98 files changed, 628 insertions, 435 deletions
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 26311f23c824..cb1d557fc22c 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -942,6 +942,7 @@ static int erst_clearer(enum pstore_type_id type, u64 id, int count,
 static struct pstore_info erst_info = {
        .owner          = THIS_MODULE,
        .name           = "erst",
+        .flags          = PSTORE_FLAGS_FRAGILE,
        .open           = erst_open_pstore,
        .close          = erst_close_pstore,
        .read           = erst_reader,
diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 7be41e676a64..00a3abe103a5 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -60,7 +60,7 @@ static int s2mps11_clk_prepare(struct clk_hw *hw)
        struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
        int ret;
-        ret = regmap_update_bits(s2mps11->iodev->regmap,
+        ret = regmap_update_bits(s2mps11->iodev->regmap_pmic,
                                S2MPS11_REG_RTC_CTRL,
                                 s2mps11->mask, s2mps11->mask);
        if (!ret)
@@ -74,7 +74,7 @@ static void s2mps11_clk_unprepare(struct clk_hw *hw)
        struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
        int ret;
-        ret = regmap_update_bits(s2mps11->iodev->regmap, S2MPS11_REG_RTC_CTRL,
+        ret = regmap_update_bits(s2mps11->iodev->regmap_pmic, S2MPS11_REG_RTC_CTRL,
                           s2mps11->mask, ~s2mps11->mask);
        if (!ret)
@@ -174,7 +174,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
                s2mps11_clk->hw.init = &s2mps11_clks_init[i];
                s2mps11_clk->mask = 1 << i;
-                ret = regmap_read(s2mps11_clk->iodev->regmap,
+                ret = regmap_read(s2mps11_clk->iodev->regmap_pmic,
                                  S2MPS11_REG_RTC_CTRL, &val);
                if (ret < 0)
                        goto err_reg;
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 5c07a56962db..634c4d6dd45a 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -75,6 +75,7 @@ config CLKSRC_DBX500_PRCMU_SCHED_CLOCK
 config CLKSRC_EFM32
        bool "Clocksource for Energy Micro's EFM32 SoCs" if !ARCH_EFM32
        depends on OF && ARM && (ARCH_EFM32 || COMPILE_TEST)
+        select CLKSRC_MMIO
        default ARCH_EFM32
        help
          Support to use the timers of EFM32 SoCs as clock source and clock
diff --git a/drivers/clocksource/clksrc-of.c b/drivers/clocksource/clksrc-of.c
index 35639cf4e5a2..b9ddd9e3a2f5 100644
--- a/drivers/clocksource/clksrc-of.c
+++ b/drivers/clocksource/clksrc-of.c
@@ -35,6 +35,5 @@ void __init clocksource_of_init(void)
                init_func = match->data;
                init_func(np);
-                of_node_put(np);
        }
 }
diff --git a/drivers/clocksource/dw_apb_timer_of.c b/drivers/clocksource/dw_apb_timer_of.c
index 45ba8aecc729..2a2ea2717f3a 100644
--- a/drivers/clocksource/dw_apb_timer_of.c
+++ b/drivers/clocksource/dw_apb_timer_of.c
@@ -108,12 +108,11 @@ static void __init add_clocksource(struct device_node *source_timer)
 static u64 read_sched_clock(void)
 {
-        return __raw_readl(sched_io_base);
+        return ~__raw_readl(sched_io_base);
 }
 static const struct of_device_id sptimer_ids[] __initconst = {
        { .compatible = "picochip,pc3x2-rtc" },
-        { .compatible = "snps,dw-apb-timer-sp" },
        { /* Sentinel */ },
 };
@@ -151,4 +150,6 @@ static void __init dw_apb_timer_init(struct device_node *timer)
        num_called++;
 }
 CLOCKSOURCE_OF_DECLARE(pc3x2_timer, "picochip,pc3x2-timer", dw_apb_timer_init);
-CLOCKSOURCE_OF_DECLARE(apb_timer, "snps,dw-apb-timer-osc", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer_osc, "snps,dw-apb-timer-osc", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer_sp, "snps,dw-apb-timer-sp", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer, "snps,dw-apb-timer", dw_apb_timer_init);
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index 2fb4695a28d8..a4f6119aafd8 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -179,6 +179,9 @@ static void __init sun4i_timer_init(struct device_node *node)
        writel(TIMER_CTL_CLK_SRC(TIMER_CTL_CLK_SRC_OSC24M),
               timer_base + TIMER_CTL_REG(0));
+        /* Make sure timer is stopped before playing with interrupts */
+        sun4i_clkevt_time_stop(0);
        ret = setup_irq(irq, &sun4i_timer_irq);
        if (ret)
                pr_warn("failed to setup irq %d\n", irq);
diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
index d8e47e502785..4e7f6802e840 100644
--- a/drivers/clocksource/time-armada-370-xp.c
+++ b/drivers/clocksource/time-armada-370-xp.c
@@ -256,11 +256,6 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
        ticks_per_jiffy = (timer_clk + HZ / 2) / HZ;
        /*
-         * Set scale and timer for sched_clock.
-         */
-        sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
-        /*
         * Setup free-running clocksource timer (interrupts
         * disabled).
         */
@@ -270,6 +265,11 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
        timer_ctrl_clrset(0, TIMER0_EN | TIMER0_RELOAD_EN |
                             TIMER0_DIV(TIMER_DIVIDER_SHIFT));
+        /*
+         * Set scale and timer for sched_clock.
+         */
+        sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
        clocksource_mmio_init(timer_base + TIMER0_VAL_OFF,
                              "armada_370_xp_clocksource",
                              timer_clk, 300, 32, clocksource_mmio_readl_down);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 446687cc2334..c823daaf9043 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -62,6 +62,7 @@ config INTEL_IOATDMA
        tristate "Intel I/OAT DMA support"
        depends on PCI && X86
        select DMA_ENGINE
+        select DMA_ENGINE_RAID
        select DCA
        help
          Enable support for the Intel(R) I/OAT DMA engine present
@@ -112,6 +113,7 @@ config MV_XOR
        bool "Marvell XOR engine support"
        depends on PLAT_ORION
        select DMA_ENGINE
+        select DMA_ENGINE_RAID
        select ASYNC_TX_ENABLE_CHANNEL_SWITCH
        ---help---
          Enable support for the Marvell XOR engine.
@@ -187,6 +189,7 @@ config AMCC_PPC440SPE_ADMA
        tristate "AMCC PPC440SPe ADMA support"
        depends on 440SPe || 440SP
        select DMA_ENGINE
+        select DMA_ENGINE_RAID
        select ARCH_HAS_ASYNC_TX_FIND_CHANNEL
        select ASYNC_TX_ENABLE_CHANNEL_SWITCH
        help
@@ -352,6 +355,7 @@ config NET_DMA
        bool "Network: TCP receive copy offload"
        depends on DMA_ENGINE && NET
        default (INTEL_IOATDMA || FSL_DMA)
+        depends on BROKEN
        help
          This enables the use of DMA engines in the network stack to
          offload receive copy-to-user operations, freeing CPU cycles.
@@ -377,4 +381,7 @@ config DMATEST
          Simple DMA test client. Say N unless you're debugging a
          DMA Device driver.
+config DMA_ENGINE_RAID
+        bool
 endif
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index f31d647acdfa..2787aba60c6b 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -347,10 +347,6 @@ static struct device *chan2dev(struct dma_chan *chan)
 {
        return &chan->dev->device;
 }
-static struct device *chan2parent(struct dma_chan *chan)
-{
-        return chan->dev->device.parent;
-}
 #if defined(VERBOSE_DEBUG)
 static void vdbg_dump_regs(struct at_dma_chan *atchan)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index ea806bdc12ef..ef63b9058f3c 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -912,7 +912,7 @@ struct dmaengine_unmap_pool {
 #define __UNMAP_POOL(x) { .size = x, .name = "dmaengine-unmap-" __stringify(x) }
 static struct dmaengine_unmap_pool unmap_pool[] = {
        __UNMAP_POOL(2),
-        #if IS_ENABLED(CONFIG_ASYNC_TX_DMA)
+        #if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
        __UNMAP_POOL(16),
        __UNMAP_POOL(128),
        __UNMAP_POOL(256),
@@ -1054,7 +1054,7 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
        dma_cookie_t cookie;
        unsigned long flags;
-        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOIO);
+        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOWAIT);
        if (!unmap)
                return -ENOMEM;
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 20f9a3aaf926..9dfcaf5c1288 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -539,9 +539,9 @@ static int dmatest_func(void *data)
                um->len = params->buf_size;
                for (i = 0; i < src_cnt; i++) {
-                        unsigned long buf = (unsigned long) thread->srcs[i];
+                        void *buf = thread->srcs[i];
                        struct page *pg = virt_to_page(buf);
-                        unsigned pg_off = buf & ~PAGE_MASK;
+                        unsigned pg_off = (unsigned long) buf & ~PAGE_MASK;
                        um->addr[i] = dma_map_page(dev->dev, pg, pg_off,
                                                   um->len, DMA_TO_DEVICE);
@@ -559,9 +559,9 @@ static int dmatest_func(void *data)
                /* map with DMA_BIDIRECTIONAL to force writeback/invalidate */
                dsts = &um->addr[src_cnt];
                for (i = 0; i < dst_cnt; i++) {
-                        unsigned long buf = (unsigned long) thread->dsts[i];
+                        void *buf = thread->dsts[i];
                        struct page *pg = virt_to_page(buf);
-                        unsigned pg_off = buf & ~PAGE_MASK;
+                        unsigned pg_off = (unsigned long) buf & ~PAGE_MASK;
                        dsts[i] = dma_map_page(dev->dev, pg, pg_off, um->len,
                                               DMA_BIDIRECTIONAL);
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 7086a16a55f2..f157c6f76b32 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -86,11 +86,6 @@ static void set_desc_cnt(struct fsldma_chan *chan,
        hw->count = CPU_TO_DMA(chan, count, 32);
 }
-static u32 get_desc_cnt(struct fsldma_chan *chan, struct fsl_desc_sw *desc)
-{
-        return DMA_TO_CPU(chan, desc->hw.count, 32);
-}
 static void set_desc_src(struct fsldma_chan *chan,
                         struct fsl_dma_ld_hw *hw, dma_addr_t src)
 {
@@ -101,16 +96,6 @@ static void set_desc_src(struct fsldma_chan *chan,
        hw->src_addr = CPU_TO_DMA(chan, snoop_bits | src, 64);
 }
-static dma_addr_t get_desc_src(struct fsldma_chan *chan,
-                               struct fsl_desc_sw *desc)
-{
-        u64 snoop_bits;
-        snoop_bits = ((chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
-                ? ((u64)FSL_DMA_SATR_SREADTYPE_SNOOP_READ << 32) : 0;
-        return DMA_TO_CPU(chan, desc->hw.src_addr, 64) & ~snoop_bits;
-}
 static void set_desc_dst(struct fsldma_chan *chan,
                         struct fsl_dma_ld_hw *hw, dma_addr_t dst)
 {
@@ -121,16 +106,6 @@ static void set_desc_dst(struct fsldma_chan *chan,
        hw->dst_addr = CPU_TO_DMA(chan, snoop_bits | dst, 64);
 }
-static dma_addr_t get_desc_dst(struct fsldma_chan *chan,
-                               struct fsl_desc_sw *desc)
-{
-        u64 snoop_bits;
-        snoop_bits = ((chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
-                ? ((u64)FSL_DMA_DATR_DWRITETYPE_SNOOP_WRITE << 32) : 0;
-        return DMA_TO_CPU(chan, desc->hw.dst_addr, 64) & ~snoop_bits;
-}
 static void set_desc_next(struct fsldma_chan *chan,
                          struct fsl_dma_ld_hw *hw, dma_addr_t next)
 {
@@ -408,7 +383,7 @@ static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
        struct fsl_desc_sw *desc = tx_to_fsl_desc(tx);
        struct fsl_desc_sw *child;
        unsigned long flags;
-        dma_cookie_t cookie;
+        dma_cookie_t cookie = -EINVAL;
        spin_lock_irqsave(&chan->desc_lock, flags);
@@ -854,10 +829,6 @@ static void fsldma_cleanup_descriptor(struct fsldma_chan *chan,
                                      struct fsl_desc_sw *desc)
 {
        struct dma_async_tx_descriptor *txd = &desc->async_tx;
-        struct device *dev = chan->common.device->dev;
-        dma_addr_t src = get_desc_src(chan, desc);
-        dma_addr_t dst = get_desc_dst(chan, desc);
-        u32 len = get_desc_cnt(chan, desc);
        /* Run the link descriptor callback function */
        if (txd->callback) {
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 7807f0ef4e20..53fb0c8365b0 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -54,12 +54,6 @@ static void mv_desc_init(struct mv_xor_desc_slot *desc, unsigned long flags)
        hw_desc->desc_command = (1 << 31);
 }
-static u32 mv_desc_get_dest_addr(struct mv_xor_desc_slot *desc)
-{
-        struct mv_xor_desc *hw_desc = desc->hw_desc;
-        return hw_desc->phy_dest_addr;
-}
 static void mv_desc_set_byte_count(struct mv_xor_desc_slot *desc,
                                   u32 byte_count)
 {
@@ -787,7 +781,6 @@ static void mv_xor_issue_pending(struct dma_chan *chan)
 /*
 * Perform a transaction to verify the HW works.
