb->private = io_data;
+        kiocb->private = p;
        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+        if (p->aio)
+                kfree(p);
+        else
+                *from = p->data;
+        return res;
 }
-static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb,
+static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
-                                   const struct iovec *iovec,
-                                   unsigned long nr_segs, loff_t loff)
 {
-        struct ffs_io_data *io_data;
+        struct ffs_io_data io_data, *p = &io_data;
-        struct iovec *iovec_copy;
+        ssize_t res;
        ENTER();
-        iovec_copy = kmalloc_array(nr_segs, sizeof(*iovec_copy), GFP_KERNEL);
+        if (!is_sync_kiocb(kiocb)) {
-        if (unlikely(!iovec_copy))
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
-                return -ENOMEM;
+                if (unlikely(!p))
+                        return -ENOMEM;
-        memcpy(iovec_copy, iovec, sizeof(struct iovec)*nr_segs);
+                p->aio = true;
+        } else {
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
+                p->aio = false;
-        if (unlikely(!io_data)) {
-                kfree(iovec_copy);
-                return -ENOMEM;
        }
-        io_data->aio = true;
+        p->read = true;
-        io_data->read = true;
+        p->kiocb = kiocb;
-        io_data->kiocb = kiocb;
+        if (p->aio) {
-        io_data->iovec = iovec_copy;
+                p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
-        io_data->nr_segs = nr_segs;
+                if (!p->to_free) {
-        io_data->len = kiocb->ki_nbytes;
+                        kfree(p);
-        io_data->mm = current->mm;
+                        return -ENOMEM;
+                }
+        } else {
+                p->data = *to;
+                p->to_free = NULL;
+        }
+        p->mm = current->mm;
-        kiocb->private = io_data;
+        kiocb->private = p;
        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+        if (p->aio) {
+                kfree(p->to_free);
+                kfree(p);
+        } else {
+                *to = p->data;
+        }
+        return res;
 }
 static int
@@ -1105,10 +1059,10 @@ static const struct file_operations ffs_epfile_operations = {
        .llseek =       no_llseek,
        .open =         ffs_epfile_open,
-        .write =        ffs_epfile_write,
+        .write =        new_sync_write,
-        .read =         ffs_epfile_read,
+        .read =         new_sync_read,
-        .aio_write =    ffs_epfile_aio_write,
+        .write_iter =   ffs_epfile_write_iter,
-        .aio_read =     ffs_epfile_aio_read,
+        .read_iter =    ffs_epfile_read_iter,
        .release =      ffs_epfile_release,
        .unlocked_ioctl =       ffs_epfile_ioctl,
 };
diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index 298b46112b1a..39f49f1ad22f 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -289,8 +289,7 @@ static void disable_loopback(struct f_loopback *loop)
        struct usb_composite_dev        *cdev;
        cdev = loop->function.config->cdev;
-        disable_endpoints(cdev, loop->in_ep, loop->out_ep, NULL, NULL, NULL,
+        disable_endpoints(cdev, loop->in_ep, loop->out_ep, NULL, NULL);
-                        NULL);
        VDBG(cdev, "%s disabled\n", loop->function.name);
 }
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index e3dae47baef3..3a5ae9900b1e 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -23,15 +23,6 @@
 #include "gadget_chips.h"
 #include "u_f.h"
-#define USB_MS_TO_SS_INTERVAL(x) USB_MS_TO_HS_INTERVAL(x)
-enum eptype {
-        EP_CONTROL = 0,
-        EP_BULK,
-        EP_ISOC,
-        EP_INTERRUPT,
-};
 /*
 * SOURCE/SINK FUNCTION ... a primary testing vehicle for USB peripheral
 * controller drivers.
@@ -64,8 +55,6 @@ struct f_sourcesink {
        struct usb_ep           *out_ep;
        struct usb_ep           *iso_in_ep;
        struct usb_ep           *iso_out_ep;
-        struct usb_ep           *int_in_ep;
-        struct usb_ep           *int_out_ep;
        int                     cur_alt;
 };
@@ -79,10 +68,6 @@ static unsigned isoc_interval;
 static unsigned isoc_maxpacket;
 static unsigned isoc_mult;
 static unsigned isoc_maxburst;
-static unsigned int_interval; /* In ms */
-static unsigned int_maxpacket;
-static unsigned int_mult;
-static unsigned int_maxburst;
 static unsigned buflen;
 /*-------------------------------------------------------------------------*/
@@ -107,16 +92,6 @@ static struct usb_interface_descriptor source_sink_intf_alt1 = {
        /* .iInterface          = DYNAMIC */
 };
-static struct usb_interface_descriptor source_sink_intf_alt2 = {
-        .bLength =              USB_DT_INTERFACE_SIZE,
-        .bDescriptorType =      USB_DT_INTERFACE,
-        .bAlternateSetting =    2,
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
-        /* .iInterface          = DYNAMIC */
-};
 /* full speed support: */
 static struct usb_endpoint_descriptor fs_source_desc = {
@@ -155,26 +130,6 @@ static struct usb_endpoint_descriptor fs_iso_sink_desc = {
        .bInterval =            4,
 };
-static struct usb_endpoint_descriptor fs_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(64),
-        .bInterval =            GZERO_INT_INTERVAL,
-};
-static struct usb_endpoint_descriptor fs_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bEndpointAddress =     USB_DIR_OUT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(64),
-        .bInterval =            GZERO_INT_INTERVAL,
-};
 static struct usb_descriptor_header *fs_source_sink_descs[] = {
        (struct usb_descriptor_header *) &source_sink_intf_alt0,
        (struct usb_descriptor_header *) &fs_sink_desc,
@@ -185,10 +140,6 @@ static struct usb_descriptor_header *fs_source_sink_descs[] = {
        (struct usb_descriptor_header *) &fs_source_desc,
        (struct usb_descriptor_header *) &fs_iso_sink_desc,
        (struct usb_descriptor_header *) &fs_iso_source_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define FS_ALT_IFC_2_OFFSET     8
-        (struct usb_descriptor_header *) &fs_int_sink_desc,
-        (struct usb_descriptor_header *) &fs_int_source_desc,
        NULL,
 };
@@ -228,24 +179,6 @@ static struct usb_endpoint_descriptor hs_iso_sink_desc = {
        .bInterval =            4,
 };
-static struct usb_endpoint_descriptor hs_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_HS_INTERVAL(GZERO_INT_INTERVAL),
-};
-static struct usb_endpoint_descriptor hs_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_HS_INTERVAL(GZERO_INT_INTERVAL),
-};
 static struct usb_descriptor_header *hs_source_sink_descs[] = {
        (struct usb_descriptor_header *) &source_sink_intf_alt0,
        (struct usb_descriptor_header *) &hs_source_desc,
@@ -256,10 +189,6 @@ static struct usb_descriptor_header *hs_source_sink_descs[] = {
        (struct usb_descriptor_header *) &hs_sink_desc,
        (struct usb_descriptor_header *) &hs_iso_source_desc,
        (struct usb_descriptor_header *) &hs_iso_sink_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define HS_ALT_IFC_2_OFFSET     8
-        (struct usb_descriptor_header *) &hs_int_source_desc,
-        (struct usb_descriptor_header *) &hs_int_sink_desc,
        NULL,
 };
@@ -335,42 +264,6 @@ static struct usb_ss_ep_comp_descriptor ss_iso_sink_comp_desc = {
        .wBytesPerInterval =    cpu_to_le16(1024),
 };
-static struct usb_endpoint_descriptor ss_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
-};
-static struct usb_ss_ep_comp_descriptor ss_int_source_comp_desc = {
-        .bLength =              USB_DT_SS_EP_COMP_SIZE,
-        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
-        .bMaxBurst =            0,
-        .bmAttributes =         0,
-        .wBytesPerInterval =    cpu_to_le16(1024),
-};
-static struct usb_endpoint_descriptor ss_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
-};
-static struct usb_ss_ep_comp_descriptor ss_int_sink_comp_desc = {
-        .bLength =              USB_DT_SS_EP_COMP_SIZE,
-        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
-        .bMaxBurst =            0,
-        .bmAttributes =         0,
-        .wBytesPerInterval =    cpu_to_le16(1024),
-};
 static struct usb_descriptor_header *ss_source_sink_descs[] = {
        (struct usb_descriptor_header *) &source_sink_intf_alt0,
        (struct usb_descriptor_header *) &ss_source_desc,
@@ -387,12 +280,6 @@ static struct usb_descriptor_header *ss_source_sink_descs[] = {
        (struct usb_descriptor_header *) &ss_iso_source_comp_desc,
        (struct usb_descriptor_header *) &ss_iso_sink_desc,
        (struct usb_descriptor_header *) &ss_iso_sink_comp_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define SS_ALT_IFC_2_OFFSET     14
-        (struct usb_descriptor_header *) &ss_int_source_desc,
-        (struct usb_descriptor_header *) &ss_int_source_comp_desc,
-        (struct usb_descriptor_header *) &ss_int_sink_desc,
-        (struct usb_descriptor_header *) &ss_int_sink_comp_desc,
        NULL,
 };
@@ -414,21 +301,6 @@ static struct usb_gadget_strings *sourcesink_strings[] = {
 };
 /*-------------------------------------------------------------------------*/
-static const char *get_ep_string(enum eptype ep_type)
-{
-        switch (ep_type) {
-        case EP_ISOC:
-                return "ISOC-";
-        case EP_INTERRUPT:
-                return "INTERRUPT-";
-        case EP_CONTROL:
-                return "CTRL-";
-        case EP_BULK:
-                return "BULK-";
-        default:
-                return "UNKNOWN-";
-        }
-}
 static inline struct usb_request *ss_alloc_ep_req(struct usb_ep *ep, int len)
 {
@@ -456,8 +328,7 @@ static void disable_ep(struct usb_composite_dev *cdev, struct usb_ep *ep)
 void disable_endpoints(struct usb_composite_dev *cdev,
                struct usb_ep *in, struct usb_ep *out,
-                struct usb_ep *iso_in, struct usb_ep *iso_out,
+                struct usb_ep *iso_in, struct usb_ep *iso_out)
-                struct usb_ep *int_in, struct usb_ep *int_out)
 {
        disable_ep(cdev, in);
        disable_ep(cdev, out);
@@ -465,10 +336,6 @@ void disable_endpoints(struct usb_composite_dev *cdev,
                disable_ep(cdev, iso_in);
        if (iso_out)
                disable_ep(cdev, iso_out);
-        if (int_in)
-                disable_ep(cdev, int_in);
-        if (int_out)
-                disable_ep(cdev, int_out);
 }
 static int
@@ -485,7 +352,6 @@ sourcesink_bind(struct usb_configuration *c, struct usb_function *f)
                return id;
        source_sink_intf_alt0.bInterfaceNumber = id;
        source_sink_intf_alt1.bInterfaceNumber = id;
-        source_sink_intf_alt2.bInterfaceNumber = id;
        /* allocate bulk endpoints */
        ss->in_ep = usb_ep_autoconfig(cdev->gadget, &fs_source_desc);
@@ -546,55 +412,14 @@ no_iso:
        if (isoc_maxpacket > 1024)
                isoc_maxpacket = 1024;
-        /* sanity check the interrupt module parameters */
-        if (int_interval < 1)
-                int_interval = 1;
-        if (int_interval > 4096)
-                int_interval = 4096;
-        if (int_mult > 2)
-                int_mult = 2;
-        if (int_maxburst > 15)
-                int_maxburst = 15;
-        /* fill in the FS interrupt descriptors from the module parameters */
-        fs_int_source_desc.wMaxPacketSize = int_maxpacket > 64 ?