 */
-#define MV_XOR_TEST_SIZE 2000
 static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
 {
@@ -797,20 +790,21 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
        struct dma_chan *dma_chan;
        dma_cookie_t cookie;
        struct dma_async_tx_descriptor *tx;
+        struct dmaengine_unmap_data *unmap;
        int err = 0;
-        src = kmalloc(sizeof(u8) * MV_XOR_TEST_SIZE, GFP_KERNEL);
+        src = kmalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
        if (!src)
                return -ENOMEM;
-        dest = kzalloc(sizeof(u8) * MV_XOR_TEST_SIZE, GFP_KERNEL);
+        dest = kzalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
        if (!dest) {
                kfree(src);
                return -ENOMEM;
        }
        /* Fill in src buffer */
-        for (i = 0; i < MV_XOR_TEST_SIZE; i++)
+        for (i = 0; i < PAGE_SIZE; i++)
                ((u8 *) src)[i] = (u8)i;
        dma_chan = &mv_chan->dmachan;
@@ -819,14 +813,26 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
                goto out;
        }
-        dest_dma = dma_map_single(dma_chan->device->dev, dest,
+        unmap = dmaengine_get_unmap_data(dma_chan->device->dev, 2, GFP_KERNEL);
-                                  MV_XOR_TEST_SIZE, DMA_FROM_DEVICE);
+        if (!unmap) {
+                err = -ENOMEM;
+                goto free_resources;
+        }
+        src_dma = dma_map_page(dma_chan->device->dev, virt_to_page(src), 0,
+                                 PAGE_SIZE, DMA_TO_DEVICE);
+        unmap->to_cnt = 1;
+        unmap->addr[0] = src_dma;
-        src_dma = dma_map_single(dma_chan->device->dev, src,
+        dest_dma = dma_map_page(dma_chan->device->dev, virt_to_page(dest), 0,
-                                 MV_XOR_TEST_SIZE, DMA_TO_DEVICE);
+                                  PAGE_SIZE, DMA_FROM_DEVICE);
+        unmap->from_cnt = 1;
+        unmap->addr[1] = dest_dma;
+        unmap->len = PAGE_SIZE;
        tx = mv_xor_prep_dma_memcpy(dma_chan, dest_dma, src_dma,
-                                    MV_XOR_TEST_SIZE, 0);
+                                    PAGE_SIZE, 0);
        cookie = mv_xor_tx_submit(tx);
        mv_xor_issue_pending(dma_chan);
        async_tx_ack(tx);
@@ -841,8 +847,8 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
        }
        dma_sync_single_for_cpu(dma_chan->device->dev, dest_dma,
-                                MV_XOR_TEST_SIZE, DMA_FROM_DEVICE);
+                                PAGE_SIZE, DMA_FROM_DEVICE);
-        if (memcmp(src, dest, MV_XOR_TEST_SIZE)) {
+        if (memcmp(src, dest, PAGE_SIZE)) {
                dev_err(dma_chan->device->dev,
                        "Self-test copy failed compare, disabling\n");
                err = -ENODEV;
@@ -850,6 +856,7 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
        }
 free_resources:
+        dmaengine_unmap_put(unmap);
        mv_xor_free_chan_resources(dma_chan);
 out:
        kfree(src);
@@ -867,13 +874,15 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
        dma_addr_t dma_srcs[MV_XOR_NUM_SRC_TEST];
        dma_addr_t dest_dma;
        struct dma_async_tx_descriptor *tx;
+        struct dmaengine_unmap_data *unmap;
        struct dma_chan *dma_chan;
        dma_cookie_t cookie;
        u8 cmp_byte = 0;
        u32 cmp_word;
        int err = 0;
+        int src_count = MV_XOR_NUM_SRC_TEST;
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
+        for (src_idx = 0; src_idx < src_count; src_idx++) {
                xor_srcs[src_idx] = alloc_page(GFP_KERNEL);
                if (!xor_srcs[src_idx]) {
                        while (src_idx--)
@@ -890,13 +899,13 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
        }
        /* Fill in src buffers */
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
+        for (src_idx = 0; src_idx < src_count; src_idx++) {
                u8 *ptr = page_address(xor_srcs[src_idx]);
                for (i = 0; i < PAGE_SIZE; i++)
                        ptr[i] = (1 << src_idx);
        }
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++)
+        for (src_idx = 0; src_idx < src_count; src_idx++)
                cmp_byte ^= (u8) (1 << src_idx);
        cmp_word = (cmp_byte << 24) | (cmp_byte << 16) |
@@ -910,16 +919,29 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
                goto out;
        }
+        unmap = dmaengine_get_unmap_data(dma_chan->device->dev, src_count + 1,
+                                         GFP_KERNEL);
+        if (!unmap) {
+                err = -ENOMEM;
+                goto free_resources;
+        }
        /* test xor */
-        dest_dma = dma_map_page(dma_chan->device->dev, dest, 0, PAGE_SIZE,
+        for (i = 0; i < src_count; i++) {
-                                DMA_FROM_DEVICE);
+                unmap->addr[i] = dma_map_page(dma_chan->device->dev, xor_srcs[i],
+                                              0, PAGE_SIZE, DMA_TO_DEVICE);
+                dma_srcs[i] = unmap->addr[i];
+                unmap->to_cnt++;
+        }
-        for (i = 0; i < MV_XOR_NUM_SRC_TEST; i++)
+        unmap->addr[src_count] = dma_map_page(dma_chan->device->dev, dest, 0, PAGE_SIZE,
-                dma_srcs[i] = dma_map_page(dma_chan->device->dev, xor_srcs[i],
+                                      DMA_FROM_DEVICE);
-                                           0, PAGE_SIZE, DMA_TO_DEVICE);
+        dest_dma = unmap->addr[src_count];
+        unmap->from_cnt = 1;
+        unmap->len = PAGE_SIZE;
        tx = mv_xor_prep_dma_xor(dma_chan, dest_dma, dma_srcs,
-                                 MV_XOR_NUM_SRC_TEST, PAGE_SIZE, 0);
+                                 src_count, PAGE_SIZE, 0);
        cookie = mv_xor_tx_submit(tx);
        mv_xor_issue_pending(dma_chan);
@@ -948,9 +970,10 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
        }
 free_resources:
+        dmaengine_unmap_put(unmap);
        mv_xor_free_chan_resources(dma_chan);
 out:
-        src_idx = MV_XOR_NUM_SRC_TEST;
+        src_idx = src_count;
        while (src_idx--)
                __free_page(xor_srcs[src_idx]);
        __free_page(dest);
@@ -1176,6 +1199,7 @@ static int mv_xor_probe(struct platform_device *pdev)
                int i = 0;
                for_each_child_of_node(pdev->dev.of_node, np) {
+                        struct mv_xor_chan *chan;
                        dma_cap_mask_t cap_mask;
                        int irq;
@@ -1193,21 +1217,21 @@ static int mv_xor_probe(struct platform_device *pdev)
                                goto err_channel_add;
                        }
-                        xordev->channels[i] =
+                        chan = mv_xor_channel_add(xordev, pdev, i,
-                                mv_xor_channel_add(xordev, pdev, i,
+                                                  cap_mask, irq);
-                                                   cap_mask, irq);
+                        if (IS_ERR(chan)) {
-                        if (IS_ERR(xordev->channels[i])) {
+                                ret = PTR_ERR(chan);
-                                ret = PTR_ERR(xordev->channels[i]);
-                                xordev->channels[i] = NULL;
                                irq_dispose_mapping(irq);
                                goto err_channel_add;
                        }
+                        xordev->channels[i] = chan;
                        i++;
                }
        } else if (pdata && pdata->channels) {
                for (i = 0; i < MV_XOR_MAX_CHANNELS; i++) {
                        struct mv_xor_channel_data *cd;
+                        struct mv_xor_chan *chan;
                        int irq;
                        cd = &pdata->channels[i];
@@ -1222,13 +1246,14 @@ static int mv_xor_probe(struct platform_device *pdev)
                                goto err_channel_add;
                        }
-                        xordev->channels[i] =
+                        chan = mv_xor_channel_add(xordev, pdev, i,
-                                mv_xor_channel_add(xordev, pdev, i,
+                                                  cd->cap_mask, irq);
-                                                   cd->cap_mask, irq);
+                        if (IS_ERR(chan)) {
-                        if (IS_ERR(xordev->channels[i])) {
+                                ret = PTR_ERR(chan);
-                                ret = PTR_ERR(xordev->channels[i]);
                                goto err_channel_add;
                        }
+                        xordev->channels[i] = chan;
                }
        }
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index cdf0483b8f2d..536632f6479c 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2492,12 +2492,9 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
 static inline void _init_desc(struct dma_pl330_desc *desc)
 {
-        desc->pchan = NULL;
        desc->req.x = &desc->px;
        desc->req.token = desc;
        desc->rqcfg.swap = SWAP_NO;
-        desc->rqcfg.privileged = 0;
-        desc->rqcfg.insnaccess = 0;
        desc->rqcfg.scctl = SCCTRL0;
        desc->rqcfg.dcctl = DCCTRL0;
        desc->req.cfg = &desc->rqcfg;
@@ -2517,7 +2514,7 @@ static int add_desc(struct dma_pl330_dmac *pdmac, gfp_t flg, int count)
        if (!pdmac)
                return 0;
-        desc = kmalloc(count * sizeof(*desc), flg);
+        desc = kcalloc(count, sizeof(*desc), flg);
        if (!desc)
                return 0;
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index 8da48c6b2a38..8bba298535b0 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -533,29 +533,6 @@ static void ppc440spe_desc_init_memcpy(struct ppc440spe_adma_desc_slot *desc,
 }
 /**
- * ppc440spe_desc_init_memset - initialize the descriptor for MEMSET operation
- */
-static void ppc440spe_desc_init_memset(struct ppc440spe_adma_desc_slot *desc,
-                                        int value, unsigned long flags)
-{
-        struct dma_cdb *hw_desc = desc->hw_desc;
-        memset(desc->hw_desc, 0, sizeof(struct dma_cdb));
-        desc->hw_next = NULL;
-        desc->src_cnt = 1;
-        desc->dst_cnt = 1;
-        if (flags & DMA_PREP_INTERRUPT)
-                set_bit(PPC440SPE_DESC_INT, &desc->flags);
-        else
-                clear_bit(PPC440SPE_DESC_INT, &desc->flags);
-        hw_desc->sg1u = hw_desc->sg1l = cpu_to_le32((u32)value);
-        hw_desc->sg3u = hw_desc->sg3l = cpu_to_le32((u32)value);
-        hw_desc->opc = DMA_CDB_OPC_DFILL128;
-}
-/**
 * ppc440spe_desc_set_src_addr - set source address into the descriptor
 */
 static void ppc440spe_desc_set_src_addr(struct ppc440spe_adma_desc_slot *desc,
@@ -1504,8 +1481,6 @@ static dma_cookie_t ppc440spe_adma_run_tx_complete_actions(
                struct ppc440spe_adma_chan *chan,
                dma_cookie_t cookie)
 {
-        int i;
        BUG_ON(desc->async_tx.cookie < 0);
        if (desc->async_tx.cookie > 0) {
                cookie = desc->async_tx.cookie;
@@ -3898,7 +3873,7 @@ static void ppc440spe_adma_init_capabilities(struct ppc440spe_adma_device *adev)
                        ppc440spe_adma_prep_dma_interrupt;
        }
        pr_info("%s: AMCC(R) PPC440SP(E) ADMA Engine: "
-          "( %s%s%s%s%s%s%s)\n",
+          "( %s%s%s%s%s%s)\n",
          dev_name(adev->dev),
          dma_has_cap(DMA_PQ, adev->common.cap_mask) ? "pq " : "",
          dma_has_cap(DMA_PQ_VAL, adev->common.cap_mask) ? "pq_val " : "",
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index bae6c29f5502..17686caf64d5 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -406,7 +406,6 @@ txx9dmac_descriptor_complete(struct txx9dmac_chan *dc,
        dma_async_tx_callback callback;
        void *param;
        struct dma_async_tx_descriptor *txd = &desc->txd;
-        struct txx9dmac_slave *ds = dc->chan.private;
        dev_vdbg(chan2dev(&dc->chan), "descriptor %u %p complete\n",
                 txd->cookie, desc);
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index b0bb056458a3..281029daf98c 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1623,7 +1623,6 @@ static struct scsi_host_template scsi_driver_template = {
        .cmd_per_lun            = 1,
        .can_queue              = 1,
        .sdev_attrs             = sbp2_scsi_sysfs_attrs,
-        .no_write_same          = 1,
 };
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 743fd426f21b..4b9dc836dcf9 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -356,6 +356,7 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
 static struct pstore_info efi_pstore_info = {
        .owner          = THIS_MODULE,
        .name           = "efi",
+        .flags          = PSTORE_FLAGS_FRAGILE,
        .open           = efi_pstore_open,
        .close          = efi_pstore_close,
        .read           = efi_pstore_read,
diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
index 7b37300973db..2baf0ddf7e02 100644
--- a/drivers/gpio/gpio-msm-v2.c
+++ b/drivers/gpio/gpio-msm-v2.c
@@ -252,7 +252,7 @@ static void msm_gpio_irq_mask(struct irq_data *d)
        spin_lock_irqsave(&tlmm_lock, irq_flags);
        writel(TARGET_PROC_NONE, GPIO_INTR_CFG_SU(gpio));
-        clear_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
+        clear_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
        __clear_bit(gpio, msm_gpio.enabled_irqs);
        spin_unlock_irqrestore(&tlmm_lock, irq_flags);
 }
@@ -264,7 +264,7 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
        spin_lock_irqsave(&tlmm_lock, irq_flags);
        __set_bit(gpio, msm_gpio.enabled_irqs);
-        set_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
+        set_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
        writel(TARGET_PROC_SCORPION, GPIO_INTR_CFG_SU(gpio));
        spin_unlock_irqrestore(&tlmm_lock, irq_flags);
 }
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index fe088a30567a..8b7e719a68c3 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -169,7 +169,8 @@ static irqreturn_t gpio_rcar_irq_handler(int irq, void *dev_id)
        u32 pending;
        unsigned int offset, irqs_handled = 0;
-        while ((pending = gpio_rcar_read(p, INTDT))) {
+        while ((pending = gpio_rcar_read(p, INTDT) &
+                          gpio_rcar_read(p, INTMSK))) {
                offset = __ffs(pending);
                gpio_rcar_write(p, INTCLR, BIT(offset));
                generic_handle_irq(irq_find_mapping(p->irq_domain, offset));
diff --git a/drivers/gpio/gpio-twl4030.c b/drivers/gpio/gpio-twl4030.c
index b97d6a6577b9..f9996899c1f2 100644
--- a/drivers/gpio/gpio-twl4030.c
+++ b/drivers/gpio/gpio-twl4030.c
@@ -300,7 +300,7 @@ static int twl_direction_in(struct gpio_chip *chip, unsigned offset)
        if (offset < TWL4030_GPIO_MAX)
                ret = twl4030_set_gpio_direction(offset, 1);
        else
-                ret = -EINVAL;
+                ret = -EINVAL;  /* LED outputs can't be set as input */
        if (!ret)
                priv->direction &= ~BIT(offset);
@@ -354,11 +354,20 @@ static void twl_set(struct gpio_chip *chip, unsigned offset, int value)
 static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
 {
        struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
-        int ret = -EINVAL;
+        int ret = 0;
        mutex_lock(&priv->mutex);
-        if (offset < TWL4030_GPIO_MAX)
+        if (offset < TWL4030_GPIO_MAX) {
                ret = twl4030_set_gpio_direction(offset, 0);
+                if (ret) {
+                        mutex_unlock(&priv->mutex);
+                        return ret;
+                }
+        }
+        /*
+         *  LED gpios i.e. offset >= TWL4030_GPIO_MAX are always output
+         */
        priv->direction |= BIT(offset);
        mutex_unlock(&priv->mutex);
diff --git a/drivers/gpu/drm/armada/armada_drm.h b/drivers/gpu/drm/armada/armada_drm.h
index eef09ec9a5ff..a72cae03b99b 100644
--- a/drivers/gpu/drm/armada/armada_drm.h
+++ b/drivers/gpu/drm/armada/armada_drm.h
@@ -103,6 +103,7 @@ void armada_drm_queue_unref_work(struct drm_device *,
 extern const struct drm_mode_config_funcs armada_drm_mode_config_funcs;
 int armada_fbdev_init(struct drm_device *);
+void armada_fbdev_lastclose(struct drm_device *);
 void armada_fbdev_fini(struct drm_device *);
 int armada_overlay_plane_create(struct drm_device *, unsigned long);
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index 4f2b28354915..62d0ff3efddf 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -321,6 +321,11 @@ static struct drm_ioctl_desc armada_ioctls[] = {
                DRM_UNLOCKED),
 };
+static void armada_drm_lastclose(struct drm_device *dev)
+{
+        armada_fbdev_lastclose(dev);
+}
 static const struct file_operations armada_drm_fops = {
        .owner                  = THIS_MODULE,
        .llseek                 = no_llseek,
@@ -337,7 +342,7 @@ static struct drm_driver armada_drm_driver = {
        .open                   = NULL,
        .preclose               = NULL,
        .postclose              = NULL,
-        .lastclose              = NULL,
+        .lastclose              = armada_drm_lastclose,
        .unload                 = armada_drm_unload,
        .get_vblank_counter     = drm_vblank_count,
        .enable_vblank          = armada_drm_enable_vblank,
diff --git a/drivers/gpu/drm/armada/armada_fbdev.c b/drivers/gpu/drm/armada/armada_fbdev.c
index dd5ea77dac96..948cb14c561e 100644
--- a/drivers/gpu/drm/armada/armada_fbdev.c
+++ b/drivers/gpu/drm/armada/armada_fbdev.c
@@ -105,9 +105,9 @@ static int armada_fb_create(struct drm_fb_helper *fbh,
        drm_fb_helper_fill_fix(info, dfb->fb.pitches[0], dfb->fb.depth);
        drm_fb_helper_fill_var(info, fbh, sizes->fb_width, sizes->fb_height);
-        DRM_DEBUG_KMS("allocated %dx%d %dbpp fb: 0x%08x\n",
+        DRM_DEBUG_KMS("allocated %dx%d %dbpp fb: 0x%08llx\n",
-                dfb->fb.width, dfb->fb.height,
+                dfb->fb.width, dfb->fb.height, dfb->fb.bits_per_pixel,
-                dfb->fb.bits_per_pixel, obj->phys_addr);
+                (unsigned long long)obj->phys_addr);
        return 0;
@@ -177,6 +177,16 @@ int armada_fbdev_init(struct drm_device *dev)
        return ret;
 }
+void armada_fbdev_lastclose(struct drm_device *dev)
+{
+        struct armada_private *priv = dev->dev_private;
+        drm_modeset_lock_all(dev);
+        if (priv->fbdev)
+                drm_fb_helper_restore_fbdev_mode(priv->fbdev);
+        drm_modeset_unlock_all(dev);
+}
 void armada_fbdev_fini(struct drm_device *dev)
 {
        struct armada_private *priv = dev->dev_private;
@@ -192,11 +202,11 @@ void armada_fbdev_fini(struct drm_device *dev)
                        framebuffer_release(info);
                }
+                drm_fb_helper_fini(fbh);
                if (fbh->fb)
                        fbh->fb->funcs->destroy(fbh->fb);
-                drm_fb_helper_fini(fbh);
                priv->fbdev = NULL;
        }
 }
diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c
index 9f2356bae7fd..887816f43476 100644
--- a/drivers/gpu/drm/armada/armada_gem.c
+++ b/drivers/gpu/drm/armada/armada_gem.c
@@ -172,8 +172,9 @@ armada_gem_linear_back(struct drm_device *dev, struct armada_gem_object *obj)
                obj->dev_addr = obj->linear->start;
        }
-        DRM_DEBUG_DRIVER("obj %p phys %#x dev %#x\n",
+        DRM_DEBUG_DRIVER("obj %p phys %#llx dev %#llx\n", obj,
-                         obj, obj->phys_addr, obj->dev_addr);
+                         (unsigned long long)obj->phys_addr,
+                         (unsigned long long)obj->dev_addr);
        return 0;
 }
@@ -557,7 +558,6 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf)
                         * refcount on the gem object itself.
                         */
                        drm_gem_object_reference(obj);
-                        dma_buf_put(buf);
                        return obj;
                }
        }
@@ -573,6 +573,7 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf)
        }
        dobj->obj.import_attach = attach;
+        get_dma_buf(buf);
        /*
         * Don't call dma_buf_map_attachment() here - it maps the
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 0a1e4a5f4234..8835dcddfac3 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -68,6 +68,8 @@
 #define EDID_QUIRK_DETAILED_SYNC_PP             (1 << 6)
 /* Force reduced-blanking timings for detailed modes */
 #define EDID_QUIRK_FORCE_REDUCED_BLANKING       (1 << 7)
+/* Force 8bpc */
+#define EDID_QUIRK_FORCE_8BPC                   (1 << 8)
 struct detailed_mode_closure {
        struct drm_connector *connector;
@@ -128,6 +130,9 @@ static struct edid_quirk {
        /* Medion MD 30217 PG */
        { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+        /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
+        { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
 };
 /*
@@ -3435,6 +3440,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
        drm_add_display_info(edid, &connector->display_info);
+        if (quirks & EDID_QUIRK_FORCE_8BPC)
+                connector->display_info.bpc = 8;
        return num_modes;
 }
 EXPORT_SYMBOL(drm_add_edid_modes);
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index f53d5246979c..66dd3a001cf1 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -566,11 +566,11 @@ err_unload:
        if (dev->driver->unload)
                dev->driver->unload(dev);
 err_primary_node:
-        drm_put_minor(dev->primary);
+        drm_unplug_minor(dev->primary);
 err_render_node:
-        drm_put_minor(dev->render);
+        drm_unplug_minor(dev->render);
 err_control_node:
-        drm_put_minor(dev->control);
+        drm_unplug_minor(dev->control);
 err_agp:
        if (dev->driver->bus->agp_destroy)
                dev->driver->bus->agp_destroy(dev);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 0cab2d045135..5c648425c1e0 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -83,6 +83,14 @@ void i915_update_dri1_breadcrumb(struct drm_device *dev)
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv;
+        /*
+         * The dri breadcrumb update races against the drm master disappearing.
+         * Instead of trying to fix this (this is by far not the only ums issue)
+         * just don't do the update in kms mode.
+         */
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                return;
        if (dev->primary->master) {
                master_priv = dev->primary->master->driver_priv;
                if (master_priv->sarea_priv)
@@ -1490,16 +1498,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        spin_lock_init(&dev_priv->uncore.lock);
        spin_lock_init(&dev_priv->mm.object_stat_lock);
        mutex_init(&dev_priv->dpio_lock);
-        mutex_init(&dev_priv->rps.hw_lock);
        mutex_init(&dev_priv->modeset_restore_lock);
-        mutex_init(&dev_priv->pc8.lock);
+        intel_pm_setup(dev);
-        dev_priv->pc8.requirements_met = false;
-        dev_priv->pc8.gpu_idle = false;
-        dev_priv->pc8.irqs_disabled = false;
-        dev_priv->pc8.enabled = false;
-        dev_priv->pc8.disable_count = 2; /* requirements_met + gpu_idle */
-        INIT_DELAYED_WORK(&dev_priv->pc8.enable_work, hsw_enable_pc8_work);
        intel_display_crc_init(dev);
@@ -1603,7 +1604,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        }
        intel_irq_init(dev);
-        intel_pm_init(dev);
        intel_uncore_sanitize(dev);
        /* Try to make sure MCHBAR is enabled before poking at it */
@@ -1848,8 +1848,10 @@ void i915_driver_lastclose(struct drm_device * dev)
 void i915_driver_preclose(struct drm_device * dev, struct drm_file *file_priv)
 {
+        mutex_lock(&dev->struct_mutex);
        i915_gem_context_close(dev, file_priv);
        i915_gem_release(dev, file_priv);
+        mutex_unlock(&dev->struct_mutex);
 }
 void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 2e367a1c6a64..5b7b7e06cb3a 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -651,6 +651,7 @@ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
                intel_modeset_init_hw(dev);
                drm_modeset_lock_all(dev);
+                drm_mode_config_reset(dev);
                intel_modeset_setup_hw_state(dev, true);
                drm_modeset_unlock_all(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index ccdbecca070d..90fcccba17b0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1755,8 +1755,13 @@ struct drm_i915_file_private {
 #define IS_MOBILE(dev)          (INTEL_INFO(dev)->is_mobile)
 #define IS_HSW_EARLY_SDV(dev)   (IS_HASWELL(dev) && \
                                 ((dev)->pdev->device & 0xFF00) == 0x0C00)
-#define IS_ULT(dev)             (IS_HASWELL(dev) && \
+#define IS_BDW_ULT(dev)         (IS_BROADWELL(dev) && \
+                                 (((dev)->pdev->device & 0xf) == 0x2  || \
+                                 ((dev)->pdev->device & 0xf) == 0x6 || \
+                                 ((dev)->pdev->device & 0xf) == 0xe))
+#define IS_HSW_ULT(dev)         (IS_HASWELL(dev) && \
                                 ((dev)->pdev->device & 0xFF00) == 0x0A00)
+#define IS_ULT(dev)             (IS_HSW_ULT(dev) || IS_BDW_ULT(dev))
 #define IS_HSW_GT3(dev)         (IS_HASWELL(dev) && \
                                 ((dev)->pdev->device & 0x00F0) == 0x0020)
 #define IS_PRELIMINARY_HW(intel_info) ((intel_info)->is_preliminary)
@@ -1901,9 +1906,7 @@ void i915_queue_hangcheck(struct drm_device *dev);
 void i915_handle_error(struct drm_device *dev, bool wedged);
 extern void intel_irq_init(struct drm_device *dev);
-extern void intel_pm_init(struct drm_device *dev);
 extern void intel_hpd_init(struct drm_device *dev);
-extern void intel_pm_init(struct drm_device *dev);
 extern void intel_uncore_sanitize(struct drm_device *dev);
 extern void intel_uncore_early_sanitize(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 72a3df32292f..b0f42b9ca037 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -347,10 +347,8 @@ void i915_gem_context_close(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_i915_file_private *file_priv = file->driver_priv;
-        mutex_lock(&dev->struct_mutex);
        idr_for_each(&file_priv->context_idr, context_idr_cleanup, NULL);
        idr_destroy(&file_priv->context_idr);
-        mutex_unlock(&dev->struct_mutex);
 }
 static struct i915_hw_context *
@@ -423,11 +421,21 @@ static int do_switch(struct i915_hw_context *to)
        if (ret)
                return ret;
-        /* Clear this page out of any CPU caches for coherent swap-in/out. Note
+        /*
+         * Pin can switch back to the default context if we end up calling into
+         * evict_everything - as a last ditch gtt defrag effort that also
+         * switches to the default context. Hence we need to reload from here.
+         */
+        from = ring->last_context;
+        /*
+         * Clear this page out of any CPU caches for coherent swap-in/out. Note
         * that thanks to write = false in this call and us not setting any gpu
         * write domains when putting a context object onto the active list
         * (when switching away from it), this won't block.
-         * XXX: We need a real interface to do this instead of trickery. */
+         *
+         * XXX: We need a real interface to do this instead of trickery.
+         */
        ret = i915_gem_object_set_to_gtt_domain(to->obj, false);
        if (ret) {
                i915_gem_object_unpin(to->obj);
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index b7376533633d..8f3adc7d0dc8 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -88,6 +88,7 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
        } else
                drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
+search_again:
        /* First see if there is a large enough contiguous idle region... */
        list_for_each_entry(vma, &vm->inactive_list, mm_list) {
                if (mark_free(vma, &unwind_list))
@@ -115,10 +116,17 @@ none:
                list_del_init(&vma->exec_list);
        }
-        /* We expect the caller to unpin, evict all and try again, or give up.
+        /* Can we unpin some objects such as idle hw contents,
-         * So calling i915_gem_evict_vm() is unnecessary.
+         * or pending flips?