-                                                64 : int_maxpacket;
-        fs_int_source_desc.bInterval = int_interval > 255 ?
-                                                255 : int_interval;
-        fs_int_sink_desc.wMaxPacketSize = int_maxpacket > 64 ?
-                                                64 : int_maxpacket;
-        fs_int_sink_desc.bInterval = int_interval > 255 ?
-                                                255 : int_interval;
-        /* allocate int endpoints */
-        ss->int_in_ep = usb_ep_autoconfig(cdev->gadget, &fs_int_source_desc);
-        if (!ss->int_in_ep)
-                goto no_int;
-        ss->int_in_ep->driver_data = cdev;      /* claim */
-        ss->int_out_ep = usb_ep_autoconfig(cdev->gadget, &fs_int_sink_desc);
-        if (ss->int_out_ep) {
-                ss->int_out_ep->driver_data = cdev;     /* claim */
-        } else {
-                ss->int_in_ep->driver_data = NULL;
-                ss->int_in_ep = NULL;
-no_int:
-                fs_source_sink_descs[FS_ALT_IFC_2_OFFSET] = NULL;
-                hs_source_sink_descs[HS_ALT_IFC_2_OFFSET] = NULL;
-                ss_source_sink_descs[SS_ALT_IFC_2_OFFSET] = NULL;
-        }
-        if (int_maxpacket > 1024)
-                int_maxpacket = 1024;
        /* support high speed hardware */
        hs_source_desc.bEndpointAddress = fs_source_desc.bEndpointAddress;
        hs_sink_desc.bEndpointAddress = fs_sink_desc.bEndpointAddress;
        /*
-         * Fill in the HS isoc and interrupt descriptors from the module
+         * Fill in the HS isoc descriptors from the module parameters.
-         * parameters. We assume that the user knows what they are doing and
+         * We assume that the user knows what they are doing and won't
-         * won't give parameters that their UDC doesn't support.
+         * give parameters that their UDC doesn't support.
         */
        hs_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
        hs_iso_source_desc.wMaxPacketSize |= isoc_mult << 11;
@@ -607,17 +432,6 @@ no_int:
        hs_iso_sink_desc.bInterval = isoc_interval;
        hs_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
-        hs_int_source_desc.wMaxPacketSize = int_maxpacket;
-        hs_int_source_desc.wMaxPacketSize |= int_mult << 11;
-        hs_int_source_desc.bInterval = USB_MS_TO_HS_INTERVAL(int_interval);
-        hs_int_source_desc.bEndpointAddress =
-                fs_int_source_desc.bEndpointAddress;
-        hs_int_sink_desc.wMaxPacketSize = int_maxpacket;
-        hs_int_sink_desc.wMaxPacketSize |= int_mult << 11;
-        hs_int_sink_desc.bInterval = USB_MS_TO_HS_INTERVAL(int_interval);
-        hs_int_sink_desc.bEndpointAddress = fs_int_sink_desc.bEndpointAddress;
        /* support super speed hardware */
        ss_source_desc.bEndpointAddress =
                fs_source_desc.bEndpointAddress;
@@ -625,9 +439,9 @@ no_int:
                fs_sink_desc.bEndpointAddress;
        /*
-         * Fill in the SS isoc and interrupt descriptors from the module
+         * Fill in the SS isoc descriptors from the module parameters.
-         * parameters. We assume that the user knows what they are doing and
+         * We assume that the user knows what they are doing and won't
-         * won't give parameters that their UDC doesn't support.
+         * give parameters that their UDC doesn't support.
         */
        ss_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
        ss_iso_source_desc.bInterval = isoc_interval;
@@ -646,37 +460,17 @@ no_int:
                isoc_maxpacket * (isoc_mult + 1) * (isoc_maxburst + 1);
        ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
-        ss_int_source_desc.wMaxPacketSize = int_maxpacket;
-        ss_int_source_desc.bInterval = USB_MS_TO_SS_INTERVAL(int_interval);
-        ss_int_source_comp_desc.bmAttributes = int_mult;
-        ss_int_source_comp_desc.bMaxBurst = int_maxburst;
-        ss_int_source_comp_desc.wBytesPerInterval =
-                int_maxpacket * (int_mult + 1) * (int_maxburst + 1);
-        ss_int_source_desc.bEndpointAddress =
-                fs_int_source_desc.bEndpointAddress;
-        ss_int_sink_desc.wMaxPacketSize = int_maxpacket;
-        ss_int_sink_desc.bInterval = USB_MS_TO_SS_INTERVAL(int_interval);
-        ss_int_sink_comp_desc.bmAttributes = int_mult;
-        ss_int_sink_comp_desc.bMaxBurst = int_maxburst;
-        ss_int_sink_comp_desc.wBytesPerInterval =
-                int_maxpacket * (int_mult + 1) * (int_maxburst + 1);
-        ss_int_sink_desc.bEndpointAddress = fs_int_sink_desc.bEndpointAddress;
        ret = usb_assign_descriptors(f, fs_source_sink_descs,
                        hs_source_sink_descs, ss_source_sink_descs);
        if (ret)
                return ret;
-        DBG(cdev, "%s speed %s: IN/%s, OUT/%s, ISO-IN/%s, ISO-OUT/%s, "
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s, ISO-IN/%s, ISO-OUT/%s\n",
-                        "INT-IN/%s, INT-OUT/%s\n",
            (gadget_is_superspeed(c->cdev->gadget) ? "super" :
             (gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full")),
                        f->name, ss->in_ep->name, ss->out_ep->name,
                        ss->iso_in_ep ? ss->iso_in_ep->name : "<none>",
-                        ss->iso_out_ep ? ss->iso_out_ep->name : "<none>",
+                        ss->iso_out_ep ? ss->iso_out_ep->name : "<none>");
-                        ss->int_in_ep ? ss->int_in_ep->name : "<none>",
-                        ss->int_out_ep ? ss->int_out_ep->name : "<none>");
        return 0;
 }
@@ -807,15 +601,14 @@ static void source_sink_complete(struct usb_ep *ep, struct usb_request *req)
 }
 static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
-                enum eptype ep_type, int speed)
+                bool is_iso, int speed)
 {
        struct usb_ep           *ep;
        struct usb_request      *req;
        int                     i, size, status;
        for (i = 0; i < 8; i++) {
-                switch (ep_type) {
+                if (is_iso) {
-                case EP_ISOC:
                        switch (speed) {
                        case USB_SPEED_SUPER:
                                size = isoc_maxpacket * (isoc_mult + 1) *
@@ -831,28 +624,9 @@ static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
                        }
                        ep = is_in ? ss->iso_in_ep : ss->iso_out_ep;
                        req = ss_alloc_ep_req(ep, size);
-                        break;
+                } else {
-                case EP_INTERRUPT:
-                        switch (speed) {
-                        case USB_SPEED_SUPER:
-                                size = int_maxpacket * (int_mult + 1) *
-                                                (int_maxburst + 1);
-                                break;
-                        case USB_SPEED_HIGH:
-                                size = int_maxpacket * (int_mult + 1);
-                                break;
-                        default:
-                                size = int_maxpacket > 1023 ?