         */
-        return -ENOSPC;
+        ret = nonblocking ? -ENOSPC : i915_gpu_idle(dev);
+        if (ret)
+                return ret;
+        /* Only idle the GPU and repeat the search once */
+        i915_gem_retire_requests(dev);
+        nonblocking = true;
+        goto search_again;
 found:
        /* drm_mm doesn't allow any other other operations while
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 38cb8d44a013..c79dd2b1f70e 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -337,8 +337,8 @@ static void gen8_ppgtt_cleanup(struct i915_address_space *vm)
                kfree(ppgtt->gen8_pt_dma_addr[i]);
        }
-        __free_pages(ppgtt->gen8_pt_pages, ppgtt->num_pt_pages << PAGE_SHIFT);
+        __free_pages(ppgtt->gen8_pt_pages, get_order(ppgtt->num_pt_pages << PAGE_SHIFT));
-        __free_pages(ppgtt->pd_pages, ppgtt->num_pd_pages << PAGE_SHIFT);
+        __free_pages(ppgtt->pd_pages, get_order(ppgtt->num_pd_pages << PAGE_SHIFT));
 }
 /**
@@ -1241,6 +1241,11 @@ static inline unsigned int gen8_get_total_gtt_size(u16 bdw_gmch_ctl)
        bdw_gmch_ctl &= BDW_GMCH_GGMS_MASK;
        if (bdw_gmch_ctl)
                bdw_gmch_ctl = 1 << bdw_gmch_ctl;
+        if (bdw_gmch_ctl > 4) {
+                WARN_ON(!i915_preliminary_hw_support);
+                return 4<<20;
+        }
        return bdw_gmch_ctl << 20;
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 080f6fd4e839..8b8bde7dce53 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9135,7 +9135,7 @@ intel_pipe_config_compare(struct drm_device *dev,
        if (IS_G4X(dev) || INTEL_INFO(dev)->gen >= 5)
                PIPE_CONF_CHECK_I(pipe_bpp);
-        if (!IS_HASWELL(dev)) {
+        if (!HAS_DDI(dev)) {
                PIPE_CONF_CHECK_CLOCK_FUZZY(adjusted_mode.crtc_clock);
                PIPE_CONF_CHECK_CLOCK_FUZZY(port_clock);
        }
@@ -11036,8 +11036,6 @@ void intel_modeset_setup_hw_state(struct drm_device *dev,
        }
        intel_modeset_check_state(dev);
-        drm_mode_config_reset(dev);
 }
 void intel_modeset_gem_init(struct drm_device *dev)
@@ -11046,7 +11044,10 @@ void intel_modeset_gem_init(struct drm_device *dev)
        intel_setup_overlay(dev);
+        drm_modeset_lock_all(dev);
+        drm_mode_config_reset(dev);
        intel_modeset_setup_hw_state(dev, false);
+        drm_modeset_unlock_all(dev);
 }
 void intel_modeset_cleanup(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index a18e88b3e425..79f91f26e288 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -821,6 +821,7 @@ void intel_update_sprite_watermarks(struct drm_plane *plane,
                                    uint32_t sprite_width, int pixel_size,
                                    bool enabled, bool scaled);
 void intel_init_pm(struct drm_device *dev);
+void intel_pm_setup(struct drm_device *dev);
 bool intel_fbc_enabled(struct drm_device *dev);
 void intel_update_fbc(struct drm_device *dev);
 void intel_gpu_ips_init(struct drm_i915_private *dev_priv);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index f161ac02c4f6..e6f782d1c669 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -451,7 +451,9 @@ static u32 intel_panel_get_backlight(struct drm_device *dev,
        spin_lock_irqsave(&dev_priv->backlight.lock, flags);
-        if (HAS_PCH_SPLIT(dev)) {
+        if (IS_BROADWELL(dev)) {
+                val = I915_READ(BLC_PWM_PCH_CTL2) & BACKLIGHT_DUTY_CYCLE_MASK;
+        } else if (HAS_PCH_SPLIT(dev)) {
                val = I915_READ(BLC_PWM_CPU_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
        } else {
                if (IS_VALLEYVIEW(dev))
@@ -479,6 +481,13 @@ static u32 intel_panel_get_backlight(struct drm_device *dev,
        return val;
 }
+static void intel_bdw_panel_set_backlight(struct drm_device *dev, u32 level)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 val = I915_READ(BLC_PWM_PCH_CTL2) & ~BACKLIGHT_DUTY_CYCLE_MASK;
+        I915_WRITE(BLC_PWM_PCH_CTL2, val | level);
+}
 static void intel_pch_panel_set_backlight(struct drm_device *dev, u32 level)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -496,7 +505,9 @@ static void intel_panel_actually_set_backlight(struct drm_device *dev,
        DRM_DEBUG_DRIVER("set backlight PWM = %d\n", level);
        level = intel_panel_compute_brightness(dev, pipe, level);
-        if (HAS_PCH_SPLIT(dev))
+        if (IS_BROADWELL(dev))
+                return intel_bdw_panel_set_backlight(dev, level);
+        else if (HAS_PCH_SPLIT(dev))
                return intel_pch_panel_set_backlight(dev, level);
        if (is_backlight_combination_mode(dev)) {
@@ -666,7 +677,16 @@ void intel_panel_enable_backlight(struct intel_connector *connector)
                POSTING_READ(reg);
                I915_WRITE(reg, tmp | BLM_PWM_ENABLE);
-                if (HAS_PCH_SPLIT(dev) &&
+                if (IS_BROADWELL(dev)) {
+                        /*
+                         * Broadwell requires PCH override to drive the PCH
+                         * backlight pin. The above will configure the CPU
+                         * backlight pin, which we don't plan to use.
+                         */
+                        tmp = I915_READ(BLC_PWM_PCH_CTL1);
+                        tmp |= BLM_PCH_OVERRIDE_ENABLE | BLM_PCH_PWM_ENABLE;
+                        I915_WRITE(BLC_PWM_PCH_CTL1, tmp);
+                } else if (HAS_PCH_SPLIT(dev) &&
                    !(dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)) {
                        tmp = I915_READ(BLC_PWM_PCH_CTL1);
                        tmp |= BLM_PCH_PWM_ENABLE;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 6e0d5e075b15..3657ab43c8fd 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5685,6 +5685,7 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        bool is_enabled, enable_requested;
+        unsigned long irqflags;
        uint32_t tmp;
        tmp = I915_READ(HSW_PWR_WELL_DRIVER);
@@ -5702,9 +5703,24 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
                                      HSW_PWR_WELL_STATE_ENABLED), 20))
                                DRM_ERROR("Timeout enabling power well\n");
                }
+                if (IS_BROADWELL(dev)) {
+                        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
+                        I915_WRITE(GEN8_DE_PIPE_IMR(PIPE_B),
+                                   dev_priv->de_irq_mask[PIPE_B]);
+                        I915_WRITE(GEN8_DE_PIPE_IER(PIPE_B),
+                                   ~dev_priv->de_irq_mask[PIPE_B] |
+                                   GEN8_PIPE_VBLANK);
+                        I915_WRITE(GEN8_DE_PIPE_IMR(PIPE_C),
+                                   dev_priv->de_irq_mask[PIPE_C]);
+                        I915_WRITE(GEN8_DE_PIPE_IER(PIPE_C),
+                                   ~dev_priv->de_irq_mask[PIPE_C] |
+                                   GEN8_PIPE_VBLANK);
+                        POSTING_READ(GEN8_DE_PIPE_IER(PIPE_C));
+                        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
+                }
        } else {
                if (enable_requested) {
-                        unsigned long irqflags;
                        enum pipe p;
                        I915_WRITE(HSW_PWR_WELL_DRIVER, 0);
@@ -6130,10 +6146,19 @@ int vlv_freq_opcode(int ddr_freq, int val)
        return val;
 }
-void intel_pm_init(struct drm_device *dev)
+void intel_pm_setup(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        mutex_init(&dev_priv->rps.hw_lock);
+        mutex_init(&dev_priv->pc8.lock);
+        dev_priv->pc8.requirements_met = false;
+        dev_priv->pc8.gpu_idle = false;
+        dev_priv->pc8.irqs_disabled = false;
+        dev_priv->pc8.enabled = false;
+        dev_priv->pc8.disable_count = 2; /* requirements_met + gpu_idle */
+        INIT_DELAYED_WORK(&dev_priv->pc8.enable_work, hsw_enable_pc8_work);
        INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                          intel_gen6_powersave_work);
 }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index b620337e6d67..c2f09d456300 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -965,6 +965,7 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
        } else if (IS_GEN6(ring->dev)) {
                mmio = RING_HWS_PGA_GEN6(ring->mmio_base);
        } else {
+                /* XXX: gen8 returns to sanity */
                mmio = RING_HWS_PGA(ring->mmio_base);
        }
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index 0b02078a0b84..25cbe073c388 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -784,6 +784,7 @@ static int gen6_do_reset(struct drm_device *dev)
 int intel_gpu_reset(struct drm_device *dev)
 {
        switch (INTEL_INFO(dev)->gen) {
+        case 8:
        case 7:
        case 6: return gen6_do_reset(dev);
        case 5: return ironlake_do_reset(dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 7a3759f1c41a..98a22e6e27a1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -858,6 +858,12 @@ static int nouveau_pmops_runtime_suspend(struct device *dev)
        if (nouveau_runtime_pm == 0)
                return -EINVAL;
+        /* are we optimus enabled? */
+        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
+                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+                return -EINVAL;
+        }
        nv_debug_level(SILENT);
        drm_kms_helper_poll_disable(drm_dev);
        vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_OFF);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 80a20120e625..b1970596a782 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1196,7 +1196,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
        } else if ((rdev->family == CHIP_TAHITI) ||
                   (rdev->family == CHIP_PITCAIRN))
                fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P8_32x32_8x16);
-        else if (rdev->family == CHIP_VERDE)
+        else if ((rdev->family == CHIP_VERDE) ||
+                 (rdev->family == CHIP_OLAND) ||
+                 (rdev->family == CHIP_HAINAN)) /* for completeness.  HAINAN has no display hw */
                fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P4_8x16);
        switch (radeon_crtc->crtc_id) {
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 0300727a4f70..d08b83c6267b 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -458,7 +458,7 @@ int cik_copy_dma(struct radeon_device *rdev,
                radeon_ring_write(ring, 0); /* src/dst endian swap */
                radeon_ring_write(ring, src_offset & 0xffffffff);
                radeon_ring_write(ring, upper_32_bits(src_offset) & 0xffffffff);
-                radeon_ring_write(ring, dst_offset & 0xfffffffc);
+                radeon_ring_write(ring, dst_offset & 0xffffffff);
                radeon_ring_write(ring, upper_32_bits(dst_offset) & 0xffffffff);
                src_offset += cur_size_in_bytes;
                dst_offset += cur_size_in_bytes;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index e354ce94cdd1..c0425bb6223a 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -2021,7 +2021,7 @@ static struct radeon_asic ci_asic = {
                .hdmi_setmode = &evergreen_hdmi_setmode,
        },
        .copy = {
-                .blit = NULL,
+                .blit = &cik_copy_cpdma,
                .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                .dma = &cik_copy_dma,
                .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
@@ -2122,7 +2122,7 @@ static struct radeon_asic kv_asic = {
                .hdmi_setmode = &evergreen_hdmi_setmode,
        },
        .copy = {
-                .blit = NULL,
+                .blit = &cik_copy_cpdma,
                .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                .dma = &cik_copy_dma,
                .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 9f5ff28864f6..1958b36ad0e5 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -508,15 +508,6 @@ static const struct file_operations radeon_driver_kms_fops = {
 #endif
 };
-static void
-radeon_pci_shutdown(struct pci_dev *pdev)
-{
-        struct drm_device *dev = pci_get_drvdata(pdev);
-        radeon_driver_unload_kms(dev);
-}
 static struct drm_driver kms_driver = {
        .driver_features =
            DRIVER_USE_AGP |
@@ -586,7 +577,6 @@ static struct pci_driver radeon_kms_pci_driver = {
        .probe = radeon_pci_probe,
        .remove = radeon_pci_remove,
        .driver.pm = &radeon_pm_ops,
-        .shutdown = radeon_pci_shutdown,
 };
 static int __init radeon_init(void)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 1c560629575a..e7dab069cccf 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -162,6 +162,16 @@ static void rs690_mc_init(struct radeon_device *rdev)
        base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
        base = G_000100_MC_FB_START(base) << 16;
        rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+        /* Some boards seem to be configured for 128MB of sideport memory,
+         * but really only have 64MB.  Just skip the sideport and use
+         * UMA memory.
+         */
+        if (rdev->mc.igp_sideport_enabled &&
+            (rdev->mc.real_vram_size == (384 * 1024 * 1024))) {
+                base += 128 * 1024 * 1024;
+                rdev->mc.real_vram_size -= 128 * 1024 * 1024;
+                rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
+        }
        /* Use K8 direct mapping for fast fb access. */ 
        rdev->fastfb_working = false;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index b249ab9b1eb2..6440eeac22d2 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -169,9 +169,9 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        }
        page_offset = ((address - vma->vm_start) >> PAGE_SHIFT) +
-            drm_vma_node_start(&bo->vma_node) - vma->vm_pgoff;
+                vma->vm_pgoff - drm_vma_node_start(&bo->vma_node);
-        page_last = vma_pages(vma) +
+        page_last = vma_pages(vma) + vma->vm_pgoff -
-            drm_vma_node_start(&bo->vma_node) - vma->vm_pgoff;
+                drm_vma_node_start(&bo->vma_node);
        if (unlikely(page_offset >= bo->num_pages)) {
                retval = VM_FAULT_SIGBUS;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index a51f48e3e917..45d5b5ab6ca9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -68,6 +68,9 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
                                  SVGA_FIFO_3D_HWVERSION));
                break;
        }
+        case DRM_VMW_PARAM_MAX_SURF_MEMORY:
+                param->value = dev_priv->memory_size;
+                break;
        default:
                DRM_ERROR("Illegal vmwgfx get param request: %d\n",
                          param->param);
diff --git a/drivers/iio/adc/ad7887.c b/drivers/iio/adc/ad7887.c
index acb7f90359a3..749a6cadab8b 100644
--- a/drivers/iio/adc/ad7887.c
+++ b/drivers/iio/adc/ad7887.c
@@ -200,7 +200,13 @@ static const struct ad7887_chip_info ad7887_chip_info_tbl[] = {
                        .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                        .address = 1,
                        .scan_index = 1,
-                        .scan_type = IIO_ST('u', 12, 16, 0),
+                        .scan_type = {
+                                .sign = 'u',
+                                .realbits = 12,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                        },
                },
                .channel[1] = {
                        .type = IIO_VOLTAGE,
@@ -210,7 +216,13 @@ static const struct ad7887_chip_info ad7887_chip_info_tbl[] = {
                        .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                        .address = 0,
                        .scan_index = 0,
-                        .scan_type = IIO_ST('u', 12, 16, 0),
+                        .scan_type = {
+                                .sign = 'u',
+                                .realbits = 12,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                        },
                },
                .channel[2] = IIO_CHAN_SOFT_TIMESTAMP(2),
                .int_vref_mv = 2500,
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index 3fb7757a1028..368660dfe135 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -651,7 +651,12 @@ static const struct iio_chan_spec adis16448_channels[] = {
                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                .address = ADIS16448_BARO_OUT,
                .scan_index = ADIS16400_SCAN_BARO,
-                .scan_type = IIO_ST('s', 16, 16, 0),
+                .scan_type = {
+                        .sign = 's',
+                        .realbits = 16,
+                        .storagebits = 16,
+                        .endianness = IIO_BE,
+                },
        },
        ADIS16400_TEMP_CHAN(ADIS16448_TEMP_OUT, 12),
        IIO_CHAN_SOFT_TIMESTAMP(11)
diff --git a/drivers/iio/light/cm36651.c b/drivers/iio/light/cm36651.c
index 21df57130018..0922e39b0ea9 100644
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -387,7 +387,7 @@ static int cm36651_read_int_time(struct cm36651_data *cm36651,
                return -EINVAL;
        }
-        return IIO_VAL_INT_PLUS_MICRO;
+        return IIO_VAL_INT;
 }
 static int cm36651_write_int_time(struct cm36651_data *cm36651,
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 6be57c38638d..9804fca6bf06 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -207,7 +207,9 @@ isert_free_rx_descriptors(struct isert_conn *isert_conn)
        isert_conn->conn_rx_descs = NULL;
 }
+static void isert_cq_tx_work(struct work_struct *);
 static void isert_cq_tx_callback(struct ib_cq *, void *);
+static void isert_cq_rx_work(struct work_struct *);
 static void isert_cq_rx_callback(struct ib_cq *, void *);
 static int
@@ -259,26 +261,36 @@ isert_create_device_ib_res(struct isert_device *device)
                cq_desc[i].device = device;
                cq_desc[i].cq_index = i;
+                INIT_WORK(&cq_desc[i].cq_rx_work, isert_cq_rx_work);
                device->dev_rx_cq[i] = ib_create_cq(device->ib_device,
                                                isert_cq_rx_callback,
                                                isert_cq_event_callback,
                                                (void *)&cq_desc[i],
                                                ISER_MAX_RX_CQ_LEN, i);
-                if (IS_ERR(device->dev_rx_cq[i]))
+                if (IS_ERR(device->dev_rx_cq[i])) {
+                        ret = PTR_ERR(device->dev_rx_cq[i]);
+                        device->dev_rx_cq[i] = NULL;
                        goto out_cq;
+                }
+                INIT_WORK(&cq_desc[i].cq_tx_work, isert_cq_tx_work);
                device->dev_tx_cq[i] = ib_create_cq(device->ib_device,
                                                isert_cq_tx_callback,
                                                isert_cq_event_callback,
                                                (void *)&cq_desc[i],
                                                ISER_MAX_TX_CQ_LEN, i);
-                if (IS_ERR(device->dev_tx_cq[i]))
+                if (IS_ERR(device->dev_tx_cq[i])) {
+                        ret = PTR_ERR(device->dev_tx_cq[i]);
+                        device->dev_tx_cq[i] = NULL;
                        goto out_cq;
+                }
-                if (ib_req_notify_cq(device->dev_rx_cq[i], IB_CQ_NEXT_COMP))
+                ret = ib_req_notify_cq(device->dev_rx_cq[i], IB_CQ_NEXT_COMP);
+                if (ret)
                        goto out_cq;
-                if (ib_req_notify_cq(device->dev_tx_cq[i], IB_CQ_NEXT_COMP))
+                ret = ib_req_notify_cq(device->dev_tx_cq[i], IB_CQ_NEXT_COMP);
+                if (ret)
                        goto out_cq;
        }
@@ -1724,7 +1736,6 @@ isert_cq_tx_callback(struct ib_cq *cq, void *context)
 {
        struct isert_cq_desc *cq_desc = (struct isert_cq_desc *)context;
-        INIT_WORK(&cq_desc->cq_tx_work, isert_cq_tx_work);
        queue_work(isert_comp_wq, &cq_desc->cq_tx_work);
 }
@@ -1768,7 +1779,6 @@ isert_cq_rx_callback(struct ib_cq *cq, void *context)
 {
        struct isert_cq_desc *cq_desc = (struct isert_cq_desc *)context;
-        INIT_WORK(&cq_desc->cq_rx_work, isert_cq_rx_work);
        queue_work(isert_rx_wq, &cq_desc->cq_rx_work);
 }
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 5f9a7ad9b964..8aeec0b4601a 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -625,6 +625,7 @@ static int ems_usb_start(struct ems_usb *dev)
                        usb_unanchor_urb(urb);
                        usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,
                                          urb->transfer_dma);
+                        usb_free_urb(urb);
                        break;
                }
@@ -798,8 +799,8 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
         * allowed (MAX_TX_URBS).
         */
        if (!context) {
-                usb_unanchor_urb(urb);
                usb_free_coherent(dev->udev, size, buf, urb->transfer_dma);
+                usb_free_urb(urb);
                netdev_warn(netdev, "couldn't find free context\n");
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 8ee9d1556e6e..263dd921edc4 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -927,6 +927,9 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
        /* set LED in default state (end of init phase) */
        pcan_usb_pro_set_led(dev, 0, 1);
+        kfree(bi);
+        kfree(fi);
        return 0;
 err_out:
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index b1cb0ffb15c7..6055d397a29e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -447,8 +447,9 @@ irqreturn_t qlcnic_83xx_intr(int irq, void *data)
        qlcnic_83xx_poll_process_aen(adapter);
-        if (ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
+        if (ahw->diag_test) {
-                ahw->diag_cnt++;
+                if (ahw->diag_test == QLCNIC_INTERRUPT_TEST)
+                        ahw->diag_cnt++;
                qlcnic_83xx_enable_legacy_msix_mbx_intr(adapter);
                return IRQ_HANDLED;
        }
@@ -1345,11 +1346,6 @@ static int qlcnic_83xx_diag_alloc_res(struct net_device *netdev, int test,
        }
        if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                /* disable and free mailbox interrupt */
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        qlcnic_83xx_enable_mbx_poll(adapter);
-                        qlcnic_83xx_free_mbx_intr(adapter);
-                }
                adapter->ahw->loopback_state = 0;
                adapter->ahw->hw_ops->setup_link_event(adapter, 1);
        }
@@ -1363,33 +1359,20 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
 {
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        struct qlcnic_host_sds_ring *sds_ring;
-        int ring, err;
+        int ring;
        clear_bit(__QLCNIC_DEV_UP, &adapter->state);
        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                for (ring = 0; ring < adapter->drv_sds_rings; ring++) {
                        sds_ring = &adapter->recv_ctx->sds_rings[ring];
-                        qlcnic_83xx_disable_intr(adapter, sds_ring);
+                        if (adapter->flags & QLCNIC_MSIX_ENABLED)
-                        if (!(adapter->flags & QLCNIC_MSIX_ENABLED))
+                                qlcnic_83xx_disable_intr(adapter, sds_ring);
-                                qlcnic_83xx_enable_mbx_poll(adapter);
                }
        }
        qlcnic_fw_destroy_ctx(adapter);
        qlcnic_detach(adapter);
-        if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        err = qlcnic_83xx_setup_mbx_intr(adapter);
-                        qlcnic_83xx_disable_mbx_poll(adapter);
-                        if (err) {
-                                dev_err(&adapter->pdev->dev,
-                                        "%s: failed to setup mbx interrupt\n",
-                                        __func__);
-                                goto out;
-                        }
-                }
-        }
        adapter->ahw->diag_test = 0;
        adapter->drv_sds_rings = drv_sds_rings;
@@ -1399,9 +1382,6 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
        if (netif_running(netdev))
                __qlcnic_up(adapter, netdev);
-        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST &&
-            !(adapter->flags & QLCNIC_MSIX_ENABLED))
-                qlcnic_83xx_disable_mbx_poll(adapter);
 out:
        netif_device_attach(netdev);
 }
@@ -3754,6 +3734,19 @@ static void qlcnic_83xx_decode_mbx_rsp(struct qlcnic_adapter *adapter,
        return;
 }
+static inline void qlcnic_dump_mailbox_registers(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 offset;
+        offset = QLCRDX(ahw, QLCNIC_DEF_INT_MASK);
+        dev_info(&adapter->pdev->dev, "Mbx interrupt mask=0x%x, Mbx interrupt enable=0x%x, Host mbx control=0x%x, Fw mbx control=0x%x",
+                 readl(ahw->pci_base0 + offset),
+                 QLCRDX(ahw, QLCNIC_MBX_INTR_ENBL),
+                 QLCRDX(ahw, QLCNIC_HOST_MBX_CTRL),
+                 QLCRDX(ahw, QLCNIC_FW_MBX_CTRL));
+}
 static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
 {
        struct qlcnic_mailbox *mbx = container_of(work, struct qlcnic_mailbox,
@@ -3798,6 +3791,8 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
                                __func__, cmd->cmd_op, cmd->type, ahw->pci_func,
                                ahw->op_mode);
                        clear_bit(QLC_83XX_MBX_READY, &mbx->status);
+                        qlcnic_dump_mailbox_registers(adapter);
+                        qlcnic_83xx_get_mbx_data(adapter, cmd);
                        qlcnic_dump_mbx(adapter, cmd);
                        qlcnic_83xx_idc_request_reset(adapter,
                                                      QLCNIC_FORCE_FW_DUMP_KEY);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 4cae6caa6bfa..a6a33508e401 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -662,4 +662,5 @@ pci_ers_result_t qlcnic_83xx_io_error_detected(struct pci_dev *,
                                               pci_channel_state_t);
 pci_ers_result_t qlcnic_83xx_io_slot_reset(struct pci_dev *);
 void qlcnic_83xx_io_resume(struct pci_dev *);
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *);
 #endif
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 89208e5b25d6..918e18ddf038 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -740,6 +740,7 @@ static int qlcnic_83xx_idc_unknown_state(struct qlcnic_adapter *adapter)
        adapter->ahw->idc.err_code = -EIO;
        dev_err(&adapter->pdev->dev,
                "%s: Device in unknown state\n", __func__);
+        clear_bit(__QLCNIC_RESETTING, &adapter->state);
        return 0;
 }
@@ -818,7 +819,6 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        struct qlcnic_mailbox *mbx = ahw->mailbox;
        int ret = 0;
-        u32 owner;
        u32 val;
        /* Perform NIC configuration based ready state entry actions */
@@ -848,9 +848,9 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
                        set_bit(__QLCNIC_RESETTING, &adapter->state);
                        qlcnic_83xx_idc_enter_need_reset_state(adapter, 1);
                }  else {
-                        owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                        netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
-                        if (ahw->pci_func == owner)
+                                    __func__);
-                                qlcnic_dump_fw(adapter);
+                        qlcnic_83xx_idc_enter_failed_state(adapter, 1);
                }
                return -EIO;
        }
@@ -948,13 +948,26 @@ static int qlcnic_83xx_idc_need_quiesce_state(struct qlcnic_adapter *adapter)
        return 0;
 }
-static int qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
+static void qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
 {
-        dev_err(&adapter->pdev->dev, "%s: please restart!!\n", __func__);
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 val, owner;
+        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                if (ahw->pci_func == owner) {
+                        qlcnic_83xx_stop_hw(adapter);
+                        qlcnic_dump_fw(adapter);
+                }
+        }
+        netdev_warn(adapter->netdev, "%s: Reboot will be required to recover the adapter!!\n",
+                    __func__);
        clear_bit(__QLCNIC_RESETTING, &adapter->state);
-        adapter->ahw->idc.err_code = -EIO;
+        ahw->idc.err_code = -EIO;
-        return 0;
+        return;
 }
 static int qlcnic_83xx_idc_quiesce_state(struct qlcnic_adapter *adapter)
@@ -1063,12 +1076,6 @@ void qlcnic_83xx_idc_poll_dev_state(struct work_struct *work)
        adapter->ahw->idc.prev_state = adapter->ahw->idc.curr_state;
        qlcnic_83xx_periodic_tasks(adapter);
-        /* Do not reschedule if firmaware is in hanged state and auto
-         * recovery is disabled
-         */
-        if ((adapter->flags & QLCNIC_FW_HANG) && !qlcnic_auto_fw_reset)
-                return;
        /* Re-schedule the function */
        if (test_bit(QLC_83XX_MODULE_LOADED, &adapter->ahw->idc.status))
                qlcnic_schedule_work(adapter, qlcnic_83xx_idc_poll_dev_state,
@@ -1219,10 +1226,10 @@ void qlcnic_83xx_idc_request_reset(struct qlcnic_adapter *adapter, u32 key)
        }
        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
-        if ((val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) ||
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
-            !qlcnic_auto_fw_reset) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
-                dev_err(&adapter->pdev->dev,
+                            __func__);
-                        "%s:failed, device in non reset mode\n", __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 0);
                qlcnic_83xx_unlock_driver(adapter);
                return;
        }
@@ -1254,24 +1261,24 @@ static int qlcnic_83xx_copy_bootloader(struct qlcnic_adapter *adapter)
        if (size & 0xF)
                size = (size + 16) & ~0xF;
-        p_cache = kzalloc(size, GFP_KERNEL);
+        p_cache = vzalloc(size);
        if (p_cache == NULL)
                return -ENOMEM;
        ret = qlcnic_83xx_lockless_flash_read32(adapter, src, p_cache,
                                                size / sizeof(u32));
        if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                return ret;
        }
        /* 16 byte write to MS memory */
        ret = qlcnic_83xx_ms_mem_write128(adapter, dest, (u32 *)p_cache,
                                          size / 16);
        if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                return ret;
        }
-        kfree(p_cache);
+        vfree(p_cache);
        return ret;
 }
@@ -1939,7 +1946,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
        p_dev->ahw->reset.seq_index = index;
 }
-static void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
 {
        p_dev->ahw->reset.seq_index = 0;
@@ -1994,6 +2001,14 @@ static int qlcnic_83xx_restart_hw(struct qlcnic_adapter *adapter)
        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
        if (!(val & QLC_83XX_IDC_GRACEFULL_RESET))
                qlcnic_dump_fw(adapter);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                            __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 1);
+                return err;
+        }
        qlcnic_83xx_init_hw(adapter);
        if (qlcnic_83xx_copy_bootloader(adapter))
@@ -2073,8 +2088,8 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
                ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
                ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
-                adapter->max_sds_rings = ahw->max_rx_ques;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
-                adapter->max_tx_rings = ahw->max_tx_ques;
+                adapter->max_tx_rings = QLCNIC_MAX_TX_RINGS;
        } else {
                return -EIO;
        }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index b36c02fafcfd..e3be2760665c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -667,30 +667,25 @@ qlcnic_set_ringparam(struct net_device *dev,
 static int qlcnic_validate_ring_count(struct qlcnic_adapter *adapter,
                                      u8 rx_ring, u8 tx_ring)
 {
+        if (rx_ring == 0 || tx_ring == 0)
+                return -EINVAL;
        if (rx_ring != 0) {
                if (rx_ring > adapter->max_sds_rings) {
-                        netdev_err(adapter->netdev, "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
+                        netdev_err(adapter->netdev,
+                                   "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
                                   rx_ring, adapter->max_sds_rings);
                        return -EINVAL;
                }
        }
         if (tx_ring != 0) {
-                if (qlcnic_82xx_check(adapter) &&
+                if (tx_ring > adapter->max_tx_rings) {
-                    (tx_ring > adapter->max_tx_rings)) {
                        netdev_err(adapter->netdev,
                                   "Invalid ring count, Tx ring count %d should not be greater than max %d driver Tx rings.\n",
                                   tx_ring, adapter->max_tx_rings);
                        return -EINVAL;
                }
-                if (qlcnic_83xx_check(adapter) &&
-                    (tx_ring > QLCNIC_SINGLE_RING)) {
-                        netdev_err(adapter->netdev,
-                                   "Invalid ring count, Tx ring count %d should not be greater than %d driver Tx rings.\n",
-                                   tx_ring, QLCNIC_SINGLE_RING);
-                         return -EINVAL;
-                }
        }
        return 0;
@@ -948,6 +943,7 @@ static int qlcnic_irq_test(struct net_device *netdev)
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        struct qlcnic_cmd_args cmd;
        int ret, drv_sds_rings = adapter->drv_sds_rings;
+        int drv_tx_rings = adapter->drv_tx_rings;
        if (qlcnic_83xx_check(adapter))
                return qlcnic_83xx_interrupt_test(netdev);
@@ -980,6 +976,7 @@ free_diag_res:
 clear_diag_irq:
        adapter->drv_sds_rings = drv_sds_rings;
+        adapter->drv_tx_rings = drv_tx_rings;
        clear_bit(__QLCNIC_RESETTING, &adapter->state);
        return ret;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 0149c9495347..eda6c691d897 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -687,17 +687,11 @@ void qlcnic_advert_link_change(struct qlcnic_adapter *adapter, int linkup)
        if (adapter->ahw->linkup && !linkup) {
                netdev_info(netdev, "NIC Link is down\n");
                adapter->ahw->linkup = 0;
-                if (netif_running(netdev)) {
+                netif_carrier_off(netdev);
-                        netif_carrier_off(netdev);
-                        netif_tx_stop_all_queues(netdev);
-                }
        } else if (!adapter->ahw->linkup && linkup) {
                netdev_info(netdev, "NIC Link is up\n");
                adapter->ahw->linkup = 1;
-                if (netif_running(netdev)) {
+                netif_carrier_on(netdev);
-                        netif_carrier_on(netdev);
-                        netif_wake_queue(netdev);
-                }
        }
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 05c1eef8df13..2c8cac0c6a55 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1178,6 +1178,7 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
        } else {
                adapter->ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                adapter->max_tx_rings = QLCNIC_MAX_HW_TX_RINGS;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
                adapter->flags &= ~QLCNIC_ESWITCH_ENABLED;
        }
@@ -1940,7 +1941,6 @@ int qlcnic_diag_alloc_res(struct net_device *netdev, int test)
        qlcnic_detach(adapter);
        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
-        adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
        adapter->ahw->diag_test = test;
        adapter->ahw->linkup = 0;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 524f713f6017..f8135725bcf6 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -327,7 +327,6 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
                return -EINVAL;
        nvdev->start_remove = true;
-        cancel_delayed_work_sync(&ndevctx->dwork);
        cancel_work_sync(&ndevctx->work);
        netif_tx_disable(ndev);
        rndis_filter_device_remove(hdev);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e884ee1fe7ed..27bbe58dcbe7 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1197,6 +1197,9 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
        err = -EPROTO;
+        if (fragment)
+                goto out;
        switch (ip_hdr(skb)->protocol) {
        case IPPROTO_TCP:
                err = maybe_pull_tail(skb,
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index a344f3d52361..330ef2d06567 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -24,8 +24,8 @@ config PHY_EXYNOS_MIPI_VIDEO
 config OMAP_USB2
        tristate "OMAP USB2 PHY Driver"
        depends on ARCH_OMAP2PLUS
+        depends on USB_PHY
        select GENERIC_PHY
-        select USB_PHY
        select OMAP_CONTROL_USB
        help
          Enable this to support the transceiver that is part of SOC. This
@@ -36,8 +36,8 @@ config OMAP_USB2
 config TWL4030_USB
        tristate "TWL4030 USB Transceiver Driver"
        depends on TWL4030_CORE && REGULATOR_TWL4030 && USB_MUSB_OMAP2PLUS
+        depends on USB_PHY
        select GENERIC_PHY
-        select USB_PHY
        help
          Enable this to support the USB OTG transceiver on TWL4030
          family chips (including the TWL5030 and TPS659x0 devices).