-                                                1023 : int_maxpacket;
-                                break;
-                        }
-                        ep = is_in ? ss->int_in_ep : ss->int_out_ep;
-                        req = ss_alloc_ep_req(ep, size);
-                        break;
-                default:
                        ep = is_in ? ss->in_ep : ss->out_ep;
                        req = ss_alloc_ep_req(ep, 0);
-                        break;
                }
                if (!req)
@@ -870,12 +644,12 @@ static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
                        cdev = ss->function.config->cdev;
                        ERROR(cdev, "start %s%s %s --> %d\n",
-                                get_ep_string(ep_type), is_in ? "IN" : "OUT",
+                              is_iso ? "ISO-" : "", is_in ? "IN" : "OUT",
-                                ep->name, status);
+                              ep->name, status);
                        free_ep_req(ep, req);
                }
-                if (!(ep_type == EP_ISOC))
+                if (!is_iso)
                        break;
        }
@@ -888,7 +662,7 @@ static void disable_source_sink(struct f_sourcesink *ss)
        cdev = ss->function.config->cdev;
        disable_endpoints(cdev, ss->in_ep, ss->out_ep, ss->iso_in_ep,
-                        ss->iso_out_ep, ss->int_in_ep, ss->int_out_ep);
+                        ss->iso_out_ep);
        VDBG(cdev, "%s disabled\n", ss->function.name);
 }
@@ -900,62 +674,6 @@ enable_source_sink(struct usb_composite_dev *cdev, struct f_sourcesink *ss,
        int                                     speed = cdev->gadget->speed;
        struct usb_ep                           *ep;
-        if (alt == 2) {
-                /* Configure for periodic interrupt endpoint */
-                ep = ss->int_in_ep;
-                if (ep) {
-                        result = config_ep_by_speed(cdev->gadget,
-                                        &(ss->function), ep);
-                        if (result)
-                                return result;
-                        result = usb_ep_enable(ep);
-                        if (result < 0)
-                                return result;
-                        ep->driver_data = ss;
-                        result = source_sink_start_ep(ss, true, EP_INTERRUPT,
-                                        speed);
-                        if (result < 0) {
-fail1:
-                                ep = ss->int_in_ep;
-                                if (ep) {
-                                        usb_ep_disable(ep);
-                                        ep->driver_data = NULL;
-                                }
-                                return result;
-                        }
-                }
-                /*
-                 * one interrupt endpoint reads (sinks) anything OUT (from the
-                 * host)
-                 */
-                ep = ss->int_out_ep;
-                if (ep) {
-                        result = config_ep_by_speed(cdev->gadget,
-                                        &(ss->function), ep);
-                        if (result)
-                                goto fail1;
-                        result = usb_ep_enable(ep);
-                        if (result < 0)
-                                goto fail1;
-                        ep->driver_data = ss;
-                        result = source_sink_start_ep(ss, false, EP_INTERRUPT,
-                                        speed);
-                        if (result < 0) {
-                                ep = ss->int_out_ep;
-                                usb_ep_disable(ep);
-                                ep->driver_data = NULL;
-                                goto fail1;
-                        }
-                }
-                goto out;
-        }
        /* one bulk endpoint writes (sources) zeroes IN (to the host) */
        ep = ss->in_ep;
        result = config_ep_by_speed(cdev->gadget, &(ss->function), ep);
@@ -966,7 +684,7 @@ fail1:
                return result;
        ep->driver_data = ss;
-        result = source_sink_start_ep(ss, true, EP_BULK, speed);
+        result = source_sink_start_ep(ss, true, false, speed);
        if (result < 0) {
 fail:
                ep = ss->in_ep;
@@ -985,7 +703,7 @@ fail:
                goto fail;
        ep->driver_data = ss;
-        result = source_sink_start_ep(ss, false, EP_BULK, speed);
+        result = source_sink_start_ep(ss, false, false, speed);
        if (result < 0) {
 fail2:
                ep = ss->out_ep;
@@ -1008,7 +726,7 @@ fail2:
                        goto fail2;
                ep->driver_data = ss;
-                result = source_sink_start_ep(ss, true, EP_ISOC, speed);
+                result = source_sink_start_ep(ss, true, true, speed);
                if (result < 0) {
 fail3:
                        ep = ss->iso_in_ep;
@@ -1031,14 +749,13 @@ fail3:
                        goto fail3;
                ep->driver_data = ss;
-                result = source_sink_start_ep(ss, false, EP_ISOC, speed);
+                result = source_sink_start_ep(ss, false, true, speed);
                if (result < 0) {
                        usb_ep_disable(ep);
                        ep->driver_data = NULL;
                        goto fail3;
                }
        }
 out:
        ss->cur_alt = alt;
@@ -1054,8 +771,6 @@ static int sourcesink_set_alt(struct usb_function *f,
        if (ss->in_ep->driver_data)
                disable_source_sink(ss);
-        else if (alt == 2 && ss->int_in_ep->driver_data)
-                disable_source_sink(ss);
        return enable_source_sink(cdev, ss, alt);
 }
@@ -1168,10 +883,6 @@ static struct usb_function *source_sink_alloc_func(
        isoc_maxpacket = ss_opts->isoc_maxpacket;
        isoc_mult = ss_opts->isoc_mult;
        isoc_maxburst = ss_opts->isoc_maxburst;
-        int_interval = ss_opts->int_interval;
-        int_maxpacket = ss_opts->int_maxpacket;
-        int_mult = ss_opts->int_mult;
-        int_maxburst = ss_opts->int_maxburst;
        buflen = ss_opts->bulk_buflen;
        ss->function.name = "source/sink";
@@ -1468,182 +1179,6 @@ static struct f_ss_opts_attribute f_ss_opts_bulk_buflen =
                        f_ss_opts_bulk_buflen_show,
                        f_ss_opts_bulk_buflen_store);
-static ssize_t f_ss_opts_int_interval_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_interval);
-        mutex_unlock(&opts->lock);
-        return result;
-}
-static ssize_t f_ss_opts_int_interval_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u32 num;
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-        ret = kstrtou32(page, 0, &num);
-        if (ret)
-                goto end;
-        if (num > 4096) {
-                ret = -EINVAL;
-                goto end;
-        }
-        opts->int_interval = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-static struct f_ss_opts_attribute f_ss_opts_int_interval =
-        __CONFIGFS_ATTR(int_interval, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_interval_show,
-                        f_ss_opts_int_interval_store);
-static ssize_t f_ss_opts_int_maxpacket_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_maxpacket);
-        mutex_unlock(&opts->lock);
-        return result;
-}
-static ssize_t f_ss_opts_int_maxpacket_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u16 num;
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-        ret = kstrtou16(page, 0, &num);
-        if (ret)
-                goto end;
-        if (num > 1024) {
-                ret = -EINVAL;
-                goto end;
-        }
-        opts->int_maxpacket = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-static struct f_ss_opts_attribute f_ss_opts_int_maxpacket =
-        __CONFIGFS_ATTR(int_maxpacket, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_maxpacket_show,
-                        f_ss_opts_int_maxpacket_store);
-static ssize_t f_ss_opts_int_mult_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_mult);
-        mutex_unlock(&opts->lock);
-        return result;
-}
-static ssize_t f_ss_opts_int_mult_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u8 num;
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-        ret = kstrtou8(page, 0, &num);
-        if (ret)
-                goto end;
-        if (num > 2) {
-                ret = -EINVAL;
-                goto end;
-        }
-        opts->int_mult = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-static struct f_ss_opts_attribute f_ss_opts_int_mult =
-        __CONFIGFS_ATTR(int_mult, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_mult_show,
-                        f_ss_opts_int_mult_store);
-static ssize_t f_ss_opts_int_maxburst_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_maxburst);
-        mutex_unlock(&opts->lock);
-        return result;
-}
-static ssize_t f_ss_opts_int_maxburst_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u8 num;
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-        ret = kstrtou8(page, 0, &num);
-        if (ret)
-                goto end;
-        if (num > 15) {
-                ret = -EINVAL;
-                goto end;
-        }
-        opts->int_maxburst = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-static struct f_ss_opts_attribute f_ss_opts_int_maxburst =
-        __CONFIGFS_ATTR(int_maxburst, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_maxburst_show,
-                        f_ss_opts_int_maxburst_store);
 static struct configfs_attribute *ss_attrs[] = {
        &f_ss_opts_pattern.attr,
        &f_ss_opts_isoc_interval.attr,
@@ -1651,10 +1186,6 @@ static struct configfs_attribute *ss_attrs[] = {
        &f_ss_opts_isoc_mult.attr,
        &f_ss_opts_isoc_maxburst.attr,
        &f_ss_opts_bulk_buflen.attr,
-        &f_ss_opts_int_interval.attr,
-        &f_ss_opts_int_maxpacket.attr,
-        &f_ss_opts_int_mult.attr,
-        &f_ss_opts_int_maxburst.attr,
        NULL,
 };
@@ -1684,8 +1215,6 @@ static struct usb_function_instance *source_sink_alloc_inst(void)
        ss_opts->isoc_interval = GZERO_ISOC_INTERVAL;
        ss_opts->isoc_maxpacket = GZERO_ISOC_MAXPACKET;
        ss_opts->bulk_buflen = GZERO_BULK_BUFLEN;
-        ss_opts->int_interval = GZERO_INT_INTERVAL;
-        ss_opts->int_maxpacket = GZERO_INT_MAXPACKET;
        config_group_init_type_name(&ss_opts->func_inst.group, "",
                                    &ss_func_type);
diff --git a/drivers/usb/gadget/function/g_zero.h b/drivers/usb/gadget/function/g_zero.h
index 2ce28b9d97cc..15f180904f8a 100644
--- a/drivers/usb/gadget/function/g_zero.h
+++ b/drivers/usb/gadget/function/g_zero.h
@@ -10,8 +10,6 @@
 #define GZERO_QLEN              32
 #define GZERO_ISOC_INTERVAL     4
 #define GZERO_ISOC_MAXPACKET    1024
-#define GZERO_INT_INTERVAL      1 /* Default interrupt interval = 1 ms */
-#define GZERO_INT_MAXPACKET     1024
 struct usb_zero_options {
        unsigned pattern;
@@ -19,10 +17,6 @@ struct usb_zero_options {
        unsigned isoc_maxpacket;
        unsigned isoc_mult;
        unsigned isoc_maxburst;
-        unsigned int_interval; /* In ms */
-        unsigned int_maxpacket;
-        unsigned int_mult;
-        unsigned int_maxburst;
        unsigned bulk_buflen;
        unsigned qlen;
 };
@@ -34,10 +28,6 @@ struct f_ss_opts {
        unsigned isoc_maxpacket;
        unsigned isoc_mult;
        unsigned isoc_maxburst;
-        unsigned int_interval; /* In ms */
-        unsigned int_maxpacket;
-        unsigned int_mult;
-        unsigned int_maxburst;
        unsigned bulk_buflen;
        /*
@@ -72,7 +62,6 @@ int lb_modinit(void);
 void free_ep_req(struct usb_ep *ep, struct usb_request *req);
 void disable_endpoints(struct usb_composite_dev *cdev,
                struct usb_ep *in, struct usb_ep *out,
-                struct usb_ep *iso_in, struct usb_ep *iso_out,
+                struct usb_ep *iso_in, struct usb_ep *iso_out);
-                struct usb_ep *int_in, struct usb_ep *int_out);
 #endif /* __G_ZERO_H */
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index db49ec4c748e..200f9a584064 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -74,6 +74,8 @@ MODULE_DESCRIPTION (DRIVER_DESC);
 MODULE_AUTHOR ("David Brownell");
 MODULE_LICENSE ("GPL");
+static int ep_open(struct inode *, struct file *);
 /*----------------------------------------------------------------------*/
@@ -283,14 +285,15 @@ static void epio_complete (struct usb_ep *ep, struct usb_request *req)
 * still need dev->lock to use epdata->ep.