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 03cf8fb81554..58e0e9739028 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -437,23 +437,18 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
        int id;
        struct phy *phy;
-        if (!dev) {
+        if (WARN_ON(!dev))
-                dev_WARN(dev, "no device provided for PHY\n");
+                return ERR_PTR(-EINVAL);
-                ret = -EINVAL;
-                goto err0;
-        }
        phy = kzalloc(sizeof(*phy), GFP_KERNEL);
-        if (!phy) {
+        if (!phy)
-                ret = -ENOMEM;
+                return ERR_PTR(-ENOMEM);
-                goto err0;
-        }
        id = ida_simple_get(&phy_ida, 0, 0, GFP_KERNEL);
        if (id < 0) {
                dev_err(dev, "unable to get id\n");
                ret = id;
-                goto err0;
+                goto free_phy;
        }
        device_initialize(&phy->dev);
@@ -468,11 +463,11 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
        ret = dev_set_name(&phy->dev, "phy-%s.%d", dev_name(dev), id);
        if (ret)
-                goto err1;
+                goto put_dev;
        ret = device_add(&phy->dev);
        if (ret)
-                goto err1;
+                goto put_dev;
        if (pm_runtime_enabled(dev)) {
                pm_runtime_enable(&phy->dev);
@@ -481,12 +476,11 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
        return phy;
-err1:
+put_dev:
-        ida_remove(&phy_ida, phy->id);
        put_device(&phy->dev);
+        ida_remove(&phy_ida, phy->id);
+free_phy:
        kfree(phy);
-err0:
        return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(phy_create);
diff --git a/drivers/pinctrl/sh-pfc/sh_pfc.h b/drivers/pinctrl/sh-pfc/sh_pfc.h
index 11bd0d970a52..e2142956a8e5 100644
--- a/drivers/pinctrl/sh-pfc/sh_pfc.h
+++ b/drivers/pinctrl/sh-pfc/sh_pfc.h
@@ -254,7 +254,7 @@ struct sh_pfc_soc_info {
 #define PINMUX_GPIO(_pin)                                               \
        [GPIO_##_pin] = {                                               \
                .pin = (u16)-1,                                         \
-                .name = __stringify(name),                              \
+                .name = __stringify(GPIO_##_pin),                       \
                .enum_id = _pin##_DATA,                                 \
        }
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 333677d68d0e..9e61922d8230 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -438,7 +438,7 @@ common_reg:
        platform_set_drvdata(pdev, s2mps11);
        config.dev = &pdev->dev;
-        config.regmap = iodev->regmap;
+        config.regmap = iodev->regmap_pmic;
        config.driver_data = s2mps11;
        for (i = 0; i < S2MPS11_REGULATOR_MAX; i++) {
                if (!reg_np) {
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 596480022b0a..38a1257e76e1 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -471,7 +471,7 @@ static void qlt_schedule_sess_for_deletion(struct qla_tgt_sess *sess,
                schedule_delayed_work(&tgt->sess_del_work, 0);
        else
                schedule_delayed_work(&tgt->sess_del_work,
-                    jiffies - sess->expires);
+                    sess->expires - jiffies);
 }
 /* ha->hardware_lock supposed to be held on entry */
@@ -550,13 +550,14 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
        struct scsi_qla_host *vha = tgt->vha;
        struct qla_hw_data *ha = vha->hw;
        struct qla_tgt_sess *sess;
-        unsigned long flags;
+        unsigned long flags, elapsed;
        spin_lock_irqsave(&ha->hardware_lock, flags);
        while (!list_empty(&tgt->del_sess_list)) {
                sess = list_entry(tgt->del_sess_list.next, typeof(*sess),
                    del_list_entry);
-                if (time_after_eq(jiffies, sess->expires)) {
+                elapsed = jiffies;
+                if (time_after_eq(elapsed, sess->expires)) {
                        qlt_undelete_sess(sess);
                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf004,
@@ -566,7 +567,7 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
                        ha->tgt.tgt_ops->put_sess(sess);
                } else {
                        schedule_delayed_work(&tgt->sess_del_work,
-                            jiffies - sess->expires);
+                            sess->expires - elapsed);
                        break;
                }
        }
@@ -4290,6 +4291,7 @@ int qlt_lport_register(struct qla_tgt_func_tmpl *qla_tgt_ops, u64 wwpn,
                if (rc != 0) {
                        ha->tgt.tgt_ops = NULL;
                        ha->tgt.target_lport_ptr = NULL;
+                        scsi_host_put(host);
                }
                mutex_unlock(&qla_tgt_mutex);
                return rc;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index 8f02bf66e20b..4964d2a2fc7d 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -446,7 +446,7 @@ int comedi_load_firmware(struct comedi_device *dev,
                release_firmware(fw);
        }
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 EXPORT_SYMBOL_GPL(comedi_load_firmware);
diff --git a/drivers/staging/comedi/drivers/8255_pci.c b/drivers/staging/comedi/drivers/8255_pci.c
index 432e3f9c3301..c55f234b29e6 100644
--- a/drivers/staging/comedi/drivers/8255_pci.c
+++ b/drivers/staging/comedi/drivers/8255_pci.c
@@ -63,7 +63,8 @@ enum pci_8255_boardid {
        BOARD_ADLINK_PCI7296,
        BOARD_CB_PCIDIO24,
        BOARD_CB_PCIDIO24H,
-        BOARD_CB_PCIDIO48H,
+        BOARD_CB_PCIDIO48H_OLD,
+        BOARD_CB_PCIDIO48H_NEW,
        BOARD_CB_PCIDIO96H,
        BOARD_NI_PCIDIO96,
        BOARD_NI_PCIDIO96B,
@@ -106,11 +107,16 @@ static const struct pci_8255_boardinfo pci_8255_boards[] = {
                .dio_badr       = 2,
                .n_8255         = 1,
        },
-        [BOARD_CB_PCIDIO48H] = {
+        [BOARD_CB_PCIDIO48H_OLD] = {
                .name           = "cb_pci-dio48h",
                .dio_badr       = 1,
                .n_8255         = 2,
        },
+        [BOARD_CB_PCIDIO48H_NEW] = {
+                .name           = "cb_pci-dio48h",
+                .dio_badr       = 2,
+                .n_8255         = 2,
+        },
        [BOARD_CB_PCIDIO96H] = {
                .name           = "cb_pci-dio96h",
                .dio_badr       = 2,
@@ -263,7 +269,10 @@ static DEFINE_PCI_DEVICE_TABLE(pci_8255_pci_table) = {
        { PCI_VDEVICE(ADLINK, 0x7296), BOARD_ADLINK_PCI7296 },
        { PCI_VDEVICE(CB, 0x0028), BOARD_CB_PCIDIO24 },
        { PCI_VDEVICE(CB, 0x0014), BOARD_CB_PCIDIO24H },
-        { PCI_VDEVICE(CB, 0x000b), BOARD_CB_PCIDIO48H },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, 0x0000, 0x0000),
+          .driver_data = BOARD_CB_PCIDIO48H_OLD },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, PCI_VENDOR_ID_CB, 0x000b),
+          .driver_data = BOARD_CB_PCIDIO48H_NEW },
        { PCI_VDEVICE(CB, 0x0017), BOARD_CB_PCIDIO96H },
        { PCI_VDEVICE(NI, 0x0160), BOARD_NI_PCIDIO96 },
        { PCI_VDEVICE(NI, 0x1630), BOARD_NI_PCIDIO96B },
diff --git a/drivers/staging/iio/magnetometer/hmc5843.c b/drivers/staging/iio/magnetometer/hmc5843.c
index 99421f90d189..0485d7f39867 100644
--- a/drivers/staging/iio/magnetometer/hmc5843.c
+++ b/drivers/staging/iio/magnetometer/hmc5843.c
@@ -451,7 +451,12 @@ done:
                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE) |  \
                        BIT(IIO_CHAN_INFO_SAMP_FREQ),                   \
                .scan_index = idx,                                      \
-                .scan_type = IIO_ST('s', 16, 16, IIO_BE),               \
+                .scan_type = {                                          \
+                        .sign = 's',                                    \
+                        .realbits = 16,                                 \
+                        .storagebits = 16,                              \
+                        .endianness = IIO_BE,                           \
+                },                                                      \
        }
 static const struct iio_chan_spec hmc5843_channels[] = {
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 6bd015ac9d68..96e4eee344ef 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -88,8 +88,9 @@ static int imx_drm_driver_unload(struct drm_device *drm)
        imx_drm_device_put();
-        drm_mode_config_cleanup(imxdrm->drm);
+        drm_vblank_cleanup(imxdrm->drm);
        drm_kms_helper_poll_fini(imxdrm->drm);
+        drm_mode_config_cleanup(imxdrm->drm);
        return 0;
 }
@@ -199,8 +200,8 @@ static void imx_drm_driver_preclose(struct drm_device *drm,
        if (!file->is_master)
                return;
-        for (i = 0; i < 4; i++)
+        for (i = 0; i < MAX_CRTC; i++)
-                imx_drm_disable_vblank(drm , i);
+                imx_drm_disable_vblank(drm, i);
 }
 static const struct file_operations imx_drm_driver_fops = {
@@ -376,8 +377,6 @@ static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
        struct imx_drm_device *imxdrm = __imx_drm_device();
        int ret;
-        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
-                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
        ret = drm_mode_crtc_set_gamma_size(imx_drm_crtc->crtc, 256);
        if (ret)
                return ret;
@@ -385,6 +384,9 @@ static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
        drm_crtc_helper_add(imx_drm_crtc->crtc,
                        imx_drm_crtc->imx_drm_helper_funcs.crtc_helper_funcs);
+        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
+                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
        drm_mode_group_reinit(imxdrm->drm);
        return 0;
@@ -428,11 +430,11 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
        ret = drm_mode_group_init_legacy_group(imxdrm->drm,
                        &imxdrm->drm->primary->mode_group);
        if (ret)
-                goto err_init;
+                goto err_kms;
        ret = drm_vblank_init(imxdrm->drm, MAX_CRTC);
        if (ret)
-                goto err_init;
+                goto err_kms;
        /*
         * with vblank_disable_allowed = true, vblank interrupt will be disabled
@@ -441,12 +443,19 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
         */
        imxdrm->drm->vblank_disable_allowed = true;
-        if (!imx_drm_device_get())
+        if (!imx_drm_device_get()) {
                ret = -EINVAL;
+                goto err_vblank;
+        }
-        ret = 0;
+        mutex_unlock(&imxdrm->mutex);
+        return 0;
-err_init:
+err_vblank:
+        drm_vblank_cleanup(drm);
+err_kms:
+        drm_kms_helper_poll_fini(drm);
+        drm_mode_config_cleanup(drm);
        mutex_unlock(&imxdrm->mutex);
        return ret;
@@ -492,6 +501,15 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
        mutex_lock(&imxdrm->mutex);
+        /*
+         * The vblank arrays are dimensioned by MAX_CRTC - we can't
+         * pass IDs greater than this to those functions.