 */
 static int
-get_ready_ep (unsigned f_flags, struct ep_data *epdata)
+get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write)
 {
        int     val;
        if (f_flags & O_NONBLOCK) {
                if (!mutex_trylock(&epdata->lock))
                        goto nonblock;
-                if (epdata->state != STATE_EP_ENABLED) {
+                if (epdata->state != STATE_EP_ENABLED &&
+                    (!is_write || epdata->state != STATE_EP_READY)) {
                        mutex_unlock(&epdata->lock);
 nonblock:
                        val = -EAGAIN;
@@ -305,18 +308,20 @@ nonblock:
        switch (epdata->state) {
        case STATE_EP_ENABLED:
+                return 0;
+        case STATE_EP_READY:                    /* not configured yet */
+                if (is_write)
+                        return 0;
+                // FALLTHRU
+        case STATE_EP_UNBOUND:                  /* clean disconnect */
                break;
        // case STATE_EP_DISABLED:              /* "can't happen" */
-        // case STATE_EP_READY:                 /* "can't happen" */
        default:                                /* error! */
                pr_debug ("%s: ep %p not available, state %d\n",
                                shortname, epdata, epdata->state);
-                // FALLTHROUGH
-        case STATE_EP_UNBOUND:                  /* clean disconnect */
-                val = -ENODEV;
-                mutex_unlock(&epdata->lock);
        }
-        return val;
+        mutex_unlock(&epdata->lock);
+        return -ENODEV;
 }
 static ssize_t
@@ -363,97 +368,6 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)
        return value;
 }
-/* handle a synchronous OUT bulk/intr/iso transfer */
-static ssize_t
-ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-        /* FIXME readahead for O_NONBLOCK and poll(); careful with ZLPs */
-        value = -ENOMEM;
-        kbuf = kmalloc (len, GFP_KERNEL);
-        if (unlikely (!kbuf))
-                goto free1;
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s read %zu OUT, status %d\n",
-                data->name, len, (int) value);
-        if (value >= 0 && copy_to_user (buf, kbuf, value))
-                value = -EFAULT;
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
-/* handle a synchronous IN bulk/intr/iso transfer */
-static ssize_t
-ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (!usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-        /* FIXME writebehind for O_NONBLOCK and poll(), qlen = 1 */
-        value = -ENOMEM;
-        kbuf = memdup_user(buf, len);
-        if (IS_ERR(kbuf)) {
-                value = PTR_ERR(kbuf);
-                kbuf = NULL;
-                goto free1;
-        }
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s write %zu IN, status %d\n",
-                data->name, len, (int) value);
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
 static int
 ep_release (struct inode *inode, struct file *fd)
 {
@@ -481,7 +395,7 @@ static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
        struct ep_data          *data = fd->private_data;
        int                     status;
-        if ((status = get_ready_ep (fd->f_flags, data)) < 0)
+        if ((status = get_ready_ep (fd->f_flags, data, false)) < 0)
                return status;
        spin_lock_irq (&data->dev->lock);
@@ -517,8 +431,8 @@ struct kiocb_priv {
        struct mm_struct        *mm;
        struct work_struct      work;
        void                    *buf;
-        const struct iovec      *iv;
+        struct iov_iter         to;
-        unsigned long           nr_segs;
+        const void              *to_free;
        unsigned                actual;
 };
@@ -541,35 +455,6 @@ static int ep_aio_cancel(struct kiocb *iocb)
        return value;
 }
-static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
-{
-        ssize_t                 len, total;
-        void                    *to_copy;
-        int                     i;
-        /* copy stuff into user buffers */
-        total = priv->actual;
-        len = 0;
-        to_copy = priv->buf;
-        for (i=0; i < priv->nr_segs; i++) {
-                ssize_t this = min((ssize_t)(priv->iv[i].iov_len), total);
-                if (copy_to_user(priv->iv[i].iov_base, to_copy, this)) {
-                        if (len == 0)
-                                len = -EFAULT;
-                        break;
-                }
-                total -= this;
-                len += this;
-                to_copy += this;
-                if (total == 0)
-                        break;
-        }
-        return len;
-}
 static void ep_user_copy_worker(struct work_struct *work)
 {
        struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work);
@@ -578,13 +463,16 @@ static void ep_user_copy_worker(struct work_struct *work)
        size_t ret;
        use_mm(mm);
-        ret = ep_copy_to_user(priv);
+        ret = copy_to_iter(priv->buf, priv->actual, &priv->to);
        unuse_mm(mm);
+        if (!ret)
+                ret = -EFAULT;
        /* completing the iocb can drop the ctx and mm, don't touch mm after */
        aio_complete(iocb, ret, ret);
        kfree(priv->buf);
+        kfree(priv->to_free);
        kfree(priv);
 }
@@ -603,8 +491,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
         * don't need to copy anything to userspace, so we can
         * complete the aio request immediately.
         */
-        if (priv->iv == NULL || unlikely(req->actual == 0)) {
+        if (priv->to_free == NULL || unlikely(req->actual == 0)) {
                kfree(req->buf);
+                kfree(priv->to_free);
                kfree(priv);
                iocb->private = NULL;
                /* aio_complete() reports bytes-transferred _and_ faults */
@@ -618,6 +507,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
                priv->buf = req->buf;
                priv->actual = req->actual;
+                INIT_WORK(&priv->work, ep_user_copy_worker);
                schedule_work(&priv->work);
        }
        spin_unlock(&epdata->dev->lock);
@@ -626,38 +516,17 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
        put_ep(epdata);
 }
-static ssize_t
+static ssize_t ep_aio(struct kiocb *iocb,
-ep_aio_rwtail(
+                      struct kiocb_priv *priv,
-        struct kiocb    *iocb,
+                      struct ep_data *epdata,
-        char            *buf,
+                      char *buf,
-        size_t          len,
+                      size_t len)
-        struct ep_data  *epdata,
-        const struct iovec *iv,
-        unsigned long   nr_segs
-)
 {
-        struct kiocb_priv       *priv;
+        struct usb_request *req;
-        struct usb_request      *req;
+        ssize_t value;
-        ssize_t                 value;
-        priv = kmalloc(sizeof *priv, GFP_KERNEL);
-        if (!priv) {
-                value = -ENOMEM;
-fail:
-                kfree(buf);
-                return value;
-        }
        iocb->private = priv;
        priv->iocb = iocb;
-        priv->iv = iv;
-        priv->nr_segs = nr_segs;
-        INIT_WORK(&priv->work, ep_user_copy_worker);
-        value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
-        if (unlikely(value < 0)) {
-                kfree(priv);
-                goto fail;
-        }
        kiocb_set_cancel_fn(iocb, ep_aio_cancel);
        get_ep(epdata);
@@ -669,75 +538,154 @@ fail:
         * allocate or submit those if the host disconnected.
         */
        spin_lock_irq(&epdata->dev->lock);
-        if (likely(epdata->ep)) {
+        value = -ENODEV;
-                req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
+        if (unlikely(epdata->ep))
-                if (likely(req)) {
+                goto fail;
-                        priv->req = req;
-                        req->buf = buf;
-                        req->length = len;
-                        req->complete = ep_aio_complete;
-                        req->context = iocb;
-                        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
-                        if (unlikely(0 != value))
-                                usb_ep_free_request(epdata->ep, req);
-                } else
-                        value = -EAGAIN;
-        } else
-                value = -ENODEV;
-        spin_unlock_irq(&epdata->dev->lock);
-        mutex_unlock(&epdata->lock);
+        req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
+        value = -ENOMEM;
+        if (unlikely(!req))
+                goto fail;
-        if (unlikely(value)) {
+        priv->req = req;
-                kfree(priv);
+        req->buf = buf;
-                put_ep(epdata);
+        req->length = len;
-        } else
+        req->complete = ep_aio_complete;
-                value = -EIOCBQUEUED;
+        req->context = iocb;
+        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
+        if (unlikely(0 != value)) {
+                usb_ep_free_request(epdata->ep, req);
+                goto fail;
+        }
+        spin_unlock_irq(&epdata->dev->lock);
+        return -EIOCBQUEUED;
+fail:
+        spin_unlock_irq(&epdata->dev->lock);
+        kfree(priv->to_free);
+        kfree(priv);
+        put_ep(epdata);
        return value;
 }
 static ssize_t
-ep_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
-                unsigned long nr_segs, loff_t o)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
+        struct file *file = iocb->ki_filp;
-        char                    *buf;
+        struct ep_data *epdata = file->private_data;
+        size_t len = iov_iter_count(to);
+        ssize_t value;
+        char *buf;
-        if (unlikely(usb_endpoint_dir_in(&epdata->desc)))
+        if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0)
-                return -EINVAL;
+                return value;
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
+        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (unlikely(!buf))
+        if (usb_endpoint_dir_in(&epdata->desc)) {
-                return -ENOMEM;
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
-        return ep_aio_rwtail(iocb, buf, iocb->ki_nbytes, epdata, iov, nr_segs);
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
+                return -ENOMEM;
+        }
+        if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+                if (value >= 0 && copy_to_iter(buf, value, to))
+                        value = -EFAULT;
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (!priv)
+                        goto fail;
+                priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL);
+                if (!priv->to_free) {
+                        kfree(priv);
+                        goto fail;
+                }
+                value = ep_aio(iocb, priv, epdata, buf, len);
+                if (value == -EIOCBQUEUED)
+                        buf = NULL;
+        }
+fail:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
+static ssize_t ep_config(struct ep_data *, const char *, size_t);
 static ssize_t
-ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
-                unsigned long nr_segs, loff_t o)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
+        struct file *file = iocb->ki_filp;
-        char                    *buf;
+        struct ep_data *epdata = file->private_data;
-        size_t                  len = 0;
+        size_t len = iov_iter_count(from);
-        int                     i = 0;
+        bool configured;
+        ssize_t value;
+        char *buf;
+        if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0)
+                return value;
-        if (unlikely(!usb_endpoint_dir_in(&epdata->desc)))
+        configured = epdata->state == STATE_EP_ENABLED;
-                return -EINVAL;
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
+        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (unlikely(!buf))
+        if (configured && !usb_endpoint_dir_in(&epdata->desc)) {
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
                return -ENOMEM;
+        }
-        for (i=0; i < nr_segs; i++) {
+        if (unlikely(copy_from_iter(buf, len, from) != len)) {
-                if (unlikely(copy_from_user(&buf[len], iov[i].iov_base,
+                value = -EFAULT;
-                                iov[i].iov_len) != 0)) {
+                goto out;
-                        kfree(buf);
+        }
-                        return -EFAULT;
+        if (unlikely(!configured)) {
+                value = ep_config(epdata, buf, len);
+        } else if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (priv) {
+                        value = ep_aio(iocb, priv, epdata, buf, len);
+                        if (value == -EIOCBQUEUED)
+                                buf = NULL;
                }
-                len += iov[i].iov_len;
        }
-        return ep_aio_rwtail(iocb, buf, len, epdata, NULL, 0);
+out:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
 /*----------------------------------------------------------------------*/
@@ -745,15 +693,15 @@ ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
 /* used after endpoint configuration */
 static const struct file_operations ep_io_operations = {
        .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
-        .read =         ep_read,
+        .open =         ep_open,
-        .write =        ep_write,
-        .unlocked_ioctl = ep_ioctl,
        .release =      ep_release,
+        .llseek =       no_llseek,
-        .aio_read =     ep_aio_read,
+        .read =         new_sync_read,
-        .aio_write =    ep_aio_write,
+        .write =        new_sync_write,
+        .unlocked_ioctl = ep_ioctl,
+        .read_iter =    ep_read_iter,
+        .write_iter =   ep_write_iter,
 };
 /* ENDPOINT INITIALIZATION
@@ -770,17 +718,12 @@ static const struct file_operations ep_io_operations = {
 * speed descriptor, then optional high speed descriptor.
 */
 static ssize_t
-ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ep_config (struct ep_data *data, const char *buf, size_t len)
 {
-        struct ep_data          *data = fd->private_data;
        struct usb_ep           *ep;
        u32                     tag;
        int                     value, length = len;
-        value = mutex_lock_interruptible(&data->lock);
-        if (value < 0)
-                return value;
        if (data->state != STATE_EP_READY) {
                value = -EL2HLT;
                goto fail;
@@ -791,9 +734,7 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                goto fail0;
        /* we might need to change message format someday */
-        if (copy_from_user (&tag, buf, 4)) {
+        memcpy(&tag, buf, 4);
-                goto fail1;
-        }
        if (tag != 1) {
                DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
                goto fail0;
@@ -806,19 +747,15 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         */
        /* full/low speed descriptor, then high speed */
-        if (copy_from_user (&data->desc, buf, USB_DT_ENDPOINT_SIZE)) {
+        memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE);
-                goto fail1;
-        }
        if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
                        || data->desc.bDescriptorType != USB_DT_ENDPOINT)
                goto fail0;
        if (len != USB_DT_ENDPOINT_SIZE) {
                if (len != 2 * USB_DT_ENDPOINT_SIZE)
                        goto fail0;
-                if (copy_from_user (&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
+                memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
-                                        USB_DT_ENDPOINT_SIZE)) {
+                        USB_DT_ENDPOINT_SIZE);
-                        goto fail1;
-                }
                if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
                                || data->hs_desc.bDescriptorType
                                        != USB_DT_ENDPOINT) {
@@ -840,24 +777,20 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        case USB_SPEED_LOW:
        case USB_SPEED_FULL:
                ep->desc = &data->desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                break;
        case USB_SPEED_HIGH:
                /* fails if caller didn't provide that descriptor... */
                ep->desc = &data->hs_desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                break;
        default:
                DBG(data->dev, "unconnected, %s init abandoned\n",
                                data->name);
                value = -EINVAL;
+                goto gone;
        }
+        value = usb_ep_enable(ep);
        if (value == 0) {
-                fd->f_op = &ep_io_operations;
+                data->state = STATE_EP_ENABLED;
                value = length;
        }
 gone:
@@ -867,14 +800,10 @@ fail:
                data->desc.bDescriptorType = 0;
                data->hs_desc.bDescriptorType = 0;
        }
-        mutex_unlock(&data->lock);
        return value;
 fail0:
        value = -EINVAL;
        goto fail;
-fail1:
-        value = -EFAULT;
-        goto fail;
 }
 static int
@@ -902,15 +831,6 @@ ep_open (struct inode *inode, struct file *fd)
        return value;
 }
-/* used before endpoint configuration */
-static const struct file_operations ep_config_operations = {
-        .llseek =       no_llseek,
-        .open =         ep_open,
-        .write =        ep_config,
-        .release =      ep_release,
-};
 /*----------------------------------------------------------------------*/
 /* EP0 IMPLEMENTATION can be partly in userspace.