+         */
+        if (imxdrm->pipes >= MAX_CRTC) {
+                ret = -EINVAL;
+                goto err_busy;
+        }
        if (imxdrm->drm->open_count) {
                ret = -EBUSY;
                goto err_busy;
@@ -528,6 +546,7 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
        return 0;
 err_register:
+        list_del(&imx_drm_crtc->list);
        kfree(imx_drm_crtc);
 err_alloc:
 err_busy:
diff --git a/drivers/staging/imx-drm/imx-tve.c b/drivers/staging/imx-drm/imx-tve.c
index 680f4c8fa081..2c44fef8d58b 100644
--- a/drivers/staging/imx-drm/imx-tve.c
+++ b/drivers/staging/imx-drm/imx-tve.c
@@ -114,7 +114,6 @@ struct imx_tve {
        struct drm_encoder encoder;
        struct imx_drm_encoder *imx_drm_encoder;
        struct device *dev;
-        spinlock_t enable_lock; /* serializes tve_enable/disable */
        spinlock_t lock;        /* register lock */
        bool enabled;
        int mode;
@@ -146,10 +145,8 @@ __releases(&tve->lock)
 static void tve_enable(struct imx_tve *tve)
 {
-        unsigned long flags;
        int ret;
-        spin_lock_irqsave(&tve->enable_lock, flags);
        if (!tve->enabled) {
                tve->enabled = true;
                clk_prepare_enable(tve->clk);
@@ -169,23 +166,18 @@ static void tve_enable(struct imx_tve *tve)
                             TVE_CD_SM_IEN |
                             TVE_CD_LM_IEN |
                             TVE_CD_MON_END_IEN);
-        spin_unlock_irqrestore(&tve->enable_lock, flags);
 }
 static void tve_disable(struct imx_tve *tve)
 {
-        unsigned long flags;
        int ret;
-        spin_lock_irqsave(&tve->enable_lock, flags);
        if (tve->enabled) {
                tve->enabled = false;
                ret = regmap_update_bits(tve->regmap, TVE_COM_CONF_REG,
                                         TVE_IPU_CLK_EN | TVE_EN, 0);
                clk_disable_unprepare(tve->clk);
        }
-        spin_unlock_irqrestore(&tve->enable_lock, flags);
 }
 static int tve_setup_tvout(struct imx_tve *tve)
@@ -601,7 +593,6 @@ static int imx_tve_probe(struct platform_device *pdev)
        tve->dev = &pdev->dev;
        spin_lock_init(&tve->lock);
-        spin_lock_init(&tve->enable_lock);
        ddc_node = of_parse_phandle(np, "ddc", 0);
        if (ddc_node) {
diff --git a/drivers/staging/imx-drm/ipu-v3/ipu-common.c b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
index 7a22ce619ed2..97ca6924dbb3 100644
--- a/drivers/staging/imx-drm/ipu-v3/ipu-common.c
+++ b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
@@ -996,35 +996,35 @@ static const struct ipu_platform_reg client_reg[] = {
        },
 };
+static DEFINE_MUTEX(ipu_client_id_mutex);
 static int ipu_client_id;
-static int ipu_add_subdevice_pdata(struct device *dev,
-                const struct ipu_platform_reg *reg)
-{
-        struct platform_device *pdev;
-        pdev = platform_device_register_data(dev, reg->name, ipu_client_id++,
-                        &reg->pdata, sizeof(struct ipu_platform_reg));
-        return PTR_ERR_OR_ZERO(pdev);
-}
 static int ipu_add_client_devices(struct ipu_soc *ipu)
 {
-        int ret;
+        struct device *dev = ipu->dev;
-        int i;
+        unsigned i;
+        int id, ret;
+        mutex_lock(&ipu_client_id_mutex);
+        id = ipu_client_id;
+        ipu_client_id += ARRAY_SIZE(client_reg);
+        mutex_unlock(&ipu_client_id_mutex);
        for (i = 0; i < ARRAY_SIZE(client_reg); i++) {
                const struct ipu_platform_reg *reg = &client_reg[i];
-                ret = ipu_add_subdevice_pdata(ipu->dev, reg);
+                struct platform_device *pdev;
-                if (ret)
+                pdev = platform_device_register_data(dev, reg->name,
+                        id++, &reg->pdata, sizeof(reg->pdata));
+                if (IS_ERR(pdev))
                        goto err_register;
        }
        return 0;
 err_register:
-        platform_device_unregister_children(to_platform_device(ipu->dev));
+        platform_device_unregister_children(to_platform_device(dev));
        return ret;
 }
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index d70e9119e906..00867190413c 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -465,6 +465,7 @@ int iscsit_del_np(struct iscsi_np *np)
                 */
                send_sig(SIGINT, np->np_thread, 1);
                kthread_stop(np->np_thread);
+                np->np_thread = NULL;
        }
        np->np_transport->iscsit_free_np(np);
@@ -823,24 +824,22 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
        if (((hdr->flags & ISCSI_FLAG_CMD_READ) ||
             (hdr->flags & ISCSI_FLAG_CMD_WRITE)) && !hdr->data_length) {
                /*
-                 * Vmware ESX v3.0 uses a modified Cisco Initiator (v3.4.2)
+                 * From RFC-3720 Section 10.3.1:
-                 * that adds support for RESERVE/RELEASE.  There is a bug
+                 *
-                 * add with this new functionality that sets R/W bits when
+                 * "Either or both of R and W MAY be 1 when either the
-                 * neither CDB carries any READ or WRITE datapayloads.
+                 *  Expected Data Transfer Length and/or Bidirectional Read
+                 *  Expected Data Transfer Length are 0"
+                 *
+                 * For this case, go ahead and clear the unnecssary bits
+                 * to avoid any confusion with ->data_direction.
                 */
-                if ((hdr->cdb[0] == 0x16) || (hdr->cdb[0] == 0x17)) {
+                hdr->flags &= ~ISCSI_FLAG_CMD_READ;
-                        hdr->flags &= ~ISCSI_FLAG_CMD_READ;
+                hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
-                        hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
-                        goto done;
-                }
-                pr_err("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
+                pr_warn("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
                        " set when Expected Data Transfer Length is 0 for"
-                        " CDB: 0x%02x. Bad iSCSI Initiator.\n", hdr->cdb[0]);
+                        " CDB: 0x%02x, Fixing up flags\n", hdr->cdb[0]);
-                return iscsit_add_reject_cmd(cmd,
-                                             ISCSI_REASON_BOOKMARK_INVALID, buf);
        }
-done:
        if (!(hdr->flags & ISCSI_FLAG_CMD_READ) &&
            !(hdr->flags & ISCSI_FLAG_CMD_WRITE) && (hdr->data_length != 0)) {
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index e3318edb233d..1c0088fe9e99 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -474,7 +474,8 @@ static ssize_t __iscsi_##prefix##_store_##name(				\
                                                                        \
        if (!capable(CAP_SYS_ADMIN))                                    \
                return -EPERM;                                          \
-                                                                        \
+        if (count >= sizeof(auth->name))                                \
+                return -EINVAL;                                         \
        snprintf(auth->name, sizeof(auth->name), "%s", page);           \
        if (!strncmp("NULL", auth->name, 4))                            \
                auth->naf_flags &= ~flags;                              \
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 4eb93b2b6473..e29279e6b577 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1403,11 +1403,6 @@ old_sess_out:
 out:
        stop = kthread_should_stop();
-        if (!stop && signal_pending(current)) {
-                spin_lock_bh(&np->np_thread_lock);
-                stop = (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN);
-                spin_unlock_bh(&np->np_thread_lock);
-        }
        /* Wait for another socket.. */
        if (!stop)
                return 1;
@@ -1415,7 +1410,6 @@ exit:
        iscsi_stop_login_thread_timer(np);
        spin_lock_bh(&np->np_thread_lock);
        np->np_thread_state = ISCSI_NP_THREAD_EXIT;
-        np->np_thread = NULL;
        spin_unlock_bh(&np->np_thread_lock);
        return 0;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 207b340498a3..d06de84b069b 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1106,6 +1106,11 @@ int se_dev_set_block_size(struct se_device *dev, u32 block_size)
        dev->dev_attrib.block_size = block_size;
        pr_debug("dev[%p]: SE Device block_size changed to %u\n",
                        dev, block_size);
+        if (dev->dev_attrib.max_bytes_per_io)
+                dev->dev_attrib.hw_max_sectors =
+                        dev->dev_attrib.max_bytes_per_io / block_size;
        return 0;
 }
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 0e34cda3271e..78241a53b555 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -66,9 +66,8 @@ static int fd_attach_hba(struct se_hba *hba, u32 host_id)
        pr_debug("CORE_HBA[%d] - TCM FILEIO HBA Driver %s on Generic"
                " Target Core Stack %s\n", hba->hba_id, FD_VERSION,
                TARGET_CORE_MOD_VERSION);
-        pr_debug("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic"
+        pr_debug("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic\n",
-                " MaxSectors: %u\n",
+                hba->hba_id, fd_host->fd_host_id);
-                hba->hba_id, fd_host->fd_host_id, FD_MAX_SECTORS);
        return 0;
 }
@@ -220,7 +219,8 @@ static int fd_configure_device(struct se_device *dev)
        }
        dev->dev_attrib.hw_block_size = fd_dev->fd_block_size;
-        dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
+        dev->dev_attrib.max_bytes_per_io = FD_MAX_BYTES;
+        dev->dev_attrib.hw_max_sectors = FD_MAX_BYTES / fd_dev->fd_block_size;
        dev->dev_attrib.hw_queue_depth = FD_MAX_DEVICE_QUEUE_DEPTH;
        if (fd_dev->fbd_flags & FDBD_HAS_BUFFERED_IO_WCE) {
diff --git a/drivers/target/target_core_file.h b/drivers/target/target_core_file.h
index 37ffc5bd2399..d7772c167685 100644
--- a/drivers/target/target_core_file.h
+++ b/drivers/target/target_core_file.h
@@ -7,7 +7,10 @@
 #define FD_DEVICE_QUEUE_DEPTH   32
 #define FD_MAX_DEVICE_QUEUE_DEPTH 128
 #define FD_BLOCKSIZE            512
-#define FD_MAX_SECTORS          2048
+/*
+ * Limited by the number of iovecs (2048) per vfs_[writev,readv] call
+ */
+#define FD_MAX_BYTES            8388608
 #define RRF_EMULATE_CDB         0x01
 #define RRF_GOT_LBA             0x02
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index f697f8baec54..2a573de19a9f 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -278,7 +278,6 @@ struct se_node_acl *core_tpg_check_initiator_node_acl(
        snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
        acl->se_tpg = tpg;
        acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX);
-        spin_lock_init(&acl->stats_lock);
        acl->dynamic_node_acl = 1;
        tpg->se_tpg_tfo->set_default_node_attributes(acl);
@@ -406,7 +405,6 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
        snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
        acl->se_tpg = tpg;
        acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX);
-        spin_lock_init(&acl->stats_lock);
        tpg->se_tpg_tfo->set_default_node_attributes(acl);
@@ -658,15 +656,9 @@ static int core_tpg_setup_virtual_lun0(struct se_portal_group *se_tpg)
        spin_lock_init(&lun->lun_sep_lock);
        init_completion(&lun->lun_ref_comp);
-        ret = percpu_ref_init(&lun->lun_ref, core_tpg_lun_ref_release);
-        if (ret < 0)
-                return ret;
        ret = core_tpg_post_addlun(se_tpg, lun, lun_access, dev);
-        if (ret < 0) {
+        if (ret < 0)
-                percpu_ref_cancel_init(&lun->lun_ref);
                return ret;
-        }
        return 0;
 }
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 268b62768f2b..34aacaaae14a 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -93,6 +93,7 @@ struct n_tty_data {
        size_t canon_head;
        size_t echo_head;
        size_t echo_commit;
+        size_t echo_mark;
        DECLARE_BITMAP(char_map, 256);
        /* private to n_tty_receive_overrun (single-threaded) */
@@ -336,6 +337,7 @@ static void reset_buffer_flags(struct n_tty_data *ldata)
 {
        ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
        ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
+        ldata->echo_mark = 0;
        ldata->line_start = 0;
        ldata->erasing = 0;
@@ -787,6 +789,7 @@ static void commit_echoes(struct tty_struct *tty)
        size_t head;
        head = ldata->echo_head;
+        ldata->echo_mark = head;
        old = ldata->echo_commit - ldata->echo_tail;
        /* Process committed echoes if the accumulated # of bytes
@@ -811,10 +814,11 @@ static void process_echoes(struct tty_struct *tty)
        size_t echoed;
        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
-            ldata->echo_commit == ldata->echo_tail)
+            ldata->echo_mark == ldata->echo_tail)
                return;
        mutex_lock(&ldata->output_lock);
+        ldata->echo_commit = ldata->echo_mark;
        echoed = __process_echoes(tty);
        mutex_unlock(&ldata->output_lock);
@@ -822,6 +826,7 @@ static void process_echoes(struct tty_struct *tty)
                tty->ops->flush_chars(tty);
 }
+/* NB: echo_mark and echo_head should be equivalent here */
 static void flush_echoes(struct tty_struct *tty)
 {
        struct n_tty_data *ldata = tty->disc_data;
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 4658e3e0ec42..06525f10e364 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -96,7 +96,8 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
        if (offset == UART_LCR) {
                int tries = 1000;
                while (tries--) {
-                        if (value == p->serial_in(p, UART_LCR))
+                        unsigned int lcr = p->serial_in(p, UART_LCR);
+                        if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
                                return;
                        dw8250_force_idle(p);
                        writeb(value, p->membase + (UART_LCR << p->regshift));
@@ -132,7 +133,8 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
        if (offset == UART_LCR) {
                int tries = 1000;
                while (tries--) {
-                        if (value == p->serial_in(p, UART_LCR))
+                        unsigned int lcr = p->serial_in(p, UART_LCR);
+                        if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
                                return;
                        dw8250_force_idle(p);
                        writel(value, p->membase + (UART_LCR << p->regshift));
@@ -455,6 +457,8 @@ MODULE_DEVICE_TABLE(of, dw8250_of_match);
 static const struct acpi_device_id dw8250_acpi_match[] = {
        { "INT33C4", 0 },
        { "INT33C5", 0 },
+        { "INT3434", 0 },
+        { "INT3435", 0 },
        { "80860F0A", 0 },
        { },
 };
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index e46e9f3f19b9..f619ad5b5eae 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -240,6 +240,7 @@ static irqreturn_t xuartps_isr(int irq, void *dev_id)
                                        continue;
                        }
+#ifdef SUPPORT_SYSRQ
                        /*
                         * uart_handle_sysrq_char() doesn't work if
                         * spinlocked, for some reason
@@ -253,6 +254,7 @@ static irqreturn_t xuartps_isr(int irq, void *dev_id)
                                }
                                spin_lock(&port->lock);
                        }
+#endif
                        port->icount.rx++;
diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
index 22fad8ad5ac2..d8a55e87877f 100644
--- a/drivers/tty/tty_ldsem.c
+++ b/drivers/tty/tty_ldsem.c
@@ -86,11 +86,21 @@ static inline long ldsem_atomic_update(long delta, struct ld_semaphore *sem)
        return atomic_long_add_return(delta, (atomic_long_t *)&sem->count);
 }
+/*
+ * ldsem_cmpxchg() updates @*old with the last-known sem->count value.