@@ -989,6 +909,10 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
        enum ep0_state                  state;
        spin_lock_irq (&dev->lock);
+        if (dev->state <= STATE_DEV_OPENED) {
+                retval = -EINVAL;
+                goto done;
+        }
        /* report fd mode change before acting on it */
        if (dev->setup_abort) {
@@ -1187,8 +1111,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        struct dev_data         *dev = fd->private_data;
        ssize_t                 retval = -ESRCH;
-        spin_lock_irq (&dev->lock);
        /* report fd mode change before acting on it */
        if (dev->setup_abort) {
                dev->setup_abort = 0;
@@ -1234,7 +1156,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        } else
                DBG (dev, "fail %s, state %d\n", __func__, dev->state);
-        spin_unlock_irq (&dev->lock);
        return retval;
 }
@@ -1281,6 +1202,9 @@ ep0_poll (struct file *fd, poll_table *wait)
       struct dev_data         *dev = fd->private_data;
       int                     mask = 0;
+        if (dev->state <= STATE_DEV_OPENED)
+                return DEFAULT_POLLMASK;
       poll_wait(fd, &dev->wait, wait);
       spin_lock_irq (&dev->lock);
@@ -1316,19 +1240,6 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
        return ret;
 }
-/* used after device configuration */
-static const struct file_operations ep0_io_operations = {
-        .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
-        .read =         ep0_read,
-        .write =        ep0_write,
-        .fasync =       ep0_fasync,
-        .poll =         ep0_poll,
-        .unlocked_ioctl =       dev_ioctl,
-        .release =      dev_release,
-};
 /*----------------------------------------------------------------------*/
 /* The in-kernel gadget driver handles most ep0 issues, in particular
@@ -1650,7 +1561,7 @@ static int activate_ep_files (struct dev_data *dev)
                        goto enomem1;
                data->dentry = gadgetfs_create_file (dev->sb, data->name,
-                                data, &ep_config_operations);
+                                data, &ep_io_operations);
                if (!data->dentry)
                        goto enomem2;
                list_add_tail (&data->epfiles, &dev->epfiles);
@@ -1852,6 +1763,14 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        u32                     tag;
        char                    *kbuf;
+        spin_lock_irq(&dev->lock);
+        if (dev->state > STATE_DEV_OPENED) {
+                value = ep0_write(fd, buf, len, ptr);
+                spin_unlock_irq(&dev->lock);
+                return value;
+        }
+        spin_unlock_irq(&dev->lock);
        if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
                return -EINVAL;
@@ -1925,7 +1844,6 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 * on, they can work ... except in cleanup paths that
                 * kick in after the ep0 descriptor is closed.
                 */
-                fd->f_op = &ep0_io_operations;
                value = len;
        }
        return value;
@@ -1956,12 +1874,14 @@ dev_open (struct inode *inode, struct file *fd)
        return value;
 }
-static const struct file_operations dev_init_operations = {
+static const struct file_operations ep0_operations = {
        .llseek =       no_llseek,
        .open =         dev_open,
+        .read =         ep0_read,
        .write =        dev_config,
        .fasync =       ep0_fasync,
+        .poll =         ep0_poll,
        .unlocked_ioctl = dev_ioctl,
        .release =      dev_release,
 };
@@ -2077,7 +1997,7 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                goto Enomem;
        dev->sb = sb;
-        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &dev_init_operations);
+        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
        if (!dev->dentry) {
                put_dev(dev);
                goto Enomem;
diff --git a/drivers/usb/gadget/legacy/tcm_usb_gadget.c b/drivers/usb/gadget/legacy/tcm_usb_gadget.c
index 3a494168661e..6e0a019aad54 100644
--- a/drivers/usb/gadget/legacy/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/legacy/tcm_usb_gadget.c
@@ -1740,10 +1740,9 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
                goto err_session;
        }
        /*
-         * Now register the TCM vHost virtual I_T Nexus as active with the
+         * Now register the TCM vHost virtual I_T Nexus as active.
-         * call to __transport_register_session()
         */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                        tv_nexus->tvn_se_sess, tv_nexus);
        tpg->tpg_nexus = tv_nexus;
        mutex_unlock(&tpg->tpg_mutex);
diff --git a/drivers/usb/gadget/legacy/zero.c b/drivers/usb/gadget/legacy/zero.c
index ff97ac93ac03..5ee95152493c 100644
--- a/drivers/usb/gadget/legacy/zero.c
+++ b/drivers/usb/gadget/legacy/zero.c
@@ -68,8 +68,6 @@ static struct usb_zero_options gzero_options = {
        .isoc_maxpacket = GZERO_ISOC_MAXPACKET,
        .bulk_buflen = GZERO_BULK_BUFLEN,
        .qlen = GZERO_QLEN,
-        .int_interval = GZERO_INT_INTERVAL,
-        .int_maxpacket = GZERO_INT_MAXPACKET,
 };
 /*-------------------------------------------------------------------------*/
@@ -268,21 +266,6 @@ module_param_named(isoc_maxburst, gzero_options.isoc_maxburst, uint,
                S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(isoc_maxburst, "0 - 15 (ss only)");
-module_param_named(int_interval, gzero_options.int_interval, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_interval, "1 - 16");
-module_param_named(int_maxpacket, gzero_options.int_maxpacket, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_maxpacket, "0 - 1023 (fs), 0 - 1024 (hs/ss)");
-module_param_named(int_mult, gzero_options.int_mult, uint, S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_mult, "0 - 2 (hs/ss only)");
-module_param_named(int_maxburst, gzero_options.int_maxburst, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_maxburst, "0 - 15 (ss only)");
 static struct usb_function *func_lb;
 static struct usb_function_instance *func_inst_lb;
@@ -318,10 +301,6 @@ static int __init zero_bind(struct usb_composite_dev *cdev)
        ss_opts->isoc_maxpacket = gzero_options.isoc_maxpacket;
        ss_opts->isoc_mult = gzero_options.isoc_mult;
        ss_opts->isoc_maxburst = gzero_options.isoc_maxburst;
-        ss_opts->int_interval = gzero_options.int_interval;
-        ss_opts->int_maxpacket = gzero_options.int_maxpacket;
-        ss_opts->int_mult = gzero_options.int_mult;
-        ss_opts->int_maxburst = gzero_options.int_maxburst;
        ss_opts->bulk_buflen = gzero_options.bulk_buflen;
        func_ss = usb_get_function(func_inst_ss);
diff --git a/drivers/usb/host/ehci-atmel.c b/drivers/usb/host/ehci-atmel.c
index 663f7908b15c..be0964a801e8 100644
--- a/drivers/usb/host/ehci-atmel.c
+++ b/drivers/usb/host/ehci-atmel.c
@@ -34,7 +34,6 @@ static const char hcd_name[] = "ehci-atmel";
 struct atmel_ehci_priv {
        struct clk *iclk;
-        struct clk *fclk;
        struct clk *uclk;
        bool clocked;
 };
@@ -51,12 +50,9 @@ static void atmel_start_clock(struct atmel_ehci_priv *atmel_ehci)
 {
        if (atmel_ehci->clocked)
                return;
-        if (IS_ENABLED(CONFIG_COMMON_CLK)) {
-                clk_set_rate(atmel_ehci->uclk, 48000000);
+        clk_prepare_enable(atmel_ehci->uclk);
-                clk_prepare_enable(atmel_ehci->uclk);
-        }
        clk_prepare_enable(atmel_ehci->iclk);
-        clk_prepare_enable(atmel_ehci->fclk);
        atmel_ehci->clocked = true;
 }
@@ -64,10 +60,9 @@ static void atmel_stop_clock(struct atmel_ehci_priv *atmel_ehci)
 {
        if (!atmel_ehci->clocked)
                return;
-        clk_disable_unprepare(atmel_ehci->fclk);
        clk_disable_unprepare(atmel_ehci->iclk);
-        if (IS_ENABLED(CONFIG_COMMON_CLK))
+        clk_disable_unprepare(atmel_ehci->uclk);
-                clk_disable_unprepare(atmel_ehci->uclk);
        atmel_ehci->clocked = false;
 }
@@ -146,20 +141,13 @@ static int ehci_atmel_drv_probe(struct platform_device *pdev)
                retval = -ENOENT;
                goto fail_request_resource;
        }
-        atmel_ehci->fclk = devm_clk_get(&pdev->dev, "uhpck");
-        if (IS_ERR(atmel_ehci->fclk)) {
+        atmel_ehci->uclk = devm_clk_get(&pdev->dev, "usb_clk");
-                dev_err(&pdev->dev, "Error getting function clock\n");
+        if (IS_ERR(atmel_ehci->uclk)) {
-                retval = -ENOENT;
+                dev_err(&pdev->dev, "failed to get uclk\n");
+                retval = PTR_ERR(atmel_ehci->uclk);
                goto fail_request_resource;
        }
-        if (IS_ENABLED(CONFIG_COMMON_CLK)) {
-                atmel_ehci->uclk = devm_clk_get(&pdev->dev, "usb_clk");
-                if (IS_ERR(atmel_ehci->uclk)) {
-                        dev_err(&pdev->dev, "failed to get uclk\n");
-                        retval = PTR_ERR(atmel_ehci->uclk);
-                        goto fail_request_resource;
-                }
-        }
        ehci = hcd_to_ehci(hcd);
        /* registers start at offset 0x0 */
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5fb66db89e05..73485fa4372f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1729,7 +1729,7 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
        if (!command)
                return;
-        ep->ep_state |= EP_HALTED | EP_RECENTLY_HALTED;
+        ep->ep_state |= EP_HALTED;
        ep->stopped_stream = stream_id;
        xhci_queue_reset_ep(xhci, command, slot_id, ep_index);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b06d1a53652d..ec8ac1674854 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1338,12 +1338,6 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                goto exit;
        }
-        /* Reject urb if endpoint is in soft reset, queue must stay empty */
-        if (xhci->devs[slot_id]->eps[ep_index].ep_state & EP_CONFIG_PENDING) {
-                xhci_warn(xhci, "Can't enqueue URB while ep is in soft reset\n");
-                ret = -EINVAL;
-        }
        if (usb_endpoint_xfer_isoc(&urb->ep->desc))
                size = urb->number_of_packets;
        else
@@ -2954,36 +2948,23 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
        }
 }
-/* Called after clearing a halted device. USB core should have sent the control
+/* Called when clearing halted device. The core should have sent the control
 * message to clear the device halt condition. The host side of the halt should
- * already be cleared with a reset endpoint command issued immediately when the
+ * already be cleared with a reset endpoint command issued when the STALL tx
- * STALL tx event was received.
+ * event was received.
+ *
+ * Context: in_interrupt
 */
 void xhci_endpoint_reset(struct usb_hcd *hcd,
                struct usb_host_endpoint *ep)
 {
        struct xhci_hcd *xhci;
-        struct usb_device *udev;
-        struct xhci_virt_device *virt_dev;
-        struct xhci_virt_ep *virt_ep;
-        struct xhci_input_control_ctx *ctrl_ctx;
-        struct xhci_command *command;
-        unsigned int ep_index, ep_state;
-        unsigned long flags;
-        u32 ep_flag;
        xhci = hcd_to_xhci(hcd);
-        udev = (struct usb_device *) ep->hcpriv;
-        if (!ep->hcpriv)
-                return;
-        virt_dev = xhci->devs[udev->slot_id];
-        ep_index = xhci_get_endpoint_index(&ep->desc);
-        virt_ep = &virt_dev->eps[ep_index];
-        ep_state = virt_ep->ep_state;
        /*
-         * Implement the config ep command in xhci 4.6.8 additional note:
+         * We might need to implement the config ep cmd in xhci 4.8.1 note:
         * The Reset Endpoint Command may only be issued to endpoints in the
         * Halted state. If software wishes reset the Data Toggle or Sequence
         * Number of an endpoint that isn't in the Halted state, then software
@@ -2991,72 +2972,9 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
         * for the target endpoint. that is in the Stopped state.
         */
-        if (ep_state & SET_DEQ_PENDING || ep_state & EP_RECENTLY_HALTED) {
+        /* For now just print debug to follow the situation */
-                virt_ep->ep_state &= ~EP_RECENTLY_HALTED;
+        xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
-                xhci_dbg(xhci, "ep recently halted, no toggle reset needed\n");
+                 ep->desc.bEndpointAddress);
-                return;
-        }
-        /* Only interrupt and bulk ep's use Data toggle, USB2 spec 5.5.4-> */
-        if (usb_endpoint_xfer_control(&ep->desc) ||
-            usb_endpoint_xfer_isoc(&ep->desc))
-                return;
-        ep_flag = xhci_get_endpoint_flag(&ep->desc);
-        if (ep_flag == SLOT_FLAG || ep_flag == EP0_FLAG)
-                return;
-        command = xhci_alloc_command(xhci, true, true, GFP_NOWAIT);
-        if (!command) {
-                xhci_err(xhci, "Could not allocate xHCI command structure.\n");
-                return;
-        }
-        spin_lock_irqsave(&xhci->lock, flags);
-        /* block ringing ep doorbell */
-        virt_ep->ep_state |= EP_CONFIG_PENDING;
-        /*
-         * Make sure endpoint ring is empty before resetting the toggle/seq.
-         * Driver is required to synchronously cancel all transfer request.
-         *
-         * xhci 4.6.6 says we can issue a configure endpoint command on a
-         * running endpoint ring as long as it's idle (queue empty)
-         */
-        if (!list_empty(&virt_ep->ring->td_list)) {
-                dev_err(&udev->dev, "EP not empty, refuse reset\n");
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                goto cleanup;
-        }
-        xhci_dbg(xhci, "Reset toggle/seq for slot %d, ep_index: %d\n",
-                 udev->slot_id, ep_index);
-        ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
-        if (!ctrl_ctx) {
-                xhci_err(xhci, "Could not get input context, bad type. virt_dev: %p, in_ctx %p\n",
-                         virt_dev, virt_dev->in_ctx);
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                goto cleanup;
-        }
-        xhci_setup_input_ctx_for_config_ep(xhci, command->in_ctx,
-                                           virt_dev->out_ctx, ctrl_ctx,
-                                           ep_flag, ep_flag);
-        xhci_endpoint_copy(xhci, command->in_ctx, virt_dev->out_ctx, ep_index);
-        xhci_queue_configure_endpoint(xhci, command, command->in_ctx->dma,
-                                     udev->slot_id, false);
-        xhci_ring_cmd_db(xhci);
-        spin_unlock_irqrestore(&xhci->lock, flags);
-        wait_for_completion(command->completion);
-cleanup:
-        virt_ep->ep_state &= ~EP_CONFIG_PENDING;
-        xhci_free_command(xhci, command);
 }
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 265ab1771d24..8e421b89632d 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -865,8 +865,6 @@ struct xhci_virt_ep {
 #define EP_HAS_STREAMS          (1 << 4)
 /* Transitioning the endpoint to not using streams, don't enqueue URBs */
 #define EP_GETTING_NO_STREAMS   (1 << 5)
-#define EP_RECENTLY_HALTED      (1 << 6)
-#define EP_CONFIG_PENDING       (1 << 7)
        /* ----  Related to URB cancellation ---- */
        struct list_head        cancelled_td_list;
        struct xhci_td          *stopped_td;
diff --git a/drivers/usb/isp1760/isp1760-core.c b/drivers/usb/isp1760/isp1760-core.c
index b9827556455f..bfa402cf3a27 100644
--- a/drivers/usb/isp1760/isp1760-core.c
+++ b/drivers/usb/isp1760/isp1760-core.c
@@ -151,8 +151,7 @@ int isp1760_register(struct resource *mem, int irq, unsigned long irqflags,
        }
        if (IS_ENABLED(CONFIG_USB_ISP1761_UDC) && !udc_disabled) {
-                ret = isp1760_udc_register(isp, irq, irqflags | IRQF_SHARED |
+                ret = isp1760_udc_register(isp, irq, irqflags);
-                                           IRQF_DISABLED);
                if (ret < 0) {
                        isp1760_hcd_unregister(&isp->hcd);
                        return ret;
diff --git a/drivers/usb/isp1760/isp1760-udc.c b/drivers/usb/isp1760/isp1760-udc.c
index 9612d7990565..f32c292cc868 100644
--- a/drivers/usb/isp1760/isp1760-udc.c
+++ b/drivers/usb/isp1760/isp1760-udc.c
@@ -1191,6 +1191,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
                             struct usb_gadget_driver *driver)
 {
        struct isp1760_udc *udc = gadget_to_udc(gadget);
+        unsigned long flags;
        /* The hardware doesn't support low speed. */
        if (driver->max_speed < USB_SPEED_FULL) {
@@ -1198,7 +1199,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
                return -EINVAL;
        }
-        spin_lock(&udc->lock);
+        spin_lock_irqsave(&udc->lock, flags);
        if (udc->driver) {
                dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
@@ -1208,7 +1209,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
        udc->driver = driver;
-        spin_unlock(&udc->lock);
+        spin_unlock_irqrestore(&udc->lock, flags);
        dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
                driver->function);
@@ -1232,6 +1233,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
 static int isp1760_udc_stop(struct usb_gadget *gadget)
 {
        struct isp1760_udc *udc = gadget_to_udc(gadget);
+        unsigned long flags;
        dev_dbg(udc->isp->dev, "%s\n", __func__);
@@ -1239,9 +1241,9 @@ static int isp1760_udc_stop(struct usb_gadget *gadget)
        isp1760_udc_write(udc, DC_MODE, 0);
-        spin_lock(&udc->lock);
+        spin_lock_irqsave(&udc->lock, flags);
        udc->driver = NULL;
-        spin_unlock(&udc->lock);
+        spin_unlock_irqrestore(&udc->lock, flags);
        return 0;
 }
@@ -1411,7 +1413,7 @@ static int isp1760_udc_init(struct isp1760_udc *udc)
                return -ENODEV;
        }
-        if (chipid != 0x00011582) {
+        if (chipid != 0x00011582 && chipid != 0x00158210) {
                dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
                return -ENODEV;
        }
@@ -1451,8 +1453,8 @@ int isp1760_udc_register(struct isp1760_device *isp, int irq,
        sprintf(udc->irqname, "%s (udc)", devname);
-        ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | IRQF_DISABLED |
+        ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
-                          irqflags, udc->irqname, udc);
+                          udc->irqname, udc);
        if (ret < 0)
                goto error;
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 14e1628483d9..39db8b603627 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -79,7 +79,8 @@ config USB_MUSB_TUSB6010
 config USB_MUSB_OMAP2PLUS
        tristate "OMAP2430 and onwards"
-        depends on ARCH_OMAP2PLUS && USB && OMAP_CONTROL_PHY
+        depends on ARCH_OMAP2PLUS && USB
+        depends on OMAP_CONTROL_PHY || !OMAP_CONTROL_PHY
        select GENERIC_PHY
 config USB_MUSB_AM35X
diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
index 403fab772724..7b3035ff9434 100644
--- a/drivers/usb/phy/phy-am335x-control.c
+++ b/drivers/usb/phy/phy-am335x-control.c
@@ -126,6 +126,9 @@ struct phy_control *am335x_get_phy_control(struct device *dev)
                return NULL;
        dev = bus_find_device(&platform_bus_type, NULL, node, match);
+        if (!dev)
+                return NULL;
        ctrl_usb = dev_get_drvdata(dev);
        if (!ctrl_usb)
                return NULL;
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 82570425fdfe..c85ea530085f 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_NO_ATA_1X),
+/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+                "Initio Corporation",
+                "",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
 /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
                "JMicron",
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index f88bfdf5b6a0..2027a27546ef 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -868,12 +868,14 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
                                func = vfio_pci_set_err_trigger;
                        break;
                }
+                break;
        case VFIO_PCI_REQ_IRQ_INDEX:
                switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
                case VFIO_IRQ_SET_ACTION_TRIGGER:
                        func = vfio_pci_set_req_trigger;
                        break;
                }
+                break;
        }
        if (!func)
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 8d4f3f1ff799..71df240a467a 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1956,10 +1956,9 @@ static int vhost_scsi_make_nexus(struct vhost_scsi_tpg *tpg,
                goto out;
        }
        /*
-         * Now register the TCM vhost virtual I_T Nexus as active with the
+         * Now register the TCM vhost virtual I_T Nexus as active.