+ * Returns 1 if count was successfully changed; @*old will have @new value.
+ * Returns 0 if count was not changed; @*old will have most recent sem->count
+ */
 static inline int ldsem_cmpxchg(long *old, long new, struct ld_semaphore *sem)
 {
-        long tmp = *old;
+        long tmp = atomic_long_cmpxchg(&sem->count, *old, new);
-        *old = atomic_long_cmpxchg(&sem->count, *old, new);
+        if (tmp == *old) {
-        return *old == tmp;
+                *old = new;
+                return 1;
+        } else {
+                *old = tmp;
+                return 0;
+        }
 }
 /*
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 5d8981c5235e..6e73f8cd60e5 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -642,6 +642,10 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                        : CI_ROLE_GADGET;
        }
+        /* only update vbus status for peripheral */
+        if (ci->role == CI_ROLE_GADGET)
+                ci_handle_vbus_change(ci);
        ret = ci_role_start(ci, ci->role);
        if (ret) {
                dev_err(dev, "can't start %s role\n", ci_role(ci)->name);
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 59e6020ea753..526cd77563d8 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -88,7 +88,8 @@ static int host_start(struct ci_hdrc *ci)
        return ret;
 disable_reg:
-        regulator_disable(ci->platdata->reg_vbus);
+        if (ci->platdata->reg_vbus)
+                regulator_disable(ci->platdata->reg_vbus);
 put_hcd:
        usb_put_hcd(hcd);
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index b34c81969cba..69d20fbb38a2 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1795,9 +1795,6 @@ static int udc_start(struct ci_hdrc *ci)
        pm_runtime_no_callbacks(&ci->gadget.dev);
        pm_runtime_enable(&ci->gadget.dev);
-        /* Update ci->vbus_active */
-        ci_handle_vbus_change(ci);
        return retval;
 destroy_eps:
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 4d387596f3f0..0b23a8639311 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -854,13 +854,11 @@ static int wdm_manage_power(struct usb_interface *intf, int on)
 {
        /* need autopm_get/put here to ensure the usbcore sees the new value */
        int rv = usb_autopm_get_interface(intf);
-        if (rv < 0)
-                goto err;
        intf->needs_remote_wakeup = on;
-        usb_autopm_put_interface(intf);
+        if (!rv)
-err:
+                usb_autopm_put_interface(intf);
-        return rv;
+        return 0;
 }
 static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 74f9cf02da07..a49217ae3533 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -455,9 +455,6 @@ static int dwc3_probe(struct platform_device *pdev)
        if (IS_ERR(regs))
                return PTR_ERR(regs);
-        usb_phy_set_suspend(dwc->usb2_phy, 0);
-        usb_phy_set_suspend(dwc->usb3_phy, 0);
        spin_lock_init(&dwc->lock);
        platform_set_drvdata(pdev, dwc);
@@ -488,6 +485,9 @@ static int dwc3_probe(struct platform_device *pdev)
                goto err0;
        }
+        usb_phy_set_suspend(dwc->usb2_phy, 0);
+        usb_phy_set_suspend(dwc->usb3_phy, 0);
        ret = dwc3_event_buffers_setup(dwc);
        if (ret) {
                dev_err(dwc->dev, "failed to setup event buffers\n");
@@ -569,6 +569,8 @@ err2:
        dwc3_event_buffers_cleanup(dwc);
 err1:
+        usb_phy_set_suspend(dwc->usb2_phy, 1);
+        usb_phy_set_suspend(dwc->usb3_phy, 1);
        dwc3_core_exit(dwc);
 err0:
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 418444ebb1b8..8c356af79409 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -136,23 +136,27 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
        struct ohci_hcd *ohci;
        int retval;
        struct usb_hcd *hcd = NULL;
+        struct device *dev = &pdev->dev;
-        if (pdev->num_resources != 2) {
+        struct resource *res;
-                pr_debug("hcd probe: invalid num_resources");
+        int irq;
-                return -ENODEV;
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_dbg(dev, "hcd probe: missing memory resource\n");
+                return -ENXIO;
        }
-        if ((pdev->resource[0].flags != IORESOURCE_MEM)
+        irq = platform_get_irq(pdev, 0);
-                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+        if (irq < 0) {
-                pr_debug("hcd probe: invalid resource type\n");
+                dev_dbg(dev, "hcd probe: missing irq resource\n");
-                return -ENODEV;
+                return irq;
        }
        hcd = usb_create_hcd(driver, &pdev->dev, "at91");
        if (!hcd)
                return -ENOMEM;
-        hcd->rsrc_start = pdev->resource[0].start;
+        hcd->rsrc_start = res->start;
-        hcd->rsrc_len = resource_size(&pdev->resource[0]);
+        hcd->rsrc_len = resource_size(res);
        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
                pr_debug("request_mem_region failed\n");
@@ -199,7 +203,7 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
        ohci->num_ports = board->ports;
        at91_start_hc(pdev);
-        retval = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_SHARED);
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
        if (retval == 0)
                return retval;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index b8dffd59eb25..73f5208714a4 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -128,7 +128,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 * any other sleep) on Haswell machines with LPT and LPT-LP
                 * with the new Intel BIOS
                 */
-                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+                /* Limit the quirk to only known vendors, as this triggers
+                 * yet another BIOS bug on some other machines
+                 * https://bugzilla.kernel.org/show_bug.cgi?id=66171
+                 */
+                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
+                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
        }
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 08e2f39027ec..2b41c636a52a 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -19,8 +19,9 @@ config AB8500_USB
          in host mode, low speed.
 config FSL_USB2_OTG
-        bool "Freescale USB OTG Transceiver Driver"
+        tristate "Freescale USB OTG Transceiver Driver"
        depends on USB_EHCI_FSL && USB_FSL_USB2 && PM_RUNTIME
+        depends on USB
        select USB_OTG
        select USB_PHY
        help
@@ -29,6 +30,7 @@ config FSL_USB2_OTG
 config ISP1301_OMAP
        tristate "Philips ISP1301 with OMAP OTG"
        depends on I2C && ARCH_OMAP_OTG
+        depends on USB
        select USB_PHY
        help
          If you say yes here you get support for the Philips ISP1301
diff --git a/drivers/usb/phy/phy-tegra-usb.c b/drivers/usb/phy/phy-tegra-usb.c
index 82232acf1ab6..bbe4f8e6e8d7 100644
--- a/drivers/usb/phy/phy-tegra-usb.c
+++ b/drivers/usb/phy/phy-tegra-usb.c
@@ -876,7 +876,7 @@ static int utmi_phy_probe(struct tegra_usb_phy *tegra_phy,
        tegra_phy->pad_regs = devm_ioremap(&pdev->dev, res->start,
                resource_size(res));
-        if (!tegra_phy->regs) {
+        if (!tegra_phy->pad_regs) {
                dev_err(&pdev->dev, "Failed to remap UTMI Pad regs\n");
                return -ENOMEM;
        }
diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 30e8a61552d4..bad57ce77ba5 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -127,7 +127,8 @@ static inline int twl6030_writeb(struct twl6030_usb *twl, u8 module,
 static inline u8 twl6030_readb(struct twl6030_usb *twl, u8 module, u8 address)
 {
-        u8 data, ret = 0;
+        u8 data;
+        int ret;
        ret = twl_i2c_read_u8(module, &data, address);
        if (ret >= 0)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 496b7e39d5be..cc7a24154490 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb);
 #define ZTE_PRODUCT_MF628                       0x0015
 #define ZTE_PRODUCT_MF626                       0x0031
 #define ZTE_PRODUCT_MC2718                      0xffe8
+#define ZTE_PRODUCT_AC2726                      0xfff1
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -1453,6 +1454,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
        { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
        { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
diff --git a/drivers/usb/serial/zte_ev.c b/drivers/usb/serial/zte_ev.c
index fca4c752a4ed..eae2c873b39f 100644
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -281,8 +281,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x19d2, 0xfffd) },
        { USB_DEVICE(0x19d2, 0xfffc) },
        { USB_DEVICE(0x19d2, 0xfffb) },
-        /* AC2726, AC8710_V3 */
+        /* AC8710_V3 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfff1, 0xff, 0xff, 0xff) },
        { USB_DEVICE(0x19d2, 0xfff6) },
        { USB_DEVICE(0x19d2, 0xfff7) },
        { USB_DEVICE(0x19d2, 0xfff8) },
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 55ea73f7c70b..4c02e2b94103 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -350,17 +350,19 @@ static enum bp_state increase_reservation(unsigned long nr_pages)
                pfn = page_to_pfn(page);
-                set_phys_to_machine(pfn, frame_list[i]);
 #ifdef CONFIG_XEN_HAVE_PVMMU
-                /* Link back into the page tables if not highmem. */
+                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                if (xen_pv_domain() && !PageHighMem(page)) {
+                        set_phys_to_machine(pfn, frame_list[i]);
-                        int ret;
-                        ret = HYPERVISOR_update_va_mapping(
+                        /* Link back into the page tables if not highmem. */
-                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                        if (!PageHighMem(page)) {
-                                mfn_pte(frame_list[i], PAGE_KERNEL),
+                                int ret;
-                                0);
+                                ret = HYPERVISOR_update_va_mapping(
-                        BUG_ON(ret);
+                                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                                mfn_pte(frame_list[i], PAGE_KERNEL),
+                                                0);
+                                BUG_ON(ret);
+                        }
                }
 #endif
@@ -378,7 +380,6 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
        enum bp_state state = BP_DONE;
        unsigned long  pfn, i;
        struct page   *page;
-        struct page   *scratch_page;
        int ret;
        struct xen_memory_reservation reservation = {
                .address_bits = 0,
@@ -411,27 +412,29 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                scrub_page(page);
+#ifdef CONFIG_XEN_HAVE_PVMMU
                /*
                 * Ballooned out frames are effectively replaced with
                 * a scratch frame.  Ensure direct mappings and the
                 * p2m are consistent.
                 */
-                scratch_page = get_balloon_scratch_page();
-#ifdef CONFIG_XEN_HAVE_PVMMU
-                if (xen_pv_domain() && !PageHighMem(page)) {
-                        ret = HYPERVISOR_update_va_mapping(
-                                (unsigned long)__va(pfn << PAGE_SHIFT),
-                                pfn_pte(page_to_pfn(scratch_page),
-                                        PAGE_KERNEL_RO), 0);
-                        BUG_ON(ret);
-                }
-#endif
                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
                        unsigned long p;
+                        struct page   *scratch_page = get_balloon_scratch_page();
+                        if (!PageHighMem(page)) {
+                                ret = HYPERVISOR_update_va_mapping(
+                                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                                pfn_pte(page_to_pfn(scratch_page),
+                                                        PAGE_KERNEL_RO), 0);
+                                BUG_ON(ret);
+                        }
                        p = page_to_pfn(scratch_page);
                        __set_phys_to_machine(pfn, pfn_to_mfn(p));
+                        put_balloon_scratch_page();
                }
-                put_balloon_scratch_page();
+#endif
                balloon_append(pfn_to_page(pfn));
        }
@@ -627,15 +630,17 @@ static int __init balloon_init(void)
        if (!xen_domain())
                return -ENODEV;
-        for_each_online_cpu(cpu)
+        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-        {
+                for_each_online_cpu(cpu)
-                per_cpu(balloon_scratch_page, cpu) = alloc_page(GFP_KERNEL);
+                {
-                if (per_cpu(balloon_scratch_page, cpu) == NULL) {
+                        per_cpu(balloon_scratch_page, cpu) = alloc_page(GFP_KERNEL);
-                        pr_warn("Failed to allocate balloon_scratch_page for cpu %d\n", cpu);
+                        if (per_cpu(balloon_scratch_page, cpu) == NULL) {
-                        return -ENOMEM;
+                                pr_warn("Failed to allocate balloon_scratch_page for cpu %d\n", cpu);
+                                return -ENOMEM;
+                        }
                }
+                register_cpu_notifier(&balloon_cpu_notifier);
        }
-        register_cpu_notifier(&balloon_cpu_notifier);
        pr_info("Initialising balloon driver\n");
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 028387192b60..aa846a48f400 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1176,7 +1176,8 @@ static int gnttab_setup(void)
                gnttab_shared.addr = xen_remap(xen_hvm_resume_frames,
                                                PAGE_SIZE * max_nr_gframes);
                if (gnttab_shared.addr == NULL) {
-                        pr_warn("Failed to ioremap gnttab share frames!\n");
+                        pr_warn("Failed to ioremap gnttab share frames (addr=0x%08lx)!\n",
+                                        xen_hvm_resume_frames);
                        return -ENOMEM;
                }
        }
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 8e74590fa1bb..569a13b9e856 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -533,12 +533,17 @@ static void privcmd_close(struct vm_area_struct *vma)
 {
        struct page **pages = vma->vm_private_data;
        int numpgs = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        int rc;
        if (!xen_feature(XENFEAT_auto_translated_physmap) || !numpgs || !pages)
                return;
-        xen_unmap_domain_mfn_range(vma, numpgs, pages);
+        rc = xen_unmap_domain_mfn_range(vma, numpgs, pages);
-        free_xenballooned_pages(numpgs, pages);
+        if (rc == 0)
+                free_xenballooned_pages(numpgs, pages);
+        else
+                pr_crit("unable to unmap MFN range: leaking %d pages. rc=%d\n",
+                        numpgs, rc);
        kfree(pages);
 }