-         * call to __transport_register_session()
         */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                        tv_nexus->tvn_se_sess, tv_nexus);
        tpg->tpg_nexus = tv_nexus;
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 0413157f3b49..6a356e344f82 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/balloon_compaction.h>
 #include <linux/oom.h>
+#include <linux/wait.h>
 /*
 * Balloon device works in 4K page units.  So each page is pointed to by
@@ -334,17 +335,25 @@ static int virtballoon_oom_notify(struct notifier_block *self,
 static int balloon(void *_vballoon)
 {
        struct virtio_balloon *vb = _vballoon;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        set_freezable();
        while (!kthread_should_stop()) {
                s64 diff;
                try_to_freeze();
-                wait_event_interruptible(vb->config_change,
-                                         (diff = towards_target(vb)) != 0
+                add_wait_queue(&vb->config_change, &wait);
-                                         || vb->need_stats_update
+                for (;;) {
-                                         || kthread_should_stop()
+                        if ((diff = towards_target(vb)) != 0 ||
-                                         || freezing(current));
+                            vb->need_stats_update ||
+                            kthread_should_stop() ||
+                            freezing(current))
+                                break;
+                        wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+                }
+                remove_wait_queue(&vb->config_change, &wait);
                if (vb->need_stats_update)
                        stats_handle_request(vb);
                if (diff > 0)
@@ -499,6 +508,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
        if (err < 0)
                goto out_oom_notify;
+        virtio_device_ready(vdev);
        vb->thread = kthread_run(balloon, vb, "vballoon");
        if (IS_ERR(vb->thread)) {
                err = PTR_ERR(vb->thread);
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index cad569890908..6010d7ec0a0f 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -156,22 +156,95 @@ static void vm_get(struct virtio_device *vdev, unsigned offset,
                   void *buf, unsigned len)
 {
        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        u8 *ptr = buf;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
-        int i;
+        u8 b;
+        __le16 w;
+        __le32 l;
-        for (i = 0; i < len; i++)
+        if (vm_dev->version == 1) {
-                ptr[i] = readb(vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+                u8 *ptr = buf;
+                int i;
+                for (i = 0; i < len; i++)
+                        ptr[i] = readb(base + offset + i);
+                return;
+        }
+        switch (len) {
+        case 1:
+                b = readb(base + offset);
+                memcpy(buf, &b, sizeof b);
+                break;
+        case 2:
+                w = cpu_to_le16(readw(base + offset));
+                memcpy(buf, &w, sizeof w);
+                break;
+        case 4:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                break;
+        case 8:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                l = cpu_to_le32(ioread32(base + offset + sizeof l));
+                memcpy(buf + sizeof l, &l, sizeof l);
+                break;
+        default:
+                BUG();
+        }
 }
 static void vm_set(struct virtio_device *vdev, unsigned offset,
                   const void *buf, unsigned len)
 {
        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        const u8 *ptr = buf;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
-        int i;
+        u8 b;
+        __le16 w;
+        __le32 l;
-        for (i = 0; i < len; i++)
+        if (vm_dev->version == 1) {
-                writeb(ptr[i], vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+                const u8 *ptr = buf;
+                int i;
+                for (i = 0; i < len; i++)
+                        writeb(ptr[i], base + offset + i);
+                return;
+        }
+        switch (len) {
+        case 1:
+                memcpy(&b, buf, sizeof b);
+                writeb(b, base + offset);
+                break;
+        case 2:
+                memcpy(&w, buf, sizeof w);
+                writew(le16_to_cpu(w), base + offset);
+                break;
+        case 4:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                break;
+        case 8:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                memcpy(&l, buf + sizeof l, sizeof l);
+                writel(le32_to_cpu(l), base + offset + sizeof l);
+                break;
+        default:
+                BUG();
+        }
+}
+static u32 vm_generation(struct virtio_device *vdev)
+{
+        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
+        if (vm_dev->version == 1)
+                return 0;
+        else
+                return readl(vm_dev->base + VIRTIO_MMIO_CONFIG_GENERATION);
 }
 static u8 vm_get_status(struct virtio_device *vdev)
@@ -440,6 +513,7 @@ static const char *vm_bus_name(struct virtio_device *vdev)
 static const struct virtio_config_ops virtio_mmio_config_ops = {
        .get            = vm_get,
        .set            = vm_set,
+        .generation     = vm_generation,
        .get_status     = vm_get_status,
        .set_status     = vm_set_status,
        .reset          = vm_reset,
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index b4bca2d4a7e5..70fba973a107 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsigned int irq)
        pirq_query_unmask(irq);
        rc = set_evtchn_to_irq(evtchn, irq);
-        if (rc != 0) {
+        if (rc)
-                pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
+                goto err;
-                       irq, rc);
-                xen_evtchn_close(evtchn);
-                return 0;
-        }
        bind_evtchn_to_cpu(evtchn, 0);
        info->evtchn = evtchn;
+        rc = xen_evtchn_port_setup(info);
+        if (rc)
+                goto err;
 out:
        unmask_evtchn(evtchn);
        eoi_pirq(irq_get_irq_data(irq));
        return 0;
+err:
+        pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
+        xen_evtchn_close(evtchn);
+        return 0;
 }
 static unsigned int startup_pirq(struct irq_data *data)
diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
index 46ae0f9f02ad..75fe3d466515 100644
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -16,7 +16,7 @@
 #include "conf_space.h"
 #include "conf_space_quirks.h"
-static bool permissive;
+bool permissive;
 module_param(permissive, bool, 0644);
 /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
index e56c934ad137..2e1d73d1d5d0 100644
--- a/drivers/xen/xen-pciback/conf_space.h
+++ b/drivers/xen/xen-pciback/conf_space.h
@@ -64,6 +64,8 @@ struct config_field_entry {
        void *data;
 };
+extern bool permissive;
 #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
 /* Add fields to a device - the add_fields macro expects to get a pointer to
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index c5ee82587e8c..2d7369391472 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -11,6 +11,10 @@
 #include "pciback.h"
 #include "conf_space.h"
+struct pci_cmd_info {
+        u16 val;
+};
 struct pci_bar_info {
        u32 val;
        u32 len_val;
@@ -20,22 +24,36 @@ struct pci_bar_info {
 #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
 #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+/* Bits guests are allowed to control in permissive mode. */
+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
+                           PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
+                           PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
+static void *command_init(struct pci_dev *dev, int offset)
 {
-        int i;
+        struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
-        int ret;
+        int err;
-        ret = xen_pcibk_read_config_word(dev, offset, value, data);
+        if (!cmd)
-        if (!pci_is_enabled(dev))
+                return ERR_PTR(-ENOMEM);
-                return ret;
+        err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
-        for (i = 0; i < PCI_ROM_RESOURCE; i++) {
+        if (err) {
-                if (dev->resource[i].flags & IORESOURCE_IO)
+                kfree(cmd);
-                        *value |= PCI_COMMAND_IO;
+                return ERR_PTR(err);
-                if (dev->resource[i].flags & IORESOURCE_MEM)
-                        *value |= PCI_COMMAND_MEMORY;
        }
+        return cmd;
+}
+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+{
+        int ret = pci_read_config_word(dev, offset, value);
+        const struct pci_cmd_info *cmd = data;
+        *value &= PCI_COMMAND_GUEST;
+        *value |= cmd->val & ~PCI_COMMAND_GUEST;
        return ret;
 }
@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
 {
        struct xen_pcibk_dev_data *dev_data;
        int err;
+        u16 val;
+        struct pci_cmd_info *cmd = data;
        dev_data = pci_get_drvdata(dev);
        if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
                }
        }
+        cmd->val = value;
+        if (!permissive && (!dev_data || !dev_data->permissive))
+                return 0;
+        /* Only allow the guest to control certain bits. */
+        err = pci_read_config_word(dev, offset, &val);
+        if (err || val == value)
+                return err;
+        value &= PCI_COMMAND_GUEST;
+        value |= val & ~PCI_COMMAND_GUEST;
        return pci_write_config_word(dev, offset, value);
 }
@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
        {
         .offset    = PCI_COMMAND,
         .size      = 2,
+         .init      = command_init,
+         .release   = bar_release,
         .u.w.read  = command_read,
         .u.w.write = command_write,
        },
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 9faca6a60bb0..42bd55a6c237 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -1659,11 +1659,8 @@ static int scsiback_make_nexus(struct scsiback_tpg *tpg,
                         name);
                goto out;
        }
-        /*
+        /* Now register the TCM pvscsi virtual I_T Nexus as active. */
-         * Now register the TCM pvscsi virtual I_T Nexus as active with the
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
-         * call to __transport_register_session()
-         */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                        tv_nexus->tvn_se_sess, tv_nexus);
        tpg->tpg_nexus = tv_nexus;